@serfab/cadre-core 0.12.0 → 1.0.0

package/dist/node-local-snapshot.js

@@ -6,7 +6,13 @@
  *  - the trusted-owner anchor (`trusted-owner-store.ts`),
  *  - the cold-start bootstrap-peer store (`bootstrap-peer-store.ts`).
  *
- * Both are the same mechanism with a different payload: a
+ * A THIRD node-local record — the enrolled-machine count
+ * (`enrolled-machine-store.ts`) — reuses {@link DurableSlot} but deliberately
+ * NOT this module's snapshot machinery: it is one scalar rather than an entry
+ * map, and it must cold-start rather than throw on an unreadable slot. Its
+ * module comment carries the reasoning; do not fold it in here.
+ *
+ * Both records here are the same mechanism with a different payload: a
  * `{ version, partyId, <entries> }` envelope, snapshot-written whole on every
  * change, loaded under one fail-safe-but-not-fail-silent policy. The only part
  * that differs per platform is WHERE the bytes are kept — Node writes a file,
@@ -41,9 +47,9 @@ export class NodeLocalSnapshot {
         this.spec = spec;
         this.entries = entries;
         /**
-         * Serialises persists: every {@link put} snapshot-writes the full entry set,
-         * so chaining writes keeps them ordered and the last landed snapshot
-         * complete.
+         * Serialises persists: every write ({@link put}, {@link remove}) snapshot-writes
+         * the full entry set, so chaining writes keeps them ordered and the last landed
+         * snapshot complete.
          */
         this.writeChain = Promise.resolve();
     }
@@ -69,14 +75,14 @@ export class NodeLocalSnapshot {
     has(key) {
         return this.entries.has(key);
     }
-    /** Fresh copy of the keys — a snapshot decoupled from later {@link put} calls. */
+    /** Fresh copy of the keys — a snapshot decoupled from later {@link put} / {@link remove} calls. */
     keySnapshot() {
         return new Set(this.entries.keys());
     }
     /**
      * Fresh copy of the `key -> entry` map — a snapshot decoupled from later
-     * {@link put} calls. The entries themselves need no copy: {@link put}
-     * REPLACES an entry rather than mutating it in place.
+     * {@link put} / {@link remove} calls. The entries themselves need no copy:
+     * {@link put} REPLACES an entry rather than mutating it in place.
      */
     entrySnapshot() {
         return new Map(this.entries);
@@ -86,12 +92,27 @@ export class NodeLocalSnapshot {
      * synchronous caller may consult the store the moment this returns), then
      * the full snapshot is persisted. A persist failure rejects the returned
      * promise but leaves the entry in memory — this session's decision stands,
-     * and any later successful {@link put} re-lands the complete set.
+     * and any later successful write re-lands the complete set.
      */
     put(key, entry) {
         this.entries.set(key, entry);
+        return this.queuePersist();
+    }
+    /**
+     * Remove an entry, with {@link put}'s contract: the in-memory map updates
+     * SYNCHRONOUSLY, then the full snapshot is persisted. Removing an absent key
+     * changes nothing, so it writes nothing.
+     */
+    remove(key) {
+        if (!this.entries.delete(key)) {
+            return Promise.resolve();
+        }
+        return this.queuePersist();
+    }
+    /** Chain a full-snapshot write behind every earlier one (see {@link put}). */
+    queuePersist() {
         const persist = this.writeChain.then(() => this.persistSnapshot());
-        // The chain itself must survive a failed persist (the next put retries the
+        // The chain itself must survive a failed persist (the next write retries the
         // full snapshot); the caller still observes the rejection via `persist`.
         this.writeChain = persist.catch((error) => {
             log('%s: persist failed for party %s: %o', this.spec.label, this.partyId, error);

package/dist/node-local-snapshot.js.map

@@ -1 +1 @@
-{"version":3,"file":"node-local-snapshot.js","sourceRoot":"","sources":["../src/node-local-snapshot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,MAAM,GAAG,GAAG,KAAK,CAAC,kCAAkC,CAAC,CAAC;AAyBtD,kFAAkF;AAClF,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAgC3B;;;;;;;;;;GAUG;AACH,MAAM,OAAO,iBAAiB;IAQ7B,YACkB,IAAiB,EACzB,OAAe,EACP,IAA8B,EAC9B,OAAuB;QAHvB,SAAI,GAAJ,IAAI,CAAa;QACzB,YAAO,GAAP,OAAO,CAAQ;QACP,SAAI,GAAJ,IAAI,CAA0B;QAC9B,YAAO,GAAP,OAAO,CAAgB;QAXzC;;;;WAIG;QACK,eAAU,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IAOnD,CAAC;IAEJ;;;;;;;;;;;;;;;OAeG;IACH,MAAM,CAAC,KAAK,CAAC,IAAI,CAChB,IAAiB,EACjB,OAAe,EACf,IAA8B;QAE9B,OAAO,IAAI,iBAAiB,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;IAC3F,CAAC;IAED,GAAG,CAAC,GAAW;QACd,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IAED,kFAAkF;IAClF,WAAW;QACV,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACrC,CAAC;IAED;;;;OAIG;IACH,aAAa;QACZ,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;;OAMG;IACH,GAAG,CAAC,GAAW,EAAE,KAAQ;QACxB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC;QACnE,2EAA2E;QAC3E,yEAAyE;QACzE,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YACzC,GAAG,CAAC,qCAAqC,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAClF,CAAC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,eAAe;QAC5B,MAAM,QAAQ,GAA4B;YACzC,OAAO,EAAE,gBAAgB;YACzB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC;SACxD,CAAC;QACF,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAC5D,CAAC;CACD;AAED,uGAAuG;AACvG,KAAK,UAAU,WAAW,CACzB,IAAiB,EACjB,OAAe,EACf,IAA8B;IAE9B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAa,CAAC;IACrC,IAAI,IAAwB,CAAC;IAC7B,IAAI,CAAC;QACJ,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,4EAA4E;QAC5E,4EAA4E;QAC5E,yEAAyE;QACzE,0EAA0E;QAC1E,4EAA4E;QAC5E,aAAa;QACb,MAAM,IAAI,KAAK,CACd,sBAAsB,IAAI,CAAC,KAAK,cAAc,OAAO,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAClH,EAAE,KAAK,EAAE,KAAK,EAAE,CAChB,CAAC;IACH,CAAC;IACD,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC;IAEvC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,GAAG,CAAC,gDAAgD,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QAClF,OAAO,OAAO,CAAC;IAChB,CAAC;IAED,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAClE,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,GAAG,CAAC,8EAA8E,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACzG,OAAO,OAAO,CAAC;IAChB,CAAC;IAED,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAClD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACzC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,aAAa,KAAK,aAAa,EAAE,CAAC;gBAC1C,GAAG,CAAC,4EAA4E,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;gBAC5G,OAAO,IAAI,GAAG,EAAE,CAAC;YAClB,CAAC;YACD,GAAG,CAAC,+CAA+C,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;YAC/E,SAAS;QACV,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACzB,CAAC;IACD,GAAG,CAAC,sCAAsC,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC/E,OAAO,OAAO,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CACvB,KAAc,EACd,OAAe,EACf,UAAkB;IAElB,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACvC,2EAA2E;IAC3E,oDAAoD;IACpD,IAAI,KAAK,CAAC,OAAO,KAAK,gBAAgB,IAAI,KAAK,CAAC,OAAO,KAAK,OAAO;QAAE,OAAO,SAAS,CAAC;IACtF,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC;IAClC,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAChD,CAAC;AAED;;;;;GAKG;AACH,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC"}
+{"version":3,"file":"node-local-snapshot.js","sourceRoot":"","sources":["../src/node-local-snapshot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,MAAM,GAAG,GAAG,KAAK,CAAC,kCAAkC,CAAC,CAAC;AA+BtD,kFAAkF;AAClF,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAgC3B;;;;;;;;;;GAUG;AACH,MAAM,OAAO,iBAAiB;IAQ7B,YACkB,IAAiB,EACzB,OAAe,EACP,IAA8B,EAC9B,OAAuB;QAHvB,SAAI,GAAJ,IAAI,CAAa;QACzB,YAAO,GAAP,OAAO,CAAQ;QACP,SAAI,GAAJ,IAAI,CAA0B;QAC9B,YAAO,GAAP,OAAO,CAAgB;QAXzC;;;;WAIG;QACK,eAAU,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IAOnD,CAAC;IAEJ;;;;;;;;;;;;;;;OAeG;IACH,MAAM,CAAC,KAAK,CAAC,IAAI,CAChB,IAAiB,EACjB,OAAe,EACf,IAA8B;QAE9B,OAAO,IAAI,iBAAiB,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;IAC3F,CAAC;IAED,GAAG,CAAC,GAAW;QACd,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IAED,mGAAmG;IACnG,WAAW;QACV,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACrC,CAAC;IAED;;;;OAIG;IACH,aAAa;QACZ,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;;OAMG;IACH,GAAG,CAAC,GAAW,EAAE,KAAQ;QACxB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC7B,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC;IAC5B,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,GAAW;QACjB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QAC1B,CAAC;QACD,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC;IAC5B,CAAC;IAED,8EAA8E;IACtE,YAAY;QACnB,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC;QACnE,6EAA6E;QAC7E,yEAAyE;QACzE,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YACzC,GAAG,CAAC,qCAAqC,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAClF,CAAC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,eAAe;QAC5B,MAAM,QAAQ,GAA4B;YACzC,OAAO,EAAE,gBAAgB;YACzB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC;SACxD,CAAC;QACF,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAC5D,CAAC;CACD;AAED,uGAAuG;AACvG,KAAK,UAAU,WAAW,CACzB,IAAiB,EACjB,OAAe,EACf,IAA8B;IAE9B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAa,CAAC;IACrC,IAAI,IAAwB,CAAC;IAC7B,IAAI,CAAC;QACJ,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,4EAA4E;QAC5E,4EAA4E;QAC5E,yEAAyE;QACzE,0EAA0E;QAC1E,4EAA4E;QAC5E,aAAa;QACb,MAAM,IAAI,KAAK,CACd,sBAAsB,IAAI,CAAC,KAAK,cAAc,OAAO,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAClH,EAAE,KAAK,EAAE,KAAK,EAAE,CAChB,CAAC;IACH,CAAC;IACD,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC;IAEvC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,GAAG,CAAC,gDAAgD,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QAClF,OAAO,OAAO,CAAC;IAChB,CAAC;IAED,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAClE,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,GAAG,CAAC,8EAA8E,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACzG,OAAO,OAAO,CAAC;IAChB,CAAC;IAED,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAClD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACzC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,aAAa,KAAK,aAAa,EAAE,CAAC;gBAC1C,GAAG,CAAC,4EAA4E,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;gBAC5G,OAAO,IAAI,GAAG,EAAE,CAAC;YAClB,CAAC;YACD,GAAG,CAAC,+CAA+C,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;YAC/E,SAAS;QACV,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACzB,CAAC;IACD,GAAG,CAAC,sCAAsC,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC/E,OAAO,OAAO,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CACvB,KAAc,EACd,OAAe,EACf,UAAkB;IAElB,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACvC,2EAA2E;IAC3E,oDAAoD;IACpD,IAAI,KAAK,CAAC,OAAO,KAAK,gBAAgB,IAAI,KAAK,CAAC,OAAO,KAAK,OAAO;QAAE,OAAO,SAAS,CAAC;IACtF,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC;IAClC,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAChD,CAAC;AAED;;;;;GAKG;AACH,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC"}

package/dist/peer-dial.d.ts

@@ -0,0 +1,143 @@
+/**
+ * Dialing one peer from a list of candidate addresses, so that an address that
+ * never answers cannot use up the time the others needed.
+ *
+ * libp2p's own multi-address dial (`libp2p.dial(addrs)`, libp2p 3.1.3's
+ * `DialQueue.dialPeer`) tries the addresses ONE AT A TIME under ONE signal, with
+ * no time limit per address. An address whose connection attempt is silently
+ * dropped — a firewall, a subnet the dialer cannot route to, a virtual adapter's
+ * address a Windows host reports alongside its real ones — holds that dial until
+ * the whole signal expires, and every address sorted after it is never tried. It
+ * also sorts the list itself (`defaultAddressSorter`), putting loopback addresses
+ * last, behind exactly the LAN addresses most likely to be dropped. A phone
+ * borrowing a node from a cadre-host whose only reachable address was the
+ * forwarded loopback one never connected for this reason.
+ *
+ * So the addresses are dialed here, each as its own `dial()` with its own time
+ * limit ({@link PeerDialBudget.perAddressMs}), inside a limit for the whole peer
+ * ({@link PeerDialBudget.totalMs}). One address per call also means libp2p's
+ * sorter has nothing to reorder, so the order is chosen here
+ * ({@link directBeforeRelayed}).
+ *
+ * Dependency-free apart from `control-stream.ts`, so any module may import it
+ * without creating an import cycle.
+ */
+import type { Connection } from '@libp2p/interface';
+import type { Multiaddr } from '@multiformats/multiaddr';
+/**
+ * Default limit on ONE address's dial attempt, in ms.
+ *
+ * It has to cover the slowest address that should succeed, because an attempt
+ * that needs longer fails the same way on every retry. That is a relayed dial on
+ * a mobile link: connect to the relay (transport, encryption and multiplexer
+ * handshakes, when no relay connection is open yet), open the circuit, then run
+ * both handshakes again end to end through the relay at roughly twice the
+ * round-trip time. At a few hundred ms per round trip that is several seconds.
+ * A direct dial that works is far quicker — a phone's WebSocket dial to a node
+ * forwarded over `adb reverse` measured 1.6 s end to end. 8 s covers the relayed
+ * case with some margin while still abandoning a silently dropped address
+ * sooner than libp2p's own 10 s dial timeout would.
+ *
+ * NOTE: a `/p2p-circuit/webrtc` address also negotiates a WebRTC session after
+ * the relay leg. If such dials are ever seen failing at exactly this limit, raise
+ * it (or `network.controlCohort.perAddressDialTimeoutMs` on the affected nodes)
+ * rather than the per-peer limit, which cannot help an address that is itself
+ * cut off.
+ *
+ * Override per node with `network.controlCohort.perAddressDialTimeoutMs`.
+ */
+export declare const DEFAULT_CONTROL_COHORT_PER_ADDRESS_DIAL_TIMEOUT_MS = 8000;
+/**
+ * Default limit on dialing ONE peer — every candidate address together — in ms.
+ *
+ * Without it, an offline peer costs (address count × up to
+ * {@link DEFAULT_CONTROL_COHORT_PER_ADDRESS_DIAL_TIMEOUT_MS}), a number that
+ * depends on how many addresses the peer happens to report. Callers dial peers
+ * one after another (the control-cohort reconcile pass dials each sibling in
+ * turn), so that cost also delays every later peer. With the limit, a reconcile
+ * pass costs at most (dialed siblings) × this.
+ *
+ * Sized to fit a typical list with dead addresses ahead of the one that works:
+ * a lent cadre-host node reports two to four addresses a phone can dial
+ * (loopback and LAN WebSocket addresses, plus any virtual adapters). Three
+ * silently dropped addresses cost 3 × 8 s = 24 s, leaving 6 s for the working
+ * address after them — well over the 1.6 s the phone measured. A peer whose
+ * working address sits behind four or more dropped ones does not fit, and fails
+ * each pass the same way; if that shows up, the remedy is ordering (try the
+ * address that last connected first), not a larger number here.
+ *
+ * Override per node with `network.controlCohort.dialTimeoutMs` — tests that
+ * drive dead addresses on purpose set it low so a pass's duration is a chosen
+ * number rather than a transitive libp2p default stretched by machine load.
+ */
+export declare const DEFAULT_CONTROL_COHORT_DIAL_TIMEOUT_MS = 30000;
+/** Time limits for dialing one peer from a list of candidate addresses. */
+export interface PeerDialBudget {
+    /** Limit on one address's attempt, in ms. */
+    perAddressMs: number;
+    /** Limit on the whole peer — every address together — in ms. */
+    totalMs: number;
+}
+/** {@link PeerDialBudget} built from the two defaults above. */
+export declare const DEFAULT_PEER_DIAL_BUDGET: Readonly<PeerDialBudget>;
+/** The slice of a libp2p node {@link dialPeerAddrs} uses. */
+export interface AddrDialer {
+    dial(addr: Multiaddr, options: {
+        signal: AbortSignal;
+    }): Promise<Connection>;
+}
+/**
+ * Dial one peer from `addrs`, one address per `dial()` call, and return the
+ * first connection that forms. Direct addresses are tried before relayed ones
+ * ({@link directBeforeRelayed}); otherwise the given order is kept.
+ *
+ * Addresses naming a transport this node lacks are not filtered out first: a
+ * one-address `dial()` rejects those at once (`NoValidAddressesError`), so they
+ * cost a log line, not time.
+ *
+ * Throws when no address connects — see {@link tryAddrsInTurn} for the error.
+ *
+ * @param label Names the dial in timeout messages and logs, e.g.
+ *   `reconcileControlCohort dial of sibling <peerId>`; each attempt reads
+ *   `<label> via <addr>`.
+ */
+export declare function dialPeerAddrs(dialer: AddrDialer, addrs: readonly Multiaddr[], budget: PeerDialBudget, label: string): Promise<Connection>;
+/**
+ * Run `attempt` against each address in the given order until one succeeds, and
+ * return its result.
+ *
+ * Each attempt is limited to `budget.perAddressMs`, or to whatever remains of
+ * `budget.totalMs` when that is less. The attempt's signal is aborted when its
+ * limit passes, so a dial in progress is cancelled rather than left running.
+ * Addresses the total leaves no time for are reported as not tried.
+ *
+ * Throws when every address fails. With one address the error is that attempt's
+ * own, unchanged. With several it is one error naming each address and why it
+ * failed, in order, with the first failure as `cause` — so the report shows the
+ * address that mattered, not only whichever happened to be tried last.
+ *
+ * Between attempts this waits for one macrotask (`setTimeout(0)`). libp2p's dial
+ * queue lets a new `dial()` join any queued dial job for the same peer id
+ * WITHOUT checking whether that job has already finished, and an aborted job
+ * leaves the queue a few microtasks after its callers are rejected. Timing out
+ * one address and immediately dialing the next for the same peer therefore
+ * joins the dying job, which rejects the new dial with `AbortError` before it
+ * touches the network — the next address is never tried. Seen against libp2p
+ * 3.1.3; `test/peer-dial.spec.ts` dials real nodes so an upgrade that changes it
+ * shows up there. All of the queue's cleanup runs as microtasks, so it has
+ * finished by the time a macrotask runs.
+ */
+export declare function tryAddrsInTurn<T>(addrs: readonly Multiaddr[], budget: PeerDialBudget, label: string, attempt: (addr: Multiaddr, signal: AbortSignal, attemptMs: number) => Promise<T>): Promise<T>;
+/**
+ * `addrs` with every circuit-relay address (one containing `/p2p-circuit`) moved
+ * after every direct one, each group keeping its given order.
+ *
+ * The one part of libp2p's own ordering worth keeping: a relayed connection is
+ * slower and limited in how much data and time it may carry, so a direct
+ * address is always worth trying first. libp2p's other rules are deliberately
+ * dropped — it puts loopback addresses last and public ones before private ones,
+ * which is how a forwarded loopback address ended up behind addresses that
+ * never answer. With a per-address limit, trying a dead address first costs a
+ * bounded amount of time, so the caller's order is the better guide.
+ */
+export declare function directBeforeRelayed(addrs: readonly Multiaddr[]): Multiaddr[];

package/dist/peer-dial.js

@@ -0,0 +1,176 @@
+/**
+ * Dialing one peer from a list of candidate addresses, so that an address that
+ * never answers cannot use up the time the others needed.
+ *
+ * libp2p's own multi-address dial (`libp2p.dial(addrs)`, libp2p 3.1.3's
+ * `DialQueue.dialPeer`) tries the addresses ONE AT A TIME under ONE signal, with
+ * no time limit per address. An address whose connection attempt is silently
+ * dropped — a firewall, a subnet the dialer cannot route to, a virtual adapter's
+ * address a Windows host reports alongside its real ones — holds that dial until
+ * the whole signal expires, and every address sorted after it is never tried. It
+ * also sorts the list itself (`defaultAddressSorter`), putting loopback addresses
+ * last, behind exactly the LAN addresses most likely to be dropped. A phone
+ * borrowing a node from a cadre-host whose only reachable address was the
+ * forwarded loopback one never connected for this reason.
+ *
+ * So the addresses are dialed here, each as its own `dial()` with its own time
+ * limit ({@link PeerDialBudget.perAddressMs}), inside a limit for the whole peer
+ * ({@link PeerDialBudget.totalMs}). One address per call also means libp2p's
+ * sorter has nothing to reorder, so the order is chosen here
+ * ({@link directBeforeRelayed}).
+ *
+ * Dependency-free apart from `control-stream.ts`, so any module may import it
+ * without creating an import cycle.
+ */
+import debug from 'debug';
+import { withDeadline } from './control-stream.js';
+const log = debug('sereus:cadre:peer-dial');
+/**
+ * Default limit on ONE address's dial attempt, in ms.
+ *
+ * It has to cover the slowest address that should succeed, because an attempt
+ * that needs longer fails the same way on every retry. That is a relayed dial on
+ * a mobile link: connect to the relay (transport, encryption and multiplexer
+ * handshakes, when no relay connection is open yet), open the circuit, then run
+ * both handshakes again end to end through the relay at roughly twice the
+ * round-trip time. At a few hundred ms per round trip that is several seconds.
+ * A direct dial that works is far quicker — a phone's WebSocket dial to a node
+ * forwarded over `adb reverse` measured 1.6 s end to end. 8 s covers the relayed
+ * case with some margin while still abandoning a silently dropped address
+ * sooner than libp2p's own 10 s dial timeout would.
+ *
+ * NOTE: a `/p2p-circuit/webrtc` address also negotiates a WebRTC session after
+ * the relay leg. If such dials are ever seen failing at exactly this limit, raise
+ * it (or `network.controlCohort.perAddressDialTimeoutMs` on the affected nodes)
+ * rather than the per-peer limit, which cannot help an address that is itself
+ * cut off.
+ *
+ * Override per node with `network.controlCohort.perAddressDialTimeoutMs`.
+ */
+export const DEFAULT_CONTROL_COHORT_PER_ADDRESS_DIAL_TIMEOUT_MS = 8000;
+/**
+ * Default limit on dialing ONE peer — every candidate address together — in ms.
+ *
+ * Without it, an offline peer costs (address count × up to
+ * {@link DEFAULT_CONTROL_COHORT_PER_ADDRESS_DIAL_TIMEOUT_MS}), a number that
+ * depends on how many addresses the peer happens to report. Callers dial peers
+ * one after another (the control-cohort reconcile pass dials each sibling in
+ * turn), so that cost also delays every later peer. With the limit, a reconcile
+ * pass costs at most (dialed siblings) × this.
+ *
+ * Sized to fit a typical list with dead addresses ahead of the one that works:
+ * a lent cadre-host node reports two to four addresses a phone can dial
+ * (loopback and LAN WebSocket addresses, plus any virtual adapters). Three
+ * silently dropped addresses cost 3 × 8 s = 24 s, leaving 6 s for the working
+ * address after them — well over the 1.6 s the phone measured. A peer whose
+ * working address sits behind four or more dropped ones does not fit, and fails
+ * each pass the same way; if that shows up, the remedy is ordering (try the
+ * address that last connected first), not a larger number here.
+ *
+ * Override per node with `network.controlCohort.dialTimeoutMs` — tests that
+ * drive dead addresses on purpose set it low so a pass's duration is a chosen
+ * number rather than a transitive libp2p default stretched by machine load.
+ */
+export const DEFAULT_CONTROL_COHORT_DIAL_TIMEOUT_MS = 30000;
+/** {@link PeerDialBudget} built from the two defaults above. */
+export const DEFAULT_PEER_DIAL_BUDGET = {
+    perAddressMs: DEFAULT_CONTROL_COHORT_PER_ADDRESS_DIAL_TIMEOUT_MS,
+    totalMs: DEFAULT_CONTROL_COHORT_DIAL_TIMEOUT_MS,
+};
+/**
+ * Dial one peer from `addrs`, one address per `dial()` call, and return the
+ * first connection that forms. Direct addresses are tried before relayed ones
+ * ({@link directBeforeRelayed}); otherwise the given order is kept.
+ *
+ * Addresses naming a transport this node lacks are not filtered out first: a
+ * one-address `dial()` rejects those at once (`NoValidAddressesError`), so they
+ * cost a log line, not time.
+ *
+ * Throws when no address connects — see {@link tryAddrsInTurn} for the error.
+ *
+ * @param label Names the dial in timeout messages and logs, e.g.
+ *   `reconcileControlCohort dial of sibling <peerId>`; each attempt reads
+ *   `<label> via <addr>`.
+ */
+export function dialPeerAddrs(dialer, addrs, budget, label) {
+    return tryAddrsInTurn(directBeforeRelayed(addrs), budget, label, (addr, signal) => dialer.dial(addr, { signal }));
+}
+/**
+ * Run `attempt` against each address in the given order until one succeeds, and
+ * return its result.
+ *
+ * Each attempt is limited to `budget.perAddressMs`, or to whatever remains of
+ * `budget.totalMs` when that is less. The attempt's signal is aborted when its
+ * limit passes, so a dial in progress is cancelled rather than left running.
+ * Addresses the total leaves no time for are reported as not tried.
+ *
+ * Throws when every address fails. With one address the error is that attempt's
+ * own, unchanged. With several it is one error naming each address and why it
+ * failed, in order, with the first failure as `cause` — so the report shows the
+ * address that mattered, not only whichever happened to be tried last.
+ *
+ * Between attempts this waits for one macrotask (`setTimeout(0)`). libp2p's dial
+ * queue lets a new `dial()` join any queued dial job for the same peer id
+ * WITHOUT checking whether that job has already finished, and an aborted job
+ * leaves the queue a few microtasks after its callers are rejected. Timing out
+ * one address and immediately dialing the next for the same peer therefore
+ * joins the dying job, which rejects the new dial with `AbortError` before it
+ * touches the network — the next address is never tried. Seen against libp2p
+ * 3.1.3; `test/peer-dial.spec.ts` dials real nodes so an upgrade that changes it
+ * shows up there. All of the queue's cleanup runs as microtasks, so it has
+ * finished by the time a macrotask runs.
+ */
+export async function tryAddrsInTurn(addrs, budget, label, attempt) {
+    const deadline = Date.now() + budget.totalMs;
+    const failures = [];
+    for (const addr of addrs) {
+        const remaining = deadline - Date.now();
+        if (remaining <= 0) {
+            failures.push({ addr, error: new Error(`not tried — the ${budget.totalMs}ms budget for ${label} was spent on earlier addresses`) });
+            continue;
+        }
+        if (failures.length > 0) {
+            await nextMacrotask();
+        }
+        const attemptMs = Math.min(budget.perAddressMs, remaining);
+        try {
+            return await withDeadline(attemptMs, `${label} via ${addr.toString()}`, (signal) => attempt(addr, signal, attemptMs));
+        }
+        catch (err) {
+            const error = err instanceof Error ? err : new Error(String(err));
+            failures.push({ addr, error });
+            log('%s via %s failed: %o', label, addr.toString(), error);
+        }
+    }
+    throw allAttemptsFailed(label, failures);
+}
+/**
+ * `addrs` with every circuit-relay address (one containing `/p2p-circuit`) moved
+ * after every direct one, each group keeping its given order.
+ *
+ * The one part of libp2p's own ordering worth keeping: a relayed connection is
+ * slower and limited in how much data and time it may carry, so a direct
+ * address is always worth trying first. libp2p's other rules are deliberately
+ * dropped — it puts loopback addresses last and public ones before private ones,
+ * which is how a forwarded loopback address ended up behind addresses that
+ * never answer. With a per-address limit, trying a dead address first costs a
+ * bounded amount of time, so the caller's order is the better guide.
+ */
+export function directBeforeRelayed(addrs) {
+    const relayed = (addr) => addr.getComponents().some((c) => c.name === 'p2p-circuit');
+    return [...addrs.filter((addr) => !relayed(addr)), ...addrs.filter(relayed)];
+}
+function allAttemptsFailed(label, failures) {
+    if (failures.length === 0) {
+        return new Error(`${label}: no candidate addresses`);
+    }
+    if (failures.length === 1) {
+        return failures[0].error;
+    }
+    const detail = failures.map((f) => `${f.addr.toString()} — ${f.error.message}`).join('; ');
+    return new Error(`${label} failed for all ${failures.length} candidate addresses: ${detail}`, { cause: failures[0].error });
+}
+function nextMacrotask() {
+    return new Promise((resolve) => setTimeout(resolve, 0));
+}
+//# sourceMappingURL=peer-dial.js.map

package/dist/peer-dial.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"peer-dial.js","sourceRoot":"","sources":["../src/peer-dial.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAG1B,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,MAAM,GAAG,GAAG,KAAK,CAAC,wBAAwB,CAAC,CAAC;AAE5C;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,kDAAkD,GAAG,IAAK,CAAC;AAExE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,KAAM,CAAC;AAU7D,gEAAgE;AAChE,MAAM,CAAC,MAAM,wBAAwB,GAA6B;IACjE,YAAY,EAAE,kDAAkD;IAChE,OAAO,EAAE,sCAAsC;CAC/C,CAAC;AAaF;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,aAAa,CAC5B,MAAkB,EAClB,KAA2B,EAC3B,MAAsB,EACtB,KAAa;IAEb,OAAO,cAAc,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;AACnH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CACnC,KAA2B,EAC3B,MAAsB,EACtB,KAAa,EACb,OAAgF;IAEhF,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC;IAC7C,MAAM,QAAQ,GAAyB,EAAE,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,SAAS,GAAG,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACxC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;YACpB,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,mBAAmB,MAAM,CAAC,OAAO,iBAAiB,KAAK,iCAAiC,CAAC,EAAE,CAAC,CAAC;YACpI,SAAS;QACV,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,aAAa,EAAE,CAAC;QACvB,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QAC3D,IAAI,CAAC;YACJ,OAAO,MAAM,YAAY,CAAC,SAAS,EAAE,GAAG,KAAK,QAAQ,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;QACvH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAClE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAC/B,GAAG,CAAC,sBAAsB,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,KAAK,CAAC,CAAC;QAC5D,CAAC;IACF,CAAC;IACD,MAAM,iBAAiB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAA2B;IAC9D,MAAM,OAAO,GAAG,CAAC,IAAe,EAAW,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC;IACzG,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa,EAAE,QAA8B;IACvE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,IAAI,KAAK,CAAC,GAAG,KAAK,0BAA0B,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC1B,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3F,OAAO,IAAI,KAAK,CAAC,GAAG,KAAK,mBAAmB,QAAQ,CAAC,MAAM,yBAAyB,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;AAC7H,CAAC;AAED,SAAS,aAAa;IACrB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;AACzD,CAAC"}

package/dist/{strand-backfill.d.ts → peer-join-backfill.d.ts}

@@ -8,8 +8,8 @@ import { BlockTransferClient, type IRawStorage } from '@optimystic/db-p2p';
  * changes it or starts exporting it.
  */
 export declare const MAX_BLOCK_MESSAGE_BYTES: number;
-/** Tuning for the per-peer strand catch-up. Every field optional; defaults in {@link DEFAULT_STRAND_BACKFILL}. */
-export interface StrandBackfillConfig {
+/** Tuning for the per-peer catch-up. Every field optional; defaults in {@link DEFAULT_PEER_JOIN_BACKFILL}. */
+export interface PeerJoinBackfillConfig {
     /** Default true. False disables the catch-up entirely (the pre-existing behaviour). */
     enabled?: boolean;
     /** Settle time after a connection opens before catching that peer up, ms. Default 1000. */
@@ -25,32 +25,39 @@ export interface StrandBackfillConfig {
     /** Per-push response deadline, ms. Default 10_000 (matches SpreadOnChurnMonitor). */
     responseTimeoutMs?: number;
 }
-/** The resolved defaults every {@link StrandBackfill} starts from. */
-export declare const DEFAULT_STRAND_BACKFILL: Required<StrandBackfillConfig>;
+/** The resolved defaults every {@link PeerJoinBackfill} starts from. */
+export declare const DEFAULT_PEER_JOIN_BACKFILL: Required<PeerJoinBackfillConfig>;
 /**
  * The one capability the catch-up needs from a transfer client. Structural (rather than
  * the concrete `BlockTransferClient`) so unit tests can capture pushes without dialing
- * libp2p — see {@link StrandBackfillDeps.createPushClient}.
+ * libp2p — see {@link PeerJoinBackfillDeps.createPushClient}.
  */
-export type StrandBackfillPushClient = Pick<BlockTransferClient, 'pushBlocks'>;
-export interface StrandBackfillDeps {
-    strandId: string;
-    /** The STRAND's libp2p node (not the control node) — source of connection events and peer ids. */
+export type PeerJoinBackfillPushClient = Pick<BlockTransferClient, 'pushBlocks'>;
+export interface PeerJoinBackfillDeps {
+    /** Log tag naming which network this catch-up serves (a strand id, or `control-<partyId>`). */
+    label: string;
+    /** The libp2p node of the network being caught up — source of connection events and peer ids. */
     libp2p: Libp2p;
     /** `node.keyNetwork`, the IPeerNetwork BlockTransferClient dials through. */
     peerNetwork: IPeerNetwork;
-    /** This strand's own raw block store — the same instance handed to the libp2p node. */
+    /** This network's own raw block store — the same instance handed to the libp2p node. */
     storage: IRawStorage;
-    /** Must equal the prefix the receiver registered its handler under: `/optimystic/strand-<strandId>`. */
+    /** Must equal the prefix the receiver registered its handler under: `/optimystic/<networkName>`. */
     protocolPrefix: string;
+    /**
+     * Membership gate, consulted at PUSH time (fails closed on a throw). Absent = push to
+     * every connected peer — correct for strand networks, NEVER for the control network;
+     * see the module comment for why the strand no-gate argument does not carry over.
+     */
+    authorizePeer?: (peerId: string) => Promise<boolean>;
     /**
      * Test seam: build the per-peer push client. Defaults to a real
      * `BlockTransferClient` over {@link peerNetwork} + {@link protocolPrefix}.
      */
-    createPushClient?: (peerId: PeerId) => StrandBackfillPushClient;
+    createPushClient?: (peerId: PeerId) => PeerJoinBackfillPushClient;
 }
 /** What one peer's catch-up actually did. Returned for tests and logged at the end of each run. */
-export interface StrandBackfillResult {
+export interface PeerJoinBackfillResult {
     /** Blocks offered: had a committed `latest` AND materialized content locally. */
     offered: number;
     /** Blocks the remote reported it persisted. */
@@ -65,19 +72,21 @@ export interface StrandBackfillResult {
     capped: number;
     /** Skipped: a single block whose wire size alone exceeds {@link MAX_BLOCK_MESSAGE_BYTES}. */
     oversized: string[];
+    /** True when the `authorizePeer` gate refused (or threw) — nothing was pushed, peer not memoized. */
+    denied: boolean;
 }
 /**
- * Copies every block in one strand's own raw store to each peer its libp2p node connects
- * to, so a peer that joined the strand after blocks were committed still ends up holding
+ * Copies every block in one network's own raw store to each peer its libp2p node connects
+ * to, so a peer that joined the network after blocks were committed still ends up holding
  * them physically (the receiver persists each push via `saveReplicatedBlock`, which is
  * monotonic and idempotent — crossing pushes from both ends cannot regress a revision).
  *
- * Best-effort throughout: nothing here throws into a libp2p event handler or into
- * `buildStrandRuntime`; a failed chunk is logged and the run continues. A peer is marked
+ * Best-effort throughout: nothing here throws into a libp2p event handler or into a
+ * runtime bring-up; a failed chunk is logged and the run continues. A peer is marked
  * fully caught up ONLY after a run with no thrown chunk and an empty `missing` list, so
  * the next `connection:open` from a peer whose catch-up failed retries it.
  */
-export declare class StrandBackfill {
+export declare class PeerJoinBackfill {
     private readonly deps;
     private readonly config;
     private readonly createPushClient;
@@ -87,15 +96,35 @@ export declare class StrandBackfill {
     private readonly done;
     /** Peers with a catch-up currently running (suppresses concurrent duplicates). */
     private readonly inFlight;
+    /**
+     * Peers whose (re-)schedule arrived while their OWN run was in flight, replayed once
+     * that run finishes. Load-bearing for the gated path: the gate's authorization check is
+     * a control-database read, so the window between it and the run's end is wide enough for
+     * the very membership commit that would have authorized the peer to land inside it —
+     * dropping that schedule (rather than deferring it) leaves the denied peer waiting for a
+     * reconnect, which is exactly what the re-arm exists to avoid.
+     */
+    private readonly rearmAfterFlight;
     /** Pending per-peer debounce timers, cleared on stop. */
     private readonly timers;
     private readonly onConnectionOpen;
     private loggedNoListBlockIds;
-    constructor(deps: StrandBackfillDeps, config?: StrandBackfillConfig);
+    constructor(deps: PeerJoinBackfillDeps, config?: PeerJoinBackfillConfig);
     /** Subscribe to connection:open AND schedule a catch-up for peers already connected. */
     start(): void;
     /** Unsubscribe, clear timers; in-flight runs observe the stopped flag and bail. */
     stop(): void;
+    /**
+     * (Re-)schedule a debounced catch-up for every currently-connected peer not yet caught
+     * up. Idempotent and cheap (caught-up peers are skipped before any timer is set, and a
+     * peer whose run is in flight is deferred to the end of that run rather than dropped).
+     * Driven by {@link start}, and — on a gated network — by the embedder whenever
+     * membership changes, so a peer whose first pass was denied (connected before it was
+     * authorized: the production join order) is retried without waiting for a reconnect.
+     * Returns how many distinct peers were considered (for the start() log) — a peer holding
+     * several connections is one peer, and is scheduled once.
+     */
+    scheduleConnectedPeers(): number;
     /** Debounced entry point for connection churn: one run per peer per settle window. */
     private schedulePeer;
     /**
@@ -103,7 +132,7 @@ export declare class StrandBackfill {
      * all-zero result without pushing when the peer is already caught up, already being
      * caught up, or this backfill is stopped.
      */
-    catchUpPeer(peerId: PeerId): Promise<StrandBackfillResult>;
+    catchUpPeer(peerId: PeerId): Promise<PeerJoinBackfillResult>;
     /** The actual copy. `clean` = every chunk pushed and the remote persisted every block. */
     private runCatchUp;
 }