@serfab/cadre-core 1.7.0 → 1.9.0

package/dist/strand-fret-addrs.js

@@ -0,0 +1,108 @@
+/**
+ * Reading the signed address records a running strand node's FRET routing table holds,
+ * as per-peer addresses ready for that node's own address book (`peer-addr-book.ts`).
+ *
+ * Why a strand node needs this. libp2p's peerStore hides every address one hour after
+ * it was first observed (the `NOTE:` on `mergePeerAddrs`), and FRET does not re-apply
+ * the records it holds: it hands a record to the peerStore when a neighbour's snapshot
+ * delivers it or a saved table is imported, and the peerStore refuses a record whose
+ * sequence number it already has. So a strand node that has been up for more than an
+ * hour would have no address for a peer whose connection then drops, although FRET
+ * still holds that peer's record. `CadreNode.refreshStrandPeerAddrs` re-merges the
+ * records on every pass, which is what keeps another party's strand nodes dialable;
+ * own-party siblings are re-resolved separately, over the strand-addr RPC.
+ *
+ * How long a record is available here is FRET's rule, not this module's: while FRET
+ * holds the entry, and at most 14 days after the record was last confirmed (a peer
+ * connected at export time counts as confirmed then).
+ *
+ * Every record is opened and verified here rather than taken on FRET's word. A record
+ * is self-certifying, the table is reached through a structural type rather than an
+ * interface this package depends on, and the address book write is attributed from what
+ * the record proves, not from the id the table filed it under.
+ */
+import debug from 'debug';
+import { PeerRecord, RecordEnvelope } from '@libp2p/peer-record';
+import { peerIdFromPublicKey } from '@libp2p/peer-id';
+import { multiaddr } from '@multiformats/multiaddr';
+import { fromString as uint8ArrayFromString } from 'uint8arrays';
+import { withTrailingPeerId } from './peer-record.js';
+const log = debug('sereus:cadre:strand-fret-addrs');
+/**
+ * The addresses of every peer `host`'s FRET table holds a usable signed record for,
+ * `host` itself excluded. A node with no FRET service (a db-p2p build without it, a
+ * test double) reads as an empty table. One bad record never costs the others: it is
+ * counted in `rejected` and skipped.
+ *
+ * Throws only what `exportTable()` throws, which a caller treats like any other
+ * failure of a pass over a node that may be mid-teardown.
+ */
+export async function strandFretPeerAddrs(host) {
+    const result = { peers: new Map(), rejected: 0 };
+    const fret = host.services?.fret;
+    if (!isFretTableSource(fret)) {
+        return result;
+    }
+    const selfId = host.peerId.toString();
+    for (const entry of fret.exportTable().entries) {
+        if (entry.id === selfId || entry.addressRecord === undefined) {
+            continue;
+        }
+        const addrs = await verifiedRecordAddrs(entry.id, entry.addressRecord.envelope);
+        if (addrs === null) {
+            result.rejected++;
+        }
+        else if (addrs.length > 0) {
+            result.peers.set(entry.id, addrs);
+        }
+    }
+    return result;
+}
+function isFretTableSource(service) {
+    return typeof service === 'object' && service !== null
+        && typeof service.exportTable === 'function';
+}
+/**
+ * The addresses one record lists, bound to `peerId`; null when the record must not be
+ * used. `openAndCertify` proves only that the envelope's own key signed it, so the
+ * signer and the peer the payload describes are each held against `peerId` here:
+ * without that, any peer could sign a record rewriting another peer's addresses.
+ */
+async function verifiedRecordAddrs(peerId, envelope) {
+    try {
+        const opened = await RecordEnvelope.openAndCertify(uint8ArrayFromString(envelope, 'base64url'), PeerRecord.DOMAIN);
+        const record = PeerRecord.createFromProtobuf(opened.payload);
+        const signer = peerIdFromPublicKey(opened.publicKey).toString();
+        const subject = record.peerId.toString();
+        if (signer !== peerId || subject !== peerId) {
+            log('skipping the address record filed under %s: signed by %s about %s', peerId, signer, subject);
+            return null;
+        }
+        return bindToPeer(record.multiaddrs.map((addr) => addr.toString()), peerId);
+    }
+    catch (error) {
+        log('skipping the address record filed under %s: %o', peerId, error);
+        return null;
+    }
+}
+/**
+ * A record names its peer once, in `peerId`, so its addresses carry no trailing
+ * `/p2p/<peerId>` and a relay-only peer's circuit address ends at the relay hop
+ * (`…/p2p/<relay>/p2p-circuit`). Each is given the suffix that makes it a complete
+ * dial target; one already terminating in a different peer id does not reach this peer
+ * and is dropped.
+ *
+ * Takes strings because `@libp2p/peer-record` carries its own `@multiformats/multiaddr`
+ * copy, a structurally different type from the one `withTrailingPeerId` takes.
+ */
+function bindToPeer(addrs, peerId) {
+    const bound = [];
+    for (const addr of addrs) {
+        const withPeer = withTrailingPeerId(multiaddr(addr), peerId);
+        if (withPeer !== null) {
+            bound.push(withPeer);
+        }
+    }
+    return bound;
+}
+//# sourceMappingURL=strand-fret-addrs.js.map

package/dist/strand-fret-addrs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"strand-fret-addrs.js","sourceRoot":"","sources":["../src/strand-fret-addrs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAkB,MAAM,yBAAyB,CAAC;AACpE,OAAO,EAAE,UAAU,IAAI,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtD,MAAM,GAAG,GAAG,KAAK,CAAC,gCAAgC,CAAC,CAAC;AAoCpD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAkB;IAC1D,MAAM,MAAM,GAAkB,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IAChE,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC;IACjC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;IACtC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,EAAE,CAAC;QAC/C,IAAI,KAAK,CAAC,EAAE,KAAK,MAAM,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YAC7D,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QAChF,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,CAAC;aAAM,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAgB;IACzC,OAAO,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;WACjD,OAAQ,OAAqC,CAAC,WAAW,KAAK,UAAU,CAAC;AAChF,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,mBAAmB,CAAC,MAAc,EAAE,QAAgB;IACjE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,cAAc,CAAC,oBAAoB,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QACnH,MAAM,MAAM,GAAG,UAAU,CAAC,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,mBAAmB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE,CAAC;QAChE,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACzC,IAAI,MAAM,KAAK,MAAM,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;YAC5C,GAAG,CAAC,mEAAmE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;YAClG,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;IAC9E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,gDAAgD,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QACrE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,UAAU,CAAC,KAAe,EAAE,MAAc;IACjD,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,kBAAkB,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;QAC7D,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/strand-instance-manager.d.ts

@@ -1,7 +1,6 @@
 import type { PrivateKey } from '@libp2p/interface';
 import { type PeerJoinBackfillConfig } from './peer-join-backfill.js';
-import { type StrandPeerObservation } from './strand-peer-observer.js';
-import type { StrandPeerBookStore } from './strand-peer-book.js';
+import { type StrandNetworkStateStore } from './strand-network-state.js';
 import { type StrandRevocationEnforcementConfig } from './strand-revocation-enforcer.js';
 import { type PendingMembershipInviteSource, type StrandMembershipReconciliationConfig } from './strand-membership-reconciler.js';
 import { type StrandFirstSyncConfig } from './strand-first-sync-gate.js';
@@ -34,8 +33,15 @@ export declare function liveStrandStatus(instance: StrandInstance): 'active' | '
  */
 export interface StartStrandConfig {
     strandRow: StrandRow;
-    /** sApp configuration provided by the hosting application */
-    sAppConfig: SAppConfig;
+    /**
+     * sApp configuration provided by the hosting application. Absent for a **storage
+     * replica** — a strand this node stores and serves without the app installed
+     * (`CadreNodeConfig.hostUnclaimedStrands`): no schema signature check, no `App`
+     * schema, no `sAppInfo` on the instance, and the default latency hint. A replica is
+     * always a joiner; `StrandDatabase` refuses to found one. An app that later claims the
+     * strand upgrades the running replica in place ({@link StrandInstanceManager.attachSApp}).
+     */
+    sAppConfig?: SAppConfig;
     storage?: StorageConfig;
     network?: NetworkConfig;
     profile: NodeProfile;
@@ -203,25 +209,14 @@ export interface StartStrandConfig {
      */
     announceDelegateToRelay?: (strandId: string, relayAddr: string, delegatePeerId: string) => Promise<void>;
     /**
-     * Called when the strand's libp2p node identifies a STRAND peer — one whose
-     * identify result names this strand's block-transfer protocol, so never the
-     * circuit relay or a bootstrap node — with the addresses it is dialable at
-     * (`strand-peer-observer.ts`). Throttled per peer; must not throw. `CadreNode`
-     * wires it to the node-local strand peer book, which is what lets a restarted
-     * machine dial the peers it was talking to. Absent ⇒ nothing is observed.
-     * Retained with the launch config, so a hibernation wake re-arms it on the
-     * rebuilt node.
-     */
-    onStrandPeerIdentified?: (strandId: string, observation: StrandPeerObservation) => void;
-    /**
-     * The node-local strand peer book the book SWAP reads and writes
-     * (`strand-peer-book-swap.ts`): the strand node signs its own addresses with
-     * {@link privateKey}, exchanges signed entries with every strand peer it identifies,
-     * and files what verifies. Absent ⇒ no swap runs — a peer that dials this node's
-     * swap handler gets no answer. `CadreNode` passes its book store. Retained with the
-     * launch config, so a hibernation wake re-arms the swap on the rebuilt node.
-     */
-    strandPeerBook?: StrandPeerBookStore;
+     * The node-local strand network state (`strand-network-state.ts`): this strand's
+     * slice of it is handed to db-p2p as `persistence`, so the strand node saves its
+     * FRET routing table (with each peer's signed address record) on every connection
+     * and re-imports it when it is next built. Absent ⇒ nothing is saved and the node
+     * starts with an empty table. `CadreNode` passes its store. Retained with the launch
+     * config, so a hibernation wake rebuilds the node over the same state.
+     */
+    networkState?: StrandNetworkStateStore;
 }
 /**
  * Volatile inputs re-resolved when resuming a quiesced strand — the ones that can
@@ -281,23 +276,6 @@ export declare class StrandInstanceManager {
      * missed writes).
      */
     private backfills;
-    /**
-     * The per-strand peer-book observation writer (`strand-peer-observer.ts`), keyed
-     * by strand id. Same lifecycle rationale as {@link backfills}: started in
-     * `buildStrandRuntime` right after the libp2p node exists, stopped and dropped in
-     * `releaseRuntime`, so quiesce → resume re-arms it on the rebuilt node. Only
-     * present when the launch config supplied `onStrandPeerIdentified`.
-     */
-    private peerObservers;
-    /**
-     * Per-strand strand peer book SWAP driver ({@link StrandPeerBookSwap}) — the signed
-     * exchange of book entries between strand peers. Same lifetime as the peer-book
-     * observer above: armed in `buildStrandRuntime` right after the libp2p node exists
-     * (its protocol handler must be registered before an early peer dials it), stopped
-     * and dropped in `releaseRuntime`. Only present when the launch config supplied
-     * `strandPeerBook`.
-     */
-    private peerBookSwaps;
     /**
      * The per-strand revoked-peer enforcer (closed strands only), keyed by strand
      * id. Same lifecycle rationale as {@link backfills}: created in
@@ -364,6 +342,23 @@ export declare class StrandInstanceManager {
      * wake becomes the better trade.
      */
     private strandStorages;
+    /**
+     * The runtime build in flight per strand id (`buildStrandRuntime`, from `startStrand` or
+     * `resumeStrand`), present until it settles. The instance is tracked for the whole build,
+     * with its database not yet constructed or not yet initialized, so a caller that must act
+     * on the FINISHED runtime ({@link attachSApp}, {@link whenRuntimeBuilt}) waits on this instead. A failed build's
+     * rejection belongs to the call that started it.
+     */
+    private runtimeBuilds;
+    /**
+     * The latest resume or quiesce requested per strand id, present until it settles. Each one
+     * starts only once the one requested before it has settled, so a wake that lands during a
+     * quiesce rebuilds after it, and a quiesce requested during a rebuild releases what that
+     * rebuild finished. The WHOLE operation, not its entry in {@link runtimeBuilds}: that settles
+     * before a resume's own catch records `'error'`, so a joiner awaiting it could read a stale
+     * status.
+     */
+    private transitions;
     private stopping;
     constructor();
     /**
@@ -395,6 +390,18 @@ export declare class StrandInstanceManager {
      * hibernation wake never re-enters the embedder's provider.
      */
     startStrand(config: StartStrandConfig): Promise<StrandInstance>;
+    /** Hold `build` in {@link runtimeBuilds} until it settles, and settle as it does. */
+    private trackRuntimeBuild;
+    /**
+     * Wait until no runtime build of `strandId` is in flight. Never rejects: a failed build
+     * is reported by the call that started it, and the caller re-reads the instance after.
+     *
+     * NOTE: after a failed launch the re-read sees the instance gone only because
+     * `startStrand`'s catch deletes it synchronously, and its continuation is queued before
+     * this waiter's. If that cleanup ever awaits before `instances.delete`, a waiter can act
+     * on the dying record; move the cleanup inside the tracked promise then.
+     */
+    private settleRuntimeBuilds;
     /**
      * Build (or rebuild) the libp2p node + StrandDatabase for an instance and
      * attach them, transitioning it to `active`. Shared by `startStrand` (fresh
@@ -509,11 +516,26 @@ export declare class StrandInstanceManager {
      * Quiesce a strand: release its strand-network resources (stop the libp2p node,
      * close the StrandDatabase) while RETAINING the instance record — identity,
      * sAppInfo, keys, latency hint, metadata — and its launch config so it can be
-     * resumed later. Mechanically this is `stopStrand` minus the instance/config
-     * deletion. The caller sets the post-quiesce status (e.g. `hibernating`).
-     * No-ops when the strand is missing or already quiesced.
+     * resumed later, then mark it `hibernating`. Mechanically this is `stopStrand` minus
+     * the instance/config deletion. A tracked strand with no runtime left (a failed
+     * rebuild already released it) is only marked; an untracked one is left alone.
+     *
+     * Ordered with {@link resumeStrand} (see {@link transitions}): it starts once the resume
+     * or launch build before it has settled, so it releases a finished runtime, and the
+     * status write is its last step, so a resume requested meanwhile writes after it. A call
+     * made while another quiesce is the latest request joins it. A failed release leaves the
+     * status as it was and rejects.
      */
     quiesceStrand(strandId: string): Promise<void>;
+    /** Body of {@link quiesceStrand}. */
+    private runQuiesce;
+    /**
+     * Whether the latest runtime transition requested for `strandId` is a quiesce that has
+     * not finished. Its handles may still be attached and its status still live, but it is on
+     * its way to `hibernating`, so a caller that needs it up must {@link resumeStrand} it — the
+     * resume runs after the quiesce — rather than treat it as live.
+     */
+    isQuiescing(strandId: string): boolean;
     /**
      * Resume a previously-quiesced strand: rebuild its libp2p node + StrandDatabase
      * from the retained launch config and re-attach them, transitioning it back to
@@ -521,8 +543,22 @@ export declare class StrandInstanceManager {
      * launch (the cohort `bootstrapNodes` seed and the strand's `servingMachines`
      * count) and updates the retained config so a later resume reuses the latest
      * values. Returns the live instance unchanged if it is already running.
+     *
+     * Overlapping calls share one rebuild: a call made while a resume is the latest request
+     * for the strand — a wake landing during a check-in — joins it and settles exactly as it
+     * does, `'error'` status included. The joiner's own `overrides` are ignored; the first
+     * resume's seed wins, and both callers resolved the cohort seed moments apart. A call made
+     * while a quiesce is the latest request runs after that quiesce and rebuilds (see
+     * {@link transitions}), and one made while `startStrand` is still building waits for that
+     * build rather than starting a second.
      */
     resumeStrand(strandId: string, overrides?: ResumeStrandOverrides): Promise<StrandInstance>;
+    /** Record `transition` as the latest for `strandId` until it settles. */
+    private holdTransition;
+    /** Wait for the transition requested before this one. Never rejects: its failure belongs to its caller. */
+    private settleTransition;
+    /** Body of {@link resumeStrand}; at most one runs per strand at a time. */
+    private runResume;
     /**
      * Honor a founder request against an ALREADY-TRACKED strand — the seam that
      * closes the "whoever launches first decides whether the bootstrap runs" gap:
@@ -539,7 +575,8 @@ export declare class StrandInstanceManager {
      * - `'already-founder'` — the retained config already founds; nothing to do.
      * - `'bootstrapped'` — config flipped and the live database ran the bootstrap.
      * - `'needs-resume'` — config flipped, but the instance is quiesced (no live
-     *   database), so the bootstrap could not run here: the CALLER must wake the
+     *   database) or being quiesced (its database is closing), so the bootstrap could
+     *   not run here: the CALLER must wake the
      *   strand (`CadreNode.wakeStrand`, which owns the hibernation bookkeeping this
      *   manager does not) so the rebuild — which now founds — runs it.
      * @param resolvePartyKey - Asked for the party's own membership key when (and only
@@ -555,6 +592,39 @@ export declare class StrandInstanceManager {
      *   whose `'needs-resume'` wake fails owes the same withdrawal.
      */
     foundExistingStrand(strandId: string, resolvePartyKey?: () => Promise<string | undefined>): Promise<'already-founder' | 'bootstrapped' | 'needs-resume'>;
+    /**
+     * Give a tracked storage replica ({@link StartStrandConfig.sAppConfig} absent) the app's
+     * schema in place — the seam for an app on this machine claiming a strand this node was
+     * already hosting. No runtime rebuild: the libp2p node, its peer id and connections, the
+     * store and its warm cache all stay, and the new `App` tables read the blocks the replica
+     * already holds. Callers attach BEFORE {@link foundExistingStrand}: the founder bootstrap
+     * writes the sApp into `Strand.Header` and refuses a database that has none.
+     *
+     * A runtime build in flight (the replica's launch, or a hibernation wake) is waited out
+     * first, so the attach acts on the database that build produced. Then, in order: the
+     * schema signature is checked before anything changes; the retained launch config takes
+     * the sApp, so every later rebuild applies it through `composeStrand`; the live database —
+     * published, or still held by the first-sync gate — gets the schema; and only then does
+     * the instance record `sAppInfo` and the sApp's latency hint. A quiesced instance gets the
+     * config alone, and its next resume applies the schema.
+     *
+     * @returns `'already-attached'` when the instance already runs an sApp — a DIFFERENT one
+     *   is logged and left as it is, as a second claim of a claimed strand always has been —
+     *   else `'attached'`.
+     * @throws when the strand is not tracked (a caller bug, or a launch that failed while
+     *   this waited on it); when the schema signature is refused, having changed nothing; and
+     *   whatever the live apply throws (e.g. a quiesce closed the database mid-apply) — the
+     *   retained config then still carries the sApp and `sAppInfo` stays unset, so the next
+     *   claim retries the apply.
+     *
+     * NOTE: two claims of one replica racing each other both pass the `sAppInfo` check and
+     * apply concurrently; the loser of the declarative diff can reject, and its `addStrand`
+     * retry then resolves `'already-attached'`. Needs an app calling `addStrand` twice at once
+     * (or beside a watcher retry); if it is ever seen, chain attaches per strand id.
+     */
+    attachSApp(strandId: string, sAppConfig: SAppConfig, options?: {
+        requireSignedSchemas?: boolean;
+    }): Promise<'attached' | 'already-attached'>;
     /**
      * Whether `strandId` is launched but still waiting for its first sync — a joiner whose
      * runtime is up while its database is withheld (status `'syncing'`, or `'idle'` after
@@ -575,6 +645,14 @@ export declare class StrandInstanceManager {
     whenWritable(strandId: string, options?: {
         timeoutMs?: number;
     }): Promise<StrandInstance>;
+    /**
+     * The tracked instance once no runtime build of it is in flight, or `undefined` when none
+     * is tracked by then — never launched, or the launch waited on failed and dropped its
+     * record. For a caller about to hand a tracked instance to an app: until its build settles
+     * the instance is `'starting'` with no database, and a failed launch leaves no instance.
+     * Never rejects; a failed build is reported by the call that started it.
+     */
+    whenRuntimeBuilt(strandId: string): Promise<StrandInstance | undefined>;
     /**
      * Hand a launch's database to the app: set `instance.database`, retire the gate that
      * held it, release every {@link whenWritable} waiter, and — when the launch had already