@serfab/cadre-core 1.9.0 → 1.11.0

package/dist/peer-dial.js

@@ -2,12 +2,15 @@
  * Dialing one peer from a list of candidate addresses, so that an address that
  * never answers cannot use up the time the others needed.
  *
- * libp2p's own multi-address dial (`libp2p.dial(addrs)`, libp2p 3.1.3's
- * `DialQueue.dialPeer`) tries the addresses ONE AT A TIME under ONE signal, with
- * no time limit per address. An address whose connection attempt is silently
- * dropped — a firewall, a subnet the dialer cannot route to, a virtual adapter's
- * address a Windows host reports alongside its real ones — holds that dial until
- * the whole signal expires, and every address sorted after it is never tried. It
+ * libp2p's own multi-address dial (`libp2p.dial(addrs)`, `DialQueue.dialPeer`)
+ * tries the addresses ONE AT A TIME under ONE signal. Its only per-address limit
+ * is the connection manager's `addressDialTimeout` (libp2p 3.3+), which cadre
+ * sizes for a cold relayed open through two admission decisions
+ * (`optimysticDialLimits` in `link-budget.ts`: 39 s at the default declared
+ * link). An address whose connection attempt is silently dropped — a firewall, a
+ * subnet the dialer cannot route to, a virtual adapter's address a Windows host
+ * reports alongside its real ones — holds that dial for that long or until the
+ * whole signal expires, and the addresses sorted after it get what is left. It
  * also sorts the list itself (`defaultAddressSorter`), putting loopback addresses
  * last, behind exactly the LAN addresses most likely to be dropped. A phone
  * borrowing a node from a cadre-host whose only reachable address was the
@@ -29,17 +32,17 @@ import { relayedDialBudgetMs } from './link-budget.js';
 const log = debug('sereus:cadre:peer-dial');
 /**
  * Default limit on ONE address's dial attempt, in ms, at the DEFAULT declared link round trip:
- * `RELAYED_DIAL_ROUND_TRIPS` (4) x `DECLARED_LINK_ROUND_TRIP_MS` (3500 ms) plus the called
- * machine's `ADMISSION_DECISION_TIMEOUT_MS` (2000 ms) = 16 000 ms (`relayedDialBudgetMs`). It
- * was a fixed 8000 ms before it was derived.
+ * `RELAYED_DIAL_ROUND_TRIPS` (5) x `DECLARED_LINK_ROUND_TRIP_MS` (3500 ms) plus
+ * `DIAL_ADMISSION_DECISIONS` (2) x `ADMISSION_DECISION_TIMEOUT_MS` (2000 ms) = 21 500 ms
+ * (`relayedDialBudgetMs`). It was a fixed 8000 ms before it was derived.
  *
  * It has to cover the slowest address that should succeed, because an attempt
  * that needs longer fails the same way on every retry. That is a relayed dial on
  * a mobile link: connect to the relay (transport, encryption and multiplexer
  * handshakes, when no relay connection is open yet), open the circuit, then run
  * both handshakes again end to end through the relay. `link-budget.ts` is where that
- * reasoning is now a measured count instead of an estimate — four link round trips, measured at
- * 12 094 ms on a link whose round trip is 3 s — so the value MOVES with a host's
+ * reasoning is now a measured count instead of an estimate — five link round trips, measured at
+ * 15 113 ms on a link whose round trip is 3 s — so the value MOVES with a host's
  * `NetworkConfig.linkRoundTripMs` rather than pinning the band this node can reach to whatever
  * number was typed here. A direct dial that works is far quicker — a phone's WebSocket dial to
  * a node forwarded over `adb reverse` measured 1.6 s end to end.
@@ -162,9 +165,10 @@ export async function dialPeerAddrs(dialer, addrs, budget, label) {
  * one address and immediately dialing the next for the same peer therefore
  * joins the dying job, which rejects the new dial with `AbortError` before it
  * touches the network — the next address is never tried. Seen against libp2p
- * 3.1.3; `test/peer-dial.spec.ts` dials real nodes so an upgrade that changes it
- * shows up there. All of the queue's cleanup runs as microtasks, so it has
- * finished by the time a macrotask runs.
+ * 3.1.3, and the queue's join is unchanged in 3.3.11; `test/peer-dial.spec.ts`
+ * dials real nodes so an upgrade that changes it shows up there. All of the
+ * queue's cleanup runs as microtasks, so it has finished by the time a
+ * macrotask runs.
  */
 export async function tryAddrsInTurn(addrs, budget, label, attempt) {
     const deadline = Date.now() + budget.totalMs;

package/dist/peer-dial.js.map

@@ -1 +1 @@
-{"version":3,"file":"peer-dial.js","sourceRoot":"","sources":["../src/peer-dial.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEnD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAEvD,MAAM,GAAG,GAAG,KAAK,CAAC,wBAAwB,CAAC,CAAC;AAE5C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,MAAM,kDAAkD,GAAG,mBAAmB,EAAE,CAAC;AAExF;;;;GAIG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC;AAEtD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAClD,oCAAoC,GAAG,kDAAkD,CAAC;AAU3F,gEAAgE;AAChE,MAAM,CAAC,MAAM,wBAAwB,GAA6B;IACjE,YAAY,EAAE,kDAAkD;IAChE,OAAO,EAAE,sCAAsC;CAC/C,CAAC;AASF;;;;;;;;;GASG;AACH,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC5C,YAAY,KAAa;QACxB,KAAK,CAAC,GAAG,KAAK,iFAAiF,CAAC,CAAC;QACjG,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IAClC,CAAC;CACD;AAQD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAClC,MAAkB,EAClB,KAA2B,EAC3B,MAAsB,EACtB,KAAa;IAEb,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IAC1D,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,cAAc,CAAC,mBAAmB,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;AACtH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CACnC,KAA2B,EAC3B,MAAsB,EACtB,KAAa,EACb,OAAgF;IAEhF,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC;IAC7C,MAAM,QAAQ,GAAyB,EAAE,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,SAAS,GAAG,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACxC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;YACpB,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,mBAAmB,MAAM,CAAC,OAAO,iBAAiB,KAAK,iCAAiC,CAAC,EAAE,CAAC,CAAC;YACpI,SAAS;QACV,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,aAAa,EAAE,CAAC;QACvB,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QAC3D,IAAI,CAAC;YACJ,OAAO,MAAM,YAAY,CAAC,SAAS,EAAE,GAAG,KAAK,QAAQ,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;QACvH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAClE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAC/B,GAAG,CAAC,sBAAsB,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,KAAK,CAAC,CAAC;QAC5D,CAAC;IACF,CAAC;IACD,MAAM,iBAAiB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAA2B;IAC9D,MAAM,OAAO,GAAG,CAAC,IAAe,EAAW,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC;IACzG,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,yFAAyF;AACzF,SAAS,kBAAkB,CAAC,MAAkB,EAAE,KAA2B,EAAE,KAAa;IACzF,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;QAC5B,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YACzC,OAAO,IAAI,CAAC;QACb,CAAC;QACD,GAAG,CAAC,+CAA+C,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC7E,OAAO,KAAK,CAAC;IACd,CAAC,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,aAAa,CAAC,IAAe,EAAE,KAAa;IACpD,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;IACxC,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,aAAa,IAAI,SAAS,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;AACnH,CAAC;AAED;;;;;GAKG;AACH,SAAS,SAAS,CAAC,SAAgC,EAAE,IAAY;IAChE,IAAI,SAAS,EAAE,IAAI,KAAK,KAAK,IAAI,SAAS,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAChE,OAAO,KAAK,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;IACjC,IAAI,CAAC;QACJ,OAAO,gBAAgB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,KAAK,QAAQ,CAAC;IAClE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,GAAG,CAAC,+DAA+D,EAAE,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC3F,OAAO,KAAK,CAAC;IACd,CAAC;AACF,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa,EAAE,QAA8B;IACvE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,IAAI,KAAK,CAAC,GAAG,KAAK,0BAA0B,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC1B,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3F,OAAO,IAAI,KAAK,CAAC,GAAG,KAAK,mBAAmB,QAAQ,CAAC,MAAM,yBAAyB,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;AAC7H,CAAC;AAED,SAAS,aAAa;IACrB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;AACzD,CAAC"}
+{"version":3,"file":"peer-dial.js","sourceRoot":"","sources":["../src/peer-dial.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEnD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAEvD,MAAM,GAAG,GAAG,KAAK,CAAC,wBAAwB,CAAC,CAAC;AAE5C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,MAAM,kDAAkD,GAAG,mBAAmB,EAAE,CAAC;AAExF;;;;GAIG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC;AAEtD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAClD,oCAAoC,GAAG,kDAAkD,CAAC;AAU3F,gEAAgE;AAChE,MAAM,CAAC,MAAM,wBAAwB,GAA6B;IACjE,YAAY,EAAE,kDAAkD;IAChE,OAAO,EAAE,sCAAsC;CAC/C,CAAC;AASF;;;;;;;;;GASG;AACH,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC5C,YAAY,KAAa;QACxB,KAAK,CAAC,GAAG,KAAK,iFAAiF,CAAC,CAAC;QACjG,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IAClC,CAAC;CACD;AAQD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAClC,MAAkB,EAClB,KAA2B,EAC3B,MAAsB,EACtB,KAAa;IAEb,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IAC1D,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,cAAc,CAAC,mBAAmB,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;AACtH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CACnC,KAA2B,EAC3B,MAAsB,EACtB,KAAa,EACb,OAAgF;IAEhF,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC;IAC7C,MAAM,QAAQ,GAAyB,EAAE,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,SAAS,GAAG,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACxC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;YACpB,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,mBAAmB,MAAM,CAAC,OAAO,iBAAiB,KAAK,iCAAiC,CAAC,EAAE,CAAC,CAAC;YACpI,SAAS;QACV,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,aAAa,EAAE,CAAC;QACvB,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QAC3D,IAAI,CAAC;YACJ,OAAO,MAAM,YAAY,CAAC,SAAS,EAAE,GAAG,KAAK,QAAQ,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;QACvH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAClE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAC/B,GAAG,CAAC,sBAAsB,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,KAAK,CAAC,CAAC;QAC5D,CAAC;IACF,CAAC;IACD,MAAM,iBAAiB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAA2B;IAC9D,MAAM,OAAO,GAAG,CAAC,IAAe,EAAW,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC;IACzG,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,yFAAyF;AACzF,SAAS,kBAAkB,CAAC,MAAkB,EAAE,KAA2B,EAAE,KAAa;IACzF,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;QAC5B,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YACzC,OAAO,IAAI,CAAC;QACb,CAAC;QACD,GAAG,CAAC,+CAA+C,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC7E,OAAO,KAAK,CAAC;IACd,CAAC,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,aAAa,CAAC,IAAe,EAAE,KAAa;IACpD,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;IACxC,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,aAAa,IAAI,SAAS,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;AACnH,CAAC;AAED;;;;;GAKG;AACH,SAAS,SAAS,CAAC,SAAgC,EAAE,IAAY;IAChE,IAAI,SAAS,EAAE,IAAI,KAAK,KAAK,IAAI,SAAS,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAChE,OAAO,KAAK,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;IACjC,IAAI,CAAC;QACJ,OAAO,gBAAgB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,KAAK,QAAQ,CAAC;IAClE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,GAAG,CAAC,+DAA+D,EAAE,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC3F,OAAO,KAAK,CAAC;IACd,CAAC;AACF,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa,EAAE,QAA8B;IACvE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,IAAI,KAAK,CAAC,GAAG,KAAK,0BAA0B,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC1B,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3F,OAAO,IAAI,KAAK,CAAC,GAAG,KAAK,mBAAmB,QAAQ,CAAC,MAAM,yBAAyB,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;AAC7H,CAAC;AAED,SAAS,aAAa;IACrB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;AACzD,CAAC"}

package/dist/peer-join-backfill.d.ts

@@ -28,9 +28,9 @@ export interface PeerJoinBackfillConfig {
     /** Max blocks per push message. Default 64. */
     maxChunkBlocks?: number;
     /**
-     * Per-push dial deadline, ms. Default {@link peerJoinPushBudget}'s `dialTimeoutMs` — four link
-     * round trips at the declared link plus the called machine's admission decision, 16 000 ms as
-     * shipped. NOT a fixed number: a relayed dial
+     * Per-push dial deadline, ms. Default {@link peerJoinPushBudget}'s `dialTimeoutMs` — five link
+     * round trips at the declared link plus two admission decisions (a party-run relay's and the
+     * called machine's), 21 500 ms as shipped. NOT a fixed number: a relayed dial
      * costs a fixed number of exchanges, so a host on a slower link moves this (and every other
      * cadre dial budget) by declaring `NetworkConfig.linkRoundTripMs`. Naming it here still wins
      * over the derived value — `link-budget.ts` has the counts and the measurement.

package/dist/pending-join-runner.d.ts

@@ -0,0 +1,186 @@
+/**
+ * The pending-join retry loop: carries on a join this party asked for through another party's
+ * invitation (`CadreControl.PendingJoin`, one row per invitation) in the background, on every
+ * owner machine of the party, until the join works, the invitation is used up or expires, or
+ * the user dismisses it. The behaviour is described in `docs/strands.md` → "Joining while the
+ * inviter is offline".
+ *
+ * `CadreNode` owns every side effect and hands this module plain functions
+ * ({@link PendingJoinRunnerDeps}): read the rows, run one attempt (its own `formStrand`), write
+ * an outcome, say whether this machine is an owner, and the clock. This module owns the policy:
+ * when to attempt, how to read an attempt's failure, and how to settle an outcome write that
+ * another machine's write beat.
+ *
+ * Only owner machines run it, because every `PendingJoin` write is owner-signed. Letting a
+ * machine without an owner key finish a join is `blocked/decide-non-owner-machine-completes-a-pending-join`;
+ * that changes {@link PendingJoinRunnerDeps.isOwner} and the write functions, not this loop.
+ */
+import type { FormStrandResult, PendingJoinRow, PendingJoinStatus, StrandFormationDisclosure, StrandMembershipInvite } from './types.js';
+import { type TimeoutScheduler } from './timeout-scheduler.js';
+/** How often an owner machine re-reads the party's pending joins (it also reads once right after start). */
+export declare const PENDING_JOIN_POLL_MS = 30000;
+/** Ceiling on the wait between two attempts of one join on one machine, before jitter. */
+export declare const PENDING_JOIN_MAX_BACKOFF_MS: number;
+/**
+ * The longest a join is tried for. A row's `ExpiresAt` is the earlier of this and the
+ * invitation's own expiration, which the inviter chose.
+ */
+export declare const MAX_PENDING_JOIN_MS: number;
+/** A `PendingJoin` row as written: every column but the stamp, which each write mints. */
+export type PendingJoinFields = Omit<PendingJoinRow, 'StampId'>;
+export interface PendingJoinRunnerDeps {
+    /** This machine's peer id; with the row id it fixes when this machine first tries a row it did not ask for. */
+    selfId: string;
+    /** `NetworkConfig.linkRoundTripMs`: the retry pace follows the formation deadlines it yields. */
+    linkRoundTripMs?: number;
+    /** Whether this machine may write `PendingJoin` rows now. Asked every pass. */
+    isOwner(): Promise<boolean>;
+    readRows(): Promise<PendingJoinRow[]>;
+    readRow(id: string): Promise<PendingJoinRow | null>;
+    /** One formation attempt for the row's invitation and disclosure (`CadreNode.formStrand`). */
+    attempt(row: PendingJoinRow): Promise<FormStrandResult>;
+    /** `ControlDatabase.replacePendingJoin`, owner-signed: throws `PendingJoinChangedError` when the live row is not `expectedStampId`. */
+    replace(expectedStampId: string, next: PendingJoinFields): Promise<PendingJoinRow>;
+    /** `ControlDatabase.deletePendingJoin`, owner-signed. */
+    remove(id: string): Promise<boolean>;
+    /** Whether this machine has no control connection now, so a write it commits reaches no other machine. */
+    isAlone(): boolean;
+    /** The sApp the row's invitation names. */
+    sAppIdOf(row: PendingJoinRow): string;
+    /** Every pass's rows, read by an owner machine; `CadreNode` stages the membership invitations they carry. */
+    observeRows(rows: readonly PendingJoinRow[]): void;
+    emit(status: PendingJoinStatus): void;
+    now?: () => number;
+    random?: () => number;
+    scheduler?: TimeoutScheduler;
+}
+/**
+ * The pending row a `requestJoin` writes: tried until the invitation's own expiration or
+ * {@link MAX_PENDING_JOIN_MS} from now, whichever comes first.
+ */
+export declare function requestedPendingJoin(id: string, encodedInvitation: string, disclosure: StrandFormationDisclosure, invitationExpiresAt: number, now: number): PendingJoinFields;
+/** A row's stored disclosure, as the next attempt sends it. Owner-signed, so anything but an object is a bug. */
+export declare function parseStoredDisclosure(row: PendingJoinRow): StrandFormationDisclosure;
+/** A `joined` row's `MembershipInvite` column, or null when it is not the `{inviteKey, invitePrivateKey}` JSON the loop writes. */
+export declare function parseStoredMembershipInvite(text: string): StrandMembershipInvite | null;
+/**
+ * The membership invitations `joined` rows carry that this process has not staged yet, so a
+ * closed strand joined on one owner machine can be seated by whichever machine launches it
+ * first. Rows older than {@link MEMBERSHIP_INVITE_TTL_MS} are skipped: their invitation is dead.
+ * `alreadyStaged` holds invite keys; a malformed column is skipped and logged.
+ */
+export declare function membershipInvitesToStage(rows: readonly PendingJoinRow[], alreadyStaged: ReadonlySet<string>, now: number): Array<{
+    rowId: string;
+    strandId: string;
+    invite: StrandMembershipInvite;
+}>;
+export declare class PendingJoinRunner {
+    private readonly deps;
+    private readonly tracked;
+    /** Rows whose latest write by this machine committed with no control connection: id → the stamp written. */
+    private readonly writtenAlone;
+    private readonly dueQueue;
+    private readonly scheduler;
+    private readonly now;
+    private readonly random;
+    /** First retry delay, and the window a row this machine did not ask for is first tried in. */
+    private readonly baseDelayMs;
+    /** How long a `token-spent` answer waits before its confirming attempt: long enough for a sibling's `joined` write to replicate. */
+    private readonly spentConfirmDelayMs;
+    private running;
+    private pollTimer;
+    private passInFlight;
+    private passAgain;
+    private backgroundAttempts;
+    constructor(deps: PendingJoinRunnerDeps);
+    /** Start passes: one at once, then every {@link PENDING_JOIN_POLL_MS}. */
+    start(): void;
+    /**
+     * Stop scheduling. Clears every timer and starts no new attempt.
+     *
+     * NOTE: an attempt already in flight is not awaited, because `formStrand` takes no abort
+     * signal. An approval that lands while the node stops can lose its local records; the row then
+     * stays pending, and the next start's attempt answers `token-spent`, which fails the row after
+     * its confirming attempt. Honest and bounded; if it shows up in practice, give `formStrand` a
+     * signal and abort it here.
+     */
+    stop(): void;
+    /** Run a pass now, for a change that may make one useful (this machine just became an owner). */
+    kick(): void;
+    /**
+     * Try `row` on this machine at once, outside the background slots, and report the status
+     * after the attempt. Joins an attempt already running for the row.
+     */
+    attemptNow(row: PendingJoinRow): Promise<PendingJoinStatus>;
+    /** This machine's view of `row`: the row's own state, with this machine's attempt state laid over a pending row. */
+    statusOf(row: PendingJoinRow): PendingJoinStatus;
+    /** Record a `PendingJoin` write this machine made outside the loop (a `requestJoin`), for {@link reissueWritesMadeAlone}. */
+    noteWritten(row: PendingJoinRow): void;
+    /** Stop tracking a row the user dismissed. An attempt in flight finishes; its outcome write then finds the row gone. */
+    forgetRow(id: string): void;
+    /**
+     * Re-write, with identical content under a fresh stamp, each row this machine last wrote while
+     * it had no control connection, so the other machines receive it. Called on the control
+     * connection growth edge. A row someone wrote since is left alone.
+     *
+     * NOTE: in memory only, so a row written alone by a process that stopped before it reconnected
+     * reaches the party only with that row's next write. A sweep of every row this machine wrote,
+     * on the first connection after start, would cover that, at the cost of one permanent
+     * `Revocation` tombstone per row per start. Revisit if other machines are seen missing such rows.
+     */
+    reissueWritesMadeAlone(): Promise<void>;
+    private schedulePass;
+    private clearPollTimer;
+    /** One pass at a time; a kick during a pass runs one more after it. */
+    private pass;
+    private runPass;
+    /** Drop every scheduled attempt; the first pass that finds this machine an owner again schedules afresh. */
+    private pauseAttempts;
+    /** Bring one read row into this machine's schedule. */
+    private consider;
+    /**
+     * The tracked entry for `row`, updated to it. A row asked for again (`RequestedAt` changed)
+     * starts this machine's counting over; a finished row stops its schedule.
+     */
+    private adopt;
+    private scheduleAttempt;
+    private cancelTimer;
+    private enqueue;
+    /** Start due attempts while background slots are free. */
+    private pump;
+    /** Run one attempt for `entry`, or join the one already running. Never rejects. */
+    private startAttempt;
+    private attemptOnce;
+    /** Read a failed attempt: retry, confirm a spent token, or fail the row. */
+    private onAttemptFailed;
+    /**
+     * A `token-spent` answer may mean another owner machine of this party won the same
+     * invitation. Adopt its outcome if the row already shows one; otherwise confirm once, after
+     * long enough for that machine's `joined` write to arrive, before failing the row.
+     */
+    private onSpent;
+    private retryLater;
+    /** `min(base × 2^(n−1), max)`, moved by up to ±{@link RETRY_JITTER}. */
+    private backoffMs;
+    /**
+     * Write `next` over the row this machine last read. When another write got there first,
+     * re-read and settle by {@link resolveLostWrite}. A row the user dismissed meanwhile is not
+     * recreated; a join this machine made is still remembered machine-locally, as every
+     * `formStrand` is.
+     */
+    private writeOutcome;
+    private settle;
+    /**
+     * Remove a finished row {@link MEMBERSHIP_INVITE_TTL_MS} after its outcome: the membership
+     * invitation it carries is dead by then, and an app that was not running has seen the strand
+     * through `strand:discovered`. Only while connected, like every write nothing waits on.
+     *
+     * NOTE: `deletePendingJoin` removes whichever incarnation is live, so a `requestJoin` of the
+     * same invitation landing on another machine in the same instant can be removed with it. The
+     * user asks again; revisit if that is ever seen.
+     */
+    private ageOut;
+    private forget;
+    private emitIfChanged;
+    private describe;
+}