import { constants as FS_CONSTANTS } from 'node:fs'
import fs from 'node:fs/promises'
import path from 'node:path'
import { createHmac, timingSafeEqual } from 'node:crypto'
import b4a from 'b4a'
import sodium from 'sodium-universal'
import {
ENDPOINT_ROLE,
DISPATCH_LIMITS,
HEALTH_CLOCK_STATE,
HEALTH_INTEGRITY_STATE,
HEALTH_REBALANCE_STATE,
OUTER_CLASS,
OUTER_ENVELOPE_HEADER_BYTES,
RESULT_SIGNATURE_DOMAIN_ID,
STORE_LIFECYCLE_STATE,
TRANSPORT_ID,
TRANSPORT_SUPPORT,
blindHealthResultV1,
blindServiceDescriptorV1,
decodeCanonical,
encodeCanonical,
resultSignaturePayload,
serviceDescriptorHash
} from '@hiverelay/blind-protocol'
import {
ADVERTISED_OPERATION_BITS,
FAMILY,
OPERATION,
assertReleaseReady,
operationBit
} from '@hiverelay/blind-protocol/wire-runtime-authority'
import { assertPrivateIpcReady } from '@hiverelay/blind-ipc'
import {
CELL_PUT_OPERATION_BIT_V2,
REQUIRED_LOCAL_IPC_FEATURE_BITS_V2
} from '@hiverelay/blind-ipc/private-ipc-v2-contract'
import { AdmissionCoordinator } from './admission-coordinator.js'
import {
BLIND_CELL_RUNTIME_BLOCKERS,
BlindCellRuntimeAdapter
} from './cell-runtime-adapter.js'
import {
BLIND_INBOX_RUNTIME_BLOCKERS,
BlindInboxRuntimeAdapter
} from './inbox-runtime-adapter.js'
import {
BLIND_CORE_RUNTIME_BLOCKERS,
BlindCoreRuntimeAdapter
} from './core-runtime-adapter.js'
import { BlindOperationCoordinator } from './coordinator.js'
import { DESCRIPTOR_CLOSED_REASON, DescriptorState, DescriptorStateError } from './descriptor-state.js'
import { READINESS_STATE_KIND, ReadinessCoordinator } from './readiness-coordinator.js'
import { ResourceBudget } from './resource-budget.js'
import { BlindDaemon } from './server.js'
import { createDaemonPrivatePostEofAuthorityIssuer } from './post-eof-authority.js'
import {
closePrivateIpcReplayJournalV2,
createPrivateIpcReplayReservationAuthorityV2,
openPrivateIpcReplayJournalV2,
privateIpcReplayJournalV2Status
} from './private-ipc-replay-journal-v2.js'
import {
BLIND_CELL_STORAGE_PRODUCTION_BLOCKERS,
BlindCellStorageEngine
} from './storage-engine.js'
import { BlindInboxStorageEngine } from './inbox-storage-engine.js'
import { BlindCoreStorageEngine } from './core-storage-engine.js'
import { loadBundledBlindStoreFormatAuthority } from './store-format-binding.js'
import {
BLIND_STORE_READER_MODE,
openBlindStoreGenerationFloor
} from './storage-generation-v12.js'
import { loadProductionEntrypointConfig } from './production-entrypoint.js'
import { loadDaemonBootstrapConfig } from './bootstrap-config.js'
import {
LIMITED_PUBLIC_TEST_V1_OPERATION_BITS,
isVnextPublicTestProfile,
vnextStoreGenesisExpectedBindings
} from './production-vnext-profile.js'
import { TwoSlotManifestStore, verifyBlindManifestSnapshot } from './manifest-store.js'
const operationBits = (familyId, operationIds) => operationIds.reduce(
(bits, operationId) => bits | operationBit(familyId, operationId), 0)
const DESCRIBE_OPERATION_BITS = operationBits(FAMILY.DESCRIBE, Object.values(OPERATION.DESCRIBE))
const CELL_OPERATION_BITS = operationBits(FAMILY.CELL, Object.values(OPERATION.CELL))
const INBOX_OPERATION_BITS = operationBits(FAMILY.INBOX, Object.values(OPERATION.INBOX))
const CORE_UNARY_OPERATION_BITS = operationBits(FAMILY.CORE, [OPERATION.CORE.MIRROR, OPERATION.CORE.PROVE])
const DESCRIBE_AND_CELL_OPERATION_BITS = DESCRIBE_OPERATION_BITS | CELL_OPERATION_BITS
const DESCRIBE_CELL_INBOX_OPERATION_BITS = DESCRIBE_AND_CELL_OPERATION_BITS | INBOX_OPERATION_BITS
const DESCRIBE_CELL_INBOX_CORE_OPERATION_BITS = DESCRIBE_CELL_INBOX_OPERATION_BITS | CORE_UNARY_OPERATION_BITS
if (DESCRIBE_CELL_INBOX_CORE_OPERATION_BITS !== ADVERTISED_OPERATION_BITS) {
throw new Error('production runtime operation assembly drifted from the advertised release profile')
}
const INBOX_RESULT_SIGNATURE_DOMAIN_IDS = new Set([
RESULT_SIGNATURE_DOMAIN_ID.INBOX_RECEIPT,
RESULT_SIGNATURE_DOMAIN_ID.INBOX_APPEND_ACK,
RESULT_SIGNATURE_DOMAIN_ID.INBOX_READ_RESULT
])
const CORE_RESULT_SIGNATURE_DOMAIN_IDS = new Set([
RESULT_SIGNATURE_DOMAIN_ID.CORE_ACK
])
const KNOWN_TRANSPORT_SUPPORT_BITS = Object.values(TRANSPORT_SUPPORT)
.reduce((bits, bit) => bits | bit, 0)
const MAX_U64 = (1n << 64n) - 1n
const SIX_HOURS_MILLIS = 21_600_000
const RUNTIME_BINDING_MAGIC = b4a.from('HRBRT001', 'ascii')
const RUNTIME_BINDING_PREFIX_BYTES = 8 + 32 + 32 + 32 + 1 + 2 + 2 + 32 + 8 + 32
const RUNTIME_BINDING_BYTES = RUNTIME_BINDING_PREFIX_BYTES + 32
const RUNTIME_BINDING_FILE = 'runtime-binding.v1'
export const PRODUCTION_RUNTIME_OPERATION_BITS = DESCRIBE_OPERATION_BITS
export const PRODUCTION_CELL_RUNTIME_OPERATION_BITS = CELL_OPERATION_BITS
export const PRODUCTION_INBOX_RUNTIME_OPERATION_BITS = INBOX_OPERATION_BITS
export const PRODUCTION_CORE_UNARY_RUNTIME_OPERATION_BITS = CORE_UNARY_OPERATION_BITS
export const PRODUCTION_DESCRIBE_AND_CELL_OPERATION_BITS = DESCRIBE_AND_CELL_OPERATION_BITS
export const PRODUCTION_DESCRIBE_CELL_INBOX_OPERATION_BITS = DESCRIBE_CELL_INBOX_OPERATION_BITS
export const PRODUCTION_DESCRIBE_CELL_INBOX_CORE_OPERATION_BITS = DESCRIBE_CELL_INBOX_CORE_OPERATION_BITS
export const PRODUCTION_RUNTIME_EXCLUSIONS = Object.freeze([
'FINAL_BUILD_PROFILE_LOCAL_BINDING_UNASSEMBLED',
'TWO_SLOT_MANIFEST_RUNTIME_INTEGRATION_UNASSEMBLED',
'DESCRIPTOR_REFRESH_PERSISTED_FLOOR_UNASSEMBLED',
'CELL_PUBLIC_EXECUTION_UNASSEMBLED',
'INBOX_PUBLIC_EXECUTION_UNASSEMBLED',
'CORE_PUBLIC_EXECUTION_UNASSEMBLED',
'FORWARD_PUBLIC_EXECUTION_UNASSEMBLED',
'PRIVATE_CONTENT_STREAM_RUNTIME_UNASSEMBLED',
'ADMISSION_REDEMPTION_ADAPTER_UNASSEMBLED',
'PROFILE2_EXTERNAL_JOURNAL_WITNESS_UNASSEMBLED'
])
const PRODUCTION_RELEASE_GATE_BRAND = Symbol('hiverelay.blind.production-release-gate')
// The production release gate. For every profile except the bounded vNext
// public-test profile this is the strict static completeness assertion: the
// shipped exclusions keep it fail-closed (BLIND_RUNTIME_INCOMPLETE), exactly as
// the signed 1.0.0-rc.1.public-test.1 artifact behaved at syd-1. For the vNext
// public-test profile the gate instead computes the genuinely-unassembled
// exclusions from the sealed-material binding and the configured assembly, then
// asserts that computed set is empty. The strict
// assertProductionRuntimeCompleteness primitive is unchanged; the vNext path
// makes each exclusion TRUE-assembled rather than filtering it away or
// weakening the gate.
export async function assertProductionRuntimeReleaseReady (environment = process.env) {
assertReleaseReady()
assertPrivateIpcReady()
const profile = environment == null ? undefined : environment.HIVERELAY_BLIND_RUNTIME_PROFILE
if (isVnextPublicTestProfile(profile)) {
const { runtimeExclusions, storageBlockers } = await vnextPublicTestCompleteness(environment)
assertProductionRuntimeCompleteness({ runtimeExclusions, storageBlockers })
return
}
assertProductionRuntimeCompleteness()
}
// Bind the genuine production release gate to a specific signed environment.
// The brand lets the test-seam guard recognise the real gate even when it is
// wrapped as a closure, so a non-production gate can never be smuggled in to
// satisfy the private-IPC replay-journal seam precondition.
export function productionReleaseGateFor (environment) {
const gate = () => assertProductionRuntimeReleaseReady(environment)
Object.defineProperty(gate, PRODUCTION_RELEASE_GATE_BRAND, { value: true })
return gate
}
function isProductionReleaseGate (gate) {
return gate === assertProductionRuntimeReleaseReady ||
(typeof gate === 'function' && gate[PRODUCTION_RELEASE_GATE_BRAND] === true)
}
export function assertProductionRuntimeCompleteness ({
runtimeExclusions = PRODUCTION_RUNTIME_EXCLUSIONS,
storageBlockers = BLIND_CELL_STORAGE_PRODUCTION_BLOCKERS
} = {}) {
if (!Array.isArray(runtimeExclusions) || !Array.isArray(storageBlockers)) {
throw new TypeError('production completeness inputs must be blocker arrays')
}
if (runtimeExclusions.length > 0) {
runtimeFailure('BLIND_RUNTIME_INCOMPLETE',
`production runtime is incomplete: ${runtimeExclusions.join(',')}`)
}
if (storageBlockers.length > 0) {
runtimeFailure('BLIND_STORAGE_INCOMPLETE',
`production storage is incomplete: ${storageBlockers.join(',')}`)
}
}
// Profile-scoped completeness. The baseline LIMITED_PUBLIC_TEST_V1 profile
// (release profile ID 1, mask 0x0001ffff) is evaluated ONLY against the eight
// baseline exclusions below. FORWARD serving and the profile-2 external
// journal witness belong to the separate, later
// LIMITED_PUBLIC_TEST_FORWARD_ONE_HOP_V1 (release profile ID 2) acceptance
// gate: they are never evaluated under the baseline, their descriptor and
// readiness bits stay zero, and the profile-2 profile itself is never selected
// here (it has its own independent serial acceptance after the baseline
// ships). This scoping is frozen in the gate — it is the correct boundary
// between two release profiles with separate completeness contracts, not a way
// to drop exclusions from a list.
export const BASELINE_COMPLETENESS_EXCLUSIONS = Object.freeze([
'FINAL_BUILD_PROFILE_LOCAL_BINDING_UNASSEMBLED',
'TWO_SLOT_MANIFEST_RUNTIME_INTEGRATION_UNASSEMBLED',
'DESCRIPTOR_REFRESH_PERSISTED_FLOOR_UNASSEMBLED',
'CELL_PUBLIC_EXECUTION_UNASSEMBLED',
'INBOX_PUBLIC_EXECUTION_UNASSEMBLED',
'CORE_PUBLIC_EXECUTION_UNASSEMBLED',
'PRIVATE_CONTENT_STREAM_RUNTIME_UNASSEMBLED',
'ADMISSION_REDEMPTION_ADAPTER_UNASSEMBLED'
])
// Profile-2 (bounded one-hop FORWARD) items. These are evaluated only under
// the profile-2 acceptance profile — which is disabled and keeps its
// descriptor/readiness bits zero — and never under the baseline.
export const PROFILE2_COMPLETENESS_EXCLUSIONS = Object.freeze([
'FORWARD_PUBLIC_EXECUTION_UNASSEMBLED',
'PROFILE2_EXTERNAL_JOURNAL_WITNESS_UNASSEMBLED'
])
// Genuinely compute which of the BASELINE profile's exclusions remain
// unassembled. Every exclusion cleared here is backed by a real code path: the
// CELL/INBOX/CORE line and admission adapter by the entrypoint configuration
// (deep capture/resolution runs during assembly), and the sealed-material
// binding / two-slot chain by cryptographic verification below. Anything not
// genuinely assembled stays in the returned list and keeps the gate closed.
// FORWARD/profile-2 items are out of scope for the baseline (see above).
// Storage promotion blockers (profile 2, rebalance, repair evidence,
// accelerated scrub) describe future surfaces, not a failed profile-1 store;
// they stay visible in status but do not block this profile, consistent with
// productionStorageOperationalIntegrity.
async function vnextPublicTestCompleteness (environment) {
const assembled = new Set()
const entrypointConfig = loadProductionEntrypointConfig(environment)
if (entrypointConfig.enableCellRuntime && entrypointConfig.enableInboxRuntime &&
entrypointConfig.enableCoreRuntime) {
assembled.add('CELL_PUBLIC_EXECUTION_UNASSEMBLED')
assembled.add('INBOX_PUBLIC_EXECUTION_UNASSEMBLED')
assembled.add('CORE_PUBLIC_EXECUTION_UNASSEMBLED')
assembled.add('PRIVATE_CONTENT_STREAM_RUNTIME_UNASSEMBLED')
}
if (entrypointConfig.admissionAdapter) {
assembled.add('ADMISSION_REDEMPTION_ADAPTER_UNASSEMBLED')
}
const bootstrap = loadDaemonBootstrapConfig(environment)
const runtimeConfig = loadProductionRuntimeConfig(environment, bootstrap.endpointIds)
// #1 FINAL_BUILD_PROFILE_LOCAL_BINDING is proven statically: the
// profile/descriptor/relay-identity binding exists and validates against the
// sealed material (this throws on any forgery). #2
// TWO_SLOT_MANIFEST_RUNTIME_INTEGRATION and #3
// DESCRIPTOR_REFRESH_PERSISTED_FLOOR are genuinely delivered in serving (the
// two-slot store manifest persists, restores and enforces the descriptor
// floor across restart) once the generation-floor bootstrap closed the
// serving integration; vnextManifestFloorAssembled reports that delivery and
// the vNext profile e2e proves it end-to-end.
await verifyVnextSealedMaterialBinding(runtimeConfig)
assembled.add('FINAL_BUILD_PROFILE_LOCAL_BINDING_UNASSEMBLED')
if (vnextManifestFloorAssembled()) {
assembled.add('TWO_SLOT_MANIFEST_RUNTIME_INTEGRATION_UNASSEMBLED')
assembled.add('DESCRIPTOR_REFRESH_PERSISTED_FLOOR_UNASSEMBLED')
}
const remaining = BASELINE_COMPLETENESS_EXCLUSIONS.filter(value => !assembled.has(value))
return Object.freeze({
runtimeExclusions: Object.freeze(remaining),
storageBlockers: Object.freeze([])
})
}
// Reports whether the vNext assembly genuinely persists and enforces the
// descriptor floor through the two-slot store manifest in runtime SERVING. The
// store-genesis ceremony seals a manifest whose genesis floor record carries
// the exact floorTransitionV1 payload (the serving cell engine's WAL recovery
// accepts it), and the generation-floor bootstrap
// (bootstrapVnextStoreGenerationFloor) establishes the storage-generation floor
// evidence from the serving engine's own recovered WAL anchor on the
// genesis-manifested store, so the full serving path — bind, engine open,
// generation floor, two-slot manifest floor enforcement across restart — is
// genuinely assembled and proven end-to-end by the vNext profile e2e. Keep this
// true ONLY while that e2e passes; if the serving integration regresses, set it
// back to false so #2/#3 stay honestly unassembled.
function vnextManifestFloorAssembled () {
return true
}
// Boot-time verified floor restoration (FLEET-DURABILITY-P1-1).
//
// The daemon re-validates the full configured descriptor chain from genesis on
// every boot. Every link carries a bounded wall-clock epoch window, so once
// the genesis window lapsed an intact relay could no longer restart:
// activation failed closed 'descriptor is expired' on the historical link even
// when the chain head was valid and fresh and the store/manifest/WAL were
// provably intact. Genesis cannot be re-issued (a byte change forks the chain)
// or dropped (CHAIN_GAP), so the only honest continuation is the verified
// restore the accepted DescriptorState.restore() semantics define — never a
// trusted boolean.
//
// Boot order (every other fail-closed rule is unchanged):
// 1. Activate the configured chain exactly as before. Any failure other than
// a wall-clock EXPIRED (fork, rollback, chain gap, invalid transition, a
// not-yet-valid link) propagates unchanged.
// 2. Only when activation died on EXPIRED and the assembly requires the
// two-slot manifest floor (the vNext profile always does), attempt the
// verified restore: load the sealed manifest READ-ONLY under the launch
// manifest key and the chain-invariant genesis bindings, require the
// persisted descriptor floor to be an EXACT link of the configured chain
// (a rolled-back or forked configuration can never contain the floor),
// MAC-verify the runtime store binding against the floor link, then
// DescriptorState.restore() the chain prefix up to the floor — signature
// and continuity/identity verification for every historical link, with
// wall-clock freshness superseded by the MAC-verified checkpoint — and
// activate() any post-floor suffix links, which DO get the full
// issued/expires wall-clock checks.
// 3. The restored head must be within its window: requireCurrent() closes
// EXPIRED/NOT_YET_VALID exactly like plain activation, so an expired HEAD
// still fails closed.
//
// The allowed case is therefore exactly: a valid, fresh, signature+continuity
// verified chain head whose descriptor floor is MAC-verified on the configured
// chain, on a store root bound to the same relay/store/durability/map/fence
// tuple. A fresh store's first boot has no floor and keeps failing closed on
// an expired genesis. The restore itself is READ-ONLY on the store: the
// data-plane recovery integrity is enforced unchanged later in the same boot
// (engine WAL recovery, the frozen generation floor, the two-slot floor
// enforcement) before anything serves, and readiness keeps a restored daemon
// unready until the live recovered store reports fullStoreVerified.
async function activateVnextBootDescriptorChain ({ descriptorBytes, config, requireManifestFloor }) {
const descriptorState = new DescriptorState({ verifySignature: verifyDetached })
try {
let snapshot
for (const bytes of descriptorBytes) snapshot = await descriptorState.activate(bytes)
return Object.freeze({ descriptorState, snapshot, restoredFromFloor: false })
} catch (error) {
if (requireManifestFloor !== true || !(error instanceof DescriptorStateError) ||
error.code !== DESCRIPTOR_CLOSED_REASON.EXPIRED) {
throw error
}
return restoreVnextBootDescriptorChain({ descriptorBytes, config })
}
}
// The restore half of the boot order above. Fails closed (RESTORE_UNVERIFIED,
// BLIND_RUNTIME_MANIFEST_REQUIRED, the manifest store's coded integrity error,
// or BLIND_RUNTIME_STORE_IDENTITY_MISMATCH) on every deviation from the single
// allowed case; never mutates the store. Secret hygiene: the manifest key and
// owner fence hash are consumed (MAC verification) and zeroed here; the
// manifest store zeroes its internal key copy on close.
async function restoreVnextBootDescriptorChain ({ descriptorBytes, config }) {
let head
try {
head = decodeCanonical(blindServiceDescriptorV1, descriptorBytes[descriptorBytes.length - 1],
{ copyBytes: true })
} catch {
throw new DescriptorStateError(DESCRIPTOR_CLOSED_REASON.RESTORE_UNVERIFIED,
'the configured chain head is not canonically decodable for floor restoration')
}
const manifestKey = await readBoundFile(config.storeManifestKeyFile, {
field: 'store manifest key', exactBytes: 32, maximumBytes: 32, secret: true
})
let ownerFenceTokenHash
let manifestStore
try {
ownerFenceTokenHash = await readBoundFile(config.ownerFenceTokenHashFile, {
field: 'owner fence token hash', exactBytes: 32, maximumBytes: 32, secret: true
})
const controlDirectory = path.join(config.storeRoot, 'control')
manifestStore = new TwoSlotManifestStore({
controlDirectory,
manifestKey,
expectedBindings: vnextStoreGenesisExpectedBindings(
head, serviceDescriptorHash(descriptorBytes[descriptorBytes.length - 1]),
config.mapGeneration, ownerFenceTokenHash)
})
let sealed
try {
await manifestStore.open({ validationOnly: true })
sealed = await manifestStore.load()
} catch (error) {
if (error && (error.code === 'ENOENT' ||
(error.code === 'RECOVERY_GAP_READ_ONLY' && /no valid manifest slot/.test(error.message)))) {
runtimeFailure('BLIND_RUNTIME_MANIFEST_REQUIRED',
'an expired-chain boot requires the sealed two-slot store manifest: a fresh store has no floor to restore from')
}
throw error
}
const floorSequence = sealed.manifest.descriptorSequenceFloor
const floorHash = sealed.manifest.descriptorHashFloor
let floorIndex = -1
for (let index = 0; index < descriptorBytes.length; index++) {
if (b4a.equals(serviceDescriptorHash(descriptorBytes[index]), floorHash)) {
floorIndex = index
break
}
}
if (floorIndex < 0) {
throw new DescriptorStateError(DESCRIPTOR_CLOSED_REASON.RESTORE_UNVERIFIED,
'the persisted manifest floor is not a link of the configured chain (rolled-back or forked configuration)')
}
const floorDescriptor = decodeCanonical(blindServiceDescriptorV1, descriptorBytes[floorIndex],
{ copyBytes: true })
if (floorDescriptor.descriptorSequence !== floorSequence) {
throw new DescriptorStateError(DESCRIPTOR_CLOSED_REASON.RESTORE_UNVERIFIED,
'the persisted manifest floor sequence does not match its descriptor hash floor')
}
// The runtime store binding is the root-level MAC over the same
// chain-invariant relay/store/durability/map/fence tuple the manifest
// seals; it must verify READ-ONLY against the floor link before any
// restoration evidence is accepted.
const expectedBinding = encodeRuntimeBinding(floorDescriptor, config.mapGeneration,
ownerFenceTokenHash, manifestKey)
const boundBinding = await readBoundFile(path.join(config.storeRoot, RUNTIME_BINDING_FILE), {
field: 'runtime store binding',
maximumBytes: RUNTIME_BINDING_BYTES,
exactBytes: RUNTIME_BINDING_BYTES,
secret: true
})
if (!timingSafeEqual(boundBinding, expectedBinding)) {
runtimeFailure('BLIND_RUNTIME_STORE_IDENTITY_MISMATCH',
'store root is bound to another relay/store/durability/map/fence tuple')
}
const descriptorState = new DescriptorState({
verifySignature: verifyDetached,
verifyRestoration: async input => {
// The restoration evidence: the manifest bytes handed to
// DescriptorState.restore() must be the live MAC-verified two-slot
// selection of this store's control root (brand check), bound to
// exactly the floor tuple the chain restores to. The runtime store
// binding was MAC-verified above. The store's data-plane recovery
// integrity is verified later in this same boot before serving
// (engine WAL recovery + generation floor), and readiness keeps a
// restored daemon unready until the live store verifies.
let controlPlaneVerified = false
try {
controlPlaneVerified = verifyBlindManifestSnapshot(sealed, controlDirectory) === true &&
b4a.equals(input.canonicalManifestBytes, sealed.bytes) &&
input.descriptorSequenceFloor === floorSequence &&
b4a.equals(input.descriptorHashFloor, floorHash)
} catch {
controlPlaneVerified = false
}
return Object.freeze({
verified: controlPlaneVerified,
fullStoreVerified: controlPlaneVerified,
descriptorSequenceFloor: input.descriptorSequenceFloor,
descriptorHashFloor: b4a.from(input.descriptorHashFloor),
relayPublicKey: b4a.from(input.relayPublicKey),
storeId: b4a.from(input.storeId),
durabilityProfileId: input.durabilityProfileId,
durabilityContinuityHash: b4a.from(input.durabilityContinuityHash),
durabilityProfileHash: b4a.from(input.durabilityProfileHash)
})
}
})
await descriptorState.restore({
descriptorChainBytes: descriptorBytes.slice(0, floorIndex + 1),
manifestBytes: sealed.bytes
})
for (let index = floorIndex + 1; index < descriptorBytes.length; index++) {
await descriptorState.activate(descriptorBytes[index])
}
return Object.freeze({
descriptorState,
snapshot: descriptorState.requireCurrent(),
restoredFromFloor: true
})
} finally {
if (manifestStore) await manifestStore.close().catch(() => {})
manifestKey.fill(0)
if (ownerFenceTokenHash) ownerFenceTokenHash.fill(0)
}
}
// Verify the sealed node-scoped material the vNext profile binds to: the
// genesis+successor descriptor chain (two-slot manifest) activated through the
// real DescriptorState — with the verified floor restore above when a
// historical link's epoch window has lapsed behind a MAC-verified floor — the
// exact signed launch floor, and the profile/descriptor/relay-identity
// binding. Any forged, missing or mismatched input fails closed. This is the
// static proof of FINAL_BUILD_PROFILE_LOCAL_BINDING,
// TWO_SLOT_MANIFEST_RUNTIME_INTEGRATION and DESCRIPTOR_REFRESH_PERSISTED_FLOOR;
// the assembly re-validates the same chain and additionally persists/restores
// the floor across restart.
async function verifyVnextSealedMaterialBinding (runtimeConfig) {
const descriptorBytes = await Promise.all(runtimeConfig.descriptorFiles.map((file, index) =>
readBoundFile(file, { field: `descriptorFiles[${index}]`, maximumBytes: 16 * 1024 })))
// The vNext profile always seals a two-slot manifest floor (cli.js sets
// requireManifestFloor for it), so an expired historical link may restore
// against that floor here exactly as in the serving assembly.
const activation = await activateVnextBootDescriptorChain({
descriptorBytes,
config: runtimeConfig,
requireManifestFloor: true
})
const snapshot = activation.snapshot
assertDescriptorLaunchFloor(snapshot, runtimeConfig)
const descriptor = snapshot.descriptor
if (descriptor.storeLifecycleState !== STORE_LIFECYCLE_STATE.ACTIVE ||
descriptor.enabledOperationBits !== LIMITED_PUBLIC_TEST_V1_OPERATION_BITS) {
runtimeFailure('BLIND_RUNTIME_DESCRIPTOR_UNSUPPORTED',
'vNext public-test descriptor must be ACTIVE with exactly the baseline 0x0001ffff operation mask')
}
if (descriptor.durability.profileId !== 1) {
runtimeFailure('BLIND_RUNTIME_DESCRIPTOR_UNSUPPORTED',
'vNext public-test descriptor must use the profile-1 store durability authority')
}
const secretKey = await readBoundFile(runtimeConfig.relaySecretKeyFile, {
field: 'relay secret key',
exactBytes: sodium.crypto_sign_SECRETKEYBYTES,
maximumBytes: sodium.crypto_sign_SECRETKEYBYTES,
secret: true
})
try {
const derivedPublicKey = b4a.alloc(sodium.crypto_sign_PUBLICKEYBYTES)
sodium.crypto_sign_ed25519_sk_to_pk(derivedPublicKey, secretKey)
if (!b4a.equals(derivedPublicKey, descriptor.relayPublicKey)) {
runtimeFailure('BLIND_RUNTIME_SIGNING_KEY_MISMATCH',
'relay signing secret does not match the current signed descriptor relay key')
}
} finally {
secretKey.fill(0)
}
}
function runtimeFailure (code, message) {
const error = new Error(message)
error.code = code
throw error
}
function canonicalAbsolutePath (value, field) {
if (typeof value !== 'string' || value.length === 0 || value.includes('\0') ||
!path.isAbsolute(value) || path.normalize(value) !== value) {
runtimeFailure('BLIND_RUNTIME_CONFIG_INVALID', `${field} must be a canonical absolute path`)
}
return value
}
function requiredPath (environment, name) {
return canonicalAbsolutePath(environment[name], name)
}
function optionalPath (environment, name) {
const value = environment[name]
return value == null || value === '' ? null : canonicalAbsolutePath(value, name)
}
function storeReaderMode (environment) {
const value = environment.HIVERELAY_BLIND_STORE_READER_MODE || BLIND_STORE_READER_MODE.BLIND_ONLY
if (!Object.values(BLIND_STORE_READER_MODE).includes(value)) {
runtimeFailure('BLIND_RUNTIME_CONFIG_INVALID', 'HIVERELAY_BLIND_STORE_READER_MODE is invalid')
}
return value
}
function requiredPathList (environment, name, maximum) {
const raw = environment[name]
if (typeof raw !== 'string' || raw.length === 0 || raw.length > 32768 || raw.includes(' ')) {
runtimeFailure('BLIND_RUNTIME_CONFIG_INVALID', `${name} must be a comma-separated canonical path list`)
}
const values = raw.split(',')
if (values.length < 1 || values.length > maximum) {
runtimeFailure('BLIND_RUNTIME_CONFIG_INVALID', `${name} must contain 1..${maximum} paths`)
}
const seen = new Set()
for (let index = 0; index < values.length; index++) {
canonicalAbsolutePath(values[index], `${name}[${index}]`)
if (seen.has(values[index])) runtimeFailure('BLIND_RUNTIME_CONFIG_INVALID', `${name} contains a duplicate path`)
seen.add(values[index])
}
return Object.freeze(values)
}
function canonicalUnsigned (environment, name, fallback, minimum, maximum) {
const raw = environment[name]
if (raw == null && fallback != null) return fallback
if (typeof raw !== 'string' || raw.length > 16 || !/^(0|[1-9][0-9]*)$/.test(raw)) {
runtimeFailure('BLIND_RUNTIME_CONFIG_INVALID', `${name} must be a canonical unsigned integer`)
}
const value = Number(raw)
if (!Number.isSafeInteger(value) || value < minimum || value > maximum) {
runtimeFailure('BLIND_RUNTIME_CONFIG_INVALID', `${name} is outside ${minimum}..${maximum}`)
}
return value
}
function canonicalU64 (environment, name, minimum = 1n) {
const raw = environment[name]
if (typeof raw !== 'string' || raw.length > 20 || !/^(0|[1-9][0-9]*)$/.test(raw)) {
runtimeFailure('BLIND_RUNTIME_CONFIG_INVALID', `${name} must be a canonical u64 integer`)
}
const value = BigInt(raw)
if (value < minimum || value > MAX_U64) {
runtimeFailure('BLIND_RUNTIME_CONFIG_INVALID', `${name} is outside its required u64 range`)
}
return value
}
function requiredHash (environment, name) {
const raw = environment[name]
if (typeof raw !== 'string' || !/^[0-9a-fA-F]{64}$/.test(raw)) {
runtimeFailure('BLIND_RUNTIME_CONFIG_INVALID', `${name} must be an exact 32-byte hash in hex`)
}
return b4a.from(raw, 'hex')
}
function endpointSupportBindings (environment, endpointIds) {
const raw = environment.HIVERELAY_BLIND_ENDPOINT_SUPPORT_BITS
if (typeof raw !== 'string' || raw.length === 0 || raw.length > 2039 ||
!/^[1-9][0-9]*:[1-9][0-9]*(?:,[1-9][0-9]*:[1-9][0-9]*)*$/.test(raw)) {
runtimeFailure('BLIND_RUNTIME_CONFIG_INVALID',
'HIVERELAY_BLIND_ENDPOINT_SUPPORT_BITS must be a canonical endpoint:support-bit list')
}
const rows = raw.split(',').map(row => {
const [endpoint, support] = row.split(':')
return { endpointId: Number(endpoint), transportSupportBit: Number(support) }
})
if (rows.length !== endpointIds.length) {
runtimeFailure('BLIND_RUNTIME_CONFIG_INVALID', 'endpoint support bindings must cover the exact launch endpoint set')
}
for (let index = 0; index < rows.length; index++) {
const row = rows[index]
if (row.endpointId !== endpointIds[index] || !Number.isInteger(row.transportSupportBit) ||
row.transportSupportBit === 0 || (row.transportSupportBit & (row.transportSupportBit - 1)) !== 0 ||
(row.transportSupportBit & ~KNOWN_TRANSPORT_SUPPORT_BITS) !== 0) {
runtimeFailure('BLIND_RUNTIME_CONFIG_INVALID',
'endpoint support bindings must be ordered, exact, and use one registered support bit')
}
Object.freeze(row)
}
return Object.freeze(rows)
}
export function loadProductionRuntimeConfig (environment = process.env, endpointIds) {
if (!Array.isArray(endpointIds) || endpointIds.length === 0) {
throw new TypeError('endpointIds from the signed launch topology are required')
}
return Object.freeze({
descriptorFiles: requiredPathList(environment, 'HIVERELAY_BLIND_DESCRIPTOR_FILES', 4096),
admissionParameterFiles: requiredPathList(environment, 'HIVERELAY_BLIND_ADMISSION_PARAMETER_FILES', 64),
relaySecretKeyFile: requiredPath(environment, 'HIVERELAY_BLIND_RELAY_SECRET_KEY_FILE'),
storeRoot: requiredPath(environment, 'HIVERELAY_BLIND_STORE_ROOT'),
privateIpcReplayRoot: optionalPath(environment, 'HIVERELAY_BLIND_PRIVATE_IPC_REPLAY_ROOT'),
inboxStoreRoot: optionalPath(environment, 'HIVERELAY_BLIND_INBOX_STORE_ROOT'),
inboxCursorKeyFile: optionalPath(environment, 'HIVERELAY_BLIND_INBOX_CURSOR_KEY_FILE'),
coreStoreRoot: optionalPath(environment, 'HIVERELAY_BLIND_CORE_STORE_ROOT'),
storeManifestKeyFile: requiredPath(environment, 'HIVERELAY_BLIND_STORE_MANIFEST_KEY_FILE'),
storeReaderMode: storeReaderMode(environment),
ownerFenceTokenHashFile: requiredPath(environment, 'HIVERELAY_BLIND_OWNER_FENCE_TOKEN_HASH_FILE'),
mapGeneration: canonicalU64(environment, 'HIVERELAY_BLIND_MAP_GENERATION'),
expectedDescriptorSequence: canonicalU64(environment, 'HIVERELAY_BLIND_EXPECTED_DESCRIPTOR_SEQUENCE', 0n),
expectedDescriptorHash: requiredHash(environment, 'HIVERELAY_BLIND_EXPECTED_DESCRIPTOR_HASH'),
endpointSupportBindings: endpointSupportBindings(environment, endpointIds),
resourceBudget: Object.freeze({
maxItems: canonicalUnsigned(environment, 'HIVERELAY_BLIND_MAX_INFLIGHT_ITEMS', 1024, 1, 1_000_000),
maxBytes: canonicalUnsigned(environment, 'HIVERELAY_BLIND_MAX_INFLIGHT_BYTES', 64 * 1024 * 1024,
1, 1024 * 1024 * 1024),
reservePercent: canonicalUnsigned(environment, 'HIVERELAY_BLIND_RESERVED_PERCENT', 5, 5, 50)
}),
server: Object.freeze({
maxConnections: canonicalUnsigned(environment, 'HIVERELAY_BLIND_MAX_CONNECTIONS', 1024, 1, 1_000_000),
maxBufferedBytes: canonicalUnsigned(environment, 'HIVERELAY_BLIND_MAX_BUFFERED_BYTES',
64 * 1024 * 1024, 1, 1024 * 1024 * 1024),
closeTimeoutMs: canonicalUnsigned(environment, 'HIVERELAY_BLIND_CLOSE_TIMEOUT_MS', 5000, 1, 60000)
})
})
}
function sameInode (left, right) {
return left.dev === right.dev && left.ino === right.ino
}
function sameFileState (left, right) {
return sameInode(left, right) && left.size === right.size && left.mode === right.mode &&
left.uid === right.uid && left.gid === right.gid && left.nlink === right.nlink &&
left.mtimeMs === right.mtimeMs && left.ctimeMs === right.ctimeMs
}
async function readBoundFile (file, options = {}) {
const maximumBytes = options.maximumBytes == null ? 1024 * 1024 : options.maximumBytes
const handle = await fs.open(file, FS_CONSTANTS.O_RDONLY | FS_CONSTANTS.O_NOFOLLOW)
try {
const [opened, linked] = await Promise.all([handle.stat(), fs.lstat(file)])
if (!opened.isFile() || linked.isSymbolicLink() || !sameInode(opened, linked) || opened.size < 1 ||
opened.size > maximumBytes || (linked.mode & 0o022) !== 0) {
runtimeFailure('BLIND_RUNTIME_FILE_INVALID', `${options.field || file} is not a stable protected regular file`)
}
if (options.secret === true) {
const permissions = linked.mode & 0o777
if (typeof process.getuid !== 'function' || linked.uid !== process.getuid() || linked.nlink !== 1 ||
(permissions !== 0o600 && permissions !== 0o400)) {
runtimeFailure('BLIND_RUNTIME_FILE_INVALID', `${options.field || file} must be daemon-owned and mode 0600/0400`)
}
}
if (await fs.realpath(file) !== file) {
runtimeFailure('BLIND_RUNTIME_FILE_INVALID', `${options.field || file} must not traverse a symlinked path`)
}
const value = await handle.readFile()
const [after, linkedAfter] = await Promise.all([handle.stat(), fs.lstat(file)])
if (!sameFileState(opened, after) || !sameFileState(after, linkedAfter) ||
value.byteLength !== opened.size || await fs.realpath(file) !== file) {
runtimeFailure('BLIND_RUNTIME_FILE_INVALID', `${options.field || file} changed while it was read`)
}
if (options.exactBytes != null && value.byteLength !== options.exactBytes) {
runtimeFailure('BLIND_RUNTIME_FILE_INVALID', `${options.field || file} must contain exactly ${options.exactBytes} bytes`)
}
return value
} finally {
await handle.close()
}
}
async function verifyPrivateStoreRoot (root) {
const stat = await fs.lstat(root)
if (!stat.isDirectory() || stat.isSymbolicLink() || typeof process.getuid !== 'function' ||
stat.uid !== process.getuid() || (stat.mode & 0o077) !== 0 || await fs.realpath(root) !== root) {
runtimeFailure('BLIND_RUNTIME_STORE_INVALID', 'blind store root must be a canonical daemon-owned private directory')
}
}
export function encodeRuntimeBinding (descriptor, mapGeneration, ownerFenceTokenHash, manifestKey) {
const prefix = b4a.alloc(RUNTIME_BINDING_PREFIX_BYTES)
let offset = 0
b4a.copy(RUNTIME_BINDING_MAGIC, prefix, offset); offset += 8
b4a.copy(descriptor.relayPublicKey, prefix, offset); offset += 32
b4a.copy(descriptor.storeId, prefix, offset); offset += 32
b4a.copy(descriptor.durabilityContinuityHash, prefix, offset); offset += 32
prefix[offset++] = descriptor.durability.profileId
prefix.writeUInt16BE(descriptor.durability.storeFormatMajor, offset); offset += 2
prefix.writeUInt16BE(descriptor.durability.storeFormatMinor, offset); offset += 2
b4a.copy(descriptor.durability.storeFormatHash, prefix, offset); offset += 32
prefix.writeBigUInt64BE(mapGeneration, offset); offset += 8
b4a.copy(ownerFenceTokenHash, prefix, offset)
const mac = createHmac('sha256', manifestKey).update(prefix).digest()
return b4a.concat([prefix, mac], RUNTIME_BINDING_BYTES)
}
async function syncDirectory (directory) {
const handle = await fs.open(directory, FS_CONSTANTS.O_RDONLY)
try {
await handle.sync()
} finally {
await handle.close()
}
}
export async function bindStoreIdentity (root, expected) {
const file = path.join(root, RUNTIME_BINDING_FILE)
let existing
let created = false
try {
existing = await readBoundFile(file, {
field: 'runtime store binding',
maximumBytes: RUNTIME_BINDING_BYTES,
exactBytes: RUNTIME_BINDING_BYTES,
secret: true
})
} catch (error) {
if (!error || error.code !== 'ENOENT') throw error
}
if (!existing) {
const entries = await fs.readdir(root)
if (entries.length !== 0) {
runtimeFailure('BLIND_RUNTIME_STORE_BINDING_REQUIRED',
'a nonempty store without a verified runtime binding must not be claimed or modified')
}
let handle
try {
handle = await fs.open(file, FS_CONSTANTS.O_WRONLY | FS_CONSTANTS.O_CREAT | FS_CONSTANTS.O_EXCL |
FS_CONSTANTS.O_NOFOLLOW, 0o600)
await handle.writeFile(expected)
await handle.sync()
await handle.close()
handle = null
await syncDirectory(root)
existing = b4a.from(expected)
created = true
} catch (error) {
if (handle) await handle.close().catch(() => {})
if (!error || error.code !== 'EEXIST') throw error
existing = await readBoundFile(file, {
field: 'runtime store binding',
maximumBytes: RUNTIME_BINDING_BYTES,
exactBytes: RUNTIME_BINDING_BYTES,
secret: true
})
}
}
if (!timingSafeEqual(existing, expected)) {
runtimeFailure('BLIND_RUNTIME_STORE_IDENTITY_MISMATCH',
'store root is bound to another relay/store/durability/map/fence tuple')
}
return created
}
// Generation-floor bootstrap for the vNext genesis-manifested store
// (orchestration step 3 of bind -> genesis -> generation-floor bootstrap ->
// serve). The serving path creates the storage-generation floor only when it
// binds a pristine store itself (allowCreate: storeBindingCreated), so on a
// store that was bound BEFORE the store-genesis ceremony ran it correctly
// refuses to invent evidence ('blind store generation evidence is missing').
// This helper is the explicit ceremony-side step that establishes that
// evidence. It:
// 1. fails fast unless the two-slot genesis manifest MAC-verifies under the
// launch key and the exact descriptor-floor/map/fence bindings (i.e. the
// store-genesis ceremony genuinely sealed this store);
// 2. re-verifies the on-disk runtime binding against the recomputed binding
// (bindStoreIdentity returns false on an already-bound store);
// 3. opens the cell storage engine with the SAME constructor arguments the
// serving path uses and reads the WAL anchor (walSequence/walHash) from the
// engine's own recovery — including any clock reconciliation the engine
// itself appends during open — so the recorded evidence is exactly the
// anchor the serving path recovers on its first boot (the anchor is read,
// never predicted or re-derived);
// 4. creates the generation-floor record with allowCreate: true. Re-running
// the helper is idempotent: an existing record is re-validated against the
// same anchor by the frozen generation-floor chain rules.
//
// Timing: run after the store-genesis ceremony and before the first serve
// boot, within the same lease epoch. If the wall-clock epoch rolls between
// the bootstrap and the first serve boot, the serving engine's clock
// reconciliation advances the WAL past the recorded anchor and the frozen
// generation floor fails closed ('evidence was rolled back or replayed') —
// the same fail-closed rule the accepted fresh-store flow already lives with
// across restarts before the first acknowledged blind write.
//
// Secret hygiene: manifestKey and ownerFenceTokenHash stay caller-owned; they
// are consumed (HMAC/MAC verification) but never copied, logged, or zeroed
// here.
export async function bootstrapVnextStoreGenerationFloor ({
storeRoot,
descriptor,
manifestKey,
ownerFenceTokenHash,
mapGeneration,
storeReaderMode = BLIND_STORE_READER_MODE.BLIND_ONLY
}) {
const controlDirectory = path.join(storeRoot, 'control')
const binding = encodeRuntimeBinding(descriptor, mapGeneration, ownerFenceTokenHash, manifestKey)
await verifyPrivateStoreRoot(storeRoot)
const manifestStore = new TwoSlotManifestStore({
controlDirectory,
manifestKey,
expectedBindings: vnextStoreGenesisExpectedBindings(
descriptor,
serviceDescriptorHash(encodeCanonical(blindServiceDescriptorV1, descriptor)),
mapGeneration,
ownerFenceTokenHash)
})
await manifestStore.open({ validationOnly: true })
try {
await manifestStore.load()
} finally {
await manifestStore.close()
}
const bindingCreated = await bindStoreIdentity(storeRoot, binding)
const storeFormatAuthority = await loadBundledBlindStoreFormatAuthority({
expectedStoreFormatHash: descriptor.durability.storeFormatHash,
expectedFormatMajor: descriptor.durability.storeFormatMajor,
expectedFormatMinor: descriptor.durability.storeFormatMinor
})
const storage = new BlindCellStorageEngine({
root: storeRoot,
relayPublicKey: descriptor.relayPublicKey,
storeId: descriptor.storeId,
durabilityProfileId: descriptor.durability.profileId,
durabilityProfileHash: descriptor.durabilityProfileHash,
mapGeneration,
ownerFenceTokenHash,
durabilityContinuityHash: descriptor.durabilityContinuityHash,
storeFormatAuthority
})
await storage.open()
let storeEvidence
try {
storeEvidence = {
walSequence: storage.transactionStore.walSequence,
walHash: b4a.from(storage.transactionStore.walHash)
}
} finally {
await storage.close()
}
const floor = await openBlindStoreGenerationFloor(controlDirectory, {
manifestKey,
storeIdentity: binding,
allowCreate: true,
storeEvidence
})
floor.assertReaderMode(storeReaderMode)
return Object.freeze({
bindingCreated,
storeEvidence: Object.freeze({
walSequence: storeEvidence.walSequence,
walHash: b4a.from(storeEvidence.walHash)
}),
firstBlindOnlyWriteAcknowledged: floor.firstBlindOnlyWriteAcknowledged
})
}
// Pre-flight the sealed two-slot manifest check (MAC + exact launch bindings)
// READ-ONLY (validationOnly), before any pristine-root mutation (runtime
// binding, fresh WAL, generation-floor record). requireManifestFloor serving
// must prove the store-genesis ceremony already sealed this root before it may
// be mutated; otherwise a serve against a pristine un-sealed root would bind
// it, write a fresh WAL and a generation-floor record, and only then discover
// the absent manifest — fencing the root against the later correct ceremony
// (adversarial finding F-01). This check mutates nothing: an absent manifest
// (missing control root or no valid slot) fails coded
// BLIND_RUNTIME_MANIFEST_REQUIRED; a forged or binding-mismatched manifest
// propagates the manifest store's coded integrity error. The root stays
// pristine so the correct ceremony still succeeds on it afterwards.
async function preflightVnextManifestRequired ({ controlDirectory, manifestKey, expectedBindings }) {
const manifestStore = new TwoSlotManifestStore({ controlDirectory, manifestKey, expectedBindings })
try {
await manifestStore.open({ validationOnly: true })
await manifestStore.load()
} catch (error) {
if (error && (error.code === 'ENOENT' ||
(error.code === 'RECOVERY_GAP_READ_ONLY' && /no valid manifest slot/.test(error.message)))) {
runtimeFailure('BLIND_RUNTIME_MANIFEST_REQUIRED',
'the vNext public-test profile requires a sealed two-slot store manifest before any store mutation')
}
throw error
} finally {
await manifestStore.close().catch(() => {})
}
}
// Load the sealed two-slot store manifest and enforce its persisted descriptor
// floor against the activated chain head (#2 TWO_SLOT_MANIFEST runtime
// integration, #3 DESCRIPTOR_REFRESH persisted floor across restart). A
// presented descriptor below the persisted floor is a rollback (fail closed);
// an equal-sequence/different-hash is a fork (fail closed); a strictly newer
// descriptor is a signed refresh and the floor is advanced so the refresh
// itself persists across the next restart. The manifest must already exist
// (sealed by the store-genesis ceremony); load() fails closed when it is
// absent, forged, or binding-mismatched.
export async function enforceVnextManifestFloor ({
controlDirectory,
manifestKey,
expectedBindings,
descriptorSequence,
descriptorHash
}) {
const manifestStore = new TwoSlotManifestStore({ controlDirectory, manifestKey, expectedBindings })
await manifestStore.open()
try {
const snapshot = await manifestStore.load()
const floorSequence = snapshot.manifest.descriptorSequenceFloor
const floorHash = snapshot.manifest.descriptorHashFloor
if (descriptorSequence < floorSequence) {
runtimeFailure('BLIND_RUNTIME_DESCRIPTOR_FLOOR_ROLLBACK',
'activated descriptor is below the persisted two-slot manifest floor')
}
if (descriptorSequence === floorSequence && !b4a.equals(descriptorHash, floorHash)) {
runtimeFailure('BLIND_RUNTIME_DESCRIPTOR_FLOOR_FORK',
'activated descriptor forks the persisted two-slot manifest floor')
}
if (descriptorSequence > floorSequence || !b4a.equals(descriptorHash, floorHash)) {
// A signed descriptor refresh: persist the advanced floor so it survives
// the next restart. advance() owns manifestRevision/previousManifestHash/mac
// and re-asserts the (unchanged) launch bindings.
await manifestStore.advance(snapshot.hash, {
descriptorSequenceFloor: descriptorSequence,
descriptorHashFloor: b4a.from(descriptorHash)
})
}
return Object.freeze({
descriptorSequenceFloor: descriptorSequence,
descriptorHashFloor: b4a.from(descriptorHash)
})
} finally {
await manifestStore.close()
}
}
function verifyDetached (input) {
if (input.signal && input.signal.aborted) return false
try {
return sodium.crypto_sign_verify_detached(input.signature, input.payload, input.publicKey)
} catch {
return false
}
}
function currentSigner (secretKey, publicKey, inboxRuntimeEnabled, coreRuntimeEnabled) {
let closed = false
return Object.freeze({
async sign (input) {
if (closed || (input.signal && input.signal.aborted) ||
(input.domainId !== RESULT_SIGNATURE_DOMAIN_ID.HEALTH_RESULT &&
input.domainId !== RESULT_SIGNATURE_DOMAIN_ID.CELL_RECEIPT &&
input.domainId !== RESULT_SIGNATURE_DOMAIN_ID.BATCH_GET_RESULT &&
!(inboxRuntimeEnabled && INBOX_RESULT_SIGNATURE_DOMAIN_IDS.has(input.domainId)) &&
!(coreRuntimeEnabled && CORE_RESULT_SIGNATURE_DOMAIN_IDS.has(input.domainId))) ||
!b4a.equals(input.publicKey, publicKey)) {
runtimeFailure('BLIND_RUNTIME_SIGNING_REFUSED', 'runtime signer refused an unbound signing request')
}
const signature = b4a.alloc(sodium.crypto_sign_BYTES)
sodium.crypto_sign_detached(signature, input.payload, secretKey)
return signature
},
async verify (input) {
return verifyDetached(input)
},
close () {
closed = true
secretKey.fill(0)
}
})
}
function describeResultVerifier () {
return Object.freeze({
async verify (input) {
if (input.signal && input.signal.aborted) return false
if (input.familyId !== FAMILY.DESCRIBE || !input.result || !input.result.relayPublicKey ||
!input.result.signature || input.result.signature.byteLength !== sodium.crypto_sign_BYTES ||
input.canonicalResultBytes.byteLength <= sodium.crypto_sign_BYTES) return false
if (input.operationId === OPERATION.DESCRIBE.GET &&
input.resultSignatureDomainId !== RESULT_SIGNATURE_DOMAIN_ID.DESCRIPTOR) return false
if (input.operationId === OPERATION.DESCRIBE.CHALLENGE &&
input.resultSignatureDomainId !== RESULT_SIGNATURE_DOMAIN_ID.HEALTH_RESULT) return false
if (input.operationId === OPERATION.DESCRIBE.ADMISSION_PARAMETERS &&
input.resultSignatureDomainId !== RESULT_SIGNATURE_DOMAIN_ID.ADMISSION_PARAMETERS) return false
const unsigned = input.canonicalResultBytes.subarray(0,
input.canonicalResultBytes.byteLength - sodium.crypto_sign_BYTES)
const trailing = input.canonicalResultBytes.subarray(unsigned.byteLength)
if (!b4a.equals(trailing, input.result.signature)) return false
let payload
try {
payload = resultSignaturePayload(input.resultSignatureDomainId, unsigned)
} catch {
return false
}
return sodium.crypto_sign_verify_detached(input.result.signature, payload, input.result.relayPublicKey)
}
})
}
function unavailableHook (method, label) {
return Object.freeze({
async [method] () {
runtimeFailure('INTERNAL', `${label} is deliberately unavailable in the signed DESCRIBE-only runtime`)
}
})
}
function cellHook (adapterHook, method, label) {
const unavailable = unavailableHook(method, label)
return Object.freeze({
async [method] (input) {
if (input && input.profile && input.profile.familyId === FAMILY.CELL) {
return adapterHook[method](input)
}
return unavailable[method](input)
}
})
}
function inboxHook (adapterHook, method, label) {
const unavailable = unavailableHook(method, label)
return Object.freeze({
async [method] (input) {
if (input && input.profile && input.profile.familyId === FAMILY.INBOX) {
return adapterHook[method](input)
}
return unavailable[method](input)
}
})
}
function coreHook (adapterHook, method, label) {
const unavailable = unavailableHook(method, label)
return Object.freeze({
async [method] (input) {
if (input && input.profile && input.profile.familyId === FAMILY.CORE) {
return adapterHook[method](input)
}
return unavailable[method](input)
}
})
}
function cellInboxCoreHook (cellAdapter, inboxAdapter, coreAdapter, hookField, method, label) {
const cell = cellAdapter == null ? null : cellHook(cellAdapter[hookField], method, label)
const inbox = inboxAdapter == null ? null : inboxHook(inboxAdapter[hookField], method, label)
const core = coreAdapter == null ? null : coreHook(coreAdapter[hookField], method, label)
const unavailable = unavailableHook(method, label)
return Object.freeze({
async [method] (input) {
const familyId = input && input.profile && input.profile.familyId
if (familyId === FAMILY.CELL && cell) return cell[method](input)
if (familyId === FAMILY.INBOX && inbox) return inbox[method](input)
if (familyId === FAMILY.CORE && core) return core[method](input)
return unavailable[method](input)
}
})
}
function cellInboxCoreTransactionCoordinator (cellAdapter, inboxAdapter, coreAdapter) {
const coordinatorFor = input => {
const familyId = input && input.profile && input.profile.familyId
if (familyId === FAMILY.CELL) return cellAdapter.transactionCoordinator
if (familyId === FAMILY.INBOX && inboxAdapter) return inboxAdapter.transactionCoordinator
if (familyId === FAMILY.CORE && coreAdapter) return coreAdapter.transactionCoordinator
return null
}
const invoke = method => (input, ...rest) => {
const coordinator = coordinatorFor(input)
if (!coordinator) runtimeFailure('INTERNAL', `admission transaction reached an unwired family at ${method}`)
return coordinator[method](input, ...rest)
}
return Object.freeze({
lookup: invoke('lookup'),
run: invoke('run'),
replay: invoke('replay')
})
}
function cellInboxCoreOperationExecutor (cellAdapter, inboxAdapter, coreAdapter) {
return Object.freeze({
...cellInboxCoreHook(cellAdapter, inboxAdapter, coreAdapter, 'operationExecutor', 'execute',
'non-CELL/INBOX/CORE operation executor'),
...(cellAdapter == null
? {}
: {
stageAtomicPut: input => cellAdapter.operationExecutor.stageAtomicPut(input),
commitAtomicPut: input => cellAdapter.operationExecutor.commitAtomicPut(input),
cancelAtomicPut: input => cellAdapter.operationExecutor.cancelAtomicPut(input)
})
})
}
function describeAndCellResultVerifier (cellAdapter) {
const describe = describeResultVerifier()
return Object.freeze({
async verify (input) {
if (input && input.familyId === FAMILY.DESCRIBE) return describe.verify(input)
if (input && input.familyId === FAMILY.CELL) return cellAdapter.resultVerifier.verify(input)
return false
}
})
}
function describeCellInboxResultVerifier (cellAdapter, inboxAdapter) {
const describeAndCell = describeAndCellResultVerifier(cellAdapter)
return Object.freeze({
async verify (input) {
if (input && input.familyId === FAMILY.INBOX) return inboxAdapter.resultVerifier.verify(input)
return describeAndCell.verify(input)
}
})
}
function describeCellInboxCoreResultVerifier (cellAdapter, inboxAdapter, coreAdapter) {
const describeCellInbox = describeCellInboxResultVerifier(cellAdapter, inboxAdapter)
return Object.freeze({
async verify (input) {
if (input && input.familyId === FAMILY.CORE) return coreAdapter.resultVerifier.verify(input)
return describeCellInbox.verify(input)
}
})
}
// The pinned upstream blind-peer authority (signed-head proof authority and
// Hypercore interop stack) is not assembled. MIRROR still durably accepts its
// sponsorship and records the recoverable RETRY_PENDING activation state;
// PROVE only serves an ACTIVE sponsored generation, which this authority can
// never produce, so it fails before any spend reaches it.
function unavailableCoreUpstream () {
return Object.freeze({
async activateMirror () {
runtimeFailure('INTERNAL', 'upstream CORE activation is unavailable until the pinned blind-peer authority is assembled')
},
async serveProof () {
runtimeFailure('INTERNAL', 'upstream CORE proof authority is unavailable until the pinned blind-peer authority is assembled')
},
async estimateProofBytes () {
runtimeFailure('INTERNAL', 'upstream CORE proof estimate is unavailable until the pinned blind-peer authority is assembled')
}
})
}
function currentUnixMillis () {
return BigInt(Date.now())
}
function currentLeaseEpoch () {
return Math.floor(Date.now() / SIX_HOURS_MILLIS)
}
function sameNumberSet (left, right) {
return left.length === right.length && left.every((value, index) => value === right[index])
}
function assertRuntimeDescriptor (snapshot, bootstrap, config, cellRuntimeEnabled, inboxRuntimeEnabled, coreRuntimeEnabled) {
const descriptor = snapshot.descriptor
const expectedOperationBits = cellRuntimeEnabled
? inboxRuntimeEnabled
? coreRuntimeEnabled
? DESCRIBE_CELL_INBOX_CORE_OPERATION_BITS
: DESCRIBE_CELL_INBOX_OPERATION_BITS
: DESCRIBE_AND_CELL_OPERATION_BITS
: DESCRIBE_OPERATION_BITS
if (descriptor.storeLifecycleState !== STORE_LIFECYCLE_STATE.ACTIVE ||
descriptor.enabledOperationBits !== expectedOperationBits) {
runtimeFailure('BLIND_RUNTIME_DESCRIPTOR_UNSUPPORTED',
`production runtime requires an ACTIVE descriptor with exact enabled operation bits 0x${expectedOperationBits.toString(16)}`)
}
if (descriptor.durability.profileId !== 1) {
runtimeFailure('BLIND_RUNTIME_DESCRIPTOR_UNSUPPORTED',
'durability profile 2 is unavailable until its external journal and witness coordinator are assembled')
}
if (!b4a.equals(descriptor.build.storeFormatHash, descriptor.durability.storeFormatHash)) {
runtimeFailure('BLIND_RUNTIME_STORE_FORMAT_MISMATCH',
'signed build and durability profiles name different store-format authorities')
}
if (descriptor.capacityBand !== 0) {
runtimeFailure('BLIND_RUNTIME_DESCRIPTOR_UNSUPPORTED',
'runtime must not attest an unmeasured nonzero capacity band')
}
const endpointIds = descriptor.endpoints.map(endpoint => endpoint.endpointId)
if (!sameNumberSet(endpointIds, bootstrap.endpointIds)) {
runtimeFailure('BLIND_RUNTIME_TOPOLOGY_MISMATCH',
'signed descriptor endpoints must equal the signed local launch endpoint set')
}
for (let index = 0; index < descriptor.endpoints.length; index++) {
const endpoint = descriptor.endpoints[index]
const support = config.endpointSupportBindings[index]
const expectedRoleBits = cellRuntimeEnabled
? ENDPOINT_ROLE.DESCRIPTOR_DISCOVERY | ENDPOINT_ROLE.STORAGE | ENDPOINT_ROLE.QUOTA_REDEEMER
: ENDPOINT_ROLE.DESCRIPTOR_DISCOVERY
if (endpoint.roleBits !== expectedRoleBits ||
endpoint.transportId !== TRANSPORT_ID.HTTPS_DIRECT ||
support.transportSupportBit !== TRANSPORT_SUPPORT.DIRECT_HTTP) {
runtimeFailure('BLIND_RUNTIME_DESCRIPTOR_UNSUPPORTED',
'runtime endpoint roles and HTTPS_DIRECT/DIRECT_HTTP support must equal the assembled family surface')
}
}
}
function assertDescribeResponseFit (snapshot, descriptorBytes, parameterBytes) {
const descriptor = snapshot.descriptor
const healthBytes = encodeCanonical(blindHealthResultV1, {
version: 1,
relayPublicKey: descriptor.relayPublicKey,
storeId: descriptor.storeId,
descriptorSequence: descriptor.descriptorSequence,
descriptorHash: snapshot.hash,
endpointId: descriptor.endpoints[0].endpointId,
transportSupportBit: TRANSPORT_SUPPORT.DIRECT_HTTP,
durabilityContinuityHash: descriptor.durabilityContinuityHash,
durabilityProfileHash: descriptor.durabilityProfileHash,
clientNonce: b4a.alloc(32, 1),
readyRoleBits: ENDPOINT_ROLE.DESCRIPTOR_DISCOVERY,
readyOperationBits: DESCRIBE_OPERATION_BITS,
clockState: HEALTH_CLOCK_STATE.READY,
effectiveEpochFloor: descriptor.issuedEpoch,
integrityState: HEALTH_INTEGRITY_STATE.DEGRADED,
checkpointAgeBand: 0,
scrubAgeBand: 0,
rebalanceState: HEALTH_REBALANCE_STATE.FENCED,
capacityBand: 0,
challengeEpoch: descriptor.issuedEpoch,
signature: b4a.alloc(64)
})
const maximumBodyBytes = Math.max(healthBytes.byteLength,
...descriptorBytes.map(bytes => bytes.byteLength), ...parameterBytes.map(bytes => bytes.byteLength))
if (descriptor.maxResponseBytes < maximumBodyBytes) {
runtimeFailure('BLIND_RUNTIME_DESCRIPTOR_UNSUPPORTED',
'signed maxResponseBytes cannot carry every configured DESCRIBE result')
}
const requiredOuterBytes = OUTER_ENVELOPE_HEADER_BYTES + DISPATCH_LIMITS.PREFIX_BYTES +
DISPATCH_LIMITS.HEADER_BYTES + maximumBodyBytes
for (const endpoint of descriptor.endpoints) {
const maximumOuterBytes = Object.entries(OUTER_CLASS).reduce((maximum, [id, bytes]) =>
(endpoint.envelopeClassBits & (1 << Number(id))) !== 0 ? Math.max(maximum, bytes) : maximum, 0)
if (maximumOuterBytes < requiredOuterBytes) {
runtimeFailure('BLIND_RUNTIME_DESCRIPTOR_UNSUPPORTED',
'endpoint envelope classes cannot carry every configured DESCRIBE result')
}
}
}
function assertDescriptorLaunchFloor (snapshot, config) {
if (snapshot.descriptorSequence !== config.expectedDescriptorSequence ||
!b4a.equals(snapshot.hash, config.expectedDescriptorHash)) {
runtimeFailure('BLIND_RUNTIME_DESCRIPTOR_FLOOR_MISMATCH',
'activated descriptor does not match the exact signed launch sequence/hash floor')
}
}
function contextAuthority (snapshot, supportByEndpoint, context) {
const endpoint = snapshot.descriptor.endpoints.find(entry => entry.endpointId === context.endpointId)
const supportBit = supportByEndpoint.get(context.endpointId)
if (!endpoint || context.transportId !== endpoint.transportId || context.transportSupportBit !== supportBit) {
runtimeFailure('TRANSPORT_UNSUPPORTED',
'private IPC context does not match its signed descriptor endpoint and explicit launch support bit')
}
return endpoint
}
export function productionStorageOperationalIntegrity (status) {
if (!status || typeof status !== 'object') {
throw new TypeError('production storage status is required')
}
const readOnly = status.state === 'READ_ONLY'
const operationalState = status.state === 'READY' || status.state === 'CLOCK_UNSAFE'
const formatBound = status.storeFormat?.bound === true
return Object.freeze({
fullStoreVerified: !readOnly && operationalState && formatBound,
integrityState: readOnly
? HEALTH_INTEGRITY_STATE.FAILED
: operationalState && formatBound
? HEALTH_INTEGRITY_STATE.VERIFIED
: HEALTH_INTEGRITY_STATE.DEGRADED
})
}
function storageDependencySnapshot (storage, enabledOperationBits, readyRoleBits, writeReadinessGuard = null, inboxReadinessGuard = null) {
return async input => {
const status = storage.status()
// Promotion blockers describe missing future surfaces (profile 2,
// rebalance, repair evidence, accelerated scrub). They are not evidence
// that this opened profile-1 store failed its own WAL/body verification.
// Keep those limitations visible through blockers/rebalanceState while
// deriving integrity only from the bound format and live store state.
const operationalIntegrity = productionStorageOperationalIntegrity(status)
const writeReady = writeReadinessGuard == null || writeReadinessGuard(input) === true
const inboxReady = inboxReadinessGuard == null || inboxReadinessGuard() === true
const readyOperationBits = writeReady
? enabledOperationBits
: enabledOperationBits & ~CELL_PUT_OPERATION_BIT_V2
return Object.freeze({
selfVerified: true,
descriptorSequence: input.descriptorSequence,
descriptorHash: b4a.from(input.descriptorHash),
endpointId: input.endpointId,
transportSupportBit: input.transportSupportBit,
fullStoreVerified: operationalIntegrity.fullStoreVerified,
readyRoleBits,
readyOperationBits: inboxReady
? readyOperationBits
: readyOperationBits & ~INBOX_OPERATION_BITS,
clockState: status.state === 'CLOCK_UNSAFE' ? HEALTH_CLOCK_STATE.UNSAFE : HEALTH_CLOCK_STATE.READY,
effectiveEpochFloor: status.epochFloor,
integrityState: operationalIntegrity.integrityState,
checkpointAgeBand: 0,
scrubAgeBand: 0,
rebalanceState: status.blockers.includes('ONLINE_REBALANCE_UNIMPLEMENTED')
? HEALTH_REBALANCE_STATE.FENCED
: HEALTH_REBALANCE_STATE.STABLE,
capacityBand: input.descriptor.capacityBand
})
}
}
function exactParameterHashes (snapshot, installed) {
const expected = snapshot.descriptor.admissionProfiles
.map(profile => b4a.toString(profile.parameterHash, 'hex')).sort()
const actual = installed.map(record => b4a.toString(record.hash, 'hex')).sort()
if (expected.length !== actual.length || expected.some((hash, index) => hash !== actual[index])) {
runtimeFailure('BLIND_RUNTIME_ADMISSION_MISMATCH',
'configured admission parameter files must equal the exact current signed descriptor profile set')
}
}
function admissionAdapterKey (input) {
return `${input.profileId}:${input.schemeId}:${b4a.toString(input.parameterHash, 'hex')}:${input.endpointId}`
}
function capturedAdmissionAdapter (adapter) {
if (!adapter || typeof adapter.prepare !== 'function' ||
typeof adapter.preparePreflight !== 'function' || typeof adapter.confirmAfterEof !== 'function') {
return null
}
const receiver = adapter
const prepare = adapter.prepare
const preparePreflight = adapter.preparePreflight
const confirmAfterEof = adapter.confirmAfterEof
return Object.freeze({
prepare: input => prepare.call(receiver, input),
preparePreflight: input => preparePreflight.call(receiver, input),
confirmAfterEof: input => confirmAfterEof.call(receiver, input)
})
}
async function captureCellPutAdmissionAdapters (resolver, snapshot, installed, options = {}) {
const strict = options.strict === true
const captured = new Map()
const required = []
for (const record of installed) {
if (!record.value.resourceCosts.some(row =>
row.familyId === FAMILY.CELL && row.operationId === OPERATION.CELL.PUT)) continue
for (const endpoint of snapshot.descriptor.endpoints) {
if ((record.value.roleBits & endpoint.roleBits) === 0) continue
required.push({ record, endpoint })
}
}
if (strict && required.length === 0) {
runtimeFailure('BLIND_RUNTIME_ADMISSION_CAPTURE_INCOMPLETE',
'strict CELL runtime requires at least one signed CELL.PUT admission profile')
}
let complete = required.length > 0
for (const { record, endpoint } of required) {
let adapter = null
try {
adapter = capturedAdmissionAdapter(await resolver({
profileId: record.value.profileId,
schemeId: record.value.schemeId,
parameterHash: b4a.from(record.hash),
descriptor: snapshot.descriptor,
parameters: record.value,
endpointId: endpoint.endpointId,
endpointRoleBits: endpoint.roleBits,
signal: null
}))
} catch (error) {
if (strict) throw error
}
if (adapter == null) {
if (strict) {
runtimeFailure('BLIND_RUNTIME_ADMISSION_ADAPTER_RESOLUTION_FAILED',
'strict CELL runtime could not capture one exact required admission adapter')
}
complete = false
continue
}
captured.set(admissionAdapterKey({
profileId: record.value.profileId,
schemeId: record.value.schemeId,
parameterHash: record.hash,
endpointId: endpoint.endpointId
}), adapter)
}
return Object.freeze({ captured, complete, required: required.length })
}
export async function assembleProductionBlindDaemon (options = {}) {
const bootstrap = options.bootstrap
if (!bootstrap || !Array.isArray(bootstrap.endpointIds) || !bootstrap.launchTopologyHash) {
throw new TypeError('validated daemon bootstrap configuration is required')
}
const releaseGate = options.releaseGate ||
productionReleaseGateFor(options.environment || process.env)
const strictAdmissionCapture = options.requireCompleteAdmissionCapture === true
if (options.requireCompleteAdmissionCapture != null &&
typeof options.requireCompleteAdmissionCapture !== 'boolean') {
throw new TypeError('requireCompleteAdmissionCapture must be a boolean')
}
// requireManifestFloor gates the vNext baseline two-slot manifest floor
// integration (#2/#3). cli.js sets it for the LIMITED_PUBLIC_TEST_V1 profile;
// it stays additive (off) for every other profile so existing manifest-less
// assembly paths are unchanged.
const requireManifestFloor = options.requireManifestFloor === true
if (options.requireManifestFloor != null &&
typeof options.requireManifestFloor !== 'boolean') {
throw new TypeError('requireManifestFloor must be a boolean')
}
const testOnlyReplayJournalOptions = options.testOnlyPrivateIpcReplayJournalOptions
if (testOnlyReplayJournalOptions != null) {
if (isProductionReleaseGate(releaseGate) ||
!testOnlyReplayJournalOptions || typeof testOnlyReplayJournalOptions !== 'object' ||
Array.isArray(testOnlyReplayJournalOptions)) {
runtimeFailure('BLIND_RUNTIME_TEST_SEAM_FORBIDDEN',
'private IPC replay journal overrides are available only behind an explicit non-production release gate')
}
const unknown = Object.keys(testOnlyReplayJournalOptions).find(key =>
!['monotonicMillis', 'faultInjector', 'compactionRecordLimit'].includes(key))
if (unknown) {
runtimeFailure('BLIND_RUNTIME_TEST_SEAM_FORBIDDEN',
`unknown private IPC replay journal test override ${unknown}`)
}
}
await releaseGate()
const cellRuntimeEnabled = options.enableCellRuntime === true
const inboxRuntimeEnabled = options.enableInboxRuntime === true
const coreRuntimeEnabled = options.enableCoreRuntime === true
if (inboxRuntimeEnabled && !cellRuntimeEnabled) {
runtimeFailure('BLIND_RUNTIME_INBOX_CELL_RUNTIME_REQUIRED',
'INBOX runtime assembly requires the assembled CELL runtime line')
}
if (coreRuntimeEnabled && !inboxRuntimeEnabled) {
runtimeFailure('BLIND_RUNTIME_CORE_INBOX_RUNTIME_REQUIRED',
'CORE runtime assembly requires the assembled INBOX runtime line')
}
if (cellRuntimeEnabled && typeof options.resolveAdmissionAdapter !== 'function') {
runtimeFailure('BLIND_RUNTIME_ADMISSION_ADAPTER_REQUIRED',
'CELL runtime assembly requires an explicit admission adapter resolver')
}
if (strictAdmissionCapture && !cellRuntimeEnabled) {
runtimeFailure('BLIND_RUNTIME_ADMISSION_CAPTURE_INCOMPLETE',
'strict admission capture requires an enabled CELL runtime')
}
const config = options.runtimeConfig || loadProductionRuntimeConfig(options.environment, bootstrap.endpointIds)
if (inboxRuntimeEnabled) {
if (config.inboxStoreRoot == null || config.inboxCursorKeyFile == null) {
runtimeFailure('BLIND_RUNTIME_CONFIG_INVALID',
'INBOX runtime assembly requires HIVERELAY_BLIND_INBOX_STORE_ROOT and HIVERELAY_BLIND_INBOX_CURSOR_KEY_FILE')
}
if (config.inboxStoreRoot === config.storeRoot ||
config.inboxStoreRoot.startsWith(`${config.storeRoot}${path.sep}`) ||
config.storeRoot.startsWith(`${config.inboxStoreRoot}${path.sep}`) ||
(config.privateIpcReplayRoot != null &&
(config.inboxStoreRoot === config.privateIpcReplayRoot ||
config.inboxStoreRoot.startsWith(`${config.privateIpcReplayRoot}${path.sep}`) ||
config.privateIpcReplayRoot.startsWith(`${config.inboxStoreRoot}${path.sep}`)))) {
runtimeFailure('BLIND_RUNTIME_INBOX_STORE_ROOT_OVERLAP',
'INBOX store root must be disjoint from the cell store and replay journal roots')
}
}
if (coreRuntimeEnabled) {
if (config.coreStoreRoot == null) {
runtimeFailure('BLIND_RUNTIME_CONFIG_INVALID',
'CORE runtime assembly requires HIVERELAY_BLIND_CORE_STORE_ROOT')
}
const overlapsCoreRoot = root =>
config.coreStoreRoot === root ||
config.coreStoreRoot.startsWith(`${root}${path.sep}`) ||
root.startsWith(`${config.coreStoreRoot}${path.sep}`)
if (overlapsCoreRoot(config.storeRoot) || overlapsCoreRoot(config.inboxStoreRoot) ||
(config.privateIpcReplayRoot != null && overlapsCoreRoot(config.privateIpcReplayRoot))) {
runtimeFailure('BLIND_RUNTIME_CORE_STORE_ROOT_OVERLAP',
'CORE store root must be disjoint from the cell store, inbox store, and replay journal roots')
}
}
let secretKey
let signer
let storage
let inboxStorage
let inboxCursorKey
let coreStorage
let privateIpcReplayJournal
let privateIpcReplayFailure = null
let durableReplayAuthority
let readiness
let daemon
let runtime
let cellAdapter
let inboxAdapter
let coreAdapter
let manifestFloorState = null
try {
const descriptorBytes = await Promise.all(config.descriptorFiles.map((file, index) => readBoundFile(file, {
field: `descriptorFiles[${index}]`,
maximumBytes: 16 * 1024
})))
// Boot order (FLEET-DURABILITY-P1-1): activate the configured chain; only
// when a historical link's window lapsed (EXPIRED) and the manifest floor
// is required does the MAC-verified floor restore run — every other
// failure keeps failing closed here exactly as before.
const activation = await activateVnextBootDescriptorChain({
descriptorBytes,
config,
requireManifestFloor
})
const descriptorState = activation.descriptorState
const descriptorSnapshot = activation.snapshot
const descriptorRestoredFromFloor = activation.restoredFromFloor
assertDescriptorLaunchFloor(descriptorSnapshot, config)
assertRuntimeDescriptor(descriptorSnapshot, bootstrap, config, cellRuntimeEnabled, inboxRuntimeEnabled,
coreRuntimeEnabled)
const storeFormatAuthority = await loadBundledBlindStoreFormatAuthority({
expectedStoreFormatHash: descriptorSnapshot.descriptor.durability.storeFormatHash,
expectedFormatMajor: descriptorSnapshot.descriptor.durability.storeFormatMajor,
expectedFormatMinor: descriptorSnapshot.descriptor.durability.storeFormatMinor
})
secretKey = await readBoundFile(config.relaySecretKeyFile, {
field: 'relay secret key',
exactBytes: sodium.crypto_sign_SECRETKEYBYTES,
maximumBytes: sodium.crypto_sign_SECRETKEYBYTES,
secret: true
})
const derivedPublicKey = b4a.alloc(sodium.crypto_sign_PUBLICKEYBYTES)
sodium.crypto_sign_ed25519_sk_to_pk(derivedPublicKey, secretKey)
if (!b4a.equals(derivedPublicKey, descriptorSnapshot.descriptor.relayPublicKey)) {
runtimeFailure('BLIND_RUNTIME_SIGNING_KEY_MISMATCH',
'relay signing secret does not match the current signed descriptor relay key')
}
signer = currentSigner(secretKey, derivedPublicKey, inboxRuntimeEnabled, coreRuntimeEnabled)
const postEofAuthorityIssuer = createDaemonPrivatePostEofAuthorityIssuer()
let admissionResolver = options.resolveAdmissionAdapter || (async () => null)
const admission = new AdmissionCoordinator({
descriptorState,
verifySignature: verifyDetached,
resolveAdapter: input => admissionResolver(input),
consumePostEofAuthority: input => postEofAuthorityIssuer.consume(input)
})
const parameterBytes = await Promise.all(config.admissionParameterFiles.map((file, index) => readBoundFile(file, {
field: `admissionParameterFiles[${index}]`,
maximumBytes: 1024 * 1024
})))
const installedParameters = []
for (const bytes of parameterBytes) installedParameters.push(await admission.installParameters(bytes))
exactParameterHashes(descriptorSnapshot, installedParameters)
if (!admission.descriptorParametersAvailable(descriptorSnapshot)) {
runtimeFailure('BLIND_RUNTIME_ADMISSION_MISMATCH', 'current signed admission parameters are unavailable')
}
const admissionCapture = cellRuntimeEnabled
? await captureCellPutAdmissionAdapters(admissionResolver, descriptorSnapshot, installedParameters, {
strict: strictAdmissionCapture
})
: Object.freeze({ captured: new Map(), complete: false, required: 0 })
if (cellRuntimeEnabled) {
if (strictAdmissionCapture) {
admissionResolver = input => {
const captured = admissionCapture.captured.get(admissionAdapterKey(input))
if (captured == null) {
runtimeFailure('BLIND_RUNTIME_ADMISSION_ADAPTER_RESOLUTION_FAILED',
'strict CELL runtime forbids live fallback outside its startup adapter capture')
}
return captured
}
} else {
const fallbackResolver = admissionResolver
admissionResolver = input => admissionCapture.captured.get(admissionAdapterKey(input)) ||
fallbackResolver(input)
}
}
assertDescribeResponseFit(descriptorSnapshot, descriptorBytes, parameterBytes)
const manifestKey = await readBoundFile(config.storeManifestKeyFile, {
field: 'store manifest key', exactBytes: 32, maximumBytes: 32, secret: true
})
let ownerFenceTokenHash
try {
ownerFenceTokenHash = await readBoundFile(config.ownerFenceTokenHashFile, {
field: 'owner fence token hash', exactBytes: 32, maximumBytes: 32, secret: true
})
await verifyPrivateStoreRoot(config.storeRoot)
if (requireManifestFloor) {
// F-01: pre-flight the sealed-manifest MAC/binding check READ-ONLY before
// any pristine-root mutation (runtime binding, WAL, generation-floor
// record). A serve against a pristine un-sealed root fails coded here
// without mutating it, so the later correct ceremony still succeeds.
await preflightVnextManifestRequired({
controlDirectory: path.join(config.storeRoot, 'control'),
manifestKey,
expectedBindings: vnextStoreGenesisExpectedBindings(
descriptorSnapshot.descriptor, descriptorSnapshot.hash, config.mapGeneration, ownerFenceTokenHash)
})
}
const binding = encodeRuntimeBinding(descriptorSnapshot.descriptor, config.mapGeneration,
ownerFenceTokenHash, manifestKey)
const storeBindingCreated = await bindStoreIdentity(config.storeRoot, binding)
let storeFloor = null
storage = new BlindCellStorageEngine({
root: config.storeRoot,
relayPublicKey: descriptorSnapshot.descriptor.relayPublicKey,
storeId: descriptorSnapshot.descriptor.storeId,
durabilityProfileId: descriptorSnapshot.descriptor.durability.profileId,
durabilityProfileHash: descriptorSnapshot.descriptor.durabilityProfileHash,
mapGeneration: config.mapGeneration,
ownerFenceTokenHash,
durabilityContinuityHash: descriptorSnapshot.descriptor.durabilityContinuityHash,
storeFormatAuthority,
onBlindWriteAcknowledged: evidence => storeFloor.acknowledgeBlindOnlyWrite(evidence)
})
await storage.open()
storeFloor = await openBlindStoreGenerationFloor(path.join(config.storeRoot, 'control'), {
manifestKey,
storeIdentity: binding,
allowCreate: storeBindingCreated,
storeEvidence: { walSequence: storage.transactionStore.walSequence, walHash: storage.transactionStore.walHash }
})
storeFloor.assertReaderMode(config.storeReaderMode)
if (requireManifestFloor) {
// #2 TWO_SLOT_MANIFEST runtime integration + #3 persisted descriptor
// floor: load the sealed two-slot manifest from the cell store control
// directory and enforce/advance its descriptor floor against the
// activated chain head. Fails closed when the manifest is absent,
// forged, or the presented descriptor rolls back/forks the floor.
manifestFloorState = await enforceVnextManifestFloor({
controlDirectory: path.join(config.storeRoot, 'control'),
manifestKey,
expectedBindings: vnextStoreGenesisExpectedBindings(
descriptorSnapshot.descriptor, descriptorSnapshot.hash, config.mapGeneration, ownerFenceTokenHash),
descriptorSequence: descriptorSnapshot.descriptorSequence,
descriptorHash: descriptorSnapshot.hash
})
}
if (inboxRuntimeEnabled) {
await verifyPrivateStoreRoot(config.inboxStoreRoot)
const inboxBindingCreated = await bindStoreIdentity(config.inboxStoreRoot, binding)
let inboxFloor = null
inboxCursorKey = await readBoundFile(config.inboxCursorKeyFile, {
field: 'inbox cursor key',
exactBytes: 32,
maximumBytes: 32,
secret: true
})
inboxStorage = new BlindInboxStorageEngine({
root: config.inboxStoreRoot,
relayPublicKey: descriptorSnapshot.descriptor.relayPublicKey,
storeId: descriptorSnapshot.descriptor.storeId,
durabilityProfileId: descriptorSnapshot.descriptor.durability.profileId,
durabilityProfileHash: descriptorSnapshot.descriptor.durabilityProfileHash,
cursorKey: inboxCursorKey,
mapGeneration: config.mapGeneration,
ownerFenceTokenHash,
durabilityContinuityHash: descriptorSnapshot.descriptor.durabilityContinuityHash,
storeFormatAuthority,
onBlindWriteAcknowledged: evidence => inboxFloor.acknowledgeBlindOnlyWrite(evidence)
})
await inboxStorage.open()
inboxFloor = await openBlindStoreGenerationFloor(path.join(config.inboxStoreRoot, 'control'), {
manifestKey,
storeIdentity: binding,
allowCreate: inboxBindingCreated,
storeEvidence: {
walSequence: inboxStorage.transactionStore.walSequence,
walHash: inboxStorage.transactionStore.walHash
}
})
inboxFloor.assertReaderMode(config.storeReaderMode)
}
if (coreRuntimeEnabled) {
await verifyPrivateStoreRoot(config.coreStoreRoot)
const coreBindingCreated = await bindStoreIdentity(config.coreStoreRoot, binding)
let coreFloor = null
coreStorage = new BlindCoreStorageEngine({
root: config.coreStoreRoot,
relayPublicKey: descriptorSnapshot.descriptor.relayPublicKey,
ownerFenceTokenHash,
durabilityContinuityHash: descriptorSnapshot.descriptor.durabilityContinuityHash,
maximumSponsoredCoreLength: descriptorSnapshot.descriptor.maxSponsoredCoreLength,
nowEpoch: currentLeaseEpoch,
nowUnixMillis: currentUnixMillis,
onBlindWriteAcknowledged: evidence => coreFloor.acknowledgeBlindOnlyWrite(evidence)
})
await coreStorage.open()
coreFloor = await openBlindStoreGenerationFloor(path.join(config.coreStoreRoot, 'control'), {
manifestKey,
storeIdentity: binding,
allowCreate: coreBindingCreated,
storeEvidence: {
walSequence: coreStorage.transactionStore.walSequence,
walHash: coreStorage.transactionStore.walHash
}
})
coreFloor.assertReaderMode(config.storeReaderMode)
}
if (cellRuntimeEnabled) {
try {
if (config.privateIpcReplayRoot == null) {
runtimeFailure('PRIVATE_IPC_V2_REPLAY_JOURNAL_ROOT_UNCONFIGURED',
'private IPC replay journal root is not configured')
}
if (config.privateIpcReplayRoot === config.storeRoot ||
config.privateIpcReplayRoot.startsWith(`${config.storeRoot}${path.sep}`) ||
config.storeRoot.startsWith(`${config.privateIpcReplayRoot}${path.sep}`)) {
runtimeFailure('PRIVATE_IPC_V2_REPLAY_JOURNAL_ROOT_OVERLAP',
'private IPC replay journal and blind store roots must be disjoint')
}
privateIpcReplayJournal = await openPrivateIpcReplayJournalV2({
root: config.privateIpcReplayRoot,
manifestKey,
launchTopologyHash: bootstrap.launchTopologyHash,
relayPublicKey: descriptorSnapshot.descriptor.relayPublicKey,
storeId: descriptorSnapshot.descriptor.storeId,
durabilityContinuityHash: descriptorSnapshot.descriptor.durabilityContinuityHash,
durabilityProfileHash: descriptorSnapshot.descriptor.durabilityProfileHash,
storeFormatHash: descriptorSnapshot.descriptor.durability.storeFormatHash,
mapGeneration: config.mapGeneration,
ownerFenceTokenHash,
...(testOnlyReplayJournalOptions || {})
})
durableReplayAuthority = createPrivateIpcReplayReservationAuthorityV2(
privateIpcReplayJournal)
} catch (error) {
privateIpcReplayFailure = Object.freeze({
state: 'UNAVAILABLE',
ready: false,
reason: typeof error?.code === 'string'
? error.code
: 'PRIVATE_IPC_V2_REPLAY_JOURNAL_OPEN_FAILED',
recovery: 'OPERATOR_REPLAY_JOURNAL_REPAIR_OR_MIGRATION_AND_RESTART_REQUIRED'
})
if (typeof options.onError === 'function') {
try {
options.onError(error)
} catch {}
}
}
}
} finally {
manifestKey.fill(0)
if (ownerFenceTokenHash) ownerFenceTokenHash.fill(0)
if (inboxCursorKey) inboxCursorKey.fill(0)
}
const durableReplayReady = Boolean(durableReplayAuthority &&
typeof durableReplayAuthority.reserve === 'function')
const v2WritePathAssembled = cellRuntimeEnabled && admissionCapture.complete
const v2WritePathReady = v2WritePathAssembled && durableReplayReady
const assembledOperationBits = cellRuntimeEnabled
? inboxRuntimeEnabled
? coreRuntimeEnabled
? DESCRIBE_CELL_INBOX_CORE_OPERATION_BITS
: DESCRIBE_CELL_INBOX_OPERATION_BITS
: DESCRIBE_AND_CELL_OPERATION_BITS
: DESCRIBE_OPERATION_BITS
const enabledOperationBits = cellRuntimeEnabled && !v2WritePathReady
? assembledOperationBits ^ CELL_PUT_OPERATION_BIT_V2
: assembledOperationBits
const readyRoleBits = cellRuntimeEnabled
? ENDPOINT_ROLE.DESCRIPTOR_DISCOVERY | ENDPOINT_ROLE.STORAGE | ENDPOINT_ROLE.QUOTA_REDEEMER
: ENDPOINT_ROLE.DESCRIPTOR_DISCOVERY
readiness = new ReadinessCoordinator({
descriptorState,
admission,
dependencySnapshot: storageDependencySnapshot(storage, enabledOperationBits, readyRoleBits, () => {
const current = descriptorState.state().snapshot
return v2WritePathReady && current &&
current.descriptorSequence === descriptorSnapshot.descriptorSequence &&
b4a.equals(current.hash, descriptorSnapshot.hash) &&
privateIpcReplayJournal != null &&
privateIpcReplayJournalV2Status(privateIpcReplayJournal).ready
}, inboxRuntimeEnabled
? () => {
const inboxStatus = inboxStorage.status()
return inboxStatus.opened === true && inboxStatus.readOnlyReason == null
}
: null),
signer
})
const budget = new ResourceBudget(config.resourceBudget)
if (cellRuntimeEnabled) {
cellAdapter = new BlindCellRuntimeAdapter({ storage, descriptorState, signer })
}
if (inboxRuntimeEnabled) {
inboxAdapter = new BlindInboxRuntimeAdapter({ storage: inboxStorage, descriptorState, signer })
}
if (coreRuntimeEnabled) {
coreAdapter = new BlindCoreRuntimeAdapter({
storage: coreStorage,
descriptorState,
signer,
upstream: unavailableCoreUpstream()
})
}
const familyHook = (hookField, method, label) =>
cellInboxCoreHook(cellAdapter, inboxAdapter, coreAdapter, hookField, method, label)
const coordinator = new BlindOperationCoordinator({
descriptorState,
admission,
readiness,
budget,
relationVerifier: cellRuntimeEnabled
? familyHook('relationVerifier', 'verify', 'non-CELL/INBOX/CORE relation verifier')
: unavailableHook('verify', 'non-DESCRIBE relation verifier'),
capabilityVerifier: cellRuntimeEnabled
? familyHook('capabilityVerifier', 'verify', 'non-CELL/INBOX/CORE capability verifier')
: unavailableHook('verify', 'non-DESCRIBE capability verifier'),
cheapStateVerifier: cellRuntimeEnabled
? familyHook('cheapStateVerifier', 'inspect', 'non-CELL/INBOX/CORE state inspector')
: unavailableHook('inspect', 'non-DESCRIBE state inspector'),
terminalStateVerifier: cellRuntimeEnabled
? familyHook('terminalStateVerifier', 'check', 'non-CELL/INBOX/CORE terminal-state verifier')
: unavailableHook('check', 'non-DESCRIBE terminal-state verifier'),
capacityGuard: cellRuntimeEnabled
? familyHook('capacityGuard', 'check', 'non-CELL/INBOX/CORE capacity guard')
: unavailableHook('check', 'non-DESCRIBE capacity guard'),
operationExecutor: cellRuntimeEnabled
? cellInboxCoreOperationExecutor(cellAdapter, inboxAdapter, coreAdapter)
: unavailableHook('execute', 'non-DESCRIBE operation executor'),
transactionCoordinator: cellRuntimeEnabled
? cellInboxCoreTransactionCoordinator(cellAdapter, inboxAdapter, coreAdapter)
: null,
resultVerifier: cellRuntimeEnabled
? inboxRuntimeEnabled
? coreRuntimeEnabled
? describeCellInboxCoreResultVerifier(cellAdapter, inboxAdapter, coreAdapter)
: describeCellInboxResultVerifier(cellAdapter, inboxAdapter)
: describeAndCellResultVerifier(cellAdapter)
: describeResultVerifier(),
authenticatedSessionVerifier: unavailableHook('verify', 'non-DESCRIBE authenticated session verifier')
})
const supportByEndpoint = new Map(config.endpointSupportBindings
.map(row => [row.endpointId, row.transportSupportBit]))
const readinessSnapshot = input => {
const supportBit = supportByEndpoint.get(input.endpointId)
if (!supportBit || !b4a.equals(input.launchTopologyHash, bootstrap.launchTopologyHash)) {
runtimeFailure('BLIND_RUNTIME_TOPOLOGY_MISMATCH', 'readiness request is outside the signed launch topology')
}
return readiness.serverSnapshot({
...input,
transportSupportBit: supportBit
})
}
const dispatch = (frame, context) => {
contextAuthority(descriptorSnapshot, supportByEndpoint, context)
return coordinator.dispatch(frame, context)
}
const dispatchStagedPut = v2WritePathAssembled
? (staged, context) => {
contextAuthority(descriptorSnapshot, supportByEndpoint, context)
return coordinator.dispatchStagedCellPut(staged, context)
}
: null
const streamTransportProfileHashForEndpoint = v2WritePathAssembled
? input => b4a.from(contextAuthority(descriptorSnapshot, supportByEndpoint, input).transportProfileHash)
: null
const writeReadinessProjection = v2WritePathAssembled
? async input => {
const supportBit = supportByEndpoint.get(input.endpointId)
if (!supportBit || supportBit !== TRANSPORT_SUPPORT.DIRECT_HTTP ||
!b4a.equals(input.launchTopologyHash, bootstrap.launchTopologyHash)) {
runtimeFailure('BLIND_RUNTIME_TOPOLOGY_MISMATCH',
'V2 write readiness is outside the exact production topology')
}
const state = await readiness.evaluate({
endpointId: input.endpointId,
transportSupportBit: supportBit,
signal: input.signal
})
const storageStatus = storage.status()
const replayStatus = privateIpcReplayJournal == null
? privateIpcReplayFailure
: privateIpcReplayJournalV2Status(privateIpcReplayJournal)
const current = descriptorState.state().snapshot
const captureCurrent = current &&
current.descriptorSequence === descriptorSnapshot.descriptorSequence &&
b4a.equals(current.hash, descriptorSnapshot.hash)
const expiresMonotonicMillis = input.absoluteDeadlineMonotonicMillis - 1n
return Object.freeze({
selfVerified: state.kind === READINESS_STATE_KIND.READY,
cellRuntimeReady: captureCurrent && state.kind === READINESS_STATE_KIND.READY &&
(state.readyOperationBits & CELL_PUT_OPERATION_BIT_V2) !== 0,
storageReady: storageStatus.state === 'READY',
admissionReady: captureCurrent && admissionCapture.complete,
replayJournalReady: replayStatus?.ready === true &&
replayStatus.occupied < replayStatus.capacity,
endpointId: input.endpointId,
launchTopologyHash: b4a.from(bootstrap.launchTopologyHash),
transportProfileHash: b4a.from(input.transportProfileHash),
descriptorSequence: descriptorSnapshot.descriptorSequence,
descriptorHash: b4a.from(descriptorSnapshot.hash),
descriptorRoleBits: descriptorSnapshot.descriptor.endpoints.find(
endpoint => endpoint.endpointId === input.endpointId).roleBits,
descriptorEnabledOperationBits: descriptorSnapshot.descriptor.enabledOperationBits,
readyRoleBits: state.kind === READINESS_STATE_KIND.READY ? state.readyRoleBits : 0,
readyOperationBits: state.kind === READINESS_STATE_KIND.READY ? state.readyOperationBits : 0,
readyWriteOperationBits: state.kind === READINESS_STATE_KIND.READY
? state.readyOperationBits & CELL_PUT_OPERATION_BIT_V2
: 0,
readyIpcFeatureBits: REQUIRED_LOCAL_IPC_FEATURE_BITS_V2,
expiresMonotonicMillis,
descriptorExpiresMonotonicMillis: input.absoluteDeadlineMonotonicMillis
})
}
: null
daemon = new BlindDaemon({
...bootstrap,
...config.server,
dispatch,
dispatchStagedPut,
postEofAuthorityIssuer,
stagedPutRelayPublicKey: descriptorSnapshot.descriptor.relayPublicKey,
streamTransportProfileHashForEndpoint,
durableReplayAuthority,
writeReadinessProjection,
readinessSnapshot,
releaseGate: async () => {},
onError: options.onError
})
let started = false
let closed = false
let closePromise = null
const publicExecutionAssembled = value =>
(v2WritePathReady &&
(value === 'CELL_PUBLIC_EXECUTION_UNASSEMBLED' ||
value === 'PRIVATE_CONTENT_STREAM_RUNTIME_UNASSEMBLED' ||
value === 'ADMISSION_REDEMPTION_ADAPTER_UNASSEMBLED')) ||
(inboxRuntimeEnabled && value === 'INBOX_PUBLIC_EXECUTION_UNASSEMBLED') ||
(coreRuntimeEnabled && value === 'CORE_PUBLIC_EXECUTION_UNASSEMBLED')
// #1/#2/#3 are genuinely assembled in this serving runtime once the
// two-slot manifest floor was loaded and enforced at startup
// (requireManifestFloor): the profile/descriptor/relay-identity binding was
// re-validated above and the persisted descriptor floor is now enforced and
// advanced across restarts. Non-vNext assemblies (manifestFloorState null)
// keep listing them, unchanged.
const manifestFloorAssembled = value =>
manifestFloorState != null &&
(value === 'FINAL_BUILD_PROFILE_LOCAL_BINDING_UNASSEMBLED' ||
value === 'TWO_SLOT_MANIFEST_RUNTIME_INTEGRATION_UNASSEMBLED' ||
value === 'DESCRIPTOR_REFRESH_PERSISTED_FLOOR_UNASSEMBLED')
const runtimeExclusions = cellRuntimeEnabled
? Object.freeze([
...PRODUCTION_RUNTIME_EXCLUSIONS.filter(value =>
!publicExecutionAssembled(value) && !manifestFloorAssembled(value)),
...BLIND_CELL_RUNTIME_BLOCKERS,
...(inboxRuntimeEnabled ? BLIND_INBOX_RUNTIME_BLOCKERS : []),
...(coreRuntimeEnabled ? BLIND_CORE_RUNTIME_BLOCKERS : [])
])
: PRODUCTION_RUNTIME_EXCLUSIONS
runtime = Object.freeze({
descriptorState,
admission,
readiness,
budget,
coordinator,
cellAdapter,
inboxAdapter,
coreAdapter,
storage,
inboxStorage,
coreStorage,
...(testOnlyReplayJournalOptions == null
? {}
: { testOnlyDurableReplayAuthority: durableReplayAuthority }),
daemon,
exclusions: runtimeExclusions,
async start () {
if (closed) throw new Error('blind production runtime is closed')
if (!started) {
await daemon.start()
started = true
}
return runtime
},
close () {
if (closePromise) return closePromise
closed = true
readiness.close()
closePromise = (async () => {
let failure = null
try {
await daemon.close()
} catch (error) {
failure = error
}
try {
if (privateIpcReplayJournal) {
await closePrivateIpcReplayJournalV2(privateIpcReplayJournal)
}
} catch (error) {
failure = failure || error
}
try {
if (coreStorage) await coreStorage.close()
} catch (error) {
failure = failure || error
}
try {
if (inboxStorage) await inboxStorage.close()
} catch (error) {
failure = failure || error
}
try {
await storage.close()
} catch (error) {
failure = failure || error
} finally {
signer.close()
}
if (failure) throw failure
})()
return closePromise
},
status () {
const replayStatus = privateIpcReplayJournal == null
? privateIpcReplayFailure
: privateIpcReplayJournalV2Status(privateIpcReplayJournal)
return Object.freeze({
started,
closed,
descriptorSequence: descriptorSnapshot.descriptorSequence,
descriptorHash: b4a.from(descriptorSnapshot.hash),
descriptorRestoredFromFloor,
manifestFloor: manifestFloorState,
enabledOperationBits: replayStatus == null || replayStatus.ready
? enabledOperationBits
: enabledOperationBits & ~CELL_PUT_OPERATION_BIT_V2,
v2WritePathReady: v2WritePathReady && replayStatus != null && replayStatus.ready,
v2WritePathAssembled,
privateIpcReplayJournal: replayStatus,
admissionCapture: Object.freeze({
complete: admissionCapture.complete,
required: admissionCapture.required,
captured: admissionCapture.captured.size
}),
exclusions: runtimeExclusions,
cell: cellAdapter == null ? null : cellAdapter.status(),
storage: storage.status(),
inbox: inboxAdapter == null ? null : inboxAdapter.status(),
inboxStorage: inboxStorage == null ? null : inboxStorage.status(),
core: coreAdapter == null ? null : coreAdapter.status(),
coreStorage: coreStorage == null ? null : coreStorage.status()
})
}
})
return runtime
} catch (error) {
if (readiness) readiness.close()
if (daemon) await daemon.close().catch(() => {})
if (privateIpcReplayJournal) {
await closePrivateIpcReplayJournalV2(privateIpcReplayJournal).catch(() => {})
}
if (coreStorage) await coreStorage.close().catch(() => {})
if (inboxStorage) await inboxStorage.close().catch(() => {})
if (storage) await storage.close().catch(() => {})
if (signer) signer.close()
else if (secretKey) secretKey.fill(0)
throw error
}
}