@abtnode/core 1.8.66 → 1.8.67-beta-f8b4c9ec

package/lib/blocklet/manager/disk.js

@@ -15,20 +15,18 @@ const { isNFTExpired, getNftExpirationDate } = require('@abtnode/util/lib/nft');
 const didDocument = require('@abtnode/util/lib/did-document');
 const { sign } = require('@arcblock/jwt');
 const { isValid: isValidDid } = require('@arcblock/did');
-const { verifyPresentation } = require('@arcblock/vc');
 const { toSvg: createDidLogo } =
   process.env.NODE_ENV !== 'test' ? require('@arcblock/did-motif') : require('@arcblock/did-motif/dist/did-motif.cjs');
 const getBlockletInfo = require('@blocklet/meta/lib/info');
 const sleep = require('@abtnode/util/lib/sleep');
 
 const logger = require('@abtnode/logger')('@abtnode/core:blocklet:manager');
-const { getVcFromPresentation } = require('@abtnode/util/lib/vc');
 const {
-  VC_TYPE_BLOCKLET_PURCHASE,
   WHO_CAN_ACCESS,
   SERVER_ROLES,
   WHO_CAN_ACCESS_PREFIX_ROLES,
   BLOCKLET_INSTALL_TYPE,
+  NODE_MODES,
 } = require('@abtnode/constant');
 
 const getBlockletEngine = require('@blocklet/meta/lib/engine');
@@ -49,7 +47,7 @@ const getComponentProcessId = require('@blocklet/meta/lib/get-component-process-
 const toBlockletDid = require('@blocklet/meta/lib/did');
 const { validateMeta } = require('@blocklet/meta/lib/validate');
 const { update: updateMetaFile } = require('@blocklet/meta/lib/file');
-const { titleSchema, mountPointSchema, environmentNameSchema } = require('@blocklet/meta/lib/schema');
+const { titleSchema, updateMountPointSchema, environmentNameSchema } = require('@blocklet/meta/lib/schema');
 const hasReservedKey = require('@blocklet/meta/lib/has-reserved-key');
 const Lock = require('@abtnode/util/lib/lock');
 
@@ -111,6 +109,8 @@ const {
   validateAppConfig,
   checkDuplicateAppSk,
   checkDuplicateMountPoint,
+  validateStore,
+  validateInServerless,
 } = require('../../util/blocklet');
 const StoreUtil = require('../../util/store');
 const states = require('../../states');
@@ -242,6 +242,8 @@ class BlockletManager extends BaseBlockletManager {
    *  did: string;
    *  title: string;
    *  description: string;
+   *  storeUrl: string;
+   *  appSk: string;
    *  sync: boolean = false; // download synchronously, not use queue
    *  delay: number; // push download task to queue after a delay
    *  downloadTokenList: Array<{did: string, token: string}>;
@@ -278,28 +280,31 @@ class BlockletManager extends BaseBlockletManager {
       context.startImmediately = !!params.startImmediately;
     }
 
+    const { appSk } = params;
+
     if (type === BLOCKLET_INSTALL_TYPE.URL) {
       const { url, controller, sync, delay } = params;
-      return this._installFromUrl({ url, controller, sync, delay }, context);
+      return this._installFromUrl({ url, controller, sync, delay, appSk }, context);
     }
 
     if (type === BLOCKLET_INSTALL_TYPE.UPLOAD) {
       const { file, did, diffVersion, deleteSet } = params;
-      return this._installFromUpload({ file, did, diffVersion, deleteSet, context });
+      return this._installFromUpload({ file, did, diffVersion, deleteSet, appSk }, context);
     }
 
     if (type === BLOCKLET_INSTALL_TYPE.STORE) {
       const { did, controller, sync, delay, storeUrl } = params;
-      return this._installFromStore({ did, controller, sync, delay, storeUrl }, context);
+      return this._installFromStore({ did, controller, sync, delay, storeUrl, appSk }, context);
     }
 
     if (type === BLOCKLET_INSTALL_TYPE.CREATE) {
-      return this._installFromCreate({ title: params.title, description: params.description }, context);
+      const { title, description } = params;
+      return this._installFromCreate({ title, description, appSk }, context);
     }
 
     if (type === BLOCKLET_INSTALL_TYPE.RESTORE) {
-      const { url, blockletSecretKey } = params;
-      return this._installFromBackup({ url, blockletSecretKey }, context);
+      const { url } = params;
+      return this._installFromBackup({ url, appSk }, context);
     }
 
     // should not be here
@@ -343,10 +348,16 @@ class BlockletManager extends BaseBlockletManager {
     },
     context = {}
   ) {
-    const mountPoint = await mountPointSchema.validateAsync(tmpMountPoint);
+    const mountPoint = await updateMountPointSchema.validateAsync(tmpMountPoint);
     logger.debug('start install component', { rootDid, mountPoint, url });
 
     if (file) {
+      // TODO: 如何触发这种场景？
+      const info = await states.node.read();
+      if (info.mode === NODE_MODES.SERVERLESS) {
+        throw new Error("Can't install component in serverless-mode server via upload");
+      }
+
       return this._installComponentFromUpload({
         rootDid,
         mountPoint,
@@ -360,6 +371,11 @@ class BlockletManager extends BaseBlockletManager {
     }
 
     if (url) {
+      const info = await states.node.read();
+      if (info.mode === NODE_MODES.SERVERLESS) {
+        validateStore(info, url);
+      }
+
       return this._installComponentFromUrl({
         rootDid,
         mountPoint,
@@ -431,25 +447,6 @@ class BlockletManager extends BaseBlockletManager {
     return { isInstalled: !!blocklet, isRunning, blockletDid, isExternal };
   }
 
-  async installBlockletFromVc({ vcPresentation, challenge }, context) {
-    logger.info('Install from vc');
-    const vc = getVcFromPresentation(vcPresentation);
-
-    // FIXME: 这里的 trustedIssuers 相当于相信任何 VC，需要想更安全的方法
-    verifyPresentation({ presentation: vcPresentation, trustedIssuers: [get(vc, 'issuer.id')], challenge });
-
-    if (!vc.type.includes(VC_TYPE_BLOCKLET_PURCHASE)) {
-      throw new Error(`Expect ${VC_TYPE_BLOCKLET_PURCHASE} VC type`);
-    }
-
-    const blockletUrl = get(vc, 'credentialSubject.purchased.blocklet.url');
-    const urlObject = new URL(blockletUrl);
-    const did = get(vc, 'credentialSubject.purchased.blocklet.id');
-    const registry = urlObject.origin;
-
-    return this._installFromStore({ did, registry }, context);
-  }
-
   async start({ did, throwOnError, checkHealthImmediately = false, e2eMode = false }, context) {
     logger.info('start blocklet', { did });
     // should check blocklet integrity
@@ -631,7 +628,7 @@ class BlockletManager extends BaseBlockletManager {
     // FIXME: 需要改成队列执行，本次失败，下次还需要重试，页面刷新后也能知道最新的状态
     await this._installFromBackup({
       url: `file://${spacesRestore.blockletRestoreDir}`,
-      blockletSecretKey: spacesRestore.blockletWallet.secretKey,
+      appSk: spacesRestore.blockletWallet.secretKey,
       moveDir: true,
     });
   }
@@ -1004,7 +1001,7 @@ class BlockletManager extends BaseBlockletManager {
   }
 
   // eslint-disable-next-line no-unused-vars
-  async config({ did, configs: newConfigs, skipHook }, context) {
+  async config({ did, configs: newConfigs, skipHook, skipDidDocument }, context) {
     if (!Array.isArray(newConfigs)) {
       throw new Error('configs list is not an array');
     }
@@ -1064,7 +1061,7 @@ class BlockletManager extends BaseBlockletManager {
       [BLOCKLET_CONFIGURABLE_KEY.BLOCKLET_APP_SK, BLOCKLET_CONFIGURABLE_KEY.BLOCKLET_WALLET_TYPE].includes(item.key)
     );
 
-    if (isSkOrWalletTypeChanged) {
+    if (isSkOrWalletTypeChanged && !skipDidDocument) {
       await this._updateDidDocument(blocklet);
     }
 
@@ -1198,7 +1195,7 @@ class BlockletManager extends BaseBlockletManager {
   }
 
   async updateComponentMountPoint({ did, rootDid: inputRootDid, mountPoint: tmpMountPoint }, context) {
-    const mountPoint = await mountPointSchema.validateAsync(tmpMountPoint);
+    const mountPoint = await updateMountPointSchema.validateAsync(tmpMountPoint);
 
     const blocklet = await states.blocklet.getBlocklet(inputRootDid);
 
@@ -1679,13 +1676,13 @@ class BlockletManager extends BaseBlockletManager {
    *  /blocklet.json
    *  /blocklet_extras.json
    * @see Blocklet 端到端备份方案的设计与实现（一期） https://team.arcblock.io/comment/discussions/e62084d5-fafa-489e-91d5-defcd6e93223
-   * @param {{ url: string, blockletSecretKey: string, moveDir: boolean}} [{ url }={}]
+   * @param {{ url: string, appSk: string, moveDir: boolean}} [{ url }={}]
    * @param {Record<string, string>} [context={}]
    * @return {Promise<any>}
    * @memberof BlockletManager
    */
-  async _installFromBackup({ url, blockletSecretKey, moveDir } = {}, context = {}) {
-    return installFromBackup({ url, blockletSecretKey, moveDir, context, manager: this, states });
+  async _installFromBackup({ url, appSk, moveDir } = {}, context = {}) {
+    return installFromBackup({ url, appSk, moveDir, context, manager: this, states });
   }
 
   async ensureBlocklet(did, opts = {}) {
@@ -2084,17 +2081,18 @@ class BlockletManager extends BaseBlockletManager {
    *
    * @param {{
    *  did: string;
-   *  registry: string;
    *  sync: boolean;
    *  delay: number;
    *  controller: Controller;
+   *  appSk: string;
+   *  storeUrl: string;
    * }} params
    * @param {*} context
    * @return {*}
    * @memberof BlockletManager
    */
   async _installFromStore(params, context) {
-    const { did, storeUrl, sync, delay, controller } = params;
+    const { did, storeUrl, sync, delay, controller, appSk } = params;
 
     logger.debug('start install blocklet', { did });
     if (!isValidDid(did)) {
@@ -2138,6 +2136,7 @@ class BlockletManager extends BaseBlockletManager {
       sync,
       delay,
       controller,
+      appSk,
       context,
     });
   }
@@ -2154,13 +2153,14 @@ class BlockletManager extends BaseBlockletManager {
    *  sync: boolean;
    *  delay: number;
    *  controller: Controller;
+   *  appSk: string;
    * }} params
    * @param {{}} context
    * @return {*}
    * @memberof BlockletManager
    */
   async _installFromUrl(params, context) {
-    const { url, sync, delay, controller } = params;
+    const { url, sync, delay, controller, appSk } = params;
 
     logger.debug('start install blocklet', { url });
 
@@ -2174,13 +2174,18 @@ class BlockletManager extends BaseBlockletManager {
 
     // install from store if url is a store url
     const { inStore, registryUrl, blockletDid: bundleDid } = await StoreUtil.parseSourceUrl(url, controller);
+
+    const nodeInfo = await states.node.read();
+
+    await validateStore(nodeInfo, registryUrl);
+
     if (inStore) {
       const exist = await states.blocklet.getBlocklet(blockletDid);
       if (exist) {
         return this.upgrade({ did: blockletDid, storeUrl: registryUrl, sync, delay }, context);
       }
 
-      return this._installFromStore({ did: bundleDid, storeUrl: registryUrl, controller, sync, delay }, context);
+      return this._installFromStore({ did: bundleDid, storeUrl: registryUrl, controller, sync, delay, appSk }, context);
     }
 
     const meta = ensureMeta(bundleMeta, { name: blockletName, did: blockletDid });
@@ -2206,6 +2211,7 @@ class BlockletManager extends BaseBlockletManager {
       sync,
       delay,
       controller,
+      appSk,
       context,
     });
   }
@@ -2310,7 +2316,7 @@ class BlockletManager extends BaseBlockletManager {
     );
   }
 
-  async _installFromCreate({ title, description }, context = {}) {
+  async _installFromCreate({ title, description, appSk }, context = {}) {
     logger.debug('create blocklet', { title, description });
 
     await joi.string().label('title').max(20).required().validateAsync(title);
@@ -2338,11 +2344,9 @@ class BlockletManager extends BaseBlockletManager {
     };
     const meta = validateMeta(rawMeta);
 
-    await states.blocklet.addBlocklet({
-      meta,
-      source: BlockletSource.custom,
-    });
+    await states.blocklet.addBlocklet({ meta, source: BlockletSource.custom });
     await this._setConfigsFromMeta(did);
+    await this._setAppSk(did, appSk);
 
     // check duplicate appSk
     await checkDuplicateAppSk({ did, states });
@@ -2382,7 +2386,7 @@ class BlockletManager extends BaseBlockletManager {
     return { cwd, tarFile };
   }
 
-  async _installFromUpload({ file, did, diffVersion, deleteSet, context }) {
+  async _installFromUpload({ file, did, diffVersion, deleteSet, appSk }, context) {
     logger.info('install blocklet', { from: 'upload file' });
     const { tarFile } = await this._downloadFromUpload(file);
 
@@ -2480,6 +2484,7 @@ class BlockletManager extends BaseBlockletManager {
     const oldState = { extraState: oldExtraState };
     try {
       await this._setConfigsFromMeta(meta.did);
+      await this._setAppSk(appSk);
       await validateBlocklet(blocklet);
 
       // check duplicate appSk
@@ -2776,6 +2781,7 @@ class BlockletManager extends BaseBlockletManager {
    *  meta: {}; // blocklet meta
    *  source: number; // example: BlockletSource.registry,
    *  deployedFrom: string;
+   *  appSk: string;
    *  context: {}
    *  sync: boolean = false;
    *  delay: number;
@@ -2785,10 +2791,15 @@ class BlockletManager extends BaseBlockletManager {
    * @memberof BlockletManager
    */
   async _install(params) {
-    const { meta, source, deployedFrom, context, sync, delay, controller } = params;
+    const { meta, source, deployedFrom, context, sync, delay, controller, appSk } = params;
 
     validateBlockletMeta(meta, { ensureDist: true });
 
+    const info = await states.node.read();
+    if (info.mode === NODE_MODES.SERVERLESS) {
+      validateInServerless({ blockletMeta: meta });
+    }
+
     const { name, did, version } = meta;
 
     const oldExtraState = await states.blockletExtras.findOne({ did: meta.did });
@@ -2808,6 +2819,7 @@ class BlockletManager extends BaseBlockletManager {
       await states.blockletExtras.addMeta({ did, meta: { did, name }, controller });
 
       await this._setConfigsFromMeta(did);
+      await this._setAppSk(did, appSk);
 
       // check duplicate appSk
       await checkDuplicateAppSk({ did, states });
@@ -3405,12 +3417,31 @@ class BlockletManager extends BaseBlockletManager {
     }
   }
 
+  async _setAppSk(did, appSk, context) {
+    if (process.env.NODE_ENV === 'production' && !appSk) {
+      throw new Error(`appSk for blocklet ${did} is required`);
+    }
+
+    if (appSk) {
+      await this.config(
+        {
+          did,
+          configs: [{ key: 'BLOCKLET_APP_SK', value: appSk, secure: true }],
+          skipHook: true,
+          skipDidDocument: true,
+        },
+        context
+      );
+    }
+  }
+
   async _findNextCustomBlockletName(leftTimes = 10) {
     if (leftTimes <= 0) {
       throw new Error('Generate custom blocklet did too many times');
     }
     const number = await states.node.increaseCustomBlockletNumber();
     const name = `custom-${number}`;
+    // MEMO: 空壳 APP可以保留原有的 did 生成逻辑
     const did = toBlockletDid(name);
     const blocklet = await states.blocklet.getBlocklet(did);
     if (blocklet) {

package/lib/blocklet/manager/helper/install-from-backup.js

@@ -19,7 +19,7 @@ const { validateBlocklet, checkDuplicateAppSk, getAppDirs } = require('../../../
  * }} param0
  * @returns
  */
-module.exports = async ({ url, blockletSecretKey, moveDir, context = {}, states, manager } = {}) => {
+module.exports = async ({ url, appSk, moveDir, context = {}, states, manager } = {}) => {
   // TODO: support more url schema feature (http, did-spaces)
   if (!url.startsWith('file://')) {
     throw new Error('url must starts with file://');
@@ -71,17 +71,17 @@ module.exports = async ({ url, blockletSecretKey, moveDir, context = {}, states,
     throw new Error('blocklet is already exist');
   }
 
-  if (blockletSecretKey) {
+  if (appSk) {
     extra.configs = extra.configs || [];
     const skConfig = extra.configs.find((x) => x.key === BLOCKLET_CONFIGURABLE_KEY.BLOCKLET_APP_SK);
     if (skConfig) {
-      skConfig.value = blockletSecretKey;
+      skConfig.value = appSk;
       skConfig.secure = true;
       skConfig.shared = false;
     } else {
       extra.configs.push({
         key: BLOCKLET_CONFIGURABLE_KEY.BLOCKLET_APP_SK,
-        value: blockletSecretKey,
+        value: appSk,
         secure: true,
         shared: false,
       });

package/lib/blocklet/storage/backup/spaces.js

@@ -150,10 +150,10 @@ class SpacesBackup {
     const { errorCount } = await spaceClient.send(
       new SyncFolderPushCommand({
         source: join(this.blockletBackupDir, '/'),
-        target: join('.did-objects', this.blocklet.appDid),
+        target: join('.did-objects', this.blocklet.appDid, '/'),
         debug: true,
-        concurrency: 64,
-        retryCount: 100,
+        concurrency: 32,
+        retryCount: 10,
         filter: (object) => {
           return object.name !== '.DS_Store';
         },

package/lib/blocklet/storage/restore/blocklets.js

@@ -1,4 +1,4 @@
-const { existsSync, remove } = require('fs-extra');
+const { existsSync, remove, ensureDirSync } = require('fs-extra');
 const { join } = require('path');
 const fg = require('fast-glob');
 const { BaseRestore } = require('./base');
@@ -10,8 +10,11 @@ class BlockletsRestore extends BaseRestore {
   async import() {
     const blockletsDir = join(this.blockletRestoreDir, this.filename);
 
+    // blockletsDir 可以不存在, 因为还原的 blocklet 可能所有的组件都是来自 store 的
     if (!existsSync(blockletsDir)) {
-      throw new Error(`dir not found: ${blockletsDir}`);
+      // FIXME: 如果文件夹不存在，需要创建文件夹，因为 installFromBackup 未做容错处理
+      ensureDirSync(blockletsDir);
+      return;
     }
 
     const paths = await fg('**/*.zip', {

package/lib/blocklet/storage/restore/spaces.js

@@ -1,7 +1,7 @@
 /**
  * @typedef {{
  *  endpoint: string;
- *  blockletSecretKey: string;
+ *  appSk: string;
  * }} SpaceRestoreInput
  */
 
@@ -98,7 +98,7 @@ class SpacesRestore {
 
   async getBlockletWallet() {
     // @FIXME: blocklet 钱包类型如何得知呢？
-    const wallet = fromSecretKey(this.input.blockletSecretKey, WalletType({ role: types.RoleType.ROLE_APPLICATION }));
+    const wallet = fromSecretKey(this.input.appSk, WalletType({ role: types.RoleType.ROLE_APPLICATION }));
 
     return wallet;
   }
@@ -115,10 +115,10 @@ class SpacesRestore {
     const { errorCount } = await spaceClient.send(
       new SyncFolderPullCommand({
         source: join('.did-objects', this.blockletWallet.address, '/'),
-        target: this.blockletRestoreDir,
+        target: join(this.blockletRestoreDir, '/'),
         debug: true,
-        concurrency: 64,
-        retryCount: 100,
+        concurrency: 32,
+        retryCount: 10,
       })
     );
 

package/lib/event.js

@@ -81,7 +81,7 @@ module.exports = ({
     }
   };
 
-  const handleBlockletAdd = async (name, { blocklet, context }) => {
+  const handleBlockletInstall = async (name, { blocklet, context }) => {
     try {
       const changed = await ensureBlockletRouting(blocklet, context);
       if (changed) {
@@ -173,7 +173,7 @@ module.exports = ({
     const blocklet = payload.blocklet || payload;
 
     if ([BlockletEvents.installed].includes(eventName)) {
-      await handleBlockletAdd(eventName, payload);
+      await handleBlockletInstall(eventName, payload);
 
       try {
         await node.createAuditLog({

package/lib/index.js

@@ -192,7 +192,6 @@ function ABTNode(options) {
 
     // Blocklet manager
     installBlocklet: blockletManager.install.bind(blockletManager),
-    installBlockletFromVc: blockletManager.installBlockletFromVc.bind(blockletManager),
     installComponent: blockletManager.installComponent.bind(blockletManager),
     startBlocklet: blockletManager.start.bind(blockletManager),
     stopBlocklet: blockletManager.stop.bind(blockletManager),

package/lib/router/helper.js

@@ -518,7 +518,7 @@ module.exports = function getRouterHelpers({ dataDirs, routingSnapshot, routerMa
 
     const ensureDomainCert = async (domain, url) => {
       const cert = await certManager.getByDomain(domain);
-      if (!cert) {
+      if (!cert || get(cert, 'meta.validTo') <= Date.now()) {
         await downloadCert({
           domain,
           url,

package/lib/router/index.js

@@ -183,6 +183,10 @@ Router.formatSites = (sites = []) => {
   result.forEach((site) => {
     if (Array.isArray(site.rules) && site.rules.length > 0) {
       const rules = cloneDeep(site.rules);
+
+      let hasRootPathBlockletRule = false;
+      let tmpBlockletRule;
+
       rules.forEach((rule) => {
         if ([ROUTING_RULE_TYPES.BLOCKLET].includes(rule.to.type) === false) {
           return;
@@ -197,6 +201,11 @@ Router.formatSites = (sites = []) => {
         }
 
         if (daemonRule) {
+          if (rule.from.pathPrefix === '/') {
+            hasRootPathBlockletRule = true;
+          }
+          tmpBlockletRule = rule;
+
           // Serve meta js: both prefix and suffix do not contain trailing slash
           // NOTICE: 这里隐含了一个约定
           //   如果安装的 blockletA 和 blockletB 都需要 __blocklet__.js
@@ -244,6 +253,24 @@ Router.formatSites = (sites = []) => {
           });
         }
       });
+
+      // ensure /__blocklet__.js should be proxy to daemon
+      if (daemonRule && !hasRootPathBlockletRule && tmpBlockletRule) {
+        site.rules.push({
+          from: {
+            pathPrefix: '/',
+            groupPathPrefix: '/',
+            pathSuffix: '/__blocklet__.js',
+          },
+          to: {
+            type: ROUTING_RULE_TYPES.DAEMON,
+            port: daemonRule.to.port,
+            did: tmpBlockletRule.to.did,
+            componentId: tmpBlockletRule.to.did,
+            cacheGroup: site.mode === BLOCKLET_MODES.PRODUCTION ? 'blockletJs' : '',
+          },
+        });
+      }
     }
   });
 

package/lib/states/node.js

@@ -124,7 +124,7 @@ class NodeState extends BaseState {
                 routing,
                 docker,
                 mode,
-                enableWelcomePage: true,
+                enableWelcomePage: mode !== NODE_MODES.SERVERLESS,
                 runtimeConfig,
                 ownerNft,
                 diskAlertThreshold: DISK_ALERT_THRESHOLD_PERCENT,

package/lib/util/blocklet.js

@@ -31,7 +31,12 @@ const getFolderSize = require('@abtnode/util/lib/get-folder-size');
 const normalizePathPrefix = require('@abtnode/util/lib/normalize-path-prefix');
 const hashFiles = require('@abtnode/util/lib/hash-files');
 const isPathPrefixEqual = require('@abtnode/util/lib/is-path-prefix-equal');
-const { BLOCKLET_MAX_MEM_LIMIT_IN_MB, BLOCKLET_STORE, BLOCKLET_INSTALL_TYPE } = require('@abtnode/constant');
+const {
+  BLOCKLET_MAX_MEM_LIMIT_IN_MB,
+  BLOCKLET_STORE,
+  BLOCKLET_INSTALL_TYPE,
+  BLOCKLET_STORE_DEV,
+} = require('@abtnode/constant');
 const formatBackSlash = require('@abtnode/util/lib/format-back-slash');
 
 const SCRIPT_ENGINES_WHITE_LIST = ['npm', 'npx', 'pnpm', 'yarn'];
@@ -835,7 +840,7 @@ const parseChildrenFromMeta = async (src, context = {}) => {
 };
 
 const validateBlocklet = (blocklet) =>
-  forEachBlocklet(blocklet, (b) => {
+  forEachBlocklet(blocklet, async (b) => {
     isRequirementsSatisfied(b.meta.requirements);
     validateEngine(getBlockletEngineNameByPlatform(b.meta));
   });
@@ -1400,12 +1405,14 @@ const getBlocklet = async ({
 
   blocklet.settings.storeList = blocklet.settings.storeList || [];
 
-  if (!blocklet.settings.storeList.find((x) => x.url === BLOCKLET_STORE.url)) {
-    blocklet.settings.storeList.unshift({
-      ...BLOCKLET_STORE,
-      protected: true,
-    });
-  }
+  [BLOCKLET_STORE_DEV, BLOCKLET_STORE].forEach((store) => {
+    if (!blocklet.settings.storeList.find((x) => x.url === store.url)) {
+      blocklet.settings.storeList.unshift({
+        ...store,
+        protected: true,
+      });
+    }
+  });
 
   // app site
   blocklet.site = await states.site.findOneByBlocklet(blocklet.meta.did);
@@ -1690,6 +1697,32 @@ const checkDuplicateMountPoint = (blocklet, mountPoint) => {
   }
 };
 
+const validateStore = (nodeInfo, storeUrl) => {
+  if (nodeInfo.mode !== 'serverless') {
+    return;
+  }
+
+  const inStoreList = nodeInfo.blockletRegistryList.find((item) => {
+    const itemURLObj = new URL(item.url);
+    const storeUrlObj = new URL(storeUrl);
+
+    return itemURLObj.host === storeUrlObj.host;
+  });
+
+  if (!inStoreList) {
+    throw new Error('Must be installed from the compliant blocklet store list');
+  }
+};
+
+const validateInServerless = ({ blockletMeta }) => {
+  const { interfaces } = blockletMeta;
+  const externalPortInterfaces = (interfaces || []).filter((item) => !!item.port?.external);
+
+  if (externalPortInterfaces.length > 0) {
+    throw new Error('Blocklets with exposed ports cannot be installed');
+  }
+};
+
 module.exports = {
   consumeServerlessNFT,
   forEachBlocklet,
@@ -1737,4 +1770,6 @@ module.exports = {
   validateAppConfig,
   checkDuplicateAppSk,
   checkDuplicateMountPoint,
+  validateStore,
+  validateInServerless,
 };

package/package.json

@@ -3,7 +3,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "1.8.66",
+  "version": "1.8.67-beta-f8b4c9ec",
   "description": "",
   "main": "lib/index.js",
   "files": [
@@ -19,33 +19,33 @@
   "author": "wangshijun <wangshijun2010@gmail.com> (http://github.com/wangshijun)",
   "license": "MIT",
   "dependencies": {
-    "@abtnode/auth": "1.8.66",
-    "@abtnode/certificate-manager": "1.8.66",
-    "@abtnode/constant": "1.8.66",
-    "@abtnode/cron": "1.8.66",
-    "@abtnode/db": "1.8.66",
-    "@abtnode/logger": "1.8.66",
-    "@abtnode/queue": "1.8.66",
-    "@abtnode/rbac": "1.8.66",
-    "@abtnode/router-provider": "1.8.66",
-    "@abtnode/static-server": "1.8.66",
-    "@abtnode/timemachine": "1.8.66",
-    "@abtnode/util": "1.8.66",
-    "@arcblock/did": "1.18.42",
+    "@abtnode/auth": "1.8.67-beta-f8b4c9ec",
+    "@abtnode/certificate-manager": "1.8.67-beta-f8b4c9ec",
+    "@abtnode/constant": "1.8.67-beta-f8b4c9ec",
+    "@abtnode/cron": "1.8.67-beta-f8b4c9ec",
+    "@abtnode/db": "1.8.67-beta-f8b4c9ec",
+    "@abtnode/logger": "1.8.67-beta-f8b4c9ec",
+    "@abtnode/queue": "1.8.67-beta-f8b4c9ec",
+    "@abtnode/rbac": "1.8.67-beta-f8b4c9ec",
+    "@abtnode/router-provider": "1.8.67-beta-f8b4c9ec",
+    "@abtnode/static-server": "1.8.67-beta-f8b4c9ec",
+    "@abtnode/timemachine": "1.8.67-beta-f8b4c9ec",
+    "@abtnode/util": "1.8.67-beta-f8b4c9ec",
+    "@arcblock/did": "1.18.54",
     "@arcblock/did-motif": "^1.1.10",
-    "@arcblock/did-util": "1.18.42",
-    "@arcblock/event-hub": "1.18.42",
-    "@arcblock/jwt": "^1.18.42",
+    "@arcblock/did-util": "1.18.54",
+    "@arcblock/event-hub": "1.18.54",
+    "@arcblock/jwt": "^1.18.54",
     "@arcblock/pm2-events": "^0.0.5",
-    "@arcblock/vc": "1.18.42",
-    "@blocklet/constant": "1.8.66",
-    "@blocklet/meta": "1.8.66",
-    "@blocklet/sdk": "1.8.66",
-    "@did-space/client": "^0.1.66",
+    "@arcblock/vc": "1.18.54",
+    "@blocklet/constant": "1.8.67-beta-f8b4c9ec",
+    "@blocklet/meta": "1.8.67-beta-f8b4c9ec",
+    "@blocklet/sdk": "1.8.67-beta-f8b4c9ec",
+    "@did-space/client": "^0.1.76",
     "@fidm/x509": "^1.2.1",
-    "@ocap/mcrypto": "1.18.42",
-    "@ocap/util": "1.18.42",
-    "@ocap/wallet": "1.18.42",
+    "@ocap/mcrypto": "1.18.54",
+    "@ocap/util": "1.18.54",
+    "@ocap/wallet": "1.18.54",
     "@slack/webhook": "^5.0.4",
     "archiver": "^5.3.1",
     "axios": "^0.27.2",
@@ -72,7 +72,6 @@
     "pm2": "^5.2.0",
     "semver": "^7.3.8",
     "shelljs": "^0.8.5",
-    "slugify": "^1.6.5",
     "ssri": "^8.0.1",
     "stream-throttle": "^0.1.3",
     "stream-to-promise": "^3.0.0",
@@ -90,5 +89,5 @@
     "express": "^4.18.2",
     "jest": "^27.5.1"
   },
-  "gitHead": "282247fd0ce6702e1d6920e90e2b3be0408cf879"
+  "gitHead": "ebf19fcbc6d99fff0d214dc0680c4df81aa94d6d"
 }