@blinklabs/dingo 0.46.4 → 0.81.0

package/npm/checksums.json

@@ -0,0 +1,8 @@
+{
+  "dingo-v0.81.0-darwin-amd64.tar.gz": "90cd6decee1ba4c9fe971e0297bf57d7c633e9cd260b236be32cbe61b4c4492d",
+  "dingo-v0.81.0-darwin-arm64.tar.gz": "f5d82dc58aff89046ca7fc0b499431c82b5c6c13a54306ccda41927af5bc93f7",
+  "dingo-v0.81.0-freebsd-amd64.tar.gz": "0a996c980a003ae1df4470610ccb5686a4b5fbb74b93ad89b138535fe3c05a38",
+  "dingo-v0.81.0-freebsd-arm64.tar.gz": "1382172f08dff9a067a072c3a647fe142055a70cda3fe8f82e6d82e20c49fb3f",
+  "dingo-v0.81.0-linux-amd64.tar.gz": "e04e15896de454b2e6e3911c4eb923b0bf2f0331d3b1e22274e6a6576964c691",
+  "dingo-v0.81.0-linux-arm64.tar.gz": "4334de18168bd79eb87fa4dad015694c275e45ced99dc3643330f57b6a7ac512"
+}

package/npm/install.js

@@ -0,0 +1,211 @@
+// Copyright 2026 Blink Labs Software
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+'use strict';
+
+const crypto = require('node:crypto');
+const fs = require('node:fs');
+const fsp = require('node:fs/promises');
+const https = require('node:https');
+const os = require('node:os');
+const path = require('node:path');
+const { spawn } = require('node:child_process');
+const { Transform } = require('node:stream');
+const { pipeline } = require('node:stream/promises');
+
+const MAX_ARCHIVE_BYTES = 256 * 1024 * 1024;
+const MAX_BINARY_BYTES = 512 * 1024 * 1024;
+const RETRY_DELAYS_MS = [100, 500];
+
+function releaseTarget(version, platform = process.platform, arch = process.arch) {
+  const targets = {
+    linux: { x64: 'amd64', arm64: 'arm64' },
+    freebsd: { x64: 'amd64', arm64: 'arm64' },
+    darwin: { x64: 'amd64', arm64: 'arm64' },
+  };
+  const goArch = targets[platform]?.[arch];
+  if (!goArch) throw new Error(`No Dingo release binary for ${platform}/${arch}`);
+  if (!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/.test(version)) {
+    throw new Error(`Invalid Dingo package version: ${version}`);
+  }
+  const filename = `dingo-v${version}-${platform}-${goArch}.tar.gz`;
+  return {
+    filename,
+    url: `https://github.com/blinklabs-io/dingo/releases/download/v${version}/${filename}`,
+  };
+}
+
+function releaseURL(version, platform = process.platform, arch = process.arch) {
+  return releaseTarget(version, platform, arch).url;
+}
+
+function byteLimit(maxBytes, description) {
+  let received = 0;
+  return new Transform({
+    transform(chunk, encoding, callback) {
+      received += chunk.length;
+      if (received > maxBytes) {
+        callback(new Error(`${description} exceeds ${maxBytes} bytes`));
+        return;
+      }
+      callback(null, chunk);
+    },
+  });
+}
+
+function downloadOnce(url, destination, get, redirects, maxBytes) {
+  return new Promise((resolve, reject) => {
+    const parsed = new URL(url);
+    if (parsed.protocol !== 'https:') {
+      reject(new Error('Dingo release downloads require HTTPS'));
+      return;
+    }
+    const request = get(parsed, (response) => {
+      if ([301, 302, 303, 307, 308].includes(response.statusCode)) {
+        response.resume();
+        if (!response.headers.location || redirects >= 5) {
+          reject(new Error('Invalid or excessive Dingo release redirects'));
+          return;
+        }
+        let redirect;
+        try {
+          redirect = new URL(response.headers.location, parsed).href;
+        } catch (error) {
+          reject(error);
+          return;
+        }
+        downloadOnce(redirect, destination, get, redirects + 1, maxBytes)
+          .then(resolve, reject);
+        return;
+      }
+      if (response.statusCode !== 200) {
+        response.resume();
+        const error = new Error(`Dingo release download returned HTTP ${response.statusCode}`);
+        error.retryable = response.statusCode >= 500 && response.statusCode <= 599;
+        reject(error);
+        return;
+      }
+      response.on('error', (error) => { error.retryable = true; });
+      pipeline(
+        response,
+        byteLimit(maxBytes, 'Dingo release archive'),
+        fs.createWriteStream(destination, { flags: 'wx' }),
+      ).then(resolve, reject);
+    });
+    request.on('error', (error) => {
+      error.retryable = true;
+      reject(error);
+    });
+    request.setTimeout(30_000, () => request.destroy(new Error('Dingo release download timed out')));
+  });
+}
+
+async function download(url, destination, get = https.get, options = {}) {
+  const delays = options.retryDelays ?? RETRY_DELAYS_MS;
+  const wait = options.wait ?? ((milliseconds) => new Promise((resolve) => {
+    setTimeout(resolve, milliseconds);
+  }));
+  const maxBytes = options.maxBytes ?? MAX_ARCHIVE_BYTES;
+  for (let attempt = 0; ; attempt += 1) {
+    await fsp.rm(destination, { force: true });
+    try {
+      await downloadOnce(url, destination, get, 0, maxBytes);
+      return;
+    } catch (error) {
+      await fsp.rm(destination, { force: true });
+      if (!error.retryable || attempt >= delays.length) throw error;
+      await wait(delays[attempt]);
+    }
+  }
+}
+
+async function sha256(filename) {
+  const digest = crypto.createHash('sha256');
+  await pipeline(fs.createReadStream(filename), digest);
+  return digest.digest('hex');
+}
+
+async function extractBinary(archive, destination, maxBytes = MAX_BINARY_BYTES) {
+  // Stream only the shipped member: archive paths never become filesystem paths.
+  const child = spawn('tar', ['-xzOf', archive, 'dingo'], { stdio: ['ignore', 'pipe', 'pipe'] });
+  let diagnostic = '';
+  child.stderr.on('data', (chunk) => { diagnostic = (diagnostic + chunk).slice(-8192); });
+  const exited = new Promise((resolve) => {
+    child.once('error', (error) => resolve({ error }));
+    child.once('close', (code, signal) => {
+      resolve({ code, signal });
+    });
+  });
+  try {
+    await pipeline(
+      child.stdout,
+      byteLimit(maxBytes, 'Dingo release binary'),
+      fs.createWriteStream(destination, { flags: 'wx', mode: 0o755 }),
+    );
+    const result = await exited;
+    if (result.error) throw result.error;
+    if (result.code !== 0) {
+      throw new Error(
+        `Cannot extract Dingo release (${result.signal || result.code}): ${diagnostic.trim()}`,
+      );
+    }
+  } catch (error) {
+    child.kill();
+    await exited;
+    throw error;
+  }
+  if ((await fsp.stat(destination)).size === 0) throw new Error('Dingo release binary is empty');
+}
+
+function binaryPath(packageRoot) {
+  return path.join(packageRoot, 'npm', 'vendor', 'dingo');
+}
+
+async function install(packageRoot, options = {}) {
+  const { version } = JSON.parse(await fsp.readFile(path.join(packageRoot, 'package.json'), 'utf8'));
+  const targetRelease = releaseTarget(version, options.platform, options.arch);
+  const checksums = options.checksums ?? JSON.parse(
+    await fsp.readFile(path.join(packageRoot, 'npm', 'checksums.json'), 'utf8'),
+  );
+  const expected = checksums[targetRelease.filename];
+  if (typeof expected !== 'string' || !/^[0-9a-f]{64}$/.test(expected)) {
+    throw new Error(`No valid checksum for ${targetRelease.filename}`);
+  }
+  const directory = await fsp.mkdtemp(path.join(os.tmpdir(), 'dingo-npm-'));
+  let pending;
+  try {
+    const archive = path.join(directory, 'release.tar.gz');
+    await (options.download || download)(targetRelease.url, archive);
+    const archiveSize = (await fsp.stat(archive)).size;
+    const maxArchiveBytes = options.maxArchiveBytes ?? MAX_ARCHIVE_BYTES;
+    if (archiveSize > maxArchiveBytes) {
+      throw new Error(`Dingo release archive exceeds ${maxArchiveBytes} bytes`);
+    }
+    const actual = await sha256(archive);
+    if (!crypto.timingSafeEqual(Buffer.from(actual, 'hex'), Buffer.from(expected, 'hex'))) {
+      throw new Error(`Checksum mismatch for ${targetRelease.filename}`);
+    }
+    const target = binaryPath(packageRoot);
+    await fsp.mkdir(path.dirname(target), { recursive: true });
+    pending = await fsp.mkdtemp(path.join(path.dirname(target), '.install-'));
+    const extracted = path.join(pending, 'dingo');
+    await extractBinary(archive, extracted, options.maxBinaryBytes);
+    await fsp.chmod(extracted, 0o755);
+    await fsp.rename(extracted, target);
+    return target;
+  } finally {
+    await fsp.rm(directory, { recursive: true, force: true });
+    if (pending) await fsp.rm(pending, { recursive: true, force: true });
+  }
+}
+
+module.exports = { binaryPath, download, install, releaseURL };

package/npm/postinstall.js

@@ -0,0 +1,21 @@
+// Copyright 2026 Blink Labs Software
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+'use strict';
+
+const path = require('node:path');
+const { install } = require('./install');
+
+install(path.join(__dirname, '..')).catch((error) => {
+  console.error(`Cannot install Dingo: ${error.message}`);
+  process.exitCode = 1;
+});

package/package.json

@@ -1,15 +1,32 @@
 {
   "name": "@blinklabs/dingo",
-  "version": "0.46.4",
+  "version": "0.81.0",
   "description": "Dingo is a Cardano blockchain data node",
-  "main": "index.js",
   "bin": {
-    "dingo": "dingo"
+    "dingo": "npm/bin/dingo.js"
   },
+  "files": [
+    "npm/install.js",
+    "npm/postinstall.js",
+    "npm/bin/dingo.js",
+    "npm/checksums.json"
+  ],
   "scripts": {
-    "postinstall": "golang-npm install",
-    "preuninstall": "golang-npm uninstall"
+    "postinstall": "node npm/postinstall.js",
+    "test": "node --test npm/test/*.test.js"
+  },
+  "engines": {
+    "node": ">=22"
   },
+  "os": [
+    "linux",
+    "freebsd",
+    "darwin"
+  ],
+  "cpu": [
+    "x64",
+    "arm64"
+  ],
   "repository": {
     "type": "git",
     "url": "git+https://github.com/blinklabs-io/dingo.git"
@@ -23,13 +40,5 @@
   "bugs": {
     "url": "https://github.com/blinklabs-io/dingo/issues"
   },
-  "homepage": "https://github.com/blinklabs-io/dingo#readme",
-  "dependencies": {
-    "golang-npm": "^0.0.6"
-  },
-  "goBinary": {
-    "name": "dingo",
-    "path": "./bin",
-    "url": "https://github.com/blinklabs-io/dingo/releases/download/v{{version}}/dingo-v{{version}}-{{platform}}-{{arch}}.tar.gz"
-  }
+  "homepage": "https://github.com/blinklabs-io/dingo#readme"
 }

package/.dockerignore

@@ -1,9 +0,0 @@
-.claude/
-.codex
-.dingo/
-.github/
-.worktrees/
-dingo
-Dockerfile
-README.md
-internal/test/archive-demo/tmp/

package/AGENTS.md

@@ -1,52 +0,0 @@
-# AGENTS.md
-
-Go Cardano node (Ouroboros). See `CLAUDE.md` for detailed rules; this file has additional content (Build/test section, `make golines` in pre-commit, Key events table) and a different structure — the two are related but not exact copies. Package layout, targets, and flags are derivable from `Makefile`, `go.mod`, `node.go`.
-
-## Build / test
-
-```
-make              # fmt, test, build
-make test         # tests with -race
-go test -v -race -run TestName ./path/to/pkg/
-```
-
-## Pre-commit
-
-```
-golangci-lint run ./...
-nilaway ./...
-modernize ./...
-make golines
-```
-
-## Testing rules
-
-- No `time.Sleep()` for sync — use `internal/test/testutil/` (`WaitForCondition`, `RequireReceive`, `context.WithTimeout`).
-- Integration tests: `internal/integration/` + `database/immutable/testdata/` (real blocks, slots 0–1.3M).
-- Mock fixtures come from `github.com/blinklabs-io/ouroboros-mock` (`fixtures/`, `ledger/`, `conformance/`). Never duplicate mocks inside dingo — extend the shared library so every Blink Labs app (dingo, gouroboros, adder, ...) reuses the same test surface.
-- DevNet end-to-end (`internal/test/devnet/run-tests.sh`): validate any change touching consensus, block production, header/VRF/KES/OpCert verification, chain selection, mempool, tx submission, NtN/NtC protocols, epoch boundaries, or nonce computation. Brings up Dingo + cardano-node side by side with `txpump` driving the mempool, so it catches divergence from the reference implementation that unit tests miss. Conformance tests in `internal/test/conformance/` are still mandatory after every change — DevNet is the additional bar for consensus-affecting work.
-
-## Non-obvious invariants
-
-- EventBus for async cross-component notifications: use `event.EventBus.SubscribeFunc()` for block/chain/mempool/peer events. Synchronous state queries between components still use direct method calls.
-- CBOR offsets: UTxOs/txs stored as 52-byte refs (magic `"DOFF"` + slot + hash + offset + length), resolved by `TieredCborCache` (hot → block LRU → cold extract). See `database/cbor_offset.go`.
-- Cert ordering: `Order("added_slot DESC, block_index DESC, cert_index DESC")` — `cert_index` resets per tx, so `block_index` is required to disambiguate across txs in the same block.
-- Rollbacks: delivered on `chain.update` as a `chain.ChainRollbackEvent` payload (no separate `chain.rollback` topic); also subscribe to `chain.fork_detected` for fork metrics. Check `TransactionEvent.Rollback` for undo.
-- Stake snapshots: mark/set/go rotation at epoch boundaries (Praos). `LedgerView.GetStakeDistribution(epoch)` for leader election. Per-pool stake in `PoolStakeSnapshot`; aggregates in `EpochSummary`.
-- Plugins (`database/plugin/`): blob = `badger` | `gcs` | `s3`; metadata = `sqlite` | `mysql` | `postgres`.
-
-## Key events
-
-| Event | Meaning |
-|---|---|
-| `chain.update` | block added |
-| `chain.fork_detected` | fork |
-| `chainselection.chain_switch` | active peer changed |
-| `epoch.transition` | epoch boundary — triggers stake snapshot |
-| `mempool.add_tx` / `mempool.remove_tx` | tx lifecycle |
-| `connmanager.conn_closed` | connection closed |
-| `peergov.peer_churn` | peer rotation |
-
-## Config
-
-Priority: CLI > env > YAML > defaults. Key env vars: `CARDANO_NETWORK`, `CARDANO_DATABASE_PATH`, `DINGO_DATABASE_BLOB_PLUGIN`, `DINGO_DATABASE_METADATA_PLUGIN`.