@fased/fased 0.1.62 → 0.1.64

package/dist/extensions/sat-mining/src/submission-ledger.js

@@ -0,0 +1,349 @@
+import { resolveStateDir } from "../../../config/paths.js";
+import { withFileLock } from "../../../plugin-sdk/file-lock.js";
+import "../../../plugin-sdk/sat-runtime.js";
+import path from "node:path";
+import fs from "node:fs/promises";
+import { createHash, randomUUID } from "node:crypto";
+
+//#region extensions/sat-mining/src/submission-ledger.ts
+const DEFAULT_LOCK_OPTIONS = {
+	retries: {
+		retries: 120,
+		factor: 1.15,
+		minTimeout: 10,
+		maxTimeout: 100,
+		randomize: true
+	},
+	stale: 12e4
+};
+const localLedgerWriteChains = new Map();
+async function withSatSubmissionLedgerLock(filePath, task) {
+	const previous = localLedgerWriteChains.get(filePath) ?? Promise.resolve();
+	let releaseLocal;
+	const localGate = new Promise((resolve) => {
+		releaseLocal = resolve;
+	});
+	const current = previous.catch(() => undefined).then(async () => await localGate);
+	localLedgerWriteChains.set(filePath, current);
+	await previous.catch(() => undefined);
+	try {
+		return await withFileLock(filePath, DEFAULT_LOCK_OPTIONS, task);
+	} finally {
+		releaseLocal();
+		void current.finally(() => {
+			if (localLedgerWriteChains.get(filePath) === current) {
+				localLedgerWriteChains.delete(filePath);
+			}
+		});
+	}
+}
+function sha256(value) {
+	return createHash("sha256").update(value).digest("hex");
+}
+function canonicalize(value) {
+	if (Array.isArray(value)) {
+		return value.map((entry) => canonicalize(entry));
+	}
+	if (value && typeof value === "object") {
+		return Object.fromEntries(Object.entries(value).filter(([, entry]) => entry !== undefined).sort(([left], [right]) => left.localeCompare(right)).map(([key, entry]) => [key, canonicalize(entry)]));
+	}
+	if (typeof value === "bigint") {
+		return value.toString();
+	}
+	return value;
+}
+function digestSatSubmissionIntent(value) {
+	return `sha256:${sha256(JSON.stringify(canonicalize(value)))}`;
+}
+function buildSatSubmissionOperationKey(intent) {
+	const action = typeof intent.action === "string" && intent.action.trim() ? intent.action.trim() : "sat";
+	const accountShape = Array.isArray(intent.instructions) ? intent.instructions.map((instruction) => {
+		const candidate = instruction;
+		return {
+			action: candidate.action,
+			keys: candidate.keys
+		};
+	}) : intent.keys;
+	return `${action}:${sha256(JSON.stringify(canonicalize(accountShape))).slice(0, 24)}`;
+}
+function normalizeStateKey(value) {
+	const normalized = value.trim().replace(/[^a-zA-Z0-9._-]+/g, "_");
+	return normalized || "unattached";
+}
+function resolveSatSubmissionLedgerPath(params) {
+	const env = params.env ?? process.env;
+	return path.join(resolveStateDir(env), "sat-mining", "wallets", normalizeStateKey(params.walletId), "submission-ledger.json");
+}
+function emptyLedger() {
+	return {
+		version: 1,
+		records: {}
+	};
+}
+function normalizeRecord(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) {
+		return null;
+	}
+	const record = value;
+	if (typeof record.requestId !== "string" || typeof record.workflowId !== "string" || typeof record.operationKey !== "string" || !/^sha256:[0-9a-f]{64}$/u.test(String(record.intentDigest ?? "")) || typeof record.walletId !== "string" || typeof record.action !== "string" || ![
+		"prepared",
+		"reserved",
+		"broadcast",
+		"confirmed",
+		"failed",
+		"unknown"
+	].includes(String(record.state ?? ""))) {
+		return null;
+	}
+	return record;
+}
+async function readLedger(filePath) {
+	try {
+		const parsed = JSON.parse(await fs.readFile(filePath, "utf8"));
+		if (parsed.version !== 1 || !parsed.records || typeof parsed.records !== "object") {
+			throw new Error(`invalid SAT submission ledger format at ${filePath}`);
+		}
+		const records = {};
+		for (const [requestId, raw] of Object.entries(parsed.records)) {
+			const record = normalizeRecord(raw);
+			if (!record || record.requestId !== requestId) {
+				throw new Error(`invalid SAT submission ledger record ${requestId}`);
+			}
+			records[requestId] = record;
+		}
+		return {
+			version: 1,
+			records
+		};
+	} catch (error) {
+		if (error.code === "ENOENT") {
+			return emptyLedger();
+		}
+		throw error;
+	}
+}
+async function writeLedger(filePath, ledger) {
+	await fs.mkdir(path.dirname(filePath), {
+		recursive: true,
+		mode: 448
+	});
+	const tempPath = `${filePath}.${process.pid}.${randomUUID()}.tmp`;
+	const handle = await fs.open(tempPath, "wx", 384);
+	try {
+		await handle.writeFile(`${JSON.stringify(ledger, null, 2)}\n`, "utf8");
+		await handle.sync();
+	} finally {
+		await handle.close();
+	}
+	try {
+		await fs.rename(tempPath, filePath);
+		const directory = await fs.open(path.dirname(filePath), "r");
+		try {
+			await directory.sync();
+		} finally {
+			await directory.close();
+		}
+	} catch (error) {
+		await fs.rm(tempPath, { force: true }).catch(() => undefined);
+		throw error;
+	}
+}
+function leaseDurationMs(env) {
+	const configured = Number(env.FASED_SAT_SUBMISSION_LEASE_MS ?? "");
+	if (Number.isFinite(configured) && configured >= 50 && configured <= 3e5) {
+		return Math.floor(configured);
+	}
+	return 6e4;
+}
+function isPidAlive(pid) {
+	if (!Number.isSafeInteger(pid) || pid <= 0) {
+		return false;
+	}
+	try {
+		process.kill(pid, 0);
+		return true;
+	} catch (error) {
+		return error.code === "EPERM";
+	}
+}
+function leaseIsLive(lease, now = Date.now()) {
+	if (!lease || Date.parse(lease.expiresAt) <= now) {
+		return false;
+	}
+	return lease.pid === process.pid || isPidAlive(lease.pid);
+}
+function assertStateTransition(requestId, current, next) {
+	const allowed = {
+		prepared: new Set([
+			"prepared",
+			"reserved",
+			"broadcast",
+			"confirmed",
+			"failed",
+			"unknown"
+		]),
+		reserved: new Set([
+			"reserved",
+			"broadcast",
+			"confirmed",
+			"failed",
+			"unknown"
+		]),
+		broadcast: new Set([
+			"broadcast",
+			"confirmed",
+			"failed",
+			"unknown"
+		]),
+		unknown: new Set([
+			"broadcast",
+			"confirmed",
+			"failed",
+			"unknown"
+		]),
+		confirmed: new Set(["confirmed"]),
+		failed: new Set(["failed"])
+	};
+	if (!allowed[current].has(next)) {
+		throw new Error(`SAT submission ${requestId} cannot move from ${current} back to ${next}`);
+	}
+}
+function buildSatSubmissionRequestId(params) {
+	const digest = sha256(JSON.stringify([
+		"fased-sat-submission-v1",
+		params.walletId,
+		params.workflowId,
+		params.operationKey
+	]));
+	return `sat-v2-${digest.slice(0, 48)}`;
+}
+async function claimSatSubmission(params) {
+	const env = params.env ?? process.env;
+	const filePath = resolveSatSubmissionLedgerPath({
+		walletId: params.walletId,
+		env
+	});
+	const requestId = buildSatSubmissionRequestId(params);
+	const owner = params.owner ?? `${process.pid}:${randomUUID()}`;
+	return await withSatSubmissionLedgerLock(filePath, async () => {
+		const ledger = await readLedger(filePath);
+		const existing = ledger.records[requestId];
+		if (existing) {
+			if (existing.intentDigest !== params.intentDigest || existing.walletId !== params.walletId || existing.workflowId !== params.workflowId || existing.operationKey !== params.operationKey) {
+				throw new Error(`SAT idempotency collision for ${requestId}: the workflow key is already bound to a different immutable intent digest`);
+			}
+			if (leaseIsLive(existing.lease) && existing.lease?.owner !== owner) {
+				return {
+					record: existing,
+					created: false,
+					claimed: false,
+					owner
+				};
+			}
+			const now = new Date().toISOString();
+			existing.lease = {
+				owner,
+				pid: process.pid,
+				acquiredAt: now,
+				expiresAt: new Date(Date.now() + leaseDurationMs(env)).toISOString()
+			};
+			existing.attempts += 1;
+			existing.updatedAt = now;
+			await writeLedger(filePath, ledger);
+			return {
+				record: existing,
+				created: false,
+				claimed: true,
+				owner
+			};
+		}
+		const now = new Date().toISOString();
+		const record = {
+			requestId,
+			workflowId: params.workflowId,
+			operationKey: params.operationKey,
+			intentDigest: params.intentDigest,
+			walletId: params.walletId,
+			action: params.action,
+			state: "prepared",
+			attempts: 1,
+			createdAt: now,
+			updatedAt: now,
+			lease: {
+				owner,
+				pid: process.pid,
+				acquiredAt: now,
+				expiresAt: new Date(Date.now() + leaseDurationMs(env)).toISOString()
+			}
+		};
+		ledger.records[requestId] = record;
+		await writeLedger(filePath, ledger);
+		return {
+			record,
+			created: true,
+			claimed: true,
+			owner
+		};
+	});
+}
+async function readSatSubmission(params) {
+	const filePath = resolveSatSubmissionLedgerPath(params);
+	return await withSatSubmissionLedgerLock(filePath, async () => {
+		const ledger = await readLedger(filePath);
+		return ledger.records[params.requestId] ?? null;
+	});
+}
+async function updateSatSubmission(params) {
+	const filePath = resolveSatSubmissionLedgerPath(params);
+	return await withSatSubmissionLedgerLock(filePath, async () => {
+		const ledger = await readLedger(filePath);
+		const record = ledger.records[params.requestId];
+		if (!record) {
+			throw new Error(`SAT submission ${params.requestId} is missing from its durable ledger`);
+		}
+		if (record.intentDigest !== params.intentDigest) {
+			throw new Error(`SAT submission ${params.requestId} intent digest changed during execution`);
+		}
+		if (params.owner && record.lease?.owner !== params.owner) {
+			throw new Error(`SAT submission ${params.requestId} lease ownership changed during execution`);
+		}
+		if (record.signature && params.signature && record.signature !== params.signature) {
+			throw new Error(`SAT submission ${params.requestId} returned a different transaction signature`);
+		}
+		assertStateTransition(params.requestId, record.state, params.state);
+		record.state = params.state;
+		if (params.signature !== undefined) {
+			record.signature = params.signature;
+		}
+		if (params.error !== undefined) {
+			record.error = params.error;
+		} else if (params.state === "confirmed") {
+			delete record.error;
+		}
+		if (params.releaseLease) {
+			delete record.lease;
+		}
+		record.updatedAt = new Date().toISOString();
+		await writeLedger(filePath, ledger);
+		return record;
+	});
+}
+async function waitForSatSubmissionLease(params) {
+	const timeoutAt = Date.now() + Math.max(100, params.timeoutMs ?? 65e3);
+	for (;;) {
+		const record = await readSatSubmission(params);
+		if (!record) {
+			throw new Error(`SAT submission ${params.requestId} disappeared while waiting for its lease`);
+		}
+		if (!leaseIsLive(record.lease)) {
+			return record;
+		}
+		if (Date.now() >= timeoutAt) {
+			throw new Error(`SAT submission ${params.requestId} is already executing in another process; retry the same idempotency key`);
+		}
+		await new Promise((resolve) => setTimeout(resolve, 25));
+	}
+}
+
+//#endregion
+export { buildSatSubmissionOperationKey, claimSatSubmission, digestSatSubmissionIntent, updateSatSubmission, waitForSatSubmissionLease };

package/dist/federation/auto-connect.js

@@ -1,7 +1,7 @@
 import { resolveStateDir } from "../config/paths.js";
 import { isTruthyEnvValue } from "../infra/env.js";
 import { resolveAgentPublicOrigin, resolveFederationBaseUrl, resolveFederationBondWalletId, resolveFederationHandle } from "./runtime.js";
-import { resolveFederationBondWallet, signFederationBondChallenge } from "../wallet/solana-bond-signing.js";
+import { FEDERATION_BOND_SIGNATURE_DOMAIN, federationBondSigningMessageBase64, resolveFederationBondWallet, signFederationBondChallenge } from "../wallet/solana-bond-signing.js";
 import { buildAttestation } from "./attestation.js";
 import path from "node:path";
 import fs from "node:fs/promises";
@@ -116,7 +116,7 @@ async function loadPersistedFederationBondProof(env) {
 	try {
 		const raw = await fs.readFile(proofPath, "utf-8");
 		const parsed = JSON.parse(raw);
-		if (typeof parsed.challengeId !== "string" || typeof parsed.bondId !== "string" || typeof parsed.walletId !== "string" || typeof parsed.walletAddress !== "string" || typeof parsed.handle !== "string" || typeof parsed.nodeId !== "string" || typeof parsed.federationBaseUrl !== "string" || typeof parsed.expiresAt !== "string" || typeof parsed.payload !== "string" || typeof parsed.payloadBase64 !== "string" || typeof parsed.signatureBase64 !== "string" || typeof parsed.signedAt !== "string") {
+		if (typeof parsed.challengeId !== "string" || typeof parsed.bondId !== "string" || typeof parsed.walletId !== "string" || typeof parsed.walletAddress !== "string" || typeof parsed.handle !== "string" || typeof parsed.nodeId !== "string" || typeof parsed.federationBaseUrl !== "string" || typeof parsed.expiresAt !== "string" || typeof parsed.payload !== "string" || typeof parsed.payloadBase64 !== "string" || parsed.signatureDomain !== FEDERATION_BOND_SIGNATURE_DOMAIN || typeof parsed.signedMessageBase64 !== "string" || typeof parsed.signatureBase64 !== "string" || typeof parsed.signedAt !== "string") {
 			return null;
 		}
 		return {
@@ -130,6 +130,8 @@ async function loadPersistedFederationBondProof(env) {
 			expiresAt: parsed.expiresAt,
 			payload: parsed.payload,
 			payloadBase64: parsed.payloadBase64,
+			signatureDomain: FEDERATION_BOND_SIGNATURE_DOMAIN,
+			signedMessageBase64: parsed.signedMessageBase64,
 			signatureBase64: parsed.signatureBase64,
 			signedAt: parsed.signedAt,
 			verifiedAt: typeof parsed.verifiedAt === "string" ? parsed.verifiedAt : undefined,
@@ -371,12 +373,38 @@ async function createFederationBondProof(opts) {
 	const challengeBody = challenge.json ?? {};
 	const challengeId = challengeBody.challengeId?.trim();
 	const expiresAt = challengeBody.expiresAt?.trim();
-	const payload = challengeBody.payload?.trim() || (challengeBody.payloadBase64 ? Buffer.from(challengeBody.payloadBase64, "base64").toString("utf-8") : "");
-	if (!challengeId || !expiresAt || !payload) {
+	let payloadBase64 = challengeBody.payloadBase64?.trim() ?? "";
+	let payload = challengeBody.payload ?? "";
+	if (payloadBase64) {
+		const decoded = Buffer.from(payloadBase64, "base64");
+		if (decoded.toString("base64") !== payloadBase64) {
+			throw new Error("federation bond challenge failed: payloadBase64 is not canonical");
+		}
+		const decodedPayload = decoded.toString("utf-8");
+		if (payload && payload !== decodedPayload) {
+			throw new Error("federation bond challenge failed: payload encodings disagree");
+		}
+		payload = decodedPayload;
+	} else if (payload) {
+		payloadBase64 = Buffer.from(payload, "utf-8").toString("base64");
+	}
+	if (!challengeId || !expiresAt || !payload || !payloadBase64) {
 		throw new Error("federation bond challenge failed: incomplete challenge payload");
 	}
+	if (!opts?.tier) {
+		throw new Error("federation bond challenge requires the locally reviewed bond tier");
+	}
 	const signedWallet = await signFederationBondChallenge({
-		payload,
+		challengeId,
+		federationOrigin: baseUrl,
+		payloadBase64,
+		handle: federationToken.handle,
+		nodeId: federationToken.nodeId,
+		tokenId: federationToken.tokenId,
+		bondId,
+		tier: opts.tier,
+		...opts.amountRaw?.trim() ? { amountRaw: opts.amountRaw.trim() } : {},
+		expiresAt,
 		env,
 		cfg: opts?.cfg,
 		walletId: resolvedWallet.walletId
@@ -391,14 +419,74 @@ async function createFederationBondProof(opts) {
 		federationBaseUrl: baseUrl,
 		expiresAt,
 		payload,
-		payloadBase64: challengeBody.payloadBase64?.trim() || Buffer.from(payload, "utf-8").toString("base64"),
+		payloadBase64,
+		signatureDomain: FEDERATION_BOND_SIGNATURE_DOMAIN,
+		signedMessageBase64: federationBondSigningMessageBase64({
+			challengeId,
+			federationOrigin: baseUrl,
+			payloadBase64
+		}),
 		signatureBase64: signedWallet.signatureBase64,
-		signedAt: new Date().toISOString()
+		signedAt: new Date().toISOString(),
+		...opts?.amountRaw?.trim() ? { bondAmountRaw: opts.amountRaw.trim() } : {},
+		...opts?.tier ? { bondTier: opts.tier } : {}
 	};
 	await persistFederationBondProof(env, proof);
 	opts?.log?.info?.(`federation bond proof prepared (${proof.handle} -> ${proof.walletAddress}, bond=${proof.bondId})`);
 	return proof;
 }
+async function persistFederationBondProofFromSignerReview(params) {
+	const env = params.env ?? process.env;
+	const review = params.review;
+	if (review.state !== "signed" || review.intentType !== "federation.bondChallenge" || review.semanticIntent.type !== "federation.bondChallenge" || review.artifactKind !== "domain-separated-message" || review.asset !== "federation:bond-challenge" || review.amount !== "1" || review.policyOperation !== "federation.bondChallenge" || review.requiredRole !== "vault" || review.requiredPrograms.length !== 1 || review.requiredPrograms[0] !== "domain:fased:federation-bond-challenge-v1") {
+		throw new Error("signed signer review is not an exact federation bond challenge");
+	}
+	const federation = review.semanticIntent.federation;
+	const signedMessageBase64 = federationBondSigningMessageBase64(federation);
+	if (!review.walletPublicKey || review.destination !== review.walletPublicKey || review.messageBase64 !== signedMessageBase64 || review.signature !== params.signatureBase64) {
+		throw new Error("signed federation review artifact does not match its wallet or payload");
+	}
+	const signature = Buffer.from(params.signatureBase64, "base64");
+	if (signature.length !== 64 || signature.toString("base64") !== params.signatureBase64) {
+		throw new Error("signed federation review returned a non-canonical Ed25519 signature");
+	}
+	const payloadBytes = Buffer.from(federation.payloadBase64, "base64");
+	if (payloadBytes.toString("base64") !== federation.payloadBase64) {
+		throw new Error("signed federation review payload is not canonical base64");
+	}
+	const payload = payloadBytes.toString("utf8");
+	if (!Buffer.from(payload, "utf8").equals(payloadBytes)) {
+		throw new Error("signed federation review payload is not valid UTF-8");
+	}
+	const challengeExpiresAt = Date.parse(federation.expiresAt);
+	if (!Number.isFinite(challengeExpiresAt) || challengeExpiresAt <= Date.now()) {
+		throw new Error("signed federation review challenge has expired");
+	}
+	const token = await loadPersistedFederationToken(env, { includeExpired: true });
+	if (!token || token.tokenId !== federation.tokenId || token.nodeId !== federation.nodeId || token.handle !== federation.handle) {
+		throw new Error("signed federation review does not match the persisted federation identity");
+	}
+	const configuredOrigin = resolveFederationBaseUrl(env);
+	if (!configuredOrigin || new URL(configuredOrigin).origin !== federation.federationOrigin) {
+		throw new Error("signed federation review does not match the configured federation origin");
+	}
+	return await persistFederationBondProof(env, {
+		challengeId: federation.challengeId,
+		bondId: federation.bondId,
+		walletId: params.walletId,
+		walletAddress: review.walletPublicKey,
+		handle: federation.handle,
+		nodeId: federation.nodeId,
+		federationBaseUrl: federation.federationOrigin,
+		expiresAt: federation.expiresAt,
+		payload,
+		payloadBase64: federation.payloadBase64,
+		signatureDomain: FEDERATION_BOND_SIGNATURE_DOMAIN,
+		signedMessageBase64,
+		signatureBase64: params.signatureBase64,
+		signedAt: review.updatedAt
+	});
+}
 async function submitFederationBondProof(opts) {
 	const env = opts?.env ?? process.env;
 	const proof = opts?.proof ?? await loadPersistedFederationBondProof(env);
@@ -415,6 +503,8 @@ async function submitFederationBondProof(opts) {
 		body: {
 			challengeId: proof.challengeId,
 			payloadBase64: proof.payloadBase64,
+			signatureDomain: proof.signatureDomain,
+			signedMessageBase64: proof.signedMessageBase64,
 			signatureBase64: proof.signatureBase64
 		}
 	});
@@ -713,4 +803,4 @@ function startFederationAutoConnect(opts) {
 }
 
 //#endregion
-export { createAndSubmitFederationBondProof, loadPersistedFederationBondProof, runFederationAutoConnectOnce, startFederationAutoConnect };
+export { createAndSubmitFederationBondProof, loadPersistedFederationBondProof, persistFederationBondProofFromSignerReview, runFederationAutoConnectOnce, startFederationAutoConnect, submitFederationBondProof };

package/dist/federation/marketplace-capability-adapter.js

@@ -1,3 +1,4 @@
+import { fetchWithSsrFGuard } from "../infra/net/fetch-guard.js";
 import { isMarketplaceAutomatedAdapterServiceKind } from "./marketplace-service-kinds.js";
 import { listLocalMarketplaceDeliveryTargets, listLocalMarketplaceOrders, upsertMarketplaceOrderConfig } from "./offers.js";
 
@@ -168,14 +169,36 @@ async function postWebhookDelivery(params) {
 		};
 	}
 	try {
-		const response = await params.fetchImpl(url, {
-			method: "POST",
-			headers: {
-				"content-type": "application/json",
-				"x-fased-marketplace-delivery": "capability"
-			},
-			body: JSON.stringify(params.payload)
+		if (new URL(url).protocol !== "https:") {
+			return {
+				ok: false,
+				reason: "webhook delivery requires HTTPS"
+			};
+		}
+	} catch {
+		return {
+			ok: false,
+			reason: "webhook delivery target has an invalid URL"
+		};
+	}
+	let guarded;
+	try {
+		guarded = await fetchWithSsrFGuard({
+			url,
+			fetchImpl: params.fetchImpl,
+			lookupFn: params.ssrfLookupFn,
+			timeoutMs: 1e4,
+			auditContext: "marketplace-capability-webhook",
+			init: {
+				method: "POST",
+				headers: {
+					"content-type": "application/json",
+					"x-fased-marketplace-delivery": "capability"
+				},
+				body: JSON.stringify(params.payload)
+			}
 		});
+		const response = guarded.response;
 		if (!response.ok) {
 			return {
 				ok: false,
@@ -188,6 +211,8 @@ async function postWebhookDelivery(params) {
 			ok: false,
 			reason: error instanceof Error ? error.message : String(error)
 		};
+	} finally {
+		await guarded?.release();
 	}
 }
 function resolveSubscriptionUpdate(params) {
@@ -279,6 +304,7 @@ async function runMarketplaceCapabilityAdapter(params) {
 	} else if (targetKind === "webhook") {
 		const webhookResult = await postWebhookDelivery({
 			fetchImpl: deps.fetchImpl,
+			ssrfLookupFn: deps.ssrfLookupFn,
 			target,
 			payload: deliveryPayload
 		});