beignet 0.21.9 → 0.21.10

package/dist/cli/beignet-node.js

@@ -454,6 +454,9 @@ function jitInvoiceError(err) {
     if (/^LSP declined the JIT receive intent|above the accepted maximum|without an intercept scid/.test(message)) {
         return new errors_1.BeignetError(errors_1.BeignetErrorCode.JIT_REFUSED, message);
     }
+    if (/^JIT receive needs a new channel from the LSP/.test(message)) {
+        return new errors_1.BeignetError(errors_1.BeignetErrorCode.NEW_CHANNELS_REFUSED, message);
+    }
     if (/timed out waiting for the LSP/.test(message)) {
         return new errors_1.BeignetError(errors_1.BeignetErrorCode.JIT_TIMEOUT, message);
     }
@@ -470,8 +473,33 @@ function requireChannelIdHex(value, field = 'channelId') {
     return Buffer.from(value, 'hex');
 }
 function isHeldRestore(ch) {
-    return ch.restoreRecencyUnproven === true;
+    return (ch.restoreRecencyUnproven === true ||
+        ch.reestablishRecencyUnproven === true ||
+        ch.reestablishSecretMissing === true ||
+        ch.restoreRevokedRisk === true);
 }
+const STALE_STATE_FORCE_CLOSE_REFUSAL = 'This channel was restored from a Recovery Capsule and its state ' +
+    'cannot be proven current, so the node will not broadcast its ' +
+    'commitment on its own initiative. If the peer holds a newer ' +
+    'state, force closing publishes a revoked commitment and the ' +
+    'whole channel balance is lost to the justice path. Waiting for ' +
+    'the peer to close is the safe outcome. Set ' +
+    'acceptStaleStateRisk: true to force close anyway.';
+const REESTABLISH_FORCE_CLOSE_REFUSAL = 'The peer claimed at channel_reestablish that this channel state is ' +
+    'behind and showed no proof. Its recency cannot be proven, so the node ' +
+    'will not broadcast its commitment on its own initiative. If the claim ' +
+    'is true, force closing publishes a revoked commitment and the whole ' +
+    'channel balance is lost to the justice path; if the peer is lying, ' +
+    'the close is safe. Waiting for the peer to close is the safe outcome. ' +
+    'Set acceptStaleStateRisk: true to force close anyway.';
+const SECRET_MISSING_FORCE_CLOSE_REFUSAL = 'This node could not produce the per-commitment secret its own ' +
+    'channel_reestablish owes this peer, so local storage is damaged or ' +
+    'incomplete and the recency of this channel cannot be proven. The node ' +
+    'will not broadcast its commitment on its own initiative. If the stored ' +
+    'state is the stale one, force closing publishes a revoked commitment ' +
+    'and the whole channel balance is lost to the justice path. Waiting for ' +
+    'the peer to close is the safe outcome. Set acceptStaleStateRisk: true ' +
+    'to force close anyway.';
 class BeignetNode extends events_1.EventEmitter {
     getOfflineReceive() {
         if (!this.offlineReceive)
@@ -533,6 +561,7 @@ class BeignetNode extends events_1.EventEmitter {
         this._autoApplySettleMs = BeignetNode.DEFAULT_AUTO_APPLY_SETTLE_MS;
         this._autoApplyMaxWaitMs = BeignetNode.DEFAULT_AUTO_APPLY_MAX_WAIT_MS;
         this._bootTargetEmpty = false;
+        this._bootTargetEmptyAt = 0;
         this._autoApply = { phase: 'idle' };
         this._resuming = false;
         this._lockPath = null;
@@ -730,13 +759,14 @@ class BeignetNode extends events_1.EventEmitter {
         if (this._recoveryAutoApply && this.recoveryMode !== 'peer-storage') {
             throw new errors_1.BeignetError('INVALID_PARAMS', 'recoveryAutoApply applies to peer-storage mode only');
         }
-        if (this._recoveryAutoApply) {
-            try {
-                (0, recovery_1.assertEmptyTarget)(this.storage);
-                this._bootTargetEmpty = true;
-            }
-            catch {
-                this._bootTargetEmpty = false;
+        try {
+            (0, recovery_1.assertEmptyTarget)(this.storage);
+            this._bootTargetEmpty = true;
+            this._bootTargetEmptyAt = Date.now();
+        }
+        catch {
+            this._bootTargetEmpty = false;
+            if (this._recoveryAutoApply) {
                 this.log('info', 'Recovery auto-apply is armed but this database already holds ' +
                     'state; capsules storage peers return are reported, not applied');
             }
@@ -894,6 +924,7 @@ class BeignetNode extends events_1.EventEmitter {
             coinType,
             network: lnNetwork,
             storage: this.storage,
+            newChannelsRefused: () => this.newChannelRefusal(),
             enableNetworking: true,
             autoReconnect: opts.autoReconnect ?? true,
             autoUpdateChannelFees: opts.autoUpdateChannelFees ?? false,
@@ -1430,7 +1461,8 @@ class BeignetNode extends events_1.EventEmitter {
             const hex = channelId.toString('hex');
             this.emit('ffor:enforce', {
                 channelId: hex,
-                epoch: this.fforEpochView(hex, record)
+                epoch: this.fforEpochView(hex, record),
+                ...this.recencyHold(channelId)
             });
         });
         this.node.on('recovery:durable', (through) => {
@@ -2340,6 +2372,42 @@ class BeignetNode extends events_1.EventEmitter {
             lastReason: a.lastReason ?? null
         };
     }
+    emptyBootRestoreUndecided() {
+        if (!this._bootTargetEmpty)
+            return false;
+        if (!this._recoveryAutoApply || this.recoveryMode !== 'peer-storage') {
+            return false;
+        }
+        const phase = this._autoApply.phase;
+        if (phase === 'applied' || phase === 'refused')
+            return false;
+        return Date.now() - this._bootTargetEmptyAt < this._autoApplyMaxWaitMs;
+    }
+    newChannelRefusal() {
+        const node = this.node;
+        if (!node) {
+            return 'New channels are refused until this node has finished booting';
+        }
+        const phase = this._autoApply.phase;
+        if (phase === 'settling' || phase === 'applying' || this._resuming) {
+            const stage = this._resuming ? 'rebuilding' : phase;
+            return ('New channels are refused while a Recovery Capsule restore is ' +
+                `unresolved (auto-apply ${stage}): the restored key-index table ` +
+                'decides the next channel key index');
+        }
+        if (this.emptyBootRestoreUndecided()) {
+            return ('New channels are refused while this empty boot waits for a ' +
+                'Recovery Capsule (auto-apply is armed and has not decided): the ' +
+                'capsule carries the key-index table the next channel key index ' +
+                'continues from');
+        }
+        if (node.getCurrentBlockHeight() === 0 &&
+            node.getChannelManager().channelIndexTipFloorArmed) {
+            return ('New channels are refused until the chain tip is known so ' +
+                'recovery can initialize channel keys');
+        }
+        return null;
+    }
     get resuming() {
         return this._resuming;
     }
@@ -3998,9 +4066,22 @@ class BeignetNode extends events_1.EventEmitter {
     }
     async fforRecover(body) {
         const idBuf = this.fforChannelId(body.channelId);
-        const r = await this.node.rescueFforEpoch(idBuf.toString('hex'), {
+        if (body.forceCloseIfUnreachable === true &&
+            this.node.getFforEpoch(idBuf.toString('hex'))?.role === 'R') {
+            this.requireForceCloseAcknowledgement(idBuf, body.acceptStaleStateRisk === true);
+        }
+        const r = await this.node
+            .rescueFforEpoch(idBuf.toString('hex'), {
             forceCloseIfUnreachable: body.forceCloseIfUnreachable === true,
+            acceptStaleStateRisk: body.acceptStaleStateRisk === true,
             destinationScript: this.fforDestinationScript()
+        })
+            .catch((err) => {
+            if (err instanceof types_5.InvalidRequestError) {
+                this.requireForceCloseAcknowledgement(idBuf, body.acceptStaleStateRisk === true);
+                throw new errors_1.BeignetError('INVALID_PARAMS', err.message);
+            }
+            throw err;
         });
         return {
             action: r.action,
@@ -4060,14 +4141,14 @@ class BeignetNode extends events_1.EventEmitter {
             error: status.error ?? null
         };
     }
-    fforEnforce(channelId) {
+    fforEnforce(channelId, acceptStaleStateRisk = false) {
         const idBuf = this.fforChannelId(channelId);
         const f = this.node.getFforEpoch(idBuf.toString('hex'));
         if (!f || f.role !== 'R') {
             throw new errors_1.BeignetError(errors_1.BeignetErrorCode.NOT_FOUND, 'no FFOR epoch of ours on this channel');
         }
         return {
-            ...this.forceCloseChannel(idBuf.toString('hex')),
+            ...this.forceCloseChannel(idBuf.toString('hex'), acceptStaleStateRisk),
             preimagesKnown: f.knownPreimages.filter((p) => p !== null).length
         };
     }
@@ -4120,19 +4201,19 @@ class BeignetNode extends events_1.EventEmitter {
             throw new errors_1.BeignetError(errors_1.BeignetErrorCode.CHANNEL_NOT_FOUND, `Channel not found: ${idBuf.toString('hex')}`);
         }
         const canonicalId = idBuf.toString('hex');
-        const held = this.node
+        const row = this.node
             .getRecoveryStatus()
-            .channels.find((c) => c.channelId === canonicalId)
-            ?.restoreRecencyUnproven;
-        if (held === true && acceptStaleStateRisk !== true) {
-            throw new errors_1.BeignetError('INVALID_PARAMS', 'This channel was restored from a Recovery Capsule and its state ' +
-                'cannot be proven current, so the node will not broadcast its ' +
-                'commitment on its own initiative. If the peer holds a newer ' +
-                'state, force closing publishes a revoked commitment and the ' +
-                'whole channel balance is lost to the justice path. Waiting for ' +
-                'the peer to close is the safe outcome. Set ' +
-                'acceptStaleStateRisk: true to force close anyway.');
-        }
+            .channels.find((c) => c.channelId === canonicalId);
+        if (row?.restoreRevokedRisk === true) {
+            throw new errors_1.BeignetError(errors_1.BeignetErrorCode.FORCE_CLOSE_REVOKED, "This channel's peer has shown, in channel_reestablish, that it " +
+                'already holds the revocation for the stored commitment. Force ' +
+                'closing would publish a revoked commitment and the whole channel ' +
+                'balance would be lost to the justice path. There is no risk to ' +
+                'accept, so acceptStaleStateRisk does not apply: wait for the ' +
+                'peer to force close, or for its retransmission to bring this ' +
+                'channel level again.');
+        }
+        this.requireForceCloseAcknowledgement(idBuf, acceptStaleStateRisk);
         let destinationScript = this.sweepDestinationScript;
         if (!destinationScript) {
             const bitcoin = require('bitcoinjs-lib');
@@ -4140,6 +4221,36 @@ class BeignetNode extends events_1.EventEmitter {
         }
         return this.node.forceCloseChannel(idBuf, destinationScript);
     }
+    recencyHold(channelId) {
+        const state = this.node
+            .getChannelManager()
+            .getChannel(channelId)
+            ?.getFullState();
+        return {
+            ...(state?.restoreRecencyUnproven === true
+                ? { restoreRecencyUnproven: true }
+                : {}),
+            ...(state?.reestablishRecencyUnproven === true
+                ? { reestablishRecencyUnproven: true }
+                : {}),
+            ...(state?.reestablishSecretMissing === true
+                ? { reestablishSecretMissing: true }
+                : {})
+        };
+    }
+    requireForceCloseAcknowledgement(channelId, acceptStaleStateRisk) {
+        if (acceptStaleStateRisk === true)
+            return;
+        const hold = this.recencyHold(channelId);
+        if (hold.reestablishSecretMissing) {
+            throw new errors_1.BeignetError('INVALID_PARAMS', SECRET_MISSING_FORCE_CLOSE_REFUSAL);
+        }
+        if (hold.restoreRecencyUnproven || hold.reestablishRecencyUnproven) {
+            throw new errors_1.BeignetError('INVALID_PARAMS', hold.restoreRecencyUnproven
+                ? STALE_STATE_FORCE_CLOSE_REFUSAL
+                : REESTABLISH_FORCE_CLOSE_REFUSAL);
+        }
+    }
     rebroadcastClose(channelId) {
         return this.node.rebroadcastClose(Buffer.from(channelId, 'hex'));
     }
@@ -4179,6 +4290,12 @@ class BeignetNode extends events_1.EventEmitter {
         const acceptsNewThrough = channel.acceptsNewHtlcs(true);
         if (state.restoreRecencyUnproven === true)
             issues.push('HELD_RESTORE: Channel was restored from a Recovery Capsule and its state has not been proven current, so it takes no new HTLCs. Routing hints will be skipped.');
+        if (state.reestablishRecencyUnproven === true)
+            issues.push('HELD_REESTABLISH: The peer claimed at channel_reestablish that this channel state is behind and showed no proof, so the channel is held and takes no new HTLCs. Routing hints will be skipped.');
+        if (state.reestablishSecretMissing === true)
+            issues.push('HELD_SECRET_MISSING: This node could not produce the per-commitment secret its own channel_reestablish owes this peer, so local storage is damaged or incomplete and the channel is held and takes no new HTLCs. Routing hints will be skipped. The store cannot recover the secret, so the exits are the peer closing or an acknowledged force close.');
+        if (state.restoreRevokedRisk === true)
+            issues.push('HELD_REVOKED: The peer proved at channel_reestablish that it already holds the revocation for this commitment, so the channel takes no new HTLCs and no force close of it is permitted, the acknowledged one included. Routing hints will be skipped. It clears when the peer retransmits and this channel levels.');
         if (state.fundingUnaccounted === true)
             issues.push('FUNDING_UNACCOUNTED: Neither mempool nor chain can account for the funding transaction, so the channel takes no new HTLCs. Routing hints will be skipped. Existing HTLCs still settle, and the quarantine lifts by itself if the funding reappears.');
         if (state.state !== 'NORMAL' &&
@@ -4249,6 +4366,12 @@ class BeignetNode extends events_1.EventEmitter {
             info.htlcUsable = ch.htlcUsable;
         if (ch.restoreRecencyUnproven)
             info.restoreRecencyUnproven = ch.restoreRecencyUnproven;
+        if (ch.reestablishRecencyUnproven)
+            info.reestablishRecencyUnproven = ch.reestablishRecencyUnproven;
+        if (ch.reestablishSecretMissing)
+            info.reestablishSecretMissing = ch.reestablishSecretMissing;
+        if (ch.restoreRevokedRisk)
+            info.restoreRevokedRisk = ch.restoreRevokedRisk;
         if (ch.fundingUnaccounted)
             info.fundingUnaccounted = ch.fundingUnaccounted;
         if (ch.payThroughSplice !== undefined)