GameCult/CultLib
Watch
9
0
Fork
You've already forked CultLib
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

cultnet-ts: stop exporting signIdunnRuntimePresence; document two limits

Browse source 
The function took state and lease digest from the caller, so anyone holding the
authority could sign active without reportHealth or assertWriteLease. It is now
private to the signer. Test: the subpath and root do not expose it. Docs:
waitForWriteLease throws out of publish if health is already non-warming;
MAX_RECENT_WARMING_PROOFS=64 is a recorded limit.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Meta Vens 2026-09-29 03:26:10 +02:00
commit 5ed9dbbcb8
3 changed files with 10 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

5
packages/cultnet-ts/src/idunn-odin-presence-publisher.ts
View file

@ -15,6 +15,11 @@ export type IdunnRuntimePresencePublisher = {
readonly requiresWriteLease: boolean;
/** Publishes the signer's presence in the health the signer reports. */
publish(detail: string): Promise<string>;
/**
* Publishes warming presence until Idunn's lease names one. Call it before
* `reportHealth('active')`: once the signer reports a non-warming health,
* `publish` inside this loop throws (it needs the lease) instead of polling.
*/
waitForWriteLease(options?: { pollIntervalMs?: number; signal?: AbortSignal }): Promise<string>;
assertWriteLease(): Promise<string>;
};

4
packages/cultnet-ts/src/idunn-runtime-authority.ts
View file

@ -29,6 +29,8 @@ const PROVIDER_PROTECTOR_CONTEXT = "gamecult-provider-health-identity-v1";
const ACTIVATION_ID_DOMAIN = Buffer.from("idunn.runtime-activation.id.v1\0", "utf8");
const CULTCACHE_STORE_FORMAT = "cultcache.store.v1";
const ED25519_PKCS8_PREFIX = Buffer.from("302e020100300506032b657004220420", "hex");
// Limit: more than this many warmings signed between Idunn's observation and
// assertWriteLease would push the leased one out and refuse a valid lease.
const MAX_RECENT_WARMING_PROOFS = 64;
const authoritiesWithSigner = new WeakSet<object>();
const authorityKeys = new WeakMap<object, { providerPrivateKey: crypto.KeyObject; activationPrivateKey: crypto.KeyObject }>();
@ -195,7 +197,7 @@ export function loadIdunnRuntimeAuthorityFromEnvironment(
* Signs the fixed Idunn v2 positional runtime-presence contract with the
* provider identity and this launch's Idunn-issued activation key.
*/
export function signIdunnRuntimePresence(
function signIdunnRuntimePresence(
authority: IdunnRuntimeAuthority,
fields: Omit<RuntimePresenceHealth, "target" | "expectedProjectionSha256" | "planId" | "incarnationId" | "sealedReleaseId" | "activationWitnessSha256" | "stateSchemaGeneration" | "stateContractSha256" | "runtimeId" | "runtimeInstanceId" | "boundEndpoint" | "healthContract" | "signerIdentityId" | "activationSignerIdentityId">,
): { presence: RuntimePresenceHealth; payload: Uint8Array; canonicalSha256: string } {

2
packages/cultnet-ts/test/idunn-runtime-authority.test.ts
View file

@ -386,4 +386,6 @@ test("the idunn-runtime subpath loads the signer and loader without loading dgra
assert.equal(typeof exported.createIdunnRuntimeSigner, "function");
assert.equal(typeof exported.loadIdunnRuntimeAuthorityFromEnvironment, "function");
assert.equal(exported.createIdunnRuntimePresencePublisher, undefined);
assert.equal(exported.signIdunnRuntimePresence, undefined);
assert.equal((require("cultnet-ts") as Record<string, unknown>).signIdunnRuntimePresence, undefined);
});