Environment variables

server/testnet/http.ts

@@ -21,6 +21,7 @@ import { custodyCommandSchema } from '../../shared/custody.ts';
 import { CustodyMarket, CustodyError, custodyMode } from '../market/custody.ts';
 import { openCustodyStorage } from '../market/custody-storage.ts';
 import type { PostgresCustody } from '../market/postgres-custody.ts';
+import { validateMarketPolicy } from '../market/policy.ts';
 import { IS_MAINNET, PROFILE } from '../../shared/network.ts';
 import { assertLaunchAllowed, launchManifest } from '../launch.ts';
 import { resourceConfig, RpcBudget, RpcError } from '../resources.ts';
@@ -29,6 +30,7 @@ import { trustedProxies, operationsPort, startOperations } from '../operations.t
 const root = fileURLToPath(new URL('../../', import.meta.url));
 assertLaunchAllowed();
 const paymentConfig = marketConfig(); // Fail before opening node resources if live payments are requested.
+await validateMarketPolicy(paymentConfig); // Reject invalid recipient checksum/network before opening node resources.
 const custodyConfig = custodyMode(); // Explicit opt-in sandbox only. Unknown/live modes fail before opening resources.
 const limits = resourceConfig();
 const proxyTrust=trustedProxies();
@@ -56,7 +58,7 @@ try { market = await Market.open(dataDir, ledger, paymentConfig); }
 catch(e) {peers.close();ledger.close();engine.close();await lock.close();await unlink(lockPath);throw e;}
 let custody: CustodyMarket | PostgresCustody | undefined;
 try {
-  if (custodyConfig === 'sandbox') custody = await openCustodyStorage(dataDir, { feeBps: paymentConfig.feeBps,
+  if (custodyConfig === 'sandbox') custody = await openCustodyStorage(dataDir, { ...paymentConfig,
     card: (hash, owner, sequence) => {
       const nft = ledger.nft(hash);
       if (!nft || nft.owner !== owner || nft.confirmations < CONSENSUS.coinbaseMaturity || nft.sequence !== sequence ||

server/testnet/sale-candidate.ts

@@ -45,6 +45,9 @@ export function termsForCustodyOrder(order: CustodyOrder, context: SaleContext,
   custodianId: string; host: string; feeBps: number; lockUntilHeight: number; expiresHeight: number;
 }): SaleTerms {
   check(order.status === 'awaiting-lock', 'Only awaiting-lock custody orders can draft candidate terms');
+  // The unactivated candidate predates configurable hosting recipients. Never silently discard one.
+  check(!order.hostFeeAddress || order.hostFeeAddress === ADDITIONAL_MARKET_FEE.address,
+    'Custom host fee recipient requires a reviewed sale-candidate terms extension');
   const allocation = allocateXmrSale(parseAtomicXmr(order.grossAtomicXmr), options.feeBps);
   check(order.sellerAtomicXmr === allocation.sellerBeforeNetworkCosts.toString() && order.hostAtomicXmr === allocation.hosting.toString() &&
     order.authorAtomicXmr === allocation.author.toString() && order.authorAddress === ADDITIONAL_MARKET_FEE.address,