Custodial markets

server/testnet/http.ts

@@ -5,7 +5,7 @@ import { resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { mkdir, open, unlink } from 'node:fs/promises';
 import { z } from 'zod';
-import { NETWORK } from '../../shared/testnet.ts';
+import { NETWORK, CONSENSUS } from '../../shared/testnet.ts';
 import { testnetOwnerOf, transactionCardIds } from '../../shared/testnet.ts';
 import { CHAIN_ID, blockSchema, tradeSchema, transferSchema, transactionSchema } from './consensus.ts';
 import { RandomX } from './randomx.ts';
@@ -17,6 +17,8 @@ import { wikipediaArticles } from '../wiki.ts';
 import { Market, marketConfig } from '../market/store.ts';
 import { marketCommandSchema } from '../../shared/market.ts';
 import { marketCommandV3Schema } from '../../shared/market-v3.ts';
+import { custodyCommandSchema } from '../../shared/custody.ts';
+import { CustodyMarket, CustodyError, custodyMode } from '../market/custody.ts';
 import { IS_MAINNET, PROFILE } from '../../shared/network.ts';
 import { assertLaunchAllowed, launchManifest } from '../launch.ts';
 import { resourceConfig, RpcBudget, RpcError } from '../resources.ts';
@@ -25,6 +27,7 @@ import { trustedProxies, operationsPort, startOperations } from '../operations.t
 const root = fileURLToPath(new URL('../../', import.meta.url));
 assertLaunchAllowed();
 const paymentConfig = marketConfig(); // Fail before opening node resources if live payments are requested.
+const custodyConfig = custodyMode(); // Explicit opt-in sandbox only. Unknown/live modes fail before opening resources.
 const limits = resourceConfig();
 const proxyTrust=trustedProxies();
 const opsPort=operationsPort();
@@ -49,6 +52,17 @@ catch(e) {ledger.close();engine.close();await lock.close();await unlink(lockPath
 let market: Market;
 try { market = await Market.open(dataDir, ledger, paymentConfig); }
 catch(e) {peers.close();ledger.close();engine.close();await lock.close();await unlink(lockPath);throw e;}
+let custody: CustodyMarket | undefined;
+try {
+  if (custodyConfig === 'sandbox') custody = await CustodyMarket.open(dataDir, { feeBps: paymentConfig.feeBps,
+    card: (hash, owner, sequence) => {
+      const s = ledger.snapshot(), b = s.blocks.find(block => block.tokenId === hash);
+      if (!b || testnetOwnerOf(s, hash) !== owner || s.blocks.length + 1 - b.height < CONSENSUS.coinbaseMaturity ||
+        s.transfers.filter(tx => transactionCardIds(tx).includes(hash)).length !== sequence ||
+        s.pendingTransfers.some(tx => transactionCardIds(tx).includes(hash))) return undefined;
+      return { title: b.article.title };
+    } });
+} catch(e) {market.close();peers.close();ledger.close();engine.close();await lock.close();await unlink(lockPath);throw e;}
 const app = express();
 app.disable('x-powered-by');
 if(proxyTrust.length)app.set('trust proxy',proxyTrust);
@@ -83,6 +97,24 @@ app.get('/api/network',(_req,res)=>res.json(launchManifest()));
 app.get('/api/chain',(_req,res)=>res.json(ledger.legacySnapshot(limits.legacyBlocks)));
 app.get('/api/peers',(_req,res)=>res.json({peers:peers.status()}));
 app.get('/api/market', (req,res)=>res.json(market.browse(Number(req.query.offset ?? 0))));
+app.get('/api/custody', (req,res)=> {
+  if (!custody) { res.json({ enabled: false }); return; }
+  try { res.json(custody.browse(Number(req.query.offset ?? 0))); }
+  catch (error) {
+    if (error instanceof CustodyError) res.status(400).json({ error: error.message });
+    else res.status(503).json({ error: 'Custody sandbox unavailable; operator review required.' });
+  }
+});
+app.post('/api/custody/command', rateLimit({windowMs:60000,limit:30,standardHeaders:'draft-8',legacyHeaders:false}), (req,res)=> {
+  if (!custody) { res.status(503).json({ error: 'Custody sandbox is disabled on this host.' }); return; }
+  const parsed = custodyCommandSchema.safeParse(req.body);
+  if (!parsed.success) { res.status(400).json({ error: 'Invalid custody command schema.' }); return; }
+  try { res.json(custody.execute(parsed.data)); }
+  catch (error) {
+    if (error instanceof CustodyError) res.status(400).json({ error: error.message });
+    else res.status(503).json({ error: 'Custody state conflict; refresh activity before retrying. Operator review may be required.' });
+  }
+});
 app.post('/api/market/command',rateLimit({windowMs:60000,limit:60,standardHeaders:'draft-8',legacyHeaders:false}),async(req,res)=>{
   const current = marketCommandV3Schema.safeParse(req.body);
   const command = current.success ? current.data : marketCommandSchema.parse(req.body);
@@ -198,6 +230,6 @@ let stopping=false;
 for(const signal of ['SIGTERM','SIGINT']as const)process.once(signal,()=>{
   if(stopping)return;stopping=true;peers.close();operations.close();clearInterval(marketTimer);
   const timeout=setTimeout(()=>process.exit(1),25000);timeout.unref();
-  server.close(async()=>{market.close();ledger.close();engine.close();await lock.close();await unlink(lockPath).catch(()=>{});clearTimeout(timeout);process.exit(0);});
+  server.close(async()=>{custody?.close();market.close();ledger.close();engine.close();await lock.close();await unlink(lockPath).catch(()=>{});clearTimeout(timeout);process.exit(0);});
 });
-server.on('error',async()=>{clearInterval(marketTimer);operations.close();peers.close();market.close();ledger.close();engine.close();await lock.close();await unlink(lockPath).catch(()=>{});process.exit(1);});
+server.on('error',async()=>{clearInterval(marketTimer);operations.close();peers.close();custody?.close();market.close();ledger.close();engine.close();await lock.close();await unlink(lockPath).catch(()=>{});process.exit(1);});