blvm-node 0.1.45

[package]
name = "blvm-node"
version = "0.1.45"
edition = "2024"
authors = ["Bitcoin Commons Team"]
description = "Bitcoin Commons BLVM: Minimal Bitcoin node implementation using blvm-protocol and blvm-consensus"
license = "MIT"
repository = "https://github.com/BTCDecoded/blvm-node"
homepage = "https://btcdecoded.org"
documentation = "https://docs.rs/blvm-node"
keywords = ["bitcoin", "node", "blockchain", "cryptocurrency", "p2p"]
categories = ["cryptography::cryptocurrencies", "network-programming"]
rust-version = "1.85"

[lints.rust]
unexpected_cfgs = { level = "warn", check-cfg = ['cfg(feature, values("governance", "erlay", "rayon", "wasm-modules"))'] }
# Integration tests (`tests/*.rs`) intentionally exercise APIs without always consuming every binding.
unused_variables = "allow"
unused_comparisons = "allow"
unused_doc_comments = "allow"

# Integration-test ergonomics (CI runs `cargo clippy --tests -- -D warnings`).
[lints.clippy]
assertions_on_constants = "allow"
too_many_arguments = "allow"
single_match = "allow"
field_reassign_with_default = "allow"

[package.metadata.docs.rs]
all-features = true
rustdoc-args = ["--cfg", "docsrs"]

[dependencies]
# Protocol / consensus / spec-lock from crates.io (monorepo: checkout siblings for local iteration).
blvm-protocol = { version = ">=0.1, <1" }
blvm-consensus = { version = ">=0.1, <1", optional = true }
blvm-spec-lock = { version = ">=0.1, <1", optional = true, default-features = false }
# crates.io releases use 0.1 semver; sibling [patch.crates-io] path for monorepo work.
# Node requires current MuHash APIs (running-state serde, insert_mut/remove_mut hot path).
blvm-muhash = { version = ">=0.1, <1" }

# Storage layer - EXACT VERSIONS for security
sled = { version = "=0.34.7", optional = true }
redb = { version = "=1.4", optional = true }
rocksdb = { version = "=0.24.0", optional = true }
# Pure-Rust LevelDB reader: used when Bitcoin Core chainstate has .ldb (true LevelDB) files
# that RocksDB cannot open. Gated behind the rocksdb feature (migration requires rocksdb dest).
rusty-leveldb = { version = "4", optional = true }
# Git-pinned deps: used only where upstream has not cut a crates.io release containing
# the API we need. All are pinned to an exact rev or tag to guarantee reproducibility.
# Policy: upgrade to crates.io as soon as a compatible release ships; never leave
# a git dep on a floating branch. Packagers who disallow git deps should disable the
# relevant feature (e.g. `--no-default-features` for tidesdb).
#
# heed3: LMDB mdb.master3 wrapper (MVCC, concurrent readers). Requires liblmdb at link time.
heed3 = { version = "=0.22.1", optional = true, default-features = false }
# rkyv: zero-copy archived values paired with heed3 mmap reads.
rkyv = { version = "=0.8.16", optional = true, features = ["bytecheck"] }
# Pinned rev; build.rs builds libtidesdb from source and links lz4/zstd/snappy (CI installs -dev packages).
tidesdb = { git = "https://github.com/tidesdb/tidesdb-rs.git", rev = "2c128540b02400a538475d992a122d940eb93da3", version = "0.6.7", optional = true }

# Networking layer - EXACT VERSIONS for security
# Explicit features avoid `full` (smaller graphs, clearer deps). Mirrors actual `tokio::` usage
# (`rt-multi-thread`, `sync`, `time`, `net`, `fs`, `process`, `io-util`, `signal`, test macros).
tokio = { version = "=1.48.0", features = [
    "macros",
    "rt",
    "rt-multi-thread",
    "sync",
    "time",
    "net",
    "io-util",
    "fs",
    "process",
    "signal",
] }
tokio-util = { version = "=0.7.17", features = ["codec", "io"] }  # Updated for iroh 0.95 compatibility (requires ^0.7.14)
futures = "=0.3.31"  # Updated for iroh 0.95 compatibility (requires ^0.3.31)
# HTTP server - EXACT VERSIONS for security
http = "=1.1.0"
http-body-util = "=0.1.1"
hyper = { version = "=1.8.0", features = ["server", "http1", "http2"] }  # Updated for iroh 0.95 compatibility (hyper-util 0.1.18 requires ^1.8.0)
hyper-util = { version = "=0.1.18", features = ["server", "http1", "tokio"] }  # Updated for iroh 0.95 compatibility (requires ^0.1.11)

# Serialization - EXACT VERSIONS for security
serde = { version = "=1.0.228", features = ["derive"] }  # Updated for iroh 0.95 compatibility (requires ^1.0.219)
serde_json = "=1.0.133"
serde_bytes = "=0.11.19"  # Updated for iroh 0.95 compatibility (requires ^0.11.17)
bincode = "=1.3.3"
bytes = "=1.11.1"  # RUSTSEC-2026-0007: Integer overflow in BytesMut::reserve (was 1.10.1)
toml = "=0.8.2"

# Pure-Rust secp256k1 (same implementation as blvm-consensus/blvm-protocol)
blvm-secp256k1 = { version = ">=0.1, <1" }
sha2 = "=0.10.9"
ripemd = "=0.1.3"
hex = "=0.4.3"
siphasher = "=0.3"
# bindgen (via librocksdb-sys) requires rustc-hash ^2.1; pin must match lockfile/resolver.
rustc-hash = "=2.1.1"  # FxHashMap/FxHashSet for disk_utxo hot path (2-3× faster than SipHash)
zeroize = { version = "=1.8.2", features = ["zeroize_derive"] }  # ^1.8 required by rustls (iroh); pin patch

# Network utilities — local IP detection is stdlib-only (UDP socket trick in lan_discovery.rs)
constant_time_eq = "=0.3"  # Constant-time comparison for token authentication
# RUSTSEC-2026-0009: iroh/rcgen transitive; force >=0.3.47 (crates.io ships 0.3.47+).
time = { version = ">=0.3.47", default-features = false }
aes-gcm = "=0.10.3"  # Module encryption
hkdf = "=0.12.4"  # Key derivation for module encryption

# Random number generation for Dandelion++
rand = "=0.8.5"
# Directory utilities for Bitcoin Core detection
dirs = "=5.0"
# SmallVec: required because blvm-protocol's Transaction always uses SmallVec regardless
# of feature flags in published versions.  The production feature previously made this
# optional but that's incompatible with the published blvm-protocol API.
smallvec = { version = "=1.15.1", features = ["serde", "const_generics"] }

# Multi-consumer channel for prefetch workers and ibd_engine Compacter
crossbeam-channel = "=0.5"
# Lower-contention mutex for IBD feeder buffer (validation + feeder hot path) and ibd_engine snapshot pattern
parking_lot = "=0.12"
# Parallel query in ibd_engine MemoryRun and SpendSession key sorting (optional, enabled via `rayon` feature)
rayon = { version = "1", optional = true }

# Address encoding (BIP173/350/351) is handled by blvm-protocol (bech32 dep lives there).
# Legacy P2PKH/P2SH (Base58Check) decoded inline in rpc/rawtx.rs using sha2.

# Error handling - EXACT VERSIONS for security
anyhow = "=1.0.93"
thiserror = "=1.0.69"

# Logging - EXACT VERSIONS for security
tracing = "=0.1.41"  # Updated for iroh 0.95 compatibility (requires ^0.1.41)
tracing-subscriber = { version = "=0.3.20", features = ["env-filter"] }

# CLI - EXACT VERSIONS for security
clap = { version = "=4.4.11", features = ["derive"] }

# Async traits - for transport abstraction
async-trait = "=0.1.75"

# Bitflags for transport preference combinations
bitflags = "^2.6"

# lru: always a direct dep so serialization_cache.rs can import it without the
# production feature gate (blvm_protocol::lru is only exposed with production).
lru = "=0.16.4"

# Concurrent HashMap for IBD v2 (zero lock contention); works on all platforms
dashmap = "=6.0"

# Memory / HTTP helpers: must live in top-level [dependencies] so Windows builds
# resolve them when default features enable `sysinfo` / `governance` (they are not Unix-only).
sysinfo = { version = "=0.30", optional = true }
reqwest = { version = "=0.12", optional = true, features = ["json"] }

# Memory allocator optimization
# Disabled for Windows cross-compilation (mimalloc linking issues with MinGW)
[target.'cfg(target_os = "linux")'.dependencies]
# IBD engine batch reads (table.rs); code is cfg(linux) with pread64 fallback elsewhere.
io-uring = "0.7"

[target.'cfg(not(target_os = "windows"))'.dependencies]
mimalloc = { version = "=0.1", default-features = false, optional = true }
libmimalloc-sys = { version = "=0.1", features = ["extended"], optional = true }

# System calls for process sandboxing (Unix)
nix = { version = "=0.28", features = ["process", "resource"], optional = true }
libc = { version = "=0.2", optional = true }

# Compression for storage optimization (optional feature)
zstd = { version = "=0.13", optional = true }

# ZeroMQ moved to first-party `blvm-zmq` module (no longer a blvm-node feature).
# File watcher for module hot-reload on change (optional feature)
notify = { version = "=6.1", optional = true }
# (miniscript, base64, regex removed — now live in blvm-miniscript module only)

# Iroh networking (optional feature)
iroh = { version = "=0.95", optional = true }
# WASM: blvm-node defines WasmModuleLoader trait; blvm-sdk implements it.
# blvm-node does NOT depend on blvm-sdk. The binary injects the loader.
# Quinn QUIC transport (optional feature)
quinn = { version = "=0.11", optional = true }
rcgen = { version = "=0.12", optional = true }
rustls = { version = "=0.23", optional = true }
h3 = { version = "=0.0.8", optional = true }
h3-quinn = { version = "=0.0.10", optional = true }

# Windows Job Objects for process sandboxing (Windows)
[target.'cfg(target_os = "windows")'.dependencies]
windows-sys = { version = "=0.59", features = ["Win32_System_JobObjects", "Win32_System_Threading", "Win32_Foundation", "Win32_Security"] }

# Security Note: Migrated from iroh-net 0.12 to iroh 0.95 to fix vulnerabilities in that stack:
# - idna 0.4.0 (RUSTSEC-2024-0421) - addressed for the iroh upgrade path
# - ring 0.16.20 (RUSTSEC-2025-0009) - addressed for the iroh upgrade path
# - rsa 0.9.8 (RUSTSEC-2023-0071) - addressed for the iroh upgrade path
# - paste 1.0.15 (unmaintained) - addressed for the iroh upgrade path
# `cargo audit` may still report those (or other) IDs while another transitive edge pulls a flagged version.
# When fixing “primary” edges (e.g. iroh upgrade), paste `cargo tree -i <crate>` for any remaining ignored IDs so reviewers see duplicate paths vs false positives.
# Reconcile periodically: run audit without `.cargo/audit.toml`, use `cargo tree -i`, then trim ignores.
# Advisory suppressions for CI: **only** `.cargo/audit.toml` (do not duplicate `--ignore` in workflows).
# iroh 0.95 transitive stack: hickory-proto/resolver (DNS) may lag — see `.cargo/audit.toml` comments.

[features]
# Storage: `database_backend = "auto"` picks heed3 when the `heed3` feature is enabled
# (see `storage/database/mod.rs::default_backend`), else RocksDB, TidesDB, Redb, Sled.
# No LevelDB (backends: rocksdb, redb, sled, tidesdb, heed3).
# Pure Rust/no C++ compile: `cargo build --no-default-features --features "redb,production,..."`.
default = ["sysinfo", "heed3", "rocksdb", "nix", "libc", "production", "governance", "utxo-commitments", "protocol-verification"]
# Note: rocksdb and erlay are mutually exclusive due to clang-sys version conflicts
iroh = ["dep:iroh"]
quinn = ["dep:quinn", "dep:rcgen", "dep:rustls", "dep:h3", "dep:h3-quinn"]
utxo-commitments = ["blvm-protocol/utxo-commitments"]
stratum-v2 = []
# Signature operations counting
sigop = []
# System information for memory stats (sysinfo is always included)
sysinfo = ["dep:sysinfo"]
# Storage backends
sled = ["dep:sled"]
redb = ["dep:redb"]
# Note: rocksdb and erlay are mutually exclusive due to clang-sys version conflicts
rocksdb = ["dep:rocksdb", "dep:rusty-leveldb"]
tidesdb = ["dep:tidesdb"]
heed3 = ["dep:heed3", "dep:rkyv"]
# Process sandboxing (Unix)
nix = ["dep:nix", "dep:libc"]
libc = ["dep:libc"]
# Rayon parallel iterators (enabled by production).
# `dep:rayon` is the actual crate; `rayon = []` enables parallel paths in blvm-consensus.
rayon = ["dep:rayon"]
# Production optimizations (parallel block validation, etc.)
production = ["blvm-protocol/production", "dep:blvm-consensus", "rayon", "mimalloc", "libc"]
# Profiling: IBD_PROFILE, PERF, BATCH logs. NOT for production.
profile = ["blvm-protocol/profile", "dep:blvm-consensus"]
# Privacy relay (Dandelion++) compiled behind feature flag; default OFF
# blvm-spec-lock: #[spec_locked("10.6")] for Orange Paper Dandelion verification
dandelion = ["dep:blvm-spec-lock", "blvm-protocol/dandelion"]
# Protocol (10.1) and handshake (10.2) verification
protocol-verification = ["dep:blvm-spec-lock", "blvm-protocol/protocol-verification"]
# CTV (BIP119 CheckTemplateVerify) - passed through from blvm-protocol
ctv = ["blvm-protocol/ctv", "dep:blvm-consensus"]
# Governance (auto-detect Commons server, HTTP client)
governance = ["dep:reqwest"]
# Memory allocator optimization (mimalloc) - faster than default allocator
# Disabled for Windows cross-compilation (mimalloc linking issues with MinGW)
mimalloc = ["dep:mimalloc", "dep:libmimalloc-sys"]
# JSON logging format for structured logging (production/monitoring)
json-logging = []
# Modern REST API (runs alongside JSON-RPC)
rest-api = []
# HTTP BIP70 payment protocol support (requires rest-api)
bip70-http = ["rest-api"]
# Module file watcher for hot-reload on module.toml/config.toml change
module-watcher = ["dep:notify"]
# WASM module support (load .wasm modules in-process, hotloading)
wasm-modules = []
# miniscript feature removed — see blvm-miniscript module
# Coverage-suite integration tests (tarpaulin / local gates only; skipped in default CI).
coverage-tests = []

# Storage compression optimizations
block-compression = ["dep:zstd"]
utxo-compression = ["dep:zstd"]
witness-compression = ["dep:zstd"]
# All compression features
compression = ["block-compression", "utxo-compression", "witness-compression"]

# Erlay (BIP330) transaction relay optimization
# Note: Requires libclang/LLVM for minisketch-rs bindgen compilation
# Erlay is entirely optional - if libclang is not available, simply don't enable this feature
# For CI without libclang: omit the erlay feature entirely
# DISABLED: erlay conflicts with rocksdb due to clang-sys version conflicts
# To enable erlay, uncomment minisketch-rs dependency above and this feature
# erlay = ["dep:minisketch-rs"]


# Security: patch transitive deps via git (crates-io ↔ crates-io patch not allowed).
# Exit criteria (reconcile with `.cargo/audit.toml` + `docs/AUDIT_SUPPRESSIONS.md`):
# - quinn-proto: drop when crates.io ships fixes merged at tag `quinn-proto-0.11.14` (RUSTSEC-2026-0037).
# After bump: run plain `cargo audit`, `cargo tree -i quinn-proto`, `cargo tree -i time`, then remove obsolete ignores.
[dev-dependencies]
blvm-protocol = { version = ">=0.1, <1", features = ["test-utils"] }
blvm-consensus = { version = ">=0.1, <1", features = ["test-utils"] }
tempfile = "=3.8.1"
rand = "0.8"
# For iroh SecretKey generation in iroh-gated tests (avoids RNG version conflicts)
getrandom = "=0.2.17"
# Module DB / WASM integration tests that used blvm_sdk live under tests/module/ — run them from a
# monorepo checkout with a path dev-dependency, or from blvm-sdk; not required for CI/crates.io.
criterion = "=0.5.1"
proptest = "=1.5.0"
dhat = "=0.3"  # Heap profiling
serial_test = "=3.0"  # Sequential test execution for database isolation

# Release profile optimizations (mirrors blvm-consensus)
[profile.release]
# Production optimizations (mirrors blvm-consensus)
opt-level = 3
lto = false        # off: fastest iteration; use thin/fat for production/CI
codegen-units = 256  # max parallelism
strip = true  # Remove symbols for smaller binaries
panic = "abort"  # Smaller binaries, no unwinding overhead

[profile.release.package."*"]
opt-level = 3

# Fast release: opt-level 2 for iteration (~2-3x faster compile)
[profile.release-fast]
inherits = "release"
opt-level = 2

[profile.release-fast.package."*"]
opt-level = 2

# Benchmark profile
[profile.bench]
opt-level = 3
debug = false
strip = false
lto = "thin"
codegen-units = 16

# Benchmark targets
# Benchmarks have been moved to blvm-bench crate
# See: https://github.com/BTCDecoded/blvm-bench

# Local development: use .cargo/config.toml or [patch.crates-io] in this file to point at sibling repos.

# IMPORTANT: rocksdb and erlay features are mutually exclusive
# Due to clang-sys version conflicts, you cannot enable both features simultaneously.
# To use rocksdb, you must exclude erlay from your build:
#   cargo build --features rocksdb --no-default-features
# Then manually add back other needed features (e.g., --features rocksdb,production)
# The build script (build.rs) will catch this conflict at build time.


# Examples
[[example]]
name = "electrum-integration"
path = "examples/electrum-integration.rs"

[[example]]
name = "wallet-integration"
path = "examples/wallet-integration.rs"

[[example]]
name = "verify_heed3"
path = "examples/verify_heed3.rs"
required-features = ["heed3"]

# Tools
[[bin]]
name = "convert-bitcoin-core-config"
path = "tools/convert-bitcoin-core-config.rs"

[[bin]]
name = "migrate-bitcoin-core"
path = "tools/migrate-bitcoin-core.rs"
required-features = ["rocksdb"]

# secp256k1 now direct path dep above; no patch needed

# Coverage suites: explicit targets replace auto-discovery so CI skips them unless
# `--features coverage-tests` (see COVERAGE_TEST_PLAN.md / tarpaulin gates).
[[test]]
name = "bip157_handler_coverage_suite"
path = "tests/bip157_handler_coverage_suite.rs"
required-features = ["coverage-tests"]

[[test]]
name = "blockchain_rpc_coverage_suite"
path = "tests/blockchain_rpc_coverage_suite.rs"
required-features = ["coverage-tests"]

[[test]]
name = "chainstate_coverage_suite"
path = "tests/chainstate_coverage_suite.rs"
required-features = ["coverage-tests"]

[[test]]
name = "control_rpc_coverage_suite"
path = "tests/control_rpc_coverage_suite.rs"
required-features = ["coverage-tests"]

[[test]]
name = "event_publisher_coverage_suite"
path = "tests/event_publisher_coverage_suite.rs"
required-features = ["coverage-tests"]

[[test]]
name = "hooks_manager_coverage_suite"
path = "tests/hooks_manager_coverage_suite.rs"
required-features = ["coverage-tests"]

[[test]]
name = "inter_module_coverage_suite"
path = "tests/inter_module_coverage_suite.rs"
required-features = ["coverage-tests"]

[[test]]
name = "mempool_rpc_coverage_suite"
path = "tests/mempool_rpc_coverage_suite.rs"
required-features = ["coverage-tests"]

[[test]]
name = "metrics_manager_coverage_suite"
path = "tests/metrics_manager_coverage_suite.rs"
required-features = ["coverage-tests"]

[[test]]
name = "mining_rpc_coverage_suite"
path = "tests/mining_rpc_coverage_suite.rs"
required-features = ["coverage-tests"]

[[test]]
name = "module_api_blockchain_coverage_suite"
path = "tests/module_api_blockchain_coverage_suite.rs"
required-features = ["coverage-tests"]

[[test]]
name = "module_integration_coverage_suite"
path = "tests/module_integration_coverage_suite.rs"
required-features = ["coverage-tests"]

[[test]]
name = "module_manager_coverage_suite"
path = "tests/module_manager_coverage_suite.rs"
required-features = ["coverage-tests"]

[[test]]
name = "module_registry_cas_coverage_suite"
path = "tests/module_registry_cas_coverage_suite.rs"
required-features = ["coverage-tests"]

[[test]]
name = "module_registry_manifest_coverage_suite"
path = "tests/module_registry_manifest_coverage_suite.rs"
required-features = ["coverage-tests"]

[[test]]
name = "network_manager_coverage_suite"
path = "tests/network_manager_coverage_suite.rs"
required-features = ["coverage-tests"]

[[test]]
name = "network_rpc_coverage_suite"
path = "tests/network_rpc_coverage_suite.rs"
required-features = ["coverage-tests"]

[[test]]
name = "node_api_ipc_coverage_suite"
path = "tests/node_api_ipc_coverage_suite.rs"
required-features = ["coverage-tests"]

[[test]]
name = "node_api_ipc_wrapper_coverage_suite"
path = "tests/node_api_ipc_wrapper_coverage_suite.rs"
required-features = ["coverage-tests"]

[[test]]
name = "node_mempool_coverage_suite"
path = "tests/node_mempool_coverage_suite.rs"
required-features = ["coverage-tests"]

[[test]]
name = "node_mod_coverage_suite"
path = "tests/node_mod_coverage_suite.rs"
required-features = ["coverage-tests"]

[[test]]
name = "payment_settlement_coverage_suite"
path = "tests/payment_settlement_coverage_suite.rs"
required-features = ["coverage-tests"]

[[test]]
name = "pruning_coverage_suite"
path = "tests/pruning_coverage_suite.rs"
required-features = ["coverage-tests"]

[[test]]
name = "rawtx_rpc_coverage_suite"
path = "tests/rawtx_rpc_coverage_suite.rs"
required-features = ["coverage-tests"]

[[test]]
name = "rpc_auth_coverage_suite"
path = "tests/rpc_auth_coverage_suite.rs"
required-features = ["coverage-tests"]

[[test]]
name = "rpc_server_coverage_suite"
path = "tests/rpc_server_coverage_suite.rs"
required-features = ["coverage-tests"]

[[test]]
name = "run_loop_coverage_suite"
path = "tests/run_loop_coverage_suite.rs"
required-features = ["coverage-tests"]

[[test]]
name = "serialization_cache_coverage_suite"
path = "tests/serialization_cache_coverage_suite.rs"
required-features = ["coverage-tests"]

[[test]]
name = "storage_bounds_coverage_suite"
path = "tests/storage_bounds_coverage_suite.rs"
required-features = ["coverage-tests"]

[[test]]
name = "storage_database_coverage_suite"
path = "tests/storage_database_coverage_suite.rs"
required-features = ["coverage-tests"]

[[test]]
name = "storage_mod_coverage_suite"
path = "tests/storage_mod_coverage_suite.rs"
required-features = ["coverage-tests"]

[[test]]
name = "timer_manager_coverage_suite"
path = "tests/timer_manager_coverage_suite.rs"
required-features = ["coverage-tests"]

[[test]]
name = "validation_mod_coverage_suite"
path = "tests/validation_mod_coverage_suite.rs"
required-features = ["coverage-tests"]