fix: enable live Pudge registry commitments

Author: a19q3

docs/wiki/Tutorial-12-Phase1-Registry-End-to-End.md

@@ -12,7 +12,7 @@ CellScript path first, then the generic artifact path.
 
 Open `https://cellscript.dev/registry/submit`. The page does not expose a
 network selector. The production Registry is CKB mainnet-only. Pudge testing
-uses `https://testnet.cellscript.dev/registry`, with a different API origin,
+uses `https://testnet.registry.cellscript.dev/registry`, with a different API origin,
 database, object store, wallet connection state, and testnet-only evidence.
 Sandbox records disappear from discovery after 72 hours and their source bytes
 are purged after a 24-hour grace period; this does not erase Pudge chain history.

services/registry-api/README.md

@@ -13,7 +13,7 @@ The Pudge test environment is a separate, ephemeral service:
 
 - `https://api.testnet.registry.cellscript.dev` is the sandbox API;
 - `https://objects.testnet.registry.cellscript.dev` is its object origin;
-- `https://testnet.cellscript.dev/registry` is its `noindex` UI.
+- `https://testnet.registry.cellscript.dev/registry` is its `noindex` UI.
 
 It uses a different Postgres volume, object volume, signing origin, wallet
 storage key, RPC identity, and Compose project. Do not put a network selector in
@@ -254,7 +254,11 @@ require `code_hash` to equal the data hash. Success appends hash-addressed
 evidence and sets only `deployment_status = chain_verified`.
 
 `CKB_RPC_URL` configures the environment RPC. `CKB_MAINNET_RPC_URL` remains a
-production compatibility alias.
+production compatibility alias. The Docker deployment sets
+`CKB_RPC_MAX_RESPONSE_BYTES=8388608`: canonical secp256k1 DepGroup validation
+must read the genesis data Cell, whose JSON-RPC hex encoding exceeds the
+conservative 2 MiB library default. The API still enforces its 8 MiB hard
+ceiling and bounded RPC timeout.
 
 ## Registry Chain Commitments
 

services/registry-api/deploy/docker-compose.production.yml

@@ -55,6 +55,7 @@ services:
       STATIC_REGISTRY_ORIGIN: ${STATIC_REGISTRY_ORIGIN:-https://registry.cellscript.dev}
       CKB_MAINNET_RPC_URL: ${CKB_MAINNET_RPC_URL:-https://mainnet.ckb.dev/rpc}
       CKB_RPC_URL: ${CKB_RPC_URL:-https://mainnet.ckb.dev/rpc}
+      CKB_RPC_MAX_RESPONSE_BYTES: "8388608"
       REGISTRY_TYPE_SCRIPT_JSON: ${REGISTRY_TYPE_SCRIPT_JSON:-}
       REGISTRY_TYPE_SCRIPT_CELL_DEP_JSON: ${REGISTRY_TYPE_SCRIPT_CELL_DEP_JSON:-}
       REGISTRY_COMMITMENT_LOCK_SCRIPT_JSON: ${REGISTRY_COMMITMENT_LOCK_SCRIPT_JSON:-}

services/registry-api/deploy/docker-compose.testnet.yml

@@ -44,6 +44,7 @@ services:
       REGISTRY_ORIGIN: ${REGISTRY_TESTNET_ORIGIN:-https://api.testnet.registry.cellscript.dev}
       STATIC_REGISTRY_ORIGIN: ${STATIC_REGISTRY_TESTNET_ORIGIN:-https://objects.testnet.registry.cellscript.dev}
       CKB_RPC_URL: ${CKB_TESTNET_RPC_URL:-https://testnet.ckb.dev/rpc}
+      CKB_RPC_MAX_RESPONSE_BYTES: "8388608"
       CKB_MIN_CONFIRMATIONS: "4"
       REGISTRY_TYPE_SCRIPT_JSON: ${REGISTRY_TESTNET_TYPE_SCRIPT_JSON:-}
       REGISTRY_TYPE_SCRIPT_CELL_DEP_JSON: ${REGISTRY_TESTNET_TYPE_SCRIPT_CELL_DEP_JSON:-}

services/registry-api/src/index.ts

@@ -1408,7 +1408,20 @@ async function ckbRpcRequest(
   if (!response.ok) {
     throw new ApiError(503, "ckb_rpc_unavailable", `CKB RPC returned HTTP ${response.status}`);
   }
-  const rpc = assertPlainObject(await readBoundedRpcJson(response, options.maximum_bytes), "invalid_ckb_rpc_response");
+  let rpcBody: unknown;
+  try {
+    rpcBody = await readBoundedRpcJson(response, options.maximum_bytes);
+  } catch (error) {
+    if (error instanceof ApiError && error.code === "ckb_rpc_response_too_large") {
+      throw new ApiError(
+        error.status,
+        error.code,
+        `CKB RPC ${method} response exceeds the configured size limit`,
+      );
+    }
+    throw error;
+  }
+  const rpc = assertPlainObject(rpcBody, "invalid_ckb_rpc_response");
   if (rpc["error"]) {
     throw new ApiError(503, "ckb_rpc_error", `CKB RPC rejected ${method}`);
   }

services/registry-api/src/node-runtime-env.ts

@@ -0,0 +1,26 @@
+import type { Env } from "./index";
+
+type NodeCkbRpcEnv = Pick<
+  Env,
+  | "CKB_MAINNET_RPC_URL"
+  | "CKB_RPC_URL"
+  | "CKB_RPC_TIMEOUT_MS"
+  | "CKB_RPC_MAX_RESPONSE_BYTES"
+  | "CKB_DEP_GROUP_MAX_MEMBERS"
+>;
+
+export function nodeCkbRpcEnv(
+  processEnv: Readonly<Record<string, string | undefined>>,
+): Partial<NodeCkbRpcEnv> {
+  return {
+    ...(processEnv["CKB_MAINNET_RPC_URL"] ? { CKB_MAINNET_RPC_URL: processEnv["CKB_MAINNET_RPC_URL"] } : {}),
+    ...(processEnv["CKB_RPC_URL"] ? { CKB_RPC_URL: processEnv["CKB_RPC_URL"] } : {}),
+    ...(processEnv["CKB_RPC_TIMEOUT_MS"] ? { CKB_RPC_TIMEOUT_MS: processEnv["CKB_RPC_TIMEOUT_MS"] } : {}),
+    ...(processEnv["CKB_RPC_MAX_RESPONSE_BYTES"]
+      ? { CKB_RPC_MAX_RESPONSE_BYTES: processEnv["CKB_RPC_MAX_RESPONSE_BYTES"] }
+      : {}),
+    ...(processEnv["CKB_DEP_GROUP_MAX_MEMBERS"]
+      ? { CKB_DEP_GROUP_MAX_MEMBERS: processEnv["CKB_DEP_GROUP_MAX_MEMBERS"] }
+      : {}),
+  };
+}

services/registry-api/src/node-server.ts

@@ -6,6 +6,7 @@ import { randomUUID } from "node:crypto";
 
 import { createApp, type Env } from "./index";
 import { FilesystemObjectStore } from "./filesystem-object-store";
+import { nodeCkbRpcEnv } from "./node-runtime-env";
 import { SqlRegistryStore } from "./sql-store";
 
 const port = integerEnv("PORT", 8787, 1, 65_535);
@@ -40,8 +41,7 @@ const env: Env = {
   ...(process.env["NAMESPACE_CLAIM_COOLDOWN_SECONDS"]
     ? { NAMESPACE_CLAIM_COOLDOWN_SECONDS: process.env["NAMESPACE_CLAIM_COOLDOWN_SECONDS"] }
     : {}),
-  ...(process.env["CKB_MAINNET_RPC_URL"] ? { CKB_MAINNET_RPC_URL: process.env["CKB_MAINNET_RPC_URL"] } : {}),
-  ...(process.env["CKB_RPC_URL"] ? { CKB_RPC_URL: process.env["CKB_RPC_URL"] } : {}),
+  ...nodeCkbRpcEnv(process.env),
   ...(process.env["REGISTRY_TYPE_SCRIPT_JSON"]
     ? { REGISTRY_TYPE_SCRIPT_JSON: process.env["REGISTRY_TYPE_SCRIPT_JSON"] }
     : {}),

services/registry-api/test/registry-api.test.ts

@@ -43,6 +43,7 @@ import {
   type SnapshotWriter,
 } from "../src/index";
 import type { PackageVersionRecord } from "../src/store";
+import { nodeCkbRpcEnv } from "../src/node-runtime-env";
 
 const now = new Date("2026-06-23T12:00:00Z");
 const ckbPrivateKey = Uint8Array.from({ length: 32 }, (_, index) => index === 31 ? 7 : 0);
@@ -51,6 +52,25 @@ const reproducerPublicKeys = {
   "builder-b": "p256-spki:MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEcZljLFjOhAdes8hm88phoxoMmsya3kKGRbmwjtH1eW4tWV_sn81NRL5EwkrqhjPuYxXfEbYBfuSVPMVD3at7hQ",
 } as const;
 
+describe("Node CKB RPC environment", () => {
+  it("forwards every bounded RPC control used by the shared API", () => {
+    expect(nodeCkbRpcEnv({
+      CKB_MAINNET_RPC_URL: "https://mainnet.ckb.dev/rpc",
+      CKB_RPC_URL: "https://testnet.ckb.dev/rpc",
+      CKB_RPC_TIMEOUT_MS: "15000",
+      CKB_RPC_MAX_RESPONSE_BYTES: "8388608",
+      CKB_DEP_GROUP_MAX_MEMBERS: "256",
+      UNRELATED_SECRET: "must-not-pass-through",
+    })).toEqual({
+      CKB_MAINNET_RPC_URL: "https://mainnet.ckb.dev/rpc",
+      CKB_RPC_URL: "https://testnet.ckb.dev/rpc",
+      CKB_RPC_TIMEOUT_MS: "15000",
+      CKB_RPC_MAX_RESPONSE_BYTES: "8388608",
+      CKB_DEP_GROUP_MAX_MEMBERS: "256",
+    });
+  });
+});
+
 function bytesHex(value: Uint8Array): string {
   return `0x${[...value].map((byte) => byte.toString(16).padStart(2, "0")).join("")}`;
 }