@antseed/node 0.1.0

package/dist/types/rating.d.ts

@@ -0,0 +1,21 @@
+import type { PeerId } from './peer.js';
+export type RatingDimension = 'quality' | 'speed' | 'reliability' | 'value' | 'overall';
+export interface PeerRating {
+    ratingId: string;
+    raterPeerId: PeerId;
+    targetPeerId: PeerId;
+    sessionId: string;
+    dimensions: Record<RatingDimension, 1 | 2 | 3 | 4 | 5>;
+    comment?: string;
+    timestamp: number;
+    /** Ed25519 signature (hex) */
+    signature: string;
+}
+export interface AggregateRating {
+    peerId: PeerId;
+    averageByDimension: Record<RatingDimension, number>;
+    overallAverage: number;
+    totalRatings: number;
+    lastUpdated: number;
+}
+//# sourceMappingURL=rating.d.ts.map

package/dist/types/rating.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rating.d.ts","sourceRoot":"","sources":["../../src/types/rating.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAExC,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,OAAO,GAAG,aAAa,GAAG,OAAO,GAAG,SAAS,CAAC;AAExF,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC,eAAe,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACvD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,8BAA8B;IAC9B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,kBAAkB,EAAE,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IACpD,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;CACrB"}

package/dist/types/rating.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=rating.js.map

package/dist/types/rating.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rating.js","sourceRoot":"","sources":["../../src/types/rating.ts"],"names":[],"mappings":""}

package/dist/types/report.d.ts

@@ -0,0 +1,20 @@
+import type { PeerId } from './peer.js';
+export type ReportReason = 'bad-quality' | 'overcharging' | 'timeout' | 'harmful-content' | 'fraud' | 'impersonation' | 'other';
+export type ReportStatus = 'pending' | 'acknowledged' | 'resolved' | 'dismissed';
+export interface ReportEvidence {
+    type: 'receipt' | 'log' | 'screenshot' | 'text';
+    data: string;
+}
+export interface PeerReport {
+    reportId: string;
+    reporterPeerId: PeerId;
+    targetPeerId: PeerId;
+    reason: ReportReason;
+    evidence: ReportEvidence[];
+    sessionId?: string;
+    timestamp: number;
+    status: ReportStatus;
+    /** Ed25519 signature over report data (hex string) */
+    signature: string;
+}
+//# sourceMappingURL=report.d.ts.map

package/dist/types/report.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"report.d.ts","sourceRoot":"","sources":["../../src/types/report.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAExC,MAAM,MAAM,YAAY,GACpB,aAAa,GACb,cAAc,GACd,SAAS,GACT,iBAAiB,GACjB,OAAO,GACP,eAAe,GACf,OAAO,CAAC;AAEZ,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,cAAc,GAAG,UAAU,GAAG,WAAW,CAAC;AAEjF,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,SAAS,GAAG,KAAK,GAAG,YAAY,GAAG,MAAM,CAAC;IAChD,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,YAAY,CAAC;IACrB,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,YAAY,CAAC;IACrB,sDAAsD;IACtD,SAAS,EAAE,MAAM,CAAC;CACnB"}

package/dist/types/report.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=report.js.map

package/dist/types/report.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"report.js","sourceRoot":"","sources":["../../src/types/report.ts"],"names":[],"mappings":""}

package/dist/types/seller.d.ts

@@ -0,0 +1,36 @@
+import type { ProviderType } from './metering.js';
+export interface SellerProviderPricingConfig {
+    inputUsdPerMillion: number;
+    outputUsdPerMillion: number;
+}
+/**
+ * Per-provider capacity and pricing configuration for sellers.
+ */
+export interface SellerProviderConfig {
+    /** Provider identifier (must match a key in AntseedConfig.providers) */
+    type: ProviderType;
+    /** Whether this provider is enabled for selling */
+    enabled: boolean;
+    /** Plan limit in messages per hour. */
+    planLimitMsgPerHour: number;
+    /** Reserve floor in messages per hour. */
+    reserveFloorMsgPerHour: number;
+    /** Default pricing in USD per 1M tokens. */
+    pricing: SellerProviderPricingConfig;
+}
+/**
+ * Top-level seller configuration.
+ */
+export interface SellerConfig {
+    /** Whether seller mode is enabled */
+    enabled: boolean;
+    /** Maximum number of concurrent buyer connections */
+    maxConcurrentBuyers: number;
+    /** Per-provider selling configuration */
+    providers: SellerProviderConfig[];
+    /** Session timeout in ms. Default: 300_000 (5 minutes). */
+    sessionTimeoutMs: number;
+    /** DHT re-announce interval in ms. Default: 60_000 (1 minute). */
+    announceIntervalMs: number;
+}
+//# sourceMappingURL=seller.d.ts.map

package/dist/types/seller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"seller.d.ts","sourceRoot":"","sources":["../../src/types/seller.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAElD,MAAM,WAAW,2BAA2B;IAC1C,kBAAkB,EAAE,MAAM,CAAC;IAC3B,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,wEAAwE;IACxE,IAAI,EAAE,YAAY,CAAC;IACnB,mDAAmD;IACnD,OAAO,EAAE,OAAO,CAAC;IACjB,uCAAuC;IACvC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,0CAA0C;IAC1C,sBAAsB,EAAE,MAAM,CAAC;IAC/B,4CAA4C;IAC5C,OAAO,EAAE,2BAA2B,CAAC;CACtC;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,qCAAqC;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,qDAAqD;IACrD,mBAAmB,EAAE,MAAM,CAAC;IAC5B,yCAAyC;IACzC,SAAS,EAAE,oBAAoB,EAAE,CAAC;IAClC,2DAA2D;IAC3D,gBAAgB,EAAE,MAAM,CAAC;IACzB,kEAAkE;IAClE,kBAAkB,EAAE,MAAM,CAAC;CAC5B"}

package/dist/types/seller.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=seller.js.map

package/dist/types/seller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"seller.js","sourceRoot":"","sources":["../../src/types/seller.ts"],"names":[],"mappings":""}

package/dist/types/staking.d.ts

@@ -0,0 +1,16 @@
+import type { PeerId } from './peer.js';
+export type StakeStatus = 'active' | 'slashed' | 'withdrawn';
+export interface StakeInfo {
+    peerId: PeerId;
+    amountUSDC: number;
+    stakedAt: number;
+    lockPeriodDays: number;
+    status: StakeStatus;
+}
+export interface StakeConfig {
+    minStakeUSDC: number;
+    lockPeriodDays: number;
+    slashPercentage: number;
+}
+export declare const DEFAULT_STAKE_CONFIG: StakeConfig;
+//# sourceMappingURL=staking.d.ts.map

package/dist/types/staking.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"staking.d.ts","sourceRoot":"","sources":["../../src/types/staking.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAExC,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,SAAS,GAAG,WAAW,CAAC;AAE7D,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,WAAW,CAAC;CACrB;AAED,MAAM,WAAW,WAAW;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,eAAO,MAAM,oBAAoB,EAAE,WAIlC,CAAC"}

package/dist/types/staking.js

@@ -0,0 +1,6 @@
+export const DEFAULT_STAKE_CONFIG = {
+    minStakeUSDC: 100,
+    lockPeriodDays: 30,
+    slashPercentage: 10,
+};
+//# sourceMappingURL=staking.js.map

package/dist/types/staking.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"staking.js","sourceRoot":"","sources":["../../src/types/staking.ts"],"names":[],"mappings":"AAkBA,MAAM,CAAC,MAAM,oBAAoB,GAAgB;IAC/C,YAAY,EAAE,GAAG;IACjB,cAAc,EAAE,EAAE;IAClB,eAAe,EAAE,EAAE;CACpB,CAAC"}

package/dist/utils/debug.d.ts

@@ -0,0 +1,4 @@
+export declare function isDebugEnabled(): boolean;
+export declare function debugLog(...args: unknown[]): void;
+export declare function debugWarn(...args: unknown[]): void;
+//# sourceMappingURL=debug.d.ts.map

package/dist/utils/debug.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"debug.d.ts","sourceRoot":"","sources":["../../src/utils/debug.ts"],"names":[],"mappings":"AAIA,wBAAgB,cAAc,IAAI,OAAO,CAaxC;AAED,wBAAgB,QAAQ,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAIjD;AAED,wBAAgB,SAAS,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAIlD"}

package/dist/utils/debug.js

@@ -0,0 +1,25 @@
+function normalizeDebugValue(value) {
+    return (value ?? '').trim().toLowerCase();
+}
+export function isDebugEnabled() {
+    const fromAntseed = normalizeDebugValue(process.env['ANTSEED_DEBUG']);
+    if (fromAntseed === '1' ||
+        fromAntseed === 'true' ||
+        fromAntseed === 'yes' ||
+        fromAntseed === 'on') {
+        return true;
+    }
+    const fromDebug = normalizeDebugValue(process.env['DEBUG']);
+    return fromDebug === '*' || fromDebug.includes('antseed');
+}
+export function debugLog(...args) {
+    if (isDebugEnabled()) {
+        console.log(...args);
+    }
+}
+export function debugWarn(...args) {
+    if (isDebugEnabled()) {
+        console.warn(...args);
+    }
+}
+//# sourceMappingURL=debug.js.map

package/dist/utils/debug.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"debug.js","sourceRoot":"","sources":["../../src/utils/debug.ts"],"names":[],"mappings":"AAAA,SAAS,mBAAmB,CAAC,KAAyB;IACpD,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,MAAM,WAAW,GAAG,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;IACtE,IACE,WAAW,KAAK,GAAG;QACnB,WAAW,KAAK,MAAM;QACtB,WAAW,KAAK,KAAK;QACrB,WAAW,KAAK,IAAI,EACpB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,SAAS,GAAG,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5D,OAAO,SAAS,KAAK,GAAG,IAAI,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,GAAG,IAAe;IACzC,IAAI,cAAc,EAAE,EAAE,CAAC;QACrB,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,GAAG,IAAe;IAC1C,IAAI,cAAc,EAAE,EAAE,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;IACxB,CAAC;AACH,CAAC"}

package/dist/utils/hex.d.ts

@@ -0,0 +1,3 @@
+export declare function hexToBytes(hex: string): Uint8Array;
+export declare function bytesToHex(bytes: Uint8Array): string;
+//# sourceMappingURL=hex.d.ts.map

package/dist/utils/hex.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hex.d.ts","sourceRoot":"","sources":["../../src/utils/hex.ts"],"names":[],"mappings":"AAAA,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAOlD;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAIpD"}

package/dist/utils/hex.js

@@ -0,0 +1,15 @@
+export function hexToBytes(hex) {
+    if (hex.length % 2 !== 0)
+        throw new Error("Hex string must have even length");
+    const bytes = new Uint8Array(hex.length / 2);
+    for (let i = 0; i < hex.length; i += 2) {
+        bytes[i / 2] = parseInt(hex.slice(i, i + 2), 16);
+    }
+    return bytes;
+}
+export function bytesToHex(bytes) {
+    return Array.from(bytes)
+        .map((b) => b.toString(16).padStart(2, "0"))
+        .join("");
+}
+//# sourceMappingURL=hex.js.map

package/dist/utils/hex.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hex.js","sourceRoot":"","sources":["../../src/utils/hex.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IAC9E,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC7C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAiB;IAC1C,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;SACrB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;AACd,CAAC"}

package/package.json

@@ -0,0 +1,62 @@
+{
+  "name": "@antseed/node",
+  "version": "0.1.0",
+  "description": "Antseed Network protocol SDK — P2P inference marketplace",
+  "type": "module",
+  "engines": {
+    "node": ">=20.0.0"
+  },
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "types": "./dist/index.d.ts"
+    },
+    "./p2p": {
+      "import": "./dist/p2p/index.js",
+      "types": "./dist/p2p/index.d.ts"
+    },
+    "./discovery": {
+      "import": "./dist/discovery/index.js",
+      "types": "./dist/discovery/index.d.ts"
+    },
+    "./metering": {
+      "import": "./dist/metering/index.js",
+      "types": "./dist/metering/index.d.ts"
+    },
+    "./payments": {
+      "import": "./dist/payments/index.js",
+      "types": "./dist/payments/index.d.ts"
+    },
+    "./types": {
+      "import": "./dist/types/index.js",
+      "types": "./dist/types/index.d.ts"
+    }
+  },
+  "scripts": {
+    "postinstall": "node scripts/patch-ethers.js",
+    "ensure:native": "node scripts/ensure-node-native-modules.mjs",
+    "build": "tsc",
+    "pretest": "npm run ensure:native",
+    "test": "\"$npm_node_execpath\" ./node_modules/vitest/vitest.mjs run",
+    "typecheck": "tsc --noEmit"
+  },
+  "dependencies": {
+    "@noble/ed25519": "^2.1.0",
+    "@silentbot1/nat-api": "^0.4.9",
+    "better-sqlite3": "^12.6.2",
+    "bittorrent-dht": "^11.0.11",
+    "ethers": "~6.16.0",
+    "node-datachannel": "^0.7.0"
+  },
+  "optionalDependencies": {
+    "keytar": "^7.9.0"
+  },
+  "devDependencies": {
+    "@types/better-sqlite3": "^7.6.13",
+    "@types/node": "^20.11.0",
+    "typescript": "^5.3.0",
+    "vitest": "^1.2.0"
+  }
+}

package/scripts/ensure-node-native-modules.mjs

@@ -0,0 +1,153 @@
+#!/usr/bin/env node
+
+import { execFileSync } from 'node:child_process';
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+const nodePackageDir = path.resolve(__dirname, '..');
+const packageJsonPath = path.resolve(nodePackageDir, 'package.json');
+const markerPath = path.resolve(nodePackageDir, 'node_modules', 'better-sqlite3', '.node-runtime-meta.json');
+const runtime = {
+  nodeExec: process.execPath,
+  nodeArch: process.arch,
+  nodeVersion: process.version,
+};
+
+function readMarker() {
+  if (!existsSync(markerPath)) return null;
+  try {
+    const raw = readFileSync(markerPath, 'utf8');
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed !== 'object') return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+
+function markerMatches(marker) {
+  return marker?.nodeExec === runtime.nodeExec
+    && marker?.nodeArch === runtime.nodeArch
+    && marker?.nodeVersion === runtime.nodeVersion;
+}
+
+function writeMarker() {
+  writeFileSync(
+    markerPath,
+    JSON.stringify({ ...runtime, updatedAt: new Date().toISOString() }, null, 2),
+    'utf8',
+  );
+}
+
+function loadBetterSqlite3() {
+  try {
+    const req = createRequire(packageJsonPath);
+    const Database = req('better-sqlite3');
+    const db = new Database(':memory:');
+    db.close();
+    return { ok: true, reason: null };
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return { ok: false, reason: message };
+  }
+}
+
+function resolveNpmCli() {
+  const envNpmExecPath = process.env.npm_execpath;
+  if (envNpmExecPath && existsSync(envNpmExecPath)) {
+    return envNpmExecPath;
+  }
+
+  try {
+    const resolved = execFileSync(
+      process.execPath,
+      ['-p', "require.resolve('npm/bin/npm-cli.js')"],
+      { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] },
+    ).trim();
+    if (resolved.length > 0 && existsSync(resolved)) {
+      return resolved;
+    }
+  } catch {
+    // fall through
+  }
+
+  try {
+    const prefix = execFileSync(
+      'npm',
+      ['config', 'get', 'prefix'],
+      { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] },
+    ).trim();
+    const fromPrefix = path.resolve(prefix, 'lib', 'node_modules', 'npm', 'bin', 'npm-cli.js');
+    if (existsSync(fromPrefix)) {
+      return fromPrefix;
+    }
+  } catch {
+    // fall through
+  }
+
+  const commonCandidates = [
+    '/usr/local/lib/node_modules/npm/bin/npm-cli.js',
+    '/opt/homebrew/lib/node_modules/npm/bin/npm-cli.js',
+    path.resolve(path.dirname(process.execPath), '..', 'lib', 'node_modules', 'npm', 'bin', 'npm-cli.js'),
+  ];
+  for (const candidate of commonCandidates) {
+    if (existsSync(candidate)) {
+      return candidate;
+    }
+  }
+
+  return '';
+}
+
+function rebuildBetterSqlite3() {
+  const npmCli = resolveNpmCli();
+  if (!existsSync(npmCli)) {
+    throw new Error(`Unable to locate npm-cli.js for runtime ${process.execPath}`);
+  }
+
+  execFileSync(
+    process.execPath,
+    [npmCli, 'rebuild', 'better-sqlite3', '--build-from-source'],
+    {
+      cwd: nodePackageDir,
+      stdio: 'inherit',
+      env: {
+        ...process.env,
+        npm_config_arch: process.arch,
+        npm_config_build_from_source: 'true',
+      },
+    },
+  );
+}
+
+if (!existsSync(path.resolve(nodePackageDir, 'node_modules', 'better-sqlite3'))) {
+  console.log('[native] better-sqlite3 not installed; skipping.');
+  process.exit(0);
+}
+
+const marker = readMarker();
+if (markerMatches(marker)) {
+  const loaded = loadBetterSqlite3();
+  if (loaded.ok) {
+    console.log(`[native] better-sqlite3 already aligned for Node ${runtime.nodeVersion} (${runtime.nodeArch}).`);
+    process.exit(0);
+  }
+}
+
+const before = loadBetterSqlite3();
+if (!before.ok) {
+  console.log(`[native] rebuilding better-sqlite3 for Node ${runtime.nodeVersion} (${runtime.nodeArch})...`);
+  rebuildBetterSqlite3();
+}
+
+const after = loadBetterSqlite3();
+if (!after.ok) {
+  throw new Error(`[native] better-sqlite3 failed to load after rebuild: ${after.reason}`);
+}
+
+writeMarker();
+console.log('[native] better-sqlite3 runtime alignment complete.');

package/scripts/patch-ethers.js

@@ -0,0 +1,44 @@
+/**
+ * Patches ethers v6 lib.esm/index.d.ts to avoid type-checking raw TypeScript sources.
+ *
+ * ethers v6 ships a lib.esm/index.d.ts that re-exports directly from the package's
+ * own TypeScript source tree (src.ts/). Because these are .ts files (not .d.ts),
+ * TypeScript's skipLibCheck does not apply to them and they fail under strict settings.
+ *
+ * The fix: redirect the two offending lines to the CJS build's ethers.d.ts, which
+ * contains only compiled, relative-path imports and is clean under any tsconfig.
+ *
+ * Related: https://github.com/ethers-io/ethers.js/issues/4014
+ */
+
+import { readFileSync, writeFileSync, existsSync } from 'node:fs'
+import { resolve, dirname } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const __dirname = fileURLToPath(new URL('.', import.meta.url))
+const indexDts = resolve(__dirname, '../node_modules/ethers/lib.esm/index.d.ts')
+
+if (!existsSync(indexDts)) {
+  // ethers not installed (optional dep scenario) — skip silently
+  process.exit(0)
+}
+
+const original = readFileSync(indexDts, 'utf-8')
+
+if (!original.includes('../src.ts/ethers.ts')) {
+  // Already patched or a fixed version of ethers — nothing to do
+  process.exit(0)
+}
+
+const patched = original
+  .replace(
+    'import * as ethers from "../src.ts/ethers.ts";',
+    'import * as ethers from "../lib.commonjs/ethers.js";'
+  )
+  .replace(
+    'export * from "../src.ts/ethers.ts";',
+    'export * from "../lib.commonjs/ethers.js";'
+  )
+
+writeFileSync(indexDts, patched, 'utf-8')
+console.log('patched ethers/lib.esm/index.d.ts → uses compiled CJS declarations')

package/src/config/encryption.test.ts

@@ -0,0 +1,49 @@
+import { describe, it, expect } from 'vitest'
+import { encryptValue, decryptValue, deriveMachineKey, generateSalt } from './encryption.js'
+
+describe('encryption', () => {
+  it('should round-trip encrypt and decrypt', () => {
+    const salt = generateSalt()
+    const key = deriveMachineKey(salt)
+    const plaintext = 'sk-ant-api03-secret-key-value'
+    const encrypted = encryptValue(plaintext, key)
+    expect(encrypted).not.toBe(plaintext)
+    const decrypted = decryptValue(encrypted, key)
+    expect(decrypted).toBe(plaintext)
+  })
+
+  it('should produce different ciphertexts for same input (random IV)', () => {
+    const salt = generateSalt()
+    const key = deriveMachineKey(salt)
+    const plaintext = 'test-secret'
+    const a = encryptValue(plaintext, key)
+    const b = encryptValue(plaintext, key)
+    expect(a).not.toBe(b)
+  })
+
+  it('should fail to decrypt with wrong key', () => {
+    const salt1 = generateSalt()
+    const salt2 = generateSalt()
+    const key1 = deriveMachineKey(salt1)
+    const key2 = deriveMachineKey(salt2)
+    const encrypted = encryptValue('secret', key1)
+    expect(() => decryptValue(encrypted, key2)).toThrow()
+  })
+
+  it('should handle empty string', () => {
+    const salt = generateSalt()
+    const key = deriveMachineKey(salt)
+    const encrypted = encryptValue('', key)
+    const decrypted = decryptValue(encrypted, key)
+    expect(decrypted).toBe('')
+  })
+
+  it('should handle unicode', () => {
+    const salt = generateSalt()
+    const key = deriveMachineKey(salt)
+    const plaintext = 'héllo wörld 🔑'
+    const encrypted = encryptValue(plaintext, key)
+    const decrypted = decryptValue(encrypted, key)
+    expect(decrypted).toBe(plaintext)
+  })
+})

package/src/config/encryption.ts

@@ -0,0 +1,53 @@
+import { createCipheriv, createDecipheriv, randomBytes, scryptSync } from 'node:crypto'
+import { hostname, homedir } from 'node:os'
+
+const ALGORITHM = 'aes-256-gcm'
+const SALT_LENGTH = 32
+const IV_LENGTH = 16
+const TAG_LENGTH = 16
+const KEY_LENGTH = 32
+
+/**
+ * Derive an encryption key from a machine-specific seed.
+ */
+export function deriveMachineKey(salt: Buffer): Buffer {
+  const seed = [
+    process.env['USER'] ?? process.env['USERNAME'] ?? '',
+    hostname(),
+    homedir(),
+  ].join(':')
+  return scryptSync(seed, salt, KEY_LENGTH)
+}
+
+/**
+ * Encrypt a string value. Returns base64-encoded ciphertext with IV and auth tag prepended.
+ */
+export function encryptValue(plaintext: string, key: Buffer): string {
+  const iv = randomBytes(IV_LENGTH)
+  const cipher = createCipheriv(ALGORITHM, key, iv)
+  const encrypted = Buffer.concat([cipher.update(plaintext, 'utf-8'), cipher.final()])
+  const tag = cipher.getAuthTag()
+  const combined = Buffer.concat([iv, tag, encrypted])
+  return combined.toString('base64')
+}
+
+/**
+ * Decrypt a base64-encoded value produced by encryptValue.
+ */
+export function decryptValue(encoded: string, key: Buffer): string {
+  const combined = Buffer.from(encoded, 'base64')
+  const iv = combined.subarray(0, IV_LENGTH)
+  const tag = combined.subarray(IV_LENGTH, IV_LENGTH + TAG_LENGTH)
+  const ciphertext = combined.subarray(IV_LENGTH + TAG_LENGTH)
+  const decipher = createDecipheriv(ALGORITHM, key, iv)
+  decipher.setAuthTag(tag)
+  const decrypted = Buffer.concat([decipher.update(ciphertext), decipher.final()])
+  return decrypted.toString('utf-8')
+}
+
+/**
+ * Generate a fresh random salt for key derivation.
+ */
+export function generateSalt(): Buffer {
+  return randomBytes(SALT_LENGTH)
+}