@antseed/node 0.2.108 → 0.2.109

package/dist/p2p/connection-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"connection-auth.js","sourceRoot":"","sources":["../../src/p2p/connection-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG1C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EACL,0BAA0B,EAC1B,sBAAsB,GAGvB,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EAAE,sBAAsB,EAAE,CAAC;AAiBlC,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAC5B,MAAM,WAAW,GAAG,GAAG,CAAC;AACxB,MAAM,eAAe,GAAG,gBAAgB,CAAC;AACzC,MAAM,aAAa,GAAG,iBAAiB,CAAC;AAExC,SAAS,cAAc,CAAC,MAAc,EAAE,KAAa;IACnD,OAAO,GAAG,MAAM,IAAI,KAAK,EAAE,CAAC;AAC9B,CAAC;AAED;;GAEG;AACH,MAAM,OAAO,gBAAgB;IAIR;IACA;IAJF,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IAElD,YACmB,QAAQ,sBAAsB,GAAG,CAAC,EAClC,aAAa,MAAM;QADnB,UAAK,GAAL,KAAK,CAA6B;QAClC,eAAU,GAAV,UAAU,CAAS;IACnC,CAAC;IAEJ,gBAAgB,CAAC,MAAc,EAAE,KAAa,EAAE,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE;QAChE,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACzB,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC1C,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,cAAc,IAAI,cAAc,GAAG,KAAK,EAAE,CAAC;YAC7C,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;YACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC;YAClD,IAAI,OAAO,GAAG,CAAC,CAAC;YAChB,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;gBACzC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBAC5B,OAAO,EAAE,CAAC;gBACV,IAAI,OAAO,IAAI,QAAQ,EAAE,CAAC;oBACxB,MAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,YAAY,CAAC,KAAa;QAChC,KAAK,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACzC,IAAI,SAAS,IAAI,KAAK,EAAE,CAAC;gBACvB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAED,MAAM,UAAU,2BAA2B,CACzC,IAAqB,EACrB,MAAc,EACd,MAAc,EACd,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE;IAElB,MAAM,KAAK,GAAG,WAAW,CAAC,gBAAgB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,0BAA0B,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IACvE,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEtC,OAAO;QACL,MAAM;QACN,EAAE,EAAE,KAAK;QACT,KAAK;QACL,GAAG;KACJ,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,OAAoC;IAEpC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IAC1C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,sBAAsB,CAAC;IAC9D,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAC1B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;IACxD,CAAC;IAED,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACjD,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACpD,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,GAAG,SAAS,EAAE,CAAC;QAC1C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC;IACjE,CAAC;IAED,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IACvD,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QACrE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;IAC3D,CAAC;IAED,IAAI,OAAO,CAAC,WAAW,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;QAC5F,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;IAC5D,CAAC;IAED,MAAM,OAAO,GAAG,0BAA0B,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACtF,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACpD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC;IAChE,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC9B,CAAC"}
+{"version":3,"file":"connection-auth.js","sourceRoot":"","sources":["../../src/p2p/connection-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG1C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,EAC5B,mBAAmB,EACnB,qBAAqB,EACrB,sBAAsB,EACtB,sBAAsB,GAKvB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAEtE,OAAO,EAAE,sBAAsB,EAAE,CAAC;AAqBlC,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAC5B,MAAM,WAAW,GAAG,GAAG,CAAC;AACxB,MAAM,eAAe,GAAG,gBAAgB,CAAC;AACzC,MAAM,aAAa,GAAG,iBAAiB,CAAC;AAExC,SAAS,cAAc,CAAC,MAAc,EAAE,KAAa;IACnD,OAAO,GAAG,MAAM,IAAI,KAAK,EAAE,CAAC;AAC9B,CAAC;AAED;;GAEG;AACH,MAAM,OAAO,gBAAgB;IAIR;IACA;IAJF,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IAElD,YACmB,QAAQ,sBAAsB,GAAG,CAAC,EAClC,aAAa,MAAM;QADnB,UAAK,GAAL,KAAK,CAA6B;QAClC,eAAU,GAAV,UAAU,CAAS;IACnC,CAAC;IAEJ,gBAAgB,CAAC,MAAc,EAAE,KAAa,EAAE,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE;QAChE,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACzB,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC1C,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,cAAc,IAAI,cAAc,GAAG,KAAK,EAAE,CAAC;YAC7C,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;YACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC;YAClD,IAAI,OAAO,GAAG,CAAC,CAAC;YAChB,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;gBACzC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBAC5B,OAAO,EAAE,CAAC;gBACV,IAAI,OAAO,IAAI,QAAQ,EAAE,CAAC;oBACxB,MAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,YAAY,CAAC,KAAa;QAChC,KAAK,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACzC,IAAI,SAAS,IAAI,KAAK,EAAE,CAAC;gBACvB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAQD,MAAM,UAAU,2BAA2B,CACzC,IAAqB,EACrB,MAAc,EACd,MAAc,EACd,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,EAClB,IAAuB;IAEvB,MAAM,KAAK,GAAG,WAAW,CAAC,gBAAgB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC5D,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,OAAO,GAAG,4BAA4B,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC;QACjH,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;IAC5E,CAAC;IACD,MAAM,OAAO,GAAG,0BAA0B,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IACvE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,OAAoC;IAEpC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IAC1C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,sBAAsB,CAAC;IAC9D,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAC1B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;IACxD,CAAC;IAED,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACjD,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACpD,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,GAAG,SAAS,EAAE,CAAC;QAC1C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC;IACjE,CAAC;IAED,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IACvD,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QACrE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;IAC3D,CAAC;IAED,IAAI,OAAO,CAAC,WAAW,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;QAC5F,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;IAC5D,CAAC;IAED,IAAI,OAAe,CAAC;IACpB,IAAI,IAAI,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,GAAG,0BAA0B,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAClF,CAAC;SAAM,IAAI,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,OAAO,CAAC,gBAAgB,IAAI,EAAE,CAAC;QAC5C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;YACpE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sCAAsC,EAAE,CAAC;QACvE,CAAC;QACD,OAAO,GAAG,4BAA4B,CACpC,OAAO,CAAC,IAAI,EACZ,MAAM,EACN,IAAI,CAAC,EAAE,EACP,IAAI,CAAC,KAAK,EACV,IAAgB,EAChB,OAAO,CAAC,UAAU,IAAI,IAAI,CAC3B,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;IAC/D,CAAC;IAED,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACpD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC;IAChE,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC9B,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,oBAAoB,CAClC,MAAc,EACd,MAAc,EACd,eAAuB,EACvB,GAAW,EACX,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE;IAElB,MAAM,KAAK,GAAG,WAAW,CAAC,gBAAgB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3F,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;AACtE,CAAC;AAYD,wEAAwE;AACxE,MAAM,UAAU,qBAAqB,CACnC,OAA6B;IAE7B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IAC1C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,sBAAsB,CAAC;IAC9D,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAC1B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;IAC5D,CAAC;IAED,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACjD,CAAC;IACD,IAAI,MAAM,KAAK,OAAO,CAAC,cAAc,EAAE,CAAC;QACtC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gDAAgD,EAAE,CAAC;IACjF,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACpD,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,GAAG,SAAS,EAAE,CAAC;QAC1C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC;IACjE,CAAC;IACD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IACvD,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QACrE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;IAC3D,CAAC;IACD,IAAI,OAAO,CAAC,WAAW,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;QAC5F,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;IAC1D,CAAC;IAED,MAAM,OAAO,GAAG,mBAAmB,CACjC,MAAM,EACN,IAAI,CAAC,EAAE,EACP,IAAI,CAAC,KAAK,EACV,OAAO,CAAC,eAAe,EACvB,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CACvB,CAAC;IACF,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mCAAmC,EAAE,CAAC;IACpE,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC9B,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,gBAAgB,CAC9B,MAAc,EACd,MAAc,EACd,OAAe,EACf,UAAkB,EAClB,YAAoB;IAEpB,MAAM,OAAO,GAAG,sBAAsB,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;IAClF,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;AAC/D,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,iBAAiB,CAAC,OAKjC;IACC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC5B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACpD,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;IACzD,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACpE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;IAC/D,CAAC;IACD,MAAM,OAAO,GAAG,sBAAsB,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IACvG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACpD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yCAAyC,EAAE,CAAC;IAC1E,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;AAC9C,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,cAAc,CAC5B,MAAc,EACd,MAAc,EACd,YAAoB,EACpB,cAAsB,EACtB,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE;IAElB,MAAM,KAAK,GAAG,WAAW,CAAC,gBAAgB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,qBAAqB,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC;IAC1F,OAAO;QACL,IAAI,EAAE,SAAS;QACf,MAAM;QACN,EAAE,EAAE,KAAK;QACT,KAAK;QACL,GAAG,EAAE,YAAY;QACjB,GAAG,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;KAC/B,CAAC;AACJ,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,eAAe,CAAC,OAM/B;IACC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IAC1C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,sBAAsB,CAAC;IAC9D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAClD,CAAC;IAED,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACjD,CAAC;IACD,IAAI,MAAM,KAAK,OAAO,CAAC,cAAc,EAAE,CAAC;QACtC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,2CAA2C,EAAE,CAAC;IAC5E,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACpD,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,GAAI,GAAG,CAAC,EAAa,CAAC,GAAG,SAAS,EAAE,CAAC;QACrD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC;IACjE,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACtE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IACvD,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QACvE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;IACzD,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QAChE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;IAC3D,CAAC;IAED,MAAM,OAAO,GAAG,qBAAqB,CAAC,MAAM,EAAE,GAAG,CAAC,EAAY,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IAC5G,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAC;IACxE,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC9B,CAAC"}

package/dist/p2p/connection-manager.d.ts

@@ -5,11 +5,16 @@ import { type PeerId } from "../types/peer.js";
 import { ConnectionState, type ConnectionConfig } from "../types/connection.js";
 import { type IceConfig } from "./ice-config.js";
 import type { Wallet } from "ethers";
+import { type TransportCrypto } from "./secure-channel.js";
 export interface PeerEndpoint {
     host: string;
     port: number;
 }
 type MetadataProvider = () => object | null;
+export interface ConnectionManagerOptions {
+    /** Refuse plaintext TCP and unsigned SDP in both directions. Default false (legacy interop). */
+    requireSecureTransport?: boolean;
+}
 /** Represents a single P2P connection. */
 export declare class PeerConnection extends EventEmitter {
     readonly remotePeerId: PeerId;
@@ -22,6 +27,7 @@ export declare class PeerConnection extends EventEmitter {
     private _rawSocket;
     private _signalingSocket;
     private _remoteCapabilities;
+    private _crypto;
     constructor(config: ConnectionConfig);
     get state(): ConnectionState;
     setRemoteCapabilities(capabilities: Iterable<string>): void;
@@ -29,7 +35,10 @@ export declare class PeerConnection extends EventEmitter {
     attachRtcPeer(rtc: NativeRtcPeerConnection): void;
     attachSignalingSocket(socket: Socket): void;
     attachDataChannel(channel: NativeDataChannel): void;
-    attachRawSocket(socket: Socket, initialData?: Uint8Array): void;
+    /** True for encrypted TCP framing or a (DTLS) data channel; false for legacy plaintext TCP. */
+    get isEncryptedTransport(): boolean;
+    get transportDescription(): "webrtc" | "tcp-encrypted" | "tcp-plaintext";
+    attachRawSocket(socket: Socket, initialData?: Uint8Array, crypto?: TransportCrypto): void;
     fail(err: Error): void;
     /** Transition to a new state and emit event. */
     setState(newState: ConnectionState): void;
@@ -55,13 +64,17 @@ export declare class ConnectionManager extends EventEmitter {
     private _server;
     private _transportMode;
     private _metadataProvider;
+    private _requireSecureTransport;
     private _ipConnectionCounts;
     private readonly _introReplayGuard;
     private static _knownEndpoints;
     private static _detectedTransportMode;
-    constructor(iceConfig?: IceConfig);
-    static init(iceConfig?: IceConfig): Promise<ConnectionManager>;
+    constructor(iceConfig?: IceConfig, options?: ConnectionManagerOptions);
+    static init(iceConfig?: IceConfig, options?: ConnectionManagerOptions): Promise<ConnectionManager>;
     get iceConfig(): IceConfig;
+    /** True when node-datachannel loaded and the probe succeeded. */
+    get supportsWebRtc(): boolean;
+    private _localCapabilities;
     get connections(): ReadonlyMap<PeerId, PeerConnection>;
     getListeningPort(): number | null;
     setMetadataProvider(provider: MetadataProvider): void;
@@ -89,8 +102,11 @@ export declare class ConnectionManager extends EventEmitter {
     closeAll(): void;
     private _createWebRtcConnection;
     private _createTcpConnection;
+    /** Buffer until the first newline, then detach and hand over line + remaining bytes. */
+    private _readSingleLine;
     private _handleInboundSocket;
     private _serveHttpMetadata;
+    private _acceptEncryptedTcpInbound;
     private _acceptTcpInbound;
     private _acceptWebRtcInbound;
     private _wireRtcPeer;

package/dist/p2p/connection-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connection-manager.d.ts","sourceRoot":"","sources":["../../src/p2p/connection-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAY,EAAE,KAAK,MAAM,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,KAAK,EACV,cAAc,IAAI,uBAAuB,EACzC,WAAW,IAAI,iBAAiB,EAEjC,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,KAAK,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,KAAK,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAKhF,OAAO,EAAE,KAAK,SAAS,EAAuB,MAAM,iBAAiB,CAAC;AACtE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAqBrC,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAGD,KAAK,gBAAgB,GAAG,MAAM,MAAM,GAAG,IAAI,CAAC;AAmC5C,0CAA0C;AAC1C,qBAAa,cAAe,SAAQ,YAAY;IAC9C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,OAAO,CAAC,MAAM,CAA+C;IAC7D,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,cAAc,CAA8C;IACpE,OAAO,CAAC,IAAI,CAAwC;IACpD,OAAO,CAAC,YAAY,CAAkC;IACtD,OAAO,CAAC,UAAU,CAAuB;IACzC,OAAO,CAAC,gBAAgB,CAAuB;IAC/C,OAAO,CAAC,mBAAmB,CAAqB;gBAEpC,MAAM,EAAE,gBAAgB;IAOpC,IAAI,KAAK,IAAI,eAAe,CAE3B;IAED,qBAAqB,CAAC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,IAAI;IAI3D,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO;IAIhD,aAAa,CAAC,GAAG,EAAE,uBAAuB,GAAG,IAAI;IAIjD,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAI3C,iBAAiB,CAAC,OAAO,EAAE,iBAAiB,GAAG,IAAI;IA6BnD,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,UAAU,GAAG,IAAI;IA8B/D,IAAI,CAAC,GAAG,EAAE,KAAK,GAAG,IAAI;IAQtB,gDAAgD;IAChD,QAAQ,CAAC,QAAQ,EAAE,eAAe,GAAG,IAAI;IAMzC,oCAAoC;IACpC,YAAY,IAAI,IAAI;IAQpB,oCAAoC;IACpC,YAAY,IAAI,IAAI;IAOpB,mDAAmD;IACnD,IAAI,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI;IA2B5B,uCAAuC;IACvC,KAAK,IAAI,IAAI;IAYb,OAAO,CAAC,mBAAmB;IA8B3B,OAAO,CAAC,UAAU;CAKnB;AAcD,mEAAmE;AACnE,qBAAa,iBAAkB,SAAQ,YAAY;IACjD,OAAO,CAAC,YAAY,CAAqC;IACzD,OAAO,CAAC,UAAU,CAAY;IAC9B,OAAO,CAAC,YAAY,CAAuB;IAC3C,OAAO,CAAC,YAAY,CAAuB;IAC3C,OAAO,CAAC,WAAW,CAAe;IAClC,OAAO,CAAC,WAAW,CAAuB;IAC1C,OAAO,CAAC,OAAO,CAA2B;IAC1C,OAAO,CAAC,cAAc,CAAgB;IACtC,OAAO,CAAC,iBAAiB,CAAiC;IAC1D,OAAO,CAAC,mBAAmB,CAA6B;IACxD,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAA0B;IAC5D,OAAO,CAAC,MAAM,CAAC,eAAe,CAAmC;IACjE,OAAO,CAAC,MAAM,CAAC,sBAAsB,CAA8B;gBAEvD,SAAS,CAAC,EAAE,SAAS;WAMpB,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,iBAAiB,CAAC;IASpE,IAAI,SAAS,IAAI,SAAS,CAEzB;IAED,IAAI,WAAW,IAAI,WAAW,CAAC,MAAM,EAAE,cAAc,CAAC,CAErD;IAED,gBAAgB,IAAI,MAAM,GAAG,IAAI;IAIjC,mBAAmB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,IAAI;IAIrD,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAIpC,gBAAgB,CAAC,QAAQ,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAKpE,MAAM,CAAC,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,GAAG,IAAI;IAIzE,MAAM,CAAC,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS;IAIpE,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,GAAG,IAAI;IAI5D,cAAc,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAkDtF,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC;IAiBpC,wCAAwC;IACxC,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,cAAc;IA0C1D,6CAA6C;IAC7C,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAIzD,mCAAmC;IACnC,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAOrC,0CAA0C;IAC1C,QAAQ,IAAI,IAAI;IAUhB,OAAO,CAAC,uBAAuB;IA2D/B,OAAO,CAAC,oBAAoB;IAiC5B,OAAO,CAAC,oBAAoB;IAoF5B,OAAO,CAAC,kBAAkB;IAsD1B,OAAO,CAAC,iBAAiB;IA0BzB,OAAO,CAAC,oBAAoB;IA+C5B,OAAO,CAAC,YAAY;IA4CpB,OAAO,CAAC,cAAc;IAYtB,OAAO,CAAC,iBAAiB;IAgBzB,OAAO,CAAC,sBAAsB;IA8C9B,OAAO,CAAC,SAAS;IAOjB,OAAO,CAAC,mBAAmB;IAmB3B,OAAO,CAAC,MAAM,CAAC,oBAAoB;IA0BnC,OAAO,CAAC,yBAAyB;IAajC,OAAO,CAAC,UAAU;CAKnB"}
+{"version":3,"file":"connection-manager.d.ts","sourceRoot":"","sources":["../../src/p2p/connection-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG3C,OAAY,EAAE,KAAK,MAAM,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,KAAK,EACV,cAAc,IAAI,uBAAuB,EACzC,WAAW,IAAI,iBAAiB,EAEjC,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,KAAK,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,KAAK,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAQhF,OAAO,EAAE,KAAK,SAAS,EAAuB,MAAM,iBAAiB,CAAC;AACtE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAerC,OAAO,EACL,KAAK,eAAe,EAIrB,MAAM,qBAAqB,CAAC;AA6C7B,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAGD,KAAK,gBAAgB,GAAG,MAAM,MAAM,GAAG,IAAI,CAAC;AAE5C,MAAM,WAAW,wBAAwB;IACvC,gGAAgG;IAChG,sBAAsB,CAAC,EAAE,OAAO,CAAC;CAClC;AAyCD,0CAA0C;AAC1C,qBAAa,cAAe,SAAQ,YAAY;IAC9C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,OAAO,CAAC,MAAM,CAA+C;IAC7D,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,cAAc,CAA8C;IACpE,OAAO,CAAC,IAAI,CAAwC;IACpD,OAAO,CAAC,YAAY,CAAkC;IACtD,OAAO,CAAC,UAAU,CAAuB;IACzC,OAAO,CAAC,gBAAgB,CAAuB;IAC/C,OAAO,CAAC,mBAAmB,CAAqB;IAChD,OAAO,CAAC,OAAO,CAAgC;gBAEnC,MAAM,EAAE,gBAAgB;IAOpC,IAAI,KAAK,IAAI,eAAe,CAE3B;IAED,qBAAqB,CAAC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,IAAI;IAI3D,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO;IAIhD,aAAa,CAAC,GAAG,EAAE,uBAAuB,GAAG,IAAI;IAIjD,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAI3C,iBAAiB,CAAC,OAAO,EAAE,iBAAiB,GAAG,IAAI;IA6BnD,+FAA+F;IAC/F,IAAI,oBAAoB,IAAI,OAAO,CAElC;IAED,IAAI,oBAAoB,IAAI,QAAQ,GAAG,eAAe,GAAG,eAAe,CAIvE;IAED,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,eAAe,GAAG,IAAI;IAgDzF,IAAI,CAAC,GAAG,EAAE,KAAK,GAAG,IAAI;IAQtB,gDAAgD;IAChD,QAAQ,CAAC,QAAQ,EAAE,eAAe,GAAG,IAAI;IAMzC,oCAAoC;IACpC,YAAY,IAAI,IAAI;IAQpB,oCAAoC;IACpC,YAAY,IAAI,IAAI;IAOpB,mDAAmD;IACnD,IAAI,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI;IAwC5B,uCAAuC;IACvC,KAAK,IAAI,IAAI;IAYb,OAAO,CAAC,mBAAmB;IA8B3B,OAAO,CAAC,UAAU;CAKnB;AAcD,mEAAmE;AACnE,qBAAa,iBAAkB,SAAQ,YAAY;IACjD,OAAO,CAAC,YAAY,CAAqC;IACzD,OAAO,CAAC,UAAU,CAAY;IAC9B,OAAO,CAAC,YAAY,CAAuB;IAC3C,OAAO,CAAC,YAAY,CAAuB;IAC3C,OAAO,CAAC,WAAW,CAAe;IAClC,OAAO,CAAC,WAAW,CAAuB;IAC1C,OAAO,CAAC,OAAO,CAA2B;IAC1C,OAAO,CAAC,cAAc,CAAgB;IACtC,OAAO,CAAC,iBAAiB,CAAiC;IAC1D,OAAO,CAAC,uBAAuB,CAAU;IACzC,OAAO,CAAC,mBAAmB,CAA6B;IACxD,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAA0B;IAC5D,OAAO,CAAC,MAAM,CAAC,eAAe,CAAmC;IACjE,OAAO,CAAC,MAAM,CAAC,sBAAsB,CAA8B;gBAEvD,SAAS,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,wBAAwB;WAOxD,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,wBAAwB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAWxG,IAAI,SAAS,IAAI,SAAS,CAEzB;IAED,iEAAiE;IACjE,IAAI,cAAc,IAAI,OAAO,CAE5B;IAED,OAAO,CAAC,kBAAkB;IAM1B,IAAI,WAAW,IAAI,WAAW,CAAC,MAAM,EAAE,cAAc,CAAC,CAErD;IAED,gBAAgB,IAAI,MAAM,GAAG,IAAI;IAIjC,mBAAmB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,IAAI;IAIrD,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAIpC,gBAAgB,CAAC,QAAQ,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAKpE,MAAM,CAAC,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,GAAG,IAAI;IAIzE,MAAM,CAAC,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS;IAIpE,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,GAAG,IAAI;IAI5D,cAAc,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAkDtF,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC;IAiBpC,wCAAwC;IACxC,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,cAAc;IAoD1D,6CAA6C;IAC7C,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAIzD,mCAAmC;IACnC,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAOrC,0CAA0C;IAC1C,QAAQ,IAAI,IAAI;IAUhB,OAAO,CAAC,uBAAuB;IA8D/B,OAAO,CAAC,oBAAoB;IAwG5B,wFAAwF;IACxF,OAAO,CAAC,eAAe;IA8BvB,OAAO,CAAC,oBAAoB;IA2G5B,OAAO,CAAC,kBAAkB;IAsD1B,OAAO,CAAC,0BAA0B;IAiDlC,OAAO,CAAC,iBAAiB;IA4BzB,OAAO,CAAC,oBAAoB;IAsD5B,OAAO,CAAC,YAAY;IAkDpB,OAAO,CAAC,cAAc;IAYtB,OAAO,CAAC,iBAAiB;IAsCzB,OAAO,CAAC,sBAAsB;IA8C9B,OAAO,CAAC,SAAS;IAOjB,OAAO,CAAC,mBAAmB;IAmB3B,OAAO,CAAC,MAAM,CAAC,oBAAoB;IA0BnC,OAAO,CAAC,yBAAyB;IAajC,OAAO,CAAC,UAAU;CAKnB"}

package/dist/p2p/connection-manager.js

@@ -1,9 +1,12 @@
 import { EventEmitter } from "node:events";
+import { execFile } from "node:child_process";
+import { createRequire } from "node:module";
 import net from "node:net";
 import { ConnectionState } from "../types/connection.js";
-import { CONNECTION_CAPABILITY_RESPONSE_AUTH_V1, CONNECTION_CAPABILITY_COOPERATIVE_CLOSE_V1, } from "../types/protocol.js";
+import { CONNECTION_CAPABILITY_RESPONSE_AUTH_V1, CONNECTION_CAPABILITY_COOPERATIVE_CLOSE_V1, CONNECTION_CAPABILITY_SIGNED_SDP_V1, CONNECTION_CAPABILITY_TCP_ENC_V1, CONNECTION_CAPABILITY_WEBRTC_V1, } from "../types/protocol.js";
 import { getDefaultIceConfig } from "./ice-config.js";
-import { NonceReplayGuard, buildConnectionAuthEnvelope, verifyConnectionAuthEnvelope, } from "./connection-auth.js";
+import { NonceReplayGuard, buildConnectionAuthEnvelope, buildSdpAuthEnvelope, buildTcpEncAck, buildTcpEncOffer, verifyConnectionAuthEnvelope, verifySdpAuthEnvelope, verifyTcpEncAck, verifyTcpEncOffer, } from "./connection-auth.js";
+import { createTransportCrypto, deriveSessionKeys, generateEphemeralKeyPair, } from "./secure-channel.js";
 let _nodeDatachannel = null;
 async function loadNodeDatachannel() {
     if (_nodeDatachannel)
@@ -11,6 +14,29 @@ async function loadNodeDatachannel() {
     _nodeDatachannel = await import("node-datachannel");
     return _nodeDatachannel;
 }
+const NDC_PROBE_SOURCE = "const m = require(process.argv[1]);" +
+    "const pc = new m.PeerConnection('antseed-probe', { iceServers: [] });" +
+    "const dc = pc.createDataChannel('probe', { ordered: true });" +
+    "dc.close(); pc.close();" +
+    "process.exit(0);";
+/**
+ * Exercise node-datachannel in a disposable child process first: a broken
+ * native build can segfault, which no in-process try/catch survives. A dead
+ * or hung child just means TCP fallback instead of a crashed node.
+ */
+function probeNodeDatachannelSafely() {
+    return new Promise((resolve) => {
+        let modulePath;
+        try {
+            modulePath = createRequire(import.meta.url).resolve("node-datachannel");
+        }
+        catch {
+            resolve(false);
+            return;
+        }
+        execFile(process.execPath, ["-e", NDC_PROBE_SOURCE, modulePath], { timeout: 10_000 }, (err) => resolve(!err));
+    });
+}
 function getNodeDatachannel() {
     if (!_nodeDatachannel)
         throw new Error("node-datachannel not loaded");
@@ -24,6 +50,8 @@ const TCP_KEEPALIVE_INITIAL_DELAY_MS = 10_000;
 const LOCAL_CONNECTION_CAPABILITIES = [
     CONNECTION_CAPABILITY_RESPONSE_AUTH_V1,
     CONNECTION_CAPABILITY_COOPERATIVE_CLOSE_V1,
+    CONNECTION_CAPABILITY_SIGNED_SDP_V1,
+    CONNECTION_CAPABILITY_TCP_ENC_V1,
 ];
 /** Represents a single P2P connection. */
 export class PeerConnection extends EventEmitter {
@@ -37,6 +65,7 @@ export class PeerConnection extends EventEmitter {
     _rawSocket = null;
     _signalingSocket = null;
     _remoteCapabilities = new Set();
+    _crypto = null;
     constructor(config) {
         super();
         this.remotePeerId = config.remotePeerId;
@@ -83,11 +112,40 @@ export class PeerConnection extends EventEmitter {
             }
         });
     }
-    attachRawSocket(socket, initialData) {
+    /** True for encrypted TCP framing or a (DTLS) data channel; false for legacy plaintext TCP. */
+    get isEncryptedTransport() {
+        return this._crypto !== null || this._dataChannel !== null;
+    }
+    get transportDescription() {
+        if (this._dataChannel !== null)
+            return "webrtc";
+        if (this._crypto !== null)
+            return "tcp-encrypted";
+        return "tcp-plaintext";
+    }
+    attachRawSocket(socket, initialData, crypto) {
         this._rawSocket = socket;
+        this._crypto = crypto ?? null;
         socket.setKeepAlive(true, TCP_KEEPALIVE_INITIAL_DELAY_MS);
+        const deliver = (chunk) => {
+            if (!this._crypto) {
+                this.emit("message", chunk);
+                return;
+            }
+            let messages;
+            try {
+                messages = this._crypto.decryptor.push(chunk);
+            }
+            catch (err) {
+                this.fail(err instanceof Error ? err : new Error(String(err)));
+                return;
+            }
+            for (const message of messages) {
+                this.emit("message", message);
+            }
+        };
         socket.on("data", (chunk) => {
-            this.emit("message", new Uint8Array(chunk));
+            deliver(new Uint8Array(chunk));
         });
         socket.on("error", (err) => {
             this.fail(err);
@@ -103,7 +161,7 @@ export class PeerConnection extends EventEmitter {
         }
         if (initialData && initialData.length > 0) {
             queueMicrotask(() => {
-                this.emit("message", initialData);
+                deliver(initialData);
             });
         }
     }
@@ -158,6 +216,19 @@ export class PeerConnection extends EventEmitter {
             this.fail(err);
             throw err;
         }
+        if (this._crypto) {
+            let frame;
+            try {
+                frame = this._crypto.encryptor.encrypt(data);
+            }
+            catch (err) {
+                const wrapped = err instanceof Error ? err : new Error(String(err));
+                this.fail(wrapped);
+                throw wrapped;
+            }
+            this._rawSocket.write(frame);
+            return;
+        }
         this._rawSocket.write(Buffer.from(data));
     }
     /** Close the connection gracefully. */
@@ -228,27 +299,40 @@ export class ConnectionManager extends EventEmitter {
     _server = null;
     _transportMode;
     _metadataProvider = null;
+    _requireSecureTransport;
     _ipConnectionCounts = new Map();
     _introReplayGuard = new NonceReplayGuard();
     static _knownEndpoints = new Map();
     static _detectedTransportMode = null;
-    constructor(iceConfig) {
+    constructor(iceConfig, options) {
         super();
         this._iceConfig = iceConfig ?? getDefaultIceConfig();
         this._transportMode = ConnectionManager._detectTransportMode();
+        this._requireSecureTransport = options?.requireSecureTransport ?? false;
     }
-    static async init(iceConfig) {
-        try {
-            await loadNodeDatachannel();
-        }
-        catch {
-            // node-datachannel not available — TCP fallback will be used
+    static async init(iceConfig, options) {
+        if (_nodeDatachannel || await probeNodeDatachannelSafely()) {
+            try {
+                await loadNodeDatachannel();
+            }
+            catch {
+                // node-datachannel not available — TCP fallback will be used
+            }
         }
-        return new ConnectionManager(iceConfig);
+        return new ConnectionManager(iceConfig, options);
     }
     get iceConfig() {
         return this._iceConfig;
     }
+    /** True when node-datachannel loaded and the probe succeeded. */
+    get supportsWebRtc() {
+        return this._transportMode === "webrtc";
+    }
+    _localCapabilities() {
+        return this.supportsWebRtc
+            ? [...LOCAL_CONNECTION_CAPABILITIES, CONNECTION_CAPABILITY_WEBRTC_V1]
+            : [...LOCAL_CONNECTION_CAPABILITIES];
+    }
     get connections() {
         return this._connections;
     }
@@ -338,6 +422,9 @@ export class ConnectionManager extends EventEmitter {
             throw new Error(`Connection to ${config.remotePeerId} already exists`);
         }
         const conn = new PeerConnection(config);
+        if (config.remoteCapabilities && config.remoteCapabilities.length > 0) {
+            conn.setRemoteCapabilities(config.remoteCapabilities);
+        }
         this._registerConnection(config.remotePeerId, conn);
         conn.startTimeout();
         if (!this._localPeerId) {
@@ -360,7 +447,14 @@ export class ConnectionManager extends EventEmitter {
             return conn;
         }
         ConnectionManager.registerPeerEndpoint(config.remotePeerId, endpoint);
-        if (this._transportMode === "webrtc") {
+        // Encrypted TCP is preferred: data channels cap messages at ~256 KiB
+        // (breaking 1 MiB protocol chunks) and set up slower. WebRTC is for peers
+        // that cannot do TCP at all; legacy peers crash-guard `hello` away, so
+        // unknown peers also get TCP.
+        const useWebRtc = this._transportMode === "webrtc"
+            && conn.hasRemoteCapability(CONNECTION_CAPABILITY_WEBRTC_V1)
+            && !conn.hasRemoteCapability(CONNECTION_CAPABILITY_TCP_ENC_V1);
+        if (useWebRtc) {
             this._createWebRtcConnection(config, conn, endpoint);
         }
         else {
@@ -403,10 +497,11 @@ export class ConnectionManager extends EventEmitter {
             this._applySignalToRtc(rtc, msg, conn);
         }, (err) => conn.fail(err), "");
         signalingSocket.once("connect", () => {
+            const capabilities = this._localCapabilities();
             this._sendLine(signalingSocket, {
                 type: "hello",
-                auth: buildConnectionAuthEnvelope("hello", this._localPeerId, this._localWallet),
-                capabilities: [...LOCAL_CONNECTION_CAPABILITIES],
+                auth: buildConnectionAuthEnvelope("hello", this._localPeerId, this._localWallet, Date.now(), { capabilities }),
+                capabilities,
             });
             rtc = this._createRtcPeer(config.remotePeerId);
             conn.attachRtcPeer(rtc);
@@ -429,13 +524,61 @@ export class ConnectionManager extends EventEmitter {
     }
     _createTcpConnection(config, conn, endpoint) {
         const socket = net.connect({ host: endpoint.host, port: endpoint.port });
+        // Once offered, the handshake fails closed on timeout — never a plaintext downgrade.
+        const useEncryption = this._requireSecureTransport || conn.hasRemoteCapability(CONNECTION_CAPABILITY_TCP_ENC_V1);
         socket.once("connect", () => {
+            const capabilities = this._localCapabilities();
+            if (!useEncryption) {
+                // Legacy plaintext path keeps the v1 envelope old responders can verify.
+                this._sendLine(socket, {
+                    type: "intro",
+                    auth: buildConnectionAuthEnvelope("intro", this._localPeerId, this._localWallet),
+                    capabilities,
+                });
+                conn.attachRawSocket(socket);
+                return;
+            }
+            const ephemeral = generateEphemeralKeyPair();
+            // v2 envelope binds capabilities and the enc key, so stripping either
+            // downgrades to an unverifiable signature instead of plaintext.
+            const auth = buildConnectionAuthEnvelope("intro", this._localPeerId, this._localWallet, Date.now(), { capabilities, encPub: ephemeral.publicKeyHex });
             this._sendLine(socket, {
                 type: "intro",
-                auth: buildConnectionAuthEnvelope("intro", this._localPeerId, this._localWallet),
-                capabilities: [...LOCAL_CONNECTION_CAPABILITIES],
+                auth,
+                capabilities,
+                enc: buildTcpEncOffer(this._localWallet, this._localPeerId, auth.ts, auth.nonce, ephemeral.publicKeyHex),
+            });
+            // Everything after the enc-ack line is encrypted frames.
+            this._readSingleLine(socket, (line, remaining) => {
+                let ack;
+                try {
+                    ack = JSON.parse(line);
+                }
+                catch {
+                    conn.fail(new Error(`Peer ${config.remotePeerId} sent an invalid enc-ack`));
+                    socket.destroy();
+                    return;
+                }
+                const verified = verifyTcpEncAck({
+                    ack,
+                    expectedPeerId: config.remotePeerId,
+                    initiatorNonce: auth.nonce,
+                });
+                if (!verified.ok) {
+                    conn.fail(new Error(`Encrypted transport handshake with ${config.remotePeerId} failed: ${verified.reason}`));
+                    socket.destroy();
+                    return;
+                }
+                const keys = deriveSessionKeys(ephemeral.privateKey, ack.pub, {
+                    initiatorPeerId: this._localPeerId,
+                    responderPeerId: config.remotePeerId,
+                    initiatorNonce: auth.nonce,
+                    responderNonce: ack.nonce,
+                    initiatorPubHex: ephemeral.publicKeyHex,
+                    responderPubHex: ack.pub,
+                }, true);
+                conn.attachRawSocket(socket, remaining.length > 0 ? new Uint8Array(remaining) : undefined, createTransportCrypto(keys));
             });
-            conn.attachRawSocket(socket);
         });
         socket.on("error", (err) => {
             if (conn.state === ConnectionState.Connecting) {
@@ -448,21 +591,53 @@ export class ConnectionManager extends EventEmitter {
             }
         });
     }
-    _handleInboundSocket(socket) {
+    /** Buffer until the first newline, then detach and hand over line + remaining bytes. */
+    _readSingleLine(socket, onLine) {
         let buffer = Buffer.alloc(0);
-        const timeout = setTimeout(() => {
-            socket.destroy();
-        }, INITIAL_LINE_TIMEOUT_MS);
         const onData = (chunk) => {
-            if (buffer.length + chunk.length > MAX_INITIAL_LINE_BYTES) {
+            buffer = Buffer.concat([buffer, chunk]);
+            const lineBreak = buffer.indexOf(0x0a); // '\n'
+            if (lineBreak < 0) {
+                if (buffer.length > MAX_INITIAL_LINE_BYTES) {
+                    socket.off("data", onData);
+                    socket.destroy();
+                }
+                return;
+            }
+            // Only the line itself is size-limited — the same chunk may carry
+            // payload bytes (e.g. an encrypted frame right after the enc-ack).
+            if (lineBreak > MAX_INITIAL_LINE_BYTES) {
                 socket.off("data", onData);
-                clearTimeout(timeout);
                 socket.destroy();
                 return;
             }
+            socket.off("data", onData);
+            const line = buffer.subarray(0, lineBreak).toString("utf8").trim();
+            const remaining = buffer.subarray(lineBreak + 1);
+            onLine(line, remaining);
+        };
+        socket.on("data", onData);
+    }
+    _handleInboundSocket(socket) {
+        let buffer = Buffer.alloc(0);
+        const timeout = setTimeout(() => {
+            socket.destroy();
+        }, INITIAL_LINE_TIMEOUT_MS);
+        const onData = (chunk) => {
             buffer = Buffer.concat([buffer, chunk]);
             const lineBreak = buffer.indexOf(0x0a); // '\n'
             if (lineBreak < 0) {
+                if (buffer.length > MAX_INITIAL_LINE_BYTES) {
+                    socket.off("data", onData);
+                    clearTimeout(timeout);
+                    socket.destroy();
+                }
+                return;
+            }
+            if (lineBreak > MAX_INITIAL_LINE_BYTES) {
+                socket.off("data", onData);
+                clearTimeout(timeout);
+                socket.destroy();
                 return;
             }
             socket.off("data", onData);
@@ -486,9 +661,14 @@ export class ConnectionManager extends EventEmitter {
                 socket.destroy();
                 return;
             }
+            const wireEncPub = intro.type === "intro" && typeof intro.enc?.pub === "string"
+                ? intro.enc.pub
+                : null;
             const verified = verifyConnectionAuthEnvelope({
                 type: intro.type,
                 auth: intro.auth,
+                wireCapabilities: intro.capabilities,
+                wireEncPub,
                 replayGuard: this._introReplayGuard,
             });
             if (!verified.ok || !verified.peerId) {
@@ -497,10 +677,23 @@ export class ConnectionManager extends EventEmitter {
             }
             const remoteCapabilities = normalizeCapabilities(intro.capabilities);
             if (intro.type === "intro") {
+                if (intro.enc) {
+                    this._acceptEncryptedTcpInbound(socket, verified.peerId, intro, remaining, remoteCapabilities);
+                    return;
+                }
+                if (this._requireSecureTransport) {
+                    socket.destroy();
+                    return;
+                }
                 this._acceptTcpInbound(socket, verified.peerId, remaining, remoteCapabilities);
                 return;
             }
             if (intro.type === "hello") {
+                if (this._transportMode !== "webrtc") {
+                    // No working WebRTC stack — refuse instead of crashing on rtc creation.
+                    socket.destroy();
+                    return;
+                }
                 this._acceptWebRtcInbound(socket, verified.peerId, remaining.toString("utf8"), remoteCapabilities);
                 return;
             }
@@ -571,7 +764,36 @@ export class ConnectionManager extends EventEmitter {
             `\r\n` +
             body);
     }
-    _acceptTcpInbound(socket, remotePeerId, remainingData, remoteCapabilities) {
+    _acceptEncryptedTcpInbound(socket, remotePeerId, intro, remainingData, remoteCapabilities) {
+        if (!this._localPeerId || !this._localWallet) {
+            // No wallet — cannot sign a valid ack.
+            socket.destroy();
+            return;
+        }
+        const offerVerified = verifyTcpEncOffer({
+            offer: intro.enc,
+            peerId: remotePeerId,
+            introTs: intro.auth.ts,
+            introNonce: intro.auth.nonce,
+        });
+        if (!offerVerified.ok) {
+            socket.destroy();
+            return;
+        }
+        const ephemeral = generateEphemeralKeyPair();
+        const ack = buildTcpEncAck(this._localWallet, this._localPeerId, ephemeral.publicKeyHex, intro.auth.nonce);
+        this._sendLine(socket, ack);
+        const keys = deriveSessionKeys(ephemeral.privateKey, intro.enc.pub, {
+            initiatorPeerId: remotePeerId,
+            responderPeerId: this._localPeerId,
+            initiatorNonce: intro.auth.nonce,
+            responderNonce: ack.nonce,
+            initiatorPubHex: intro.enc.pub,
+            responderPubHex: ephemeral.publicKeyHex,
+        }, false);
+        this._acceptTcpInbound(socket, remotePeerId, remainingData, remoteCapabilities, createTransportCrypto(keys));
+    }
+    _acceptTcpInbound(socket, remotePeerId, remainingData, remoteCapabilities, crypto) {
         const existing = this._connections.get(remotePeerId);
         if (existing && existing.state !== ConnectionState.Closed && existing.state !== ConnectionState.Failed) {
             // Replace stale/ghost connections from the same peer instead of rejecting
@@ -584,7 +806,7 @@ export class ConnectionManager extends EventEmitter {
         });
         conn.setRemoteCapabilities(remoteCapabilities);
         this._registerConnection(remotePeerId, conn);
-        conn.attachRawSocket(socket, remainingData.length > 0 ? new Uint8Array(remainingData) : undefined);
+        conn.attachRawSocket(socket, remainingData.length > 0 ? new Uint8Array(remainingData) : undefined, crypto);
         this.emit("connection", conn);
     }
     _acceptWebRtcInbound(socket, remotePeerId, initialSignalingBuffer, remoteCapabilities) {
@@ -601,9 +823,17 @@ export class ConnectionManager extends EventEmitter {
         conn.setRemoteCapabilities(remoteCapabilities);
         conn.attachSignalingSocket(socket);
         this._registerConnection(remotePeerId, conn);
-        const rtc = this._createRtcPeer(remotePeerId);
-        conn.attachRtcPeer(rtc);
-        this._wireRtcPeer(conn, rtc, socket, false);
+        let rtc;
+        try {
+            rtc = this._createRtcPeer(remotePeerId);
+            conn.attachRtcPeer(rtc);
+            this._wireRtcPeer(conn, rtc, socket, false);
+        }
+        catch (err) {
+            conn.fail(err instanceof Error ? err : new Error(String(err)));
+            socket.destroy();
+            return;
+        }
         this._attachSignalingParser(socket, (msg) => {
             this._applySignalToRtc(rtc, msg, conn);
         }, (err) => conn.fail(err), initialSignalingBuffer);
@@ -619,10 +849,16 @@ export class ConnectionManager extends EventEmitter {
     }
     _wireRtcPeer(conn, rtc, signalingSocket, isInitiator) {
         rtc.onLocalDescription((sdp, descriptionType) => {
+            const normalizedType = this._normalizeDescriptionType(descriptionType);
+            // Signing the SDP binds its DTLS fingerprint to our identity.
+            const auth = this._localPeerId && this._localWallet
+                ? buildSdpAuthEnvelope(this._localPeerId, this._localWallet, normalizedType, sdp)
+                : undefined;
             this._sendLine(signalingSocket, {
                 type: "sdp",
                 sdp,
-                descriptionType: this._normalizeDescriptionType(descriptionType),
+                descriptionType: normalizedType,
+                ...(auth ? { auth } : {}),
             });
         });
         rtc.onLocalCandidate((candidate, mid) => {
@@ -667,9 +903,30 @@ export class ConnectionManager extends EventEmitter {
     _applySignalToRtc(rtc, signal, conn) {
         try {
             if (signal.type === "sdp") {
+                if (signal.auth) {
+                    const verified = verifySdpAuthEnvelope({
+                        auth: signal.auth,
+                        expectedPeerId: conn.remotePeerId,
+                        descriptionType: signal.descriptionType,
+                        sdp: signal.sdp,
+                        replayGuard: this._introReplayGuard,
+                    });
+                    if (!verified.ok) {
+                        conn.fail(new Error(`SDP signature from ${conn.remotePeerId} rejected: ${verified.reason}`));
+                        return;
+                    }
+                }
+                else if (this._requireSecureTransport
+                    || conn.hasRemoteCapability(CONNECTION_CAPABILITY_SIGNED_SDP_V1)) {
+                    // Peer is known to sign its SDP — unsigned means a stripped signature.
+                    conn.fail(new Error(`Peer ${conn.remotePeerId} sent unsigned SDP`));
+                    return;
+                }
                 rtc.setRemoteDescription(signal.sdp, signal.descriptionType);
             }
             else {
+                // Candidates stay unsigned: DTLS still verifies the cert against the
+                // signed SDP fingerprint, so tampering can only break connectivity.
                 rtc.addRemoteCandidate(signal.candidate, signal.mid);
             }
         }