@decentnetwork/lan 0.1.138 → 0.1.140

package/dist/proxy/route-learner.d.ts

@@ -0,0 +1,33 @@
+/** Consecutive bad DIRECT outcomes before a host is learned into a region. */
+export declare const MISCLASSIFIED_AFTER = 2;
+/** A tunnel that lived less than this and delivered less than SUSPICIOUS_BYTES
+ *  downstream is a "suspicious close" — established, then killed before the
+ *  TLS handshake could even finish (a completed handshake alone sends >1KB of
+ *  certificate data down, so <1KB ≈ RST-after-ClientHello, the GFW signature).
+ *  A legit-but-tiny exchange (tracking pixel, 204 API poll) clears 1KB easily
+ *  and is never counted. */
+export declare const SUSPICIOUS_MS = 3000;
+export declare const SUSPICIOUS_BYTES = 1024;
+export declare class RouteLearner {
+    #private;
+    constructor(path?: string, log?: (msg: string) => void);
+    /** The learned region for a host, if any (and not expired). */
+    get(host: string): string | null;
+    /** Record a bad DIRECT outcome (hard failure or suspicious close).
+     *  Returns true when the host has crossed the threshold and should be
+     *  learned into the fallback region. */
+    recordDirectBad(host: string): boolean;
+    /** A DIRECT tunnel to the host worked properly — clear its strike counter. */
+    recordDirectGood(host: string): void;
+    /** Classify an established tunnel's ending: was it a suspicious early close? */
+    static suspiciousClose(bytesDown: number, lifetimeMs: number): boolean;
+    learn(host: string, region: string): void;
+    /** The learned region failed too (all exits down for this host) — forget it
+     *  so the host can try DIRECT again next time. */
+    unlearn(host: string): void;
+    get size(): number;
+    entries(): Array<{
+        host: string;
+        region: string;
+    }>;
+}

package/dist/proxy/route-learner.js

@@ -0,0 +1,129 @@
+//
+// Route learner — automatic classification of hosts the static domain table
+// misses (e.g. piccpndali.v.myalicdn.com, CCTV's real video CDN, which no
+// suffix list anticipated and which therefore leaked DIRECT and geo-failed).
+//
+// Signals that a DIRECT route is wrong for a host:
+//   * hard failure — the dial itself errors or times out;
+//   * suspicious close — the tunnel establishes but dies almost immediately
+//     with almost no payload (the GFW-style RST-after-ClientHello, or a
+//     geo-block that drops the connection instead of answering).
+//
+// After MISCLASSIFIED_AFTER consecutive bad DIRECT outcomes the host is
+// learned into a fallback region and persisted, so the fix survives restarts.
+// A learned route that stops working (all exits fail) is unlearned — a host
+// can always find its way back to DIRECT.
+//
+import fs from "node:fs";
+/** Consecutive bad DIRECT outcomes before a host is learned into a region. */
+export const MISCLASSIFIED_AFTER = 2;
+/** A tunnel that lived less than this and delivered less than SUSPICIOUS_BYTES
+ *  downstream is a "suspicious close" — established, then killed before the
+ *  TLS handshake could even finish (a completed handshake alone sends >1KB of
+ *  certificate data down, so <1KB ≈ RST-after-ClientHello, the GFW signature).
+ *  A legit-but-tiny exchange (tracking pixel, 204 API poll) clears 1KB easily
+ *  and is never counted. */
+export const SUSPICIOUS_MS = 3000;
+export const SUSPICIOUS_BYTES = 1024;
+/** Learned entries expire after this long (the internet moves; re-verify). */
+const LEARNED_TTL_MS = 30 * 24 * 3600 * 1000;
+/** Cap the failure-counter table so hostile traffic can't grow it unbounded. */
+const MAX_TRACKED_HOSTS = 2000;
+export class RouteLearner {
+    #learned = new Map();
+    #fails = new Map();
+    #path;
+    #saveTimer = null;
+    #log;
+    constructor(path, log) {
+        this.#path = path;
+        this.#log = log ?? (() => undefined);
+        this.#load();
+    }
+    /** The learned region for a host, if any (and not expired). */
+    get(host) {
+        const e = this.#learned.get(host);
+        if (!e)
+            return null;
+        if (Date.now() - e.at > LEARNED_TTL_MS) {
+            this.#learned.delete(host);
+            this.#scheduleSave();
+            return null;
+        }
+        return e.region;
+    }
+    /** Record a bad DIRECT outcome (hard failure or suspicious close).
+     *  Returns true when the host has crossed the threshold and should be
+     *  learned into the fallback region. */
+    recordDirectBad(host) {
+        if (this.#fails.size >= MAX_TRACKED_HOSTS && !this.#fails.has(host)) {
+            const oldest = this.#fails.keys().next().value;
+            this.#fails.delete(oldest);
+        }
+        const n = (this.#fails.get(host) ?? 0) + 1;
+        this.#fails.set(host, n);
+        return n >= MISCLASSIFIED_AFTER;
+    }
+    /** A DIRECT tunnel to the host worked properly — clear its strike counter. */
+    recordDirectGood(host) {
+        this.#fails.delete(host);
+    }
+    /** Classify an established tunnel's ending: was it a suspicious early close? */
+    static suspiciousClose(bytesDown, lifetimeMs) {
+        return lifetimeMs < SUSPICIOUS_MS && bytesDown < SUSPICIOUS_BYTES;
+    }
+    learn(host, region) {
+        this.#learned.set(host, { region, at: Date.now() });
+        this.#fails.delete(host);
+        this.#log(`learned route ${host} → region [${region}] (direct kept failing)`);
+        this.#scheduleSave();
+    }
+    /** The learned region failed too (all exits down for this host) — forget it
+     *  so the host can try DIRECT again next time. */
+    unlearn(host) {
+        if (this.#learned.delete(host)) {
+            this.#log(`unlearned route ${host} (region exits failed; back to direct)`);
+            this.#scheduleSave();
+        }
+    }
+    get size() {
+        return this.#learned.size;
+    }
+    entries() {
+        return [...this.#learned.entries()].map(([host, e]) => ({ host, region: e.region }));
+    }
+    #load() {
+        if (!this.#path)
+            return;
+        try {
+            const raw = JSON.parse(fs.readFileSync(this.#path, "utf8"));
+            const now = Date.now();
+            for (const [host, e] of Object.entries(raw)) {
+                if (e && typeof e.region === "string" && now - e.at <= LEARNED_TTL_MS)
+                    this.#learned.set(host, e);
+            }
+            if (this.#learned.size > 0)
+                this.#log(`loaded ${this.#learned.size} learned route(s) from ${this.#path}`);
+        }
+        catch {
+            /* no file yet / unreadable — start empty */
+        }
+    }
+    #scheduleSave() {
+        if (!this.#path || this.#saveTimer)
+            return;
+        this.#saveTimer = setTimeout(() => {
+            this.#saveTimer = null;
+            try {
+                const obj = {};
+                for (const [h, e] of this.#learned)
+                    obj[h] = e;
+                fs.writeFileSync(this.#path, JSON.stringify(obj, null, 2));
+            }
+            catch {
+                /* best-effort persistence */
+            }
+        }, 3000);
+        this.#saveTimer.unref?.();
+    }
+}

package/dist/router/paced-forwarder.d.ts

@@ -0,0 +1,45 @@
+export type FlowKey = string;
+export interface PacedForwarderOptions {
+    /** Actually hand a packet to the carrier for `dstIp`. Should resolve quickly
+     *  (best-effort UDP); rejection is counted as a drop. */
+    send: (dstIp: string, packet: Uint8Array) => Promise<void>;
+    /** Default per-destination rate (bytes/sec) before a measured estimate
+     *  arrives. Generous so pacing is a no-op until setRate tightens it. */
+    defaultRateBps?: number;
+    /** Max queued bytes per flow before tail-drop (bounds latency + memory). */
+    maxFlowBytes?: number;
+    /** Max queued bytes across a destination before shed (backstop). */
+    maxDestBytes?: number;
+    /** Token-bucket burst ceiling as seconds-worth of rate. */
+    burstSeconds?: number;
+    now?: () => number;
+    schedule?: (fn: () => void, ms: number) => void;
+}
+export interface PacedForwarderStats {
+    dests: number;
+    flows: number;
+    queuedBytes: number;
+    sent: number;
+    dropped: number;
+}
+export declare class PacedForwarder {
+    #private;
+    constructor(opts: PacedForwarderOptions);
+    /** Set the paced target rate (bytes/sec) for a destination from a measured
+     *  delivered-rate estimate. */
+    setRate(dstIp: string, rateBps: number): void;
+    /** Enqueue one IP packet for `dstIp` under flow `flowKey`. Never blocks; the
+     *  drain loop releases it paced + fairly. Returns false if it was dropped
+     *  (queue overflow). */
+    enqueue(dstIp: string, flowKey: FlowKey, packet: Uint8Array): boolean;
+    stats(): PacedForwarderStats;
+}
+/** Build a stable per-flow key from the 5-tuple (direction-agnostic within a
+ *  destination — src identifies the flow, dst is the queue owner). */
+export declare function flowKeyOf(p: {
+    srcIp: string;
+    dstIp: string;
+    srcPort?: number;
+    dstPort?: number;
+    protocol: number;
+}): FlowKey;

package/dist/router/paced-forwarder.js

@@ -0,0 +1,188 @@
+//
+// Paced, fair egress forwarder for TUN → carrier IP data.
+//
+// Problem (measured): the raw path drops nothing when idle but ~90% under load
+// — classic CONGESTION. Every forwarded IP packet was fired at the carrier the
+// instant it arrived, with no pacing and no fairness. When several flows (a
+// video's many connections, an SSH session, a download) together exceed the
+// path's capacity, the network drops indiscriminately; some flows' inner TCP
+// reads that as loss and collapses into multi-second RTO backoff — the stall
+// that stutters video even at low resolution and lags SSH.
+//
+// This inserts two classic mechanisms in front of session.send:
+//
+//   1. Per-flow FAIR QUEUE (round-robin over the 5-tuple). Each flow gets its
+//      own queue; we serve them in rotation, one packet each, so no single
+//      bursty flow can starve the others. A flooding flow's own queue overflows
+//      (tail-drop) — signalling congestion to just that flow's TCP — instead of
+//      drowning everyone.
+//
+//   2. Per-destination TOKEN-BUCKET PACER. Packets are released toward a target
+//      rate instead of in bursts, so we stop overrunning the path and inducing
+//      the drops ourselves. The target rate is set externally from a delivered-
+//      rate estimate (setRate); until one is known it defaults generously so the
+//      pacer never becomes the bottleneck — the fair queue still does its work.
+//
+// Clock and scheduler are injectable so the logic is unit-testable without
+// real time.
+//
+const DEFAULT_RATE_BPS = 12_500_000; // 100 Mbps — effectively uncapped until measured
+const DEFAULT_MAX_FLOW_BYTES = 256 * 1024;
+const DEFAULT_MAX_DEST_BYTES = 4 * 1024 * 1024;
+const DEFAULT_BURST_SECONDS = 0.05; // 50ms of rate as burst — smooths without adding latency
+const MIN_RATE_BPS = 32 * 1024; // never pace below 256 kbps
+class Dest {
+    rateBps;
+    tokens;
+    lastRefillMs;
+    burstBytes;
+    flows = new Map();
+    order = []; // round-robin ring
+    cursor = 0;
+    totalBytes = 0;
+    draining = false;
+    constructor(rateBps, burstSeconds, nowMs) {
+        this.rateBps = rateBps;
+        this.burstBytes = Math.max(1500, rateBps * burstSeconds);
+        this.tokens = this.burstBytes;
+        this.lastRefillMs = nowMs;
+    }
+    refill(nowMs) {
+        const dt = nowMs - this.lastRefillMs;
+        if (dt <= 0)
+            return;
+        this.tokens = Math.min(this.burstBytes, this.tokens + (this.rateBps * dt) / 1000);
+        this.lastRefillMs = nowMs;
+    }
+    setRate(rateBps, burstSeconds) {
+        this.rateBps = Math.max(MIN_RATE_BPS, rateBps);
+        this.burstBytes = Math.max(1500, this.rateBps * burstSeconds);
+        if (this.tokens > this.burstBytes)
+            this.tokens = this.burstBytes;
+    }
+}
+export class PacedForwarder {
+    #opts;
+    #dests = new Map();
+    #sent = 0;
+    #dropped = 0;
+    constructor(opts) {
+        this.#opts = {
+            send: opts.send,
+            defaultRateBps: opts.defaultRateBps ?? DEFAULT_RATE_BPS,
+            maxFlowBytes: opts.maxFlowBytes ?? DEFAULT_MAX_FLOW_BYTES,
+            maxDestBytes: opts.maxDestBytes ?? DEFAULT_MAX_DEST_BYTES,
+            burstSeconds: opts.burstSeconds ?? DEFAULT_BURST_SECONDS,
+            now: opts.now ?? Date.now,
+            schedule: opts.schedule ?? ((fn, ms) => { setTimeout(fn, ms).unref?.(); }),
+        };
+    }
+    /** Set the paced target rate (bytes/sec) for a destination from a measured
+     *  delivered-rate estimate. */
+    setRate(dstIp, rateBps) {
+        const d = this.#dest(dstIp);
+        d.setRate(rateBps, this.#opts.burstSeconds);
+    }
+    /** Enqueue one IP packet for `dstIp` under flow `flowKey`. Never blocks; the
+     *  drain loop releases it paced + fairly. Returns false if it was dropped
+     *  (queue overflow). */
+    enqueue(dstIp, flowKey, packet) {
+        const d = this.#dest(dstIp);
+        // Backstop: shed if the whole destination is way over budget.
+        if (d.totalBytes >= this.#opts.maxDestBytes) {
+            this.#dropped++;
+            return false;
+        }
+        let f = d.flows.get(flowKey);
+        if (!f) {
+            f = { key: flowKey, packets: [], bytes: 0 };
+            d.flows.set(flowKey, f);
+            d.order.push(flowKey);
+        }
+        // Per-flow tail-drop: a flooding flow overflows its own queue, signalling
+        // congestion to just that flow's TCP without starving the others.
+        if (f.bytes + packet.length > this.#opts.maxFlowBytes) {
+            const oldest = f.packets.shift();
+            if (oldest) {
+                f.bytes -= oldest.length;
+                d.totalBytes -= oldest.length;
+                this.#dropped++;
+            }
+        }
+        f.packets.push(packet);
+        f.bytes += packet.length;
+        d.totalBytes += packet.length;
+        this.#drain(dstIp);
+        return true;
+    }
+    stats() {
+        let flows = 0, queued = 0;
+        for (const d of this.#dests.values()) {
+            flows += d.flows.size;
+            queued += d.totalBytes;
+        }
+        return { dests: this.#dests.size, flows, queuedBytes: queued, sent: this.#sent, dropped: this.#dropped };
+    }
+    #dest(dstIp) {
+        let d = this.#dests.get(dstIp);
+        if (!d) {
+            d = new Dest(this.#opts.defaultRateBps, this.#opts.burstSeconds, this.#opts.now());
+            this.#dests.set(dstIp, d);
+        }
+        return d;
+    }
+    #drain(dstIp) {
+        const d = this.#dests.get(dstIp);
+        if (!d || d.draining)
+            return;
+        d.draining = true;
+        this.#pump(dstIp, d);
+    }
+    #pump(dstIp, d) {
+        d.draining = false;
+        const now = this.#opts.now();
+        d.refill(now);
+        // Round-robin across flows: emit one packet from the next non-empty flow
+        // each step, spending tokens; stop when out of tokens or all queues empty.
+        let guard = 0;
+        while (d.order.length > 0) {
+            if (++guard > 100_000)
+                break; // safety
+            const key = d.order[d.cursor % d.order.length];
+            const f = d.flows.get(key);
+            if (!f || f.packets.length === 0) {
+                // Drop this flow from the ring.
+                d.order.splice(d.cursor % d.order.length, 1);
+                if (f && f.packets.length === 0)
+                    d.flows.delete(key);
+                if (d.order.length === 0)
+                    break;
+                if (d.cursor >= d.order.length)
+                    d.cursor = 0;
+                continue;
+            }
+            const size = f.packets[0].length;
+            if (d.tokens < size) {
+                // Out of tokens — resume when enough have refilled.
+                const need = size - d.tokens;
+                const ms = Math.max(1, Math.ceil((need / d.rateBps) * 1000));
+                d.draining = true;
+                this.#opts.schedule(() => this.#pump(dstIp, d), ms);
+                return;
+            }
+            // Emit one packet from this flow, then advance the cursor (fairness).
+            const pkt = f.packets.shift();
+            f.bytes -= size;
+            d.totalBytes -= size;
+            d.tokens -= size;
+            this.#sent++;
+            void this.#opts.send(dstIp, pkt).catch(() => { this.#dropped++; });
+            d.cursor = (d.cursor + 1) % Math.max(1, d.order.length);
+        }
+    }
+}
+/** Build a stable per-flow key from the 5-tuple (direction-agnostic within a
+ *  destination — src identifies the flow, dst is the queue owner). */
+export function flowKeyOf(p) {
+    return `${p.protocol}|${p.srcIp}:${p.srcPort ?? 0}|${p.dstIp}:${p.dstPort ?? 0}`;
+}

package/dist/router/packet-router.d.ts

@@ -16,6 +16,10 @@ export interface PacketRouterOptions {
     peerManager: PeerManager;
     ipam: Ipam;
     acl: AclEngine;
+    /** Pace + fair-queue egress IP data (default true). Under load this prevents
+     *  one bursty flow from congestion-collapsing others. Set false to fire every
+     *  packet immediately (the old behavior). */
+    pacedForwarding?: boolean;
 }
 export declare class PacketRouter extends EventEmitter {
     private tunDevice;
@@ -23,6 +27,10 @@ export declare class PacketRouter extends EventEmitter {
     private ipam;
     private acl;
     private sessionManager;
+    private pacer;
+    /** Inbound IP bytes received per source peer since the last rate report. */
+    private inboundBytes;
+    private rateReportTimer?;
     private logger;
     private isRunning;
     private listenedSessions;
@@ -37,6 +45,8 @@ export declare class PacketRouter extends EventEmitter {
     private loggedDropTuples;
     constructor(opts: PacketRouterOptions);
     start(): Promise<void>;
+    /** Emit one delivered-rate report per peer with meaningful inbound this tick. */
+    private sendRateReports;
     stop(): Promise<void>;
     /**
      * Swap the active TUN device. Used when dora's background retry

package/dist/router/packet-router.js

@@ -8,14 +8,28 @@
 import { EventEmitter } from "events";
 import { IpParser } from "./ip-parser.js";
 import { SessionManager } from "./session-manager.js";
+import { PacedForwarder, flowKeyOf } from "./paced-forwarder.js";
 import { Logger } from "../utils/logger.js";
 const SUBNET_PREFIX = "10.86.";
+// How often each node reports the delivered rate of a peer's inbound flow.
+const RATE_REPORT_INTERVAL_MS = 1000;
+// Only report for peers whose inbound this interval exceeds this — no point
+// pacing a trickle (SSH/keepalives), and it keeps reports sparse.
+const RATE_REPORT_MIN_BYTES = 32 * 1024; // ~256 kbps sustained
+// The sender paces to measured × headroom so throughput can still probe upward
+// when the path frees up; loss caps it back down via the next report.
+const RATE_REPORT_HEADROOM = 1.25;
+const RATE_REPORT_MIN_BPS = 64 * 1024;
 export class PacketRouter extends EventEmitter {
     tunDevice;
     peerManager;
     ipam;
     acl;
     sessionManager;
+    pacer = null;
+    /** Inbound IP bytes received per source peer since the last rate report. */
+    inboundBytes = new Map();
+    rateReportTimer;
     logger;
     isRunning = false;
     listenedSessions = new WeakSet();
@@ -45,6 +59,29 @@ export class PacketRouter extends EventEmitter {
             ipam: opts.ipam,
         });
         this.logger = new Logger({ prefix: "PacketRouter" });
+        if (opts.pacedForwarding !== false) {
+            // The pacer's send callback resolves the (cached) session for the dest at
+            // release time and hands it the packet. A rejected send counts as a drop.
+            this.pacer = new PacedForwarder({
+                send: async (dstIp, pkt) => {
+                    const s = await this.sessionManager.getOrOpenSession(dstIp);
+                    if (!s)
+                        throw new Error("no session");
+                    await s.send(pkt);
+                    this.stats.packetsForwarded++;
+                },
+            });
+            // A peer's rate report tells us how fast our traffic to them is actually
+            // landing — pace our sends to their vIP toward it (with a little headroom
+            // so throughput can still climb when capacity frees up).
+            this.peerManager.on("rate-report", (pubkey, bytesPerSec) => {
+                const mapping = this.ipam.resolveCarrierId(pubkey);
+                if (!mapping?.virtualIp || !this.pacer)
+                    return;
+                const target = Math.max(RATE_REPORT_MIN_BPS, bytesPerSec * RATE_REPORT_HEADROOM);
+                this.pacer.setRate(mapping.virtualIp, target);
+            });
+        }
         this.setupCarrierHandlers();
     }
     async start() {
@@ -78,8 +115,28 @@ export class PacketRouter extends EventEmitter {
         this.keepaliveTimer = setInterval(() => {
             this.sendKeepalivesToActiveSessions();
         }, 10000);
+        // Periodic delivered-rate reports: tell each peer how fast their inbound IP
+        // flow is actually landing here, so their pacer can size to it.
+        if (this.pacer) {
+            this.rateReportTimer = setInterval(() => {
+                this.sendRateReports();
+            }, RATE_REPORT_INTERVAL_MS);
+            this.rateReportTimer.unref?.();
+        }
         this.logger.info("Packet router started");
     }
+    /** Emit one delivered-rate report per peer with meaningful inbound this tick. */
+    sendRateReports() {
+        if (this.inboundBytes.size === 0)
+            return;
+        const perSec = 1000 / RATE_REPORT_INTERVAL_MS;
+        for (const [pubkey, bytes] of this.inboundBytes) {
+            if (bytes >= RATE_REPORT_MIN_BYTES) {
+                void this.peerManager.sendRateReport(pubkey, bytes * perSec);
+            }
+        }
+        this.inboundBytes.clear();
+    }
     async stop() {
         if (!this.isRunning)
             return;
@@ -89,6 +146,10 @@ export class PacketRouter extends EventEmitter {
             clearInterval(this.keepaliveTimer);
             this.keepaliveTimer = undefined;
         }
+        if (this.rateReportTimer) {
+            clearInterval(this.rateReportTimer);
+            this.rateReportTimer = undefined;
+        }
         await this.tunDevice.stopReadLoop();
         this.sessionManager.closeAll();
         this.logger.info("Packet router stopped");
@@ -260,7 +321,14 @@ export class PacketRouter extends EventEmitter {
             this.recordDrop(parsed.dstIp, reason);
             return;
         }
-        // Send packet
+        // Send packet. With pacing on, enqueue into the per-flow fair queue and
+        // return immediately (the pacer releases it toward the target rate without
+        // one flow starving another under load); the send itself happens in the
+        // pacer's drain. Without pacing, fire it straight at the session (old path).
+        if (this.pacer) {
+            this.pacer.enqueue(parsed.dstIp, flowKeyOf(parsed), packet);
+            return;
+        }
         try {
             await session.send(packet);
             this.stats.packetsForwarded++;
@@ -332,6 +400,11 @@ export class PacketRouter extends EventEmitter {
         try {
             await this.tunDevice.write(packet);
             this.stats.packetsReceived++;
+            // Accumulate delivered bytes from this peer so the periodic rate report
+            // can tell them how fast their traffic is actually landing here — the
+            // signal their pacer uses to size its token bucket.
+            if (this.pacer)
+                this.inboundBytes.set(srcPubkey, (this.inboundBytes.get(srcPubkey) ?? 0) + packet.length);
             this.logger.debug(`Received ${proto} ${parsed.srcIp}:${parsed.srcPort || "-"} -> ${parsed.dstIp}:${parsed.dstPort || "-"} (${packet.length} bytes)`);
         }
         catch (err) {

package/dist/types.d.ts

@@ -186,6 +186,13 @@ export interface DecentAgentNetConfig {
     proxy?: ProxyConfig;
     friends?: FriendsConfig;
     dora?: DoraConfig;
+    forwarding?: ForwardingConfig;
+}
+export interface ForwardingConfig {
+    /** Pace + fair-queue egress IP data (default true). Prevents one bursty flow
+     *  from congestion-collapsing others under load. Set false for the old
+     *  fire-every-packet-immediately behavior. */
+    paced?: boolean;
 }
 export interface PacketSessionInfo {
     peerId: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decentnetwork/lan",
-  "version": "0.1.138",
+  "version": "0.1.140",
   "description": "Private virtual LAN for self-hosted services and AI agents, built on Elastos Carrier. NAT-traversal, name service, ACL, all over a peer-to-peer mesh — no public IP required.",
   "type": "module",
   "main": "./dist/index.js",
@@ -79,15 +79,17 @@
   },
   "dependencies": {
     "@decentnetwork/dora": "^0.1.11",
-    "@decentnetwork/peer": "^0.1.71",
+    "@decentnetwork/peer": "^0.1.73",
     "ink": "^5.2.1",
     "js-yaml": "^4.1.0",
+    "node-forge": "^1.4.0",
     "react": "^18.3.1",
     "yargs": "^17.7.2"
   },
   "devDependencies": {
     "@types/js-yaml": "^4.0.9",
     "@types/node": "^20.12.12",
+    "@types/node-forge": "^1.3.14",
     "@types/yargs": "^17.0.35",
     "@typescript-eslint/eslint-plugin": "^7.10.0",
     "@typescript-eslint/parser": "^7.10.0",