@hivemind-os/collective-relay 0.2.0

package/dist/index.js

@@ -0,0 +1,1859 @@
+// src/index.ts
+import { pathToFileURL } from "url";
+
+// src/config.ts
+import { homedir } from "os";
+import { join, resolve } from "path";
+function getDefaultRelayConfig(baseDir = resolve(homedir(), ".hivemind-os/collective", "relay")) {
+  return {
+    host: "0.0.0.0",
+    port: 8080,
+    identity: {
+      keyPath: join(baseDir, "identity.key")
+    },
+    fees: {
+      basePercentage: 5,
+      minimumMist: 1000n
+    },
+    limits: {
+      maxConnections: 1e3,
+      maxRequestsPerSecond: 100,
+      taskTimeoutMs: 3e4,
+      heartbeatIntervalMs: 1e4,
+      heartbeatTimeoutMs: 3e4,
+      authNonceTtlMs: 5 * 6e4
+    },
+    cors: {
+      allowedOrigins: []
+    }
+  };
+}
+function loadRelayConfig(overrides = {}) {
+  const dataDir = process.env.COLLECTIVE_RELAY_DATA_DIR ? resolve(process.env.COLLECTIVE_RELAY_DATA_DIR) : void 0;
+  const defaults = getDefaultRelayConfig(dataDir);
+  const config = {
+    host: process.env.COLLECTIVE_RELAY_HOST ?? overrides.host ?? defaults.host,
+    port: readNumber(process.env.COLLECTIVE_RELAY_PORT) ?? overrides.port ?? defaults.port,
+    identity: {
+      keyPath: resolve(overrides.identity?.keyPath ?? process.env.COLLECTIVE_RELAY_KEY_PATH ?? defaults.identity.keyPath)
+    },
+    fees: {
+      basePercentage: readNumber(process.env.COLLECTIVE_RELAY_FEE_PERCENT) ?? overrides.fees?.basePercentage ?? defaults.fees.basePercentage,
+      minimumMist: readBigInt(process.env.COLLECTIVE_RELAY_MINIMUM_MIST) ?? overrides.fees?.minimumMist ?? defaults.fees.minimumMist
+    },
+    limits: {
+      maxConnections: readNumber(process.env.COLLECTIVE_RELAY_MAX_CONNECTIONS) ?? overrides.limits?.maxConnections ?? defaults.limits.maxConnections,
+      maxRequestsPerSecond: readNumber(process.env.COLLECTIVE_RELAY_MAX_RPS) ?? overrides.limits?.maxRequestsPerSecond ?? defaults.limits.maxRequestsPerSecond,
+      taskTimeoutMs: readNumber(process.env.COLLECTIVE_RELAY_TASK_TIMEOUT_MS) ?? overrides.limits?.taskTimeoutMs ?? defaults.limits.taskTimeoutMs,
+      heartbeatIntervalMs: readNumber(process.env.COLLECTIVE_RELAY_HEARTBEAT_INTERVAL_MS) ?? overrides.limits?.heartbeatIntervalMs ?? defaults.limits.heartbeatIntervalMs,
+      heartbeatTimeoutMs: readNumber(process.env.COLLECTIVE_RELAY_HEARTBEAT_TIMEOUT_MS) ?? overrides.limits?.heartbeatTimeoutMs ?? defaults.limits.heartbeatTimeoutMs,
+      authNonceTtlMs: readNumber(process.env.COLLECTIVE_RELAY_AUTH_NONCE_TTL_MS) ?? overrides.limits?.authNonceTtlMs ?? defaults.limits.authNonceTtlMs
+    },
+    cors: {
+      allowedOrigins: overrides.cors?.allowedOrigins ?? readStringList(process.env.COLLECTIVE_RELAY_ALLOWED_ORIGINS) ?? defaults.cors?.allowedOrigins ?? []
+    },
+    sui: overrides.sui || process.env.COLLECTIVE_RELAY_SUI_RPC_URL || process.env.COLLECTIVE_RELAY_SUI_PACKAGE_ID ? {
+      rpcUrl: overrides.sui?.rpcUrl ?? process.env.COLLECTIVE_RELAY_SUI_RPC_URL ?? "",
+      packageId: overrides.sui?.packageId ?? process.env.COLLECTIVE_RELAY_SUI_PACKAGE_ID ?? ""
+    } : void 0,
+    relayRegistry: overrides.relayRegistry || process.env.COLLECTIVE_RELAY_REGISTRY_ENABLED || process.env.COLLECTIVE_RELAY_REGISTRY_STAKE_ID || process.env.COLLECTIVE_RELAY_REGISTRY_RELAY_ID ? {
+      enabled: readBoolean(process.env.COLLECTIVE_RELAY_REGISTRY_ENABLED) ?? overrides.relayRegistry?.enabled ?? true,
+      relayId: overrides.relayRegistry?.relayId ?? process.env.COLLECTIVE_RELAY_REGISTRY_RELAY_ID,
+      stakePositionId: overrides.relayRegistry?.stakePositionId ?? process.env.COLLECTIVE_RELAY_REGISTRY_STAKE_ID,
+      endpoint: overrides.relayRegistry?.endpoint ?? process.env.COLLECTIVE_RELAY_REGISTRY_ENDPOINT,
+      capabilities: overrides.relayRegistry?.capabilities ?? readStringList(process.env.COLLECTIVE_RELAY_REGISTRY_CAPABILITIES) ?? [],
+      region: overrides.relayRegistry?.region ?? process.env.COLLECTIVE_RELAY_REGISTRY_REGION,
+      routingFeeBps: readNumber(process.env.COLLECTIVE_RELAY_REGISTRY_FEE_BPS) ?? overrides.relayRegistry?.routingFeeBps,
+      heartbeatIntervalMs: readNumber(process.env.COLLECTIVE_RELAY_REGISTRY_HEARTBEAT_INTERVAL_MS) ?? overrides.relayRegistry?.heartbeatIntervalMs ?? defaults.limits.heartbeatIntervalMs
+    } : void 0
+  };
+  validateRelayConfig(config);
+  return config;
+}
+function validateRelayConfig(config) {
+  if (!config.host) {
+    throw new Error("Relay host is required.");
+  }
+  if (!Number.isInteger(config.port) || config.port <= 0) {
+    throw new Error("Relay port must be a positive integer.");
+  }
+  if (!config.identity.keyPath) {
+    throw new Error("Relay identity keyPath is required.");
+  }
+  if (config.fees.basePercentage < 0) {
+    throw new Error("Relay base fee percentage must be non-negative.");
+  }
+  if (config.fees.minimumMist < 0n) {
+    throw new Error("Relay minimum fee must be non-negative.");
+  }
+  for (const [name, value] of Object.entries(config.limits)) {
+    if (!Number.isInteger(value) || value <= 0) {
+      throw new Error(`Relay limit ${name} must be a positive integer.`);
+    }
+  }
+  if (config.cors && config.cors.allowedOrigins.some((origin) => origin.trim().length === 0)) {
+    throw new Error("Relay CORS allowed origins must be non-empty strings.");
+  }
+  if (!config.relayRegistry || config.relayRegistry.enabled === false) {
+    return;
+  }
+  if (!config.sui?.rpcUrl || !config.sui.packageId) {
+    throw new Error("Relay registry integration requires sui.rpcUrl and sui.packageId.");
+  }
+  if (config.relayRegistry.stakePositionId && !/^0x[0-9a-f]+$/i.test(config.relayRegistry.stakePositionId)) {
+    throw new Error("Relay registry stakePositionId must be a 0x-prefixed object id.");
+  }
+  if (config.relayRegistry.relayId && !/^0x[0-9a-f]+$/i.test(config.relayRegistry.relayId)) {
+    throw new Error("Relay registry relayId must be a 0x-prefixed object id.");
+  }
+  if (config.relayRegistry.routingFeeBps !== void 0) {
+    if (!Number.isInteger(config.relayRegistry.routingFeeBps) || config.relayRegistry.routingFeeBps < 0 || config.relayRegistry.routingFeeBps > 1e4) {
+      throw new Error("Relay registry routingFeeBps must be an integer between 0 and 10000.");
+    }
+  }
+  if (!Number.isInteger(config.relayRegistry.heartbeatIntervalMs) || config.relayRegistry.heartbeatIntervalMs <= 0) {
+    throw new Error("Relay registry heartbeat interval must be a positive integer.");
+  }
+}
+function readNumber(value) {
+  if (!value) {
+    return void 0;
+  }
+  const parsed = Number(value);
+  return Number.isFinite(parsed) ? parsed : void 0;
+}
+function readBigInt(value) {
+  if (!value) {
+    return void 0;
+  }
+  return /^\d+$/.test(value.trim()) ? BigInt(value.trim()) : void 0;
+}
+function readBoolean(value) {
+  if (!value) {
+    return void 0;
+  }
+  const normalized = value.trim().toLowerCase();
+  if (normalized === "true" || normalized === "1" || normalized === "yes") {
+    return true;
+  }
+  if (normalized === "false" || normalized === "0" || normalized === "no") {
+    return false;
+  }
+  return void 0;
+}
+function readStringList(value) {
+  if (!value) {
+    return void 0;
+  }
+  const parsed = value.split(",").map((entry) => entry.trim()).filter(Boolean);
+  return parsed.length > 0 ? parsed : void 0;
+}
+
+// src/server/http-server.ts
+import cors from "@fastify/cors";
+import rateLimit from "@fastify/rate-limit";
+import websocket from "@fastify/websocket";
+import Fastify from "fastify";
+import WebSocket from "ws";
+
+// src/health/monitor.ts
+var HealthMonitor = class {
+  constructor(options = {}) {
+    this.options = options;
+    this.now = options.now ?? (() => Date.now());
+    this.startedAt = this.now();
+  }
+  options;
+  now;
+  startedAt;
+  activeRequests = 0;
+  connectedProviders = 0;
+  totalRequestsServed = 0;
+  totalLatencyMs = 0;
+  setConnectedProviders(count) {
+    this.connectedProviders = count;
+  }
+  beginRequest() {
+    const startedAt = this.now();
+    let finished = false;
+    this.activeRequests += 1;
+    return {
+      finish: () => {
+        if (finished) {
+          return;
+        }
+        finished = true;
+        this.activeRequests -= 1;
+        this.totalRequestsServed += 1;
+        this.totalLatencyMs += this.now() - startedAt;
+      }
+    };
+  }
+  recordRequest(latencyMs) {
+    this.totalRequestsServed += 1;
+    this.totalLatencyMs += latencyMs;
+  }
+  getStatus() {
+    const connectedProviders = this.options.getConnectedProviders?.() ?? this.connectedProviders;
+    let status = "healthy";
+    if (connectedProviders === 0 && this.activeRequests > 0) {
+      status = "unhealthy";
+    } else if (connectedProviders === 0) {
+      status = "degraded";
+    }
+    return {
+      status,
+      uptime: this.now() - this.startedAt,
+      connectedProviders,
+      activeRequests: this.activeRequests,
+      totalRequestsServed: this.totalRequestsServed,
+      averageLatencyMs: this.totalRequestsServed === 0 ? 0 : Math.round(this.totalLatencyMs / this.totalRequestsServed)
+    };
+  }
+};
+
+// src/identity/relay-identity.ts
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { dirname, resolve as resolve2 } from "path";
+import { createDID, generateKeypair, keypairFromSecretKey, signString } from "@hivemind-os/collective-core";
+var RelayIdentity = class _RelayIdentity {
+  constructor(keyPath, keypair) {
+    this.keyPath = keyPath;
+    this.keypair = keypair;
+    this.did = createDID(keypair.publicKey);
+  }
+  keyPath;
+  keypair;
+  did;
+  static load(keyPath) {
+    const resolvedKeyPath = resolve2(keyPath);
+    mkdirSync(dirname(resolvedKeyPath), { recursive: true, mode: 448 });
+    if (existsSync(resolvedKeyPath)) {
+      chmodSync(resolvedKeyPath, 384);
+      const secretKey = Uint8Array.from(Buffer.from(readFileSync(resolvedKeyPath, "utf8").trim(), "hex"));
+      return new _RelayIdentity(resolvedKeyPath, keypairFromSecretKey(secretKey));
+    }
+    const keypair = generateKeypair();
+    writeFileSync(resolvedKeyPath, Buffer.from(keypair.secretKey).toString("hex"), { mode: 384 });
+    chmodSync(resolvedKeyPath, 384);
+    return new _RelayIdentity(resolvedKeyPath, keypair);
+  }
+  signPayload(payload) {
+    return signString(payload, this.keypair.secretKey);
+  }
+};
+
+// src/payment/payment-gate.ts
+import { randomUUID } from "crypto";
+import {
+  decodeRelaySuiPaymentProof,
+  verifyRelaySuiPaymentProof,
+  USDC_ADDRESS
+} from "@hivemind-os/collective-core";
+import { PaymentRail } from "@hivemind-os/collective-types";
+import {
+  decodePaymentSignatureHeader,
+  encodePaymentRequiredHeader,
+  encodePaymentResponseHeader
+} from "@x402/core/http";
+import { PERMIT2_ADDRESS, permit2WitnessTypes, x402ExactPermit2ProxyAddress } from "@x402/evm";
+import { getAddress, verifyTypedData } from "viem";
+
+// src/payment/fee-schedule.ts
+function calculateRelayFee(basePrice, feeSchedule) {
+  const computed = basePrice * BigInt(feeSchedule.basePercentage) / 100n;
+  const relayFee = computed > feeSchedule.minimumMist ? computed : feeSchedule.minimumMist;
+  return {
+    relayFee,
+    totalPrice: basePrice + relayFee
+  };
+}
+
+// src/payment/payment-gate.ts
+var DEFAULT_X402_NETWORK = "base-sepolia";
+var DEFAULT_EVM_PAYMENT_ADDRESS = "0x0000000000000000000000000000000000000abc";
+var PaymentGate = class {
+  constructor(options) {
+    this.options = options;
+    this.now = options.now ?? (() => Date.now());
+    this.nonceFactory = options.nonceFactory ?? (() => randomUUID());
+    this.basePriceResolver = options.basePriceResolver ?? (() => 0n);
+    this.defaultRail = options.defaultRail ?? PaymentRail.SUI_TRANSFER;
+  }
+  options;
+  activeChallenges = /* @__PURE__ */ new Map();
+  consumedProofs = /* @__PURE__ */ new Map();
+  now;
+  nonceFactory;
+  basePriceResolver;
+  defaultRail;
+  generate402Challenge(rail, capability, provider) {
+    const basePrice = this.basePriceResolver(capability, provider);
+    const fee = this.calculateFee(basePrice);
+    const nonce = this.nonceFactory();
+    const expiresAt = this.now() + (this.options.challengeTtlMs ?? 6e4);
+    const challenge = rail === PaymentRail.X402_BASE ? this.createX402Challenge(fee, nonce, expiresAt) : this.createSuiChallenge(rail, fee, nonce, expiresAt);
+    this.activeChallenges.set(challenge.nonce, challenge);
+    return challenge;
+  }
+  getChallenge(nonce) {
+    return this.activeChallenges.get(nonce) ?? null;
+  }
+  isChallengeExpired(challenge) {
+    return challenge.expiresAt <= this.now();
+  }
+  async verifyPayment(paymentHeader, challenge) {
+    this.pruneConsumedProofs();
+    if (!this.activeChallenges.has(challenge.nonce)) {
+      return {
+        accepted: false,
+        reason: "Unknown payment challenge."
+      };
+    }
+    if (this.isChallengeExpired(challenge)) {
+      this.activeChallenges.delete(challenge.nonce);
+      return {
+        accepted: false,
+        reason: "Payment challenge expired."
+      };
+    }
+    const replayMetadata = getPaymentReplayMetadata(paymentHeader, challenge);
+    if (replayMetadata && this.consumedProofs.has(replayMetadata.key)) {
+      return {
+        accepted: false,
+        reason: "Payment proof has already been used."
+      };
+    }
+    const verifier = this.options.verifyPaymentProof;
+    const verification = verifier ? await verifier(paymentHeader, challenge) : await this.verifyChallenge(paymentHeader, challenge);
+    if (verification.accepted) {
+      this.activeChallenges.delete(challenge.nonce);
+      if (replayMetadata) {
+        this.consumedProofs.set(replayMetadata.key, replayMetadata.expiresAt);
+      }
+    }
+    return verification;
+  }
+  calculateFee(basePrice) {
+    return calculateRelayFee(basePrice, this.options.feeSchedule);
+  }
+  pruneExpiredChallenges() {
+    this.pruneConsumedProofs();
+    let removed = 0;
+    for (const challenge of this.activeChallenges.values()) {
+      if (!this.isChallengeExpired(challenge)) {
+        continue;
+      }
+      this.activeChallenges.delete(challenge.nonce);
+      removed += 1;
+    }
+    return removed;
+  }
+  pruneConsumedProofs() {
+    const now = this.now();
+    for (const [replayKey, expiresAt] of this.consumedProofs.entries()) {
+      if (expiresAt > now) {
+        continue;
+      }
+      this.consumedProofs.delete(replayKey);
+    }
+  }
+  createSuiChallenge(rail, fee, nonce, expiresAt) {
+    return {
+      rail,
+      paymentAddress: this.options.paymentAddress ?? this.options.relayDid,
+      amount: fee.totalPrice.toString(),
+      currency: "MIST",
+      network: "sui",
+      relayFee: fee.relayFee.toString(),
+      expiresAt,
+      nonce
+    };
+  }
+  createX402Challenge(fee, nonce, expiresAt) {
+    const network = DEFAULT_X402_NETWORK;
+    const asset = USDC_ADDRESS[network];
+    const paymentAddress = this.options.evmPaymentAddress ?? DEFAULT_EVM_PAYMENT_ADDRESS;
+    const paymentRequiredHeader = encodePaymentRequiredHeader({
+      x402Version: 2,
+      resource: { url: "https://relay.hivemind-collective.local/execute" },
+      accepts: [
+        {
+          scheme: "exact",
+          network: toCaip2Network(network),
+          asset,
+          amount: fee.totalPrice.toString(),
+          payTo: paymentAddress,
+          maxTimeoutSeconds: Math.max(1, Math.ceil((expiresAt - this.now()) / 1e3)),
+          extra: {
+            assetTransferMethod: "permit2",
+            currency: "USDC",
+            nonce,
+            expiresAt: String(expiresAt)
+          }
+        }
+      ]
+    });
+    return {
+      rail: PaymentRail.X402_BASE,
+      paymentAddress,
+      amount: fee.totalPrice.toString(),
+      currency: "USDC",
+      network,
+      relayFee: fee.relayFee.toString(),
+      expiresAt,
+      nonce,
+      asset,
+      extra: {
+        assetTransferMethod: "permit2",
+        currency: "USDC",
+        nonce,
+        expiresAt: String(expiresAt),
+        "payment-required": paymentRequiredHeader
+      }
+    };
+  }
+  async verifyChallenge(paymentHeader, challenge) {
+    switch (challenge.rail) {
+      case PaymentRail.X402_BASE:
+        return verifyX402Payment(paymentHeader, challenge);
+      case PaymentRail.SUI_TRANSFER:
+      case PaymentRail.SUI_ESCROW:
+        return verifySuiPayment(paymentHeader, challenge);
+      default:
+        return {
+          accepted: false,
+          reason: `Unsupported payment rail: ${String(challenge.rail)}`
+        };
+    }
+  }
+};
+async function verifyX402Payment(paymentHeader, challenge) {
+  try {
+    const payment = decodePaymentSignatureHeader(paymentHeader);
+    const accepted = payment.accepted;
+    if (accepted.scheme !== "exact" || accepted.amount !== challenge.amount || normalizeNetwork(accepted.network) !== normalizeNetwork(toCaip2Network(challenge.network)) || getAddress(accepted.payTo) !== getAddress(challenge.paymentAddress) || challenge.asset && getAddress(accepted.asset) !== getAddress(challenge.asset)) {
+      return {
+        accepted: false,
+        reason: "x402 payment requirements did not match the relay challenge."
+      };
+    }
+    if (!hasPermit2Authorization(payment.payload)) {
+      return {
+        accepted: false,
+        reason: "Only Permit2 x402 payments are currently supported by the relay."
+      };
+    }
+    const authorization = payment.payload.permit2Authorization;
+    const verified = await verifyTypedData({
+      address: getAddress(authorization.from),
+      domain: {
+        name: "Permit2",
+        chainId: toChainId(challenge.network),
+        verifyingContract: PERMIT2_ADDRESS
+      },
+      types: permit2WitnessTypes,
+      primaryType: "PermitWitnessTransferFrom",
+      message: {
+        permitted: {
+          token: getAddress(authorization.permitted.token),
+          amount: BigInt(authorization.permitted.amount)
+        },
+        spender: getAddress(authorization.spender),
+        nonce: BigInt(authorization.nonce),
+        deadline: BigInt(authorization.deadline),
+        witness: {
+          to: getAddress(authorization.witness.to),
+          validAfter: BigInt(authorization.witness.validAfter)
+        }
+      },
+      signature: payment.payload.signature
+    });
+    const deadlineMs = deadlineToTimestampMs(authorization.deadline);
+    if (!verified || getAddress(authorization.witness.to) !== getAddress(challenge.paymentAddress) || getAddress(authorization.permitted.token) !== getAddress(challenge.asset ?? authorization.permitted.token) || authorization.permitted.amount !== challenge.amount || getAddress(authorization.spender) !== getAddress(x402ExactPermit2ProxyAddress) || deadlineMs === null || deadlineMs > challenge.expiresAt + 1e3) {
+      return {
+        accepted: false,
+        reason: "x402 payment signature verification failed."
+      };
+    }
+    return {
+      accepted: true,
+      payer: authorization.from,
+      settlementReference: encodePaymentResponseHeader({
+        success: true,
+        transaction: `x402-${challenge.nonce}`,
+        network: toCaip2Network(challenge.network),
+        amount: challenge.amount,
+        payer: authorization.from
+      }),
+      relayFee: challenge.relayFee,
+      totalPrice: challenge.amount
+    };
+  } catch (error) {
+    return {
+      accepted: false,
+      reason: error instanceof Error ? error.message : "x402 payment verification failed."
+    };
+  }
+}
+async function verifySuiPayment(paymentHeader, challenge) {
+  try {
+    const proof = decodeRelaySuiPaymentProof(paymentHeader);
+    if (proof.amount !== challenge.amount || proof.nonce !== challenge.nonce || proof.currency !== challenge.currency || proof.network !== challenge.network || proof.paymentAddress !== challenge.paymentAddress || proof.expiresAt !== challenge.expiresAt) {
+      return {
+        accepted: false,
+        reason: "Sui payment proof did not match the relay challenge."
+      };
+    }
+    if (!verifyRelaySuiPaymentProof(proof)) {
+      return {
+        accepted: false,
+        reason: "Sui payment proof signature verification failed."
+      };
+    }
+    return {
+      accepted: true,
+      payer: proof.payerAddress,
+      settlementReference: JSON.stringify({
+        rail: challenge.rail,
+        nonce: challenge.nonce,
+        payerDid: proof.payerDid,
+        payerAddress: proof.payerAddress
+      }),
+      relayFee: challenge.relayFee,
+      totalPrice: challenge.amount
+    };
+  } catch (error) {
+    return {
+      accepted: false,
+      reason: error instanceof Error ? error.message : "Sui payment proof verification failed."
+    };
+  }
+}
+function hasPermit2Authorization(value) {
+  if (!value || typeof value !== "object") {
+    return false;
+  }
+  const candidate = value;
+  const authorization = candidate.permit2Authorization;
+  return Boolean(
+    typeof candidate.signature === "string" && authorization && typeof authorization.from === "string" && typeof authorization.spender === "string" && typeof authorization.nonce === "string" && typeof authorization.deadline === "string" && typeof authorization.witness === "object" && typeof authorization.permitted === "object"
+  );
+}
+function getPaymentReplayMetadata(paymentHeader, challenge) {
+  try {
+    switch (challenge.rail) {
+      case PaymentRail.X402_BASE: {
+        const payment = decodePaymentSignatureHeader(paymentHeader);
+        if (!hasPermit2Authorization(payment.payload)) {
+          return null;
+        }
+        const expiresAt = deadlineToTimestampMs(payment.payload.permit2Authorization.deadline) ?? challenge.expiresAt;
+        return {
+          key: `x402:${payment.payload.signature}`,
+          expiresAt
+        };
+      }
+      case PaymentRail.SUI_TRANSFER:
+      case PaymentRail.SUI_ESCROW: {
+        const proof = decodeRelaySuiPaymentProof(paymentHeader);
+        return {
+          key: `sui:${proof.signature}`,
+          expiresAt: proof.expiresAt
+        };
+      }
+      default:
+        return null;
+    }
+  } catch {
+    return null;
+  }
+}
+function deadlineToTimestampMs(deadlineSeconds) {
+  if (!/^\d+$/.test(deadlineSeconds)) {
+    return null;
+  }
+  const deadlineMs = BigInt(deadlineSeconds) * 1000n;
+  if (deadlineMs > BigInt(Number.MAX_SAFE_INTEGER)) {
+    return null;
+  }
+  return Number(deadlineMs);
+}
+function normalizeNetwork(network) {
+  return network.trim().toLowerCase();
+}
+function toChainId(network) {
+  switch (normalizeNetwork(network)) {
+    case "base":
+      return 8453;
+    case "base-sepolia":
+      return 84532;
+    case "localhost":
+      return 31337;
+    default:
+      throw new Error(`Unsupported x402 network: ${network}`);
+  }
+}
+function toCaip2Network(network) {
+  return `eip155:${toChainId(network)}`;
+}
+
+// src/registry/relay-registry-service.ts
+import { Ed25519Keypair } from "@mysten/sui/keypairs/ed25519";
+import { MeshSuiClient, RelayNodeStatus, RelayRegistryClient } from "@hivemind-os/collective-core";
+var RelayRegistryService = class {
+  constructor(config, identity, client) {
+    this.config = config;
+    this.identity = identity;
+    this.enabled = Boolean(config.relayRegistry?.enabled && config.sui?.rpcUrl && config.sui.packageId && config.relayRegistry.stakePositionId);
+    this.signer = Ed25519Keypair.fromSecretKey(identity.keypair.secretKey);
+    this.client = client ?? (this.enabled ? new RelayRegistryClient(createRelaySuiClient(config), { packageId: config.sui?.packageId ?? "" }) : void 0);
+    this.state = {
+      enabled: this.enabled,
+      registered: false,
+      capabilities: config.relayRegistry?.capabilities ?? [],
+      region: config.relayRegistry?.region,
+      stakePositionId: config.relayRegistry?.stakePositionId,
+      endpoint: config.relayRegistry?.endpoint,
+      routingFeeBps: config.relayRegistry?.routingFeeBps
+    };
+  }
+  config;
+  identity;
+  enabled;
+  signer;
+  client;
+  heartbeatTimer;
+  state;
+  async start(serverAddress) {
+    if (!this.enabled || !this.client || !this.config.relayRegistry?.stakePositionId) {
+      return;
+    }
+    const endpoint = resolveRelayEndpoint(this.config, serverAddress);
+    this.state.endpoint = endpoint;
+    this.state.capabilities = this.config.relayRegistry.capabilities;
+    this.state.region = this.config.relayRegistry.region;
+    this.state.stakePositionId = this.config.relayRegistry.stakePositionId;
+    this.state.routingFeeBps = resolveRoutingFeeBps(this.config);
+    this.state.operator = this.signer.getPublicKey().toSuiAddress();
+    try {
+      const existing = await this.resolveExistingRelay(endpoint);
+      if (existing) {
+        this.applyRelay(existing);
+      } else {
+        const registered = await this.client.registerRelay({
+          endpoint,
+          stakeId: this.config.relayRegistry.stakePositionId,
+          capabilities: this.config.relayRegistry.capabilities,
+          region: this.config.relayRegistry.region ?? "global",
+          routingFeeBps: resolveRoutingFeeBps(this.config),
+          signer: this.signer
+        });
+        await this.refreshRelay(registered.relayId);
+      }
+      await this.sendHeartbeat();
+      this.heartbeatTimer = setInterval(() => {
+        void this.sendHeartbeat();
+      }, this.config.relayRegistry.heartbeatIntervalMs);
+    } catch (error) {
+      this.state.lastError = error instanceof Error ? error.message : String(error);
+    }
+  }
+  async stop() {
+    if (this.heartbeatTimer) {
+      clearInterval(this.heartbeatTimer);
+      this.heartbeatTimer = void 0;
+    }
+  }
+  async recordRouting(feeAmountMist) {
+    if (!this.state.relayId) {
+      return;
+    }
+    if (feeAmountMist < 0n) {
+      throw new Error("feeAmountMist must be non-negative.");
+    }
+    this.state.totalRouted = (this.state.totalRouted ?? 0) + 1;
+    this.state.totalFeesEarnedMist = (BigInt(this.state.totalFeesEarnedMist ?? "0") + feeAmountMist).toString();
+    this.state.lastError = void 0;
+  }
+  getInfo() {
+    return { ...this.state };
+  }
+  async sendHeartbeat() {
+    if (!this.client || !this.state.relayId) {
+      return;
+    }
+    try {
+      const result = await this.client.heartbeat({ relayId: this.state.relayId, signer: this.signer });
+      this.state.lastHeartbeat = result.lastHeartbeat;
+      this.state.lastError = void 0;
+      await this.refreshRelay(this.state.relayId);
+    } catch (error) {
+      this.state.lastError = error instanceof Error ? error.message : String(error);
+    }
+  }
+  async resolveExistingRelay(endpoint) {
+    if (!this.client || !this.config.relayRegistry) {
+      return null;
+    }
+    if (this.config.relayRegistry.relayId) {
+      return await this.client.getRelay(this.config.relayRegistry.relayId);
+    }
+    const operator = this.signer.getPublicKey().toSuiAddress();
+    const matches = await this.client.listRelays({
+      activeOnly: false,
+      operator,
+      stakePositionId: this.config.relayRegistry.stakePositionId,
+      endpoint
+    });
+    return matches.find((relay) => relay.status === RelayNodeStatus.ACTIVE) ?? matches[0] ?? null;
+  }
+  async refreshRelay(relayId) {
+    if (!this.client) {
+      return;
+    }
+    const relay = await this.client.getRelay(relayId);
+    if (relay) {
+      this.applyRelay(relay);
+    }
+  }
+  applyRelay(relay) {
+    this.state = {
+      ...this.state,
+      enabled: true,
+      registered: true,
+      relayId: relay.id,
+      operator: relay.operator,
+      endpoint: relay.endpoint,
+      stakePositionId: relay.stakePositionId,
+      capabilities: relay.capabilities,
+      region: relay.region,
+      status: relayStatusToText(relay.status),
+      routingFeeBps: relay.routingFeeBps,
+      lastHeartbeat: relay.lastHeartbeat,
+      totalRouted: relay.totalRouted,
+      totalFeesEarnedMist: relay.totalFeesEarnedMist.toString(),
+      lastError: void 0
+    };
+  }
+};
+function createRelaySuiClient(config) {
+  return new MeshSuiClient({
+    rpcUrl: config.sui?.rpcUrl ?? "",
+    faucetUrl: config.sui?.rpcUrl ?? "",
+    packageId: config.sui?.packageId ?? "",
+    registryId: config.sui?.packageId ?? ""
+  });
+}
+function resolveRelayEndpoint(config, serverAddress) {
+  if (config.relayRegistry?.endpoint) {
+    return config.relayRegistry.endpoint;
+  }
+  const url = new URL(serverAddress);
+  url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
+  url.pathname = "/v1/ws";
+  url.search = "";
+  url.hash = "";
+  return url.toString();
+}
+function resolveRoutingFeeBps(config) {
+  return config.relayRegistry?.routingFeeBps ?? Math.max(0, Math.round(config.fees.basePercentage * 100));
+}
+function relayStatusToText(status) {
+  switch (status) {
+    case RelayNodeStatus.INACTIVE:
+      return "INACTIVE";
+    case RelayNodeStatus.SLASHED:
+      return "SLASHED";
+    default:
+      return "ACTIVE";
+  }
+}
+
+// src/routing/message-types.ts
+function normalizeCapability(capability) {
+  return capability.trim().toLowerCase();
+}
+function createAuthPayload(message) {
+  const capabilities = [...new Set(message.capabilities.map(normalizeCapability))].sort().join(",");
+  return `mesh-relay-auth|${message.did}|${message.nonce}|${capabilities}`;
+}
+function serializeRelayMessage(message) {
+  return JSON.stringify(message);
+}
+function parseProviderMessage(payload) {
+  const raw = typeof payload === "string" ? payload : payload instanceof ArrayBuffer ? Buffer.from(payload).toString("utf8") : Array.isArray(payload) ? Buffer.concat(payload).toString("utf8") : payload.toString("utf8");
+  try {
+    const parsed = JSON.parse(raw);
+    if (!isRecord(parsed) || typeof parsed.type !== "string") {
+      return null;
+    }
+    switch (parsed.type) {
+      case "auth":
+        return typeof parsed.did === "string" && typeof parsed.nonce === "string" && typeof parsed.signature === "string" && Array.isArray(parsed.capabilities) && parsed.capabilities.every((entry) => typeof entry === "string") ? {
+          type: "auth",
+          did: parsed.did,
+          nonce: parsed.nonce,
+          signature: parsed.signature,
+          capabilities: parsed.capabilities
+        } : null;
+      case "heartbeat":
+        return typeof parsed.sessionId === "string" ? { type: "heartbeat", sessionId: parsed.sessionId } : null;
+      case "task_result":
+        return typeof parsed.sessionId === "string" && typeof parsed.taskId === "string" && isPositiveInteger(parsed.sequence) ? { type: "task_result", sessionId: parsed.sessionId, taskId: parsed.taskId, sequence: parsed.sequence, result: parsed.result } : null;
+      case "task_progress":
+        return typeof parsed.sessionId === "string" && typeof parsed.taskId === "string" && isPositiveInteger(parsed.sequence) && isValidProgress(parsed.progress) && (parsed.message === void 0 || typeof parsed.message === "string") ? {
+          type: "task_progress",
+          sessionId: parsed.sessionId,
+          taskId: parsed.taskId,
+          sequence: parsed.sequence,
+          progress: parsed.progress,
+          message: parsed.message
+        } : null;
+      case "task_chunk":
+        return typeof parsed.sessionId === "string" && typeof parsed.taskId === "string" && isPositiveInteger(parsed.sequence) && typeof parsed.data === "string" ? { type: "task_chunk", sessionId: parsed.sessionId, taskId: parsed.taskId, sequence: parsed.sequence, data: parsed.data } : null;
+      case "task_error":
+        return typeof parsed.sessionId === "string" && typeof parsed.taskId === "string" && isPositiveInteger(parsed.sequence) && isRecord(parsed.error) && typeof parsed.error.code === "string" && typeof parsed.error.message === "string" ? {
+          type: "task_error",
+          sessionId: parsed.sessionId,
+          taskId: parsed.taskId,
+          sequence: parsed.sequence,
+          error: {
+            code: parsed.error.code,
+            message: parsed.error.message
+          }
+        } : null;
+      default:
+        return null;
+    }
+  } catch {
+    return null;
+  }
+}
+function parseRelayMessage(payload) {
+  const raw = typeof payload === "string" ? payload : payload instanceof ArrayBuffer ? Buffer.from(payload).toString("utf8") : Array.isArray(payload) ? Buffer.concat(payload).toString("utf8") : payload.toString("utf8");
+  try {
+    const parsed = JSON.parse(raw);
+    if (!isRecord(parsed) || typeof parsed.type !== "string") {
+      return null;
+    }
+    switch (parsed.type) {
+      case "auth_ok":
+        return typeof parsed.sessionId === "string" && typeof parsed.relayDid === "string" ? { type: "auth_ok", sessionId: parsed.sessionId, relayDid: parsed.relayDid } : null;
+      case "auth_fail":
+        return typeof parsed.reason === "string" ? { type: "auth_fail", reason: parsed.reason } : null;
+      case "heartbeat_ack":
+        return { type: "heartbeat_ack" };
+      case "task_request":
+        return typeof parsed.sessionId === "string" && typeof parsed.taskId === "string" && typeof parsed.capability === "string" && typeof parsed.requesterDid === "string" && isPositiveInteger(parsed.sequence) ? {
+          type: "task_request",
+          sessionId: parsed.sessionId,
+          taskId: parsed.taskId,
+          capability: parsed.capability,
+          input: parsed.input,
+          requesterDid: parsed.requesterDid,
+          sequence: parsed.sequence
+        } : null;
+      default:
+        return null;
+    }
+  } catch {
+    return null;
+  }
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isPositiveInteger(value) {
+  return typeof value === "number" && Number.isInteger(value) && value > 0;
+}
+function isValidProgress(value) {
+  return typeof value === "number" && Number.isFinite(value) && value >= 0 && value <= 1;
+}
+
+// src/routing/router.ts
+import { randomUUID as randomUUID3 } from "crypto";
+
+// src/routing/session-manager.ts
+import { randomUUID as randomUUID2 } from "crypto";
+import { EventEmitter } from "events";
+import { parseDID, verify } from "@hivemind-os/collective-core";
+var encoder = new TextEncoder();
+var SessionManager = class extends EventEmitter {
+  constructor(options) {
+    super();
+    this.options = options;
+    this.now = options.now ?? (() => Date.now());
+  }
+  options;
+  sessions = /* @__PURE__ */ new Map();
+  sessionsByDid = /* @__PURE__ */ new Map();
+  capabilityIndex = /* @__PURE__ */ new Map();
+  inboundSequences = /* @__PURE__ */ new Map();
+  capabilityCursor = /* @__PURE__ */ new Map();
+  recentAuthNonces = /* @__PURE__ */ new Map();
+  now;
+  registerSession(ws, authMessage) {
+    if (this.sessions.size >= this.options.maxConnections) {
+      throw new Error("Relay connection limit reached.");
+    }
+    this.pruneRecentAuthNonces();
+    if (this.getSessionByDid(authMessage.did)) {
+      throw new Error(`Provider ${authMessage.did} is already connected to the relay.`);
+    }
+    this.verifyAuthMessage(authMessage);
+    this.markAuthNonceUsed(authMessage);
+    const sessionId = randomUUID2();
+    const timestamp = this.now();
+    const normalizedCapabilities = [...new Set(authMessage.capabilities.map(normalizeCapability))];
+    const session = {
+      sessionId,
+      providerDid: authMessage.did,
+      ws,
+      capabilities: [...normalizedCapabilities],
+      normalizedCapabilities,
+      connectedAt: timestamp,
+      lastHeartbeat: timestamp,
+      sequenceCounter: 0
+    };
+    this.sessions.set(sessionId, session);
+    this.addDidIndex(session.providerDid, sessionId);
+    this.addCapabilities(sessionId, normalizedCapabilities);
+    const cleanup = () => {
+      this.removeSession(sessionId);
+    };
+    ws.once("close", cleanup);
+    ws.once("error", cleanup);
+    this.emit("session_registered", this.toProviderInfo(session));
+    return session;
+  }
+  findProvider(capability, preferredDid) {
+    const normalizedCapability = normalizeCapability(capability);
+    if (preferredDid) {
+      return this.getSessionByDid(preferredDid, normalizedCapability);
+    }
+    const ids = [...this.capabilityIndex.get(normalizedCapability) ?? []];
+    if (ids.length === 0) {
+      return null;
+    }
+    const cursor = this.capabilityCursor.get(normalizedCapability) ?? 0;
+    const sessionId = ids[cursor % ids.length];
+    this.capabilityCursor.set(normalizedCapability, cursor + 1);
+    return sessionId ? this.sessions.get(sessionId) ?? null : null;
+  }
+  removeSession(sessionId) {
+    const session = this.sessions.get(sessionId);
+    if (!session) {
+      return;
+    }
+    this.sessions.delete(sessionId);
+    this.inboundSequences.delete(sessionId);
+    this.removeDidIndex(session.providerDid, sessionId);
+    this.removeCapabilities(sessionId, session.normalizedCapabilities);
+    this.emit("session_removed", this.toProviderInfo(session));
+  }
+  disconnectSession(sessionId, code = 4001, reason = "Session expired") {
+    const session = this.sessions.get(sessionId);
+    if (!session) {
+      return;
+    }
+    try {
+      session.ws.close(code, reason);
+    } catch {
+      this.removeSession(sessionId);
+    }
+  }
+  disconnectAllSessions(code = 1012, reason = "Relay shutting down") {
+    for (const sessionId of [...this.sessions.keys()]) {
+      this.disconnectSession(sessionId, code, reason);
+    }
+  }
+  handleHeartbeat(sessionId) {
+    const session = this.sessions.get(sessionId);
+    if (!session) {
+      return;
+    }
+    session.lastHeartbeat = this.now();
+  }
+  sweepExpiredSessions() {
+    this.pruneRecentAuthNonces();
+    const now = this.now();
+    const expired = [...this.sessions.values()].filter((session) => now - session.lastHeartbeat > this.options.heartbeatTimeoutMs).map((session) => session.sessionId);
+    for (const sessionId of expired) {
+      this.disconnectSession(sessionId, 4002, "Heartbeat timeout");
+    }
+    return expired;
+  }
+  getConnectedProviders() {
+    return [...this.sessions.values()].map((session) => this.toProviderInfo(session));
+  }
+  getSession(sessionId) {
+    return this.sessions.get(sessionId) ?? null;
+  }
+  getSessionByDid(did, capability) {
+    const sessionIds = [...this.sessionsByDid.get(did) ?? []];
+    if (sessionIds.length === 0) {
+      return null;
+    }
+    const normalizedCapability = capability ? normalizeCapability(capability) : void 0;
+    for (const sessionId of sessionIds) {
+      const session = this.sessions.get(sessionId);
+      if (!session) {
+        continue;
+      }
+      if (!normalizedCapability || session.normalizedCapabilities.includes(normalizedCapability)) {
+        return session;
+      }
+    }
+    return null;
+  }
+  getSessionCount() {
+    return this.sessions.size;
+  }
+  nextSequence(sessionId) {
+    const session = this.sessions.get(sessionId);
+    if (!session) {
+      throw new Error(`Unknown relay session: ${sessionId}`);
+    }
+    session.sequenceCounter += 1;
+    return session.sequenceCounter;
+  }
+  validateIncomingSequence(sessionId, sequence) {
+    const previous = this.inboundSequences.get(sessionId) ?? 0;
+    if (!Number.isInteger(sequence) || sequence <= previous) {
+      return false;
+    }
+    this.inboundSequences.set(sessionId, sequence);
+    return true;
+  }
+  verifyAuthMessage(authMessage) {
+    if (this.recentAuthNonces.has(this.getAuthNonceKey(authMessage))) {
+      throw new Error("Authentication nonce has already been used.");
+    }
+    try {
+      const payload = createAuthPayload(authMessage);
+      const signature = decodeHex(authMessage.signature);
+      const publicKey = parseDID(authMessage.did).publicKey;
+      if (!verify(encoder.encode(payload), signature, publicKey)) {
+        throw new Error("Invalid provider authentication signature.");
+      }
+    } catch (error) {
+      if (error instanceof Error && error.message === "Authentication nonce has already been used.") {
+        throw error;
+      }
+      throw new Error("Invalid provider authentication signature.");
+    }
+  }
+  markAuthNonceUsed(authMessage) {
+    this.recentAuthNonces.set(this.getAuthNonceKey(authMessage), this.now() + this.getAuthNonceTtlMs());
+  }
+  pruneRecentAuthNonces() {
+    const now = this.now();
+    for (const [nonceKey, expiresAt] of this.recentAuthNonces.entries()) {
+      if (expiresAt > now) {
+        continue;
+      }
+      this.recentAuthNonces.delete(nonceKey);
+    }
+  }
+  getAuthNonceKey(authMessage) {
+    return `${authMessage.did}:${authMessage.nonce}`;
+  }
+  getAuthNonceTtlMs() {
+    return this.options.authNonceTtlMs ?? 5 * 6e4;
+  }
+  addDidIndex(did, sessionId) {
+    const ids = this.sessionsByDid.get(did) ?? /* @__PURE__ */ new Set();
+    ids.add(sessionId);
+    this.sessionsByDid.set(did, ids);
+  }
+  removeDidIndex(did, sessionId) {
+    const ids = this.sessionsByDid.get(did);
+    if (!ids) {
+      return;
+    }
+    ids.delete(sessionId);
+    if (ids.size === 0) {
+      this.sessionsByDid.delete(did);
+    }
+  }
+  addCapabilities(sessionId, capabilities) {
+    for (const capability of capabilities) {
+      const sessions = this.capabilityIndex.get(capability) ?? /* @__PURE__ */ new Set();
+      sessions.add(sessionId);
+      this.capabilityIndex.set(capability, sessions);
+    }
+  }
+  removeCapabilities(sessionId, capabilities) {
+    for (const capability of capabilities) {
+      const sessions = this.capabilityIndex.get(capability);
+      if (!sessions) {
+        continue;
+      }
+      sessions.delete(sessionId);
+      if (sessions.size === 0) {
+        this.capabilityIndex.delete(capability);
+        this.capabilityCursor.delete(capability);
+      }
+    }
+  }
+  toProviderInfo(session) {
+    return {
+      sessionId: session.sessionId,
+      providerDid: session.providerDid,
+      capabilities: [...session.capabilities],
+      connectedAt: session.connectedAt,
+      lastHeartbeat: session.lastHeartbeat
+    };
+  }
+};
+function decodeHex(value) {
+  if (!/^[0-9a-f]+$/i.test(value) || value.length % 2 !== 0) {
+    throw new Error("Authentication signature must be a hex string.");
+  }
+  return Uint8Array.from(Buffer.from(value, "hex"));
+}
+
+// src/routing/router.ts
+var RelayRouteError = class extends Error {
+  constructor(code, message, statusCode, retryable = false) {
+    super(message);
+    this.code = code;
+    this.statusCode = statusCode;
+    this.retryable = retryable;
+    this.name = "RelayRouteError";
+  }
+  code;
+  statusCode;
+  retryable;
+};
+var RelayRouter = class {
+  constructor(options) {
+    this.options = options;
+    this.options.sessionManager.on("session_removed", (session) => {
+      this.rejectSessionTasks(session.sessionId, new RelayRouteError("PROVIDER_DISCONNECTED", "Provider disconnected.", 503, true));
+    });
+  }
+  options;
+  pendingTasks = /* @__PURE__ */ new Map();
+  async routeTask(request) {
+    return this.dispatch(request);
+  }
+  async routeStreamingTask(request, onChunk) {
+    return this.dispatch(request, onChunk);
+  }
+  async routeMulti(request, providerDids) {
+    return await Promise.all(
+      providerDids.map((providerDid, index) => this.dispatch({
+        ...request,
+        providerDid,
+        taskId: request.taskId ? `${request.taskId}-${index + 1}` : void 0
+      }))
+    );
+  }
+  close() {
+    for (const taskId of [...this.pendingTasks.keys()]) {
+      this.completeTask(
+        taskId,
+        void 0,
+        new RelayRouteError("RELAY_SHUTDOWN", "Relay is shutting down.", 503, true)
+      );
+    }
+  }
+  handleProviderMessage(sessionId, message) {
+    if (message.sessionId !== sessionId) {
+      throw new RelayRouteError("SESSION_MISMATCH", "Relay session id did not match the authenticated connection.", 409);
+    }
+    if (!this.options.sessionManager.validateIncomingSequence(sessionId, message.sequence)) {
+      throw new RelayRouteError("REPLAY_DETECTED", "Out-of-order relay message rejected.", 409);
+    }
+    const session = this.options.sessionManager.getSession(sessionId);
+    if (!session) {
+      throw new RelayRouteError("SESSION_NOT_FOUND", "Relay session was not found.", 404);
+    }
+    const pending = this.pendingTasks.get(message.taskId);
+    if (!pending || pending.sessionId !== sessionId) {
+      return;
+    }
+    switch (message.type) {
+      case "task_progress":
+        this.emitTaskEvent(message.taskId, {
+          type: "progress",
+          taskId: message.taskId,
+          sequence: message.sequence,
+          progress: message.progress,
+          message: message.message
+        });
+        break;
+      case "task_chunk":
+        this.emitTaskEvent(message.taskId, {
+          type: "chunk",
+          taskId: message.taskId,
+          sequence: message.sequence,
+          data: message.data
+        });
+        break;
+      case "task_error":
+        this.completeTask(
+          message.taskId,
+          void 0,
+          new RelayRouteError(message.error.code, message.error.message, 502, true)
+        );
+        break;
+      case "task_result":
+        if (!this.emitTaskEvent(message.taskId, {
+          type: "result",
+          taskId: message.taskId,
+          sequence: message.sequence,
+          result: message.result
+        })) {
+          return;
+        }
+        this.completeTask(message.taskId, {
+          taskId: message.taskId,
+          providerDid: session.providerDid,
+          sequence: message.sequence,
+          result: message.result
+        });
+        break;
+    }
+  }
+  async dispatch(request, onChunk) {
+    const session = this.findSession(request.capability, request.providerDid);
+    const taskId = request.taskId ?? randomUUID3();
+    const sequence = this.options.sessionManager.nextSequence(session.sessionId);
+    const relayMessage = {
+      type: "task_request",
+      sessionId: session.sessionId,
+      taskId,
+      capability: request.capability,
+      input: request.input,
+      requesterDid: request.requesterDid,
+      sequence
+    };
+    const response = new Promise((resolve3, reject) => {
+      const timeoutMs = request.timeoutMs ?? this.options.taskTimeoutMs;
+      const timer = setTimeout(() => {
+        this.pendingTasks.delete(taskId);
+        reject(new RelayRouteError("TASK_TIMEOUT", `Task ${taskId} timed out.`, 504, true));
+      }, timeoutMs);
+      this.pendingTasks.set(taskId, {
+        taskId,
+        sessionId: session.sessionId,
+        onChunk,
+        resolve: resolve3,
+        reject,
+        timer
+      });
+    });
+    try {
+      await sendWebSocketMessage(session.ws, serializeRelayMessage(relayMessage));
+      return await response;
+    } catch (error) {
+      this.completeTask(taskId, void 0, toRouteError(error));
+      throw toRouteError(error);
+    }
+  }
+  emitTaskEvent(taskId, event) {
+    const pending = this.pendingTasks.get(taskId);
+    if (!pending?.onChunk) {
+      return true;
+    }
+    try {
+      pending.onChunk(event);
+      return true;
+    } catch {
+      this.completeTask(
+        taskId,
+        void 0,
+        new RelayRouteError("STREAM_DELIVERY_FAILED", "Streaming consumer disconnected before relay delivery completed.", 499, true)
+      );
+      return false;
+    }
+  }
+  completeTask(taskId, response, error) {
+    const pending = this.pendingTasks.get(taskId);
+    if (!pending) {
+      return;
+    }
+    clearTimeout(pending.timer);
+    this.pendingTasks.delete(taskId);
+    if (error) {
+      pending.reject(error);
+      return;
+    }
+    if (!response) {
+      pending.reject(new RelayRouteError("TASK_FAILED", `Task ${taskId} failed.`, 500));
+      return;
+    }
+    pending.resolve(response);
+  }
+  rejectSessionTasks(sessionId, error) {
+    for (const [taskId, pending] of this.pendingTasks.entries()) {
+      if (pending.sessionId !== sessionId) {
+        continue;
+      }
+      this.completeTask(taskId, void 0, error);
+    }
+  }
+  findSession(capability, providerDid) {
+    const session = this.options.sessionManager.findProvider(capability, providerDid);
+    if (!session) {
+      throw new RelayRouteError("PROVIDER_NOT_FOUND", `No provider is connected for capability ${capability}.`, 404, true);
+    }
+    return session;
+  }
+};
+async function sendWebSocketMessage(ws, message) {
+  if ("readyState" in ws && typeof ws.readyState === "number" && ws.readyState !== 1) {
+    throw new RelayRouteError("PROVIDER_UNAVAILABLE", "Provider WebSocket is not open.", 503, true);
+  }
+  await new Promise((resolve3, reject) => {
+    try {
+      ws.send(message, (error) => {
+        if (error) {
+          reject(error);
+          return;
+        }
+        resolve3();
+      });
+    } catch (error) {
+      reject(error);
+    }
+  });
+}
+function toRouteError(error) {
+  if (error instanceof RelayRouteError) {
+    return error;
+  }
+  return new RelayRouteError("ROUTING_FAILED", error instanceof Error ? error.message : "Relay routing failed.", 502, true);
+}
+
+// src/server/middleware.ts
+import { randomUUID as randomUUID4 } from "crypto";
+import { PaymentRail as PaymentRail2 } from "@hivemind-os/collective-types";
+import { isValidDID } from "@hivemind-os/collective-core";
+function registerMeshMiddleware(app, relayDid) {
+  app.addHook("onRequest", async (request, reply) => {
+    const requesterDid = request.headers["x-mesh-requester"];
+    const targetProvider = request.headers["x-mesh-target-provider"];
+    if (typeof requesterDid === "string" && requesterDid.length > 0 && !isValidDID(requesterDid)) {
+      reply.code(400).send({
+        error: {
+          code: "INVALID_REQUESTER_DID",
+          message: "X-Mesh-Requester must be a valid did:mesh identifier."
+        }
+      });
+      return;
+    }
+    if (typeof targetProvider === "string" && targetProvider.length > 0 && !isValidDID(targetProvider)) {
+      reply.code(400).send({
+        error: {
+          code: "INVALID_TARGET_PROVIDER_DID",
+          message: "X-Mesh-Target-Provider must be a valid did:mesh identifier."
+        }
+      });
+      return;
+    }
+    reply.header("X-Mesh-Relay", relayDid);
+  });
+}
+function getMeshRequestContext(request) {
+  return {
+    requestId: readHeader(request, "x-mesh-request-id") ?? randomUUID4(),
+    requesterDid: readHeader(request, "x-mesh-requester"),
+    targetProviderDid: readHeader(request, "x-mesh-target-provider"),
+    timestamp: readHeader(request, "x-mesh-timestamp"),
+    signature: readHeader(request, "x-mesh-signature"),
+    paymentSignature: readHeader(request, "payment-signature") ?? readHeader(request, "x-payment-signature"),
+    paymentNonce: readHeader(request, "x-mesh-payment-nonce"),
+    paymentRail: normalizePaymentRail(readHeader(request, "x-mesh-payment-rail")),
+    sessionId: readHeader(request, "x-mesh-session-id"),
+    sequence: readPositiveInteger(readHeader(request, "x-mesh-sequence"))
+  };
+}
+function applyMeshResponseHeaders(reply, relayDid, requestId) {
+  reply.header("X-Mesh-Relay", relayDid);
+  reply.header("X-Mesh-Request-Id", requestId);
+}
+function readHeader(request, name) {
+  const value = request.headers[name];
+  return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function readPositiveInteger(value) {
+  if (!value || !/^\d+$/.test(value)) {
+    return void 0;
+  }
+  return Number(value);
+}
+function normalizePaymentRail(value) {
+  if (value === PaymentRail2.SUI_ESCROW || value === PaymentRail2.SUI_TRANSFER || value === PaymentRail2.X402_BASE) {
+    return value;
+  }
+  return void 0;
+}
+
+// src/server/routes.ts
+import { encodePaymentResponseHeader as encodePaymentResponseHeader2 } from "@x402/core/http";
+import { PaymentRail as PaymentRail3 } from "@hivemind-os/collective-types";
+var CONSUMER_SEQUENCE_TTL_MS = 60 * 6e4;
+async function registerRelayRoutes(app, deps) {
+  const consumerSequences = /* @__PURE__ */ new Map();
+  app.get("/health", async () => {
+    const status = deps.healthMonitor.getStatus();
+    return {
+      status: status.status === "healthy" ? "ok" : status.status,
+      relayStatus: status.status,
+      uptime: status.uptime,
+      connectedProviders: status.connectedProviders,
+      activeRequests: status.activeRequests,
+      totalRequestsServed: status.totalRequestsServed,
+      averageLatencyMs: status.averageLatencyMs,
+      relayRegistry: deps.relayRegistry?.getInfo() ?? { enabled: false, registered: false }
+    };
+  });
+  app.get("/info", async () => ({
+    relayDid: deps.relayDid,
+    version: deps.version,
+    feeSchedule: {
+      basePercentage: deps.config.fees.basePercentage,
+      minimumMist: deps.config.fees.minimumMist.toString()
+    },
+    capabilities: [...new Set(deps.sessionManager.getConnectedProviders().flatMap((provider) => provider.capabilities))].sort(),
+    relayRegistry: deps.relayRegistry?.getInfo() ?? { enabled: false, registered: false }
+  }));
+  app.post("/mesh/providers/:providerDid/capabilities/:capability/execute", async (request, reply) => {
+    const tracker = deps.healthMonitor.beginRequest();
+    const context = getMeshRequestContext(request);
+    applyMeshResponseHeaders(reply, deps.relayDid, context.requestId);
+    try {
+      const params = request.params;
+      const sequenceError = validateConsumerSequence(consumerSequences, context, Date.now());
+      if (sequenceError) {
+        reply.code(sequenceError.statusCode).send(toError(sequenceError.code, sequenceError.message, context.requestId));
+        return;
+      }
+      if (!context.requesterDid) {
+        reply.code(400).send(toError("REQUESTER_REQUIRED", "X-Mesh-Requester header is required.", context.requestId));
+        return;
+      }
+      const provider = deps.sessionManager.findProvider(params.capability, params.providerDid);
+      if (!provider) {
+        reply.code(404).send(
+          toError("PROVIDER_NOT_FOUND", `Provider ${params.providerDid} is not connected to the relay.`, context.requestId)
+        );
+        return;
+      }
+      const paymentRail = context.paymentRail ?? defaultPaymentRailForProvider(provider, deps.paymentGate);
+      if (!context.paymentSignature) {
+        const challenge2 = deps.paymentGate.generate402Challenge(paymentRail, params.capability, provider);
+        reply.code(402).header("PAYMENT-REQUIRED", challenge2.extra?.["payment-required"] ?? "").send({
+          ...toError("PAYMENT_REQUIRED", "Payment is required before relay execution.", context.requestId),
+          payment: challenge2
+        });
+        return;
+      }
+      const challenge = context.paymentNonce ? deps.paymentGate.getChallenge(context.paymentNonce) : null;
+      if (!challenge) {
+        reply.code(400).send(
+          toError("PAYMENT_CHALLENGE_REQUIRED", "X-Mesh-Payment-Nonce must reference an active challenge.", context.requestId)
+        );
+        return;
+      }
+      const verification = await deps.paymentGate.verifyPayment(context.paymentSignature, challenge);
+      if (!verification.accepted) {
+        reply.code(402).send({
+          ...toError("PAYMENT_REJECTED", verification.reason ?? "Payment verification failed.", context.requestId),
+          payment: challenge
+        });
+        return;
+      }
+      if (!deps.sessionManager.getSession(provider.sessionId)) {
+        reply.code(503).send(
+          toError(
+            "PROVIDER_UNAVAILABLE",
+            `Provider ${params.providerDid} disconnected before the relay could start the task. No funds were settled.`,
+            context.requestId,
+            true
+          )
+        );
+        return;
+      }
+      if (isStreamingRequest(request)) {
+        reply.hijack();
+        reply.raw.writeHead(200, {
+          "content-type": "text/event-stream; charset=utf-8",
+          "cache-control": "no-cache, no-transform",
+          connection: "keep-alive",
+          "x-mesh-provider": provider.providerDid,
+          "x-mesh-request-id": context.requestId,
+          "x-mesh-relay": deps.relayDid,
+          "payment-response": verification.settlementReference ?? ""
+        });
+        try {
+          const routed = await deps.router.routeStreamingTask(
+            {
+              requesterDid: context.requesterDid,
+              providerDid: params.providerDid,
+              capability: params.capability,
+              input: request.body,
+              timeoutMs: deps.config.limits.taskTimeoutMs
+            },
+            (event) => {
+              if (event.type === "result") {
+                return;
+              }
+              writeSse(reply.raw, event.type, event);
+            }
+          );
+          await deps.relayRegistry?.recordRouting(BigInt(challenge.relayFee));
+          writeSse(reply.raw, "result", {
+            taskId: routed.taskId,
+            providerDid: routed.providerDid,
+            result: routed.result,
+            paymentReceipt: verification.settlementReference,
+            relayFeeMist: challenge.relayFee
+          });
+        } catch (error) {
+          const routeError = error instanceof RelayRouteError ? error : new RelayRouteError("ROUTE_FAILED", "Relay routing failed.", 502, true);
+          writeSse(reply.raw, "error", { code: routeError.code, message: routeError.message });
+        } finally {
+          reply.raw.end();
+        }
+        return;
+      }
+      const response = await deps.router.routeTask({
+        requesterDid: context.requesterDid,
+        providerDid: params.providerDid,
+        capability: params.capability,
+        input: request.body,
+        timeoutMs: deps.config.limits.taskTimeoutMs
+      });
+      await deps.relayRegistry?.recordRouting(BigInt(challenge.relayFee));
+      reply.code(200).header("X-Mesh-Provider", response.providerDid).header("X-Mesh-Response-Id", response.taskId).header("X-Mesh-Relay-Fee", challenge.relayFee).header(
+        "PAYMENT-RESPONSE",
+        verification.settlementReference ?? encodePaymentResponseHeader2({
+          success: true,
+          transaction: `relay-${response.taskId}`,
+          network: toSettlementNetwork(challenge.network),
+          amount: challenge.amount,
+          payer: verification.payer
+        })
+      ).send(response.result);
+    } catch (error) {
+      const routeError = error instanceof RelayRouteError ? error : new RelayRouteError("ROUTE_FAILED", "Relay routing failed.", 502, true);
+      reply.code(routeError.statusCode).send(toError(routeError.code, routeError.message, context.requestId, routeError.retryable));
+    } finally {
+      tracker.finish();
+    }
+  });
+}
+function validateConsumerSequence(sequences, context, now) {
+  pruneConsumerSequences(sequences, now);
+  if (!context.sessionId && context.sequence === void 0) {
+    return null;
+  }
+  if (!context.sessionId || context.sequence === void 0) {
+    return {
+      code: "SEQUENCE_REQUIRED",
+      message: "X-Mesh-Session-Id and X-Mesh-Sequence must be provided together.",
+      statusCode: 400
+    };
+  }
+  const previous = sequences.get(context.sessionId)?.sequence ?? 0;
+  if (context.sequence <= previous) {
+    return {
+      code: "REPLAY_DETECTED",
+      message: "Relay rejected a replayed or out-of-order consumer request.",
+      statusCode: 409
+    };
+  }
+  sequences.set(context.sessionId, { sequence: context.sequence, updatedAt: now });
+  return null;
+}
+function pruneConsumerSequences(sequences, now) {
+  for (const [sessionId, state] of sequences.entries()) {
+    if (now - state.updatedAt <= CONSUMER_SEQUENCE_TTL_MS) {
+      continue;
+    }
+    sequences.delete(sessionId);
+  }
+}
+function defaultPaymentRailForProvider(provider, paymentGate) {
+  return paymentGate.defaultRail ?? PaymentRail3.SUI_TRANSFER;
+}
+function isStreamingRequest(request) {
+  const accept = typeof request.headers.accept === "string" ? request.headers.accept : "";
+  if (accept.includes("text/event-stream")) {
+    return true;
+  }
+  if (typeof request.query !== "object" || request.query === null) {
+    return false;
+  }
+  const query = request.query;
+  return query.stream === "1" || query.stream === "true";
+}
+function writeSse(stream, event, data) {
+  stream.write(`event: ${event}
+`);
+  stream.write(`data: ${JSON.stringify(data)}
+
+`);
+}
+function toError(code, message, requestId, retryable = false) {
+  return {
+    error: {
+      code,
+      message,
+      details: {},
+      retryable,
+      retryAfterMs: retryable ? 1e3 : null,
+      requestId
+    }
+  };
+}
+function toSettlementNetwork(network) {
+  switch (network) {
+    case "base":
+      return "eip155:8453";
+    case "base-sepolia":
+      return "eip155:84532";
+    case "sui-mainnet":
+      return "sui:mainnet";
+    case "sui-testnet":
+      return "sui:testnet";
+    case "sui-devnet":
+      return "sui:devnet";
+    default:
+      return network.includes(":") ? network : "sui:testnet";
+  }
+}
+
+// src/server/http-server.ts
+var RELAY_VERSION = "0.1.0";
+async function createRelayServer(config, options = {}) {
+  const app = Fastify({
+    logger: {
+      level: "info"
+    }
+  });
+  const identity = RelayIdentity.load(config.identity.keyPath);
+  const sessionManager = new SessionManager({
+    maxConnections: config.limits.maxConnections,
+    heartbeatTimeoutMs: config.limits.heartbeatTimeoutMs,
+    authNonceTtlMs: config.limits.authNonceTtlMs
+  });
+  const router = new RelayRouter({
+    sessionManager,
+    taskTimeoutMs: config.limits.taskTimeoutMs
+  });
+  const paymentGate = new PaymentGate({
+    relayDid: identity.did,
+    feeSchedule: config.fees
+  });
+  const healthMonitor = new HealthMonitor({
+    getConnectedProviders: () => sessionManager.getConnectedProviders().length
+  });
+  const relayRegistry = options.relayRegistry ?? new RelayRegistryService(config, identity);
+  await app.register(cors, {
+    origin: (origin, callback) => {
+      const allowedOrigins = config.cors?.allowedOrigins ?? [];
+      if (!origin) {
+        callback(null, false);
+        return;
+      }
+      callback(null, allowedOrigins.includes(origin));
+    }
+  });
+  app.register(rateLimit, {
+    max: config.limits.maxRequestsPerSecond,
+    timeWindow: "1 second"
+  });
+  await app.register(websocket);
+  registerMeshMiddleware(app, identity.did);
+  await registerRelayRoutes(app, {
+    relayDid: identity.did,
+    version: RELAY_VERSION,
+    config,
+    sessionManager,
+    router,
+    paymentGate,
+    healthMonitor,
+    relayRegistry
+  });
+  app.get("/v1/ws", { websocket: true }, (socket) => {
+    attachProviderSocket({
+      ws: normalizeWebSocket(socket),
+      identity,
+      sessionManager,
+      router
+    });
+  });
+  const heartbeatSweep = setInterval(() => {
+    sessionManager.sweepExpiredSessions();
+    paymentGate.pruneExpiredChallenges();
+  }, Math.max(1e3, Math.floor(config.limits.heartbeatIntervalMs / 2)));
+  app.addHook("onClose", async () => {
+    clearInterval(heartbeatSweep);
+    await relayRegistry.stop();
+    router.close();
+    sessionManager.disconnectAllSessions();
+  });
+  await app.ready();
+  return {
+    app,
+    config,
+    identity,
+    sessionManager,
+    router,
+    paymentGate,
+    healthMonitor,
+    relayRegistry,
+    start: async () => {
+      const address = await app.listen({ host: config.host, port: config.port });
+      const resolvedAddress = typeof address === "string" ? address : `http://${config.host}:${config.port}`;
+      await relayRegistry.start(resolvedAddress);
+      return resolvedAddress;
+    }
+  };
+}
+function attachProviderSocket(params) {
+  let authenticatedSessionId;
+  const authTimeout = setTimeout(() => {
+    if (authenticatedSessionId) {
+      return;
+    }
+    safeSend(params.ws, serializeRelayMessage({ type: "auth_fail", reason: "Authentication timeout." }));
+    safeClose(params.ws, 4003, "Authentication timeout");
+  }, 5e3);
+  params.ws.on("message", (payload) => {
+    const message = parseProviderMessage(payload);
+    if (!message) {
+      clearTimeout(authTimeout);
+      safeSend(params.ws, serializeRelayMessage({ type: "auth_fail", reason: "Invalid relay message." }));
+      safeClose(params.ws, 4004, "Invalid relay message");
+      return;
+    }
+    if (!authenticatedSessionId) {
+      if (message.type !== "auth") {
+        clearTimeout(authTimeout);
+        safeSend(params.ws, serializeRelayMessage({ type: "auth_fail", reason: "Authentication required." }));
+        safeClose(params.ws, 4005, "Authentication required");
+        return;
+      }
+      try {
+        const session = params.sessionManager.registerSession(params.ws, message);
+        authenticatedSessionId = session.sessionId;
+        clearTimeout(authTimeout);
+        safeSend(
+          params.ws,
+          serializeRelayMessage({
+            type: "auth_ok",
+            sessionId: session.sessionId,
+            relayDid: params.identity.did
+          })
+        );
+      } catch (error) {
+        clearTimeout(authTimeout);
+        safeSend(
+          params.ws,
+          serializeRelayMessage({
+            type: "auth_fail",
+            reason: error instanceof Error ? error.message : "Authentication failed."
+          })
+        );
+        safeClose(params.ws, 4006, "Authentication failed");
+      }
+      return;
+    }
+    if (message.type === "auth") {
+      safeSend(params.ws, serializeRelayMessage({ type: "auth_fail", reason: "Session already authenticated." }));
+      return;
+    }
+    if (message.type === "heartbeat") {
+      if (message.sessionId !== authenticatedSessionId) {
+        safeClose(params.ws, 4007, "Session mismatch");
+        return;
+      }
+      params.sessionManager.handleHeartbeat(authenticatedSessionId);
+      safeSend(params.ws, serializeRelayMessage({ type: "heartbeat_ack" }));
+      return;
+    }
+    try {
+      params.router.handleProviderMessage(authenticatedSessionId, message);
+    } catch (error) {
+      safeClose(params.ws, 4008, error instanceof Error ? error.message : "Provider message rejected");
+    }
+  });
+  const cleanup = () => {
+    clearTimeout(authTimeout);
+    if (authenticatedSessionId) {
+      params.sessionManager.removeSession(authenticatedSessionId);
+    }
+  };
+  params.ws.once("close", cleanup);
+  params.ws.once("error", cleanup);
+}
+function normalizeWebSocket(socket) {
+  if ("on" in socket && typeof socket.on === "function" && "send" in socket && typeof socket.send === "function" && "close" in socket && typeof socket.close === "function") {
+    return socket;
+  }
+  if ("socket" in socket && socket.socket) {
+    return socket.socket;
+  }
+  throw new Error("Fastify websocket route did not provide a WebSocket connection.");
+}
+function safeSend(ws, message) {
+  if (ws.readyState !== WebSocket.OPEN) {
+    return;
+  }
+  ws.send(message);
+}
+function safeClose(ws, code, reason) {
+  if (ws.readyState === WebSocket.CLOSED) {
+    return;
+  }
+  ws.close(code, reason);
+}
+
+// src/index.ts
+async function startRelayServer() {
+  const config = loadRelayConfig();
+  const relay = await createRelayServer(config);
+  const address = await relay.start();
+  return { relay, address };
+}
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  try {
+    const { relay, address } = await startRelayServer();
+    relay.app.log.info({ address, relayDid: relay.identity.did }, "Relay server started");
+  } catch (error) {
+    console.error(error);
+    process.exitCode = 1;
+  }
+}
+export {
+  HealthMonitor,
+  PaymentGate,
+  RelayIdentity,
+  RelayRegistryService,
+  RelayRouteError,
+  RelayRouter,
+  SessionManager,
+  applyMeshResponseHeaders,
+  calculateRelayFee,
+  createAuthPayload,
+  createRelayServer,
+  getDefaultRelayConfig,
+  getMeshRequestContext,
+  loadRelayConfig,
+  normalizeCapability,
+  parseProviderMessage,
+  parseRelayMessage,
+  registerMeshMiddleware,
+  registerRelayRoutes,
+  serializeRelayMessage,
+  startRelayServer,
+  validateRelayConfig
+};
+//# sourceMappingURL=index.js.map