@uuaid/pillar 0.2.0-alpha.8 → 2.0.1

package/bin/pillar.mjs

@@ -7,11 +7,16 @@
  *   pillar id    [--home ~/.pillar]              print our UUAID + PeerId + addrs
  *   pillar send  <recipient> <kind> <json>       send a signed envelope
  *   pillar recv  [--home ~/.pillar] [--follow]   listen for envelopes and print them
+ *   pillar inbox [--home ~/.pillar] [--unread] [--notify CMD] [--mark-read]
+ *                                                one-shot: pull pending mail, print, exit
+ *   pillar trust [set|allow|block|unlist|quarantine]   recipient consent policy
+ *   pillar tier  [issue|install|verify]          signed volume/size tier grants
  *   pillar peers                                 list currently connected peers
  *
  * All commands respect --home to point at an alternate pillar directory,
  * useful for running multiple pillars on one machine (Zestro dogfood etc.).
  */
+import "../src/node-check.mjs"; // must stay the first import: refuses Node < 22 before any dependency loads
 import { mkdirSync, existsSync, readFileSync, writeFileSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { homedir } from "node:os";
@@ -19,6 +24,10 @@ import { argv, exit } from "node:process";
 import { Keychain } from "../src/identity/keychain.mjs";
 import { Pillar } from "../src/pillar.mjs";
 import { loadFleetAddressBook } from "../src/address-book.mjs";
+import { loadTrustPolicy, POLICIES } from "../src/identity/trust.mjs";
+import { parseLinkOffer, isLinkOfferLive, LINK_GRANT_KINDS } from "../src/net/link-offer.mjs";
+import { mintDelegationDoc } from "../src/net/delegation.mjs";
+import { refusalLine } from "../src/net/refusals.mjs";
 
 function parseArgs(argv) {
   const args = { _: [] };
@@ -58,6 +67,19 @@ function loadPillar(args) {
   const carriers = args.carrier
     ? [args.carrier]
     : (process.env.PILLAR_CARRIERS ? process.env.PILLAR_CARRIERS.split(",") : (cfg.carriers ?? []));
+  // Trust gate: --policy overrides trust.json's policy for this invocation.
+  const trust = loadTrustPolicy(home);
+  if (args.policy) {
+    if (!POLICIES.includes(args.policy)) {
+      console.error(`--policy must be one of ${POLICIES.join("|")}`);
+      exit(2);
+    }
+    trust.policy = args.policy;
+  }
+  // Tier grant: <home>/tier-grant.json (issued via `pillar tier issue`) is
+  // attached to carrier delivers — raises budgets at carriers trusting the issuer.
+  const tgPath = join(home, "tier-grant.json");
+  const tierGrant = existsSync(tgPath) ? JSON.parse(readFileSync(tgPath, "utf-8")) : null;
   return new Pillar({
     keychain: kc,
     mailboxPath: mbPath,
@@ -67,6 +89,8 @@ function loadPillar(args) {
     dhtClientMode: cfg.dhtClientMode ?? true,
     carriers,
     enableLibp2p: !(args["carrier-only"] || cfg.carrierOnly === true),
+    trust,
+    tierGrant,
   });
 }
 
@@ -245,6 +269,121 @@ async function cmdSend(args) {
   }
 }
 
+
+// ── delegate ──────────────────────────────────────────────────────────────────
+// The desktop-link ceiling enforced by chat-web (browser-chat-session.ts,
+// LINK_TTL_MS). A grant with a longer window verifies fine and is then DROPPED
+// by the browser without a word, so this side refuses it loudly instead.
+const LINK_TTL_DAYS_MAX = 7;
+
+/**
+ * pillar delegate --to-browser '<uuaid://link/...>'
+ *
+ * Pair a browser tab to THIS pillar identity. The tab publishes an offer
+ * carrying its own freshly minted device key; this mints a delegation naming
+ * that key as delegate and this identity as principal, and sends it as a
+ * `_link` grant to the tab's inbox.
+ *
+ * The persona seed never leaves this machine — only a signed, time-boxed
+ * document does. Identical in every respect to what a phone sends: the
+ * handshake authenticates the PRINCIPAL (the envelope sender must equal the
+ * delegation principal), and never the kind of device the principal runs on.
+ * That is what lets a headless agent hold a desktop.
+ */
+async function cmdDelegate(args) {
+  const offerRaw = typeof args["to-browser"] === "string" ? args["to-browser"] : args._[1];
+  if (!offerRaw || args["to-browser"] === true) {
+    console.error("usage: pillar delegate --to-browser '<uuaid://link/...>' [--ttl-days N] [--name NAME]");
+    console.error("  Paste the offer string the browser shows under its QR code.");
+    exit(2);
+  }
+
+  const offer = parseLinkOffer(offerRaw);
+  if (!offer) {
+    console.error("not a valid link offer. Expected: uuaid://link/<delegate-uuaid>?pk=<64hex>&nonce=<hex>&exp=<iso>");
+    exit(2);
+  }
+  if (!isLinkOfferLive(offer)) {
+    console.error(`offer expired at ${offer.exp} — reload the browser tab for a fresh one`);
+    exit(1);
+  }
+
+  const ttlDays = args["ttl-days"] !== undefined ? Number(args["ttl-days"]) : LINK_TTL_DAYS_MAX;
+  if (!Number.isFinite(ttlDays) || ttlDays <= 0) {
+    console.error("--ttl-days must be a positive number");
+    exit(2);
+  }
+  // Refuse rather than mint a grant the far side discards in silence.
+  if (ttlDays > LINK_TTL_DAYS_MAX) {
+    console.error(`--ttl-days ${ttlDays} exceeds the ${LINK_TTL_DAYS_MAX}-day desktop-link ceiling.`);
+    console.error("A longer grant is a VALID document that the browser drops without reporting why.");
+    exit(2);
+  }
+
+  const p = loadPillar(args);
+  await p.start();
+  try {
+    const me = p.keychain._identity;
+    const delegation = mintDelegationDoc(p.keychain, {
+      delegate: offer.delegate,
+      delegatePublicKey: offer.pk,
+      kinds: [...LINK_GRANT_KINDS], // never "*": that would let the desktop read this identity's inbox
+      ttlDays,
+    });
+
+    // The snapshot's persona MUST equal the delegation principal exactly — the
+    // browser rejects the whole grant on any mismatch, treating a disagreeing
+    // snapshot as evidence that neither half can be trusted.
+    // fleet.json is { fleet: { "<role>": { uuaid, publicKey, ... } } } — keyed by
+    // ROLE, which is also the human-readable name the desktop shows. A row
+    // without a publicKey cannot be sealed to, so it is not a contact.
+    const contacts = [];
+    const fp = fleetPath(args);
+    if (existsSync(fp)) {
+      let fleet = {};
+      try {
+        fleet = JSON.parse(readFileSync(fp, "utf-8")).fleet ?? {};
+      } catch {
+        console.error(`warning: ${fp} is not readable JSON — sending 0 contacts`);
+      }
+      for (const [role, entry] of Object.entries(fleet)) {
+        if (typeof entry?.uuaid !== "string" || typeof entry?.publicKey !== "string") continue;
+        contacts.push({ uuaid: entry.uuaid, publicKey: entry.publicKey, name: String(role) });
+      }
+    }
+
+    const payload = {
+      _link: { v: 1, op: "grant", nonce: offer.nonce },
+      delegation,
+      snapshot: {
+        persona: { uuaid: me.uuaid, publicKey: me.publicKeyHex },
+        displayName: typeof args.name === "string" ? args.name : null,
+        contacts,
+      },
+    };
+
+    const { envelope } = await p.send({
+      recipient: offer.delegate,
+      kind: "message",
+      payload,
+      recipientPublicKey: offer.pk,
+      resolveTimeoutMs: 5000,
+    });
+
+    console.log(`linked ${offer.delegate}`);
+    console.log(`  principal: ${me.uuaid}`);
+    console.log(`  window:    ${delegation.notBefore} -> ${delegation.notAfter} (${ttlDays}d)`);
+    console.log(`  contacts:  ${contacts.length}`);
+    console.log(`  envelope:  ${envelope.id}`);
+    console.log("");
+    console.log("The tab pairs when it polls. If it does not, the grant was refused in");
+    console.log("silence — check the offer is unexpired and unclaimed, and that the tab");
+    console.log("still shows the same QR (a reload rotates the nonce and voids this grant).");
+  } finally {
+    await p.stop();
+  }
+}
+
 async function cmdSendGroup(args) {
   const [groupName, kind, jsonStr] = args._.slice(1);
   if (!groupName || !kind) {
@@ -266,7 +405,7 @@ async function cmdSendGroup(args) {
     let failed = 0;
     for (const r of results) {
       if (r.ok) console.log(`  ✓ ${r.member}  via ${r.via}  ${r.envelopeId}`);
-      else { failed++; console.error(`  ✗ ${r.member}  ${r.error}`); }
+      else { failed++; console.error(`  ✗ ${r.member}  ${refusalLine(r) ?? r.error}`); }
     }
     console.log(`group "${groupName}": ${results.length - failed}/${results.length} delivered`);
     if (failed) exit(1);
@@ -375,7 +514,7 @@ async function cmdRecv(args) {
           await p.send({ recipient: env.sender, recipientPublicKey: senderKey, kind: "reply", payload: { thread, inReplyTo: env.id, status: "error", reason: e.message.slice(0, 300), text: `zestro bridge error: ${e.message.slice(0, 300)}` } });
         }
       }
-    } else if (bridge) {
+    } else if (bridge && env.kind !== "ack" && env.kind !== "reply") {
       try {
         const result = await bridge.sendCommand({ command: JSON.stringify({ kind: env.kind, payload: env.payload, sender: env.sender }) });
         console.log(`  → zestro result: ${JSON.stringify(result).slice(0, 200)}`);
@@ -388,6 +527,10 @@ async function cmdRecv(args) {
           console.error(`  → zestro bridge error: ${e.message}`);
         }
       }
+    } else if (bridge) {
+      // ack/reply are receipts for OUR earlier sends — bridging them would
+      // inject a Zestro agent turn per receipt. Print-only (line above).
+      console.log(`  → zestro: not bridged (kind=${env.kind} is a receipt)`);
     }
   });
 
@@ -397,6 +540,198 @@ async function cmdRecv(args) {
   await new Promise(() => {});
 }
 
+async function cmdInbox(args) {
+  // One-shot mail check for ANY identity: point --home at the pillar dir that
+  // minted the uuaid.  Pulls pending envelopes from the carrier (no long-poll),
+  // prints them decrypted, reports unread backlog, exits.  --notify CMD runs a
+  // shell hook when there is mail (cron/launchd-friendly); --mark-read stamps
+  // read_at on everything printed.
+  args["carrier-only"] = true; // inbox check needs the carrier only — no libp2p listener
+  const p = loadPillar(args);
+  const fresh = [];
+  p.onEnvelope((env) => { fresh.push(env); });
+  await p.start();
+  // Address book BEFORE the drain: the trust "directory" policy needs known
+  // senders loaded, or every fresh envelope counts as a stranger.
+  loadFleetAddressBook(fleetPath(args), p);
+  const pulled = await p.drainCarrierInbox();
+  // fromPublicKey: the sender's verified Ed25519 key (transportSignature —
+  // open() binds it to `from`). Lets a drain-and-reply consumer (the fleet
+  // courier's auto-ack, a bot) seal back to a sender who is NOT in fleet.json
+  // via `pillar send … --to-pubkey <fromPublicKey>`. Additive field.
+  for (const env of fresh) {
+    console.log(JSON.stringify({ new: true, id: env.id, from: env.sender, fromPublicKey: env.transportSignature?.publicKey ?? null, kind: env.kind, at: env.createdAt, payload: env.payload }));
+  }
+  // Backlog: rows stored earlier (e.g. by a recv daemon) but never surfaced.
+  const { decrypt } = await import("../src/net/envelope.mjs");
+  const freshIds = new Set(fresh.map(e => e.id));
+  const backlog = (p.mailbox.inboxUnread?.(500) ?? []).filter(r => !freshIds.has(r.envelope_id));
+  if (args.unread) {
+    for (const row of backlog) {
+      const env = JSON.parse(row.envelope_json);
+      let payload = null;
+      try { payload = decrypt(p.keychain, env); } catch (_e) { payload = { error: "decrypt failed" }; }
+      console.log(JSON.stringify({ new: false, id: env.id, from: env.sender, fromPublicKey: env.transportSignature?.publicKey ?? null, kind: env.kind, at: env.createdAt, payload }));
+    }
+  }
+  const qCount = (p.mailbox.inboxQuarantined?.(500) ?? []).length;
+  console.log(`inbox: ${fresh.length} new, ${backlog.length} older unread${args.unread ? "" : " (--unread to print)"}${qCount ? `, ${qCount} quarantined (pillar trust quarantine)` : ""}`);
+  if (args["mark-read"]) {
+    for (const env of fresh) p.mailbox.markInboxRead?.(env.id);
+    if (args.unread) for (const row of backlog) p.mailbox.markInboxRead?.(row.envelope_id);
+  }
+  if (args.notify && typeof args.notify === "string" && (pulled > 0 || backlog.length > 0)) {
+    const { spawnSync } = await import("node:child_process");
+    const r = spawnSync(args.notify, {
+      shell: true,
+      input: JSON.stringify({ uuaid: p.uuaid, new: pulled, unread: backlog.length }) + "\n",
+      env: { ...process.env, PILLAR_NEW: String(pulled), PILLAR_UNREAD: String(backlog.length), PILLAR_UUAID: p.uuaid },
+      stdio: ["pipe", "inherit", "inherit"],
+    });
+    if (r.status !== 0) console.error(`notify hook exited ${r.status}`);
+  }
+  await p.stop();
+  exit(0);
+}
+
+async function cmdTrust(args) {
+  // pillar trust                          show policy + lists + quarantine count
+  // pillar trust set <open|directory|allowlist>
+  // pillar trust allow|block <uuaid>      add to list (removes from the other)
+  // pillar trust unlist <uuaid>           remove from both lists
+  // pillar trust quarantine [--release ID]  list quarantined mail / release one
+  const home = homePath(args);
+  const tPath = join(home, "trust.json");
+  const t = loadTrustPolicy(home);
+  const sub = args._[1];
+  const save = () => writeFileSync(tPath, JSON.stringify({ policy: t.policy, allow: t.allow, block: t.block }, null, 2));
+  if (!sub) {
+    console.log(`policy: ${t.policy}${t.exists ? "" : " (no trust.json — default)"}`);
+    console.log(`allow (${t.allow.length}):`); for (const u of t.allow) console.log(`  ${u}`);
+    console.log(`block (${t.block.length}):`); for (const u of t.block) console.log(`  ${u}`);
+    const { Mailbox } = await import("../src/mailbox/mailbox.mjs");
+    const mb = new Mailbox(join(home, "mailbox.db"));
+    const q = mb.inboxQuarantined(500);
+    console.log(`quarantined: ${q.length} (pillar trust quarantine to list)`);
+    mb.close();
+    return;
+  }
+  if (sub === "set") {
+    const pol = args._[2];
+    if (!POLICIES.includes(pol)) { console.error(`usage: pillar trust set <${POLICIES.join("|")}>`); exit(2); }
+    t.policy = pol; save();
+    console.log(`policy: ${pol} (${tPath})`);
+    return;
+  }
+  if (sub === "allow" || sub === "block") {
+    const u = args._[2];
+    if (!u?.startsWith("uuaid:")) { console.error(`usage: pillar trust ${sub} <uuaid:...>`); exit(2); }
+    t.allow = t.allow.filter(x => x !== u);
+    t.block = t.block.filter(x => x !== u);
+    t[sub === "allow" ? "allow" : "block"].push(u);
+    save();
+    console.log(`${sub}: ${u}`);
+    return;
+  }
+  if (sub === "unlist") {
+    const u = args._[2];
+    t.allow = t.allow.filter(x => x !== u);
+    t.block = t.block.filter(x => x !== u);
+    save();
+    console.log(`unlisted: ${u}`);
+    return;
+  }
+  if (sub === "quarantine") {
+    const { Mailbox } = await import("../src/mailbox/mailbox.mjs");
+    const mb = new Mailbox(join(home, "mailbox.db"));
+    if (args.release) {
+      mb.db.prepare("update inbox set quarantined = null where envelope_id = ?").run(args.release);
+      console.log(`released: ${args.release} (now visible to pillar inbox --unread)`);
+      mb.close();
+      return;
+    }
+    for (const row of mb.inboxQuarantined(500)) {
+      console.log(JSON.stringify({ id: row.envelope_id, from: row.sender, reason: row.quarantined, at: row.received_at }));
+    }
+    mb.close();
+    return;
+  }
+  console.error("usage: pillar trust [set <policy>|allow <uuaid>|block <uuaid>|unlist <uuaid>|quarantine [--release ID]]");
+  exit(2);
+}
+
+async function cmdTier(args) {
+  // pillar tier                                    show installed grant
+  // pillar tier issue <uuaid> <tier> [--expires ISO] [--rate N] [--max-body N] [--out FILE]
+  //                                                sign a grant with THIS home's key (issuer)
+  // pillar tier install <grant.json>               install a received grant into this home
+  // pillar tier verify <grant.json> --issuer HEX   verify signature/expiry locally
+  const { makeTierGrant, verifyTierGrant, grantFingerprint, TIER_DEFAULTS } =
+    await import("../src/identity/tier.mjs");
+  const home = homePath(args);
+  const sub = args._[1];
+  if (!sub) {
+    const tgPath = join(home, "tier-grant.json");
+    if (!existsSync(tgPath)) { console.log("no tier grant installed (community tier)"); return; }
+    const g = JSON.parse(readFileSync(tgPath, "utf-8"));
+    console.log(`tier: ${g.tier}  rate: ${g.envelopesPerMin}/min  maxBody: ${g.maxBodyBytes}B`);
+    console.log(`subject: ${g.uuaid}`);
+    console.log(`issuer:  ${g.issuer}`);
+    console.log(`expires: ${g.expires}  fingerprint: ${grantFingerprint(g)}`);
+    return;
+  }
+  if (sub === "issue") {
+    const [, , uuaid, tier] = args._;
+    if (!uuaid || !TIER_DEFAULTS[tier]) {
+      console.error(`usage: pillar tier issue <uuaid:...> <${Object.keys(TIER_DEFAULTS).join("|")}> [--expires ISO] [--rate N] [--max-body BYTES] [--out FILE]`);
+      exit(2);
+    }
+    const kc = new Keychain(join(home, "keychain.json"));
+    kc.load({ passphrase: process.env.PILLAR_PASSPHRASE ?? "" });
+    const expires = args.expires ?? new Date(Date.now() + 365 * 86400_000).toISOString();
+    const grant = makeTierGrant(kc, {
+      uuaid, tier, expires,
+      envelopesPerMin: args.rate ? Number(args.rate) : undefined,
+      maxBodyBytes: args["max-body"] ? Number(args["max-body"]) : undefined,
+    });
+    const out = typeof args.out === "string" ? args.out : `tier-grant-${grantFingerprint(grant)}.json`;
+    writeFileSync(out, JSON.stringify(grant, null, 2));
+    console.log(`issued ${tier} grant for ${uuaid}`);
+    console.log(`  rate ${grant.envelopesPerMin}/min, maxBody ${grant.maxBodyBytes}B, expires ${expires}`);
+    console.log(`  issuer ${grant.issuer}`);
+    console.log(`  -> ${out} (send to the grantee; they run: pillar tier install ${out})`);
+    return;
+  }
+  if (sub === "install") {
+    const file = args._[2];
+    if (!file || !existsSync(file)) { console.error("usage: pillar tier install <grant.json>"); exit(2); }
+    const g = JSON.parse(readFileSync(file, "utf-8"));
+    const kc = new Keychain(join(home, "keychain.json"));
+    kc.load({ passphrase: process.env.PILLAR_PASSPHRASE ?? "" });
+    if (g.uuaid !== kc._identity.uuaid) {
+      console.error(`grant subject ${g.uuaid} != this home's identity ${kc._identity.uuaid}`);
+      exit(1);
+    }
+    const v = verifyTierGrant(g, [g.issuer]); // structural check (sig by named issuer, expiry, ceilings)
+    if (!v.ok) { console.error(`grant invalid: ${v.reason}`); exit(1); }
+    writeFileSync(join(home, "tier-grant.json"), JSON.stringify(g, null, 2));
+    console.log(`installed ${g.tier} grant (fingerprint ${grantFingerprint(g)}) — sent with every carrier deliver`);
+    console.log(`note: budgets rise only at carriers that trust issuer ${g.issuer.slice(0, 16)}…`);
+    return;
+  }
+  if (sub === "verify") {
+    const file = args._[2];
+    const issuer = args.issuer;
+    if (!file || !existsSync(file) || !issuer) { console.error("usage: pillar tier verify <grant.json> --issuer HEX"); exit(2); }
+    const g = JSON.parse(readFileSync(file, "utf-8"));
+    const v = verifyTierGrant(g, [String(issuer)]);
+    console.log(v.ok ? `VALID: ${g.tier} for ${g.uuaid} until ${g.expires}` : `INVALID: ${v.reason}`);
+    exit(v.ok ? 0 : 1);
+  }
+  console.error("usage: pillar tier [issue|install|verify]");
+  exit(2);
+}
+
 async function cmdPeers(args) {
   const p = loadPillar(args);
   await p.start();
@@ -416,11 +751,17 @@ async function main() {
     case "send-group": return cmdSendGroup(args);
     case "groups": return cmdGroups(args);
     case "recv":  return cmdRecv(args);
+    case "inbox": return cmdInbox(args);
+    case "trust": return cmdTrust(args);
+    case "tier":  return cmdTier(args);
     case "peers": return cmdPeers(args);
+    case "delegate": return cmdDelegate(args);
     default:
-      console.error(`usage: pillar <init|id|send|send-group|groups|recv|peers> [--home DIR]`);
+      console.error(`usage: pillar <init|id|send|send-group|groups|recv|inbox|trust|tier|peers|delegate> [--home DIR]`);
       exit(2);
   }
 }
 
-main().catch(e => { console.error(e); exit(1); });
+// A carrier or broker refusal prints one line, `<code>: <fix>` (src/net/refusals.mjs);
+// anything else keeps the full error.
+main().catch(e => { console.error(refusalLine(e) ?? e); exit(1); });

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@uuaid/pillar",
-  "version": "0.2.0-alpha.8",
-  "description": "IAASO-3050 reference implementation. Every agent runs its own PDP pillar, discovers peers via a Kademlia DHT, and exchanges cryptographically signed + Noise-encrypted messages over libp2p. One command to install and join the network.",
+  "version": "2.0.1",
+  "description": "Pillar (Protocol for Inter-agent Linked Ledger And Relay) \u2014 the secure delivery layer of UACP, the Universal Agent Communication Protocol. UACP = UUAID (identity) + Envelope (signed, encrypted container) + Pillar (relay, mailbox, routing, store-and-forward). Reference implementation of the UACP delivery layer; includes VDA-1 (IAASO-3901, in ballot) delivery attestation and a blind escrow for the Zilligon ZGN / EVM rails.",
   "license": "Apache-2.0",
   "type": "module",
   "main": "src/index.mjs",
@@ -10,29 +10,52 @@
     "pillar-carrier": "bin/carrier.mjs",
     "pillar-ask": "bin/pillar-ask.mjs",
     "pillar-responder": "bin/pillar-responder.mjs",
-    "pillar-seed": "bin/pillar-seed.mjs"
+    "pillar-seed": "bin/pillar-seed.mjs",
+    "pillar-directory": "bin/pillar-directory.mjs",
+    "pillar-escrow": "bin/pillar-escrow.mjs",
+    "pillar-blob": "bin/pillar-blob.mjs"
   },
   "exports": {
-    ".": "./src/index.mjs"
+    ".": "./src/index.mjs",
+    "./keychain": "./src/identity/keychain.mjs",
+    "./jcs": "./src/identity/jcs.mjs",
+    "./tier": "./src/identity/tier.mjs",
+    "./envelope": "./src/net/envelope.mjs",
+    "./delegation": "./src/net/delegation.mjs",
+    "./e2e": "./src/crypto/e2e.mjs",
+    "./carrier-client": "./src/net/carrier-client.mjs",
+    "./seed-tier": "./src/net/seed-tier.mjs",
+    "./seed-registry": "./src/net/seed-registry.mjs",
+    "./blob": "./src/blob/blob.mjs",
+    "./blob/http": "./src/blob/http.mjs",
+    "./blob/store": "./src/blob/store.mjs",
+    "./blob/broker": "./src/blob/broker.mjs",
+    "./refusals": "./src/net/refusals.mjs",
+    "./package.json": "./package.json"
   },
   "files": [
     "src",
     "bin",
     "README.md",
     "INTERACTION-CONVENTION.md",
+    "HOSTING-LIMITS.md",
     "LICENSE"
   ],
   "scripts": {
     "test": "node --test --test-reporter spec test/unit/*.test.mjs",
     "test:int": "node --test --test-reporter spec test/integration/*.test.mjs",
     "test:chaos": "node --test --test-reporter spec test/chaos/*.test.mjs",
-    "test:all": "node --test --test-reporter spec test/unit/*.test.mjs test/integration/*.test.mjs test/chaos/*.test.mjs"
+    "test:all": "node --test --test-reporter spec test/unit/*.test.mjs test/integration/*.test.mjs test/chaos/*.test.mjs",
+    "preflight": "node scripts/preflight-publish.mjs",
+    "prepublishOnly": "node scripts/preflight-publish.mjs",
+    "postpublish": "node scripts/verify-publish.mjs"
   },
   "engines": {
-    "node": ">=20"
+    "node": ">=22"
   },
   "dependencies": {
     "@chainsafe/libp2p-noise": "^17.0.0",
+    "@noble/hashes": "^2.3.0",
     "@chainsafe/libp2p-yamux": "^8.0.1",
     "@libp2p/autonat": "^3.0.26",
     "@libp2p/bootstrap": "^12.0.29",
@@ -48,7 +71,7 @@
     "@libp2p/websockets": "^10.1.19",
     "@multiformats/multiaddr": "^13.0.3",
     "@noble/curves": "^2.3.0",
-    "better-sqlite3": "^11.10.0",
+    "better-sqlite3": "^12.11.1",
     "it-pipe": "^3.0.1",
     "it-pushable": "^3.2.4",
     "libp2p": "^3.3.8",