@xtr-dev/rondevu-server 0.5.13 → 0.5.15

package/dist/index.js

@@ -29,320 +29,6 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 
-// src/crypto.ts
-var crypto_exports = {};
-__export(crypto_exports, {
-  buildSignatureMessage: () => buildSignatureMessage,
-  decryptSecret: () => decryptSecret,
-  encryptSecret: () => encryptSecret,
-  generateCredentialName: () => generateCredentialName,
-  generateSecret: () => generateSecret,
-  generateSignature: () => generateSignature,
-  validateTag: () => validateTag,
-  validateTags: () => validateTags,
-  validateUsername: () => validateUsername,
-  verifySignature: () => verifySignature
-});
-function generateCredentialName() {
-  const adjectives = [
-    "brave",
-    "calm",
-    "eager",
-    "fancy",
-    "gentle",
-    "happy",
-    "jolly",
-    "kind",
-    "lively",
-    "merry",
-    "nice",
-    "proud",
-    "quiet",
-    "swift",
-    "witty",
-    "young",
-    "bright",
-    "clever",
-    "daring",
-    "fair",
-    "grand",
-    "humble",
-    "noble",
-    "quick"
-  ];
-  const nouns = [
-    "tiger",
-    "eagle",
-    "river",
-    "mountain",
-    "ocean",
-    "forest",
-    "desert",
-    "valley",
-    "thunder",
-    "wind",
-    "fire",
-    "stone",
-    "cloud",
-    "star",
-    "moon",
-    "sun",
-    "wolf",
-    "bear",
-    "hawk",
-    "lion",
-    "fox",
-    "deer",
-    "owl",
-    "swan"
-  ];
-  const adjective = adjectives[Math.floor(Math.random() * adjectives.length)];
-  const noun = nouns[Math.floor(Math.random() * nouns.length)];
-  const random = crypto.getRandomValues(new Uint8Array(8));
-  const hex = Array.from(random).map((b) => b.toString(16).padStart(2, "0")).join("");
-  return `${adjective}-${noun}-${hex}`;
-}
-function generateSecret() {
-  const bytes = crypto.getRandomValues(new Uint8Array(32));
-  const secret = Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
-  if (secret.length !== 64) {
-    throw new Error("Secret generation failed: invalid length");
-  }
-  for (let i = 0; i < secret.length; i++) {
-    const c = secret[i];
-    if ((c < "0" || c > "9") && (c < "a" || c > "f")) {
-      throw new Error(`Secret generation failed: invalid hex character at position ${i}: '${c}'`);
-    }
-  }
-  return secret;
-}
-function hexToBytes(hex) {
-  if (hex.length % 2 !== 0) {
-    throw new Error("Hex string must have even length");
-  }
-  for (let i = 0; i < hex.length; i++) {
-    const c = hex[i].toLowerCase();
-    if ((c < "0" || c > "9") && (c < "a" || c > "f")) {
-      throw new Error(`Invalid hex character at position ${i}: '${hex[i]}'`);
-    }
-  }
-  const match = hex.match(/.{1,2}/g);
-  if (!match) {
-    throw new Error("Invalid hex string format");
-  }
-  return new Uint8Array(match.map((byte) => {
-    const parsed = parseInt(byte, 16);
-    if (isNaN(parsed)) {
-      throw new Error(`Invalid hex byte: ${byte}`);
-    }
-    return parsed;
-  }));
-}
-async function encryptSecret(secret, masterKeyHex) {
-  if (!masterKeyHex || masterKeyHex.length !== 64) {
-    throw new Error("Master key must be 64-character hex string (32 bytes)");
-  }
-  const keyBytes = hexToBytes(masterKeyHex);
-  const key = await crypto.subtle.importKey(
-    "raw",
-    keyBytes,
-    { name: "AES-GCM", length: 256 },
-    false,
-    ["encrypt"]
-  );
-  const iv = crypto.getRandomValues(new Uint8Array(12));
-  const encoder = new TextEncoder();
-  const secretBytes = encoder.encode(secret);
-  const ciphertext = await crypto.subtle.encrypt(
-    { name: "AES-GCM", iv, tagLength: 128 },
-    key,
-    secretBytes
-  );
-  const ivHex = Array.from(iv).map((b) => b.toString(16).padStart(2, "0")).join("");
-  const ciphertextHex = Array.from(new Uint8Array(ciphertext)).map((b) => b.toString(16).padStart(2, "0")).join("");
-  return `${ivHex}:${ciphertextHex}`;
-}
-async function decryptSecret(encryptedSecret, masterKeyHex) {
-  if (!masterKeyHex || masterKeyHex.length !== 64) {
-    throw new Error("Master key must be 64-character hex string (32 bytes)");
-  }
-  const parts = encryptedSecret.split(":");
-  if (parts.length !== 2) {
-    throw new Error("Invalid encrypted secret format (expected iv:ciphertext)");
-  }
-  const [ivHex, ciphertextHex] = parts;
-  if (ivHex.length !== 24) {
-    throw new Error("Invalid IV length (expected 12 bytes = 24 hex characters)");
-  }
-  if (ciphertextHex.length < 32) {
-    throw new Error("Invalid ciphertext length (must include 16-byte auth tag)");
-  }
-  const iv = hexToBytes(ivHex);
-  const ciphertext = hexToBytes(ciphertextHex);
-  const keyBytes = hexToBytes(masterKeyHex);
-  const key = await crypto.subtle.importKey(
-    "raw",
-    keyBytes,
-    { name: "AES-GCM", length: 256 },
-    false,
-    ["decrypt"]
-  );
-  const decryptedBytes = await crypto.subtle.decrypt(
-    { name: "AES-GCM", iv, tagLength: 128 },
-    key,
-    ciphertext
-  );
-  const decoder = new TextDecoder();
-  return decoder.decode(decryptedBytes);
-}
-async function generateSignature(secret, message) {
-  const secretBytes = hexToBytes(secret);
-  const key = await crypto.subtle.importKey(
-    "raw",
-    secretBytes,
-    { name: "HMAC", hash: "SHA-256" },
-    false,
-    ["sign"]
-  );
-  const encoder = new TextEncoder();
-  const messageBytes = encoder.encode(message);
-  const signatureBytes = await crypto.subtle.sign("HMAC", key, messageBytes);
-  return import_node_buffer.Buffer.from(signatureBytes).toString("base64");
-}
-async function verifySignature(secret, message, signature) {
-  try {
-    const secretBytes = hexToBytes(secret);
-    const key = await crypto.subtle.importKey(
-      "raw",
-      secretBytes,
-      { name: "HMAC", hash: "SHA-256" },
-      false,
-      ["verify"]
-    );
-    const encoder = new TextEncoder();
-    const messageBytes = encoder.encode(message);
-    const signatureBytes = import_node_buffer.Buffer.from(signature, "base64");
-    return await crypto.subtle.verify("HMAC", key, signatureBytes, messageBytes);
-  } catch (error) {
-    console.error("Signature verification error:", error);
-    return false;
-  }
-}
-function canonicalJSON(obj, depth = 0) {
-  const MAX_DEPTH = 100;
-  if (depth > MAX_DEPTH) {
-    throw new Error("Object nesting too deep for canonicalization");
-  }
-  if (obj === null) return "null";
-  if (obj === void 0) return JSON.stringify(void 0);
-  const type = typeof obj;
-  if (type === "function") throw new Error("Functions are not supported in RPC parameters");
-  if (type === "symbol" || type === "bigint") throw new Error(`${type} is not supported in RPC parameters`);
-  if (type === "number" && !Number.isFinite(obj)) throw new Error("NaN and Infinity are not supported in RPC parameters");
-  if (type !== "object") return JSON.stringify(obj);
-  if (Array.isArray(obj)) {
-    return "[" + obj.map((item) => canonicalJSON(item, depth + 1)).join(",") + "]";
-  }
-  const sortedKeys = Object.keys(obj).sort();
-  const pairs = sortedKeys.map((key) => JSON.stringify(key) + ":" + canonicalJSON(obj[key], depth + 1));
-  return "{" + pairs.join(",") + "}";
-}
-function buildSignatureMessage(timestamp, nonce, method, params) {
-  if (nonce.length !== 36) {
-    throw new Error("Nonce must be a valid UUID v4 (use crypto.randomUUID())");
-  }
-  if (nonce[8] !== "-" || nonce[13] !== "-" || nonce[18] !== "-" || nonce[23] !== "-") {
-    throw new Error("Nonce must be a valid UUID v4 (use crypto.randomUUID())");
-  }
-  if (nonce[14] !== "4") {
-    throw new Error("Nonce must be a valid UUID v4 (use crypto.randomUUID())");
-  }
-  const variant = nonce[19].toLowerCase();
-  if (variant !== "8" && variant !== "9" && variant !== "a" && variant !== "b") {
-    throw new Error("Nonce must be a valid UUID v4 (use crypto.randomUUID())");
-  }
-  const hexChars = nonce.replace(/-/g, "");
-  for (let i = 0; i < hexChars.length; i++) {
-    const c = hexChars[i].toLowerCase();
-    if ((c < "0" || c > "9") && (c < "a" || c > "f")) {
-      throw new Error("Nonce must be a valid UUID v4 (use crypto.randomUUID())");
-    }
-  }
-  const paramsStr = canonicalJSON(params || {});
-  return `${timestamp}:${nonce}:${method}:${paramsStr}`;
-}
-function validateUsername(username) {
-  if (typeof username !== "string") {
-    return { valid: false, error: "Username must be a string" };
-  }
-  if (username.length < USERNAME_MIN_LENGTH) {
-    return { valid: false, error: `Username must be at least ${USERNAME_MIN_LENGTH} characters` };
-  }
-  if (username.length > USERNAME_MAX_LENGTH) {
-    return { valid: false, error: `Username must be at most ${USERNAME_MAX_LENGTH} characters` };
-  }
-  if (!USERNAME_REGEX.test(username)) {
-    return { valid: false, error: "Username must be lowercase alphanumeric with optional dashes/periods, and start/end with alphanumeric" };
-  }
-  return { valid: true };
-}
-function validateTag(tag) {
-  if (typeof tag !== "string") {
-    return { valid: false, error: "Tag must be a string" };
-  }
-  if (tag.length < TAG_MIN_LENGTH) {
-    return { valid: false, error: `Tag must be at least ${TAG_MIN_LENGTH} character` };
-  }
-  if (tag.length > TAG_MAX_LENGTH) {
-    return { valid: false, error: `Tag must be at most ${TAG_MAX_LENGTH} characters` };
-  }
-  if (tag.length === 1) {
-    if (!/^[a-z0-9]$/.test(tag)) {
-      return { valid: false, error: "Tag must be lowercase alphanumeric" };
-    }
-    return { valid: true };
-  }
-  if (!TAG_REGEX.test(tag)) {
-    return { valid: false, error: "Tag must be lowercase alphanumeric with optional dots/dashes, and start/end with alphanumeric" };
-  }
-  return { valid: true };
-}
-function validateTags(tags, maxTags = 20) {
-  if (!Array.isArray(tags)) {
-    return { valid: false, error: "Tags must be an array" };
-  }
-  if (tags.length === 0) {
-    return { valid: false, error: "At least one tag is required" };
-  }
-  if (tags.length > maxTags) {
-    return { valid: false, error: `Maximum ${maxTags} tags allowed` };
-  }
-  for (let i = 0; i < tags.length; i++) {
-    const result = validateTag(tags[i]);
-    if (!result.valid) {
-      return { valid: false, error: `Tag ${i + 1}: ${result.error}` };
-    }
-  }
-  const uniqueTags = new Set(tags);
-  if (uniqueTags.size !== tags.length) {
-    return { valid: false, error: "Duplicate tags are not allowed" };
-  }
-  return { valid: true };
-}
-var import_node_buffer, USERNAME_REGEX, USERNAME_MIN_LENGTH, USERNAME_MAX_LENGTH, TAG_MIN_LENGTH, TAG_MAX_LENGTH, TAG_REGEX;
-var init_crypto = __esm({
-  "src/crypto.ts"() {
-    "use strict";
-    import_node_buffer = require("node:buffer");
-    USERNAME_REGEX = /^[a-z0-9][a-z0-9.-]*[a-z0-9]$/;
-    USERNAME_MIN_LENGTH = 4;
-    USERNAME_MAX_LENGTH = 32;
-    TAG_MIN_LENGTH = 1;
-    TAG_MAX_LENGTH = 64;
-    TAG_REGEX = /^[a-z0-9]([a-z0-9.-]*[a-z0-9])?$/;
-  }
-});
-
 // src/storage/hash-id.ts
 async function generateOfferHash(sdp) {
   const randomBytes = crypto.getRandomValues(new Uint8Array(8));
@@ -371,31 +57,28 @@ var memory_exports = {};
 __export(memory_exports, {
   MemoryStorage: () => MemoryStorage
 });
-var YEAR_IN_MS, MemoryStorage;
+var MemoryStorage;
 var init_memory = __esm({
   "src/storage/memory.ts"() {
     "use strict";
     init_hash_id();
-    YEAR_IN_MS = 365 * 24 * 60 * 60 * 1e3;
     MemoryStorage = class {
-      constructor(masterEncryptionKey) {
+      constructor() {
         // Primary storage
-        this.credentials = /* @__PURE__ */ new Map();
         this.offers = /* @__PURE__ */ new Map();
         this.iceCandidates = /* @__PURE__ */ new Map();
         // offerId → candidates
         this.rateLimits = /* @__PURE__ */ new Map();
         this.nonces = /* @__PURE__ */ new Map();
         // Secondary indexes for efficient lookups
-        this.offersByUsername = /* @__PURE__ */ new Map();
-        // username → offer IDs
+        this.offersByPublicKey = /* @__PURE__ */ new Map();
+        // publicKey → offer IDs
         this.offersByTag = /* @__PURE__ */ new Map();
         // tag → offer IDs
         this.offersByAnswerer = /* @__PURE__ */ new Map();
-        // answerer username → offer IDs
+        // answerer publicKey → offer IDs
         // Auto-increment counter for ICE candidates
         this.iceCandidateIdCounter = 0;
-        this.masterEncryptionKey = masterEncryptionKey;
       }
       // ===== Offer Management =====
       async createOffers(offers) {
@@ -405,7 +88,7 @@ var init_memory = __esm({
           const id = request.id || await generateOfferHash(request.sdp);
           const offer = {
             id,
-            username: request.username,
+            publicKey: request.publicKey,
             tags: request.tags,
             sdp: request.sdp,
             createdAt: now,
@@ -413,10 +96,10 @@ var init_memory = __esm({
             lastSeen: now
           };
           this.offers.set(id, offer);
-          if (!this.offersByUsername.has(request.username)) {
-            this.offersByUsername.set(request.username, /* @__PURE__ */ new Set());
+          if (!this.offersByPublicKey.has(request.publicKey)) {
+            this.offersByPublicKey.set(request.publicKey, /* @__PURE__ */ new Set());
           }
-          this.offersByUsername.get(request.username).add(id);
+          this.offersByPublicKey.get(request.publicKey).add(id);
           for (const tag of request.tags) {
             if (!this.offersByTag.has(tag)) {
               this.offersByTag.set(tag, /* @__PURE__ */ new Set());
@@ -427,9 +110,9 @@ var init_memory = __esm({
         }
         return created;
       }
-      async getOffersByUsername(username) {
+      async getOffersByPublicKey(publicKey) {
         const now = Date.now();
-        const offerIds = this.offersByUsername.get(username);
+        const offerIds = this.offersByPublicKey.get(publicKey);
         if (!offerIds) return [];
         const offers = [];
         for (const id of offerIds) {
@@ -447,9 +130,9 @@ var init_memory = __esm({
         }
         return offer;
       }
-      async deleteOffer(offerId, ownerUsername) {
+      async deleteOffer(offerId, ownerPublicKey) {
         const offer = this.offers.get(offerId);
-        if (!offer || offer.username !== ownerUsername) {
+        if (!offer || offer.publicKey !== ownerPublicKey) {
           return false;
         }
         this.removeOfferFromIndexes(offer);
@@ -469,41 +152,41 @@ var init_memory = __esm({
         }
         return count;
       }
-      async answerOffer(offerId, answererUsername, answerSdp, matchedTags) {
+      async answerOffer(offerId, answererPublicKey, answerSdp, matchedTags) {
         const offer = await this.getOfferById(offerId);
         if (!offer) {
           return { success: false, error: "Offer not found or expired" };
         }
-        if (offer.answererUsername) {
+        if (offer.answererPublicKey) {
           return { success: false, error: "Offer already answered" };
         }
         const now = Date.now();
-        offer.answererUsername = answererUsername;
+        offer.answererPublicKey = answererPublicKey;
         offer.answerSdp = answerSdp;
         offer.answeredAt = now;
         offer.matchedTags = matchedTags;
-        if (!this.offersByAnswerer.has(answererUsername)) {
-          this.offersByAnswerer.set(answererUsername, /* @__PURE__ */ new Set());
+        if (!this.offersByAnswerer.has(answererPublicKey)) {
+          this.offersByAnswerer.set(answererPublicKey, /* @__PURE__ */ new Set());
         }
-        this.offersByAnswerer.get(answererUsername).add(offerId);
+        this.offersByAnswerer.get(answererPublicKey).add(offerId);
         return { success: true };
       }
-      async getAnsweredOffers(offererUsername) {
+      async getAnsweredOffers(offererPublicKey) {
         const now = Date.now();
-        const offerIds = this.offersByUsername.get(offererUsername);
+        const offerIds = this.offersByPublicKey.get(offererPublicKey);
         if (!offerIds) return [];
         const offers = [];
         for (const id of offerIds) {
           const offer = this.offers.get(id);
-          if (offer && offer.answererUsername && offer.expiresAt > now) {
+          if (offer && offer.answererPublicKey && offer.expiresAt > now) {
             offers.push(offer);
           }
         }
         return offers.sort((a, b) => (b.answeredAt || 0) - (a.answeredAt || 0));
       }
-      async getOffersAnsweredBy(answererUsername) {
+      async getOffersAnsweredBy(answererPublicKey) {
         const now = Date.now();
-        const offerIds = this.offersByAnswerer.get(answererUsername);
+        const offerIds = this.offersByAnswerer.get(answererPublicKey);
         if (!offerIds) return [];
         const offers = [];
         for (const id of offerIds) {
@@ -515,7 +198,7 @@ var init_memory = __esm({
         return offers.sort((a, b) => (b.answeredAt || 0) - (a.answeredAt || 0));
       }
       // ===== Discovery =====
-      async discoverOffers(tags, excludeUsername, limit, offset) {
+      async discoverOffers(tags, excludePublicKey, limit, offset) {
         if (tags.length === 0) return [];
         const now = Date.now();
         const matchingOfferIds = /* @__PURE__ */ new Set();
@@ -530,14 +213,14 @@ var init_memory = __esm({
         const offers = [];
         for (const id of matchingOfferIds) {
           const offer = this.offers.get(id);
-          if (offer && offer.expiresAt > now && !offer.answererUsername && (!excludeUsername || offer.username !== excludeUsername)) {
+          if (offer && offer.expiresAt > now && !offer.answererPublicKey && (!excludePublicKey || offer.publicKey !== excludePublicKey)) {
             offers.push(offer);
           }
         }
         offers.sort((a, b) => b.createdAt - a.createdAt);
         return offers.slice(offset, offset + limit);
       }
-      async getRandomOffer(tags, excludeUsername) {
+      async getRandomOffer(tags, excludePublicKey) {
         if (tags.length === 0) return null;
         const now = Date.now();
         const matchingOffers = [];
@@ -552,7 +235,7 @@ var init_memory = __esm({
         }
         for (const id of matchingOfferIds) {
           const offer = this.offers.get(id);
-          if (offer && offer.expiresAt > now && !offer.answererUsername && (!excludeUsername || offer.username !== excludeUsername)) {
+          if (offer && offer.expiresAt > now && !offer.answererPublicKey && (!excludePublicKey || offer.publicKey !== excludePublicKey)) {
             matchingOffers.push(offer);
           }
         }
@@ -561,7 +244,7 @@ var init_memory = __esm({
         return matchingOffers[randomIndex];
       }
       // ===== ICE Candidate Management =====
-      async addIceCandidates(offerId, username, role, candidates) {
+      async addIceCandidates(offerId, publicKey, role, candidates) {
         const baseTimestamp = Date.now();
         if (!this.iceCandidates.has(offerId)) {
           this.iceCandidates.set(offerId, []);
@@ -571,7 +254,7 @@ var init_memory = __esm({
           const candidate = {
             id: ++this.iceCandidateIdCounter,
             offerId,
-            username,
+            publicKey,
             role,
             candidate: candidates[i],
             createdAt: baseTimestamp + i
@@ -584,7 +267,7 @@ var init_memory = __esm({
         const candidates = this.iceCandidates.get(offerId) || [];
         return candidates.filter((c) => c.role === targetRole && (since === void 0 || c.createdAt > since)).sort((a, b) => a.createdAt - b.createdAt);
       }
-      async getIceCandidatesForMultipleOffers(offerIds, username, since) {
+      async getIceCandidatesForMultipleOffers(offerIds, publicKey, since) {
         const result = /* @__PURE__ */ new Map();
         if (offerIds.length === 0) return result;
         if (offerIds.length > 1e3) {
@@ -594,8 +277,8 @@ var init_memory = __esm({
           const offer = this.offers.get(offerId);
           if (!offer) continue;
           const candidates = this.iceCandidates.get(offerId) || [];
-          const isOfferer = offer.username === username;
-          const isAnswerer = offer.answererUsername === username;
+          const isOfferer = offer.publicKey === publicKey;
+          const isAnswerer = offer.answererPublicKey === publicKey;
           if (!isOfferer && !isAnswerer) continue;
           const targetRole = isOfferer ? "answerer" : "offerer";
           const filteredCandidates = candidates.filter((c) => c.role === targetRole && (since === void 0 || c.createdAt > since)).sort((a, b) => a.createdAt - b.createdAt);
@@ -605,79 +288,6 @@ var init_memory = __esm({
         }
         return result;
       }
-      // ===== Credential Management =====
-      async generateCredentials(request) {
-        const now = Date.now();
-        const expiresAt = request.expiresAt || now + YEAR_IN_MS;
-        const { generateCredentialName: generateCredentialName2, generateSecret: generateSecret2, encryptSecret: encryptSecret2 } = await Promise.resolve().then(() => (init_crypto(), crypto_exports));
-        let name;
-        if (request.name) {
-          if (this.credentials.has(request.name)) {
-            throw new Error("Username already taken");
-          }
-          name = request.name;
-        } else {
-          let attempts = 0;
-          const maxAttempts = 100;
-          while (attempts < maxAttempts) {
-            name = generateCredentialName2();
-            if (!this.credentials.has(name)) break;
-            attempts++;
-          }
-          if (attempts >= maxAttempts) {
-            throw new Error(`Failed to generate unique credential name after ${maxAttempts} attempts`);
-          }
-        }
-        const secret = generateSecret2();
-        const encryptedSecret = await encryptSecret2(secret, this.masterEncryptionKey);
-        const credential = {
-          name,
-          secret: encryptedSecret,
-          createdAt: now,
-          expiresAt,
-          lastUsed: now
-        };
-        this.credentials.set(name, credential);
-        return {
-          ...credential,
-          secret
-          // Return plaintext, not encrypted
-        };
-      }
-      async getCredential(name) {
-        const credential = this.credentials.get(name);
-        if (!credential || credential.expiresAt <= Date.now()) {
-          return null;
-        }
-        try {
-          const { decryptSecret: decryptSecret2 } = await Promise.resolve().then(() => (init_crypto(), crypto_exports));
-          const decryptedSecret = await decryptSecret2(credential.secret, this.masterEncryptionKey);
-          return {
-            ...credential,
-            secret: decryptedSecret
-          };
-        } catch (error) {
-          console.error(`Failed to decrypt secret for credential '${name}':`, error);
-          return null;
-        }
-      }
-      async updateCredentialUsage(name, lastUsed, expiresAt) {
-        const credential = this.credentials.get(name);
-        if (credential) {
-          credential.lastUsed = lastUsed;
-          credential.expiresAt = expiresAt;
-        }
-      }
-      async deleteExpiredCredentials(now) {
-        let count = 0;
-        for (const [name, credential] of this.credentials) {
-          if (credential.expiresAt < now) {
-            this.credentials.delete(name);
-            count++;
-          }
-        }
-        return count;
-      }
       // ===== Rate Limiting =====
       async checkRateLimit(identifier, limit, windowMs) {
         const now = Date.now();
@@ -721,12 +331,11 @@ var init_memory = __esm({
         return count;
       }
       async close() {
-        this.credentials.clear();
         this.offers.clear();
         this.iceCandidates.clear();
         this.rateLimits.clear();
         this.nonces.clear();
-        this.offersByUsername.clear();
+        this.offersByPublicKey.clear();
         this.offersByTag.clear();
         this.offersByAnswerer.clear();
       }
@@ -734,24 +343,21 @@ var init_memory = __esm({
       async getOfferCount() {
         return this.offers.size;
       }
-      async getOfferCountByUsername(username) {
-        const offerIds = this.offersByUsername.get(username);
+      async getOfferCountByPublicKey(publicKey) {
+        const offerIds = this.offersByPublicKey.get(publicKey);
         return offerIds ? offerIds.size : 0;
       }
-      async getCredentialCount() {
-        return this.credentials.size;
-      }
       async getIceCandidateCount(offerId) {
         const candidates = this.iceCandidates.get(offerId);
         return candidates ? candidates.length : 0;
       }
       // ===== Helper Methods =====
       removeOfferFromIndexes(offer) {
-        const usernameOffers = this.offersByUsername.get(offer.username);
-        if (usernameOffers) {
-          usernameOffers.delete(offer.id);
-          if (usernameOffers.size === 0) {
-            this.offersByUsername.delete(offer.username);
+        const publicKeyOffers = this.offersByPublicKey.get(offer.publicKey);
+        if (publicKeyOffers) {
+          publicKeyOffers.delete(offer.id);
+          if (publicKeyOffers.size === 0) {
+            this.offersByPublicKey.delete(offer.publicKey);
           }
         }
         for (const tag of offer.tags) {
@@ -763,12 +369,12 @@ var init_memory = __esm({
             }
           }
         }
-        if (offer.answererUsername) {
-          const answererOffers = this.offersByAnswerer.get(offer.answererUsername);
+        if (offer.answererPublicKey) {
+          const answererOffers = this.offersByAnswerer.get(offer.answererPublicKey);
           if (answererOffers) {
             answererOffers.delete(offer.id);
             if (answererOffers.size === 0) {
-              this.offersByAnswerer.delete(offer.answererUsername);
+              this.offersByAnswerer.delete(offer.answererPublicKey);
             }
           }
         }
@@ -782,54 +388,63 @@ var sqlite_exports = {};
 __export(sqlite_exports, {
   SQLiteStorage: () => SQLiteStorage
 });
-var import_better_sqlite3, YEAR_IN_MS2, SQLiteStorage;
+var import_better_sqlite3, SQLiteStorage;
 var init_sqlite = __esm({
   "src/storage/sqlite.ts"() {
     "use strict";
     import_better_sqlite3 = __toESM(require("better-sqlite3"));
     init_hash_id();
-    YEAR_IN_MS2 = 365 * 24 * 60 * 60 * 1e3;
     SQLiteStorage = class {
       /**
        * Creates a new SQLite storage instance
        * @param path Path to SQLite database file, or ':memory:' for in-memory database
-       * @param masterEncryptionKey 64-char hex string for encrypting secrets (32 bytes)
        */
-      constructor(path = ":memory:", masterEncryptionKey) {
+      constructor(path = ":memory:") {
         this.db = new import_better_sqlite3.default(path);
-        this.masterEncryptionKey = masterEncryptionKey;
         this.initializeDatabase();
       }
       /**
-       * Initializes database schema with tags-based offers
+       * Initializes database schema with Ed25519 public key identity
        */
       initializeDatabase() {
         this.db.exec(`
+      -- Identities table (Ed25519 public key as identity)
+      CREATE TABLE IF NOT EXISTS identities (
+        public_key TEXT PRIMARY KEY,
+        created_at INTEGER NOT NULL,
+        expires_at INTEGER NOT NULL,
+        last_used INTEGER NOT NULL,
+        CHECK(length(public_key) = 64)
+      );
+
+      CREATE INDEX IF NOT EXISTS idx_identities_expires ON identities(expires_at);
+
       -- WebRTC signaling offers with tags
       CREATE TABLE IF NOT EXISTS offers (
         id TEXT PRIMARY KEY,
-        username TEXT NOT NULL,
+        public_key TEXT NOT NULL,
         tags TEXT NOT NULL,
         sdp TEXT NOT NULL,
         created_at INTEGER NOT NULL,
         expires_at INTEGER NOT NULL,
         last_seen INTEGER NOT NULL,
-        answerer_username TEXT,
+        answerer_public_key TEXT,
         answer_sdp TEXT,
         answered_at INTEGER,
-        matched_tags TEXT
+        matched_tags TEXT,
+        FOREIGN KEY (public_key) REFERENCES identities(public_key) ON DELETE CASCADE
       );
 
-      CREATE INDEX IF NOT EXISTS idx_offers_username ON offers(username);
+      CREATE INDEX IF NOT EXISTS idx_offers_public_key ON offers(public_key);
       CREATE INDEX IF NOT EXISTS idx_offers_expires ON offers(expires_at);
       CREATE INDEX IF NOT EXISTS idx_offers_last_seen ON offers(last_seen);
-      CREATE INDEX IF NOT EXISTS idx_offers_answerer ON offers(answerer_username);
+      CREATE INDEX IF NOT EXISTS idx_offers_answerer ON offers(answerer_public_key);
 
       -- ICE candidates table
       CREATE TABLE IF NOT EXISTS ice_candidates (
         id INTEGER PRIMARY KEY AUTOINCREMENT,
         offer_id TEXT NOT NULL,
-        username TEXT NOT NULL,
+        public_key TEXT NOT NULL,
         role TEXT NOT NULL CHECK(role IN ('offerer', 'answerer')),
         candidate TEXT NOT NULL,
         created_at INTEGER NOT NULL,
@@ -837,22 +452,9 @@ var init_sqlite = __esm({
       );
 
       CREATE INDEX IF NOT EXISTS idx_ice_offer ON ice_candidates(offer_id);
-      CREATE INDEX IF NOT EXISTS idx_ice_username ON ice_candidates(username);
+      CREATE INDEX IF NOT EXISTS idx_ice_public_key ON ice_candidates(public_key);
       CREATE INDEX IF NOT EXISTS idx_ice_created ON ice_candidates(created_at);
 
-      -- Credentials table (replaces usernames with simpler name + secret auth)
-      CREATE TABLE IF NOT EXISTS credentials (
-        name TEXT PRIMARY KEY,
-        secret TEXT NOT NULL UNIQUE,
-        created_at INTEGER NOT NULL,
-        expires_at INTEGER NOT NULL,
-        last_used INTEGER NOT NULL,
-        CHECK(length(name) >= 3 AND length(name) <= 32)
-      );
-
-      CREATE INDEX IF NOT EXISTS idx_credentials_expires ON credentials(expires_at);
-      CREATE INDEX IF NOT EXISTS idx_credentials_secret ON credentials(secret);
-
       -- Rate limits table (for distributed rate limiting)
       CREATE TABLE IF NOT EXISTS rate_limits (
         identifier TEXT PRIMARY KEY,
@@ -883,14 +485,14 @@ var init_sqlite = __esm({
         );
         const transaction = this.db.transaction((offersWithIds2) => {
           const offerStmt = this.db.prepare(`
-        INSERT INTO offers (id, username, tags, sdp, created_at, expires_at, last_seen)
+        INSERT INTO offers (id, public_key, tags, sdp, created_at, expires_at, last_seen)
         VALUES (?, ?, ?, ?, ?, ?, ?)
       `);
           for (const offer of offersWithIds2) {
             const now = Date.now();
             offerStmt.run(
               offer.id,
-              offer.username,
+              offer.publicKey,
               JSON.stringify(offer.tags),
               offer.sdp,
               now,
@@ -899,7 +501,7 @@ var init_sqlite = __esm({
             );
             created.push({
               id: offer.id,
-              username: offer.username,
+              publicKey: offer.publicKey,
               tags: offer.tags,
               sdp: offer.sdp,
               createdAt: now,
@@ -911,13 +513,13 @@ var init_sqlite = __esm({
         transaction(offersWithIds);
         return created;
       }
-      async getOffersByUsername(username) {
+      async getOffersByPublicKey(publicKey) {
         const stmt = this.db.prepare(`
       SELECT * FROM offers
-      WHERE username = ? AND expires_at > ?
+      WHERE public_key = ? AND expires_at > ?
       ORDER BY last_seen DESC
     `);
-        const rows = stmt.all(username, Date.now());
+        const rows = stmt.all(publicKey, Date.now());
         return rows.map((row) => this.rowToOffer(row));
       }
       async getOfferById(offerId) {
@@ -931,12 +533,12 @@ var init_sqlite = __esm({
         }
         return this.rowToOffer(row);
       }
-      async deleteOffer(offerId, ownerUsername) {
+      async deleteOffer(offerId, ownerPublicKey) {
         const stmt = this.db.prepare(`
       DELETE FROM offers
-      WHERE id = ? AND username = ?
+      WHERE id = ? AND public_key = ?
     `);
-        const result = stmt.run(offerId, ownerUsername);
+        const result = stmt.run(offerId, ownerPublicKey);
         return result.changes > 0;
       }
       async deleteExpiredOffers(now) {
@@ -944,7 +546,7 @@ var init_sqlite = __esm({
         const result = stmt.run(now);
         return result.changes;
       }
-      async answerOffer(offerId, answererUsername, answerSdp, matchedTags) {
+      async answerOffer(offerId, answererPublicKey, answerSdp, matchedTags) {
         const offer = await this.getOfferById(offerId);
         if (!offer) {
           return {
@@ -952,7 +554,7 @@ var init_sqlite = __esm({
             error: "Offer not found or expired"
           };
         }
-        if (offer.answererUsername) {
+        if (offer.answererPublicKey) {
           return {
             success: false,
             error: "Offer already answered"
@@ -960,11 +562,11 @@ var init_sqlite = __esm({
         }
         const stmt = this.db.prepare(`
       UPDATE offers
-      SET answerer_username = ?, answer_sdp = ?, answered_at = ?, matched_tags = ?
-      WHERE id = ? AND answerer_username IS NULL
+      SET answerer_public_key = ?, answer_sdp = ?, answered_at = ?, matched_tags = ?
+      WHERE id = ? AND answerer_public_key IS NULL
     `);
         const matchedTagsJson = matchedTags ? JSON.stringify(matchedTags) : null;
-        const result = stmt.run(answererUsername, answerSdp, Date.now(), matchedTagsJson, offerId);
+        const result = stmt.run(answererPublicKey, answerSdp, Date.now(), matchedTagsJson, offerId);
         if (result.changes === 0) {
           return {
             success: false,
@@ -973,26 +575,26 @@ var init_sqlite = __esm({
         }
         return { success: true };
       }
-      async getAnsweredOffers(offererUsername) {
+      async getAnsweredOffers(offererPublicKey) {
         const stmt = this.db.prepare(`
       SELECT * FROM offers
-      WHERE username = ? AND answerer_username IS NOT NULL AND expires_at > ?
+      WHERE public_key = ? AND answerer_public_key IS NOT NULL AND expires_at > ?
       ORDER BY answered_at DESC
     `);
-        const rows = stmt.all(offererUsername, Date.now());
+        const rows = stmt.all(offererPublicKey, Date.now());
         return rows.map((row) => this.rowToOffer(row));
       }
-      async getOffersAnsweredBy(answererUsername) {
+      async getOffersAnsweredBy(answererPublicKey) {
         const stmt = this.db.prepare(`
       SELECT * FROM offers
-      WHERE answerer_username = ? AND expires_at > ?
+      WHERE answerer_public_key = ? AND expires_at > ?
       ORDER BY answered_at DESC
     `);
-        const rows = stmt.all(answererUsername, Date.now());
+        const rows = stmt.all(answererPublicKey, Date.now());
         return rows.map((row) => this.rowToOffer(row));
       }
       // ===== Discovery =====
-      async discoverOffers(tags, excludeUsername, limit, offset) {
+      async discoverOffers(tags, excludePublicKey, limit, offset) {
         if (tags.length === 0) {
           return [];
         }
@@ -1001,12 +603,12 @@ var init_sqlite = __esm({
       SELECT DISTINCT o.* FROM offers o, json_each(o.tags) as t
       WHERE t.value IN (${placeholders})
         AND o.expires_at > ?
-        AND o.answerer_username IS NULL
+        AND o.answerer_public_key IS NULL
     `;
         const params = [...tags, Date.now()];
-        if (excludeUsername) {
-          query += " AND o.username != ?";
-          params.push(excludeUsername);
+        if (excludePublicKey) {
+          query += " AND o.public_key != ?";
+          params.push(excludePublicKey);
         }
         query += " ORDER BY o.created_at DESC LIMIT ? OFFSET ?";
         params.push(limit, offset);
@@ -1014,7 +616,7 @@ var init_sqlite = __esm({
         const rows = stmt.all(...params);
         return rows.map((row) => this.rowToOffer(row));
       }
-      async getRandomOffer(tags, excludeUsername) {
+      async getRandomOffer(tags, excludePublicKey) {
         if (tags.length === 0) {
           return null;
         }
@@ -1023,12 +625,12 @@ var init_sqlite = __esm({
       SELECT DISTINCT o.* FROM offers o, json_each(o.tags) as t
       WHERE t.value IN (${placeholders})
         AND o.expires_at > ?
-        AND o.answerer_username IS NULL
+        AND o.answerer_public_key IS NULL
     `;
         const params = [...tags, Date.now()];
-        if (excludeUsername) {
-          query += " AND o.username != ?";
-          params.push(excludeUsername);
+        if (excludePublicKey) {
+          query += " AND o.public_key != ?";
+          params.push(excludePublicKey);
         }
         query += " ORDER BY RANDOM() LIMIT 1";
         const stmt = this.db.prepare(query);
@@ -1036,9 +638,9 @@ var init_sqlite = __esm({
         return row ? this.rowToOffer(row) : null;
       }
       // ===== ICE Candidate Management =====
-      async addIceCandidates(offerId, username, role, candidates) {
+      async addIceCandidates(offerId, publicKey, role, candidates) {
         const stmt = this.db.prepare(`
-      INSERT INTO ice_candidates (offer_id, username, role, candidate, created_at)
+      INSERT INTO ice_candidates (offer_id, public_key, role, candidate, created_at)
       VALUES (?, ?, ?, ?, ?)
     `);
         const baseTimestamp = Date.now();
@@ -1046,7 +648,7 @@ var init_sqlite = __esm({
           for (let i = 0; i < candidates2.length; i++) {
             stmt.run(
               offerId,
-              username,
+              publicKey,
               role,
               JSON.stringify(candidates2[i]),
               baseTimestamp + i
@@ -1072,13 +674,13 @@ var init_sqlite = __esm({
         return rows.map((row) => ({
           id: row.id,
           offerId: row.offer_id,
-          username: row.username,
+          publicKey: row.public_key,
           role: row.role,
           candidate: JSON.parse(row.candidate),
           createdAt: row.created_at
         }));
       }
-      async getIceCandidatesForMultipleOffers(offerIds, username, since) {
+      async getIceCandidatesForMultipleOffers(offerIds, publicKey, since) {
         const result = /* @__PURE__ */ new Map();
         if (offerIds.length === 0) {
           return result;
@@ -1091,16 +693,16 @@ var init_sqlite = __esm({
         }
         const placeholders = offerIds.map(() => "?").join(",");
         let query = `
-      SELECT ic.*, o.username as offer_username
+      SELECT ic.*, o.public_key as offer_public_key
       FROM ice_candidates ic
       INNER JOIN offers o ON o.id = ic.offer_id
       WHERE ic.offer_id IN (${placeholders})
       AND (
-        (o.username = ? AND ic.role = 'answerer')
-        OR (o.answerer_username = ? AND ic.role = 'offerer')
+        (o.public_key = ? AND ic.role = 'answerer')
+        OR (o.answerer_public_key = ? AND ic.role = 'offerer')
       )
     `;
-        const params = [...offerIds, username, username];
+        const params = [...offerIds, publicKey, publicKey];
         if (since !== void 0) {
           query += " AND ic.created_at > ?";
           params.push(since);
@@ -1112,7 +714,7 @@ var init_sqlite = __esm({
           const candidate = {
             id: row.id,
             offerId: row.offer_id,
-            username: row.username,
+            publicKey: row.public_key,
             role: row.role,
             candidate: JSON.parse(row.candidate),
             createdAt: row.created_at
@@ -1124,92 +726,6 @@ var init_sqlite = __esm({
         }
         return result;
       }
-      // ===== Credential Management =====
-      async generateCredentials(request) {
-        const now = Date.now();
-        const expiresAt = request.expiresAt || now + YEAR_IN_MS2;
-        const { generateCredentialName: generateCredentialName2, generateSecret: generateSecret2 } = await Promise.resolve().then(() => (init_crypto(), crypto_exports));
-        let name;
-        if (request.name) {
-          const existing = this.db.prepare(`
-        SELECT name FROM credentials WHERE name = ?
-      `).get(request.name);
-          if (existing) {
-            throw new Error("Username already taken");
-          }
-          name = request.name;
-        } else {
-          let attempts = 0;
-          const maxAttempts = 100;
-          while (attempts < maxAttempts) {
-            name = generateCredentialName2();
-            const existing = this.db.prepare(`
-          SELECT name FROM credentials WHERE name = ?
-        `).get(name);
-            if (!existing) {
-              break;
-            }
-            attempts++;
-          }
-          if (attempts >= maxAttempts) {
-            throw new Error(`Failed to generate unique credential name after ${maxAttempts} attempts`);
-          }
-        }
-        const secret = generateSecret2();
-        const { encryptSecret: encryptSecret2 } = await Promise.resolve().then(() => (init_crypto(), crypto_exports));
-        const encryptedSecret = await encryptSecret2(secret, this.masterEncryptionKey);
-        const stmt = this.db.prepare(`
-      INSERT INTO credentials (name, secret, created_at, expires_at, last_used)
-      VALUES (?, ?, ?, ?, ?)
-    `);
-        stmt.run(name, encryptedSecret, now, expiresAt, now);
-        return {
-          name,
-          secret,
-          // Return plaintext secret, not encrypted
-          createdAt: now,
-          expiresAt,
-          lastUsed: now
-        };
-      }
-      async getCredential(name) {
-        const stmt = this.db.prepare(`
-      SELECT * FROM credentials
-      WHERE name = ? AND expires_at > ?
-    `);
-        const row = stmt.get(name, Date.now());
-        if (!row) {
-          return null;
-        }
-        try {
-          const { decryptSecret: decryptSecret2 } = await Promise.resolve().then(() => (init_crypto(), crypto_exports));
-          const decryptedSecret = await decryptSecret2(row.secret, this.masterEncryptionKey);
-          return {
-            name: row.name,
-            secret: decryptedSecret,
-            // Return decrypted secret
-            createdAt: row.created_at,
-            expiresAt: row.expires_at,
-            lastUsed: row.last_used
-          };
-        } catch (error) {
-          console.error(`Failed to decrypt secret for credential '${name}':`, error);
-          return null;
-        }
-      }
-      async updateCredentialUsage(name, lastUsed, expiresAt) {
-        const stmt = this.db.prepare(`
-      UPDATE credentials
-      SET last_used = ?, expires_at = ?
-      WHERE name = ?
-    `);
-        stmt.run(lastUsed, expiresAt, name);
-      }
-      async deleteExpiredCredentials(now) {
-        const stmt = this.db.prepare("DELETE FROM credentials WHERE expires_at < ?");
-        const result = stmt.run(now);
-        return result.changes;
-      }
       // ===== Rate Limiting =====
       async checkRateLimit(identifier, limit, windowMs) {
         const now = Date.now();
@@ -1264,12 +780,8 @@ var init_sqlite = __esm({
         const result = this.db.prepare("SELECT COUNT(*) as count FROM offers").get();
         return result.count;
       }
-      async getOfferCountByUsername(username) {
-        const result = this.db.prepare("SELECT COUNT(*) as count FROM offers WHERE username = ?").get(username);
-        return result.count;
-      }
-      async getCredentialCount() {
-        const result = this.db.prepare("SELECT COUNT(*) as count FROM credentials").get();
+      async getOfferCountByPublicKey(publicKey) {
+        const result = this.db.prepare("SELECT COUNT(*) as count FROM offers WHERE public_key = ?").get(publicKey);
         return result.count;
       }
       async getIceCandidateCount(offerId) {
@@ -1283,13 +795,13 @@ var init_sqlite = __esm({
       rowToOffer(row) {
         return {
           id: row.id,
-          username: row.username,
+          publicKey: row.public_key,
           tags: JSON.parse(row.tags),
           sdp: row.sdp,
           createdAt: row.created_at,
           expiresAt: row.expires_at,
           lastSeen: row.last_seen,
-          answererUsername: row.answerer_username || void 0,
+          answererPublicKey: row.answerer_public_key || void 0,
           answerSdp: row.answer_sdp || void 0,
           answeredAt: row.answered_at || void 0,
           matchedTags: row.matched_tags ? JSON.parse(row.matched_tags) : void 0
@@ -1304,25 +816,22 @@ var mysql_exports = {};
 __export(mysql_exports, {
   MySQLStorage: () => MySQLStorage
 });
-var import_promise, YEAR_IN_MS3, MySQLStorage;
+var import_promise, MySQLStorage;
 var init_mysql = __esm({
   "src/storage/mysql.ts"() {
     "use strict";
     import_promise = __toESM(require("mysql2/promise"));
     init_hash_id();
-    YEAR_IN_MS3 = 365 * 24 * 60 * 60 * 1e3;
     MySQLStorage = class _MySQLStorage {
-      constructor(pool, masterEncryptionKey) {
+      constructor(pool) {
         this.pool = pool;
-        this.masterEncryptionKey = masterEncryptionKey;
       }
       /**
        * Creates a new MySQL storage instance with connection pooling
        * @param connectionString MySQL connection URL
-       * @param masterEncryptionKey 64-char hex string for encrypting secrets
        * @param poolSize Maximum number of connections in the pool
        */
-      static async create(connectionString, masterEncryptionKey, poolSize = 10) {
+      static async create(connectionString, poolSize = 10) {
         const pool = import_promise.default.createPool({
           uri: connectionString,
           waitForConnections: true,
@@ -1331,7 +840,7 @@ var init_mysql = __esm({
           enableKeepAlive: true,
           keepAliveInitialDelay: 1e4
         });
-        const storage = new _MySQLStorage(pool, masterEncryptionKey);
+        const storage = new _MySQLStorage(pool);
         await storage.initializeDatabase();
         return storage;
       }
@@ -1339,47 +848,47 @@ var init_mysql = __esm({
         const conn = await this.pool.getConnection();
         try {
           await conn.query(`
+        CREATE TABLE IF NOT EXISTS identities (
+          public_key CHAR(64) PRIMARY KEY,
+          created_at BIGINT NOT NULL,
+          expires_at BIGINT NOT NULL,
+          last_used BIGINT NOT NULL,
+          INDEX idx_identities_expires (expires_at)
+        ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci
+      `);
+          await conn.query(`
         CREATE TABLE IF NOT EXISTS offers (
           id VARCHAR(64) PRIMARY KEY,
-          username VARCHAR(32) NOT NULL,
+          public_key CHAR(64) NOT NULL,
           tags JSON NOT NULL,
           sdp MEDIUMTEXT NOT NULL,
           created_at BIGINT NOT NULL,
           expires_at BIGINT NOT NULL,
           last_seen BIGINT NOT NULL,
-          answerer_username VARCHAR(32),
+          answerer_public_key CHAR(64),
           answer_sdp MEDIUMTEXT,
           answered_at BIGINT,
           matched_tags JSON,
-          INDEX idx_offers_username (username),
+          INDEX idx_offers_public_key (public_key),
           INDEX idx_offers_expires (expires_at),
           INDEX idx_offers_last_seen (last_seen),
-          INDEX idx_offers_answerer (answerer_username)
+          INDEX idx_offers_answerer (answerer_public_key),
+          FOREIGN KEY (public_key) REFERENCES identities(public_key) ON DELETE CASCADE
         ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci
       `);
           await conn.query(`
         CREATE TABLE IF NOT EXISTS ice_candidates (
           id BIGINT AUTO_INCREMENT PRIMARY KEY,
           offer_id VARCHAR(64) NOT NULL,
-          username VARCHAR(32) NOT NULL,
+          public_key CHAR(64) NOT NULL,
           role ENUM('offerer', 'answerer') NOT NULL,
           candidate JSON NOT NULL,
           created_at BIGINT NOT NULL,
           INDEX idx_ice_offer (offer_id),
-          INDEX idx_ice_username (username),
+          INDEX idx_ice_public_key (public_key),
           INDEX idx_ice_created (created_at),
           FOREIGN KEY (offer_id) REFERENCES offers(id) ON DELETE CASCADE
         ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci
-      `);
-          await conn.query(`
-        CREATE TABLE IF NOT EXISTS credentials (
-          name VARCHAR(32) PRIMARY KEY,
-          secret VARCHAR(512) NOT NULL UNIQUE,
-          created_at BIGINT NOT NULL,
-          expires_at BIGINT NOT NULL,
-          last_used BIGINT NOT NULL,
-          INDEX idx_credentials_expires (expires_at)
-        ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci
       `);
           await conn.query(`
         CREATE TABLE IF NOT EXISTS rate_limits (
@@ -1411,13 +920,13 @@ var init_mysql = __esm({
           for (const request of offers) {
             const id = request.id || await generateOfferHash(request.sdp);
             await conn.query(
-              `INSERT INTO offers (id, username, tags, sdp, created_at, expires_at, last_seen)
+              `INSERT INTO offers (id, public_key, tags, sdp, created_at, expires_at, last_seen)
            VALUES (?, ?, ?, ?, ?, ?, ?)`,
-              [id, request.username, JSON.stringify(request.tags), request.sdp, now, request.expiresAt, now]
+              [id, request.publicKey, JSON.stringify(request.tags), request.sdp, now, request.expiresAt, now]
             );
             created.push({
               id,
-              username: request.username,
+              publicKey: request.publicKey,
               tags: request.tags,
               sdp: request.sdp,
               createdAt: now,
@@ -1434,10 +943,10 @@ var init_mysql = __esm({
         }
         return created;
       }
-      async getOffersByUsername(username) {
+      async getOffersByPublicKey(publicKey) {
         const [rows] = await this.pool.query(
-          `SELECT * FROM offers WHERE username = ? AND expires_at > ? ORDER BY last_seen DESC`,
-          [username, Date.now()]
+          `SELECT * FROM offers WHERE public_key = ? AND expires_at > ? ORDER BY last_seen DESC`,
+          [publicKey, Date.now()]
         );
         return rows.map((row) => this.rowToOffer(row));
       }
@@ -1448,10 +957,10 @@ var init_mysql = __esm({
         );
         return rows.length > 0 ? this.rowToOffer(rows[0]) : null;
       }
-      async deleteOffer(offerId, ownerUsername) {
+      async deleteOffer(offerId, ownerPublicKey) {
         const [result] = await this.pool.query(
-          `DELETE FROM offers WHERE id = ? AND username = ?`,
-          [offerId, ownerUsername]
+          `DELETE FROM offers WHERE id = ? AND public_key = ?`,
+          [offerId, ownerPublicKey]
         );
         return result.affectedRows > 0;
       }
@@ -1462,94 +971,94 @@ var init_mysql = __esm({
         );
         return result.affectedRows;
       }
-      async answerOffer(offerId, answererUsername, answerSdp, matchedTags) {
+      async answerOffer(offerId, answererPublicKey, answerSdp, matchedTags) {
         const offer = await this.getOfferById(offerId);
         if (!offer) {
           return { success: false, error: "Offer not found or expired" };
         }
-        if (offer.answererUsername) {
+        if (offer.answererPublicKey) {
           return { success: false, error: "Offer already answered" };
         }
         const matchedTagsJson = matchedTags ? JSON.stringify(matchedTags) : null;
         const [result] = await this.pool.query(
-          `UPDATE offers SET answerer_username = ?, answer_sdp = ?, answered_at = ?, matched_tags = ?
-       WHERE id = ? AND answerer_username IS NULL`,
-          [answererUsername, answerSdp, Date.now(), matchedTagsJson, offerId]
+          `UPDATE offers SET answerer_public_key = ?, answer_sdp = ?, answered_at = ?, matched_tags = ?
+       WHERE id = ? AND answerer_public_key IS NULL`,
+          [answererPublicKey, answerSdp, Date.now(), matchedTagsJson, offerId]
         );
         if (result.affectedRows === 0) {
           return { success: false, error: "Offer already answered (race condition)" };
         }
         return { success: true };
       }
-      async getAnsweredOffers(offererUsername) {
+      async getAnsweredOffers(offererPublicKey) {
         const [rows] = await this.pool.query(
           `SELECT * FROM offers
-       WHERE username = ? AND answerer_username IS NOT NULL AND expires_at > ?
+       WHERE public_key = ? AND answerer_public_key IS NOT NULL AND expires_at > ?
        ORDER BY answered_at DESC`,
-          [offererUsername, Date.now()]
+          [offererPublicKey, Date.now()]
         );
         return rows.map((row) => this.rowToOffer(row));
       }
-      async getOffersAnsweredBy(answererUsername) {
+      async getOffersAnsweredBy(answererPublicKey) {
         const [rows] = await this.pool.query(
           `SELECT * FROM offers
-       WHERE answerer_username = ? AND expires_at > ?
+       WHERE answerer_public_key = ? AND expires_at > ?
        ORDER BY answered_at DESC`,
-          [answererUsername, Date.now()]
+          [answererPublicKey, Date.now()]
         );
         return rows.map((row) => this.rowToOffer(row));
       }
       // ===== Discovery =====
-      async discoverOffers(tags, excludeUsername, limit, offset) {
+      async discoverOffers(tags, excludePublicKey, limit, offset) {
         if (tags.length === 0) return [];
         const tagArray = JSON.stringify(tags);
         let query = `
       SELECT DISTINCT o.* FROM offers o
       WHERE JSON_OVERLAPS(o.tags, ?)
         AND o.expires_at > ?
-        AND o.answerer_username IS NULL
+        AND o.answerer_public_key IS NULL
     `;
         const params = [tagArray, Date.now()];
-        if (excludeUsername) {
-          query += " AND o.username != ?";
-          params.push(excludeUsername);
+        if (excludePublicKey) {
+          query += " AND o.public_key != ?";
+          params.push(excludePublicKey);
         }
         query += " ORDER BY o.created_at DESC LIMIT ? OFFSET ?";
         params.push(limit, offset);
         const [rows] = await this.pool.query(query, params);
         return rows.map((row) => this.rowToOffer(row));
       }
-      async getRandomOffer(tags, excludeUsername) {
+      async getRandomOffer(tags, excludePublicKey) {
         if (tags.length === 0) return null;
         const tagArray = JSON.stringify(tags);
         let query = `
       SELECT DISTINCT o.* FROM offers o
       WHERE JSON_OVERLAPS(o.tags, ?)
         AND o.expires_at > ?
-        AND o.answerer_username IS NULL
+        AND o.answerer_public_key IS NULL
     `;
         const params = [tagArray, Date.now()];
-        if (excludeUsername) {
-          query += " AND o.username != ?";
-          params.push(excludeUsername);
+        if (excludePublicKey) {
+          query += " AND o.public_key != ?";
+          params.push(excludePublicKey);
         }
         query += " ORDER BY RAND() LIMIT 1";
         const [rows] = await this.pool.query(query, params);
         return rows.length > 0 ? this.rowToOffer(rows[0]) : null;
       }
       // ===== ICE Candidate Management =====
-      async addIceCandidates(offerId, username, role, candidates) {
+      async addIceCandidates(offerId, publicKey, role, candidates) {
         if (candidates.length === 0) return 0;
         const baseTimestamp = Date.now();
         const values = candidates.map((c, i) => [
           offerId,
-          username,
+          publicKey,
           role,
           JSON.stringify(c),
           baseTimestamp + i
         ]);
         await this.pool.query(
-          `INSERT INTO ice_candidates (offer_id, username, role, candidate, created_at)
+          `INSERT INTO ice_candidates (offer_id, public_key, role, candidate, created_at)
        VALUES ?`,
           [values]
         );
@@ -1566,7 +1075,7 @@ var init_mysql = __esm({
         const [rows] = await this.pool.query(query, params);
         return rows.map((row) => this.rowToIceCandidate(row));
       }
-      async getIceCandidatesForMultipleOffers(offerIds, username, since) {
+      async getIceCandidatesForMultipleOffers(offerIds, publicKey, since) {
         const result = /* @__PURE__ */ new Map();
         if (offerIds.length === 0) return result;
         if (offerIds.length > 1e3) {
@@ -1574,16 +1083,16 @@ var init_mysql = __esm({
         }
         const placeholders = offerIds.map(() => "?").join(",");
         let query = `
-      SELECT ic.*, o.username as offer_username
+      SELECT ic.*, o.public_key as offer_public_key
       FROM ice_candidates ic
       INNER JOIN offers o ON o.id = ic.offer_id
       WHERE ic.offer_id IN (${placeholders})
       AND (
-        (o.username = ? AND ic.role = 'answerer')
-        OR (o.answerer_username = ? AND ic.role = 'offerer')
+        (o.public_key = ? AND ic.role = 'answerer')
+        OR (o.answerer_public_key = ? AND ic.role = 'offerer')
       )
     `;
-        const params = [...offerIds, username, username];
+        const params = [...offerIds, publicKey, publicKey];
         if (since !== void 0) {
           query += " AND ic.created_at > ?";
           params.push(since);
@@ -1599,86 +1108,6 @@ var init_mysql = __esm({
         }
         return result;
       }
-      // ===== Credential Management =====
-      async generateCredentials(request) {
-        const now = Date.now();
-        const expiresAt = request.expiresAt || now + YEAR_IN_MS3;
-        const { generateCredentialName: generateCredentialName2, generateSecret: generateSecret2, encryptSecret: encryptSecret2 } = await Promise.resolve().then(() => (init_crypto(), crypto_exports));
-        let name;
-        if (request.name) {
-          const [existing] = await this.pool.query(
-            `SELECT name FROM credentials WHERE name = ?`,
-            [request.name]
-          );
-          if (existing.length > 0) {
-            throw new Error("Username already taken");
-          }
-          name = request.name;
-        } else {
-          let attempts = 0;
-          const maxAttempts = 100;
-          while (attempts < maxAttempts) {
-            name = generateCredentialName2();
-            const [existing] = await this.pool.query(
-              `SELECT name FROM credentials WHERE name = ?`,
-              [name]
-            );
-            if (existing.length === 0) break;
-            attempts++;
-          }
-          if (attempts >= maxAttempts) {
-            throw new Error(`Failed to generate unique credential name after ${maxAttempts} attempts`);
-          }
-        }
-        const secret = generateSecret2();
-        const encryptedSecret = await encryptSecret2(secret, this.masterEncryptionKey);
-        await this.pool.query(
-          `INSERT INTO credentials (name, secret, created_at, expires_at, last_used)
-       VALUES (?, ?, ?, ?, ?)`,
-          [name, encryptedSecret, now, expiresAt, now]
-        );
-        return {
-          name,
-          secret,
-          createdAt: now,
-          expiresAt,
-          lastUsed: now
-        };
-      }
-      async getCredential(name) {
-        const [rows] = await this.pool.query(
-          `SELECT * FROM credentials WHERE name = ? AND expires_at > ?`,
-          [name, Date.now()]
-        );
-        if (rows.length === 0) return null;
-        try {
-          const { decryptSecret: decryptSecret2 } = await Promise.resolve().then(() => (init_crypto(), crypto_exports));
-          const decryptedSecret = await decryptSecret2(rows[0].secret, this.masterEncryptionKey);
-          return {
-            name: rows[0].name,
-            secret: decryptedSecret,
-            createdAt: Number(rows[0].created_at),
-            expiresAt: Number(rows[0].expires_at),
-            lastUsed: Number(rows[0].last_used)
-          };
-        } catch (error) {
-          console.error(`Failed to decrypt secret for credential '${name}':`, error);
-          return null;
-        }
-      }
-      async updateCredentialUsage(name, lastUsed, expiresAt) {
-        await this.pool.query(
-          `UPDATE credentials SET last_used = ?, expires_at = ? WHERE name = ?`,
-          [lastUsed, expiresAt, name]
-        );
-      }
-      async deleteExpiredCredentials(now) {
-        const [result] = await this.pool.query(
-          `DELETE FROM credentials WHERE expires_at < ?`,
-          [now]
-        );
-        return result.affectedRows;
-      }
       // ===== Rate Limiting =====
       async checkRateLimit(identifier, limit, windowMs) {
         const now = Date.now();
@@ -1734,17 +1163,13 @@ var init_mysql = __esm({
         const [rows] = await this.pool.query("SELECT COUNT(*) as count FROM offers");
         return Number(rows[0].count);
       }
-      async getOfferCountByUsername(username) {
+      async getOfferCountByPublicKey(publicKey) {
         const [rows] = await this.pool.query(
-          "SELECT COUNT(*) as count FROM offers WHERE username = ?",
-          [username]
+          "SELECT COUNT(*) as count FROM offers WHERE public_key = ?",
+          [publicKey]
         );
         return Number(rows[0].count);
       }
-      async getCredentialCount() {
-        const [rows] = await this.pool.query("SELECT COUNT(*) as count FROM credentials");
-        return Number(rows[0].count);
-      }
       async getIceCandidateCount(offerId) {
         const [rows] = await this.pool.query(
           "SELECT COUNT(*) as count FROM ice_candidates WHERE offer_id = ?",
@@ -1756,13 +1181,13 @@ var init_mysql = __esm({
       rowToOffer(row) {
         return {
           id: row.id,
-          username: row.username,
+          publicKey: row.public_key,
           tags: typeof row.tags === "string" ? JSON.parse(row.tags) : row.tags,
           sdp: row.sdp,
           createdAt: Number(row.created_at),
           expiresAt: Number(row.expires_at),
           lastSeen: Number(row.last_seen),
-          answererUsername: row.answerer_username || void 0,
+          answererPublicKey: row.answerer_public_key || void 0,
           answerSdp: row.answer_sdp || void 0,
           answeredAt: row.answered_at ? Number(row.answered_at) : void 0,
           matchedTags: row.matched_tags ? typeof row.matched_tags === "string" ? JSON.parse(row.matched_tags) : row.matched_tags : void 0
@@ -1772,7 +1197,7 @@ var init_mysql = __esm({
         return {
           id: Number(row.id),
           offerId: row.offer_id,
-          username: row.username,
+          publicKey: row.public_key,
           role: row.role,
           candidate: typeof row.candidate === "string" ? JSON.parse(row.candidate) : row.candidate,
           createdAt: Number(row.created_at)
@@ -1787,32 +1212,29 @@ var postgres_exports = {};
 __export(postgres_exports, {
   PostgreSQLStorage: () => PostgreSQLStorage
 });
-var import_pg, YEAR_IN_MS4, PostgreSQLStorage;
+var import_pg, PostgreSQLStorage;
 var init_postgres = __esm({
   "src/storage/postgres.ts"() {
     "use strict";
     import_pg = require("pg");
     init_hash_id();
-    YEAR_IN_MS4 = 365 * 24 * 60 * 60 * 1e3;
     PostgreSQLStorage = class _PostgreSQLStorage {
-      constructor(pool, masterEncryptionKey) {
+      constructor(pool) {
         this.pool = pool;
-        this.masterEncryptionKey = masterEncryptionKey;
       }
       /**
        * Creates a new PostgreSQL storage instance with connection pooling
        * @param connectionString PostgreSQL connection URL
-       * @param masterEncryptionKey 64-char hex string for encrypting secrets
        * @param poolSize Maximum number of connections in the pool
        */
-      static async create(connectionString, masterEncryptionKey, poolSize = 10) {
+      static async create(connectionString, poolSize = 10) {
         const pool = new import_pg.Pool({
           connectionString,
           max: poolSize,
           idleTimeoutMillis: 3e4,
           connectionTimeoutMillis: 5e3
         });
-        const storage = new _PostgreSQLStorage(pool, masterEncryptionKey);
+        const storage = new _PostgreSQLStorage(pool);
         await storage.initializeDatabase();
         return storage;
       }
@@ -1820,49 +1242,48 @@ var init_postgres = __esm({
         const client = await this.pool.connect();
         try {
           await client.query(`
-        CREATE TABLE IF NOT EXISTS offers (
-          id VARCHAR(64) PRIMARY KEY,
-          username VARCHAR(32) NOT NULL,
-          tags JSONB NOT NULL,
-          sdp TEXT NOT NULL,
+        CREATE TABLE IF NOT EXISTS identities (
+          public_key CHAR(64) PRIMARY KEY,
+          created_at BIGINT NOT NULL,
+          expires_at BIGINT NOT NULL,
+          last_used BIGINT NOT NULL
+        )
+      `);
+          await client.query(`CREATE INDEX IF NOT EXISTS idx_identities_expires ON identities(expires_at)`);
+          await client.query(`
+        CREATE TABLE IF NOT EXISTS offers (
+          id VARCHAR(64) PRIMARY KEY,
+          public_key CHAR(64) NOT NULL REFERENCES identities(public_key) ON DELETE CASCADE,
+          tags JSONB NOT NULL,
+          sdp TEXT NOT NULL,
           created_at BIGINT NOT NULL,
           expires_at BIGINT NOT NULL,
           last_seen BIGINT NOT NULL,
-          answerer_username VARCHAR(32),
+          answerer_public_key CHAR(64),
           answer_sdp TEXT,
           answered_at BIGINT,
           matched_tags JSONB
         )
       `);
-          await client.query(`CREATE INDEX IF NOT EXISTS idx_offers_username ON offers(username)`);
+          await client.query(`CREATE INDEX IF NOT EXISTS idx_offers_public_key ON offers(public_key)`);
           await client.query(`CREATE INDEX IF NOT EXISTS idx_offers_expires ON offers(expires_at)`);
           await client.query(`CREATE INDEX IF NOT EXISTS idx_offers_last_seen ON offers(last_seen)`);
-          await client.query(`CREATE INDEX IF NOT EXISTS idx_offers_answerer ON offers(answerer_username)`);
+          await client.query(`CREATE INDEX IF NOT EXISTS idx_offers_answerer ON offers(answerer_public_key)`);
           await client.query(`CREATE INDEX IF NOT EXISTS idx_offers_tags ON offers USING GIN(tags)`);
           await client.query(`
         CREATE TABLE IF NOT EXISTS ice_candidates (
           id BIGSERIAL PRIMARY KEY,
           offer_id VARCHAR(64) NOT NULL REFERENCES offers(id) ON DELETE CASCADE,
-          username VARCHAR(32) NOT NULL,
+          public_key CHAR(64) NOT NULL,
           role VARCHAR(8) NOT NULL CHECK (role IN ('offerer', 'answerer')),
           candidate JSONB NOT NULL,
           created_at BIGINT NOT NULL
         )
       `);
           await client.query(`CREATE INDEX IF NOT EXISTS idx_ice_offer ON ice_candidates(offer_id)`);
-          await client.query(`CREATE INDEX IF NOT EXISTS idx_ice_username ON ice_candidates(username)`);
+          await client.query(`CREATE INDEX IF NOT EXISTS idx_ice_public_key ON ice_candidates(public_key)`);
           await client.query(`CREATE INDEX IF NOT EXISTS idx_ice_created ON ice_candidates(created_at)`);
           await client.query(`
-        CREATE TABLE IF NOT EXISTS credentials (
-          name VARCHAR(32) PRIMARY KEY,
-          secret VARCHAR(512) NOT NULL UNIQUE,
-          created_at BIGINT NOT NULL,
-          expires_at BIGINT NOT NULL,
-          last_used BIGINT NOT NULL
-        )
-      `);
-          await client.query(`CREATE INDEX IF NOT EXISTS idx_credentials_expires ON credentials(expires_at)`);
-          await client.query(`
         CREATE TABLE IF NOT EXISTS rate_limits (
           identifier VARCHAR(255) PRIMARY KEY,
           count INT NOT NULL,
@@ -1892,13 +1313,13 @@ var init_postgres = __esm({
           for (const request of offers) {
             const id = request.id || await generateOfferHash(request.sdp);
             await client.query(
-              `INSERT INTO offers (id, username, tags, sdp, created_at, expires_at, last_seen)
+              `INSERT INTO offers (id, public_key, tags, sdp, created_at, expires_at, last_seen)
            VALUES ($1, $2, $3, $4, $5, $6, $7)`,
-              [id, request.username, JSON.stringify(request.tags), request.sdp, now, request.expiresAt, now]
+              [id, request.publicKey, JSON.stringify(request.tags), request.sdp, now, request.expiresAt, now]
             );
             created.push({
               id,
-              username: request.username,
+              publicKey: request.publicKey,
               tags: request.tags,
               sdp: request.sdp,
               createdAt: now,
@@ -1915,10 +1336,10 @@ var init_postgres = __esm({
         }
         return created;
       }
-      async getOffersByUsername(username) {
+      async getOffersByPublicKey(publicKey) {
         const result = await this.pool.query(
-          `SELECT * FROM offers WHERE username = $1 AND expires_at > $2 ORDER BY last_seen DESC`,
-          [username, Date.now()]
+          `SELECT * FROM offers WHERE public_key = $1 AND expires_at > $2 ORDER BY last_seen DESC`,
+          [publicKey, Date.now()]
         );
         return result.rows.map((row) => this.rowToOffer(row));
       }
@@ -1929,10 +1350,10 @@ var init_postgres = __esm({
         );
         return result.rows.length > 0 ? this.rowToOffer(result.rows[0]) : null;
       }
-      async deleteOffer(offerId, ownerUsername) {
+      async deleteOffer(offerId, ownerPublicKey) {
         const result = await this.pool.query(
-          `DELETE FROM offers WHERE id = $1 AND username = $2`,
-          [offerId, ownerUsername]
+          `DELETE FROM offers WHERE id = $1 AND public_key = $2`,
+          [offerId, ownerPublicKey]
         );
         return (result.rowCount ?? 0) > 0;
       }
@@ -1943,57 +1364,57 @@ var init_postgres = __esm({
         );
         return result.rowCount ?? 0;
       }
-      async answerOffer(offerId, answererUsername, answerSdp, matchedTags) {
+      async answerOffer(offerId, answererPublicKey, answerSdp, matchedTags) {
         const offer = await this.getOfferById(offerId);
         if (!offer) {
           return { success: false, error: "Offer not found or expired" };
         }
-        if (offer.answererUsername) {
+        if (offer.answererPublicKey) {
           return { success: false, error: "Offer already answered" };
         }
         const matchedTagsJson = matchedTags ? JSON.stringify(matchedTags) : null;
         const result = await this.pool.query(
-          `UPDATE offers SET answerer_username = $1, answer_sdp = $2, answered_at = $3, matched_tags = $4
-       WHERE id = $5 AND answerer_username IS NULL`,
-          [answererUsername, answerSdp, Date.now(), matchedTagsJson, offerId]
+          `UPDATE offers SET answerer_public_key = $1, answer_sdp = $2, answered_at = $3, matched_tags = $4
+       WHERE id = $5 AND answerer_public_key IS NULL`,
+          [answererPublicKey, answerSdp, Date.now(), matchedTagsJson, offerId]
         );
         if ((result.rowCount ?? 0) === 0) {
           return { success: false, error: "Offer already answered (race condition)" };
         }
         return { success: true };
       }
-      async getAnsweredOffers(offererUsername) {
+      async getAnsweredOffers(offererPublicKey) {
         const result = await this.pool.query(
           `SELECT * FROM offers
-       WHERE username = $1 AND answerer_username IS NOT NULL AND expires_at > $2
+       WHERE public_key = $1 AND answerer_public_key IS NOT NULL AND expires_at > $2
        ORDER BY answered_at DESC`,
-          [offererUsername, Date.now()]
+          [offererPublicKey, Date.now()]
         );
         return result.rows.map((row) => this.rowToOffer(row));
       }
-      async getOffersAnsweredBy(answererUsername) {
+      async getOffersAnsweredBy(answererPublicKey) {
         const result = await this.pool.query(
           `SELECT * FROM offers
-       WHERE answerer_username = $1 AND expires_at > $2
+       WHERE answerer_public_key = $1 AND expires_at > $2
        ORDER BY answered_at DESC`,
-          [answererUsername, Date.now()]
+          [answererPublicKey, Date.now()]
         );
         return result.rows.map((row) => this.rowToOffer(row));
       }
       // ===== Discovery =====
-      async discoverOffers(tags, excludeUsername, limit, offset) {
+      async discoverOffers(tags, excludePublicKey, limit, offset) {
         if (tags.length === 0) return [];
         let query = `
       SELECT DISTINCT o.* FROM offers o
       WHERE o.tags ?| $1
         AND o.expires_at > $2
-        AND o.answerer_username IS NULL
+        AND o.answerer_public_key IS NULL
     `;
         const params = [tags, Date.now()];
         let paramIndex = 3;
-        if (excludeUsername) {
-          query += ` AND o.username != $${paramIndex}`;
-          params.push(excludeUsername);
+        if (excludePublicKey) {
+          query += ` AND o.public_key != $${paramIndex}`;
+          params.push(excludePublicKey);
           paramIndex++;
         }
         query += ` ORDER BY o.created_at DESC LIMIT $${paramIndex} OFFSET $${paramIndex + 1}`;
@@ -2001,26 +1422,26 @@ var init_postgres = __esm({
         const result = await this.pool.query(query, params);
         return result.rows.map((row) => this.rowToOffer(row));
       }
-      async getRandomOffer(tags, excludeUsername) {
+      async getRandomOffer(tags, excludePublicKey) {
         if (tags.length === 0) return null;
         let query = `
       SELECT DISTINCT o.* FROM offers o
       WHERE o.tags ?| $1
         AND o.expires_at > $2
-        AND o.answerer_username IS NULL
+        AND o.answerer_public_key IS NULL
     `;
         const params = [tags, Date.now()];
         let paramIndex = 3;
-        if (excludeUsername) {
-          query += ` AND o.username != $${paramIndex}`;
-          params.push(excludeUsername);
+        if (excludePublicKey) {
+          query += ` AND o.public_key != $${paramIndex}`;
+          params.push(excludePublicKey);
         }
         query += " ORDER BY RANDOM() LIMIT 1";
         const result = await this.pool.query(query, params);
         return result.rows.length > 0 ? this.rowToOffer(result.rows[0]) : null;
       }
       // ===== ICE Candidate Management =====
-      async addIceCandidates(offerId, username, role, candidates) {
+      async addIceCandidates(offerId, publicKey, role, candidates) {
         if (candidates.length === 0) return 0;
         const baseTimestamp = Date.now();
         const client = await this.pool.connect();
@@ -2028,9 +1449,9 @@ var init_postgres = __esm({
           await client.query("BEGIN");
           for (let i = 0; i < candidates.length; i++) {
             await client.query(
-              `INSERT INTO ice_candidates (offer_id, username, role, candidate, created_at)
+              `INSERT INTO ice_candidates (offer_id, public_key, role, candidate, created_at)
            VALUES ($1, $2, $3, $4, $5)`,
-              [offerId, username, role, JSON.stringify(candidates[i]), baseTimestamp + i]
+              [offerId, publicKey, role, JSON.stringify(candidates[i]), baseTimestamp + i]
             );
           }
           await client.query("COMMIT");
@@ -2053,23 +1474,23 @@ var init_postgres = __esm({
         const result = await this.pool.query(query, params);
         return result.rows.map((row) => this.rowToIceCandidate(row));
       }
-      async getIceCandidatesForMultipleOffers(offerIds, username, since) {
+      async getIceCandidatesForMultipleOffers(offerIds, publicKey, since) {
         const resultMap = /* @__PURE__ */ new Map();
         if (offerIds.length === 0) return resultMap;
         if (offerIds.length > 1e3) {
           throw new Error("Too many offer IDs (max 1000)");
         }
         let query = `
-      SELECT ic.*, o.username as offer_username
+      SELECT ic.*, o.public_key as offer_public_key
       FROM ice_candidates ic
       INNER JOIN offers o ON o.id = ic.offer_id
       WHERE ic.offer_id = ANY($1)
       AND (
-        (o.username = $2 AND ic.role = 'answerer')
-        OR (o.answerer_username = $2 AND ic.role = 'offerer')
+        (o.public_key = $2 AND ic.role = 'answerer')
+        OR (o.answerer_public_key = $2 AND ic.role = 'offerer')
       )
     `;
-        const params = [offerIds, username];
+        const params = [offerIds, publicKey];
         if (since !== void 0) {
           query += " AND ic.created_at > $3";
           params.push(since);
@@ -2085,86 +1506,6 @@ var init_postgres = __esm({
         }
         return resultMap;
       }
-      // ===== Credential Management =====
-      async generateCredentials(request) {
-        const now = Date.now();
-        const expiresAt = request.expiresAt || now + YEAR_IN_MS4;
-        const { generateCredentialName: generateCredentialName2, generateSecret: generateSecret2, encryptSecret: encryptSecret2 } = await Promise.resolve().then(() => (init_crypto(), crypto_exports));
-        let name;
-        if (request.name) {
-          const existing = await this.pool.query(
-            `SELECT name FROM credentials WHERE name = $1`,
-            [request.name]
-          );
-          if (existing.rows.length > 0) {
-            throw new Error("Username already taken");
-          }
-          name = request.name;
-        } else {
-          let attempts = 0;
-          const maxAttempts = 100;
-          while (attempts < maxAttempts) {
-            name = generateCredentialName2();
-            const existing = await this.pool.query(
-              `SELECT name FROM credentials WHERE name = $1`,
-              [name]
-            );
-            if (existing.rows.length === 0) break;
-            attempts++;
-          }
-          if (attempts >= maxAttempts) {
-            throw new Error(`Failed to generate unique credential name after ${maxAttempts} attempts`);
-          }
-        }
-        const secret = generateSecret2();
-        const encryptedSecret = await encryptSecret2(secret, this.masterEncryptionKey);
-        await this.pool.query(
-          `INSERT INTO credentials (name, secret, created_at, expires_at, last_used)
-       VALUES ($1, $2, $3, $4, $5)`,
-          [name, encryptedSecret, now, expiresAt, now]
-        );
-        return {
-          name,
-          secret,
-          createdAt: now,
-          expiresAt,
-          lastUsed: now
-        };
-      }
-      async getCredential(name) {
-        const result = await this.pool.query(
-          `SELECT * FROM credentials WHERE name = $1 AND expires_at > $2`,
-          [name, Date.now()]
-        );
-        if (result.rows.length === 0) return null;
-        try {
-          const { decryptSecret: decryptSecret2 } = await Promise.resolve().then(() => (init_crypto(), crypto_exports));
-          const decryptedSecret = await decryptSecret2(result.rows[0].secret, this.masterEncryptionKey);
-          return {
-            name: result.rows[0].name,
-            secret: decryptedSecret,
-            createdAt: Number(result.rows[0].created_at),
-            expiresAt: Number(result.rows[0].expires_at),
-            lastUsed: Number(result.rows[0].last_used)
-          };
-        } catch (error) {
-          console.error(`Failed to decrypt secret for credential '${name}':`, error);
-          return null;
-        }
-      }
-      async updateCredentialUsage(name, lastUsed, expiresAt) {
-        await this.pool.query(
-          `UPDATE credentials SET last_used = $1, expires_at = $2 WHERE name = $3`,
-          [lastUsed, expiresAt, name]
-        );
-      }
-      async deleteExpiredCredentials(now) {
-        const result = await this.pool.query(
-          `DELETE FROM credentials WHERE expires_at < $1`,
-          [now]
-        );
-        return result.rowCount ?? 0;
-      }
       // ===== Rate Limiting =====
       async checkRateLimit(identifier, limit, windowMs) {
         const now = Date.now();
@@ -2223,17 +1564,13 @@ var init_postgres = __esm({
         const result = await this.pool.query("SELECT COUNT(*) as count FROM offers");
         return Number(result.rows[0].count);
       }
-      async getOfferCountByUsername(username) {
+      async getOfferCountByPublicKey(publicKey) {
         const result = await this.pool.query(
-          "SELECT COUNT(*) as count FROM offers WHERE username = $1",
-          [username]
+          "SELECT COUNT(*) as count FROM offers WHERE public_key = $1",
+          [publicKey]
         );
         return Number(result.rows[0].count);
       }
-      async getCredentialCount() {
-        const result = await this.pool.query("SELECT COUNT(*) as count FROM credentials");
-        return Number(result.rows[0].count);
-      }
       async getIceCandidateCount(offerId) {
         const result = await this.pool.query(
           "SELECT COUNT(*) as count FROM ice_candidates WHERE offer_id = $1",
@@ -2245,13 +1582,13 @@ var init_postgres = __esm({
       rowToOffer(row) {
         return {
           id: row.id,
-          username: row.username,
+          publicKey: row.public_key.trim(),
           tags: typeof row.tags === "string" ? JSON.parse(row.tags) : row.tags,
           sdp: row.sdp,
           createdAt: Number(row.created_at),
           expiresAt: Number(row.expires_at),
           lastSeen: Number(row.last_seen),
-          answererUsername: row.answerer_username || void 0,
+          answererPublicKey: row.answerer_public_key?.trim() || void 0,
           answerSdp: row.answer_sdp || void 0,
           answeredAt: row.answered_at ? Number(row.answered_at) : void 0,
           matchedTags: row.matched_tags || void 0
@@ -2261,7 +1598,7 @@ var init_postgres = __esm({
         return {
           id: Number(row.id),
           offerId: row.offer_id,
-          username: row.username,
+          publicKey: row.public_key.trim(),
           role: row.role,
           candidate: typeof row.candidate === "string" ? JSON.parse(row.candidate) : row.candidate,
           createdAt: Number(row.created_at)
@@ -2278,10 +1615,610 @@ var import_node_server = require("@hono/node-server");
 var import_hono = require("hono");
 var import_cors = require("hono/cors");
 
+// src/crypto.ts
+var import_node_buffer = require("node:buffer");
+
+// node_modules/@noble/ed25519/index.js
+var ed25519_CURVE = {
+  p: 0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffedn,
+  n: 0x1000000000000000000000000000000014def9dea2f79cd65812631a5cf5d3edn,
+  h: 8n,
+  a: 0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffecn,
+  d: 0x52036cee2b6ffe738cc740797779e89800700a4d4141d8ab75eb4dca135978a3n,
+  Gx: 0x216936d3cd6e53fec0a4e231fdd6dc5c692cc7609525a7b2c9562d608f25d51an,
+  Gy: 0x6666666666666666666666666666666666666666666666666666666666666658n
+};
+var { p: P, n: N, Gx, Gy, a: _a, d: _d, h } = ed25519_CURVE;
+var L = 32;
+var L2 = 64;
+var captureTrace = (...args) => {
+  if ("captureStackTrace" in Error && typeof Error.captureStackTrace === "function") {
+    Error.captureStackTrace(...args);
+  }
+};
+var err = (message = "") => {
+  const e = new Error(message);
+  captureTrace(e, err);
+  throw e;
+};
+var isBig = (n) => typeof n === "bigint";
+var isStr = (s) => typeof s === "string";
+var isBytes = (a) => a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array";
+var abytes = (value, length, title = "") => {
+  const bytes = isBytes(value);
+  const len = value?.length;
+  const needsLen = length !== void 0;
+  if (!bytes || needsLen && len !== length) {
+    const prefix = title && `"${title}" `;
+    const ofLen = needsLen ? ` of length ${length}` : "";
+    const got = bytes ? `length=${len}` : `type=${typeof value}`;
+    err(prefix + "expected Uint8Array" + ofLen + ", got " + got);
+  }
+  return value;
+};
+var u8n = (len) => new Uint8Array(len);
+var u8fr = (buf) => Uint8Array.from(buf);
+var padh = (n, pad) => n.toString(16).padStart(pad, "0");
+var bytesToHex = (b) => Array.from(abytes(b)).map((e) => padh(e, 2)).join("");
+var C = { _0: 48, _9: 57, A: 65, F: 70, a: 97, f: 102 };
+var _ch = (ch) => {
+  if (ch >= C._0 && ch <= C._9)
+    return ch - C._0;
+  if (ch >= C.A && ch <= C.F)
+    return ch - (C.A - 10);
+  if (ch >= C.a && ch <= C.f)
+    return ch - (C.a - 10);
+  return;
+};
+var hexToBytes = (hex) => {
+  const e = "hex invalid";
+  if (!isStr(hex))
+    return err(e);
+  const hl = hex.length;
+  const al = hl / 2;
+  if (hl % 2)
+    return err(e);
+  const array = u8n(al);
+  for (let ai = 0, hi = 0; ai < al; ai++, hi += 2) {
+    const n1 = _ch(hex.charCodeAt(hi));
+    const n2 = _ch(hex.charCodeAt(hi + 1));
+    if (n1 === void 0 || n2 === void 0)
+      return err(e);
+    array[ai] = n1 * 16 + n2;
+  }
+  return array;
+};
+var cr = () => globalThis?.crypto;
+var subtle = () => cr()?.subtle ?? err("crypto.subtle must be defined, consider polyfill");
+var concatBytes = (...arrs) => {
+  const r = u8n(arrs.reduce((sum, a) => sum + abytes(a).length, 0));
+  let pad = 0;
+  arrs.forEach((a) => {
+    r.set(a, pad);
+    pad += a.length;
+  });
+  return r;
+};
+var big = BigInt;
+var assertRange = (n, min, max, msg = "bad number: out of range") => isBig(n) && min <= n && n < max ? n : err(msg);
+var M = (a, b = P) => {
+  const r = a % b;
+  return r >= 0n ? r : b + r;
+};
+var modN = (a) => M(a, N);
+var invert = (num, md) => {
+  if (num === 0n || md <= 0n)
+    err("no inverse n=" + num + " mod=" + md);
+  let a = M(num, md), b = md, x = 0n, y = 1n, u = 1n, v = 0n;
+  while (a !== 0n) {
+    const q = b / a, r = b % a;
+    const m = x - u * q, n = y - v * q;
+    b = a, a = r, x = u, y = v, u = m, v = n;
+  }
+  return b === 1n ? M(x, md) : err("no inverse");
+};
+var apoint = (p) => p instanceof Point ? p : err("Point expected");
+var B256 = 2n ** 256n;
+var Point = class _Point {
+  static BASE;
+  static ZERO;
+  X;
+  Y;
+  Z;
+  T;
+  constructor(X, Y, Z, T) {
+    const max = B256;
+    this.X = assertRange(X, 0n, max);
+    this.Y = assertRange(Y, 0n, max);
+    this.Z = assertRange(Z, 1n, max);
+    this.T = assertRange(T, 0n, max);
+    Object.freeze(this);
+  }
+  static CURVE() {
+    return ed25519_CURVE;
+  }
+  static fromAffine(p) {
+    return new _Point(p.x, p.y, 1n, M(p.x * p.y));
+  }
+  /** RFC8032 5.1.3: Uint8Array to Point. */
+  static fromBytes(hex, zip215 = false) {
+    const d = _d;
+    const normed = u8fr(abytes(hex, L));
+    const lastByte = hex[31];
+    normed[31] = lastByte & ~128;
+    const y = bytesToNumLE(normed);
+    const max = zip215 ? B256 : P;
+    assertRange(y, 0n, max);
+    const y2 = M(y * y);
+    const u = M(y2 - 1n);
+    const v = M(d * y2 + 1n);
+    let { isValid, value: x } = uvRatio(u, v);
+    if (!isValid)
+      err("bad point: y not sqrt");
+    const isXOdd = (x & 1n) === 1n;
+    const isLastByteOdd = (lastByte & 128) !== 0;
+    if (!zip215 && x === 0n && isLastByteOdd)
+      err("bad point: x==0, isLastByteOdd");
+    if (isLastByteOdd !== isXOdd)
+      x = M(-x);
+    return new _Point(x, y, 1n, M(x * y));
+  }
+  static fromHex(hex, zip215) {
+    return _Point.fromBytes(hexToBytes(hex), zip215);
+  }
+  get x() {
+    return this.toAffine().x;
+  }
+  get y() {
+    return this.toAffine().y;
+  }
+  /** Checks if the point is valid and on-curve. */
+  assertValidity() {
+    const a = _a;
+    const d = _d;
+    const p = this;
+    if (p.is0())
+      return err("bad point: ZERO");
+    const { X, Y, Z, T } = p;
+    const X2 = M(X * X);
+    const Y2 = M(Y * Y);
+    const Z2 = M(Z * Z);
+    const Z4 = M(Z2 * Z2);
+    const aX2 = M(X2 * a);
+    const left = M(Z2 * M(aX2 + Y2));
+    const right = M(Z4 + M(d * M(X2 * Y2)));
+    if (left !== right)
+      return err("bad point: equation left != right (1)");
+    const XY = M(X * Y);
+    const ZT = M(Z * T);
+    if (XY !== ZT)
+      return err("bad point: equation left != right (2)");
+    return this;
+  }
+  /** Equality check: compare points P&Q. */
+  equals(other) {
+    const { X: X1, Y: Y1, Z: Z1 } = this;
+    const { X: X2, Y: Y2, Z: Z2 } = apoint(other);
+    const X1Z2 = M(X1 * Z2);
+    const X2Z1 = M(X2 * Z1);
+    const Y1Z2 = M(Y1 * Z2);
+    const Y2Z1 = M(Y2 * Z1);
+    return X1Z2 === X2Z1 && Y1Z2 === Y2Z1;
+  }
+  is0() {
+    return this.equals(I);
+  }
+  /** Flip point over y coordinate. */
+  negate() {
+    return new _Point(M(-this.X), this.Y, this.Z, M(-this.T));
+  }
+  /** Point doubling. Complete formula. Cost: `4M + 4S + 1*a + 6add + 1*2`. */
+  double() {
+    const { X: X1, Y: Y1, Z: Z1 } = this;
+    const a = _a;
+    const A = M(X1 * X1);
+    const B = M(Y1 * Y1);
+    const C2 = M(2n * M(Z1 * Z1));
+    const D = M(a * A);
+    const x1y1 = X1 + Y1;
+    const E = M(M(x1y1 * x1y1) - A - B);
+    const G2 = D + B;
+    const F = G2 - C2;
+    const H = D - B;
+    const X3 = M(E * F);
+    const Y3 = M(G2 * H);
+    const T3 = M(E * H);
+    const Z3 = M(F * G2);
+    return new _Point(X3, Y3, Z3, T3);
+  }
+  /** Point addition. Complete formula. Cost: `8M + 1*k + 8add + 1*2`. */
+  add(other) {
+    const { X: X1, Y: Y1, Z: Z1, T: T1 } = this;
+    const { X: X2, Y: Y2, Z: Z2, T: T2 } = apoint(other);
+    const a = _a;
+    const d = _d;
+    const A = M(X1 * X2);
+    const B = M(Y1 * Y2);
+    const C2 = M(T1 * d * T2);
+    const D = M(Z1 * Z2);
+    const E = M((X1 + Y1) * (X2 + Y2) - A - B);
+    const F = M(D - C2);
+    const G2 = M(D + C2);
+    const H = M(B - a * A);
+    const X3 = M(E * F);
+    const Y3 = M(G2 * H);
+    const T3 = M(E * H);
+    const Z3 = M(F * G2);
+    return new _Point(X3, Y3, Z3, T3);
+  }
+  subtract(other) {
+    return this.add(apoint(other).negate());
+  }
+  /**
+   * Point-by-scalar multiplication. Scalar must be in range 1 <= n < CURVE.n.
+   * Uses {@link wNAF} for base point.
+   * Uses fake point to mitigate side-channel leakage.
+   * @param n scalar by which point is multiplied
+   * @param safe safe mode guards against timing attacks; unsafe mode is faster
+   */
+  multiply(n, safe = true) {
+    if (!safe && (n === 0n || this.is0()))
+      return I;
+    assertRange(n, 1n, N);
+    if (n === 1n)
+      return this;
+    if (this.equals(G))
+      return wNAF(n).p;
+    let p = I;
+    let f = G;
+    for (let d = this; n > 0n; d = d.double(), n >>= 1n) {
+      if (n & 1n)
+        p = p.add(d);
+      else if (safe)
+        f = f.add(d);
+    }
+    return p;
+  }
+  multiplyUnsafe(scalar) {
+    return this.multiply(scalar, false);
+  }
+  /** Convert point to 2d xy affine point. (X, Y, Z) ∋ (x=X/Z, y=Y/Z) */
+  toAffine() {
+    const { X, Y, Z } = this;
+    if (this.equals(I))
+      return { x: 0n, y: 1n };
+    const iz = invert(Z, P);
+    if (M(Z * iz) !== 1n)
+      err("invalid inverse");
+    const x = M(X * iz);
+    const y = M(Y * iz);
+    return { x, y };
+  }
+  toBytes() {
+    const { x, y } = this.assertValidity().toAffine();
+    const b = numTo32bLE(y);
+    b[31] |= x & 1n ? 128 : 0;
+    return b;
+  }
+  toHex() {
+    return bytesToHex(this.toBytes());
+  }
+  clearCofactor() {
+    return this.multiply(big(h), false);
+  }
+  isSmallOrder() {
+    return this.clearCofactor().is0();
+  }
+  isTorsionFree() {
+    let p = this.multiply(N / 2n, false).double();
+    if (N % 2n)
+      p = p.add(this);
+    return p.is0();
+  }
+};
+var G = new Point(Gx, Gy, 1n, M(Gx * Gy));
+var I = new Point(0n, 1n, 1n, 0n);
+Point.BASE = G;
+Point.ZERO = I;
+var numTo32bLE = (num) => hexToBytes(padh(assertRange(num, 0n, B256), L2)).reverse();
+var bytesToNumLE = (b) => big("0x" + bytesToHex(u8fr(abytes(b)).reverse()));
+var pow2 = (x, power) => {
+  let r = x;
+  while (power-- > 0n) {
+    r *= r;
+    r %= P;
+  }
+  return r;
+};
+var pow_2_252_3 = (x) => {
+  const x2 = x * x % P;
+  const b2 = x2 * x % P;
+  const b4 = pow2(b2, 2n) * b2 % P;
+  const b5 = pow2(b4, 1n) * x % P;
+  const b10 = pow2(b5, 5n) * b5 % P;
+  const b20 = pow2(b10, 10n) * b10 % P;
+  const b40 = pow2(b20, 20n) * b20 % P;
+  const b80 = pow2(b40, 40n) * b40 % P;
+  const b160 = pow2(b80, 80n) * b80 % P;
+  const b240 = pow2(b160, 80n) * b80 % P;
+  const b250 = pow2(b240, 10n) * b10 % P;
+  const pow_p_5_8 = pow2(b250, 2n) * x % P;
+  return { pow_p_5_8, b2 };
+};
+var RM1 = 0x2b8324804fc1df0b2b4d00993dfbd7a72f431806ad2fe478c4ee1b274a0ea0b0n;
+var uvRatio = (u, v) => {
+  const v3 = M(v * v * v);
+  const v7 = M(v3 * v3 * v);
+  const pow = pow_2_252_3(u * v7).pow_p_5_8;
+  let x = M(u * v3 * pow);
+  const vx2 = M(v * x * x);
+  const root1 = x;
+  const root2 = M(x * RM1);
+  const useRoot1 = vx2 === u;
+  const useRoot2 = vx2 === M(-u);
+  const noRoot = vx2 === M(-u * RM1);
+  if (useRoot1)
+    x = root1;
+  if (useRoot2 || noRoot)
+    x = root2;
+  if ((M(x) & 1n) === 1n)
+    x = M(-x);
+  return { isValid: useRoot1 || useRoot2, value: x };
+};
+var modL_LE = (hash) => modN(bytesToNumLE(hash));
+var sha512a = (...m) => hashes.sha512Async(concatBytes(...m));
+var hashFinishA = (res) => sha512a(res.hashable).then(res.finish);
+var defaultVerifyOpts = { zip215: true };
+var _verify = (sig, msg, pub, opts = defaultVerifyOpts) => {
+  sig = abytes(sig, L2);
+  msg = abytes(msg);
+  pub = abytes(pub, L);
+  const { zip215 } = opts;
+  let A;
+  let R;
+  let s;
+  let SB;
+  let hashable = Uint8Array.of();
+  try {
+    A = Point.fromBytes(pub, zip215);
+    R = Point.fromBytes(sig.slice(0, L), zip215);
+    s = bytesToNumLE(sig.slice(L, L2));
+    SB = G.multiply(s, false);
+    hashable = concatBytes(R.toBytes(), A.toBytes(), msg);
+  } catch (error) {
+  }
+  const finish = (hashed) => {
+    if (SB == null)
+      return false;
+    if (!zip215 && A.isSmallOrder())
+      return false;
+    const k = modL_LE(hashed);
+    const RkA = R.add(A.multiply(k, false));
+    return RkA.add(SB.negate()).clearCofactor().is0();
+  };
+  return { hashable, finish };
+};
+var verifyAsync = async (signature, message, publicKey, opts = defaultVerifyOpts) => hashFinishA(_verify(signature, message, publicKey, opts));
+var hashes = {
+  sha512Async: async (message) => {
+    const s = subtle();
+    const m = concatBytes(message);
+    return u8n(await s.digest("SHA-512", m.buffer));
+  },
+  sha512: void 0
+};
+var W = 8;
+var scalarBits = 256;
+var pwindows = Math.ceil(scalarBits / W) + 1;
+var pwindowSize = 2 ** (W - 1);
+var precompute = () => {
+  const points = [];
+  let p = G;
+  let b = p;
+  for (let w = 0; w < pwindows; w++) {
+    b = p;
+    points.push(b);
+    for (let i = 1; i < pwindowSize; i++) {
+      b = b.add(p);
+      points.push(b);
+    }
+    p = b.double();
+  }
+  return points;
+};
+var Gpows = void 0;
+var ctneg = (cnd, p) => {
+  const n = p.negate();
+  return cnd ? n : p;
+};
+var wNAF = (n) => {
+  const comp = Gpows || (Gpows = precompute());
+  let p = I;
+  let f = G;
+  const pow_2_w = 2 ** W;
+  const maxNum = pow_2_w;
+  const mask = big(pow_2_w - 1);
+  const shiftBy = big(W);
+  for (let w = 0; w < pwindows; w++) {
+    let wbits = Number(n & mask);
+    n >>= shiftBy;
+    if (wbits > pwindowSize) {
+      wbits -= maxNum;
+      n += 1n;
+    }
+    const off = w * pwindowSize;
+    const offF = off;
+    const offP = off + Math.abs(wbits) - 1;
+    const isEven = w % 2 !== 0;
+    const isNeg = wbits < 0;
+    if (wbits === 0) {
+      f = f.add(ctneg(isEven, comp[offF]));
+    } else {
+      p = p.add(ctneg(isNeg, comp[offP]));
+    }
+  }
+  if (n !== 0n)
+    err("invalid wnaf");
+  return { p, f };
+};
+
+// src/crypto.ts
+hashes.sha512Async = async (message) => {
+  const hashBuffer = await crypto.subtle.digest("SHA-512", message);
+  return new Uint8Array(hashBuffer);
+};
+function hexToBytes2(hex) {
+  if (hex.length % 2 !== 0) {
+    throw new Error("Hex string must have even length");
+  }
+  for (let i = 0; i < hex.length; i++) {
+    const c = hex[i].toLowerCase();
+    if ((c < "0" || c > "9") && (c < "a" || c > "f")) {
+      throw new Error(`Invalid hex character at position ${i}: '${hex[i]}'`);
+    }
+  }
+  const match = hex.match(/.{1,2}/g);
+  if (!match) {
+    throw new Error("Invalid hex string format");
+  }
+  return new Uint8Array(match.map((byte) => {
+    const parsed = parseInt(byte, 16);
+    if (isNaN(parsed)) {
+      throw new Error(`Invalid hex byte: ${byte}`);
+    }
+    return parsed;
+  }));
+}
+function canonicalJSON(obj, depth = 0) {
+  const MAX_DEPTH = 100;
+  if (depth > MAX_DEPTH) {
+    throw new Error("Object nesting too deep for canonicalization");
+  }
+  if (obj === null) return "null";
+  if (obj === void 0) return JSON.stringify(void 0);
+  const type = typeof obj;
+  if (type === "function") throw new Error("Functions are not supported in RPC parameters");
+  if (type === "symbol" || type === "bigint") throw new Error(`${type} is not supported in RPC parameters`);
+  if (type === "number" && !Number.isFinite(obj)) throw new Error("NaN and Infinity are not supported in RPC parameters");
+  if (type !== "object") return JSON.stringify(obj);
+  if (Array.isArray(obj)) {
+    return "[" + obj.map((item) => canonicalJSON(item, depth + 1)).join(",") + "]";
+  }
+  const sortedKeys = Object.keys(obj).sort();
+  const pairs = sortedKeys.map((key) => JSON.stringify(key) + ":" + canonicalJSON(obj[key], depth + 1));
+  return "{" + pairs.join(",") + "}";
+}
+function buildSignatureMessage(timestamp, nonce, method, params) {
+  if (nonce.length !== 36) {
+    throw new Error("Nonce must be a valid UUID v4 (use crypto.randomUUID())");
+  }
+  if (nonce[8] !== "-" || nonce[13] !== "-" || nonce[18] !== "-" || nonce[23] !== "-") {
+    throw new Error("Nonce must be a valid UUID v4 (use crypto.randomUUID())");
+  }
+  if (nonce[14] !== "4") {
+    throw new Error("Nonce must be a valid UUID v4 (use crypto.randomUUID())");
+  }
+  const variant = nonce[19].toLowerCase();
+  if (variant !== "8" && variant !== "9" && variant !== "a" && variant !== "b") {
+    throw new Error("Nonce must be a valid UUID v4 (use crypto.randomUUID())");
+  }
+  const hexChars = nonce.replace(/-/g, "");
+  for (let i = 0; i < hexChars.length; i++) {
+    const c = hexChars[i].toLowerCase();
+    if ((c < "0" || c > "9") && (c < "a" || c > "f")) {
+      throw new Error("Nonce must be a valid UUID v4 (use crypto.randomUUID())");
+    }
+  }
+  const paramsStr = canonicalJSON(params || {});
+  return `${timestamp}:${nonce}:${method}:${paramsStr}`;
+}
+var ED25519_PUBLIC_KEY_LENGTH = 32;
+var ED25519_SIGNATURE_LENGTH = 64;
+function validatePublicKey(publicKey) {
+  if (typeof publicKey !== "string") {
+    return { valid: false, error: "Public key must be a string" };
+  }
+  if (publicKey.length !== ED25519_PUBLIC_KEY_LENGTH * 2) {
+    return { valid: false, error: `Public key must be ${ED25519_PUBLIC_KEY_LENGTH * 2} hex characters (${ED25519_PUBLIC_KEY_LENGTH} bytes)` };
+  }
+  for (let i = 0; i < publicKey.length; i++) {
+    const c = publicKey[i];
+    if ((c < "0" || c > "9") && (c < "a" || c > "f")) {
+      return { valid: false, error: `Invalid hex character at position ${i}: '${c}' (use lowercase hex)` };
+    }
+  }
+  return { valid: true };
+}
+async function verifyEd25519Signature(publicKey, message, signature) {
+  try {
+    const pkValidation = validatePublicKey(publicKey);
+    if (!pkValidation.valid) {
+      console.error("Ed25519 verification error: invalid public key:", pkValidation.error);
+      return false;
+    }
+    const publicKeyBytes = hexToBytes2(publicKey);
+    const encoder = new TextEncoder();
+    const messageBytes = encoder.encode(message);
+    const signatureBytes = import_node_buffer.Buffer.from(signature, "base64");
+    if (signatureBytes.length !== ED25519_SIGNATURE_LENGTH) {
+      console.error(`Ed25519 verification error: signature length ${signatureBytes.length}, expected ${ED25519_SIGNATURE_LENGTH}`);
+      return false;
+    }
+    return await verifyAsync(signatureBytes, messageBytes, publicKeyBytes);
+  } catch (error) {
+    console.error("Ed25519 verification error:", error);
+    return false;
+  }
+}
+var TAG_MIN_LENGTH = 1;
+var TAG_MAX_LENGTH = 64;
+var TAG_REGEX = /^[a-z0-9]([a-z0-9.-]*[a-z0-9])?$/;
+function validateTag(tag) {
+  if (typeof tag !== "string") {
+    return { valid: false, error: "Tag must be a string" };
+  }
+  if (tag.length < TAG_MIN_LENGTH) {
+    return { valid: false, error: `Tag must be at least ${TAG_MIN_LENGTH} character` };
+  }
+  if (tag.length > TAG_MAX_LENGTH) {
+    return { valid: false, error: `Tag must be at most ${TAG_MAX_LENGTH} characters` };
+  }
+  if (tag.length === 1) {
+    if (!/^[a-z0-9]$/.test(tag)) {
+      return { valid: false, error: "Tag must be lowercase alphanumeric" };
+    }
+    return { valid: true };
+  }
+  if (!TAG_REGEX.test(tag)) {
+    return { valid: false, error: "Tag must be lowercase alphanumeric with optional dots/dashes, and start/end with alphanumeric" };
+  }
+  return { valid: true };
+}
+function validateTags(tags, maxTags = 20) {
+  if (!Array.isArray(tags)) {
+    return { valid: false, error: "Tags must be an array" };
+  }
+  if (tags.length === 0) {
+    return { valid: false, error: "At least one tag is required" };
+  }
+  if (tags.length > maxTags) {
+    return { valid: false, error: `Maximum ${maxTags} tags allowed` };
+  }
+  for (let i = 0; i < tags.length; i++) {
+    const result = validateTag(tags[i]);
+    if (!result.valid) {
+      return { valid: false, error: `Tag ${i + 1}: ${result.error}` };
+    }
+  }
+  const uniqueTags = new Set(tags);
+  if (uniqueTags.size !== tags.length) {
+    return { valid: false, error: "Duplicate tags are not allowed" };
+  }
+  return { valid: true };
+}
+
 // src/rpc.ts
-init_crypto();
 var MAX_PAGE_SIZE = 100;
-var CREDENTIAL_RATE_WINDOW = 1e3;
 var REQUEST_RATE_WINDOW = 1e3;
 function getJsonDepth(obj, maxDepth, currentDepth = 0) {
   if (obj === null || typeof obj !== "object") {
@@ -2312,7 +2249,7 @@ var ErrorCodes = {
   AUTH_REQUIRED: "AUTH_REQUIRED",
   INVALID_CREDENTIALS: "INVALID_CREDENTIALS",
   // Validation errors
-  INVALID_NAME: "INVALID_NAME",
+  INVALID_PUBLIC_KEY: "INVALID_PUBLIC_KEY",
   INVALID_TAG: "INVALID_TAG",
   INVALID_SDP: "INVALID_SDP",
   INVALID_PARAMS: "INVALID_PARAMS",
@@ -2353,108 +2290,29 @@ function validateTimestamp(timestamp, config) {
     throw new RpcError(ErrorCodes.INVALID_PARAMS, "Timestamp too far in future");
   }
 }
-async function verifyRequestSignature(name, timestamp, nonce, signature, method, params, storage, config) {
+async function verifyRequestSignature(publicKey, timestamp, nonce, signature, method, params, storage, config) {
   validateTimestamp(timestamp, config);
-  const credential = await storage.getCredential(name);
-  if (!credential) {
-    throw new RpcError(ErrorCodes.INVALID_CREDENTIALS, "Invalid credentials");
+  const pkValidation = validatePublicKey(publicKey);
+  if (!pkValidation.valid) {
+    throw new RpcError(ErrorCodes.INVALID_PUBLIC_KEY, pkValidation.error || "Invalid public key");
   }
   const message = buildSignatureMessage(timestamp, nonce, method, params);
-  const isValid = await verifySignature(credential.secret, message, signature);
+  const isValid = await verifyEd25519Signature(publicKey, message, signature);
   if (!isValid) {
     throw new RpcError(ErrorCodes.INVALID_CREDENTIALS, "Invalid signature");
   }
-  const nonceKey = `nonce:${name}:${nonce}`;
+  const nonceKey = `nonce:${publicKey}:${nonce}`;
   const nonceExpiresAt = timestamp + config.timestampMaxAge;
   const nonceIsNew = await storage.checkAndMarkNonce(nonceKey, nonceExpiresAt);
   if (!nonceIsNew) {
     throw new RpcError(ErrorCodes.INVALID_CREDENTIALS, "Nonce already used (replay attack detected)");
   }
-  const now = Date.now();
-  const credentialExpiresAt = now + 365 * 24 * 60 * 60 * 1e3;
-  await storage.updateCredentialUsage(name, now, credentialExpiresAt);
 }
 var handlers = {
   /**
-   * Generate new credentials (name + secret pair)
-   * No authentication required - this is how users get started
-   * SECURITY: Rate limited per IP to prevent abuse (database-backed for multi-instance support)
-   */
-  async generateCredentials(params, name, timestamp, signature, storage, config, request) {
-    const credentialCount = await storage.getCredentialCount();
-    if (credentialCount >= config.maxTotalCredentials) {
-      throw new RpcError(
-        ErrorCodes.STORAGE_FULL,
-        `Server credential limit reached (${config.maxTotalCredentials}). Try again later.`
-      );
-    }
-    let rateLimitKey;
-    let rateLimit;
-    if (!request.clientIp) {
-      console.warn("\u26A0\uFE0F  WARNING: Unable to determine client IP for credential generation. Using global rate limit.");
-      rateLimitKey = "cred_gen:global_unknown";
-      rateLimit = 2;
-    } else {
-      rateLimitKey = `cred_gen:${request.clientIp}`;
-      rateLimit = config.credentialsPerIpPerSecond;
-    }
-    const allowed = await storage.checkRateLimit(
-      rateLimitKey,
-      rateLimit,
-      CREDENTIAL_RATE_WINDOW
-    );
-    if (!allowed) {
-      throw new RpcError(
-        ErrorCodes.RATE_LIMIT_EXCEEDED,
-        `Rate limit exceeded. Maximum ${rateLimit} credentials per second${request.clientIp ? " per IP" : " (global limit for unidentified IPs)"}.`
-      );
-    }
-    if (params.name !== void 0) {
-      if (typeof params.name !== "string") {
-        throw new RpcError(ErrorCodes.INVALID_PARAMS, "name must be a string");
-      }
-      const usernameValidation = validateUsername(params.name);
-      if (!usernameValidation.valid) {
-        throw new RpcError(ErrorCodes.INVALID_PARAMS, usernameValidation.error || "Invalid username");
-      }
-    }
-    if (params.expiresAt !== void 0) {
-      if (typeof params.expiresAt !== "number" || isNaN(params.expiresAt) || !Number.isFinite(params.expiresAt)) {
-        throw new RpcError(ErrorCodes.INVALID_PARAMS, "expiresAt must be a valid timestamp");
-      }
-      const now = Date.now();
-      if (params.expiresAt < now - 6e4) {
-        throw new RpcError(ErrorCodes.INVALID_PARAMS, "expiresAt cannot be in the past");
-      }
-      const maxFuture = now + 10 * 365 * 24 * 60 * 60 * 1e3;
-      if (params.expiresAt > maxFuture) {
-        throw new RpcError(ErrorCodes.INVALID_PARAMS, "expiresAt cannot be more than 10 years in the future");
-      }
-    }
-    try {
-      const credential = await storage.generateCredentials({
-        name: params.name,
-        expiresAt: params.expiresAt
-      });
-      return {
-        name: credential.name,
-        secret: credential.secret,
-        createdAt: credential.createdAt,
-        expiresAt: credential.expiresAt
-      };
-    } catch (error) {
-      if (error.message === "Username already taken") {
-        throw new RpcError(ErrorCodes.INVALID_PARAMS, "Username already taken");
-      }
-      throw error;
-    }
-  },
-  /**
-   * Discover offers by tags - Supports 2 modes:
-   * 1. Paginated discovery: tags array with limit/offset
-   * 2. Random discovery: tags array without limit (returns single random offer)
+   * Discover offers by tags
    */
-  async discover(params, name, timestamp, signature, storage, config, request) {
+  async discover(params, publicKey, timestamp, signature, storage, config, request) {
     const { tags, limit, offset } = params;
     const tagsValidation = validateTags(tags);
     if (!tagsValidation.valid) {
@@ -2469,17 +2327,17 @@ var handlers = {
       }
       const pageLimit = Math.min(Math.max(1, limit), MAX_PAGE_SIZE);
       const pageOffset = Math.max(0, offset || 0);
-      const excludeUsername2 = name || null;
+      const excludePublicKey2 = publicKey || null;
       const offers = await storage.discoverOffers(
         tags,
-        excludeUsername2,
+        excludePublicKey2,
         pageLimit,
         pageOffset
       );
       return {
         offers: offers.map((offer2) => ({
           offerId: offer2.id,
-          username: offer2.username,
+          publicKey: offer2.publicKey,
           tags: offer2.tags,
           sdp: offer2.sdp,
           createdAt: offer2.createdAt,
@@ -2490,14 +2348,14 @@ var handlers = {
         offset: pageOffset
       };
     }
-    const excludeUsername = name || null;
-    const offer = await storage.getRandomOffer(tags, excludeUsername);
+    const excludePublicKey = publicKey || null;
+    const offer = await storage.getRandomOffer(tags, excludePublicKey);
     if (!offer) {
       throw new RpcError(ErrorCodes.OFFER_NOT_FOUND, "No offers found matching tags");
     }
     return {
       offerId: offer.id,
-      username: offer.username,
+      publicKey: offer.publicKey,
       tags: offer.tags,
       sdp: offer.sdp,
       createdAt: offer.createdAt,
@@ -2507,10 +2365,10 @@ var handlers = {
   /**
    * Publish offers with tags
    */
-  async publishOffer(params, name, timestamp, signature, storage, config, request) {
+  async publishOffer(params, publicKey, timestamp, signature, storage, config, request) {
     const { tags, offers, ttl } = params;
-    if (!name) {
-      throw new RpcError(ErrorCodes.AUTH_REQUIRED, "Name required for offer publishing");
+    if (!publicKey) {
+      throw new RpcError(ErrorCodes.AUTH_REQUIRED, "Authentication required for offer publishing");
     }
     const tagsValidation = validateTags(tags);
     if (!tagsValidation.valid) {
@@ -2525,7 +2383,7 @@ var handlers = {
         `Too many offers (max ${config.maxOffersPerRequest})`
       );
     }
-    const userOfferCount = await storage.getOfferCountByUsername(name);
+    const userOfferCount = await storage.getOfferCountByPublicKey(publicKey);
     if (userOfferCount + offers.length > config.maxOffersPerUser) {
       throw new RpcError(
         ErrorCodes.TOO_MANY_OFFERS_PER_USER,
@@ -2559,20 +2417,17 @@ var handlers = {
       }
     }
     const now = Date.now();
-    const offerTtl = ttl !== void 0 ? Math.min(
-      Math.max(ttl, config.offerMinTtl),
-      config.offerMaxTtl
-    ) : config.offerDefaultTtl;
+    const offerTtl = ttl !== void 0 ? Math.min(Math.max(ttl, config.offerMinTtl), config.offerMaxTtl) : config.offerDefaultTtl;
     const expiresAt = now + offerTtl;
     const offerRequests = offers.map((offer) => ({
-      username: name,
+      publicKey,
       tags,
       sdp: offer.sdp,
       expiresAt
     }));
     const createdOffers = await storage.createOffers(offerRequests);
     return {
-      username: name,
+      publicKey,
       tags,
       offers: createdOffers.map((offer) => ({
         offerId: offer.id,
@@ -2587,26 +2442,26 @@ var handlers = {
   /**
    * Delete an offer by ID
    */
-  async deleteOffer(params, name, timestamp, signature, storage, config, request) {
+  async deleteOffer(params, publicKey, timestamp, signature, storage, config, request) {
     const { offerId } = params;
-    if (!name) {
-      throw new RpcError(ErrorCodes.AUTH_REQUIRED, "Name required");
+    if (!publicKey) {
+      throw new RpcError(ErrorCodes.AUTH_REQUIRED, "Authentication required");
     }
     validateStringParam(offerId, "offerId");
-    const deleted = await storage.deleteOffer(offerId, name);
+    const deleted = await storage.deleteOffer(offerId, publicKey);
     if (!deleted) {
-      throw new RpcError(ErrorCodes.NOT_AUTHORIZED, "Offer not found or not owned by this name");
+      throw new RpcError(ErrorCodes.NOT_AUTHORIZED, "Offer not found or not owned by this identity");
     }
     return { success: true };
   },
   /**
    * Answer an offer
    */
-  async answerOffer(params, name, timestamp, signature, storage, config, request) {
+  async answerOffer(params, publicKey, timestamp, signature, storage, config, request) {
     const { offerId, sdp, matchedTags } = params;
     validateStringParam(offerId, "offerId");
-    if (!name) {
-      throw new RpcError(ErrorCodes.AUTH_REQUIRED, "Name required");
+    if (!publicKey) {
+      throw new RpcError(ErrorCodes.AUTH_REQUIRED, "Authentication required");
     }
     if (!sdp || typeof sdp !== "string" || sdp.length === 0) {
       throw new RpcError(ErrorCodes.INVALID_SDP, "Invalid SDP");
@@ -2621,7 +2476,7 @@ var handlers = {
     if (!offer) {
       throw new RpcError(ErrorCodes.OFFER_NOT_FOUND, "Offer not found");
     }
-    if (offer.answererUsername) {
+    if (offer.answererPublicKey) {
       throw new RpcError(ErrorCodes.OFFER_ALREADY_ANSWERED, "Offer already answered");
     }
     if (matchedTags && matchedTags.length > 0) {
@@ -2631,53 +2486,53 @@ var handlers = {
         throw new RpcError(ErrorCodes.INVALID_PARAMS, `matchedTags contains tags not on offer: ${invalidTags.join(", ")}`);
       }
     }
-    await storage.answerOffer(offerId, name, sdp, matchedTags);
+    await storage.answerOffer(offerId, publicKey, sdp, matchedTags);
     return { success: true, offerId };
   },
   /**
    * Get answer for an offer
    */
-  async getOfferAnswer(params, name, timestamp, signature, storage, config, request) {
+  async getOfferAnswer(params, publicKey, timestamp, signature, storage, config, request) {
     const { offerId } = params;
     validateStringParam(offerId, "offerId");
-    if (!name) {
-      throw new RpcError(ErrorCodes.AUTH_REQUIRED, "Name required");
+    if (!publicKey) {
+      throw new RpcError(ErrorCodes.AUTH_REQUIRED, "Authentication required");
     }
     const offer = await storage.getOfferById(offerId);
     if (!offer) {
       throw new RpcError(ErrorCodes.OFFER_NOT_FOUND, "Offer not found");
     }
-    if (offer.username !== name) {
+    if (offer.publicKey !== publicKey) {
       throw new RpcError(ErrorCodes.NOT_AUTHORIZED, "Not authorized to access this offer");
     }
-    if (!offer.answererUsername || !offer.answerSdp) {
+    if (!offer.answererPublicKey || !offer.answerSdp) {
       throw new RpcError(ErrorCodes.OFFER_NOT_ANSWERED, "Offer not yet answered");
     }
     return {
       sdp: offer.answerSdp,
       offerId: offer.id,
-      answererId: offer.answererUsername,
+      answererPublicKey: offer.answererPublicKey,
       answeredAt: offer.answeredAt
     };
   },
   /**
    * Combined polling for answers and ICE candidates
    */
-  async poll(params, name, timestamp, signature, storage, config, request) {
+  async poll(params, publicKey, timestamp, signature, storage, config, request) {
     const { since } = params;
-    if (!name) {
-      throw new RpcError(ErrorCodes.AUTH_REQUIRED, "Name required");
+    if (!publicKey) {
+      throw new RpcError(ErrorCodes.AUTH_REQUIRED, "Authentication required");
     }
     if (since !== void 0 && (typeof since !== "number" || since < 0 || !Number.isFinite(since))) {
       throw new RpcError(ErrorCodes.INVALID_PARAMS, "Invalid since parameter: must be a non-negative number");
     }
     const sinceTimestamp = since !== void 0 ? since : 0;
-    const answeredOffers = await storage.getAnsweredOffers(name);
+    const answeredOffers = await storage.getAnsweredOffers(publicKey);
     const filteredAnswers = answeredOffers.filter(
       (offer) => offer.answeredAt && offer.answeredAt > sinceTimestamp
     );
-    const ownedOffers = await storage.getOffersByUsername(name);
-    const answeredByUser = await storage.getOffersAnsweredBy(name);
+    const ownedOffers = await storage.getOffersByPublicKey(publicKey);
+    const answeredByUser = await storage.getOffersAnsweredBy(publicKey);
     const allOfferIds = [
       ...ownedOffers.map((offer) => offer.id),
       ...answeredByUser.map((offer) => offer.id)
@@ -2685,7 +2540,7 @@ var handlers = {
     const offerIds = [...new Set(allOfferIds)];
     const iceCandidatesMap = await storage.getIceCandidatesForMultipleOffers(
       offerIds,
-      name,
+      publicKey,
       sinceTimestamp
     );
     const iceCandidatesByOffer = {};
@@ -2695,7 +2550,7 @@ var handlers = {
     return {
       answers: filteredAnswers.map((offer) => ({
         offerId: offer.id,
-        answererId: offer.answererUsername,
+        answererPublicKey: offer.answererPublicKey,
         sdp: offer.answerSdp,
         answeredAt: offer.answeredAt
       })),
@@ -2705,11 +2560,11 @@ var handlers = {
   /**
    * Add ICE candidates
    */
-  async addIceCandidates(params, name, timestamp, signature, storage, config, request) {
+  async addIceCandidates(params, publicKey, timestamp, signature, storage, config, request) {
     const { offerId, candidates } = params;
     validateStringParam(offerId, "offerId");
-    if (!name) {
-      throw new RpcError(ErrorCodes.AUTH_REQUIRED, "Name required");
+    if (!publicKey) {
+      throw new RpcError(ErrorCodes.AUTH_REQUIRED, "Authentication required");
     }
     if (!Array.isArray(candidates) || candidates.length === 0) {
       throw new RpcError(ErrorCodes.MISSING_PARAMS, "Missing or invalid required parameter: candidates");
@@ -2755,10 +2610,10 @@ var handlers = {
         `ICE candidate limit exceeded for offer. Current: ${currentCandidateCount}, limit: ${config.maxIceCandidatesPerOffer}.`
       );
     }
-    const role = offer.username === name ? "offerer" : "answerer";
+    const role = offer.publicKey === publicKey ? "offerer" : "answerer";
     const count = await storage.addIceCandidates(
       offerId,
-      name,
+      publicKey,
       role,
       candidates
     );
@@ -2767,11 +2622,11 @@ var handlers = {
   /**
    * Get ICE candidates
    */
-  async getIceCandidates(params, name, timestamp, signature, storage, config, request) {
+  async getIceCandidates(params, publicKey, timestamp, signature, storage, config, request) {
     const { offerId, since } = params;
     validateStringParam(offerId, "offerId");
-    if (!name) {
-      throw new RpcError(ErrorCodes.AUTH_REQUIRED, "Name required");
+    if (!publicKey) {
+      throw new RpcError(ErrorCodes.AUTH_REQUIRED, "Authentication required");
     }
     if (since !== void 0 && (typeof since !== "number" || since < 0 || !Number.isFinite(since))) {
       throw new RpcError(ErrorCodes.INVALID_PARAMS, "Invalid since parameter: must be a non-negative number");
@@ -2781,8 +2636,8 @@ var handlers = {
     if (!offer) {
       throw new RpcError(ErrorCodes.OFFER_NOT_FOUND, "Offer not found");
     }
-    const isOfferer = offer.username === name;
-    const isAnswerer = offer.answererUsername === name;
+    const isOfferer = offer.publicKey === publicKey;
+    const isAnswerer = offer.answererPublicKey === publicKey;
     if (!isOfferer && !isAnswerer) {
       throw new RpcError(ErrorCodes.NOT_AUTHORIZED, "Not authorized to access ICE candidates for this offer");
     }
@@ -2801,12 +2656,10 @@ var handlers = {
     };
   }
 };
-var UNAUTHENTICATED_METHODS = /* @__PURE__ */ new Set(["generateCredentials", "discover"]);
+var UNAUTHENTICATED_METHODS = /* @__PURE__ */ new Set(["discover"]);
 async function handleRpc(requests, ctx, storage, config) {
   const responses = [];
-  const clientIp = ctx.req.header("cf-connecting-ip") || // Cloudflare
-  ctx.req.header("x-real-ip") || // Nginx
-  ctx.req.header("x-forwarded-for")?.split(",")[0].trim() || void 0;
+  const clientIp = ctx.req.header("cf-connecting-ip") || ctx.req.header("x-real-ip") || ctx.req.header("x-forwarded-for")?.split(",")[0].trim() || void 0;
   if (clientIp) {
     const rateLimitKey = `req:${clientIp}`;
     const allowed = await storage.checkRateLimit(
@@ -2822,7 +2675,7 @@ async function handleRpc(requests, ctx, storage, config) {
       }));
     }
   }
-  const name = ctx.req.header("X-Name");
+  const publicKey = ctx.req.header("X-PublicKey");
   const timestampHeader = ctx.req.header("X-Timestamp");
   const nonce = ctx.req.header("X-Nonce");
   const signature = ctx.req.header("X-Signature");
@@ -2867,10 +2720,10 @@ async function handleRpc(requests, ctx, storage, config) {
       }
       const requiresAuth = !UNAUTHENTICATED_METHODS.has(method);
       if (requiresAuth) {
-        if (!name || typeof name !== "string") {
+        if (!publicKey || typeof publicKey !== "string") {
           responses.push({
             success: false,
-            error: "Missing or invalid X-Name header",
+            error: "Missing or invalid X-PublicKey header",
             errorCode: ErrorCodes.AUTH_REQUIRED
           });
           continue;
@@ -2900,7 +2753,7 @@ async function handleRpc(requests, ctx, storage, config) {
           continue;
         }
         await verifyRequestSignature(
-          name,
+          publicKey,
           timestamp,
           nonce,
           signature,
@@ -2911,7 +2764,7 @@ async function handleRpc(requests, ctx, storage, config) {
         );
         const result = await handler(
           params || {},
-          name,
+          publicKey,
           timestamp,
           signature,
           storage,
@@ -2925,11 +2778,9 @@ async function handleRpc(requests, ctx, storage, config) {
       } else {
         const result = await handler(
           params || {},
-          name || "",
+          publicKey || "",
           0,
-          // timestamp
           "",
-          // signature
           storage,
           config,
           { ...request, clientIp }
@@ -2939,15 +2790,15 @@ async function handleRpc(requests, ctx, storage, config) {
           result
         });
       }
-    } catch (err) {
-      if (err instanceof RpcError) {
+    } catch (err2) {
+      if (err2 instanceof RpcError) {
         responses.push({
           success: false,
-          error: err.message,
-          errorCode: err.errorCode
+          error: err2.message,
+          errorCode: err2.errorCode
         });
       } else {
-        console.error("Unexpected RPC error:", err);
+        console.error("Unexpected RPC error:", err2);
         responses.push({
           success: false,
           error: "Internal server error",
@@ -2973,7 +2824,7 @@ function createApp(storage, config) {
       return config.corsOrigins[0];
     },
     allowMethods: ["GET", "POST", "OPTIONS"],
-    allowHeaders: ["Content-Type", "Origin", "X-Name", "X-Timestamp", "X-Nonce", "X-Signature"],
+    allowHeaders: ["Content-Type", "Origin", "X-PublicKey", "X-Timestamp", "X-Nonce", "X-Signature"],
     exposeHeaders: ["Content-Type"],
     credentials: false,
     maxAge: 86400
@@ -2982,7 +2833,7 @@ function createApp(storage, config) {
     return c.json({
       version: config.version,
       name: "Rondevu",
-      description: "WebRTC signaling with RPC interface and HMAC signature-based authentication"
+      description: "WebRTC signaling with RPC interface and Ed25519 signature-based authentication"
     }, 200);
   });
   app.get("/health", (c) => {
@@ -3019,9 +2870,9 @@ function createApp(storage, config) {
       }
       const responses = await handleRpc(requests, c, storage, config);
       return c.json(responses, 200);
-    } catch (err) {
-      console.error("RPC error:", err);
-      const errorMsg = err instanceof SyntaxError ? "Invalid JSON in request body" : "Request must be valid JSON array";
+    } catch (err2) {
+      console.error("RPC error:", err2);
+      const errorMsg = err2 instanceof SyntaxError ? "Invalid JSON in request body" : "Request must be valid JSON array";
       return c.json([{
         success: false,
         error: errorMsg,
@@ -3038,24 +2889,8 @@ function createApp(storage, config) {
 }
 
 // src/config.ts
-var BUILD_VERSION = true ? "0.5.12" : "unknown";
+var BUILD_VERSION = true ? "0.5.14" : "unknown";
 function loadConfig() {
-  let masterEncryptionKey = process.env.MASTER_ENCRYPTION_KEY;
-  if (!masterEncryptionKey) {
-    const isDevelopment = process.env.NODE_ENV === "development";
-    if (!isDevelopment) {
-      throw new Error(
-        "MASTER_ENCRYPTION_KEY environment variable must be set. Generate with: openssl rand -hex 32\nFor development only, set NODE_ENV=development to use insecure dev key."
-      );
-    }
-    console.error("\u26A0\uFE0F  WARNING: Using insecure deterministic development key");
-    console.error("\u26A0\uFE0F  ONLY use NODE_ENV=development for local development");
-    console.error("\u26A0\uFE0F  Generate production key with: openssl rand -hex 32");
-    masterEncryptionKey = "a3f8b9c2d1e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0";
-  }
-  if (masterEncryptionKey.length !== 64 || !/^[0-9a-fA-F]{64}$/.test(masterEncryptionKey)) {
-    throw new Error("MASTER_ENCRYPTION_KEY must be 64-character hex string (32 bytes). Generate with: openssl rand -hex 32");
-  }
   function parsePositiveInt(value, defaultValue, name, min = 1) {
     const parsed = parseInt(value || defaultValue, 10);
     if (isNaN(parsed)) {
@@ -3091,13 +2926,10 @@ function loadConfig() {
     // Min 1 second
     timestampMaxFuture: parsePositiveInt(process.env.TIMESTAMP_MAX_FUTURE, "60000", "TIMESTAMP_MAX_FUTURE", 1e3),
     // Min 1 second
-    masterEncryptionKey,
     // Resource limits
     maxOffersPerUser: parsePositiveInt(process.env.MAX_OFFERS_PER_USER, "1000", "MAX_OFFERS_PER_USER", 1),
     maxTotalOffers: parsePositiveInt(process.env.MAX_TOTAL_OFFERS, "100000", "MAX_TOTAL_OFFERS", 1),
-    maxTotalCredentials: parsePositiveInt(process.env.MAX_TOTAL_CREDENTIALS, "50000", "MAX_TOTAL_CREDENTIALS", 1),
     maxIceCandidatesPerOffer: parsePositiveInt(process.env.MAX_ICE_CANDIDATES_PER_OFFER, "50", "MAX_ICE_CANDIDATES_PER_OFFER", 1),
-    credentialsPerIpPerSecond: parsePositiveInt(process.env.CREDENTIALS_PER_IP_PER_SECOND, "5", "CREDENTIALS_PER_IP_PER_SECOND", 1),
     requestsPerIpPerSecond: parsePositiveInt(process.env.REQUESTS_PER_IP_PER_SECOND, "50", "REQUESTS_PER_IP_PER_SECOND", 1)
   };
   return config;
@@ -3119,17 +2951,14 @@ var CONFIG_DEFAULTS = {
   // Resource limits
   maxOffersPerUser: 1e3,
   maxTotalOffers: 1e5,
-  maxTotalCredentials: 5e4,
   maxIceCandidatesPerOffer: 50,
-  credentialsPerIpPerSecond: 5,
   requestsPerIpPerSecond: 50
 };
 async function runCleanup(storage, now) {
   const offers = await storage.deleteExpiredOffers(now);
-  const credentials = await storage.deleteExpiredCredentials(now);
   const rateLimits = await storage.deleteExpiredRateLimits(now);
   const nonces = await storage.deleteExpiredNonces(now);
-  return { offers, credentials, rateLimits, nonces };
+  return { offers, rateLimits, nonces };
 }
 
 // src/storage/factory.ts
@@ -3137,36 +2966,25 @@ async function createStorage(config) {
   switch (config.type) {
     case "memory": {
       const { MemoryStorage: MemoryStorage2 } = await Promise.resolve().then(() => (init_memory(), memory_exports));
-      return new MemoryStorage2(config.masterEncryptionKey);
+      return new MemoryStorage2();
     }
     case "sqlite": {
       const { SQLiteStorage: SQLiteStorage2 } = await Promise.resolve().then(() => (init_sqlite(), sqlite_exports));
-      return new SQLiteStorage2(
-        config.sqlitePath || ":memory:",
-        config.masterEncryptionKey
-      );
+      return new SQLiteStorage2(config.sqlitePath || ":memory:");
     }
     case "mysql": {
       if (!config.connectionString) {
         throw new Error("MySQL storage requires DATABASE_URL connection string");
       }
       const { MySQLStorage: MySQLStorage2 } = await Promise.resolve().then(() => (init_mysql(), mysql_exports));
-      return MySQLStorage2.create(
-        config.connectionString,
-        config.masterEncryptionKey,
-        config.poolSize || 10
-      );
+      return MySQLStorage2.create(config.connectionString, config.poolSize || 10);
     }
     case "postgres": {
       if (!config.connectionString) {
         throw new Error("PostgreSQL storage requires DATABASE_URL connection string");
       }
       const { PostgreSQLStorage: PostgreSQLStorage2 } = await Promise.resolve().then(() => (init_postgres(), postgres_exports));
-      return PostgreSQLStorage2.create(
-        config.connectionString,
-        config.masterEncryptionKey,
-        config.poolSize || 10
-      );
+      return PostgreSQLStorage2.create(config.connectionString, config.poolSize || 10);
     }
     default:
       throw new Error(`Unsupported storage type: ${config.type}`);
@@ -3189,7 +3007,6 @@ async function main() {
   });
   const storage = await createStorage({
     type: config.storageType,
-    masterEncryptionKey: config.masterEncryptionKey,
     sqlitePath: config.storagePath,
     connectionString: config.databaseUrl,
     poolSize: config.dbPoolSize
@@ -3198,12 +3015,12 @@ async function main() {
   const cleanupTimer = setInterval(async () => {
     try {
       const result = await runCleanup(storage, Date.now());
-      const total = result.offers + result.credentials + result.rateLimits + result.nonces;
+      const total = result.offers + result.rateLimits + result.nonces;
       if (total > 0) {
-        console.log(`Cleanup: ${result.offers} offers, ${result.credentials} credentials, ${result.rateLimits} rate limits, ${result.nonces} nonces`);
+        console.log(`Cleanup: ${result.offers} offers, ${result.rateLimits} rate limits, ${result.nonces} nonces`);
       }
-    } catch (err) {
-      console.error("Cleanup error:", err);
+    } catch (err2) {
+      console.error("Cleanup error:", err2);
     }
   }, config.cleanupInterval);
   const app = createApp(storage, config);
@@ -3222,8 +3039,13 @@ async function main() {
   process.on("SIGINT", shutdown);
   process.on("SIGTERM", shutdown);
 }
-main().catch((err) => {
-  console.error("Fatal error:", err);
+main().catch((err2) => {
+  console.error("Fatal error:", err2);
   process.exit(1);
 });
+/*! Bundled license information:
+
+@noble/ed25519/index.js:
+  (*! noble-ed25519 - MIT License (c) 2019 Paul Miller (paulmillr.com) *)
+*/
 //# sourceMappingURL=index.js.map