instar 0.26.11 → 0.27.2

package/dist/threadline/relay/SybilProtection.d.ts

@@ -0,0 +1,78 @@
+/**
+ * SybilProtection — Relay-side protection against identity flooding.
+ *
+ * Spec Section 3.12:
+ * - Proof-of-Work at connection (Hashcash-style, ~1s commodity hardware)
+ * - Dynamic difficulty (3x spike → scale up, 10x ceiling)
+ * - Fast-solver throttling (<100ms = suspicious)
+ * - Identity aging (new identities hidden from directory for 1h)
+ * - IP rate limiting (10 new connections/min, 50 total/IP)
+ * - Identity-level limits (5 identities per IP per hour)
+ */
+/** Identity aging: new identities hidden for 1 hour */
+export declare const IDENTITY_AGING_MS: number;
+/** IP rate limits */
+export declare const IP_LIMITS: {
+    readonly newConnectionsPerMinute: 10;
+    readonly totalConnectionsPerIP: 50;
+    readonly identitiesPerIPPerHour: 5;
+};
+export interface PoWChallenge {
+    epoch: string;
+    difficulty: number;
+    issuedAt: number;
+}
+export interface PoWSolution {
+    challenge: PoWChallenge;
+    nonce: string;
+    solveTimeMs: number;
+}
+export interface IPConnectionState {
+    recentConnections: number[];
+    identities: Set<string>;
+    identityTimestamps: number[];
+}
+/**
+ * Generate a PoW challenge for a connecting agent.
+ */
+export declare function generateChallenge(clientIP: string, currentDifficulty?: number): PoWChallenge;
+/**
+ * Verify a PoW solution.
+ *
+ * Checks:
+ * 1. SHA-256(epoch || clientIP || nonce) has enough leading zero bits
+ * 2. Epoch is current (within tolerance)
+ * 3. Not solved suspiciously fast
+ */
+export declare function verifySolution(solution: PoWSolution, clientIP: string): {
+    valid: boolean;
+    suspicious: boolean;
+    reason?: string;
+};
+/**
+ * Solve a PoW challenge (for client-side use / testing).
+ */
+export declare function solveChallenge(challenge: PoWChallenge, clientIP: string): PoWSolution;
+/**
+ * Compute dynamic difficulty based on connection rate.
+ *
+ * Attack condition: >3x rolling 10-minute average = spike.
+ * Difficulty scales linearly from 1x to ceiling proportional to spike magnitude.
+ */
+export declare function computeDynamicDifficulty(recentConnectionRate: number, baselineRate: number): number;
+export declare class IPRateLimiter {
+    private ipStates;
+    /**
+     * Check if a new connection from an IP is allowed.
+     */
+    checkConnection(ip: string, fingerprint: string): {
+        allowed: boolean;
+        reason?: string;
+    };
+    /**
+     * Check if an identity is old enough to appear in directory.
+     */
+    isIdentityAged(firstSeenTimestamp: number, now?: number): boolean;
+    private getOrCreateState;
+}
+//# sourceMappingURL=SybilProtection.d.ts.map

package/dist/threadline/relay/SybilProtection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SybilProtection.d.ts","sourceRoot":"","sources":["../../../src/threadline/relay/SybilProtection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAkBH,uDAAuD;AACvD,eAAO,MAAM,iBAAiB,QAAiB,CAAC;AAEhD,qBAAqB;AACrB,eAAO,MAAM,SAAS;;;;CAIZ,CAAC;AAIX,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,YAAY,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,iBAAiB;IAChC,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACxB,kBAAkB,EAAE,MAAM,EAAE,CAAC;CAC9B;AAID;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,EAChB,iBAAiB,CAAC,EAAE,MAAM,GACzB,YAAY,CAOd;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,WAAW,EACrB,QAAQ,EAAE,MAAM,GACf;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,UAAU,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAoB1D;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,GAAG,WAAW,CAgBrF;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,oBAAoB,EAAE,MAAM,EAC5B,YAAY,EAAE,MAAM,GACnB,MAAM,CAUR;AAID,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAA6C;IAE7D;;OAEG;IACH,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;IAoCvF;;OAEG;IACH,cAAc,CAAC,kBAAkB,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO;IAIjE,OAAO,CAAC,gBAAgB;CAQzB"}

package/dist/threadline/relay/SybilProtection.js

@@ -0,0 +1,187 @@
+/**
+ * SybilProtection — Relay-side protection against identity flooding.
+ *
+ * Spec Section 3.12:
+ * - Proof-of-Work at connection (Hashcash-style, ~1s commodity hardware)
+ * - Dynamic difficulty (3x spike → scale up, 10x ceiling)
+ * - Fast-solver throttling (<100ms = suspicious)
+ * - Identity aging (new identities hidden from directory for 1h)
+ * - IP rate limiting (10 new connections/min, 50 total/IP)
+ * - Identity-level limits (5 identities per IP per hour)
+ */
+import crypto from 'node:crypto';
+// ── Constants ────────────────────────────────────────────────────────
+/** Default PoW difficulty: 20 leading zero bits (~1s on commodity hardware) */
+const DEFAULT_DIFFICULTY = 20;
+/** Max difficulty ceiling: 10x baseline = ~10s on commodity hardware */
+const MAX_DIFFICULTY_BITS = DEFAULT_DIFFICULTY + 4; // ~16x baseline, capped
+/** Epoch rotation interval (10 minutes) */
+const EPOCH_INTERVAL_MS = 10 * 60 * 1000;
+/** Fast-solver threshold: solutions under 100ms are suspicious */
+const FAST_SOLVER_THRESHOLD_MS = 100;
+/** Identity aging: new identities hidden for 1 hour */
+export const IDENTITY_AGING_MS = 60 * 60 * 1000;
+/** IP rate limits */
+export const IP_LIMITS = {
+    newConnectionsPerMinute: 10,
+    totalConnectionsPerIP: 50,
+    identitiesPerIPPerHour: 5,
+};
+// ── PoW Functions ────────────────────────────────────────────────────
+/**
+ * Generate a PoW challenge for a connecting agent.
+ */
+export function generateChallenge(clientIP, currentDifficulty) {
+    const epoch = getCurrentEpoch();
+    return {
+        epoch,
+        difficulty: currentDifficulty ?? DEFAULT_DIFFICULTY,
+        issuedAt: Date.now(),
+    };
+}
+/**
+ * Verify a PoW solution.
+ *
+ * Checks:
+ * 1. SHA-256(epoch || clientIP || nonce) has enough leading zero bits
+ * 2. Epoch is current (within tolerance)
+ * 3. Not solved suspiciously fast
+ */
+export function verifySolution(solution, clientIP) {
+    // Check epoch freshness (allow previous + current epoch)
+    const currentEpoch = getCurrentEpoch();
+    const previousEpoch = getEpoch(Date.now() - EPOCH_INTERVAL_MS);
+    if (solution.challenge.epoch !== currentEpoch && solution.challenge.epoch !== previousEpoch) {
+        return { valid: false, suspicious: false, reason: 'Stale epoch — challenge expired' };
+    }
+    // Verify hash
+    const hash = computePoWHash(solution.challenge.epoch, clientIP, solution.nonce);
+    const leadingZeros = countLeadingZeroBits(hash);
+    if (leadingZeros < solution.challenge.difficulty) {
+        return { valid: false, suspicious: false, reason: `Insufficient work: ${leadingZeros} < ${solution.challenge.difficulty} bits` };
+    }
+    // Fast-solver detection
+    const elapsedMs = Date.now() - solution.challenge.issuedAt;
+    const suspicious = elapsedMs < FAST_SOLVER_THRESHOLD_MS;
+    return { valid: true, suspicious };
+}
+/**
+ * Solve a PoW challenge (for client-side use / testing).
+ */
+export function solveChallenge(challenge, clientIP) {
+    const startTime = Date.now();
+    let nonce = 0;
+    while (true) {
+        const nonceHex = nonce.toString(16).padStart(16, '0');
+        const hash = computePoWHash(challenge.epoch, clientIP, nonceHex);
+        if (countLeadingZeroBits(hash) >= challenge.difficulty) {
+            return {
+                challenge,
+                nonce: nonceHex,
+                solveTimeMs: Date.now() - startTime,
+            };
+        }
+        nonce++;
+    }
+}
+/**
+ * Compute dynamic difficulty based on connection rate.
+ *
+ * Attack condition: >3x rolling 10-minute average = spike.
+ * Difficulty scales linearly from 1x to ceiling proportional to spike magnitude.
+ */
+export function computeDynamicDifficulty(recentConnectionRate, baselineRate) {
+    if (baselineRate <= 0)
+        return DEFAULT_DIFFICULTY;
+    const ratio = recentConnectionRate / baselineRate;
+    if (ratio <= 3)
+        return DEFAULT_DIFFICULTY;
+    // Linear scale from baseline to 10x ceiling
+    const scaleFactor = Math.min((ratio - 3) / 7, 1); // 0 at 3x, 1 at 10x
+    const extraBits = Math.floor(scaleFactor * (MAX_DIFFICULTY_BITS - DEFAULT_DIFFICULTY));
+    return Math.min(DEFAULT_DIFFICULTY + extraBits, MAX_DIFFICULTY_BITS);
+}
+// ── IP Rate Limiter ──────────────────────────────────────────────────
+export class IPRateLimiter {
+    ipStates = new Map();
+    /**
+     * Check if a new connection from an IP is allowed.
+     */
+    checkConnection(ip, fingerprint) {
+        const now = Date.now();
+        const state = this.getOrCreateState(ip);
+        // Prune old entries
+        const oneMinuteAgo = now - 60 * 1000;
+        const oneHourAgo = now - 60 * 60 * 1000;
+        state.recentConnections = state.recentConnections.filter(t => t > oneMinuteAgo);
+        state.identityTimestamps = state.identityTimestamps.filter(t => t > oneHourAgo);
+        // Check connections per minute
+        if (state.recentConnections.length >= IP_LIMITS.newConnectionsPerMinute) {
+            return { allowed: false, reason: `IP rate limit: ${IP_LIMITS.newConnectionsPerMinute} connections/min` };
+        }
+        // Check total connections per IP
+        if (state.recentConnections.length >= IP_LIMITS.totalConnectionsPerIP) {
+            return { allowed: false, reason: `IP total limit: ${IP_LIMITS.totalConnectionsPerIP} connections` };
+        }
+        // Check identities per IP per hour
+        if (!state.identities.has(fingerprint) &&
+            state.identityTimestamps.length >= IP_LIMITS.identitiesPerIPPerHour) {
+            return { allowed: false, reason: `IP identity limit: ${IP_LIMITS.identitiesPerIPPerHour} identities/hour` };
+        }
+        // Record
+        state.recentConnections.push(now);
+        if (!state.identities.has(fingerprint)) {
+            state.identities.add(fingerprint);
+            state.identityTimestamps.push(now);
+        }
+        return { allowed: true };
+    }
+    /**
+     * Check if an identity is old enough to appear in directory.
+     */
+    isIdentityAged(firstSeenTimestamp, now) {
+        return ((now ?? Date.now()) - firstSeenTimestamp) >= IDENTITY_AGING_MS;
+    }
+    getOrCreateState(ip) {
+        let state = this.ipStates.get(ip);
+        if (!state) {
+            state = { recentConnections: [], identities: new Set(), identityTimestamps: [] };
+            this.ipStates.set(ip, state);
+        }
+        return state;
+    }
+}
+// ── Helpers ──────────────────────────────────────────────────────────
+function getCurrentEpoch() {
+    return getEpoch(Date.now());
+}
+function getEpoch(timestamp) {
+    const epochNum = Math.floor(timestamp / EPOCH_INTERVAL_MS);
+    return epochNum.toString(16);
+}
+function computePoWHash(epoch, clientIP, nonce) {
+    return crypto.createHash('sha256')
+        .update(epoch)
+        .update(clientIP)
+        .update(nonce)
+        .digest();
+}
+function countLeadingZeroBits(hash) {
+    let bits = 0;
+    for (const byte of hash) {
+        if (byte === 0) {
+            bits += 8;
+        }
+        else {
+            // Count leading zeros in this byte
+            let mask = 0x80;
+            while (mask > 0 && (byte & mask) === 0) {
+                bits++;
+                mask >>= 1;
+            }
+            break;
+        }
+    }
+    return bits;
+}
+//# sourceMappingURL=SybilProtection.js.map

package/dist/threadline/relay/SybilProtection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SybilProtection.js","sourceRoot":"","sources":["../../../src/threadline/relay/SybilProtection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,wEAAwE;AAExE,+EAA+E;AAC/E,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAE9B,wEAAwE;AACxE,MAAM,mBAAmB,GAAG,kBAAkB,GAAG,CAAC,CAAC,CAAC,wBAAwB;AAE5E,2CAA2C;AAC3C,MAAM,iBAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEzC,kEAAkE;AAClE,MAAM,wBAAwB,GAAG,GAAG,CAAC;AAErC,uDAAuD;AACvD,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEhD,qBAAqB;AACrB,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,uBAAuB,EAAE,EAAE;IAC3B,qBAAqB,EAAE,EAAE;IACzB,sBAAsB,EAAE,CAAC;CACjB,CAAC;AAsBX,wEAAwE;AAExE;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAgB,EAChB,iBAA0B;IAE1B,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;IAChC,OAAO;QACL,KAAK;QACL,UAAU,EAAE,iBAAiB,IAAI,kBAAkB;QACnD,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE;KACrB,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAC5B,QAAqB,EACrB,QAAgB;IAEhB,yDAAyD;IACzD,MAAM,YAAY,GAAG,eAAe,EAAE,CAAC;IACvC,MAAM,aAAa,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,iBAAiB,CAAC,CAAC;IAC/D,IAAI,QAAQ,CAAC,SAAS,CAAC,KAAK,KAAK,YAAY,IAAI,QAAQ,CAAC,SAAS,CAAC,KAAK,KAAK,aAAa,EAAE,CAAC;QAC5F,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC;IACxF,CAAC;IAED,cAAc;IACd,MAAM,IAAI,GAAG,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChF,MAAM,YAAY,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAChD,IAAI,YAAY,GAAG,QAAQ,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC;QACjD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,YAAY,MAAM,QAAQ,CAAC,SAAS,CAAC,UAAU,OAAO,EAAE,CAAC;IACnI,CAAC;IAED,wBAAwB;IACxB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC;IAC3D,MAAM,UAAU,GAAG,SAAS,GAAG,wBAAwB,CAAC;IAExD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AACrC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,SAAuB,EAAE,QAAgB;IACtE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,IAAI,KAAK,GAAG,CAAC,CAAC;IAEd,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,cAAc,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACjE,IAAI,oBAAoB,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,UAAU,EAAE,CAAC;YACvD,OAAO;gBACL,SAAS;gBACT,KAAK,EAAE,QAAQ;gBACf,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACpC,CAAC;QACJ,CAAC;QACD,KAAK,EAAE,CAAC;IACV,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CACtC,oBAA4B,EAC5B,YAAoB;IAEpB,IAAI,YAAY,IAAI,CAAC;QAAE,OAAO,kBAAkB,CAAC;IAEjD,MAAM,KAAK,GAAG,oBAAoB,GAAG,YAAY,CAAC;IAClD,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,kBAAkB,CAAC;IAE1C,4CAA4C;IAC5C,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,oBAAoB;IACtE,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,GAAG,CAAC,mBAAmB,GAAG,kBAAkB,CAAC,CAAC,CAAC;IACvF,OAAO,IAAI,CAAC,GAAG,CAAC,kBAAkB,GAAG,SAAS,EAAE,mBAAmB,CAAC,CAAC;AACvE,CAAC;AAED,wEAAwE;AAExE,MAAM,OAAO,aAAa;IAChB,QAAQ,GAAmC,IAAI,GAAG,EAAE,CAAC;IAE7D;;OAEG;IACH,eAAe,CAAC,EAAU,EAAE,WAAmB;QAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;QAExC,oBAAoB;QACpB,MAAM,YAAY,GAAG,GAAG,GAAG,EAAE,GAAG,IAAI,CAAC;QACrC,MAAM,UAAU,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QACxC,KAAK,CAAC,iBAAiB,GAAG,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,YAAY,CAAC,CAAC;QAChF,KAAK,CAAC,kBAAkB,GAAG,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC;QAEhF,+BAA+B;QAC/B,IAAI,KAAK,CAAC,iBAAiB,CAAC,MAAM,IAAI,SAAS,CAAC,uBAAuB,EAAE,CAAC;YACxE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,SAAS,CAAC,uBAAuB,kBAAkB,EAAE,CAAC;QAC3G,CAAC;QAED,iCAAiC;QACjC,IAAI,KAAK,CAAC,iBAAiB,CAAC,MAAM,IAAI,SAAS,CAAC,qBAAqB,EAAE,CAAC;YACtE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,SAAS,CAAC,qBAAqB,cAAc,EAAE,CAAC;QACtG,CAAC;QAED,mCAAmC;QACnC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC;YAClC,KAAK,CAAC,kBAAkB,CAAC,MAAM,IAAI,SAAS,CAAC,sBAAsB,EAAE,CAAC;YACxE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,SAAS,CAAC,sBAAsB,kBAAkB,EAAE,CAAC;QAC9G,CAAC;QAED,SAAS;QACT,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YACvC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAClC,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrC,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,kBAA0B,EAAE,GAAY;QACrD,OAAO,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,kBAAkB,CAAC,IAAI,iBAAiB,CAAC;IACzE,CAAC;IAEO,gBAAgB,CAAC,EAAU;QACjC,IAAI,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,EAAE,iBAAiB,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,GAAG,EAAE,EAAE,kBAAkB,EAAE,EAAE,EAAE,CAAC;YACjF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAC/B,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAED,wEAAwE;AAExE,SAAS,eAAe;IACtB,OAAO,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,QAAQ,CAAC,SAAiB;IACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,iBAAiB,CAAC,CAAC;IAC3D,OAAO,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,cAAc,CAAC,KAAa,EAAE,QAAgB,EAAE,KAAa;IACpE,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC;SAC/B,MAAM,CAAC,KAAK,CAAC;SACb,MAAM,CAAC,QAAQ,CAAC;SAChB,MAAM,CAAC,KAAK,CAAC;SACb,MAAM,EAAE,CAAC;AACd,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;YACf,IAAI,IAAI,CAAC,CAAC;QACZ,CAAC;aAAM,CAAC;YACN,mCAAmC;YACnC,IAAI,IAAI,GAAG,IAAI,CAAC;YAChB,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACvC,IAAI,EAAE,CAAC;gBACP,IAAI,KAAK,CAAC,CAAC;YACb,CAAC;YACD,MAAM;QACR,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "0.26.11",
+  "version": "0.27.2",
   "description": "Persistent autonomy infrastructure for AI agents",
   "type": "module",
   "main": "dist/index.js",
@@ -24,13 +24,16 @@
     "test:watch": "vitest",
     "test:integration": "vitest run --config vitest.integration.config.ts",
     "test:e2e": "vitest run --config vitest.e2e.config.ts",
+    "test:contract": "node scripts/run-contract-tests.js",
+    "test:contract:raw": "vitest run --config vitest.contract.config.ts",
     "test:all": "vitest run && vitest run --config vitest.integration.config.ts && vitest run --config vitest.e2e.config.ts",
     "lint": "tsc --noEmit",
     "clean": "rm -rf dist",
     "check:upgrade-guide": "node scripts/check-upgrade-guide.js",
     "check:pre-push-gate": "node scripts/pre-push-gate.js",
     "check:release": "node scripts/analyze-release.js",
-    "prepublishOnly": "npm run build && npm run check:upgrade-guide",
+    "check:contract-evidence": "node scripts/check-contract-evidence.js",
+    "prepublishOnly": "npm run build && npm run check:upgrade-guide && npm run check:contract-evidence",
     "postinstall": "node scripts/fix-better-sqlite3.cjs",
     "prepare": "husky"
   },
@@ -83,12 +86,15 @@
     "@inquirer/prompts": "^8.2.1",
     "@modelcontextprotocol/sdk": "^1.27.1",
     "@noble/ciphers": "^2.1.1",
+    "@noble/hashes": "^2.0.1",
+    "@scure/bip39": "^2.0.1",
     "better-sqlite3": "^12.8.0",
     "cloudflared": "^0.7.1",
     "commander": "^12.0.0",
     "croner": "^8.0.0",
     "express": "^4.18.0",
     "marked": "^17.0.5",
+    "moltbridge": "^0.1.6",
     "picocolors": "^1.0.0",
     "proper-lockfile": "^4.1.2",
     "ws": "^8.19.0",
@@ -108,6 +114,6 @@
     "husky": "^9.1.7",
     "supertest": "^7.2.2",
     "typescript": "^5.9.3",
-    "vitest": "^2.0.0"
+    "vitest": "^2.1.9"
   }
 }