soulprint-network 0.3.7 → 0.3.8

package/dist/code-hash.json

@@ -1,7 +1,7 @@
 {
-  "codeHash": "46483cb30c07c25eab3484cb4642abfc1c20f6647730edfba82833136a8aa21e",
-  "codeHashHex": "0x46483cb30c07c25eab3484cb4642abfc1c20f6647730edfba82833136a8aa21e",
-  "computedAt": "2026-02-24T22:15:27.997Z",
+  "codeHash": "cede7ea2b4acfb3c25dd603fa290f41ea12f02394d617857e0c3247f30d0e0a3",
+  "codeHashHex": "0xcede7ea2b4acfb3c25dd603fa290f41ea12f02394d617857e0c3247f30d0e0a3",
+  "computedAt": "2026-02-24T22:57:27.288Z",
   "fileCount": 18,
   "files": [
     "blockchain/blockchain-anchor.ts",

package/dist/validator.d.ts

@@ -13,7 +13,7 @@ export declare function setP2PNode(node: SoulprintP2PNode): void;
  *
  * PROTOCOL ENFORCEMENT:
  * - Si el bot tiene DocumentVerified, su score total nunca puede caer por
- *   debajo de PROTOCOL.VERIFIED_SCORE_FLOOR (52) — inamovible.
+ *   debajo de PROTOCOL.VERIFIED_SCORE_FLOOR (52) - inamovible.
  * - Anti-replay: la misma attestation (mismo issuer + timestamp + context)
  *   no se puede aplicar dos veces.
  *

package/dist/validator.js

@@ -2,7 +2,7 @@ import { createServer } from "node:http";
 import { readFileSync, writeFileSync, existsSync, mkdirSync } from "node:fs";
 import { join } from "node:path";
 import { homedir } from "node:os";
-import { generateKeypair, keypairFromPrivateKey, decodeToken, sign, createToken, TOKEN_LIFETIME_SECONDS, TOKEN_RENEW_PREEMPTIVE_SECS, TOKEN_RENEW_GRACE_SECS, TOKEN_RENEW_COOLDOWN_SECS, verifyAttestation, computeReputation, defaultReputation, PROTOCOL, PROTOCOL_HASH, isProtocolHashCompatible, computeTotalScoreWithFloor, checkFarming, recordApprovedGain, recordFarmingStrike, loadAuditStore, exportAuditStore, } from "soulprint-core";
+import { generateKeypair, keypairFromPrivateKey, decodeToken, sign, createToken, TOKEN_LIFETIME_SECONDS, TOKEN_RENEW_PREEMPTIVE_SECS, TOKEN_RENEW_GRACE_SECS, TOKEN_RENEW_COOLDOWN_SECS, NonceStore, verifyAttestation, computeReputation, defaultReputation, PROTOCOL, PROTOCOL_HASH, isProtocolHashCompatible, computeTotalScoreWithFloor, checkFarming, recordApprovedGain, recordFarmingStrike, loadAuditStore, exportAuditStore, } from "soulprint-core";
 import { verifyProof, deserializeProof } from "soulprint-zkp";
 import { buildChallengeResponse, verifyPeerBehavior, } from "./peer-challenge.js";
 import { handleCredentialRoute } from "./credentials/index.js";
@@ -23,11 +23,11 @@ const PEERS_DB = join(NODE_DIR, "peers.json");
 const AUDIT_DB = join(NODE_DIR, "audit.json");
 const VERSION = "0.2.0";
 const MAX_BODY_BYTES = 64 * 1024;
-// ── Protocol constants (inamovibles — no cambiar directamente aquí) ───────────
+// ── Protocol constants (inamovibles - no cambiar directamente aquí) ───────────
 const RATE_LIMIT_MS = PROTOCOL.RATE_LIMIT_WINDOW_MS;
 const RATE_LIMIT_MAX = PROTOCOL.RATE_LIMIT_MAX;
 const CLOCK_SKEW_MAX = PROTOCOL.CLOCK_SKEW_MAX_SECONDS;
-const MIN_ATTESTER_SCORE = PROTOCOL.MIN_ATTESTER_SCORE; // 65 — inamovible
+const MIN_ATTESTER_SCORE = PROTOCOL.MIN_ATTESTER_SCORE; // 65 - inamovible
 const ATT_MAX_AGE_SECONDS = PROTOCOL.ATT_MAX_AGE_SECONDS;
 const GOSSIP_TIMEOUT_MS = PROTOCOL.GOSSIP_TIMEOUT_MS;
 // ── P2P Node (Phase 5) ────────────────────────────────────────────────────────
@@ -44,7 +44,7 @@ export function setP2PNode(node) {
     onAttestationReceived(node, (att, fromPeer) => {
         // Validar firma antes de aplicar
         if (!verifyAttestation(att)) {
-            console.warn(`[p2p] Attestation inválida de peer ${fromPeer.slice(0, 16)}... — descartada`);
+            console.warn(`[p2p] Attestation inválida de peer ${fromPeer.slice(0, 16)}... - descartada`);
             return;
         }
         // Anti-replay ya está dentro de applyAttestation()
@@ -55,6 +55,8 @@ export function setP2PNode(node) {
 }
 // ── Rate limiter ──────────────────────────────────────────────────────────────
 const rateLimits = new Map();
+// ── DPoP Nonce Store — anti-replay para request signing ──────────────────────
+const dpopNonces = new NonceStore();
 function checkRateLimit(ip) {
     const now = Date.now();
     const entry = rateLimits.get(ip);
@@ -115,7 +117,7 @@ function getReputation(did) {
  *
  * PROTOCOL ENFORCEMENT:
  * - Si el bot tiene DocumentVerified, su score total nunca puede caer por
- *   debajo de PROTOCOL.VERIFIED_SCORE_FLOOR (52) — inamovible.
+ *   debajo de PROTOCOL.VERIFIED_SCORE_FLOOR (52) - inamovible.
  * - Anti-replay: la misma attestation (mismo issuer + timestamp + context)
  *   no se puede aplicar dos veces.
  *
@@ -177,8 +179,8 @@ function savePeers() { writeFileSync(PEERS_DB, JSON.stringify(peers, null, 2));
  * Gossip: propaga la attestation a la red.
  *
  * Estrategia:
- *  1. P2P GossipSub (Phase 5) — si el nodo libp2p está activo
- *  2. HTTP fire-and-forget (Phase 3) — fallback para nodos legacy sin libp2p
+ *  1. P2P GossipSub (Phase 5) - si el nodo libp2p está activo
+ *  2. HTTP fire-and-forget (Phase 3) - fallback para nodos legacy sin libp2p
  *
  * Ambos canales son fire-and-forget: no bloquean la respuesta al cliente.
  */
@@ -296,7 +298,7 @@ function handleInfo(res, nodeKeypair) {
 function handleProtocol(res) {
     json(res, 200, {
         protocol_version: PROTOCOL.VERSION,
-        // ── Protocol Hash — IDENTIDAD DE LA RED ────────────────────────────────
+        // ── Protocol Hash - IDENTIDAD DE LA RED ────────────────────────────────
         // Cualquier nodo con un hash diferente es rechazado automáticamente.
         // Si PROTOCOL fue modificado (aunque sea un valor), este hash cambia.
         protocol_hash: PROTOCOL_HASH,
@@ -383,9 +385,9 @@ async function handleAttest(req, res, ip) {
     if (from_peer) {
         const peerHash = req.headers["x-protocol-hash"];
         if (peerHash && !isProtocolHashCompatible(peerHash)) {
-            console.warn(`[protocol] Gossip rechazado de ${ip} — hash incompatible: ${peerHash?.slice(0, 16)}...`);
+            console.warn(`[protocol] Gossip rechazado de ${ip} - hash incompatible: ${peerHash?.slice(0, 16)}...`);
             return json(res, 409, {
-                error: "Protocol mismatch — gossip rejected",
+                error: "Protocol mismatch - gossip rejected",
                 our_hash: PROTOCOL_HASH,
                 their_hash: peerHash,
             });
@@ -415,7 +417,7 @@ async function handleAttest(req, res, ip) {
     // Si viene del exterior, exigir service_spt
     if (!from_peer) {
         if (!service_spt)
-            return json(res, 401, { error: "Missing service_spt — only verified services can attest" });
+            return json(res, 401, { error: "Missing service_spt - only verified services can attest" });
         const serviceTok = decodeToken(service_spt);
         if (!serviceTok)
             return json(res, 401, { error: "Invalid or expired service_spt" });
@@ -446,7 +448,7 @@ async function handleAttest(req, res, ip) {
         const session = {
             did: att.target_did,
             startTime: (att.timestamp - 60) * 1000, // estimar inicio de sesión 60s antes
-            events: [], // no tenemos eventos individuales aquí — se evalúa en withTracking()
+            events: [], // no tenemos eventos individuales aquí - se evalúa en withTracking()
             issuerDid: att.issuer_did,
         };
         const farmResult = checkFarming(session, prevAtts);
@@ -530,13 +532,13 @@ async function handlePeerRegister(req, res) {
         return json(res, 400, { error: "Missing field: url" });
     if (!/^https?:\/\//.test(url))
         return json(res, 400, { error: "url must start with http:// or https://" });
-    // ── Protocol Hash Enforcement — INAMOVIBLE POR LA RED ────────────────────
+    // ── Protocol Hash Enforcement - INAMOVIBLE POR LA RED ────────────────────
     // Si el peer envía un hash, DEBE coincidir con el nuestro.
     // Si no envía hash → se acepta (nodos legacy / primeras versiones).
     // En versiones futuras, el hash será OBLIGATORIO.
     if (protocol_hash && !isProtocolHashCompatible(protocol_hash)) {
         return json(res, 409, {
-            error: "Protocol mismatch — node rejected",
+            error: "Protocol mismatch - node rejected",
             reason: "The peer is running with different protocol constants. This breaks network consensus.",
             our_hash: PROTOCOL_HASH,
             their_hash: protocol_hash,
@@ -667,7 +669,7 @@ async function handleTokenRenew(req, res, nodeKeypair) {
     // Decodificar sin verificar expiración (queremos ver el DID aunque esté expirado)
     const token = decodeToken(body.spt);
     if (!token)
-        return json(res, 401, { error: "Invalid SPT — cannot decode" });
+        return json(res, 401, { error: "Invalid SPT - cannot decode" });
     const nowSecs = Math.floor(Date.now() / 1000);
     const secsUntilExpiry = token.expires - nowSecs;
     const secsAfterExpiry = nowSecs - token.expires;
@@ -683,13 +685,13 @@ async function handleTokenRenew(req, res, nodeKeypair) {
     if (!inPreemptWindow && !inGraceWindow) {
         if (!isExpired) {
             return json(res, 400, {
-                error: "Token válido — no necesita renovación aún",
+                error: "Token válido - no necesita renovación aún",
                 expires_in: secsUntilExpiry,
                 renew_after: secsUntilExpiry - RENEW_PREEMPT,
             });
         }
         return json(res, 401, {
-            error: "Token expirado hace más de 7 días — requiere re-verificación completa",
+            error: "Token expirado hace más de 7 días - requiere re-verificación completa",
             expired_ago: secsAfterExpiry,
             max_grace: RENEW_GRACE,
         });
@@ -699,7 +701,7 @@ async function handleTokenRenew(req, res, nodeKeypair) {
     const lastRenew = repStore[token.did]?._lastRenew ?? 0;
     if (nowSecs - lastRenew < RENEW_COOLDOWN) {
         return json(res, 429, {
-            error: "Renovación muy frecuente — espera 60s entre renovaciones",
+            error: "Renovación muy frecuente - espera 60s entre renovaciones",
             retry_in: RENEW_COOLDOWN - (nowSecs - lastRenew),
         });
     }
@@ -708,7 +710,7 @@ async function handleTokenRenew(req, res, nodeKeypair) {
     const nullifierEntry = nullifierPair?.[1];
     if (!nullifierEntry) {
         return json(res, 403, {
-            error: "DID no registrado en este nodo — requiere re-verificación",
+            error: "DID no registrado en este nodo - requiere re-verificación",
             did: token.did,
         });
     }
@@ -721,7 +723,7 @@ async function handleTokenRenew(req, res, nodeKeypair) {
     const scoreFloor = PROTOCOL.VERIFIED_SCORE_FLOOR ?? 52;
     if (currentRep < scoreFloor) {
         return json(res, 403, {
-            error: "Score por debajo del floor — renovación denegada",
+            error: "Score por debajo del floor - renovación denegada",
             score: currentRep,
             floor: scoreFloor,
             hint: "El bot necesita más attestations positivas",
@@ -938,7 +940,7 @@ export function startValidatorNode(port = PORT) {
             return json(res, 200, anchor.getStats());
         }
         // ── Consensus P2P endpoints (sin EVM, sin gas) ─────────────────────────
-        // GET /consensus/state-info — handshake para state-sync
+        // GET /consensus/state-info - handshake para state-sync
         if (cleanUrl === "/consensus/state-info" && req.method === "GET") {
             return json(res, 200, {
                 nullifierCount: nullifierConsensus.getAllNullifiers().length,
@@ -948,7 +950,7 @@ export function startValidatorNode(port = PORT) {
                 nodeVersion: VERSION,
             });
         }
-        // GET /consensus/state?page=N&limit=500&since=TS — bulk state sync
+        // GET /consensus/state?page=N&limit=500&since=TS - bulk state sync
         if (cleanUrl === "/consensus/state" && req.method === "GET") {
             const params = new URLSearchParams(url.split("?")[1] ?? "");
             const page = parseInt(params.get("page") ?? "0");
@@ -967,7 +969,7 @@ export function startValidatorNode(port = PORT) {
                 protocolHash: PROTOCOL_HASH,
             });
         }
-        // POST /consensus/message — recibir mensaje de consenso cifrado
+        // POST /consensus/message - recibir mensaje de consenso cifrado
         if (cleanUrl === "/consensus/message" && req.method === "POST") {
             const body = await readBody(req);
             if (!body?.payload)
@@ -990,7 +992,7 @@ export function startValidatorNode(port = PORT) {
             }
         }
         // ── Governance endpoints ──────────────────────────────────────────────────
-        // GET /governance — estado del hash aprobado + propuestas activas
+        // GET /governance - estado del hash aprobado + propuestas activas
         if (cleanUrl === "/governance" && req.method === "GET") {
             const [currentHash, active, history] = await Promise.all([
                 client?.getCurrentApprovedHash() ?? null,
@@ -1005,14 +1007,14 @@ export function startValidatorNode(port = PORT) {
                 nodeCompatible: !currentHash || currentHash.toLowerCase() === ("0x" + PROTOCOL_HASH).toLowerCase(),
             });
         }
-        // GET /governance/proposals — lista de propuestas activas
+        // GET /governance/proposals - lista de propuestas activas
         if (cleanUrl === "/governance/proposals" && req.method === "GET") {
             if (!client?.isConnected)
                 return json(res, 503, { error: "Blockchain not connected" });
             const proposals = await client.getActiveProposals();
             return json(res, 200, { proposals, total: proposals.length });
         }
-        // GET /governance/proposal/:id — detalle de una propuesta
+        // GET /governance/proposal/:id - detalle de una propuesta
         if (cleanUrl.match(/^\/governance\/proposal\/\d+$/) && req.method === "GET") {
             if (!client?.isConnected)
                 return json(res, 503, { error: "Blockchain not connected" });
@@ -1023,7 +1025,7 @@ export function startValidatorNode(port = PORT) {
             const remaining = await client.getTimelockRemaining(proposalId);
             return json(res, 200, { ...proposal, timelockRemainingSeconds: remaining });
         }
-        // POST /governance/propose — proponer upgrade del PROTOCOL_HASH
+        // POST /governance/propose - proponer upgrade del PROTOCOL_HASH
         // Body: { did, newHash, rationale }
         if (cleanUrl === "/governance/propose" && req.method === "POST") {
             if (!client?.isConnected)
@@ -1038,10 +1040,10 @@ export function startValidatorNode(port = PORT) {
                 rationale: body.rationale,
             });
             if (!result)
-                return json(res, 500, { error: "Proposal failed — check validator logs" });
+                return json(res, 500, { error: "Proposal failed - check validator logs" });
             return json(res, 201, result);
         }
-        // POST /governance/vote — votar en una propuesta
+        // POST /governance/vote - votar en una propuesta
         // Body: { proposalId, did, approve }
         if (cleanUrl === "/governance/vote" && req.method === "POST") {
             if (!client?.isConnected)
@@ -1056,10 +1058,10 @@ export function startValidatorNode(port = PORT) {
                 approve: Boolean(body.approve),
             });
             if (!txHash)
-                return json(res, 500, { error: "Vote failed — check validator logs" });
+                return json(res, 500, { error: "Vote failed - check validator logs" });
             return json(res, 200, { txHash, proposalId: body.proposalId, approve: body.approve });
         }
-        // POST /governance/execute — ejecutar propuesta post-timelock
+        // POST /governance/execute - ejecutar propuesta post-timelock
         // Body: { proposalId }
         if (cleanUrl === "/governance/execute" && req.method === "POST") {
             if (!client?.isConnected)
@@ -1069,7 +1071,7 @@ export function startValidatorNode(port = PORT) {
                 return json(res, 400, { error: "Required: proposalId" });
             const txHash = await client.executeProposal(Number(body.proposalId));
             if (!txHash)
-                return json(res, 500, { error: "Execute failed — timelock not expired or proposal not approved" });
+                return json(res, 500, { error: "Execute failed - timelock not expired or proposal not approved" });
             return json(res, 200, { txHash, proposalId: body.proposalId, executed: true });
         }
         json(res, 404, { error: "Not found" });
@@ -1101,7 +1103,7 @@ export function startValidatorNode(port = PORT) {
         console.log(`   POST /credentials/phone/verify`);
         console.log(`   GET  /credentials/github/start   → GitHub OAuth (native fetch)`);
         console.log(`   GET  /credentials/github/callback`);
-        console.log(`\n   Anti-farming: ON — max +1/day, pattern detection, cooldowns`);
+        console.log(`\n   Anti-farming: ON - max +1/day, pattern detection, cooldowns`);
         console.log(`\n   Consensus P2P (sin EVM, sin gas):`);
         console.log(`   GET  /consensus/state-info    handshake para state-sync`);
         console.log(`   GET  /consensus/state         bulk state sync paginado`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "soulprint-network",
-  "version": "0.3.7",
+  "version": "0.3.8",
   "description": "Soulprint validator node — HTTP server that verifies ZK proofs, co-signs SPTs, anti-Sybil registry",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",