soulprint-network 0.4.0 → 0.4.2

package/dist/blockchain/PeerRegistryClient.d.ts

@@ -0,0 +1,40 @@
+export declare const PEER_REGISTRY_RPC = "https://sepolia.base.org";
+export declare const PEER_REGISTRY_ADDRESS: string;
+export interface PeerEntry {
+    peerDid: string;
+    peerId: string;
+    multiaddr: string;
+    score: number;
+    lastSeen: number;
+}
+export declare class PeerRegistryClient {
+    private provider;
+    private contract;
+    private wallet?;
+    private cache;
+    private cacheAt;
+    private cacheTTLMs;
+    private address;
+    constructor(opts?: {
+        rpc?: string;
+        address?: string;
+        privateKey?: string;
+        cacheTTLMs?: number;
+    });
+    /** Get all registered peers (cached, TTL 5 min) */
+    getAllPeers(): Promise<PeerEntry[]>;
+    /** Force refresh from blockchain */
+    refreshPeers(): Promise<PeerEntry[]>;
+    /** Register this node on-chain. Non-blocking — logs warning on failure. */
+    registerSelf(opts: {
+        peerDid: string;
+        peerId: string;
+        multiaddr: string;
+        score?: number;
+    }): Promise<void>;
+    /** Returns multiaddrs of all peers (for bootstrap) */
+    getBootstrapMultiaddrs(): Promise<string[]>;
+    get contractAddress(): string;
+}
+/** Singleton instance (read-only) */
+export declare const peerRegistryClient: PeerRegistryClient;

package/dist/blockchain/PeerRegistryClient.js

@@ -0,0 +1,125 @@
+/**
+ * PeerRegistryClient
+ * On-chain peer discovery for Soulprint validator nodes (Base Sepolia).
+ *
+ * - On startup: reads all peers from contract → used as bootstrap multiaddrs
+ * - On startup: registers self (DID, peerId, multiaddr, score=0)
+ * - Cache TTL 5 min, refreshPeers() to invalidate
+ * - Non-blocking: RPC failures log a warning and continue
+ */
+import { ethers } from "ethers";
+export const PEER_REGISTRY_RPC = "https://sepolia.base.org";
+// Load address from addresses.json
+import { readFileSync } from "node:fs";
+import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+const __dirname = dirname(fileURLToPath(import.meta.url));
+function loadAddress() {
+    try {
+        const f = join(__dirname, "addresses.json");
+        const d = JSON.parse(readFileSync(f, "utf8"));
+        return d["PeerRegistry"] ?? "";
+    }
+    catch {
+        return "";
+    }
+}
+export const PEER_REGISTRY_ADDRESS = loadAddress();
+const ABI = [
+    "function registerPeer(string peerDid, string peerId, string multiaddr, uint256 score) external",
+    "function removePeer(string peerDid) external",
+    "function getPeer(string peerDid) external view returns (string did, string peerId, string multiaddr, uint256 score, uint256 lastSeen)",
+    "function getAllPeers() external view returns (tuple(string peerDid, string peerId, string multiaddr, uint256 score, uint256 lastSeen, address registrant)[])",
+    "function peerCount() external view returns (uint256)",
+    "event PeerRegistered(string indexed peerDid, string peerId, string multiaddr, uint256 score, address indexed registrant, uint256 timestamp)",
+    "event PeerUpdated(string indexed peerDid, string peerId, string multiaddr, uint256 score, address indexed registrant, uint256 timestamp)",
+    "event PeerRemoved(string indexed peerDid, address indexed removedBy, uint256 timestamp)",
+];
+export class PeerRegistryClient {
+    provider;
+    contract;
+    wallet;
+    cache = null;
+    cacheAt = 0;
+    cacheTTLMs;
+    address;
+    constructor(opts) {
+        this.address = opts?.address ?? PEER_REGISTRY_ADDRESS;
+        this.cacheTTLMs = opts?.cacheTTLMs ?? 5 * 60 * 1000; // 5 min
+        const rpc = opts?.rpc ?? PEER_REGISTRY_RPC;
+        this.provider = new ethers.JsonRpcProvider(rpc);
+        if (!this.address) {
+            console.warn("[peer-registry] ⚠️  No contract address — peer registry disabled");
+            this.contract = null;
+            return;
+        }
+        if (opts?.privateKey) {
+            this.wallet = new ethers.Wallet(opts.privateKey, this.provider);
+            this.contract = new ethers.Contract(this.address, ABI, this.wallet);
+        }
+        else {
+            this.contract = new ethers.Contract(this.address, ABI, this.provider);
+        }
+    }
+    /** Get all registered peers (cached, TTL 5 min) */
+    async getAllPeers() {
+        if (this.cache && Date.now() - this.cacheAt < this.cacheTTLMs) {
+            return this.cache;
+        }
+        return this.refreshPeers();
+    }
+    /** Force refresh from blockchain */
+    async refreshPeers() {
+        if (!this.address) {
+            console.warn("[peer-registry] ⚠️  No contract address configured — skipping peer fetch");
+            return [];
+        }
+        try {
+            const raw = await this.contract.getAllPeers();
+            this.cache = raw.map((p) => ({
+                peerDid: p.peerDid,
+                peerId: p.peerId,
+                multiaddr: p.multiaddr,
+                score: Number(p.score),
+                lastSeen: Number(p.lastSeen),
+            }));
+            this.cacheAt = Date.now();
+            return this.cache;
+        }
+        catch (err) {
+            console.warn(`[peer-registry] ⚠️  Could not fetch peers from chain: ${err.shortMessage ?? err.message}`);
+            return this.cache ?? [];
+        }
+    }
+    /** Register this node on-chain. Non-blocking — logs warning on failure. */
+    async registerSelf(opts) {
+        if (!this.wallet) {
+            console.warn("[peer-registry] ⚠️  No private key — cannot register self on-chain");
+            return;
+        }
+        if (!this.address) {
+            console.warn("[peer-registry] ⚠️  No contract address — skipping self-registration");
+            return;
+        }
+        try {
+            const feeData = await this.provider.getFeeData();
+            const tx = await this.contract.registerPeer(opts.peerDid, opts.peerId, opts.multiaddr, BigInt(opts.score ?? 0), { gasPrice: feeData.gasPrice });
+            console.log(`[peer-registry] 📡 Registering self on-chain... tx: ${tx.hash}`);
+            await tx.wait();
+            console.log(`[peer-registry] ✅ Registered: did=${opts.peerDid.slice(0, 20)}... multiaddr=${opts.multiaddr}`);
+            // Invalidate cache so next getAllPeers() reflects the new entry
+            this.cache = null;
+        }
+        catch (err) {
+            console.warn(`[peer-registry] ⚠️  Self-registration failed (non-fatal): ${err.shortMessage ?? err.message}`);
+        }
+    }
+    /** Returns multiaddrs of all peers (for bootstrap) */
+    async getBootstrapMultiaddrs() {
+        const peers = await this.getAllPeers();
+        return peers.map(p => p.multiaddr).filter(Boolean);
+    }
+    get contractAddress() { return this.address; }
+}
+/** Singleton instance (read-only) */
+export const peerRegistryClient = new PeerRegistryClient();

package/dist/blockchain/addresses.json

@@ -0,0 +1,3 @@
+{
+  "PeerRegistry": "0x452fb66159dFCfC13f2fD9627aA4c56886BfB15b"
+}

package/dist/blockchain/protocol-thresholds-client.d.ts

@@ -0,0 +1,49 @@
+/**
+ * ProtocolThresholdsClient
+ * Lee los thresholds del protocolo desde Base Sepolia.
+ * - Cache con TTL (10 min por defecto)
+ * - Fallback transparente a constantes locales si la blockchain no es accesible
+ * - Solo el superAdmin puede actualizar on-chain; aquí solo leemos
+ */
+import { ethers } from "ethers";
+export declare const PROTOCOL_THRESHOLDS_ADDRESS = "0xD8f78d65b35806101672A49801b57F743f2D2ab1";
+export declare const PROTOCOL_THRESHOLDS_CHAIN = "Base Sepolia (chainId: 84532)";
+export declare const PROTOCOL_THRESHOLDS_RPC = "https://sepolia.base.org";
+export interface ProtocolThresholds {
+    SCORE_FLOOR: number;
+    VERIFIED_SCORE_FLOOR: number;
+    MIN_ATTESTER_SCORE: number;
+    FACE_SIM_DOC_SELFIE: number;
+    FACE_SIM_SELFIE_SELFIE: number;
+    DEFAULT_REPUTATION: number;
+    IDENTITY_MAX: number;
+    REPUTATION_MAX: number;
+    VERIFY_RETRY_MAX: number;
+    source: "blockchain" | "local_fallback";
+    loadedAt: number;
+    superAdmin?: string;
+}
+export declare class ProtocolThresholdsClient {
+    private provider;
+    private contract;
+    private cache;
+    private cacheTTLMs;
+    private address;
+    constructor(opts?: {
+        rpc?: string;
+        address?: string;
+        cacheTTLMs?: number;
+    });
+    /** Carga thresholds desde blockchain — fallback transparente a local */
+    load(): Promise<ProtocolThresholds>;
+    /** Invalida la cache — el siguiente load() irá a blockchain */
+    invalidate(): void;
+    /** Lee un threshold individual (con cache) */
+    get(name: keyof Omit<ProtocolThresholds, "source" | "loadedAt" | "superAdmin">): Promise<number>;
+    /** Devuelve la dirección del contrato */
+    get contractAddress(): string;
+    /** Acceso directo al contrato para uso en tests */
+    get rawContract(): ethers.Contract;
+}
+/** Instancia global (singleton) para uso en el validador */
+export declare const thresholdsClient: ProtocolThresholdsClient;

package/dist/blockchain/protocol-thresholds-client.js

@@ -0,0 +1,102 @@
+/**
+ * ProtocolThresholdsClient
+ * Lee los thresholds del protocolo desde Base Sepolia.
+ * - Cache con TTL (10 min por defecto)
+ * - Fallback transparente a constantes locales si la blockchain no es accesible
+ * - Solo el superAdmin puede actualizar on-chain; aquí solo leemos
+ */
+import { ethers } from "ethers";
+import { PROTOCOL } from "soulprint-core";
+export const PROTOCOL_THRESHOLDS_ADDRESS = "0xD8f78d65b35806101672A49801b57F743f2D2ab1";
+export const PROTOCOL_THRESHOLDS_CHAIN = "Base Sepolia (chainId: 84532)";
+export const PROTOCOL_THRESHOLDS_RPC = "https://sepolia.base.org";
+const ABI = [
+    "function getThreshold(string calldata name) external view returns (uint256)",
+    "function superAdmin() external view returns (address)",
+    "function pendingSuperAdmin() external view returns (address)",
+    "function getAll() external view returns (string[] memory names, uint256[] memory values)",
+    "event ThresholdUpdated(bytes32 indexed key, uint256 oldValue, uint256 newValue, address indexed by, uint256 timestamp)",
+];
+// Valores locales como fallback
+function localFallback(source = "local_fallback") {
+    return {
+        SCORE_FLOOR: PROTOCOL.SCORE_FLOOR,
+        VERIFIED_SCORE_FLOOR: PROTOCOL.VERIFIED_SCORE_FLOOR,
+        MIN_ATTESTER_SCORE: PROTOCOL.MIN_ATTESTER_SCORE,
+        FACE_SIM_DOC_SELFIE: Math.round(PROTOCOL.FACE_SIM_DOC_SELFIE * 1000),
+        FACE_SIM_SELFIE_SELFIE: Math.round(PROTOCOL.FACE_SIM_SELFIE_SELFIE * 1000),
+        DEFAULT_REPUTATION: PROTOCOL.DEFAULT_REPUTATION,
+        IDENTITY_MAX: PROTOCOL.IDENTITY_MAX,
+        REPUTATION_MAX: PROTOCOL.REPUTATION_MAX,
+        VERIFY_RETRY_MAX: PROTOCOL.VERIFY_RETRY_MAX,
+        source,
+        loadedAt: Date.now(),
+    };
+}
+export class ProtocolThresholdsClient {
+    provider;
+    contract;
+    cache = null;
+    cacheTTLMs;
+    address;
+    constructor(opts) {
+        this.address = opts?.address ?? PROTOCOL_THRESHOLDS_ADDRESS;
+        this.cacheTTLMs = opts?.cacheTTLMs ?? 10 * 60 * 1000; // 10 min
+        const rpc = opts?.rpc ?? PROTOCOL_THRESHOLDS_RPC;
+        this.provider = new ethers.JsonRpcProvider(rpc);
+        this.contract = new ethers.Contract(this.address, ABI, this.provider);
+    }
+    /** Carga thresholds desde blockchain — fallback transparente a local */
+    async load() {
+        // Cache hit
+        if (this.cache && Date.now() - this.cache.loadedAt < this.cacheTTLMs) {
+            return this.cache;
+        }
+        try {
+            const [admin, floor, vfloor, minAtt, faceSim, faceSimSS, defRep, idMax, repMax, retryMax] = await Promise.all([
+                this.contract.superAdmin(),
+                this.contract.getThreshold("SCORE_FLOOR"),
+                this.contract.getThreshold("VERIFIED_SCORE_FLOOR"),
+                this.contract.getThreshold("MIN_ATTESTER_SCORE"),
+                this.contract.getThreshold("FACE_SIM_DOC_SELFIE"),
+                this.contract.getThreshold("FACE_SIM_SELFIE_SELFIE"),
+                this.contract.getThreshold("DEFAULT_REPUTATION"),
+                this.contract.getThreshold("IDENTITY_MAX"),
+                this.contract.getThreshold("REPUTATION_MAX"),
+                this.contract.getThreshold("VERIFY_RETRY_MAX"),
+            ]);
+            this.cache = {
+                SCORE_FLOOR: Number(floor),
+                VERIFIED_SCORE_FLOOR: Number(vfloor),
+                MIN_ATTESTER_SCORE: Number(minAtt),
+                FACE_SIM_DOC_SELFIE: Number(faceSim),
+                FACE_SIM_SELFIE_SELFIE: Number(faceSimSS),
+                DEFAULT_REPUTATION: Number(defRep),
+                IDENTITY_MAX: Number(idMax),
+                REPUTATION_MAX: Number(repMax),
+                VERIFY_RETRY_MAX: Number(retryMax),
+                source: "blockchain",
+                loadedAt: Date.now(),
+                superAdmin: admin,
+            };
+            return this.cache;
+        }
+        catch (err) {
+            console.warn(`[thresholds] ⚠️  Blockchain no disponible — usando fallback local (${err.shortMessage ?? err.message})`);
+            return localFallback("local_fallback");
+        }
+    }
+    /** Invalida la cache — el siguiente load() irá a blockchain */
+    invalidate() { this.cache = null; }
+    /** Lee un threshold individual (con cache) */
+    async get(name) {
+        const t = await this.load();
+        return t[name];
+    }
+    /** Devuelve la dirección del contrato */
+    get contractAddress() { return this.address; }
+    /** Acceso directo al contrato para uso en tests */
+    get rawContract() { return this.contract; }
+}
+/** Instancia global (singleton) para uso en el validador */
+export const thresholdsClient = new ProtocolThresholdsClient();

package/dist/code-hash.json

@@ -1,11 +1,13 @@
 {
-  "codeHash": "71e41f8c443a60f95aa13ae942aa7c36a242ca69b02c43cdb973aaed92f004d5",
-  "codeHashHex": "0x71e41f8c443a60f95aa13ae942aa7c36a242ca69b02c43cdb973aaed92f004d5",
-  "computedAt": "2026-02-25T03:16:23.336Z",
-  "fileCount": 19,
+  "codeHash": "740841a4e4069e7576a21b2da277ae7bb5b65bed028121cbc3277c865f58544f",
+  "codeHashHex": "0x740841a4e4069e7576a21b2da277ae7bb5b65bed028121cbc3277c865f58544f",
+  "computedAt": "2026-03-01T01:46:41.787Z",
+  "fileCount": 21,
   "files": [
+    "blockchain/PeerRegistryClient.ts",
     "blockchain/blockchain-anchor.ts",
     "blockchain/blockchain-client.ts",
+    "blockchain/protocol-thresholds-client.ts",
     "code-integrity.ts",
     "consensus/attestation-consensus.ts",
     "consensus/index.ts",

package/dist/server.js

@@ -6,8 +6,9 @@
  *  1. HTTP server (port 4888)    — clientes y legado
  *  2. libp2p P2P node (port 6888) — Kademlia DHT + GossipSub + mDNS
  */
-import { startValidatorNode, setP2PNode } from "./validator.js";
+import { startValidatorNode, setP2PNode, setPeerRegistryClient } from "./validator.js";
 import { createSoulprintP2PNode, MAINNET_BOOTSTRAP, stopP2PNode } from "./p2p.js";
+import { PeerRegistryClient } from "./blockchain/PeerRegistryClient.js";
 // ─── Config ──────────────────────────────────────────────────────────────────
 const HTTP_PORT = parseInt(process.env.SOULPRINT_PORT ?? "4888");
 const P2P_PORT = parseInt(process.env.SOULPRINT_P2P_PORT ?? String(HTTP_PORT + 2000));
@@ -42,6 +43,43 @@ catch (err) {
     console.warn(`⚠️  P2P no disponible — solo HTTP gossip activo`);
     console.warn(`   Error: ${err?.message ?? String(err)}\n`);
 }
+// ─── On-chain PeerRegistry (auto-registro) ────────────────────────────────────
+const adminPrivateKey = process.env.ADMIN_PRIVATE_KEY;
+const peerRegistry = new PeerRegistryClient({
+    privateKey: adminPrivateKey,
+});
+setPeerRegistryClient(peerRegistry);
+// Register self after P2P is ready (non-blocking)
+setTimeout(async () => {
+    try {
+        if (!adminPrivateKey) {
+            console.warn("[peer-registry] ⚠️  ADMIN_PRIVATE_KEY not set — skipping on-chain registration");
+            return;
+        }
+        // Get node identity from validator (fetched via HTTP)
+        const infoRes = await fetch(`http://localhost:${HTTP_PORT}/health`, { signal: AbortSignal.timeout(5000) });
+        const info = await infoRes.json();
+        // Get P2P multiaddr (first non-localhost if available)
+        let multiaddr = `http://localhost:${HTTP_PORT}`;
+        if (p2pNode) {
+            const addrs = p2pNode.getMultiaddrs().map((m) => m.toString());
+            const publicAddr = addrs.find(a => !a.includes("127.0.0.1") && !a.includes("/ip4/0.0.0.0"));
+            multiaddr = publicAddr ?? addrs[0] ?? multiaddr;
+        }
+        // Use node DID from keypair (read from health endpoint) and P2P peerId
+        const nodeDid = globalThis._nodeDid ?? `did:soulprint:node:${Date.now()}`;
+        const nodePeer = p2pNode?.peerId?.toString() ?? "";
+        await peerRegistry.registerSelf({
+            peerDid: nodeDid,
+            peerId: nodePeer,
+            multiaddr,
+            score: 0,
+        });
+    }
+    catch (e) {
+        console.warn(`[peer-registry] ⚠️  Could not register self: ${e.message}`);
+    }
+}, 3_000);
 // ─── HTTP Bootstrap Peers (auto-registro) ─────────────────────────────────────
 // SOULPRINT_BOOTSTRAP_HTTP=http://node1:4888,http://node2:4888
 // Registra peers HTTP automáticamente al arrancar (útil en WSL2 / Docker / cloud)

package/dist/validator.d.ts

@@ -1,6 +1,19 @@
 import { IncomingMessage, ServerResponse } from "node:http";
 import { BotAttestation, BotReputation } from "soulprint-core";
 import { type SoulprintP2PNode } from "./p2p.js";
+import { PeerRegistryClient } from "./blockchain/PeerRegistryClient.js";
+export declare function getLiveThresholds(): {
+    SCORE_FLOOR: number;
+    VERIFIED_SCORE_FLOOR: number;
+    MIN_ATTESTER_SCORE: number;
+    FACE_SIM_DOC_SELFIE: number;
+    FACE_SIM_SELFIE_SELFIE: number;
+    DEFAULT_REPUTATION: number;
+    IDENTITY_MAX: number;
+    REPUTATION_MAX: number;
+    source: "blockchain" | "local_fallback";
+};
+export declare function setPeerRegistryClient(client: PeerRegistryClient): void;
 /**
  * Inyecta el nodo libp2p al validador.
  * Cuando se llama:
@@ -13,7 +26,7 @@ export declare function setP2PNode(node: SoulprintP2PNode): void;
  *
  * PROTOCOL ENFORCEMENT:
  * - Si el bot tiene DocumentVerified, su score total nunca puede caer por
- *   debajo de PROTOCOL.VERIFIED_SCORE_FLOOR (52) - inamovible.
+ *   debajo de liveThresholds.VERIFIED_SCORE_FLOOR (52) - inamovible.
  * - Anti-replay: la misma attestation (mismo issuer + timestamp + context)
  *   no se puede aplicar dos veces.
  *

package/dist/validator.js

@@ -11,6 +11,7 @@ import { selectGossipPeers, routingStats } from "./crypto/peer-router.js";
 import { NullifierConsensus, AttestationConsensus, StateSyncManager } from "./consensus/index.js";
 import { BlockchainAnchor } from "./blockchain/blockchain-anchor.js";
 import { SoulprintBlockchainClient, loadBlockchainConfig, } from "./blockchain/blockchain-client.js";
+import { thresholdsClient, PROTOCOL_THRESHOLDS_ADDRESS, PROTOCOL_THRESHOLDS_CHAIN, } from "./blockchain/protocol-thresholds-client.js";
 import { getCodeIntegrity, logCodeIntegrity, computeRuntimeHash } from "./code-integrity.js";
 import { getMCPEntry, getVerifiedMCPEntries, getAllMCPEntries, getRegistryInfo, verifyMCPOnChain, revokeMCPOnChain, registerMCPOnChain, } from "./mcp-registry-client.js";
 import { publishAttestationP2P, onAttestationReceived, getP2PStats, dialP2PPeer, } from "./p2p.js";
@@ -28,11 +29,52 @@ const MAX_BODY_BYTES = 64 * 1024;
 const RATE_LIMIT_MS = PROTOCOL.RATE_LIMIT_WINDOW_MS;
 const RATE_LIMIT_MAX = PROTOCOL.RATE_LIMIT_MAX;
 const CLOCK_SKEW_MAX = PROTOCOL.CLOCK_SKEW_MAX_SECONDS;
-const MIN_ATTESTER_SCORE = PROTOCOL.MIN_ATTESTER_SCORE; // 65 - inamovible
 const ATT_MAX_AGE_SECONDS = PROTOCOL.ATT_MAX_AGE_SECONDS;
 const GOSSIP_TIMEOUT_MS = PROTOCOL.GOSSIP_TIMEOUT_MS;
+// ── Thresholds cargados desde blockchain al arrancar (fallback: local) ────────
+// Usados en runtime — se pueden actualizar solo via superAdmin en el contrato.
+// El validador recarga cada 10 minutos automáticamente.
+let liveThresholds = {
+    SCORE_FLOOR: PROTOCOL.SCORE_FLOOR,
+    VERIFIED_SCORE_FLOOR: PROTOCOL.VERIFIED_SCORE_FLOOR,
+    MIN_ATTESTER_SCORE: PROTOCOL.MIN_ATTESTER_SCORE,
+    FACE_SIM_DOC_SELFIE: PROTOCOL.FACE_SIM_DOC_SELFIE,
+    FACE_SIM_SELFIE_SELFIE: PROTOCOL.FACE_SIM_SELFIE_SELFIE,
+    DEFAULT_REPUTATION: PROTOCOL.DEFAULT_REPUTATION,
+    IDENTITY_MAX: PROTOCOL.IDENTITY_MAX,
+    REPUTATION_MAX: PROTOCOL.REPUTATION_MAX,
+    source: "local_fallback",
+};
+export function getLiveThresholds() { return liveThresholds; }
+async function refreshThresholds() {
+    try {
+        thresholdsClient.invalidate();
+        const t = await thresholdsClient.load();
+        liveThresholds = {
+            SCORE_FLOOR: t.SCORE_FLOOR,
+            VERIFIED_SCORE_FLOOR: t.VERIFIED_SCORE_FLOOR,
+            MIN_ATTESTER_SCORE: t.MIN_ATTESTER_SCORE,
+            FACE_SIM_DOC_SELFIE: t.FACE_SIM_DOC_SELFIE / 1000,
+            FACE_SIM_SELFIE_SELFIE: t.FACE_SIM_SELFIE_SELFIE / 1000,
+            DEFAULT_REPUTATION: t.DEFAULT_REPUTATION,
+            IDENTITY_MAX: t.IDENTITY_MAX,
+            REPUTATION_MAX: t.REPUTATION_MAX,
+            source: t.source,
+        };
+        console.log(`[thresholds] ✅ Cargados desde ${t.source === "blockchain" ? "blockchain" : "fallback local"}`);
+        if (t.source === "blockchain") {
+            console.log(`[thresholds]    SCORE_FLOOR=${t.SCORE_FLOOR} VERIFIED_SCORE_FLOOR=${t.VERIFIED_SCORE_FLOOR} MIN_ATTESTER=${t.MIN_ATTESTER_SCORE}`);
+        }
+    }
+    catch { /* usa los valores actuales */ }
+}
 // ── P2P Node (Phase 5) ────────────────────────────────────────────────────────
 let p2pNode = null;
+// ── PeerRegistry Client ───────────────────────────────────────────────────────
+let peerRegistryClient = null;
+export function setPeerRegistryClient(client) {
+    peerRegistryClient = client;
+}
 /**
  * Inyecta el nodo libp2p al validador.
  * Cuando se llama:
@@ -118,7 +160,7 @@ function getReputation(did) {
  *
  * PROTOCOL ENFORCEMENT:
  * - Si el bot tiene DocumentVerified, su score total nunca puede caer por
- *   debajo de PROTOCOL.VERIFIED_SCORE_FLOOR (52) - inamovible.
+ *   debajo de liveThresholds.VERIFIED_SCORE_FLOOR (52) - inamovible.
  * - Anti-replay: la misma attestation (mismo issuer + timestamp + context)
  *   no se puede aplicar dos veces.
  *
@@ -146,11 +188,11 @@ function applyAttestation(att) {
     const hasDocument = existing?.hasDocumentVerified ?? false;
     let finalRepScore = rep.score;
     if (hasDocument) {
-        const minRepForFloor = Math.max(0, PROTOCOL.VERIFIED_SCORE_FLOOR - identityFromStore);
+        const minRepForFloor = Math.max(0, liveThresholds.VERIFIED_SCORE_FLOOR - identityFromStore);
         finalRepScore = Math.max(finalRepScore, minRepForFloor);
         if (finalRepScore !== rep.score) {
             console.log(`[floor] Reputation clamped for ${att.target_did.slice(0, 20)}...: ` +
-                `${rep.score} → ${finalRepScore} (VERIFIED_SCORE_FLOOR=${PROTOCOL.VERIFIED_SCORE_FLOOR})`);
+                `${rep.score} → ${finalRepScore} (VERIFIED_SCORE_FLOOR=${liveThresholds.VERIFIED_SCORE_FLOOR})`);
         }
     }
     repStore[att.target_did] = {
@@ -293,7 +335,7 @@ function handleInfo(res, nodeKeypair) {
  * Expone las constantes de protocolo inamovibles.
  * Los clientes y otros nodos usan este endpoint para:
  *  1. Verificar compatibilidad de versión antes de conectarse
- *  2. Obtener los valores actuales de SCORE_FLOOR y MIN_ATTESTER_SCORE
+ *  2. Obtener los valores actuales de SCORE_FLOOR y liveThresholds.MIN_ATTESTER_SCORE
  *  3. Validar que el nodo no ha sido modificado para bajar los thresholds
  */
 function handleProtocol(res) {
@@ -304,9 +346,9 @@ function handleProtocol(res) {
         // Si PROTOCOL fue modificado (aunque sea un valor), este hash cambia.
         protocol_hash: PROTOCOL_HASH,
         // ── Score limits ────────────────────────────────────────────────────────
-        score_floor: PROTOCOL.SCORE_FLOOR,
-        verified_score_floor: PROTOCOL.VERIFIED_SCORE_FLOOR,
-        min_attester_score: PROTOCOL.MIN_ATTESTER_SCORE,
+        score_floor: liveThresholds.SCORE_FLOOR,
+        verified_score_floor: liveThresholds.VERIFIED_SCORE_FLOOR,
+        min_attester_score: liveThresholds.MIN_ATTESTER_SCORE,
         identity_max: PROTOCOL.IDENTITY_MAX,
         reputation_max: PROTOCOL.REPUTATION_MAX,
         max_score: PROTOCOL.MAX_SCORE,
@@ -346,7 +388,7 @@ function handleGetReputation(res, did) {
  * }
  *
  * Validaciones:
- *   1. service_spt tiene score >= MIN_ATTESTER_SCORE (solo servicios verificados)
+ *   1. service_spt tiene score >= liveThresholds.MIN_ATTESTER_SCORE (solo servicios verificados)
  *   2. service_spt.did == attestation.issuer_did (el emisor es quien dice ser)
  *   3. Firma Ed25519 de la attestation es válida
  *   4. timestamp no tiene más de ATT_MAX_AGE_SECONDS de antigüedad
@@ -422,10 +464,10 @@ async function handleAttest(req, res, ip) {
         const serviceTok = decodeToken(service_spt);
         if (!serviceTok)
             return json(res, 401, { error: "Invalid or expired service_spt" });
-        if (serviceTok.score < MIN_ATTESTER_SCORE) {
+        if (serviceTok.score < liveThresholds.MIN_ATTESTER_SCORE) {
             return json(res, 403, {
-                error: `Service score too low (${serviceTok.score} < ${MIN_ATTESTER_SCORE})`,
-                required: MIN_ATTESTER_SCORE,
+                error: `Service score too low (${serviceTok.score} < ${liveThresholds.MIN_ATTESTER_SCORE})`,
+                required: liveThresholds.MIN_ATTESTER_SCORE,
                 got: serviceTok.score,
             });
         }
@@ -747,7 +789,7 @@ async function handleTokenRenew(req, res, nodeKeypair) {
     const currentRep = repEntry
         ? computeTotalScoreWithFloor(repEntry.identityScore ?? 0, repEntry.score ?? 0, repEntry.hasDocumentVerified ?? false)
         : 0;
-    const scoreFloor = PROTOCOL.VERIFIED_SCORE_FLOOR ?? 52;
+    const scoreFloor = liveThresholds.VERIFIED_SCORE_FLOOR ?? 52;
     if (currentRep < scoreFloor) {
         return json(res, 403, {
             error: "Score por debajo del floor - renovación denegada",
@@ -794,6 +836,16 @@ export function startValidatorNode(port = PORT) {
     loadPeers();
     loadAudit();
     const nodeKeypair = loadOrCreateNodeKeypair();
+    // Expose DID globally so server.ts can use it for peer registration
+    globalThis._nodeDid = nodeKeypair.did;
+    // ── Cargar thresholds desde blockchain al arrancar ────────────────────────
+    // No bloqueante — el nodo arranca con valores locales y los actualiza async
+    refreshThresholds().then(() => {
+        console.log(`[thresholds] 📡 Fuente: ${liveThresholds.source} | SCORE_FLOOR=${liveThresholds.SCORE_FLOOR}`);
+        console.log(`[thresholds]    Contrato: ${PROTOCOL_THRESHOLDS_ADDRESS} (${PROTOCOL_THRESHOLDS_CHAIN})`);
+    });
+    // Refresco automático cada 10 minutos
+    setInterval(refreshThresholds, 10 * 60 * 1000);
     // ── Módulos de consenso P2P (sin EVM, sin gas fees) ──────────────────────
     const nullifierConsensus = new NullifierConsensus({
         selfDid: nodeKeypair.did,
@@ -924,11 +976,57 @@ export function startValidatorNode(port = PORT) {
             return handleInfo(res, nodeKeypair);
         if (cleanUrl === "/protocol" && req.method === "GET")
             return handleProtocol(res);
+        // GET /protocol/thresholds — thresholds live desde blockchain (superAdmin-mutable)
+        if (cleanUrl === "/protocol/thresholds" && req.method === "GET") {
+            return json(res, 200, {
+                source: liveThresholds.source,
+                contract: PROTOCOL_THRESHOLDS_ADDRESS,
+                chain: PROTOCOL_THRESHOLDS_CHAIN,
+                thresholds: {
+                    SCORE_FLOOR: liveThresholds.SCORE_FLOOR,
+                    VERIFIED_SCORE_FLOOR: liveThresholds.VERIFIED_SCORE_FLOOR,
+                    MIN_ATTESTER_SCORE: liveThresholds.MIN_ATTESTER_SCORE,
+                    FACE_SIM_DOC_SELFIE: liveThresholds.FACE_SIM_DOC_SELFIE,
+                    FACE_SIM_SELFIE_SELFIE: liveThresholds.FACE_SIM_SELFIE_SELFIE,
+                    DEFAULT_REPUTATION: liveThresholds.DEFAULT_REPUTATION,
+                    IDENTITY_MAX: liveThresholds.IDENTITY_MAX,
+                    REPUTATION_MAX: liveThresholds.REPUTATION_MAX,
+                },
+                last_loaded: new Date(Date.now()).toISOString(),
+                note: "Solo el superAdmin del contrato puede modificar estos valores on-chain",
+            });
+        }
+        // GET /network/peers — all peers from on-chain PeerRegistry
+        if (cleanUrl === "/network/peers" && req.method === "GET") {
+            try {
+                const chainPeers = peerRegistryClient
+                    ? await peerRegistryClient.getAllPeers()
+                    : [];
+                return json(res, 200, {
+                    ok: true,
+                    peers: chainPeers,
+                    count: chainPeers.length,
+                    contract: peerRegistryClient?.contractAddress ?? null,
+                    timestamp: Date.now(),
+                });
+            }
+            catch (err) {
+                return json(res, 500, { ok: false, error: err.message });
+            }
+        }
         // GET /network/stats — stats públicas para la landing page
         if (cleanUrl === "/network/stats" && req.method === "GET") {
             const p2pStats = p2pNode ? getP2PStats(p2pNode) : null;
             const httpPeers = peers.length;
             const libp2pPeers = p2pStats?.peers ?? 0;
+            let registeredPeers = 0;
+            try {
+                if (peerRegistryClient) {
+                    const chainPeers = await peerRegistryClient.getAllPeers();
+                    registeredPeers = chainPeers.length;
+                }
+            }
+            catch { /* non-fatal */ }
             return json(res, 200, {
                 node_did: nodeKeypair.did.slice(0, 20) + "...",
                 version: VERSION,
@@ -944,6 +1042,8 @@ export function startValidatorNode(port = PORT) {
                 p2p_enabled: !!p2pNode,
                 // total = max de ambas capas (HTTP gossip es el piso mínimo garantizado)
                 total_peers: Math.max(httpPeers, libp2pPeers),
+                // on-chain registered peers (PeerRegistry)
+                registered_peers: registeredPeers,
                 // estado general
                 uptime_ms: Date.now() - (globalThis._startTime ?? Date.now()),
                 timestamp: Date.now(),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "soulprint-network",
-  "version": "0.4.0",
+  "version": "0.4.2",
   "description": "Soulprint validator node — HTTP server that verifies ZK proofs, co-signs SPTs, anti-Sybil registry",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -11,6 +11,11 @@
     "dist",
     "README.md"
   ],
+  "scripts": {
+    "build": "tsc && node scripts/compute-code-hash.mjs && cp -f src/blockchain/addresses.json dist/blockchain/addresses.json 2>/dev/null || true",
+    "start": "node dist/server.js",
+    "build:hash": "node scripts/compute-code-hash.mjs"
+  },
   "publishConfig": {
     "access": "public"
   },
@@ -46,9 +51,9 @@
     "nodemailer": "^8.0.1",
     "otpauth": "^9.5.0",
     "otplib": "^13.3.0",
-    "uint8arrays": "5.1.0",
-    "soulprint-core": "0.1.11",
-    "soulprint-zkp": "0.1.5"
+    "soulprint-core": "workspace:*",
+    "soulprint-zkp": "workspace:*",
+    "uint8arrays": "5.1.0"
   },
   "devDependencies": {
     "@types/node": "^20.0.0",
@@ -64,10 +69,5 @@
       "import": "./dist/index.js",
       "types": "./dist/index.d.ts"
     }
-  },
-  "scripts": {
-    "build": "tsc && node scripts/compute-code-hash.mjs",
-    "start": "node dist/server.js",
-    "build:hash": "node scripts/compute-code-hash.mjs"
   }
 }