.githooks/pre-commit

@@ -1,98 +0,0 @@
-#!/bin/bash
-
-# Colors for output
-CYAN='\033[0;36m'
-YELLOW='\033[1;33m'
-GREEN='\033[0;32m'
-RED='\033[0;31m'
-BLUE='\033[0;34m'
-NOCOLOR='\033[0m'
-
-# Get the directory where this hook is located
-HOOK_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# Go up from .git/hooks/ to repo root
-REPO_ROOT="$(cd "$HOOK_DIR/../.." && pwd)"
-CHANGELOG_SCRIPT="$REPO_ROOT/scripts/update_changelog.sh"
-PREVIEW_FILE="$REPO_ROOT/.changelog_preview.tmp"
-VERSION_FILE="$REPO_ROOT/.changelog_version.tmp"
-
-# Only run changelog update if there are actual code changes (not just changelog files)
-STAGED_FILES=$(git diff --cached --name-only --diff-filter=ACM)
-if [ -z "$STAGED_FILES" ]; then
-  # No staged files, exit
-  exit 0
-fi
-
-# Check if only CHANGELOG.md and/or Makefile are being committed
-OTHER_FILES=$(echo "$STAGED_FILES" | grep -v "^CHANGELOG.md$" | grep -v "^Makefile$")
-if [ -z "$OTHER_FILES" ]; then
-  # Only changelog files are being committed, skip update
-  exit 0
-fi
-
-# Check for skip flag
-# To skip changelog generation, set SKIP_CHANGELOG=1 before committing:
-#   SKIP_CHANGELOG=1 git commit -m "your message"
-#   SKIP_CHANGELOG=1 git commit
-if [ "$SKIP_CHANGELOG" = "1" ] || [ "$SKIP_CHANGELOG" = "true" ]; then
-  echo -e "${YELLOW}Skipping changelog update (SKIP_CHANGELOG is set)${NOCOLOR}"
-  exit 0
-fi
-
-# Update changelog before commit
-if [ -f "$CHANGELOG_SCRIPT" ]; then
-  echo -e "\n${CYAN}Updating changelog...${NOCOLOR}"
-  
-  # Set environment variable to indicate we're running from pre-commit
-  export CHANGELOG_CONTEXT=pre-commit
-  
-  bash "$CHANGELOG_SCRIPT"
-  changelog_status=$?
-  if [ $changelog_status -ne 0 ]; then
-    echo -e "${RED}Commit aborted: changelog update failed.${NOCOLOR}"
-    exit 1
-  fi
-  
-  # Show preview if changelog was updated
-  if [ -f "$PREVIEW_FILE" ] && [ -f "$VERSION_FILE" ]; then
-    NEW_VERSION=$(cat "$VERSION_FILE")
-    PREVIEW_CONTENT=$(cat "$PREVIEW_FILE")
-    
-    echo ""
-    echo -e "${BLUE}========================================================================${NOCOLOR}"
-    echo -e "${CYAN}                    CHANGELOG PREVIEW${NOCOLOR}"
-    echo -e "${BLUE}========================================================================${NOCOLOR}"
-    echo ""
-    echo -e "${GREEN}New Version: ${YELLOW}$NEW_VERSION${NOCOLOR}"
-    echo ""
-    echo -e "${CYAN}Changelog Entry:${NOCOLOR}"
-    echo -e "${BLUE}────────────────────────────────────────────────────────────────────────${NOCOLOR}"
-    echo -e "$PREVIEW_CONTENT"
-    echo -e "${BLUE}────────────────────────────────────────────────────────────────────────${NOCOLOR}"
-    echo ""
-    echo -e "${YELLOW}Do you want to proceed with the commit? (yes/no):${NOCOLOR} "
-    # Read from /dev/tty to ensure we can read from terminal even in git hook context
-    read -r confirmation < /dev/tty
-    
-    if [ "$confirmation" != "yes" ]; then
-      echo -e "${RED}Commit aborted by user.${NOCOLOR}"
-      echo -e "${YELLOW}To revert changes, run:${NOCOLOR}"
-      echo -e "  git checkout CHANGELOG.md Makefile"
-      # Clean up temp files
-      rm -f "$PREVIEW_FILE" "$VERSION_FILE"
-      exit 1
-    fi
-    
-    echo -e "${GREEN}Proceeding with commit...${NOCOLOR}"
-    
-    # Add the updated CHANGELOG.md and Makefile to the current commit
-    echo -e "${CYAN}Staging CHANGELOG.md and Makefile...${NOCOLOR}"
-    git add CHANGELOG.md Makefile
-    
-    # Clean up temp files
-    rm -f "$PREVIEW_FILE" "$VERSION_FILE"
-  fi
-else
-  echo -e "${YELLOW}Warning: changelog update script not found at $CHANGELOG_SCRIPT${NOCOLOR}"
-fi
-

.githooks/pre-push

@@ -1,18 +1,11 @@
 #!/bin/bash
 
-# Colors for output
+echo -e "\nRunning tests:"
-CYAN='\033[0;36m'
-GREEN='\033[0;32m'
-RED='\033[0;31m'
-NOCOLOR='\033[0m'
-
-# Run tests before push
-echo -e "\n${CYAN}Running tests...${NOCOLOR}"
 go test ./...   # Runs all tests in your repo
 status=$?
 if [ $status -ne 0 ]; then
-  echo -e "${RED}Push aborted: some tests failed.${NOCOLOR}"
+  echo "Push aborted: some tests failed."
   exit 1
 else
-  echo -e "${GREEN}All tests passed. Proceeding with push.${NOCOLOR}"
+  echo "All tests passed. Proceeding with push."
 fi

.github/workflows/release-apt.yml

@@ -1,198 +0,0 @@
-name: Release APT Package
-
-on:
-  release:
-    types: [published]
-  workflow_dispatch:
-    inputs:
-      version:
-        description: "Version to release (e.g., 0.69.20)"
-        required: true
-
-permissions:
-  contents: write
-  packages: write
-
-jobs:
-  build-deb:
-    name: Build Debian Package
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        arch: [amd64, arm64]
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Set up Go
-        uses: actions/setup-go@v5
-        with:
-          go-version: "1.23"
-
-      - name: Get version
-        id: version
-        run: |
-          if [ "${{ github.event_name }}" = "release" ]; then
-            VERSION="${{ github.event.release.tag_name }}"
-            VERSION="${VERSION#v}"  # Remove 'v' prefix if present
-          else
-            VERSION="${{ github.event.inputs.version }}"
-          fi
-          echo "version=$VERSION" >> $GITHUB_OUTPUT
-
-      - name: Set up QEMU (for arm64)
-        if: matrix.arch == 'arm64'
-        uses: docker/setup-qemu-action@v3
-
-      - name: Build binary
-        env:
-          GOARCH: ${{ matrix.arch }}
-          CGO_ENABLED: 0
-        run: |
-          VERSION="${{ steps.version.outputs.version }}"
-          COMMIT=$(git rev-parse --short HEAD)
-          DATE=$(date -u +%Y-%m-%dT%H:%M:%SZ)
-          LDFLAGS="-X 'main.version=$VERSION' -X 'main.commit=$COMMIT' -X 'main.date=$DATE'"
-
-          mkdir -p build/usr/local/bin
-          go build -ldflags "$LDFLAGS" -o build/usr/local/bin/orama cmd/cli/main.go
-          go build -ldflags "$LDFLAGS" -o build/usr/local/bin/debros-node cmd/node/main.go
-          # Build the entire gateway package so helper files (e.g., config parsing) are included
-          go build -ldflags "$LDFLAGS" -o build/usr/local/bin/debros-gateway ./cmd/gateway
-
-      - name: Create Debian package structure
-        run: |
-          VERSION="${{ steps.version.outputs.version }}"
-          ARCH="${{ matrix.arch }}"
-          PKG_NAME="orama_${VERSION}_${ARCH}"
-
-          mkdir -p ${PKG_NAME}/DEBIAN
-          mkdir -p ${PKG_NAME}/usr/local/bin
-
-          # Copy binaries
-          cp build/usr/local/bin/* ${PKG_NAME}/usr/local/bin/
-          chmod 755 ${PKG_NAME}/usr/local/bin/*
-
-          # Create control file
-          cat > ${PKG_NAME}/DEBIAN/control << EOF
-          Package: orama
-          Version: ${VERSION}
-          Section: net
-          Priority: optional
-          Architecture: ${ARCH}
-          Depends: libc6
-          Maintainer: DeBros Team <team@debros.network>
-          Description: Orama Network - Distributed P2P Database System
-           Orama is a distributed peer-to-peer network that combines
-           RQLite for distributed SQL, IPFS for content-addressed storage,
-           and LibP2P for peer discovery and communication.
-          EOF
-
-          # Create postinst script
-          cat > ${PKG_NAME}/DEBIAN/postinst << 'EOF'
-          #!/bin/bash
-          set -e
-          echo ""
-          echo "Orama installed successfully!"
-          echo ""
-          echo "To set up your node, run:"
-          echo "  sudo orama install"
-          echo ""
-          EOF
-          chmod 755 ${PKG_NAME}/DEBIAN/postinst
-
-      - name: Build .deb package
-        run: |
-          VERSION="${{ steps.version.outputs.version }}"
-          ARCH="${{ matrix.arch }}"
-          PKG_NAME="orama_${VERSION}_${ARCH}"
-
-          dpkg-deb --build ${PKG_NAME}
-          mv ${PKG_NAME}.deb orama_${VERSION}_${ARCH}.deb
-
-      - name: Upload artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: deb-${{ matrix.arch }}
-          path: "*.deb"
-
-  publish-apt:
-    name: Publish to APT Repository
-    needs: build-deb
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Download all artifacts
-        uses: actions/download-artifact@v4
-        with:
-          path: packages
-
-      - name: Get version
-        id: version
-        run: |
-          if [ "${{ github.event_name }}" = "release" ]; then
-            VERSION="${{ github.event.release.tag_name }}"
-            VERSION="${VERSION#v}"
-          else
-            VERSION="${{ github.event.inputs.version }}"
-          fi
-          echo "version=$VERSION" >> $GITHUB_OUTPUT
-
-      - name: Set up GPG
-        if: env.GPG_PRIVATE_KEY != ''
-        env:
-          GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
-        run: |
-          echo "$GPG_PRIVATE_KEY" | gpg --import
-
-      - name: Create APT repository structure
-        run: |
-          mkdir -p apt-repo/pool/main/o/orama
-          mkdir -p apt-repo/dists/stable/main/binary-amd64
-          mkdir -p apt-repo/dists/stable/main/binary-arm64
-
-          # Move packages
-          mv packages/deb-amd64/*.deb apt-repo/pool/main/o/orama/
-          mv packages/deb-arm64/*.deb apt-repo/pool/main/o/orama/
-
-          # Generate Packages files
-          cd apt-repo
-          dpkg-scanpackages --arch amd64 pool/ > dists/stable/main/binary-amd64/Packages
-          dpkg-scanpackages --arch arm64 pool/ > dists/stable/main/binary-arm64/Packages
-
-          gzip -k dists/stable/main/binary-amd64/Packages
-          gzip -k dists/stable/main/binary-arm64/Packages
-
-          # Generate Release file
-          cat > dists/stable/Release << EOF
-          Origin: Orama
-          Label: Orama
-          Suite: stable
-          Codename: stable
-          Architectures: amd64 arm64
-          Components: main
-          Description: Orama Network APT Repository
-          EOF
-
-          cd ..
-
-      - name: Upload to release
-        if: github.event_name == 'release'
-        uses: softprops/action-gh-release@v1
-        with:
-          files: |
-            apt-repo/pool/main/o/orama/*.deb
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Deploy APT repository to GitHub Pages
-        uses: peaceiris/actions-gh-pages@v4
-        with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-          publish_dir: ./apt-repo
-          destination_dir: apt
-          keep_files: true

.github/workflows/release.yaml

@@ -1,73 +0,0 @@
-name: Release
-
-on:
-  push:
-    tags:
-      - 'v*'
-  workflow_dispatch:
-
-permissions:
-  contents: write
-  packages: write
-
-jobs:
-  build-release:
-    runs-on: ubuntu-latest
-    
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0  # Need full history for changelog
-      
-      - name: Set up Go
-        uses: actions/setup-go@v4
-        with:
-          go-version: '1.21'
-          cache: true
-      
-      - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@v5
-        with:
-          distribution: goreleaser
-          version: latest
-          args: release --clean
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      
-      - name: Upload artifacts
-        uses: actions/upload-artifact@v4
-        with:
-          name: release-artifacts
-          path: dist/
-          retention-days: 5
-
-  # Optional: Publish to GitHub Packages (requires additional setup)
-  publish-packages:
-    runs-on: ubuntu-latest
-    needs: build-release
-    if: startsWith(github.ref, 'refs/tags/')
-    
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-      
-      - name: Download artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: release-artifacts
-          path: dist/
-      
-      - name: Publish to GitHub Packages
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          echo "Publishing Debian packages to GitHub Packages..."
-          for deb in dist/*.deb; do
-            if [ -f "$deb" ]; then
-              curl -H "Authorization: token $GITHUB_TOKEN" \
-                   -H "Content-Type: application/octet-stream" \
-                   --data-binary @"$deb" \
-                   "https://uploads.github.com/repos/${{ github.repository }}/releases/upload?name=$(basename "$deb")"
-            fi
-          done

.gitignore

@@ -73,7 +73,3 @@ data/bootstrap/rqlite/
 .env.*
 
 configs/
-
-.dev/
-
-.gocache/

.goreleaser.yaml

@@ -1,66 +1,64 @@
-# GoReleaser Configuration for DeBros Network
+# GoReleaser config for network
-# Builds and releases the dbn binary for multiple platforms
+project_name: network
-# Other binaries (node, gateway, identity) are installed via: dbn setup
 
-project_name: debros-network
+before:
-
+  hooks:
-env:
+    - go mod tidy
-  - GO111MODULE=on
 
 builds:
-  # dbn binary - only build the CLI
+  - id: network-node
-  - id: dbn
+    main: ./cmd/node
-    main: ./cmd/cli
+    binary: network-node
-    binary: dbn
+    env:
-    goos:
+      - CGO_ENABLED=0
-      - linux
+    flags: ["-trimpath"]
-      - darwin
-    goarch:
-      - amd64
-      - arm64
     ldflags:
       - -s -w
       - -X main.version={{.Version}}
-      - -X main.commit={{.ShortCommit}}
+      - -X main.commit={{.Commit}}
       - -X main.date={{.Date}}
-    mod_timestamp: "{{ .CommitTimestamp }}"
+    goos: [linux, darwin, windows]
+    goarch: [amd64, arm64]
+    mod_timestamp: '{{ .CommitDate }}'
+
+  - id: network-cli
+    main: ./cmd/cli
+    binary: network-cli
+    env:
+      - CGO_ENABLED=0
+    flags: ["-trimpath"]
+    ldflags:
+      - -s -w
+      - -X main.version={{.Version}}
+      - -X main.commit={{.Commit}}
+      - -X main.date={{.Date}}
+    goos: [linux, darwin, windows]
+    goarch: [amd64, arm64]
+    mod_timestamp: '{{ .CommitDate }}'
 
 archives:
-  # Tar.gz archives for dbn
+  - id: default
-  - id: binaries
+    builds: [network-node, network-cli]
     format: tar.gz
     name_template: "{{ .ProjectName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
     files:
+      - LICENSE*
       - README.md
-      - LICENSE
-      - CHANGELOG.md
-    format_overrides:
-      - goos: windows
-        format: zip
 
 checksum:
   name_template: "checksums.txt"
-  algorithm: sha256
 
-snapshot:
+signs:
-  name_template: "{{ incpatch .Version }}-next"
+  - artifacts: checksum
 
 changelog:
   sort: asc
-  abbrev: -1
+  use: git
   filters:
     exclude:
-      - "^docs:"
+      - '^docs:'
-      - "^test:"
+      - '^test:'
-      - "^chore:"
+      - '^ci:'
-      - "^ci:"
-      - Merge pull request
-      - Merge branch
 
 release:
-  github:
-    owner: DeBrosOfficial
-    name: network
-  draft: false
   prerelease: auto
-  name_template: "Release {{.Version}}"

.zed/debug.json

@@ -11,7 +11,7 @@
     "program": "./cmd/gateway",
     "env": {
       "GATEWAY_ADDR": ":6001",
-      "GATEWAY_BOOTSTRAP_PEERS": "/ip4/localhost/tcp/4001/p2p/12D3KooWSHHwEY6cga3ng7tD1rzStAU58ogQXVMX3LZJ6Gqf6dee",
+      "GATEWAY_BOOTSTRAP_PEERS": "/ip4/127.0.0.1/tcp/4001/p2p/12D3KooWSHHwEY6cga3ng7tD1rzStAU58ogQXVMX3LZJ6Gqf6dee",
       "GATEWAY_NAMESPACE": "default",
       "GATEWAY_API_KEY": "ak_iGustrsFk9H8uXpwczCATe5U:default"
     }
@@ -36,7 +36,7 @@
     "program": "./cmd/gateway",
     "env": {
       "GATEWAY_ADDR": ":6001",
-      "GATEWAY_BOOTSTRAP_PEERS": "/ip4/localhost/tcp/4001/p2p/12D3KooWSHHwEY6cga3ng7tD1rzStAU58ogQXVMX3LZJ6Gqf6dee",
+      "GATEWAY_BOOTSTRAP_PEERS": "/ip4/127.0.0.1/tcp/4001/p2p/12D3KooWSHHwEY6cga3ng7tD1rzStAU58ogQXVMX3LZJ6Gqf6dee",
       "GATEWAY_NAMESPACE": "default",
       "GATEWAY_API_KEY": "ak_iGustrsFk9H8uXpwczCATe5U:default"
     }

CONTRIBUTING.md

@@ -22,19 +22,19 @@ make deps
 - Test: `make test`
 - Format/Vet: `make fmt vet` (or `make lint`)
 
-````
+```
 
 Useful CLI commands:
 
 ```bash
-./bin/orama health
+./bin/network-cli health
-./bin/orama peers
+./bin/network-cli peers
-./bin/orama status
+./bin/network-cli status
-````
+```
 
 ## Versioning
 
-- The CLI reports its version via `orama version`.
+- The CLI reports its version via `network-cli version`.
 - Releases are tagged (e.g., `v0.18.0-beta`) and published via GoReleaser.
 
 ## Pull Requests

Makefile

@@ -6,20 +6,22 @@ test:
 	go test -v $(TEST)
 
 # Gateway-focused E2E tests assume gateway and nodes are already running
-# Auto-discovers configuration from ~/.orama and queries database for API key
+# Configure via env:
-# No environment variables required
+#   GATEWAY_BASE_URL (default http://127.0.0.1:6001)
+#   GATEWAY_API_KEY  (required for auth-protected routes)
 .PHONY: test-e2e
 test-e2e:
-	@echo "Running comprehensive E2E tests..."
+	@echo "Running gateway E2E tests (HTTP/WS only)..."
-	@echo "Auto-discovering configuration from ~/.orama..."
+	@echo "Base URL: $${GATEWAY_BASE_URL:-http://127.0.0.1:6001}"
+	@test -n "$$GATEWAY_API_KEY" || (echo "GATEWAY_API_KEY must be set" && exit 1)
 	go test -v -tags e2e ./e2e
 
 # Network - Distributed P2P Database System
 # Makefile for development and build tasks
 
-.PHONY: build clean test run-node run-node2 run-node3 run-example deps tidy fmt vet lint clear-ports install-hooks kill
+.PHONY: build clean test run-node run-node2 run-node3 run-example deps tidy fmt vet lint clear-ports
 
-VERSION := 0.72.1
+VERSION := 0.51.2-beta
 COMMIT  ?= $(shell git rev-parse --short HEAD 2>/dev/null || echo unknown)
 DATE    ?= $(shell date -u +%Y-%m-%dT%H:%M:%SZ)
 LDFLAGS := -X 'main.version=$(VERSION)' -X 'main.commit=$(COMMIT)' -X 'main.date=$(DATE)'
@@ -29,16 +31,11 @@ build: deps
 	@echo "Building network executables (version=$(VERSION))..."
 	@mkdir -p bin
 	go build -ldflags "$(LDFLAGS)" -o bin/identity ./cmd/identity
-	go build -ldflags "$(LDFLAGS)" -o bin/orama-node ./cmd/node
+	go build -ldflags "$(LDFLAGS)" -o bin/node ./cmd/node
-	go build -ldflags "$(LDFLAGS)" -o bin/orama cmd/cli/main.go
+	go build -ldflags "$(LDFLAGS)" -o bin/network-cli cmd/cli/main.go
 	# Inject gateway build metadata via pkg path variables
 	go build -ldflags "$(LDFLAGS) -X 'github.com/DeBrosOfficial/network/pkg/gateway.BuildVersion=$(VERSION)' -X 'github.com/DeBrosOfficial/network/pkg/gateway.BuildCommit=$(COMMIT)' -X 'github.com/DeBrosOfficial/network/pkg/gateway.BuildTime=$(DATE)'" -o bin/gateway ./cmd/gateway
-	@echo "Build complete! Run ./bin/orama version"
+	@echo "Build complete! Run ./bin/network-cli version"
-
-# Install git hooks
-install-hooks:
-	@echo "Installing git hooks..."
-	@bash scripts/install-hooks.sh
 
 # Clean build artifacts
 clean:
@@ -49,48 +46,128 @@ clean:
 
 # Run bootstrap node (auto-selects identity and data dir)
 run-node:
-	@echo "Starting node..."
+	@echo "Starting bootstrap node with config..."
-	@echo "Config: ~/.orama/node.yaml"
+	go run ./cmd/node --config configs/bootstrap.yaml
-	go run ./cmd/orama-node --config node.yaml
 
-# Run second node - requires join address
+# Run second node (regular) - requires join address of bootstrap node
+# Usage: make run-node2 JOINADDR=/ip4/127.0.0.1/tcp/5001 HTTP=5002 RAFT=7002 P2P=4002
 run-node2:
-	@echo "Starting second node..."
+	@echo "Starting regular node2 with config..."
-	@echo "Config: ~/.orama/node2.yaml"
+	go run ./cmd/node --config configs/node.yaml
-	go run ./cmd/orama-node --config node2.yaml
 
-# Run third node - requires join address
+# Run third node (regular) - requires join address of bootstrap node
+# Usage: make run-node3 JOINADDR=/ip4/127.0.0.1/tcp/5001 HTTP=5003 RAFT=7003 P2P=4003
 run-node3:
-	@echo "Starting third node..."
+	@echo "Starting regular node3 with config..."
-	@echo "Config: ~/.orama/node3.yaml"
+	go run ./cmd/node --config configs/node3.yaml
-	go run ./cmd/orama-node --config node3.yaml
 
 # Run gateway HTTP server
+# Usage examples:
+#   make run-gateway                                   # uses defaults (:8080, namespace=default)
+#   GATEWAY_ADDR=":8081" make run-gateway              # override listen addr via env
+#   GATEWAY_NAMESPACE=myapp make run-gateway           # set namespace
+#   GATEWAY_BOOTSTRAP_PEERS="/ip4/127.0.0.1/tcp/4001/p2p/<ID>" make run-gateway
+#   GATEWAY_REQUIRE_AUTH=1 GATEWAY_API_KEYS="key1:ns1,key2:ns2" make run-gateway
 run-gateway:
 	@echo "Starting gateway HTTP server..."
-	@echo "Note: Config must be in ~/.orama/data/gateway.yaml"
+	GATEWAY_ADDR=$(or $(ADDR),$(GATEWAY_ADDR)) \
-	go run ./cmd/orama-gateway
+	GATEWAY_NAMESPACE=$(or $(NAMESPACE),$(GATEWAY_NAMESPACE)) \
+	GATEWAY_BOOTSTRAP_PEERS=$(GATEWAY_BOOTSTRAP_PEERS) \
+	GATEWAY_REQUIRE_AUTH=$(GATEWAY_REQUIRE_AUTH) \
+	GATEWAY_API_KEYS=$(GATEWAY_API_KEYS) \
+	go run ./cmd/gateway
 
-# Setup local domain names for development
+# Run basic usage example
-setup-domains:
+run-example:
-	@echo "Setting up local domains..."
+	@echo "Running basic usage example..."
-	@sudo bash scripts/setup-local-domains.sh
+	go run examples/basic_usage.go
 
-# Development environment target
+# Show how to run with flags
-# Uses orama dev up to start full stack with dependency and port checking
+show-bootstrap:
-dev: build setup-domains
+	@echo "Provide join address via flags, e.g.:"
-	@./bin/orama dev up
+	@echo "  make run-node2 JOINADDR=/ip4/127.0.0.1/tcp/5001 HTTP=5002 RAFT=7002 P2P=4002"
 
-# Graceful shutdown of all dev services
+# Run network CLI
-stop:
+run-cli:
-	@if [ -f ./bin/orama ]; then \
+	@echo "Running network CLI help..."
-		./bin/orama dev down || true; \
+	./bin/network-cli help
-	fi
-	@bash scripts/dev-kill-all.sh
 
-# Force kill all processes (immediate termination)
+# Network CLI helper commands
-kill:
+cli-health:
-	@bash scripts/dev-kill-all.sh
+	@echo "Checking network health..."
+	./bin/network-cli health
+
+cli-peers:
+	@echo "Listing network peers..."
+	./bin/network-cli peers
+
+cli-status:
+	@echo "Getting network status..."
+	./bin/network-cli status
+
+cli-storage-test:
+	@echo "Testing storage operations..."
+	@./bin/network-cli storage put test-key "Hello Network" || echo "Storage test requires running network"
+	@./bin/network-cli storage get test-key || echo "Storage test requires running network"
+	@./bin/network-cli storage list || echo "Storage test requires running network"
+
+cli-pubsub-test:
+	@echo "Testing pub/sub operations..."
+	@./bin/network-cli pubsub publish test-topic "Hello World" || echo "PubSub test requires running network"
+	@./bin/network-cli pubsub topics || echo "PubSub test requires running network"
+
+# Download dependencies
+deps:
+	@echo "Downloading dependencies..."
+	go mod download
+
+# Tidy dependencies
+tidy:
+	@echo "Tidying dependencies..."
+	go mod tidy
+
+# Format code
+fmt:
+	@echo "Formatting code..."
+	go fmt ./...
+
+# Vet code
+vet:
+	@echo "Vetting code..."
+	go vet ./...
+
+# Lint alias (lightweight for now)
+lint: fmt vet
+	@echo "Linting complete (fmt + vet)"
+
+# Clear common development ports
+clear-ports:
+	@echo "Clearing common dev ports (4001/4002, 5001/5002, 7001/7002)..."
+	@chmod +x scripts/clear-ports.sh || true
+	@scripts/clear-ports.sh
+
+# Development setup
+dev-setup: deps
+	@echo "Setting up development environment..."
+	@mkdir -p data/bootstrap data/node data/node2 data/node3
+	@mkdir -p data/test-bootstrap data/test-node1 data/test-node2
+	@echo "Development setup complete!"
+
+# Start development cluster (requires multiple terminals)
+dev-cluster:
+	@echo "To start a development cluster, run these commands in separate terminals:"
+	@echo "1. make run-node           # Start bootstrap node (uses configs/bootstrap.yaml)"
+	@echo "2. make run-node2          # Start second node (uses configs/node.yaml)"
+	@echo "3. make run-node3          # Start third node (uses configs/node.yaml)"
+	@echo "4. make run-example        # Test basic functionality"
+	@echo "5. make cli-health         # Check network health"
+	@echo "6. make cli-peers          # List peers"
+	@echo "7. make cli-storage-test   # Test storage"
+	@echo "8. make cli-pubsub-test    # Test messaging"
+
+# Full development workflow
+dev: clean build test
+	@echo "Development workflow complete!"
 
 # Help
 help:
@@ -98,29 +175,29 @@ help:
 	@echo "  build         - Build all executables"
 	@echo "  clean         - Clean build artifacts"
 	@echo "  test          - Run tests"
-	@echo ""
+	@echo "  run-node      - Start bootstrap node"
-	@echo "Local Development (Recommended):"
+	@echo "  run-node2     - Start second node (requires JOINADDR, optional HTTP/RAFT/P2P)"
-	@echo "  make dev      - Start full development stack with one command"
+	@echo "  run-node3     - Start third node (requires JOINADDR, optional HTTP/RAFT/P2P)"
-	@echo "                 - Checks dependencies and available ports"
+	@echo "  run-gateway   - Start HTTP gateway (flags via env: GATEWAY_ADDR, GATEWAY_NAMESPACE, GATEWAY_BOOTSTRAP_PEERS, GATEWAY_REQUIRE_AUTH, GATEWAY_API_KEYS)"
-	@echo "                 - Generates configs and starts all services"
+	@echo "  run-example   - Run usage example"
-	@echo "                 - Validates cluster health"
+	@echo "  run-cli       - Run network CLI help"
-	@echo "  make stop     - Gracefully stop all development services"
+	@echo "  show-bootstrap - Show example bootstrap usage with flags"
-	@echo "  make kill     - Force kill all development services (use if stop fails)"
+	@echo "  cli-health    - Check network health"
-	@echo ""
+	@echo "  cli-peers     - List network peers"
-	@echo "Development Management (via orama):"
+	@echo "  cli-status    - Get network status"
-	@echo "  ./bin/orama dev status  - Show status of all dev services"
+	@echo "  cli-storage-test - Test storage operations"
-	@echo "  ./bin/orama dev logs <component> [--follow]"
+	@echo "  cli-pubsub-test  - Test pub/sub operations"
-	@echo ""
+	@echo "  test-multinode   - Full multi-node test with 1 bootstrap + 2 nodes"
-	@echo "Individual Node Targets (advanced):"
+	@echo "  test-peer-discovery - Test peer discovery (requires running nodes)"
-	@echo "  run-node      - Start first node directly"
+	@echo "  test-replication - Test data replication (requires running nodes)"
-	@echo "  run-node2     - Start second node directly"
+	@echo "  test-consensus   - Test database consensus (requires running nodes)"
-	@echo "  run-node3     - Start third node directly"
-	@echo "  run-gateway   - Start HTTP gateway directly"
-	@echo ""
-	@echo "Maintenance:"
 	@echo "  deps          - Download dependencies"
 	@echo "  tidy          - Tidy dependencies"
 	@echo "  fmt           - Format code"
 	@echo "  vet           - Vet code"
 	@echo "  lint          - Lint code (fmt + vet)"
+	@echo "  clear-ports   - Clear common dev ports"
+	@echo "  dev-setup     - Setup development environment"
+	@echo "  dev-cluster   - Show cluster startup commands"
+	@echo "  dev           - Full development workflow"
 	@echo "  help          - Show this help"

cmd/cli/main.go

@@ -1,16 +1,27 @@
 package main
 
 import (
+	"context"
+	"encoding/json"
 	"fmt"
+	"log"
 	"os"
+	"os/exec"
+	"strconv"
+	"strings"
 	"time"
 
-	"github.com/DeBrosOfficial/network/pkg/cli"
+	"github.com/DeBrosOfficial/network/pkg/auth"
+	"github.com/DeBrosOfficial/network/pkg/client"
+	"github.com/libp2p/go-libp2p/core/crypto"
+	"github.com/libp2p/go-libp2p/core/peer"
 )
 
 var (
-	timeout = 30 * time.Second
+	bootstrapPeer = "/ip4/127.0.0.1/tcp/4001"
-	format  = "table"
+	timeout       = 30 * time.Second
+	format        = "table"
+	useProduction = false
 )
 
 // version metadata populated via -ldflags at build time
@@ -34,7 +45,7 @@ func main() {
 
 	switch command {
 	case "version":
-		fmt.Printf("orama %s", version)
+		fmt.Printf("network-cli %s", version)
 		if commit != "" {
 			fmt.Printf(" (commit %s)", commit)
 		}
@@ -43,40 +54,28 @@ func main() {
 		}
 		fmt.Println()
 		return
-
+	case "health":
-	// Development environment commands
+		handleHealth()
-	case "dev":
+	case "peers":
-		cli.HandleDevCommand(args)
+		handlePeers()
-
-	// Production environment commands (legacy with 'prod' prefix)
-	case "prod":
-		cli.HandleProdCommand(args)
-
-	// Direct production commands (new simplified interface)
-	case "install":
-		cli.HandleProdCommand(append([]string{"install"}, args...))
-	case "upgrade":
-		cli.HandleProdCommand(append([]string{"upgrade"}, args...))
-	case "migrate":
-		cli.HandleProdCommand(append([]string{"migrate"}, args...))
 	case "status":
-		cli.HandleProdCommand(append([]string{"status"}, args...))
+		handleStatus()
-	case "start":
+	case "query":
-		cli.HandleProdCommand(append([]string{"start"}, args...))
+		if len(args) == 0 {
-	case "stop":
+			fmt.Fprintf(os.Stderr, "Usage: network-cli query <sql>\n")
-		cli.HandleProdCommand(append([]string{"stop"}, args...))
+			os.Exit(1)
-	case "restart":
+		}
-		cli.HandleProdCommand(append([]string{"restart"}, args...))
+		handleQuery(args[0])
-	case "logs":
+	case "pubsub":
-		cli.HandleProdCommand(append([]string{"logs"}, args...))
+		handlePubSub(args)
-	case "uninstall":
+	case "connect":
-		cli.HandleProdCommand(append([]string{"uninstall"}, args...))
+		if len(args) == 0 {
-
+			fmt.Fprintf(os.Stderr, "Usage: network-cli connect <peer_address>\n")
-	// Authentication commands
+			os.Exit(1)
-	case "auth":
+		}
-		cli.HandleAuthCommand(args)
+		handleConnect(args[0])
-
+	case "peer-id":
-	// Help
+		handlePeerID()
 	case "help", "--help", "-h":
 		showHelp()
 
@@ -90,6 +89,10 @@ func main() {
 func parseGlobalFlags(args []string) {
 	for i, arg := range args {
 		switch arg {
+		case "-b", "--bootstrap":
+			if i+1 < len(args) {
+				bootstrapPeer = args[i+1]
+			}
 		case "-f", "--format":
 			if i+1 < len(args) {
 				format = args[i+1]
@@ -100,52 +103,530 @@ func parseGlobalFlags(args []string) {
 					timeout = d
 				}
 			}
+		case "--production":
+			useProduction = true
 		}
 	}
 }
 
-func showHelp() {
+func handleHealth() {
-	fmt.Printf("Orama CLI - Distributed P2P Network Management Tool\n\n")
+	client, err := createClient()
-	fmt.Printf("Usage: orama <command> [args...]\n\n")
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "Failed to create client: %v\n", err)
+		os.Exit(1)
+	}
+	defer client.Disconnect()
 
-	fmt.Printf("💻 Local Development:\n")
+	health, err := client.Health()
-	fmt.Printf("  dev up                        - Start full local dev environment\n")
+	if err != nil {
-	fmt.Printf("  dev down                      - Stop all dev services\n")
+		fmt.Fprintf(os.Stderr, "Failed to get health: %v\n", err)
-	fmt.Printf("  dev status                    - Show status of dev services\n")
+		os.Exit(1)
-	fmt.Printf("  dev logs <component>          - View dev component logs\n")
+	}
-	fmt.Printf("  dev help                      - Show dev command help\n\n")
 
-	fmt.Printf("🚀 Production Deployment:\n")
+	if format == "json" {
-	fmt.Printf("  install                       - Install production node (requires root/sudo)\n")
+		printJSON(health)
-	fmt.Printf("  upgrade                       - Upgrade existing installation\n")
+	} else {
-	fmt.Printf("  status                        - Show production service status\n")
+		printHealth(health)
-	fmt.Printf("  start                         - Start all production services (requires root/sudo)\n")
+	}
-	fmt.Printf("  stop                          - Stop all production services (requires root/sudo)\n")
+}
-	fmt.Printf("  restart                       - Restart all production services (requires root/sudo)\n")
+
-	fmt.Printf("  logs <service>                - View production service logs\n")
+func handlePeers() {
-	fmt.Printf("  uninstall                     - Remove production services (requires root/sudo)\n\n")
+	client, err := createClient()
-
+	if err != nil {
-	fmt.Printf("🔐 Authentication:\n")
+		fmt.Fprintf(os.Stderr, "Failed to create client: %v\n", err)
-	fmt.Printf("  auth login                    - Authenticate with wallet\n")
+		os.Exit(1)
-	fmt.Printf("  auth logout                   - Clear stored credentials\n")
+	}
-	fmt.Printf("  auth whoami                   - Show current authentication\n")
+	defer client.Disconnect()
-	fmt.Printf("  auth status                   - Show detailed auth info\n")
+
-	fmt.Printf("  auth help                     - Show auth command help\n\n")
+	ctx, cancel := context.WithTimeout(context.Background(), timeout)
-
+	defer cancel()
-	fmt.Printf("Global Flags:\n")
+
-	fmt.Printf("  -f, --format <format>         - Output format: table, json (default: table)\n")
+	peers, err := client.Network().GetPeers(ctx)
-	fmt.Printf("  -t, --timeout <duration>      - Operation timeout (default: 30s)\n")
+	if err != nil {
-	fmt.Printf("  --help, -h                    - Show this help message\n\n")
+		fmt.Fprintf(os.Stderr, "Failed to get peers: %v\n", err)
-
+		os.Exit(1)
-	fmt.Printf("Examples:\n")
+	}
-	fmt.Printf("  # First node (creates new cluster)\n")
+
-	fmt.Printf("  sudo orama install --vps-ip 203.0.113.1 --domain node-1.orama.network\n\n")
+	if format == "json" {
-
+		printJSON(peers)
-	fmt.Printf("  # Join existing cluster\n")
+	} else {
-	fmt.Printf("  sudo orama install --vps-ip 203.0.113.2 --domain node-2.orama.network \\\n")
+		printPeers(peers)
-	fmt.Printf("    --peers /ip4/203.0.113.1/tcp/4001/p2p/12D3KooW... --cluster-secret <hex>\n\n")
+	}
-
+}
-	fmt.Printf("  # Service management\n")
+
-	fmt.Printf("  orama status\n")
+func handleStatus() {
-	fmt.Printf("  orama logs node --follow\n")
+	client, err := createClient()
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "Failed to create client: %v\n", err)
+		os.Exit(1)
+	}
+	defer client.Disconnect()
+
+	ctx, cancel := context.WithTimeout(context.Background(), timeout)
+	defer cancel()
+
+	status, err := client.Network().GetStatus(ctx)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "Failed to get status: %v\n", err)
+		os.Exit(1)
+	}
+
+	if format == "json" {
+		printJSON(status)
+	} else {
+		printStatus(status)
+	}
+}
+
+func handleQuery(sql string) {
+	// Ensure user is authenticated
+	_ = ensureAuthenticated()
+
+	client, err := createClient()
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "Failed to create client: %v\n", err)
+		os.Exit(1)
+	}
+	defer client.Disconnect()
+
+	ctx, cancel := context.WithTimeout(context.Background(), timeout)
+	defer cancel()
+
+	result, err := client.Database().Query(ctx, sql)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "Failed to execute query: %v\n", err)
+		os.Exit(1)
+	}
+
+	if format == "json" {
+		printJSON(result)
+	} else {
+		printQueryResult(result)
+	}
+}
+
+func handlePubSub(args []string) {
+	if len(args) == 0 {
+		fmt.Fprintf(os.Stderr, "Usage: network-cli pubsub <publish|subscribe|topics> [args...]\n")
+		os.Exit(1)
+	}
+
+	// Ensure user is authenticated
+	_ = ensureAuthenticated()
+
+	client, err := createClient()
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "Failed to create client: %v\n", err)
+		os.Exit(1)
+	}
+	defer client.Disconnect()
+
+	ctx, cancel := context.WithTimeout(context.Background(), timeout)
+	defer cancel()
+
+	subcommand := args[0]
+	switch subcommand {
+	case "publish":
+		if len(args) < 3 {
+			fmt.Fprintf(os.Stderr, "Usage: network-cli pubsub publish <topic> <message>\n")
+			os.Exit(1)
+		}
+		err := client.PubSub().Publish(ctx, args[1], []byte(args[2]))
+		if err != nil {
+			fmt.Fprintf(os.Stderr, "Failed to publish message: %v\n", err)
+			os.Exit(1)
+		}
+		fmt.Printf("✅ Published message to topic: %s\n", args[1])
+
+	case "subscribe":
+		if len(args) < 2 {
+			fmt.Fprintf(os.Stderr, "Usage: network-cli pubsub subscribe <topic> [duration]\n")
+			os.Exit(1)
+		}
+		duration := 30 * time.Second
+		if len(args) > 2 {
+			if d, err := time.ParseDuration(args[2]); err == nil {
+				duration = d
+			}
+		}
+
+		ctx, cancel := context.WithTimeout(context.Background(), duration)
+		defer cancel()
+
+		fmt.Printf("🔔 Subscribing to topic '%s' for %v...\n", args[1], duration)
+
+		messageHandler := func(topic string, data []byte) error {
+			fmt.Printf("📨 [%s] %s: %s\n", time.Now().Format("15:04:05"), topic, string(data))
+			return nil
+		}
+
+		err := client.PubSub().Subscribe(ctx, args[1], messageHandler)
+		if err != nil {
+			fmt.Fprintf(os.Stderr, "Failed to subscribe: %v\n", err)
+			os.Exit(1)
+		}
+
+		<-ctx.Done()
+		fmt.Printf("✅ Subscription ended\n")
+
+	case "topics":
+		topics, err := client.PubSub().ListTopics(ctx)
+		if err != nil {
+			fmt.Fprintf(os.Stderr, "Failed to list topics: %v\n", err)
+			os.Exit(1)
+		}
+		if format == "json" {
+			printJSON(topics)
+		} else {
+			for _, topic := range topics {
+				fmt.Println(topic)
+			}
+		}
+
+	default:
+		fmt.Fprintf(os.Stderr, "Unknown pubsub command: %s\n", subcommand)
+		os.Exit(1)
+	}
+}
+
+func ensureAuthenticated() *auth.Credentials {
+	gatewayURL := auth.GetDefaultGatewayURL()
+
+	credentials, err := auth.GetOrPromptForCredentials(gatewayURL)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "Authentication failed: %v\n", err)
+		os.Exit(1)
+	}
+
+	return credentials
+}
+
+func openBrowser(target string) error {
+	cmds := [][]string{
+		{"xdg-open", target},
+		{"open", target},
+		{"cmd", "/c", "start", target},
+	}
+	for _, c := range cmds {
+		cmd := exec.Command(c[0], c[1:]...)
+		if err := cmd.Start(); err == nil {
+			return nil
+		}
+	}
+	log.Printf("Please open %s manually", target)
+	return nil
+}
+
+func getenvDefault(key, def string) string {
+	if v := strings.TrimSpace(os.Getenv(key)); v != "" {
+		return v
+	}
+	return def
+}
+
+func handleConnect(peerAddr string) {
+	client, err := createClient()
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "Failed to create client: %v\n", err)
+		os.Exit(1)
+	}
+	defer client.Disconnect()
+
+	ctx, cancel := context.WithTimeout(context.Background(), timeout)
+	defer cancel()
+
+	err = client.Network().ConnectToPeer(ctx, peerAddr)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "Failed to connect to peer: %v\n", err)
+		os.Exit(1)
+	}
+
+	fmt.Printf("✅ Connected to peer: %s\n", peerAddr)
+}
+
+func handlePeerID() {
+	// Try to get peer ID from running network first
+	client, err := createClient()
+	if err == nil {
+		defer client.Disconnect()
+		ctx, cancel := context.WithTimeout(context.Background(), timeout)
+		defer cancel()
+
+		if status, err := client.Network().GetStatus(ctx); err == nil {
+			if format == "json" {
+				printJSON(map[string]string{"peer_id": status.NodeID})
+			} else {
+				fmt.Printf("🆔 Peer ID: %s\n", status.NodeID)
+			}
+			return
+		}
+	}
+
+	fmt.Fprintf(os.Stderr, "❌ Could not find peer ID. Make sure the node is running or identity files exist.\n")
+	os.Exit(1)
+}
+
+func createClient() (client.NetworkClient, error) {
+	config := client.DefaultClientConfig("network-cli")
+
+	// Check for existing credentials using enhanced authentication
+	creds, err := auth.GetValidEnhancedCredentials()
+	if err != nil {
+		// No valid credentials found, use the enhanced authentication flow
+		gatewayURL := auth.GetDefaultGatewayURL()
+
+		newCreds, authErr := auth.GetOrPromptForCredentials(gatewayURL)
+		if authErr != nil {
+			return nil, fmt.Errorf("authentication failed: %w", authErr)
+		}
+
+		creds = newCreds
+	}
+
+	// Configure client with API key
+	config.APIKey = creds.APIKey
+
+	// Update last used time - the enhanced store handles saving automatically
+	creds.UpdateLastUsed()
+
+	networkClient, err := client.NewClient(config)
+	if err != nil {
+		return nil, err
+	}
+
+	if err := networkClient.Connect(); err != nil {
+		return nil, err
+	}
+
+	return networkClient, nil
+}
+
+func discoverBootstrapPeer() string {
+	// Look for peer info in common locations
+	peerInfoPaths := []string{
+		"./data/bootstrap/peer.info",
+		"./data/test-bootstrap/peer.info",
+		"/tmp/bootstrap-peer.info",
+	}
+
+	for _, path := range peerInfoPaths {
+		if data, err := os.ReadFile(path); err == nil {
+			peerAddr := strings.TrimSpace(string(data))
+			if peerAddr != "" {
+				// Only print discovery message in table format
+				if format != "json" {
+					fmt.Printf("🔍 Discovered bootstrap peer: %s\n", peerAddr)
+				}
+				return peerAddr
+			}
+		}
+	}
+
+	return "" // Return empty string if no peer info found
+}
+
+func isPrintableText(s string) bool {
+	printableCount := 0
+	for _, r := range s {
+		if r >= 32 && r <= 126 || r == '\n' || r == '\r' || r == '\t' {
+			printableCount++
+		}
+	}
+	return len(s) > 0 && float64(printableCount)/float64(len(s)) > 0.8
+}
+
+func showHelp() {
+	fmt.Printf("Network CLI - Distributed P2P Network Management Tool\n\n")
+	fmt.Printf("Usage: network-cli <command> [args...]\n\n")
+	fmt.Printf("🔐 Authentication: Commands requiring authentication will automatically prompt for wallet connection.\n\n")
+	fmt.Printf("Commands:\n")
+	fmt.Printf("  health                    - Check network health\n")
+	fmt.Printf("  peers                     - List connected peers\n")
+	fmt.Printf("  status                    - Show network status\n")
+	fmt.Printf("  peer-id                   - Show this node's peer ID\n")
+	fmt.Printf("  query <sql>               🔐 Execute database query\n")
+	fmt.Printf("  pubsub publish <topic> <msg> 🔐 Publish message\n")
+	fmt.Printf("  pubsub subscribe <topic> [duration] 🔐 Subscribe to topic\n")
+	fmt.Printf("  pubsub topics             🔐 List topics\n")
+	fmt.Printf("  connect <peer_address>    - Connect to peer\n")
+
+	fmt.Printf("  help                      - Show this help\n\n")
+	fmt.Printf("Global Flags:\n")
+	fmt.Printf("  -b, --bootstrap <addr>    - Bootstrap peer address (default: /ip4/127.0.0.1/tcp/4001)\n")
+	fmt.Printf("  -f, --format <format>     - Output format: table, json (default: table)\n")
+	fmt.Printf("  -t, --timeout <duration>  - Operation timeout (default: 30s)\n")
+	fmt.Printf("  --production              - Connect to production bootstrap peers\n\n")
+	fmt.Printf("Authentication:\n")
+	fmt.Printf("  Commands marked with 🔐 will automatically prompt for wallet authentication\n")
+	fmt.Printf("  if no valid credentials are found. You can manage multiple wallets and\n")
+	fmt.Printf("  choose between them during the authentication flow.\n\n")
+	fmt.Printf("Examples:\n")
+	fmt.Printf("  network-cli health\n")
+	fmt.Printf("  network-cli peer-id\n")
+	fmt.Printf("  network-cli peer-id --format json\n")
+	fmt.Printf("  network-cli peers --format json\n")
+	fmt.Printf("  network-cli peers --production\n")
+	fmt.Printf("  ./bin/network-cli pubsub publish notifications \"Hello World\"\n")
+}
+
+func printHealth(health *client.HealthStatus) {
+	fmt.Printf("🏥 Network Health\n")
+	fmt.Printf("Status: %s\n", getStatusEmoji(health.Status)+health.Status)
+	fmt.Printf("Last Updated: %s\n", health.LastUpdated.Format("2006-01-02 15:04:05"))
+	fmt.Printf("Response Time: %v\n", health.ResponseTime)
+	fmt.Printf("\nChecks:\n")
+	for check, status := range health.Checks {
+		emoji := "✅"
+		if status != "ok" {
+			emoji = "❌"
+		}
+		fmt.Printf("  %s %s: %s\n", emoji, check, status)
+	}
+}
+
+func printPeers(peers []client.PeerInfo) {
+	fmt.Printf("👥 Connected Peers (%d)\n\n", len(peers))
+	if len(peers) == 0 {
+		fmt.Printf("No peers connected\n")
+		return
+	}
+
+	for i, peer := range peers {
+		connEmoji := "🔴"
+		if peer.Connected {
+			connEmoji = "🟢"
+		}
+		fmt.Printf("%d. %s %s\n", i+1, connEmoji, peer.ID)
+		fmt.Printf("   Addresses: %v\n", peer.Addresses)
+		fmt.Printf("   Last Seen: %s\n", peer.LastSeen.Format("2006-01-02 15:04:05"))
+		fmt.Println()
+	}
+}
+
+func printStatus(status *client.NetworkStatus) {
+	fmt.Printf("🌐 Network Status\n")
+	fmt.Printf("Node ID: %s\n", status.NodeID)
+	fmt.Printf("Connected: %s\n", getBoolEmoji(status.Connected)+strconv.FormatBool(status.Connected))
+	fmt.Printf("Peer Count: %d\n", status.PeerCount)
+	fmt.Printf("Database Size: %s\n", formatBytes(status.DatabaseSize))
+	fmt.Printf("Uptime: %v\n", status.Uptime.Round(time.Second))
+}
+
+func printQueryResult(result *client.QueryResult) {
+	fmt.Printf("📊 Query Result\n")
+	fmt.Printf("Rows: %d\n\n", result.Count)
+
+	if len(result.Rows) == 0 {
+		fmt.Printf("No data returned\n")
+		return
+	}
+
+	// Print header
+	for i, col := range result.Columns {
+		if i > 0 {
+			fmt.Printf(" | ")
+		}
+		fmt.Printf("%-15s", col)
+	}
+	fmt.Println()
+
+	// Print separator
+	for i := range result.Columns {
+		if i > 0 {
+			fmt.Printf("-+-")
+		}
+		fmt.Printf("%-15s", "---------------")
+	}
+	fmt.Println()
+
+	// Print rows
+	for _, row := range result.Rows {
+		for i, cell := range row {
+			if i > 0 {
+				fmt.Printf(" | ")
+			}
+			fmt.Printf("%-15v", cell)
+		}
+		fmt.Println()
+	}
+}
+
+func printJSON(data interface{}) {
+	jsonData, err := json.MarshalIndent(data, "", "  ")
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "Failed to marshal JSON: %v\n", err)
+		return
+	}
+	fmt.Println(string(jsonData))
+}
+
+// Helper functions
+
+func getStatusEmoji(status string) string {
+	switch status {
+	case "healthy":
+		return "🟢 "
+	case "degraded":
+		return "🟡 "
+	case "unhealthy":
+		return "🔴 "
+	default:
+		return "⚪ "
+	}
+}
+
+func getBoolEmoji(b bool) string {
+	if b {
+		return "✅ "
+	}
+	return "❌ "
+}
+
+func formatBytes(bytes int64) string {
+	const unit = 1024
+	if bytes < unit {
+		return fmt.Sprintf("%d B", bytes)
+	}
+	div, exp := int64(unit), 0
+	for n := bytes / unit; n >= unit; n /= unit {
+		div *= unit
+		exp++
+	}
+	return fmt.Sprintf("%.1f %cB", float64(bytes)/float64(div), "KMGTPE"[exp])
+}
+
+// extractPeerIDFromFile extracts peer ID from an identity key file
+func extractPeerIDFromFile(keyFile string) string {
+	// Read the identity key file
+	data, err := os.ReadFile(keyFile)
+	if err != nil {
+		return ""
+	}
+
+	// Unmarshal the private key
+	priv, err := crypto.UnmarshalPrivateKey(data)
+	if err != nil {
+		return ""
+	}
+
+	// Get the public key
+	pub := priv.GetPublic()
+
+	// Get the peer ID
+	peerID, err := peer.IDFromPublicKey(pub)
+	if err != nil {
+		return ""
+	}
+
+	return peerID.String()
+}
+
+// extractPeerIDFromMultiaddr extracts the peer ID from a multiaddr string
+func extractPeerIDFromMultiaddr(multiaddr string) string {
+	// Look for /p2p/ followed by the peer ID
+	parts := strings.Split(multiaddr, "/p2p/")
+	if len(parts) >= 2 {
+		return parts[1]
+	}
+	return ""
 }

cmd/gateway/config.go

@@ -2,16 +2,13 @@ package main
 
 import (
 	"flag"
-	"fmt"
 	"os"
-	"path/filepath"
 	"strings"
-	"time"
 
-	"github.com/DeBrosOfficial/network/pkg/config"
 	"github.com/DeBrosOfficial/network/pkg/gateway"
 	"github.com/DeBrosOfficial/network/pkg/logging"
 	"go.uber.org/zap"
+	"gopkg.in/yaml.v3"
 )
 
 // For transition, alias main.GatewayConfig to pkg/gateway.Config
@@ -40,172 +37,108 @@ func getEnvBoolDefault(key string, def bool) bool {
 	}
 }
 
-// parseGatewayConfig loads gateway.yaml from ~/.orama exclusively.
+// parseGatewayConfig loads optional configs/gateway.yaml then applies env and flags.
-// It accepts an optional --config flag for absolute paths (used by systemd services).
+// Priority: flags > env > yaml > defaults.
 func parseGatewayConfig(logger *logging.ColoredLogger) *gateway.Config {
-	// Parse --config flag (optional, for systemd services that pass absolute paths)
+	// Base defaults
-	configFlag := flag.String("config", "", "Config file path (absolute path or filename in ~/.orama)")
+	cfg := &gateway.Config{
-	flag.Parse()
+		ListenAddr:      ":6001",
+		ClientNamespace: "default",
+		BootstrapPeers:  nil,
+		RQLiteDSN:       "",
+	}
 
-	// Determine config path
+	// 1) YAML (optional)
-	var configPath string
+	{
-	var err error
+		type yamlCfg struct {
-	if *configFlag != "" {
+			ListenAddr      string   `yaml:"listen_addr"`
-		// If --config flag is provided, use it (handles both absolute and relative paths)
+			ClientNamespace string   `yaml:"client_namespace"`
-		if filepath.IsAbs(*configFlag) {
+			RQLiteDSN       string   `yaml:"rqlite_dsn"`
-			configPath = *configFlag
+			BootstrapPeers  []string `yaml:"bootstrap_peers"`
-		} else {
+		}
-			configPath, err = config.DefaultPath(*configFlag)
+		const path = "configs/gateway.yaml"
-			if err != nil {
+		if data, err := os.ReadFile(path); err == nil {
-				logger.ComponentError(logging.ComponentGeneral, "Failed to determine config path", zap.Error(err))
+			var y yamlCfg
-				fmt.Fprintf(os.Stderr, "Configuration error: %v\n", err)
+			if err := yaml.Unmarshal(data, &y); err != nil {
-				os.Exit(1)
+				logger.ComponentWarn(logging.ComponentGeneral, "failed to parse configs/gateway.yaml; ignoring", zap.Error(err))
+			} else {
+				if v := strings.TrimSpace(y.ListenAddr); v != "" {
+					cfg.ListenAddr = v
+				}
+				if v := strings.TrimSpace(y.ClientNamespace); v != "" {
+					cfg.ClientNamespace = v
+				}
+				if v := strings.TrimSpace(y.RQLiteDSN); v != "" {
+					cfg.RQLiteDSN = v
+				}
+				if len(y.BootstrapPeers) > 0 {
+					var bp []string
+					for _, p := range y.BootstrapPeers {
+						p = strings.TrimSpace(p)
+						if p != "" {
+							bp = append(bp, p)
+						}
+					}
+					if len(bp) > 0 {
+						cfg.BootstrapPeers = bp
+					}
+				}
 			}
 		}
-	} else {
-		// Default behavior: look for gateway.yaml in ~/.orama/data/, ~/.orama/configs/, or ~/.orama/
-		configPath, err = config.DefaultPath("gateway.yaml")
-		if err != nil {
-			logger.ComponentError(logging.ComponentGeneral, "Failed to determine config path", zap.Error(err))
-			fmt.Fprintf(os.Stderr, "Configuration error: %v\n", err)
-			os.Exit(1)
-		}
 	}
 
-	// Load YAML
+	// 2) Env overrides
-	type yamlCfg struct {
+	if v := strings.TrimSpace(os.Getenv("GATEWAY_ADDR")); v != "" {
-		ListenAddr            string   `yaml:"listen_addr"`
-		ClientNamespace       string   `yaml:"client_namespace"`
-		RQLiteDSN             string   `yaml:"rqlite_dsn"`
-		Peers                 []string `yaml:"bootstrap_peers"`
-		EnableHTTPS           bool     `yaml:"enable_https"`
-		DomainName            string   `yaml:"domain_name"`
-		TLSCacheDir           string   `yaml:"tls_cache_dir"`
-		OlricServers          []string `yaml:"olric_servers"`
-		OlricTimeout          string   `yaml:"olric_timeout"`
-		IPFSClusterAPIURL     string   `yaml:"ipfs_cluster_api_url"`
-		IPFSAPIURL            string   `yaml:"ipfs_api_url"`
-		IPFSTimeout           string   `yaml:"ipfs_timeout"`
-		IPFSReplicationFactor int      `yaml:"ipfs_replication_factor"`
-	}
-
-	data, err := os.ReadFile(configPath)
-	if err != nil {
-		logger.ComponentError(logging.ComponentGeneral, "Config file not found",
-			zap.String("path", configPath),
-			zap.Error(err))
-		fmt.Fprintf(os.Stderr, "\nConfig file not found at %s\n", configPath)
-		fmt.Fprintf(os.Stderr, "Generate it using: dbn config init --type gateway\n")
-		os.Exit(1)
-	}
-
-	var y yamlCfg
-	// Use strict YAML decoding to reject unknown fields
-	if err := config.DecodeStrict(strings.NewReader(string(data)), &y); err != nil {
-		logger.ComponentError(logging.ComponentGeneral, "Failed to parse gateway config", zap.Error(err))
-		fmt.Fprintf(os.Stderr, "Configuration parse error: %v\n", err)
-		os.Exit(1)
-	}
-
-	// Build config from YAML
-	cfg := &gateway.Config{
-		ListenAddr:            ":6001",
-		ClientNamespace:       "default",
-		BootstrapPeers:        nil,
-		RQLiteDSN:             "",
-		EnableHTTPS:           false,
-		DomainName:            "",
-		TLSCacheDir:           "",
-		OlricServers:          nil,
-		OlricTimeout:          0,
-		IPFSClusterAPIURL:     "",
-		IPFSAPIURL:            "",
-		IPFSTimeout:           0,
-		IPFSReplicationFactor: 0,
-	}
-
-	if v := strings.TrimSpace(y.ListenAddr); v != "" {
 		cfg.ListenAddr = v
 	}
-	if v := strings.TrimSpace(y.ClientNamespace); v != "" {
+	if v := strings.TrimSpace(os.Getenv("GATEWAY_NAMESPACE")); v != "" {
 		cfg.ClientNamespace = v
 	}
-	if v := strings.TrimSpace(y.RQLiteDSN); v != "" {
+	if v := strings.TrimSpace(os.Getenv("GATEWAY_RQLITE_DSN")); v != "" {
 		cfg.RQLiteDSN = v
 	}
-	if len(y.Peers) > 0 {
+	if v := strings.TrimSpace(os.Getenv("GATEWAY_BOOTSTRAP_PEERS")); v != "" {
-		var peers []string
+		parts := strings.Split(v, ",")
-		for _, p := range y.Peers {
+		var bp []string
-			p = strings.TrimSpace(p)
+		for _, part := range parts {
-			if p != "" {
+			s := strings.TrimSpace(part)
-				peers = append(peers, p)
+			if s != "" {
+				bp = append(bp, s)
 			}
 		}
-		if len(peers) > 0 {
+		cfg.BootstrapPeers = bp
-			cfg.BootstrapPeers = peers
-		}
 	}
 
-	// HTTPS configuration
+	// 3) Flags (override env)
-	cfg.EnableHTTPS = y.EnableHTTPS
+	addr := flag.String("addr", "", "HTTP listen address (e.g., :6001)")
-	if v := strings.TrimSpace(y.DomainName); v != "" {
+	ns := flag.String("namespace", "", "Client namespace for scoping resources")
-		cfg.DomainName = v
+	peers := flag.String("bootstrap-peers", "", "Comma-separated bootstrap peers for network client")
+
+	// Do not call flag.Parse() elsewhere to avoid double-parsing
+	flag.Parse()
+
+	if a := strings.TrimSpace(*addr); a != "" {
+		cfg.ListenAddr = a
 	}
-	if v := strings.TrimSpace(y.TLSCacheDir); v != "" {
+	if n := strings.TrimSpace(*ns); n != "" {
-		cfg.TLSCacheDir = v
+		cfg.ClientNamespace = n
-	} else if cfg.EnableHTTPS {
+	}
-		// Default TLS cache directory if HTTPS is enabled but not specified
+	if p := strings.TrimSpace(*peers); p != "" {
-		homeDir, err := os.UserHomeDir()
+		parts := strings.Split(p, ",")
-		if err == nil {
+		var bp []string
-			cfg.TLSCacheDir = filepath.Join(homeDir, ".orama", "tls-cache")
+		for _, part := range parts {
+			s := strings.TrimSpace(part)
+			if s != "" {
+				bp = append(bp, s)
+			}
 		}
+		cfg.BootstrapPeers = bp
 	}
 
-	// Olric configuration
+	logger.ComponentInfo(logging.ComponentGeneral, "Loaded gateway configuration",
-	if len(y.OlricServers) > 0 {
-		cfg.OlricServers = y.OlricServers
-	}
-	if v := strings.TrimSpace(y.OlricTimeout); v != "" {
-		if parsed, err := time.ParseDuration(v); err == nil {
-			cfg.OlricTimeout = parsed
-		} else {
-			logger.ComponentWarn(logging.ComponentGeneral, "invalid olric_timeout, using default", zap.String("value", v), zap.Error(err))
-		}
-	}
-
-	// IPFS configuration
-	if v := strings.TrimSpace(y.IPFSClusterAPIURL); v != "" {
-		cfg.IPFSClusterAPIURL = v
-	}
-	if v := strings.TrimSpace(y.IPFSAPIURL); v != "" {
-		cfg.IPFSAPIURL = v
-	}
-	if v := strings.TrimSpace(y.IPFSTimeout); v != "" {
-		if parsed, err := time.ParseDuration(v); err == nil {
-			cfg.IPFSTimeout = parsed
-		} else {
-			logger.ComponentWarn(logging.ComponentGeneral, "invalid ipfs_timeout, using default", zap.String("value", v), zap.Error(err))
-		}
-	}
-	if y.IPFSReplicationFactor > 0 {
-		cfg.IPFSReplicationFactor = y.IPFSReplicationFactor
-	}
-
-	// Validate configuration
-	if errs := cfg.ValidateConfig(); len(errs) > 0 {
-		fmt.Fprintf(os.Stderr, "\nGateway configuration errors (%d):\n", len(errs))
-		for _, err := range errs {
-			fmt.Fprintf(os.Stderr, "  - %s\n", err)
-		}
-		fmt.Fprintf(os.Stderr, "\nPlease fix the configuration and try again.\n")
-		os.Exit(1)
-	}
-
-	logger.ComponentInfo(logging.ComponentGeneral, "Loaded gateway configuration from YAML",
-		zap.String("path", configPath),
 		zap.String("addr", cfg.ListenAddr),
 		zap.String("namespace", cfg.ClientNamespace),
-		zap.Int("peer_count", len(cfg.BootstrapPeers)),
+		zap.Int("bootstrap_peer_count", len(cfg.BootstrapPeers)),
 	)
 
 	return cfg

cmd/gateway/main.go

@@ -12,7 +12,6 @@ import (
 	"github.com/DeBrosOfficial/network/pkg/gateway"
 	"github.com/DeBrosOfficial/network/pkg/logging"
 	"go.uber.org/zap"
-	"golang.org/x/crypto/acme/autocert"
 )
 
 func setupLogger() *logging.ColoredLogger {
@@ -43,123 +42,6 @@ func main() {
 
 	logger.ComponentInfo(logging.ComponentGeneral, "Creating HTTP server and routes...")
 
-	// Check if HTTPS is enabled
-	if cfg.EnableHTTPS && cfg.DomainName != "" {
-		logger.ComponentInfo(logging.ComponentGeneral, "HTTPS enabled with ACME",
-			zap.String("domain", cfg.DomainName),
-			zap.String("tls_cache_dir", cfg.TLSCacheDir),
-		)
-
-		// Set up ACME manager
-		manager := &autocert.Manager{
-			Prompt:     autocert.AcceptTOS,
-			HostPolicy: autocert.HostWhitelist(cfg.DomainName),
-		}
-
-		// Set cache directory if specified
-		if cfg.TLSCacheDir != "" {
-			manager.Cache = autocert.DirCache(cfg.TLSCacheDir)
-			logger.ComponentInfo(logging.ComponentGeneral, "Using TLS certificate cache",
-				zap.String("cache_dir", cfg.TLSCacheDir),
-			)
-		}
-
-		// Create HTTP server for ACME challenge (port 80)
-		httpServer := &http.Server{
-			Addr:    ":80",
-			Handler: manager.HTTPHandler(nil), // Redirects all HTTP traffic to HTTPS except ACME challenge
-		}
-
-		// Create HTTPS server (port 443)
-		httpsServer := &http.Server{
-			Addr:      ":443",
-			Handler:   gw.Routes(),
-			TLSConfig: manager.TLSConfig(),
-		}
-
-		// Start HTTP server for ACME challenge
-		logger.ComponentInfo(logging.ComponentGeneral, "Starting HTTP server for ACME challenge on port 80...")
-		httpLn, err := net.Listen("tcp", ":80")
-		if err != nil {
-			logger.ComponentError(logging.ComponentGeneral, "failed to bind HTTP listen address (port 80)", zap.Error(err))
-			os.Exit(1)
-		}
-		logger.ComponentInfo(logging.ComponentGeneral, "HTTP listener bound", zap.String("listen_addr", httpLn.Addr().String()))
-
-		// Start HTTPS server
-		logger.ComponentInfo(logging.ComponentGeneral, "Starting HTTPS server on port 443...")
-		httpsLn, err := net.Listen("tcp", ":443")
-		if err != nil {
-			logger.ComponentError(logging.ComponentGeneral, "failed to bind HTTPS listen address (port 443)", zap.Error(err))
-			os.Exit(1)
-		}
-		logger.ComponentInfo(logging.ComponentGeneral, "HTTPS listener bound", zap.String("listen_addr", httpsLn.Addr().String()))
-
-		// Serve HTTP in a goroutine
-		httpServeErrCh := make(chan error, 1)
-		go func() {
-			if err := httpServer.Serve(httpLn); err != nil && err != http.ErrServerClosed {
-				httpServeErrCh <- err
-				return
-			}
-			httpServeErrCh <- nil
-		}()
-
-		// Serve HTTPS in a goroutine
-		httpsServeErrCh := make(chan error, 1)
-		go func() {
-			if err := httpsServer.ServeTLS(httpsLn, "", ""); err != nil && err != http.ErrServerClosed {
-				httpsServeErrCh <- err
-				return
-			}
-			httpsServeErrCh <- nil
-		}()
-
-		// Wait for termination signal or server error
-		quit := make(chan os.Signal, 1)
-		signal.Notify(quit, os.Interrupt, syscall.SIGTERM)
-
-		select {
-		case sig := <-quit:
-			logger.ComponentInfo(logging.ComponentGeneral, "shutdown signal received", zap.String("signal", sig.String()))
-		case err := <-httpServeErrCh:
-			if err != nil {
-				logger.ComponentError(logging.ComponentGeneral, "HTTP server error", zap.Error(err))
-			} else {
-				logger.ComponentInfo(logging.ComponentGeneral, "HTTP server exited normally")
-			}
-		case err := <-httpsServeErrCh:
-			if err != nil {
-				logger.ComponentError(logging.ComponentGeneral, "HTTPS server error", zap.Error(err))
-			} else {
-				logger.ComponentInfo(logging.ComponentGeneral, "HTTPS server exited normally")
-			}
-		}
-
-		logger.ComponentInfo(logging.ComponentGeneral, "Shutting down gateway servers...")
-
-		ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-		defer cancel()
-
-		// Shutdown HTTPS server
-		if err := httpsServer.Shutdown(ctx); err != nil {
-			logger.ComponentError(logging.ComponentGeneral, "HTTPS server shutdown error", zap.Error(err))
-		} else {
-			logger.ComponentInfo(logging.ComponentGeneral, "HTTPS server shutdown complete")
-		}
-
-		// Shutdown HTTP server
-		if err := httpServer.Shutdown(ctx); err != nil {
-			logger.ComponentError(logging.ComponentGeneral, "HTTP server shutdown error", zap.Error(err))
-		} else {
-			logger.ComponentInfo(logging.ComponentGeneral, "HTTP server shutdown complete")
-		}
-
-		logger.ComponentInfo(logging.ComponentGeneral, "Gateway shutdown complete")
-		return
-	}
-
-	// Standard HTTP server (no HTTPS)
 	server := &http.Server{
 		Addr:    cfg.ListenAddr,
 		Handler: gw.Routes(),

cmd/node/main.go

@@ -4,18 +4,18 @@ import (
 	"context"
 	"flag"
 	"fmt"
-	"net"
+	"io/ioutil"
+	"log"
 	"os"
 	"os/signal"
 	"path/filepath"
-	"strconv"
-	"strings"
 	"syscall"
 
 	"github.com/DeBrosOfficial/network/pkg/config"
 	"github.com/DeBrosOfficial/network/pkg/logging"
 	"github.com/DeBrosOfficial/network/pkg/node"
 	"go.uber.org/zap"
+	"gopkg.in/yaml.v3"
 )
 
 // setup_logger initializes a logger for the given component.
@@ -24,33 +24,75 @@ func setup_logger(component logging.Component) (logger *logging.ColoredLogger) {
 
 	logger, err = logging.NewColoredLogger(component, true)
 	if err != nil {
-		fmt.Fprintf(os.Stderr, "Failed to create logger: %v\n", err)
+		log.Fatalf("Failed to create logger: %v", err)
-		os.Exit(1)
 	}
 
 	return logger
 }
 
-// parse_flags parses command-line flags and returns them.
+// parse_and_return_network_flags it initializes all the network flags coming from the .yaml files
-func parse_flags() (configName *string, help *bool) {
+func parse_and_return_network_flags() (configPath *string, dataDir, nodeID *string, p2pPort, rqlHTTP, rqlRaft *int, rqlJoinAddr *string, advAddr *string, help *bool) {
-	configName = flag.String("config", "node.yaml", "Config filename in ~/.orama (default: node.yaml)")
+	logger := setup_logger(logging.ComponentNode)
+
+	configPath = flag.String("config", "", "Path to config YAML file (overrides defaults)")
+	dataDir = flag.String("data", "", "Data directory (auto-detected if not provided)")
+	nodeID = flag.String("id", "", "Node identifier (for running multiple local nodes)")
+	p2pPort = flag.Int("p2p-port", 4001, "LibP2P listen port")
+	rqlHTTP = flag.Int("rqlite-http-port", 5001, "RQLite HTTP API port")
+	rqlRaft = flag.Int("rqlite-raft-port", 7001, "RQLite Raft port")
+	rqlJoinAddr = flag.String("rqlite-join-address", "", "RQLite address to join (e.g., /ip4/)")
+	advAddr = flag.String("adv-addr", "127.0.0.1", "Default Advertise address for rqlite and rafts")
 	help = flag.Bool("help", false, "Show help")
 	flag.Parse()
 
+	logger.Info("Successfully parsed all flags and arguments.")
+
+	if *configPath != "" {
+		cfg, err := LoadConfigFromYAML(*configPath)
+		if err != nil {
+			logger.Error("Failed to load config from YAML", zap.Error(err))
+			os.Exit(1)
+		}
+		logger.ComponentInfo(logging.ComponentNode, "Configuration loaded from YAML file", zap.String("path", *configPath))
+
+		// Instead of returning flag values, return config values
+		// For ListenAddresses, extract port from multiaddr string if possible, else use default
+		var p2pPortVal int
+		if len(cfg.Node.ListenAddresses) > 0 {
+			// Try to parse port from multiaddr string
+			var port int
+			_, err := fmt.Sscanf(cfg.Node.ListenAddresses[0], "/ip4/0.0.0.0/tcp/%d", &port)
+			if err == nil {
+				p2pPortVal = port
+			} else {
+				p2pPortVal = 4001
+			}
+		} else {
+			p2pPortVal = 4001
+		}
+		return configPath,
+			&cfg.Node.DataDir,
+			&cfg.Node.ID,
+			&p2pPortVal,
+			&cfg.Database.RQLitePort,
+			&cfg.Database.RQLiteRaftPort,
+			&cfg.Database.RQLiteJoinAddress,
+			&cfg.Discovery.HttpAdvAddress,
+			help
+	}
+
 	return
 }
 
-// LoadConfigFromYAML loads a config from a YAML file using strict decoding.
+// LoadConfigFromYAML loads a config from a YAML file
 func LoadConfigFromYAML(path string) (*config.Config, error) {
-	file, err := os.Open(path)
+	data, err := ioutil.ReadFile(path)
 	if err != nil {
-		return nil, fmt.Errorf("failed to open config file: %w", err)
+		return nil, fmt.Errorf("failed to read config file: %w", err)
 	}
-	defer file.Close()
-
 	var cfg config.Config
-	if err := config.DecodeStrict(file, &cfg); err != nil {
+	if err := yaml.Unmarshal(data, &cfg); err != nil {
-		return nil, err
+		return nil, fmt.Errorf("failed to unmarshal YAML: %w", err)
 	}
 	return &cfg, nil
 }
@@ -59,53 +101,21 @@ func LoadConfigFromYAML(path string) (*config.Config, error) {
 func check_if_should_open_help(help *bool) {
 	if *help {
 		flag.Usage()
-		os.Exit(0)
+		return
 	}
 }
 
-// select_data_dir validates that we can load the config from ~/.orama
+// select_data_dir selects the data directory for the node
-func select_data_dir_check(configName *string) {
+// If none of (hasConfigFile, nodeID, dataDir) are present, throw an error and do not start
+func select_data_dir(dataDir *string, nodeID *string, hasConfigFile bool) {
 	logger := setup_logger(logging.ComponentNode)
 
-	var configPath string
+	if !hasConfigFile && (*nodeID == "" || nodeID == nil) && (*dataDir == "" || dataDir == nil) {
-	var err error
+		logger.Error("No config file, node ID, or data directory specified. Please provide at least one. Refusing to start.")
-
-	// Check if configName is an absolute path
-	if filepath.IsAbs(*configName) {
-		// Use absolute path directly
-		configPath = *configName
-	} else {
-		// Ensure config directory exists and is writable
-		_, err = config.EnsureConfigDir()
-		if err != nil {
-			logger.Error("Failed to ensure config directory", zap.Error(err))
-			fmt.Fprintf(os.Stderr, "\n❌ Configuration Error:\n")
-			fmt.Fprintf(os.Stderr, "Failed to create/access config directory: %v\n", err)
-			fmt.Fprintf(os.Stderr, "\nPlease ensure:\n")
-			fmt.Fprintf(os.Stderr, "  1. Home directory is accessible: %s\n", os.ExpandEnv("~"))
-			fmt.Fprintf(os.Stderr, "  2. You have write permissions to home directory\n")
-			fmt.Fprintf(os.Stderr, "  3. Disk space is available\n")
-			os.Exit(1)
-		}
-
-		configPath, err = config.DefaultPath(*configName)
-		if err != nil {
-			logger.Error("Failed to determine config path", zap.Error(err))
-			os.Exit(1)
-		}
-	}
-
-	if _, err := os.Stat(configPath); err != nil {
-		logger.Error("Config file not found",
-			zap.String("path", configPath),
-			zap.Error(err))
-		fmt.Fprintf(os.Stderr, "\n❌ Configuration Error:\n")
-		fmt.Fprintf(os.Stderr, "Config file not found at %s\n", configPath)
-		fmt.Fprintf(os.Stderr, "\nGenerate it with one of:\n")
-		fmt.Fprintf(os.Stderr, "  orama config init --type node\n")
-		fmt.Fprintf(os.Stderr, "  orama config init --type node --peers '<peer_multiaddr>'\n")
 		os.Exit(1)
 	}
+
+	logger.Info("Successfully selected Data Directory of: %s", zap.String("dataDir", *dataDir))
 }
 
 // startNode starts the node with the given configuration and port
@@ -115,55 +125,22 @@ func startNode(ctx context.Context, cfg *config.Config, port int) error {
 	n, err := node.NewNode(cfg)
 	if err != nil {
 		logger.Error("failed to create node: %v", zap.Error(err))
-		return err
 	}
 
 	if err := n.Start(ctx); err != nil {
 		logger.Error("failed to start node: %v", zap.Error(err))
-		return err
 	}
 
-	// Expand data directory path for peer.info file
+	// Save the peer ID to a file for CLI access (especially useful for bootstrap)
-	dataDir := os.ExpandEnv(cfg.Node.DataDir)
-	if strings.HasPrefix(dataDir, "~") {
-		home, err := os.UserHomeDir()
-		if err != nil {
-			logger.Error("failed to determine home directory: %v", zap.Error(err))
-			dataDir = cfg.Node.DataDir
-		} else {
-			dataDir = filepath.Join(home, dataDir[1:])
-		}
-	}
-
-	// Save the peer ID to a file for CLI access
 	peerID := n.GetPeerID()
-	peerInfoFile := filepath.Join(dataDir, "peer.info")
+	peerInfoFile := filepath.Join(cfg.Node.DataDir, "peer.info")
-
+	peerMultiaddr := fmt.Sprintf("/ip4/0.0.0.0/tcp/%d/p2p/%s", port, peerID)
-	// Extract advertise IP from config (prefer http_adv_address, fallback to raft_adv_address)
-	advertiseIP := "0.0.0.0" // Default fallback
-	if cfg.Discovery.HttpAdvAddress != "" {
-		if host, _, err := net.SplitHostPort(cfg.Discovery.HttpAdvAddress); err == nil && host != "" && host != "localhost" {
-			advertiseIP = host
-		}
-	} else if cfg.Discovery.RaftAdvAddress != "" {
-		if host, _, err := net.SplitHostPort(cfg.Discovery.RaftAdvAddress); err == nil && host != "" && host != "localhost" {
-			advertiseIP = host
-		}
-	}
-
-	// Determine IP protocol (IPv4 or IPv6) for multiaddr
-	ipProtocol := "ip4"
-	if ip := net.ParseIP(advertiseIP); ip != nil && ip.To4() == nil {
-		ipProtocol = "ip6"
-	}
-
-	peerMultiaddr := fmt.Sprintf("/%s/%s/tcp/%d/p2p/%s", ipProtocol, advertiseIP, port, peerID)
 
 	if err := os.WriteFile(peerInfoFile, []byte(peerMultiaddr), 0644); err != nil {
 		logger.Error("Failed to save peer info: %v", zap.Error(err))
 	} else {
 		logger.Info("Peer info saved to: %s", zap.String("path", peerInfoFile))
-		logger.Info("Peer multiaddr: %s", zap.String("path", peerMultiaddr))
+		logger.Info("Bootstrap multiaddr: %s", zap.String("path", peerMultiaddr))
 	}
 
 	logger.Info("Node started successfully")
@@ -175,8 +152,8 @@ func startNode(ctx context.Context, cfg *config.Config, port int) error {
 	return n.Stop()
 }
 
-// apply_flag_overrides applies command line argument overrides to the config
+// load_args_into_config applies command line argument overrides to the config
-func apply_flag_overrides(cfg *config.Config, p2pPort, rqlHTTP, rqlRaft *int, rqlJoinAddr *string, advAddr *string, dataDir *string) {
+func load_args_into_config(cfg *config.Config, p2pPort, rqlHTTP, rqlRaft *int, rqlJoinAddr *string, advAddr *string, dataDir *string) {
 	logger := setup_logger(logging.ComponentNode)
 
 	// Apply RQLite HTTP port override
@@ -206,8 +183,8 @@ func apply_flag_overrides(cfg *config.Config, p2pPort, rqlHTTP, rqlRaft *int, rq
 	}
 
 	if *advAddr != "" {
-		cfg.Discovery.HttpAdvAddress = fmt.Sprintf("%s:%d", *advAddr, cfg.Database.RQLitePort)
+		cfg.Discovery.HttpAdvAddress = fmt.Sprintf("%s:%d", *advAddr, *rqlHTTP)
-		cfg.Discovery.RaftAdvAddress = fmt.Sprintf("%s:%d", *advAddr, cfg.Database.RQLiteRaftPort)
+		cfg.Discovery.RaftAdvAddress = fmt.Sprintf("%s:%d", *advAddr, *rqlRaft)
 	}
 
 	if *dataDir != "" {
@@ -215,125 +192,34 @@ func apply_flag_overrides(cfg *config.Config, p2pPort, rqlHTTP, rqlRaft *int, rq
 	}
 }
 
-// printValidationErrors prints aggregated validation errors and exits.
-func printValidationErrors(errs []error) {
-	fmt.Fprintf(os.Stderr, "\nConfiguration errors (%d):\n", len(errs))
-	for _, err := range errs {
-		fmt.Fprintf(os.Stderr, "  - %s\n", err)
-	}
-	fmt.Fprintf(os.Stderr, "\nPlease fix the configuration and try again.\n")
-	os.Exit(1)
-}
-
-// ensureDataDirectories ensures that all necessary data directories exist and have correct permissions.
-func ensureDataDirectories(cfg *config.Config, logger *logging.ColoredLogger) error {
-	// Expand ~ in data_dir path
-	dataDir := os.ExpandEnv(cfg.Node.DataDir)
-	if strings.HasPrefix(dataDir, "~") {
-		home, err := os.UserHomeDir()
-		if err != nil {
-			return fmt.Errorf("failed to determine home directory: %w", err)
-		}
-		dataDir = filepath.Join(home, dataDir[1:])
-	}
-
-	// Ensure Node.DataDir exists and is writable
-	if err := os.MkdirAll(dataDir, 0755); err != nil {
-		return fmt.Errorf("failed to create data directory %s: %w", dataDir, err)
-	}
-	logger.ComponentInfo(logging.ComponentNode, "Data directory created/verified", zap.String("path", dataDir))
-
-	// Ensure RQLite data directory exists
-	rqliteDir := filepath.Join(dataDir, "rqlite")
-	if err := os.MkdirAll(rqliteDir, 0755); err != nil {
-		return fmt.Errorf("failed to create rqlite data directory: %w", err)
-	}
-	logger.ComponentInfo(logging.ComponentNode, "RQLite data directory created/verified", zap.String("path", rqliteDir))
-
-	return nil
-}
-
 func main() {
 	logger := setup_logger(logging.ComponentNode)
 
-	// Parse command-line flags
+	configPath, dataDir, nodeID, p2pPort, rqlHTTP, rqlRaft, rqlJoinAddr, advAddr, help := parse_and_return_network_flags()
-	configName, help := parse_flags()
 
 	check_if_should_open_help(help)
+	select_data_dir(dataDir, nodeID, *configPath != "")
 
-	// Check if config file exists and determine path
+	// Load Node Configuration
-	select_data_dir_check(configName)
-
-	// Determine config path (handle both absolute and relative paths)
-	// Note: select_data_dir_check already validated the path exists, so we can safely determine it here
-	var configPath string
-	var err error
-	if filepath.IsAbs(*configName) {
-		// Absolute path passed directly (e.g., from systemd service)
-		configPath = *configName
-	} else {
-		// Relative path - use DefaultPath which checks both ~/.orama/configs/ and ~/.orama/
-		configPath, err = config.DefaultPath(*configName)
-		if err != nil {
-			logger.Error("Failed to determine config path", zap.Error(err))
-			fmt.Fprintf(os.Stderr, "Configuration error: %v\n", err)
-			os.Exit(1)
-		}
-	}
-
 	var cfg *config.Config
-	var cfgErr error
+	cfg = config.DefaultConfig()
-	cfg, cfgErr = LoadConfigFromYAML(configPath)
+	logger.ComponentInfo(logging.ComponentNode, "Default configuration loaded successfully")
-	if cfgErr != nil {
-		logger.Error("Failed to load config from YAML", zap.Error(cfgErr))
-		fmt.Fprintf(os.Stderr, "Configuration load error: %v\n", cfgErr)
-		os.Exit(1)
-	}
-	logger.ComponentInfo(logging.ComponentNode, "Configuration loaded from YAML file", zap.String("path", configPath))
 
-	// Set default advertised addresses if empty
+	// Apply command line argument overrides
-	if cfg.Discovery.HttpAdvAddress == "" {
+	load_args_into_config(cfg, p2pPort, rqlHTTP, rqlRaft, rqlJoinAddr, advAddr, dataDir)
-		cfg.Discovery.HttpAdvAddress = fmt.Sprintf("localhost:%d", cfg.Database.RQLitePort)
+	logger.ComponentInfo(logging.ComponentNode, "Command line arguments applied to configuration")
-	}
-	if cfg.Discovery.RaftAdvAddress == "" {
-		cfg.Discovery.RaftAdvAddress = fmt.Sprintf("localhost:%d", cfg.Database.RQLiteRaftPort)
-	}
 
-	// Validate configuration
+	// LibP2P uses configurable port (default 4001); RQLite uses 5001 (HTTP) and 7001 (Raft)
-	if errs := cfg.Validate(); len(errs) > 0 {
+	port := *p2pPort
-		printValidationErrors(errs)
-	}
-
-	// Expand and create data directories
-	if err := ensureDataDirectories(cfg, logger); err != nil {
-		logger.Error("Failed to create data directories", zap.Error(err))
-		fmt.Fprintf(os.Stderr, "\n❌ Data Directory Error:\n")
-		fmt.Fprintf(os.Stderr, "%v\n", err)
-		os.Exit(1)
-	}
 
 	logger.ComponentInfo(logging.ComponentNode, "Node configuration summary",
 		zap.Strings("listen_addresses", cfg.Node.ListenAddresses),
 		zap.Int("rqlite_http_port", cfg.Database.RQLitePort),
 		zap.Int("rqlite_raft_port", cfg.Database.RQLiteRaftPort),
-		zap.Strings("peers", cfg.Discovery.BootstrapPeers),
+		zap.Int("p2p_port", port),
+		zap.Strings("bootstrap_peers", cfg.Discovery.BootstrapPeers),
 		zap.String("rqlite_join_address", cfg.Database.RQLiteJoinAddress),
-		zap.String("data_directory", cfg.Node.DataDir))
+		zap.String("data_directory", *dataDir))
-
-	// Extract P2P port from listen addresses
-	p2pPort := 4001 // default
-	if len(cfg.Node.ListenAddresses) > 0 {
-		// Parse port from multiaddr like "/ip4/0.0.0.0/tcp/4001"
-		parts := strings.Split(cfg.Node.ListenAddresses[0], "/")
-		for i, part := range parts {
-			if part == "tcp" && i+1 < len(parts) {
-				if port, err := strconv.Atoi(parts[i+1]); err == nil {
-					p2pPort = port
-					break
-				}
-			}
-		}
-	}
 
 	// Create context for graceful shutdown
 	ctx, cancel := context.WithCancel(context.Background())
@@ -343,7 +229,7 @@ func main() {
 	errChan := make(chan error, 1)
 	doneChan := make(chan struct{})
 	go func() {
-		if err := startNode(ctx, cfg, p2pPort); err != nil {
+		if err := startNode(ctx, cfg, port); err != nil {
 			errChan <- err
 		}
 		close(doneChan)

debian/control

@@ -1,19 +0,0 @@
-Package: orama
-Version: 0.69.20
-Section: net
-Priority: optional
-Architecture: amd64
-Depends: libc6
-Maintainer: DeBros Team <dev@debros.io>
-Description: Orama Network - Distributed P2P Database System
- Orama is a distributed peer-to-peer network that combines
- RQLite for distributed SQL, IPFS for content-addressed storage,
- and LibP2P for peer discovery and communication.
- .
- Features:
-  - Distributed SQLite database with Raft consensus
-  - IPFS-based file storage with encryption
-  - LibP2P peer-to-peer networking
-  - Olric distributed cache
-  - Unified HTTP/HTTPS gateway
-

debian/postinst

@@ -1,18 +0,0 @@
-#!/bin/bash
-set -e
-
-# Post-installation script for orama package
-
-echo "Orama installed successfully!"
-echo ""
-echo "To set up your node, run:"
-echo "  sudo orama install"
-echo ""
-echo "This will launch the interactive installer."
-echo ""
-echo "For command-line installation:"
-echo "  sudo orama install --vps-ip <your-ip> --domain <your-domain>"
-echo ""
-echo "For help:"
-echo "  orama --help"
-

e2e/auth_negative_test.go

@@ -1,294 +0,0 @@
-//go:build e2e
-
-package e2e
-
-import (
-	"context"
-	"net/http"
-	"testing"
-	"time"
-	"unicode"
-)
-
-func TestAuth_MissingAPIKey(t *testing.T) {
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-
-	// Request without auth headers
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, GetGatewayURL()+"/v1/network/status", nil)
-	if err != nil {
-		t.Fatalf("failed to create request: %v", err)
-	}
-
-	client := NewHTTPClient(30 * time.Second)
-	resp, err := client.Do(req)
-	if err != nil {
-		t.Fatalf("request failed: %v", err)
-	}
-	defer resp.Body.Close()
-
-	// Should be unauthorized
-	if resp.StatusCode != http.StatusUnauthorized && resp.StatusCode != http.StatusForbidden {
-		t.Logf("warning: expected 401/403 for missing auth, got %d (auth may not be enforced on this endpoint)", resp.StatusCode)
-	}
-}
-
-func TestAuth_InvalidAPIKey(t *testing.T) {
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-
-	// Request with invalid API key
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, GetGatewayURL()+"/v1/cache/health", nil)
-	if err != nil {
-		t.Fatalf("failed to create request: %v", err)
-	}
-
-	req.Header.Set("Authorization", "Bearer invalid-key-xyz")
-
-	client := NewHTTPClient(30 * time.Second)
-	resp, err := client.Do(req)
-	if err != nil {
-		t.Fatalf("request failed: %v", err)
-	}
-	defer resp.Body.Close()
-
-	// Should be unauthorized
-	if resp.StatusCode != http.StatusUnauthorized && resp.StatusCode != http.StatusForbidden {
-		t.Logf("warning: expected 401/403 for invalid key, got %d", resp.StatusCode)
-	}
-}
-
-func TestAuth_CacheWithoutAuth(t *testing.T) {
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-
-	// Request cache endpoint without auth
-	req := &HTTPRequest{
-		Method:   http.MethodGet,
-		URL:      GetGatewayURL() + "/v1/cache/health",
-		SkipAuth: true,
-	}
-
-	_, status, err := req.Do(ctx)
-	if err != nil {
-		t.Fatalf("request failed: %v", err)
-	}
-
-	// Should fail with 401 or 403
-	if status != http.StatusUnauthorized && status != http.StatusForbidden {
-		t.Logf("warning: expected 401/403 for cache without auth, got %d", status)
-	}
-}
-
-func TestAuth_StorageWithoutAuth(t *testing.T) {
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-
-	// Request storage endpoint without auth
-	req := &HTTPRequest{
-		Method:   http.MethodGet,
-		URL:      GetGatewayURL() + "/v1/storage/status/QmTest",
-		SkipAuth: true,
-	}
-
-	_, status, err := req.Do(ctx)
-	if err != nil {
-		t.Fatalf("request failed: %v", err)
-	}
-
-	// Should fail with 401 or 403
-	if status != http.StatusUnauthorized && status != http.StatusForbidden {
-		t.Logf("warning: expected 401/403 for storage without auth, got %d", status)
-	}
-}
-
-func TestAuth_RQLiteWithoutAuth(t *testing.T) {
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-
-	// Request rqlite endpoint without auth
-	req := &HTTPRequest{
-		Method:   http.MethodGet,
-		URL:      GetGatewayURL() + "/v1/rqlite/schema",
-		SkipAuth: true,
-	}
-
-	_, status, err := req.Do(ctx)
-	if err != nil {
-		t.Fatalf("request failed: %v", err)
-	}
-
-	// Should fail with 401 or 403
-	if status != http.StatusUnauthorized && status != http.StatusForbidden {
-		t.Logf("warning: expected 401/403 for rqlite without auth, got %d", status)
-	}
-}
-
-func TestAuth_MalformedBearerToken(t *testing.T) {
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-
-	// Request with malformed bearer token
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, GetGatewayURL()+"/v1/cache/health", nil)
-	if err != nil {
-		t.Fatalf("failed to create request: %v", err)
-	}
-
-	// Missing "Bearer " prefix
-	req.Header.Set("Authorization", "invalid-token-format")
-
-	client := NewHTTPClient(30 * time.Second)
-	resp, err := client.Do(req)
-	if err != nil {
-		t.Fatalf("request failed: %v", err)
-	}
-	defer resp.Body.Close()
-
-	// Should be unauthorized
-	if resp.StatusCode != http.StatusUnauthorized && resp.StatusCode != http.StatusForbidden {
-		t.Logf("warning: expected 401/403 for malformed token, got %d", resp.StatusCode)
-	}
-}
-
-func TestAuth_ExpiredJWT(t *testing.T) {
-	// Skip if JWT is not being used
-	if GetJWT() == "" && GetAPIKey() == "" {
-		t.Skip("No JWT or API key configured")
-	}
-
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-
-	// This test would require an expired JWT token
-	// For now, test with a clearly invalid JWT structure
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, GetGatewayURL()+"/v1/cache/health", nil)
-	if err != nil {
-		t.Fatalf("failed to create request: %v", err)
-	}
-
-	req.Header.Set("Authorization", "Bearer expired.jwt.token")
-
-	client := NewHTTPClient(30 * time.Second)
-	resp, err := client.Do(req)
-	if err != nil {
-		t.Fatalf("request failed: %v", err)
-	}
-	defer resp.Body.Close()
-
-	// Should be unauthorized
-	if resp.StatusCode != http.StatusUnauthorized && resp.StatusCode != http.StatusForbidden {
-		t.Logf("warning: expected 401/403 for expired JWT, got %d", resp.StatusCode)
-	}
-}
-
-func TestAuth_EmptyBearerToken(t *testing.T) {
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-
-	// Request with empty bearer token
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, GetGatewayURL()+"/v1/cache/health", nil)
-	if err != nil {
-		t.Fatalf("failed to create request: %v", err)
-	}
-
-	req.Header.Set("Authorization", "Bearer ")
-
-	client := NewHTTPClient(30 * time.Second)
-	resp, err := client.Do(req)
-	if err != nil {
-		t.Fatalf("request failed: %v", err)
-	}
-	defer resp.Body.Close()
-
-	// Should be unauthorized
-	if resp.StatusCode != http.StatusUnauthorized && resp.StatusCode != http.StatusForbidden {
-		t.Logf("warning: expected 401/403 for empty token, got %d", resp.StatusCode)
-	}
-}
-
-func TestAuth_DuplicateAuthHeaders(t *testing.T) {
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-
-	// Request with both API key and invalid JWT
-	req := &HTTPRequest{
-		Method: http.MethodGet,
-		URL:    GetGatewayURL() + "/v1/cache/health",
-		Headers: map[string]string{
-			"Authorization": "Bearer " + GetAPIKey(),
-			"X-API-Key":     GetAPIKey(),
-		},
-	}
-
-	_, status, err := req.Do(ctx)
-	if err != nil {
-		t.Fatalf("request failed: %v", err)
-	}
-
-	// Should succeed if API key is valid
-	if status != http.StatusOK {
-		t.Logf("request with both headers returned %d", status)
-	}
-}
-
-func TestAuth_CaseSensitiveAPIKey(t *testing.T) {
-	if GetAPIKey() == "" {
-		t.Skip("No API key configured")
-	}
-
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-
-	// Request with incorrectly cased API key
-	apiKey := GetAPIKey()
-	incorrectKey := ""
-	for i, ch := range apiKey {
-		if i%2 == 0 && unicode.IsLetter(ch) {
-			incorrectKey += string(unicode.ToUpper(ch)) // Convert to uppercase
-		} else {
-			incorrectKey += string(ch)
-		}
-	}
-
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, GetGatewayURL()+"/v1/cache/health", nil)
-	if err != nil {
-		t.Fatalf("failed to create request: %v", err)
-	}
-
-	req.Header.Set("Authorization", "Bearer "+incorrectKey)
-
-	client := NewHTTPClient(30 * time.Second)
-	resp, err := client.Do(req)
-	if err != nil {
-		t.Fatalf("request failed: %v", err)
-	}
-	defer resp.Body.Close()
-
-	// API keys should be case-sensitive
-	if resp.StatusCode == http.StatusOK {
-		t.Logf("warning: API key check may not be case-sensitive (got 200)")
-	}
-}
-
-func TestAuth_HealthEndpointNoAuth(t *testing.T) {
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-
-	// Health endpoint at /health should not require auth
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, GetGatewayURL()+"/v1/health", nil)
-	if err != nil {
-		t.Fatalf("failed to create request: %v", err)
-	}
-
-	client := NewHTTPClient(30 * time.Second)
-	resp, err := client.Do(req)
-	if err != nil {
-		t.Fatalf("request failed: %v", err)
-	}
-	defer resp.Body.Close()
-
-	// Should succeed without auth
-	if resp.StatusCode != http.StatusOK {
-		t.Fatalf("expected 200 for /health without auth, got %d", resp.StatusCode)
-	}
-}

e2e/cache_http_test.go

@@ -1,511 +0,0 @@
-//go:build e2e
-
-package e2e
-
-import (
-	"context"
-	"fmt"
-	"net/http"
-	"testing"
-	"time"
-)
-
-func TestCache_Health(t *testing.T) {
-	SkipIfMissingGateway(t)
-
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-
-	req := &HTTPRequest{
-		Method: http.MethodGet,
-		URL:    GetGatewayURL() + "/v1/cache/health",
-	}
-
-	body, status, err := req.Do(ctx)
-	if err != nil {
-		t.Fatalf("health check failed: %v", err)
-	}
-
-	if status != http.StatusOK {
-		t.Fatalf("expected status 200, got %d", status)
-	}
-
-	var resp map[string]interface{}
-	if err := DecodeJSON(body, &resp); err != nil {
-		t.Fatalf("failed to decode response: %v", err)
-	}
-
-	if resp["status"] != "ok" {
-		t.Fatalf("expected status 'ok', got %v", resp["status"])
-	}
-
-	if resp["service"] != "olric" {
-		t.Fatalf("expected service 'olric', got %v", resp["service"])
-	}
-}
-
-func TestCache_PutGet(t *testing.T) {
-	SkipIfMissingGateway(t)
-
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-
-	dmap := GenerateDMapName()
-	key := "test-key"
-	value := "test-value"
-
-	// Put value
-	putReq := &HTTPRequest{
-		Method: http.MethodPost,
-		URL:    GetGatewayURL() + "/v1/cache/put",
-		Body: map[string]interface{}{
-			"dmap":  dmap,
-			"key":   key,
-			"value": value,
-		},
-	}
-
-	body, status, err := putReq.Do(ctx)
-	if err != nil {
-		t.Fatalf("put failed: %v", err)
-	}
-
-	if status != http.StatusOK {
-		t.Fatalf("expected status 200, got %d: %s", status, string(body))
-	}
-
-	// Get value
-	getReq := &HTTPRequest{
-		Method: http.MethodPost,
-		URL:    GetGatewayURL() + "/v1/cache/get",
-		Body: map[string]interface{}{
-			"dmap": dmap,
-			"key":  key,
-		},
-	}
-
-	body, status, err = getReq.Do(ctx)
-	if err != nil {
-		t.Fatalf("get failed: %v", err)
-	}
-
-	if status != http.StatusOK {
-		t.Fatalf("expected status 200, got %d", status)
-	}
-
-	var getResp map[string]interface{}
-	if err := DecodeJSON(body, &getResp); err != nil {
-		t.Fatalf("failed to decode response: %v", err)
-	}
-
-	if getResp["value"] != value {
-		t.Fatalf("expected value %q, got %v", value, getResp["value"])
-	}
-}
-
-func TestCache_PutGetJSON(t *testing.T) {
-	SkipIfMissingGateway(t)
-
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-
-	dmap := GenerateDMapName()
-	key := "json-key"
-	jsonValue := map[string]interface{}{
-		"name": "John",
-		"age":  30,
-		"tags": []string{"developer", "golang"},
-	}
-
-	// Put JSON value
-	putReq := &HTTPRequest{
-		Method: http.MethodPost,
-		URL:    GetGatewayURL() + "/v1/cache/put",
-		Body: map[string]interface{}{
-			"dmap":  dmap,
-			"key":   key,
-			"value": jsonValue,
-		},
-	}
-
-	_, status, err := putReq.Do(ctx)
-	if err != nil {
-		t.Fatalf("put failed: %v", err)
-	}
-
-	if status != http.StatusOK {
-		t.Fatalf("expected status 200, got %d", status)
-	}
-
-	// Get JSON value
-	getReq := &HTTPRequest{
-		Method: http.MethodPost,
-		URL:    GetGatewayURL() + "/v1/cache/get",
-		Body: map[string]interface{}{
-			"dmap": dmap,
-			"key":  key,
-		},
-	}
-
-	body, status, err := getReq.Do(ctx)
-	if err != nil {
-		t.Fatalf("get failed: %v", err)
-	}
-
-	if status != http.StatusOK {
-		t.Fatalf("expected status 200, got %d", status)
-	}
-
-	var getResp map[string]interface{}
-	if err := DecodeJSON(body, &getResp); err != nil {
-		t.Fatalf("failed to decode response: %v", err)
-	}
-
-	retrievedValue := getResp["value"].(map[string]interface{})
-	if retrievedValue["name"] != jsonValue["name"] {
-		t.Fatalf("expected name %q, got %v", jsonValue["name"], retrievedValue["name"])
-	}
-	if retrievedValue["age"] != float64(30) {
-		t.Fatalf("expected age 30, got %v", retrievedValue["age"])
-	}
-}
-
-func TestCache_Delete(t *testing.T) {
-	SkipIfMissingGateway(t)
-
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-
-	dmap := GenerateDMapName()
-	key := "delete-key"
-	value := "delete-value"
-
-	// Put value
-	putReq := &HTTPRequest{
-		Method: http.MethodPost,
-		URL:    GetGatewayURL() + "/v1/cache/put",
-		Body: map[string]interface{}{
-			"dmap":  dmap,
-			"key":   key,
-			"value": value,
-		},
-	}
-
-	_, status, err := putReq.Do(ctx)
-	if err != nil || status != http.StatusOK {
-		t.Fatalf("put failed: status %d, err %v", status, err)
-	}
-
-	// Delete value
-	deleteReq := &HTTPRequest{
-		Method: http.MethodPost,
-		URL:    GetGatewayURL() + "/v1/cache/delete",
-		Body: map[string]interface{}{
-			"dmap": dmap,
-			"key":  key,
-		},
-	}
-
-	_, status, err = deleteReq.Do(ctx)
-	if err != nil {
-		t.Fatalf("delete failed: %v", err)
-	}
-
-	if status != http.StatusOK {
-		t.Fatalf("expected status 200, got %d", status)
-	}
-
-	// Verify deletion
-	getReq := &HTTPRequest{
-		Method: http.MethodPost,
-		URL:    GetGatewayURL() + "/v1/cache/get",
-		Body: map[string]interface{}{
-			"dmap": dmap,
-			"key":  key,
-		},
-	}
-
-	_, status, err = getReq.Do(ctx)
-	// Should get 404 for missing key
-	if status != http.StatusNotFound {
-		t.Fatalf("expected status 404 for deleted key, got %d", status)
-	}
-}
-
-func TestCache_TTL(t *testing.T) {
-	SkipIfMissingGateway(t)
-
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-
-	dmap := GenerateDMapName()
-	key := "ttl-key"
-	value := "ttl-value"
-
-	// Put value with TTL
-	putReq := &HTTPRequest{
-		Method: http.MethodPost,
-		URL:    GetGatewayURL() + "/v1/cache/put",
-		Body: map[string]interface{}{
-			"dmap":  dmap,
-			"key":   key,
-			"value": value,
-			"ttl":   "2s",
-		},
-	}
-
-	_, status, err := putReq.Do(ctx)
-	if err != nil {
-		t.Fatalf("put with TTL failed: %v", err)
-	}
-
-	if status != http.StatusOK {
-		t.Fatalf("expected status 200, got %d", status)
-	}
-
-	// Verify value exists
-	getReq := &HTTPRequest{
-		Method: http.MethodPost,
-		URL:    GetGatewayURL() + "/v1/cache/get",
-		Body: map[string]interface{}{
-			"dmap": dmap,
-			"key":  key,
-		},
-	}
-
-	_, status, err = getReq.Do(ctx)
-	if err != nil || status != http.StatusOK {
-		t.Fatalf("get immediately after put failed: status %d, err %v", status, err)
-	}
-
-	// Wait for TTL expiry (2 seconds + buffer)
-	Delay(2500)
-
-	// Verify value is expired
-	_, status, err = getReq.Do(ctx)
-	if status != http.StatusNotFound {
-		t.Logf("warning: TTL expiry may not be fully implemented; got status %d", status)
-	}
-}
-
-func TestCache_Scan(t *testing.T) {
-	SkipIfMissingGateway(t)
-
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-
-	dmap := GenerateDMapName()
-
-	// Put multiple keys
-	keys := []string{"user-1", "user-2", "session-1", "session-2"}
-	for _, key := range keys {
-		putReq := &HTTPRequest{
-			Method: http.MethodPost,
-			URL:    GetGatewayURL() + "/v1/cache/put",
-			Body: map[string]interface{}{
-				"dmap":  dmap,
-				"key":   key,
-				"value": "value-" + key,
-			},
-		}
-
-		_, status, err := putReq.Do(ctx)
-		if err != nil || status != http.StatusOK {
-			t.Fatalf("put failed: status %d, err %v", status, err)
-		}
-	}
-
-	// Scan all keys
-	scanReq := &HTTPRequest{
-		Method: http.MethodPost,
-		URL:    GetGatewayURL() + "/v1/cache/scan",
-		Body: map[string]interface{}{
-			"dmap": dmap,
-		},
-	}
-
-	body, status, err := scanReq.Do(ctx)
-	if err != nil {
-		t.Fatalf("scan failed: %v", err)
-	}
-
-	if status != http.StatusOK {
-		t.Fatalf("expected status 200, got %d", status)
-	}
-
-	var scanResp map[string]interface{}
-	if err := DecodeJSON(body, &scanResp); err != nil {
-		t.Fatalf("failed to decode response: %v", err)
-	}
-
-	keysResp := scanResp["keys"].([]interface{})
-	if len(keysResp) < 4 {
-		t.Fatalf("expected at least 4 keys, got %d", len(keysResp))
-	}
-}
-
-func TestCache_ScanWithRegex(t *testing.T) {
-	SkipIfMissingGateway(t)
-
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-
-	dmap := GenerateDMapName()
-
-	// Put keys with different patterns
-	keys := []string{"user-1", "user-2", "session-1", "session-2"}
-	for _, key := range keys {
-		putReq := &HTTPRequest{
-			Method: http.MethodPost,
-			URL:    GetGatewayURL() + "/v1/cache/put",
-			Body: map[string]interface{}{
-				"dmap":  dmap,
-				"key":   key,
-				"value": "value-" + key,
-			},
-		}
-
-		_, status, err := putReq.Do(ctx)
-		if err != nil || status != http.StatusOK {
-			t.Fatalf("put failed: status %d, err %v", status, err)
-		}
-	}
-
-	// Scan with regex pattern
-	scanReq := &HTTPRequest{
-		Method: http.MethodPost,
-		URL:    GetGatewayURL() + "/v1/cache/scan",
-		Body: map[string]interface{}{
-			"dmap":    dmap,
-			"pattern": "^user-",
-		},
-	}
-
-	body, status, err := scanReq.Do(ctx)
-	if err != nil {
-		t.Fatalf("scan with regex failed: %v", err)
-	}
-
-	if status != http.StatusOK {
-		t.Fatalf("expected status 200, got %d", status)
-	}
-
-	var scanResp map[string]interface{}
-	if err := DecodeJSON(body, &scanResp); err != nil {
-		t.Fatalf("failed to decode response: %v", err)
-	}
-
-	keysResp := scanResp["keys"].([]interface{})
-	if len(keysResp) < 2 {
-		t.Fatalf("expected at least 2 keys matching pattern, got %d", len(keysResp))
-	}
-}
-
-func TestCache_MultiGet(t *testing.T) {
-	SkipIfMissingGateway(t)
-
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-
-	dmap := GenerateDMapName()
-	keys := []string{"key-1", "key-2", "key-3"}
-
-	// Put values
-	for i, key := range keys {
-		putReq := &HTTPRequest{
-			Method: http.MethodPost,
-			URL:    GetGatewayURL() + "/v1/cache/put",
-			Body: map[string]interface{}{
-				"dmap":  dmap,
-				"key":   key,
-				"value": fmt.Sprintf("value-%d", i),
-			},
-		}
-
-		_, status, err := putReq.Do(ctx)
-		if err != nil || status != http.StatusOK {
-			t.Fatalf("put failed: status %d, err %v", status, err)
-		}
-	}
-
-	// Multi-get
-	multiGetReq := &HTTPRequest{
-		Method: http.MethodPost,
-		URL:    GetGatewayURL() + "/v1/cache/mget",
-		Body: map[string]interface{}{
-			"dmap": dmap,
-			"keys": keys,
-		},
-	}
-
-	body, status, err := multiGetReq.Do(ctx)
-	if err != nil {
-		t.Fatalf("mget failed: %v", err)
-	}
-
-	if status != http.StatusOK {
-		t.Fatalf("expected status 200, got %d", status)
-	}
-
-	var mgetResp map[string]interface{}
-	if err := DecodeJSON(body, &mgetResp); err != nil {
-		t.Fatalf("failed to decode response: %v", err)
-	}
-
-	results := mgetResp["results"].([]interface{})
-	if len(results) != 3 {
-		t.Fatalf("expected 3 results, got %d", len(results))
-	}
-}
-
-func TestCache_MissingDMap(t *testing.T) {
-	SkipIfMissingGateway(t)
-
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-
-	getReq := &HTTPRequest{
-		Method: http.MethodPost,
-		URL:    GetGatewayURL() + "/v1/cache/get",
-		Body: map[string]interface{}{
-			"dmap": "",
-			"key":  "any-key",
-		},
-	}
-
-	_, status, err := getReq.Do(ctx)
-	if err != nil {
-		t.Fatalf("request failed: %v", err)
-	}
-
-	if status != http.StatusBadRequest {
-		t.Fatalf("expected status 400 for missing dmap, got %d", status)
-	}
-}
-
-func TestCache_MissingKey(t *testing.T) {
-	SkipIfMissingGateway(t)
-
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-
-	dmap := GenerateDMapName()
-
-	getReq := &HTTPRequest{
-		Method: http.MethodPost,
-		URL:    GetGatewayURL() + "/v1/cache/get",
-		Body: map[string]interface{}{
-			"dmap": dmap,
-			"key":  "non-existent-key",
-		},
-	}
-
-	_, status, err := getReq.Do(ctx)
-	if err != nil {
-		t.Fatalf("request failed: %v", err)
-	}
-
-	if status != http.StatusNotFound {
-		t.Fatalf("expected status 404 for missing key, got %d", status)
-	}
-}

e2e/client_e2e_test.go

@@ -0,0 +1,93 @@
+//go:build e2e
+
+package e2e
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/DeBrosOfficial/network/pkg/client"
+)
+
+func getenv(k, def string) string {
+	if v := strings.TrimSpace(os.Getenv(k)); v != "" {
+		return v
+	}
+	return def
+}
+
+func requireEnv(t *testing.T, key string) string {
+	t.Helper()
+	v := strings.TrimSpace(os.Getenv(key))
+	if v == "" {
+		t.Skipf("%s not set; skipping", key)
+	}
+	return v
+}
+
+func TestClient_Database_CreateQueryMigrate(t *testing.T) {
+	apiKey := requireEnv(t, "GATEWAY_API_KEY")
+	namespace := getenv("E2E_CLIENT_NAMESPACE", "default")
+
+	cfg := client.DefaultClientConfig(namespace)
+	cfg.APIKey = apiKey
+	cfg.QuietMode = true
+
+	if v := strings.TrimSpace(os.Getenv("E2E_BOOTSTRAP_PEERS")); v != "" {
+		parts := strings.Split(v, ",")
+		var peers []string
+		for _, p := range parts {
+			p = strings.TrimSpace(p)
+			if p != "" {
+				peers = append(peers, p)
+			}
+		}
+		cfg.BootstrapPeers = peers
+	}
+	if v := strings.TrimSpace(os.Getenv("E2E_RQLITE_NODES")); v != "" {
+		nodes := strings.Fields(strings.ReplaceAll(v, ",", " "))
+		cfg.DatabaseEndpoints = nodes
+	}
+
+	c, err := client.NewClient(cfg)
+	if err != nil {
+		t.Fatalf("new client: %v", err)
+	}
+	if err := c.Connect(); err != nil {
+		t.Fatalf("connect: %v", err)
+	}
+	t.Cleanup(func() { _ = c.Disconnect() })
+
+	// Unique table per run
+	table := fmt.Sprintf("e2e_items_client_%d", time.Now().UnixNano())
+	schema := fmt.Sprintf("CREATE TABLE IF NOT EXISTS %s (id INTEGER PRIMARY KEY AUTOINCREMENT, name TEXT, created_at DATETIME DEFAULT CURRENT_TIMESTAMP)", table)
+	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
+	defer cancel()
+	if err := c.Database().CreateTable(ctx, schema); err != nil {
+		t.Fatalf("create table: %v", err)
+	}
+	// Insert via transaction
+	stmts := []string{
+		fmt.Sprintf("INSERT INTO %s(name) VALUES ('alpha')", table),
+		fmt.Sprintf("INSERT INTO %s(name) VALUES ('beta')", table),
+	}
+	ctx2, cancel2 := context.WithTimeout(context.Background(), 15*time.Second)
+	defer cancel2()
+	if err := c.Database().Transaction(ctx2, stmts); err != nil {
+		t.Fatalf("transaction: %v", err)
+	}
+	// Query rows
+	ctx3, cancel3 := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel3()
+	res, err := c.Database().Query(ctx3, fmt.Sprintf("SELECT name FROM %s ORDER BY id", table))
+	if err != nil {
+		t.Fatalf("query: %v", err)
+	}
+	if res.Count < 2 {
+		t.Fatalf("expected at least 2 rows, got %d", res.Count)
+	}
+}

e2e/concurrency_test.go

@@ -1,503 +0,0 @@
-//go:build e2e
-
-package e2e
-
-import (
-	"context"
-	"fmt"
-	"net/http"
-	"sync"
-	"sync/atomic"
-	"testing"
-	"time"
-)
-
-// TestCache_ConcurrentWrites tests concurrent cache writes
-func TestCache_ConcurrentWrites(t *testing.T) {
-	SkipIfMissingGateway(t)
-
-	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
-	defer cancel()
-
-	dmap := GenerateDMapName()
-	numGoroutines := 10
-	var wg sync.WaitGroup
-	var errorCount int32
-
-	for i := 0; i < numGoroutines; i++ {
-		wg.Add(1)
-		go func(idx int) {
-			defer wg.Done()
-
-			key := fmt.Sprintf("key-%d", idx)
-			value := fmt.Sprintf("value-%d", idx)
-
-			putReq := &HTTPRequest{
-				Method: http.MethodPost,
-				URL:    GetGatewayURL() + "/v1/cache/put",
-				Body: map[string]interface{}{
-					"dmap":  dmap,
-					"key":   key,
-					"value": value,
-				},
-			}
-
-			_, status, err := putReq.Do(ctx)
-			if err != nil || status != http.StatusOK {
-				atomic.AddInt32(&errorCount, 1)
-			}
-		}(i)
-	}
-
-	wg.Wait()
-
-	if errorCount > 0 {
-		t.Fatalf("expected no errors, got %d", errorCount)
-	}
-
-	// Verify all values exist
-	scanReq := &HTTPRequest{
-		Method: http.MethodPost,
-		URL:    GetGatewayURL() + "/v1/cache/scan",
-		Body: map[string]interface{}{
-			"dmap": dmap,
-		},
-	}
-
-	body, status, err := scanReq.Do(ctx)
-	if err != nil || status != http.StatusOK {
-		t.Fatalf("scan failed: status %d, err %v", status, err)
-	}
-
-	var scanResp map[string]interface{}
-	if err := DecodeJSON(body, &scanResp); err != nil {
-		t.Fatalf("failed to decode response: %v", err)
-	}
-
-	keys := scanResp["keys"].([]interface{})
-	if len(keys) < numGoroutines {
-		t.Fatalf("expected at least %d keys, got %d", numGoroutines, len(keys))
-	}
-}
-
-// TestCache_ConcurrentReads tests concurrent cache reads
-func TestCache_ConcurrentReads(t *testing.T) {
-	SkipIfMissingGateway(t)
-
-	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
-	defer cancel()
-
-	dmap := GenerateDMapName()
-	key := "shared-key"
-	value := "shared-value"
-
-	// Put value first
-	putReq := &HTTPRequest{
-		Method: http.MethodPost,
-		URL:    GetGatewayURL() + "/v1/cache/put",
-		Body: map[string]interface{}{
-			"dmap":  dmap,
-			"key":   key,
-			"value": value,
-		},
-	}
-
-	_, status, err := putReq.Do(ctx)
-	if err != nil || status != http.StatusOK {
-		t.Fatalf("put failed: status %d, err %v", status, err)
-	}
-
-	// Read concurrently
-	numGoroutines := 10
-	var wg sync.WaitGroup
-	var errorCount int32
-
-	for i := 0; i < numGoroutines; i++ {
-		wg.Add(1)
-		go func() {
-			defer wg.Done()
-
-			getReq := &HTTPRequest{
-				Method: http.MethodPost,
-				URL:    GetGatewayURL() + "/v1/cache/get",
-				Body: map[string]interface{}{
-					"dmap": dmap,
-					"key":  key,
-				},
-			}
-
-			body, status, err := getReq.Do(ctx)
-			if err != nil || status != http.StatusOK {
-				atomic.AddInt32(&errorCount, 1)
-				return
-			}
-
-			var getResp map[string]interface{}
-			if err := DecodeJSON(body, &getResp); err != nil {
-				atomic.AddInt32(&errorCount, 1)
-				return
-			}
-
-			if getResp["value"] != value {
-				atomic.AddInt32(&errorCount, 1)
-			}
-		}()
-	}
-
-	wg.Wait()
-
-	if errorCount > 0 {
-		t.Fatalf("expected no errors, got %d", errorCount)
-	}
-}
-
-// TestCache_ConcurrentDeleteAndWrite tests concurrent delete and write
-func TestCache_ConcurrentDeleteAndWrite(t *testing.T) {
-	SkipIfMissingGateway(t)
-
-	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
-	defer cancel()
-
-	dmap := GenerateDMapName()
-	var wg sync.WaitGroup
-	var errorCount int32
-
-	numWrites := 5
-	numDeletes := 3
-
-	// Write keys
-	for i := 0; i < numWrites; i++ {
-		wg.Add(1)
-		go func(idx int) {
-			defer wg.Done()
-
-			key := fmt.Sprintf("key-%d", idx)
-			value := fmt.Sprintf("value-%d", idx)
-
-			putReq := &HTTPRequest{
-				Method: http.MethodPost,
-				URL:    GetGatewayURL() + "/v1/cache/put",
-				Body: map[string]interface{}{
-					"dmap":  dmap,
-					"key":   key,
-					"value": value,
-				},
-			}
-
-			_, status, err := putReq.Do(ctx)
-			if err != nil || status != http.StatusOK {
-				atomic.AddInt32(&errorCount, 1)
-			}
-		}(i)
-	}
-
-	wg.Wait()
-
-	// Delete some keys
-	for i := 0; i < numDeletes; i++ {
-		wg.Add(1)
-		go func(idx int) {
-			defer wg.Done()
-
-			key := fmt.Sprintf("key-%d", idx)
-
-			deleteReq := &HTTPRequest{
-				Method: http.MethodPost,
-				URL:    GetGatewayURL() + "/v1/cache/delete",
-				Body: map[string]interface{}{
-					"dmap": dmap,
-					"key":  key,
-				},
-			}
-
-			_, status, err := deleteReq.Do(ctx)
-			if err != nil || status != http.StatusOK {
-				atomic.AddInt32(&errorCount, 1)
-			}
-		}(i)
-	}
-
-	wg.Wait()
-
-	if errorCount > 0 {
-		t.Fatalf("expected no errors, got %d", errorCount)
-	}
-}
-
-// TestRQLite_ConcurrentInserts tests concurrent database inserts
-func TestRQLite_ConcurrentInserts(t *testing.T) {
-	SkipIfMissingGateway(t)
-
-	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
-	defer cancel()
-
-	table := GenerateTableName()
-	schema := fmt.Sprintf(
-		"CREATE TABLE IF NOT EXISTS %s (id INTEGER PRIMARY KEY AUTOINCREMENT, value INTEGER)",
-		table,
-	)
-
-	// Create table
-	createReq := &HTTPRequest{
-		Method: http.MethodPost,
-		URL:    GetGatewayURL() + "/v1/rqlite/create-table",
-		Body: map[string]interface{}{
-			"schema": schema,
-		},
-	}
-
-	_, status, err := createReq.Do(ctx)
-	if err != nil || (status != http.StatusCreated && status != http.StatusOK) {
-		t.Fatalf("create table failed: status %d, err %v", status, err)
-	}
-
-	// Insert concurrently
-	numInserts := 10
-	var wg sync.WaitGroup
-	var errorCount int32
-
-	for i := 0; i < numInserts; i++ {
-		wg.Add(1)
-		go func(idx int) {
-			defer wg.Done()
-
-			txReq := &HTTPRequest{
-				Method: http.MethodPost,
-				URL:    GetGatewayURL() + "/v1/rqlite/transaction",
-				Body: map[string]interface{}{
-					"statements": []string{
-						fmt.Sprintf("INSERT INTO %s(value) VALUES (%d)", table, idx),
-					},
-				},
-			}
-
-			_, status, err := txReq.Do(ctx)
-			if err != nil || status != http.StatusOK {
-				atomic.AddInt32(&errorCount, 1)
-			}
-		}(i)
-	}
-
-	wg.Wait()
-
-	if errorCount > 0 {
-		t.Logf("warning: %d concurrent inserts failed", errorCount)
-	}
-
-	// Verify count
-	queryReq := &HTTPRequest{
-		Method: http.MethodPost,
-		URL:    GetGatewayURL() + "/v1/rqlite/query",
-		Body: map[string]interface{}{
-			"sql": fmt.Sprintf("SELECT COUNT(*) as count FROM %s", table),
-		},
-	}
-
-	body, status, err := queryReq.Do(ctx)
-	if err != nil || status != http.StatusOK {
-		t.Fatalf("count query failed: status %d, err %v", status, err)
-	}
-
-	var countResp map[string]interface{}
-	if err := DecodeJSON(body, &countResp); err != nil {
-		t.Fatalf("failed to decode response: %v", err)
-	}
-
-	if rows, ok := countResp["rows"].([]interface{}); ok && len(rows) > 0 {
-		row := rows[0].([]interface{})
-		count := int(row[0].(float64))
-		if count < numInserts {
-			t.Logf("warning: expected %d inserts, got %d", numInserts, count)
-		}
-	}
-}
-
-// TestRQLite_LargeBatchTransaction tests a large transaction with many statements
-func TestRQLite_LargeBatchTransaction(t *testing.T) {
-	SkipIfMissingGateway(t)
-
-	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
-	defer cancel()
-
-	table := GenerateTableName()
-	schema := fmt.Sprintf(
-		"CREATE TABLE IF NOT EXISTS %s (id INTEGER PRIMARY KEY AUTOINCREMENT, value TEXT)",
-		table,
-	)
-
-	// Create table
-	createReq := &HTTPRequest{
-		Method: http.MethodPost,
-		URL:    GetGatewayURL() + "/v1/rqlite/create-table",
-		Body: map[string]interface{}{
-			"schema": schema,
-		},
-	}
-
-	_, status, err := createReq.Do(ctx)
-	if err != nil || (status != http.StatusCreated && status != http.StatusOK) {
-		t.Fatalf("create table failed: status %d, err %v", status, err)
-	}
-
-	// Create large batch (100 statements)
-	var ops []map[string]interface{}
-	for i := 0; i < 100; i++ {
-		ops = append(ops, map[string]interface{}{
-			"kind": "exec",
-			"sql":  fmt.Sprintf("INSERT INTO %s(value) VALUES ('value-%d')", table, i),
-		})
-	}
-
-	txReq := &HTTPRequest{
-		Method: http.MethodPost,
-		URL:    GetGatewayURL() + "/v1/rqlite/transaction",
-		Body: map[string]interface{}{
-			"ops": ops,
-		},
-	}
-
-	_, status, err = txReq.Do(ctx)
-	if err != nil || status != http.StatusOK {
-		t.Fatalf("large batch transaction failed: status %d, err %v", status, err)
-	}
-
-	// Verify count
-	queryReq := &HTTPRequest{
-		Method: http.MethodPost,
-		URL:    GetGatewayURL() + "/v1/rqlite/query",
-		Body: map[string]interface{}{
-			"sql": fmt.Sprintf("SELECT COUNT(*) as count FROM %s", table),
-		},
-	}
-
-	body, status, err := queryReq.Do(ctx)
-	if err != nil || status != http.StatusOK {
-		t.Fatalf("count query failed: status %d, err %v", status, err)
-	}
-
-	var countResp map[string]interface{}
-	if err := DecodeJSON(body, &countResp); err != nil {
-		t.Fatalf("failed to decode response: %v", err)
-	}
-
-	if rows, ok := countResp["rows"].([]interface{}); ok && len(rows) > 0 {
-		row := rows[0].([]interface{})
-		if int(row[0].(float64)) != 100 {
-			t.Fatalf("expected 100 rows, got %v", row[0])
-		}
-	}
-}
-
-// TestCache_TTLExpiryWithSleep tests TTL expiry with a controlled sleep
-func TestCache_TTLExpiryWithSleep(t *testing.T) {
-	SkipIfMissingGateway(t)
-
-	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
-	defer cancel()
-
-	dmap := GenerateDMapName()
-	key := "ttl-expiry-key"
-	value := "ttl-expiry-value"
-
-	// Put value with 2 second TTL
-	putReq := &HTTPRequest{
-		Method: http.MethodPost,
-		URL:    GetGatewayURL() + "/v1/cache/put",
-		Body: map[string]interface{}{
-			"dmap":  dmap,
-			"key":   key,
-			"value": value,
-			"ttl":   "2s",
-		},
-	}
-
-	_, status, err := putReq.Do(ctx)
-	if err != nil || status != http.StatusOK {
-		t.Fatalf("put with TTL failed: status %d, err %v", status, err)
-	}
-
-	// Verify exists immediately
-	getReq := &HTTPRequest{
-		Method: http.MethodPost,
-		URL:    GetGatewayURL() + "/v1/cache/get",
-		Body: map[string]interface{}{
-			"dmap": dmap,
-			"key":  key,
-		},
-	}
-
-	_, status, err = getReq.Do(ctx)
-	if err != nil || status != http.StatusOK {
-		t.Fatalf("get immediately after put failed: status %d, err %v", status, err)
-	}
-
-	// Sleep for TTL duration + buffer
-	Delay(2500)
-
-	// Try to get after TTL expires
-	_, status, err = getReq.Do(ctx)
-	if status == http.StatusOK {
-		t.Logf("warning: TTL expiry may not be fully implemented; key still exists after TTL")
-	}
-}
-
-// TestCache_ConcurrentWriteAndDelete tests concurrent writes and deletes on same key
-func TestCache_ConcurrentWriteAndDelete(t *testing.T) {
-	SkipIfMissingGateway(t)
-
-	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
-	defer cancel()
-
-	dmap := GenerateDMapName()
-	key := "contested-key"
-
-	// Alternate between writes and deletes
-	numIterations := 5
-	for i := 0; i < numIterations; i++ {
-		// Write
-		putReq := &HTTPRequest{
-			Method: http.MethodPost,
-			URL:    GetGatewayURL() + "/v1/cache/put",
-			Body: map[string]interface{}{
-				"dmap":  dmap,
-				"key":   key,
-				"value": fmt.Sprintf("value-%d", i),
-			},
-		}
-
-		_, status, err := putReq.Do(ctx)
-		if err != nil || status != http.StatusOK {
-			t.Fatalf("put failed at iteration %d: status %d, err %v", i, status, err)
-		}
-
-		// Read
-		getReq := &HTTPRequest{
-			Method: http.MethodPost,
-			URL:    GetGatewayURL() + "/v1/cache/get",
-			Body: map[string]interface{}{
-				"dmap": dmap,
-				"key":  key,
-			},
-		}
-
-		_, status, err = getReq.Do(ctx)
-		if err != nil || status != http.StatusOK {
-			t.Fatalf("get failed at iteration %d: status %d, err %v", i, status, err)
-		}
-
-		// Delete
-		deleteReq := &HTTPRequest{
-			Method: http.MethodPost,
-			URL:    GetGatewayURL() + "/v1/cache/delete",
-			Body: map[string]interface{}{
-				"dmap": dmap,
-				"key":  key,
-			},
-		}
-
-		_, status, err = deleteReq.Do(ctx)
-		if err != nil || status != http.StatusOK {
-			t.Logf("warning: delete at iteration %d failed: status %d, err %v", i, status, err)
-		}
-	}
-}

e2e/env.go

@@ -1,646 +0,0 @@
-//go:build e2e
-
-package e2e
-
-import (
-	"bytes"
-	"context"
-	"database/sql"
-	"encoding/json"
-	"fmt"
-	"io"
-	"math/rand"
-	"net/http"
-	"os"
-	"path/filepath"
-	"sync"
-	"testing"
-	"time"
-
-	"github.com/DeBrosOfficial/network/pkg/client"
-	"github.com/DeBrosOfficial/network/pkg/config"
-	"github.com/DeBrosOfficial/network/pkg/ipfs"
-	_ "github.com/mattn/go-sqlite3"
-	"go.uber.org/zap"
-	"gopkg.in/yaml.v2"
-)
-
-var (
-	gatewayURLCache  string
-	apiKeyCache      string
-	bootstrapCache   []string
-	rqliteCache      []string
-	ipfsClusterCache string
-	ipfsAPICache     string
-	cacheMutex       sync.RWMutex
-)
-
-// loadGatewayConfig loads gateway configuration from ~/.orama/gateway.yaml
-func loadGatewayConfig() (map[string]interface{}, error) {
-	configPath, err := config.DefaultPath("gateway.yaml")
-	if err != nil {
-		return nil, fmt.Errorf("failed to get gateway config path: %w", err)
-	}
-
-	data, err := os.ReadFile(configPath)
-	if err != nil {
-		return nil, fmt.Errorf("failed to read gateway config: %w", err)
-	}
-
-	var cfg map[string]interface{}
-	if err := yaml.Unmarshal(data, &cfg); err != nil {
-		return nil, fmt.Errorf("failed to parse gateway config: %w", err)
-	}
-
-	return cfg, nil
-}
-
-// loadNodeConfig loads node configuration from ~/.orama/node-*.yaml
-func loadNodeConfig(filename string) (map[string]interface{}, error) {
-	configPath, err := config.DefaultPath(filename)
-	if err != nil {
-		return nil, fmt.Errorf("failed to get config path: %w", err)
-	}
-
-	data, err := os.ReadFile(configPath)
-	if err != nil {
-		return nil, fmt.Errorf("failed to read config: %w", err)
-	}
-
-	var cfg map[string]interface{}
-	if err := yaml.Unmarshal(data, &cfg); err != nil {
-		return nil, fmt.Errorf("failed to parse config: %w", err)
-	}
-
-	return cfg, nil
-}
-
-// GetGatewayURL returns the gateway base URL from config
-func GetGatewayURL() string {
-	cacheMutex.RLock()
-	if gatewayURLCache != "" {
-		defer cacheMutex.RUnlock()
-		return gatewayURLCache
-	}
-	cacheMutex.RUnlock()
-
-	// Try to load from gateway config
-	gwCfg, err := loadGatewayConfig()
-	if err == nil {
-		if server, ok := gwCfg["server"].(map[interface{}]interface{}); ok {
-			if port, ok := server["port"].(int); ok {
-				url := fmt.Sprintf("http://localhost:%d", port)
-				cacheMutex.Lock()
-				gatewayURLCache = url
-				cacheMutex.Unlock()
-				return url
-			}
-		}
-	}
-
-	// Default fallback
-	return "http://localhost:6001"
-}
-
-// GetRQLiteNodes returns rqlite endpoint addresses from config
-func GetRQLiteNodes() []string {
-	cacheMutex.RLock()
-	if len(rqliteCache) > 0 {
-		defer cacheMutex.RUnlock()
-		return rqliteCache
-	}
-	cacheMutex.RUnlock()
-
-	// Try all node config files
-	for _, cfgFile := range []string{"node-1.yaml", "node-2.yaml", "node-3.yaml", "node-4.yaml", "node-5.yaml"} {
-		nodeCfg, err := loadNodeConfig(cfgFile)
-		if err != nil {
-			continue
-		}
-
-		if db, ok := nodeCfg["database"].(map[interface{}]interface{}); ok {
-			if rqlitePort, ok := db["rqlite_port"].(int); ok {
-				nodes := []string{fmt.Sprintf("http://localhost:%d", rqlitePort)}
-				cacheMutex.Lock()
-				rqliteCache = nodes
-				cacheMutex.Unlock()
-				return nodes
-			}
-		}
-	}
-
-	// Default fallback
-	return []string{"http://localhost:5001"}
-}
-
-// queryAPIKeyFromRQLite queries the SQLite database directly for an API key
-func queryAPIKeyFromRQLite() (string, error) {
-	// Build database path from bootstrap/node config
-	homeDir, err := os.UserHomeDir()
-	if err != nil {
-		return "", fmt.Errorf("failed to get home directory: %w", err)
-	}
-
-	// Try all node data directories
-	dbPaths := []string{
-		filepath.Join(homeDir, ".orama", "data", "node-1", "rqlite", "db.sqlite"),
-		filepath.Join(homeDir, ".orama", "data", "node-2", "rqlite", "db.sqlite"),
-		filepath.Join(homeDir, ".orama", "data", "node-3", "rqlite", "db.sqlite"),
-		filepath.Join(homeDir, ".orama", "data", "node-4", "rqlite", "db.sqlite"),
-		filepath.Join(homeDir, ".orama", "data", "node-5", "rqlite", "db.sqlite"),
-	}
-
-	for _, dbPath := range dbPaths {
-		// Check if database file exists
-		if _, err := os.Stat(dbPath); err != nil {
-			continue
-		}
-
-		// Open SQLite database
-		db, err := sql.Open("sqlite3", dbPath)
-		if err != nil {
-			continue
-		}
-		defer db.Close()
-
-		// Set timeout for connection
-		ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
-		defer cancel()
-
-		// Query the api_keys table
-		row := db.QueryRowContext(ctx, "SELECT key FROM api_keys ORDER BY id LIMIT 1")
-		var apiKey string
-		if err := row.Scan(&apiKey); err != nil {
-			if err == sql.ErrNoRows {
-				continue // Try next database
-			}
-			continue // Skip this database on error
-		}
-
-		if apiKey != "" {
-			return apiKey, nil
-		}
-	}
-
-	return "", fmt.Errorf("failed to retrieve API key from any SQLite database")
-}
-
-// GetAPIKey returns the gateway API key from rqlite or cache
-func GetAPIKey() string {
-	cacheMutex.RLock()
-	if apiKeyCache != "" {
-		defer cacheMutex.RUnlock()
-		return apiKeyCache
-	}
-	cacheMutex.RUnlock()
-
-	// Query rqlite for API key
-	apiKey, err := queryAPIKeyFromRQLite()
-	if err != nil {
-		return ""
-	}
-
-	cacheMutex.Lock()
-	apiKeyCache = apiKey
-	cacheMutex.Unlock()
-
-	return apiKey
-}
-
-// GetJWT returns the gateway JWT token (currently not auto-discovered)
-func GetJWT() string {
-	return ""
-}
-
-// GetBootstrapPeers returns bootstrap peer addresses from config
-func GetBootstrapPeers() []string {
-	cacheMutex.RLock()
-	if len(bootstrapCache) > 0 {
-		defer cacheMutex.RUnlock()
-		return bootstrapCache
-	}
-	cacheMutex.RUnlock()
-
-	configFiles := []string{"node-1.yaml", "node-2.yaml", "node-3.yaml", "node-4.yaml", "node-5.yaml"}
-	seen := make(map[string]struct{})
-	var peers []string
-
-	for _, cfgFile := range configFiles {
-		nodeCfg, err := loadNodeConfig(cfgFile)
-		if err != nil {
-			continue
-		}
-		discovery, ok := nodeCfg["discovery"].(map[interface{}]interface{})
-		if !ok {
-			continue
-		}
-		rawPeers, ok := discovery["bootstrap_peers"].([]interface{})
-		if !ok {
-			continue
-		}
-		for _, v := range rawPeers {
-			peerStr, ok := v.(string)
-			if !ok || peerStr == "" {
-				continue
-			}
-			if _, exists := seen[peerStr]; exists {
-				continue
-			}
-			seen[peerStr] = struct{}{}
-			peers = append(peers, peerStr)
-		}
-	}
-
-	if len(peers) == 0 {
-		return nil
-	}
-
-	cacheMutex.Lock()
-	bootstrapCache = peers
-	cacheMutex.Unlock()
-
-	return peers
-}
-
-// GetIPFSClusterURL returns the IPFS cluster API URL from config
-func GetIPFSClusterURL() string {
-	cacheMutex.RLock()
-	if ipfsClusterCache != "" {
-		defer cacheMutex.RUnlock()
-		return ipfsClusterCache
-	}
-	cacheMutex.RUnlock()
-
-	// Try to load from node config
-	for _, cfgFile := range []string{"node-1.yaml", "node-2.yaml", "node-3.yaml", "node-4.yaml", "node-5.yaml"} {
-		nodeCfg, err := loadNodeConfig(cfgFile)
-		if err != nil {
-			continue
-		}
-
-		if db, ok := nodeCfg["database"].(map[interface{}]interface{}); ok {
-			if ipfs, ok := db["ipfs"].(map[interface{}]interface{}); ok {
-				if url, ok := ipfs["cluster_api_url"].(string); ok && url != "" {
-					cacheMutex.Lock()
-					ipfsClusterCache = url
-					cacheMutex.Unlock()
-					return url
-				}
-			}
-		}
-	}
-
-	// Default fallback
-	return "http://localhost:9094"
-}
-
-// GetIPFSAPIURL returns the IPFS API URL from config
-func GetIPFSAPIURL() string {
-	cacheMutex.RLock()
-	if ipfsAPICache != "" {
-		defer cacheMutex.RUnlock()
-		return ipfsAPICache
-	}
-	cacheMutex.RUnlock()
-
-	// Try to load from node config
-	for _, cfgFile := range []string{"node-1.yaml", "node-2.yaml", "node-3.yaml", "node-4.yaml", "node-5.yaml"} {
-		nodeCfg, err := loadNodeConfig(cfgFile)
-		if err != nil {
-			continue
-		}
-
-		if db, ok := nodeCfg["database"].(map[interface{}]interface{}); ok {
-			if ipfs, ok := db["ipfs"].(map[interface{}]interface{}); ok {
-				if url, ok := ipfs["api_url"].(string); ok && url != "" {
-					cacheMutex.Lock()
-					ipfsAPICache = url
-					cacheMutex.Unlock()
-					return url
-				}
-			}
-		}
-	}
-
-	// Default fallback
-	return "http://localhost:5001"
-}
-
-// GetClientNamespace returns the test client namespace from config
-func GetClientNamespace() string {
-	// Try to load from node config
-	for _, cfgFile := range []string{"node-1.yaml", "node-2.yaml", "node-3.yaml", "node-4.yaml", "node-5.yaml"} {
-		nodeCfg, err := loadNodeConfig(cfgFile)
-		if err != nil {
-			continue
-		}
-
-		if discovery, ok := nodeCfg["discovery"].(map[interface{}]interface{}); ok {
-			if ns, ok := discovery["node_namespace"].(string); ok && ns != "" {
-				return ns
-			}
-		}
-	}
-
-	return "default"
-}
-
-// SkipIfMissingGateway skips the test if gateway is not accessible or API key not available
-func SkipIfMissingGateway(t *testing.T) {
-	t.Helper()
-	apiKey := GetAPIKey()
-	if apiKey == "" {
-		t.Skip("API key not available from rqlite; gateway tests skipped")
-	}
-
-	// Verify gateway is accessible
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
-	defer cancel()
-
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, GetGatewayURL()+"/v1/health", nil)
-	if err != nil {
-		t.Skip("Gateway not accessible; tests skipped")
-		return
-	}
-
-	resp, err := http.DefaultClient.Do(req)
-	if err != nil {
-		t.Skip("Gateway not accessible; tests skipped")
-		return
-	}
-	resp.Body.Close()
-}
-
-// IsGatewayReady checks if the gateway is accessible and healthy
-func IsGatewayReady(ctx context.Context) bool {
-	gatewayURL := GetGatewayURL()
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, gatewayURL+"/v1/health", nil)
-	if err != nil {
-		return false
-	}
-	resp, err := http.DefaultClient.Do(req)
-	if err != nil {
-		return false
-	}
-	defer resp.Body.Close()
-	return resp.StatusCode == http.StatusOK
-}
-
-// NewHTTPClient creates an authenticated HTTP client for gateway requests
-func NewHTTPClient(timeout time.Duration) *http.Client {
-	if timeout == 0 {
-		timeout = 30 * time.Second
-	}
-	return &http.Client{Timeout: timeout}
-}
-
-// HTTPRequest is a helper for making authenticated HTTP requests
-type HTTPRequest struct {
-	Method   string
-	URL      string
-	Body     interface{}
-	Headers  map[string]string
-	Timeout  time.Duration
-	SkipAuth bool
-}
-
-// Do executes an HTTP request and returns the response body
-func (hr *HTTPRequest) Do(ctx context.Context) ([]byte, int, error) {
-	if hr.Timeout == 0 {
-		hr.Timeout = 30 * time.Second
-	}
-
-	var reqBody io.Reader
-	if hr.Body != nil {
-		data, err := json.Marshal(hr.Body)
-		if err != nil {
-			return nil, 0, fmt.Errorf("failed to marshal request body: %w", err)
-		}
-		reqBody = bytes.NewReader(data)
-	}
-
-	req, err := http.NewRequestWithContext(ctx, hr.Method, hr.URL, reqBody)
-	if err != nil {
-		return nil, 0, fmt.Errorf("failed to create request: %w", err)
-	}
-
-	// Add headers
-	if hr.Headers != nil {
-		for k, v := range hr.Headers {
-			req.Header.Set(k, v)
-		}
-	}
-
-	// Add JSON content type if body is present
-	if hr.Body != nil && req.Header.Get("Content-Type") == "" {
-		req.Header.Set("Content-Type", "application/json")
-	}
-
-	// Add auth headers
-	if !hr.SkipAuth {
-		if apiKey := GetAPIKey(); apiKey != "" {
-			req.Header.Set("Authorization", "Bearer "+apiKey)
-			req.Header.Set("X-API-Key", apiKey)
-		}
-	}
-
-	client := NewHTTPClient(hr.Timeout)
-	resp, err := client.Do(req)
-	if err != nil {
-		return nil, 0, fmt.Errorf("request failed: %w", err)
-	}
-	defer resp.Body.Close()
-
-	respBody, err := io.ReadAll(resp.Body)
-	if err != nil {
-		return nil, resp.StatusCode, fmt.Errorf("failed to read response: %w", err)
-	}
-
-	return respBody, resp.StatusCode, nil
-}
-
-// DecodeJSON unmarshals response body into v
-func DecodeJSON(data []byte, v interface{}) error {
-	return json.Unmarshal(data, v)
-}
-
-// NewNetworkClient creates a network client configured for e2e tests
-func NewNetworkClient(t *testing.T) client.NetworkClient {
-	t.Helper()
-
-	namespace := GetClientNamespace()
-	cfg := client.DefaultClientConfig(namespace)
-	cfg.APIKey = GetAPIKey()
-	cfg.QuietMode = true // Suppress debug logs in tests
-
-	if jwt := GetJWT(); jwt != "" {
-		cfg.JWT = jwt
-	}
-
-	if peers := GetBootstrapPeers(); len(peers) > 0 {
-		cfg.BootstrapPeers = peers
-	}
-
-	if nodes := GetRQLiteNodes(); len(nodes) > 0 {
-		cfg.DatabaseEndpoints = nodes
-	}
-
-	c, err := client.NewClient(cfg)
-	if err != nil {
-		t.Fatalf("failed to create network client: %v", err)
-	}
-
-	return c
-}
-
-// GenerateUniqueID generates a unique identifier for test resources
-func GenerateUniqueID(prefix string) string {
-	return fmt.Sprintf("%s_%d_%d", prefix, time.Now().UnixNano(), rand.Intn(10000))
-}
-
-// GenerateTableName generates a unique table name for database tests
-func GenerateTableName() string {
-	return GenerateUniqueID("e2e_test")
-}
-
-// GenerateDMapName generates a unique dmap name for cache tests
-func GenerateDMapName() string {
-	return GenerateUniqueID("test_dmap")
-}
-
-// GenerateTopic generates a unique topic name for pubsub tests
-func GenerateTopic() string {
-	return GenerateUniqueID("e2e_topic")
-}
-
-// Delay pauses execution for the specified duration
-func Delay(ms int) {
-	time.Sleep(time.Duration(ms) * time.Millisecond)
-}
-
-// WaitForCondition waits for a condition with exponential backoff
-func WaitForCondition(maxWait time.Duration, check func() bool) error {
-	deadline := time.Now().Add(maxWait)
-	backoff := 100 * time.Millisecond
-
-	for {
-		if check() {
-			return nil
-		}
-		if time.Now().After(deadline) {
-			return fmt.Errorf("condition not met within %v", maxWait)
-		}
-		time.Sleep(backoff)
-		if backoff < 2*time.Second {
-			backoff = backoff * 2
-		}
-	}
-}
-
-// NewTestLogger creates a test logger for debugging
-func NewTestLogger(t *testing.T) *zap.Logger {
-	t.Helper()
-	config := zap.NewDevelopmentConfig()
-	config.Level = zap.NewAtomicLevelAt(zap.DebugLevel)
-	logger, err := config.Build()
-	if err != nil {
-		t.Fatalf("failed to create logger: %v", err)
-	}
-	return logger
-}
-
-// CleanupDatabaseTable drops a table from the database after tests
-func CleanupDatabaseTable(t *testing.T, tableName string) {
-	t.Helper()
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-
-	// Query rqlite to drop the table
-	homeDir, err := os.UserHomeDir()
-	if err != nil {
-		t.Logf("warning: failed to get home directory for cleanup: %v", err)
-		return
-	}
-
-	dbPath := filepath.Join(homeDir, ".orama", "data", "node-1", "rqlite", "db.sqlite")
-	db, err := sql.Open("sqlite3", dbPath)
-	if err != nil {
-		t.Logf("warning: failed to open database for cleanup: %v", err)
-		return
-	}
-	defer db.Close()
-
-	dropSQL := fmt.Sprintf("DROP TABLE IF EXISTS %s", tableName)
-	if _, err := db.ExecContext(ctx, dropSQL); err != nil {
-		t.Logf("warning: failed to drop table %s: %v", tableName, err)
-	}
-}
-
-// CleanupDMapCache deletes a dmap from the cache after tests
-func CleanupDMapCache(t *testing.T, dmapName string) {
-	t.Helper()
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-
-	req := &HTTPRequest{
-		Method:  http.MethodDelete,
-		URL:     GetGatewayURL() + "/v1/cache/dmap/" + dmapName,
-		Timeout: 10 * time.Second,
-	}
-
-	_, status, err := req.Do(ctx)
-	if err != nil {
-		t.Logf("warning: failed to delete dmap %s: %v", dmapName, err)
-		return
-	}
-
-	if status != http.StatusOK && status != http.StatusNoContent && status != http.StatusNotFound {
-		t.Logf("warning: delete dmap returned status %d", status)
-	}
-}
-
-// CleanupIPFSFile unpins a file from IPFS after tests
-func CleanupIPFSFile(t *testing.T, cid string) {
-	t.Helper()
-	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
-	defer cancel()
-
-	logger := NewTestLogger(t)
-	cfg := &ipfs.Config{
-		ClusterAPIURL: GetIPFSClusterURL(),
-		Timeout:       30 * time.Second,
-	}
-
-	client, err := ipfs.NewClient(*cfg, logger)
-	if err != nil {
-		t.Logf("warning: failed to create IPFS client for cleanup: %v", err)
-		return
-	}
-
-	if err := client.Unpin(ctx, cid); err != nil {
-		t.Logf("warning: failed to unpin file %s: %v", cid, err)
-	}
-}
-
-// CleanupCacheEntry deletes a cache entry after tests
-func CleanupCacheEntry(t *testing.T, dmapName, key string) {
-	t.Helper()
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-
-	req := &HTTPRequest{
-		Method:  http.MethodDelete,
-		URL:     GetGatewayURL() + "/v1/cache/dmap/" + dmapName + "/key/" + key,
-		Timeout: 10 * time.Second,
-	}
-
-	_, status, err := req.Do(ctx)
-	if err != nil {
-		t.Logf("warning: failed to delete cache entry: %v", err)
-		return
-	}
-
-	if status != http.StatusOK && status != http.StatusNoContent && status != http.StatusNotFound {
-		t.Logf("warning: delete cache entry returned status %d", status)
-	}
-}

e2e/gateway_e2e_test.go

@@ -0,0 +1,427 @@
+//go:build e2e
+
+package e2e
+
+import (
+	"crypto/rand"
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/url"
+	"os"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/gorilla/websocket"
+)
+
+func getEnv(key, def string) string {
+	if v := strings.TrimSpace(os.Getenv(key)); v != "" {
+		return v
+	}
+	return def
+}
+
+func requireAPIKey(t *testing.T) string {
+	t.Helper()
+	key := strings.TrimSpace(os.Getenv("GATEWAY_API_KEY"))
+	if key == "" {
+		t.Skip("GATEWAY_API_KEY not set; skipping gateway auth-required tests")
+	}
+	return key
+}
+
+func gatewayBaseURL() string {
+	return getEnv("GATEWAY_BASE_URL", "http://127.0.0.1:6001")
+}
+
+func httpClient() *http.Client {
+	return &http.Client{Timeout: 10 * time.Second}
+}
+
+func authHeader(key string) http.Header {
+	h := http.Header{}
+	h.Set("Authorization", "Bearer "+key)
+	h.Set("Content-Type", "application/json")
+	return h
+}
+
+func TestGateway_Health(t *testing.T) {
+	base := gatewayBaseURL()
+	resp, err := httpClient().Get(base + "/v1/health")
+	if err != nil {
+		t.Fatalf("health request error: %v", err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("unexpected status: %d", resp.StatusCode)
+	}
+	var body map[string]any
+	if err := json.NewDecoder(resp.Body).Decode(&body); err != nil {
+		t.Fatalf("decode: %v", err)
+	}
+	if body["status"] != "ok" {
+		t.Fatalf("status not ok: %+v", body)
+	}
+}
+
+func TestGateway_PubSub_WS_Echo(t *testing.T) {
+	key := requireAPIKey(t)
+	base := gatewayBaseURL()
+
+	topic := fmt.Sprintf("e2e-ws-%d", time.Now().UnixNano())
+	wsURL, hdr := toWSURL(base+"/v1/pubsub/ws?topic="+url.QueryEscape(topic)), http.Header{}
+	hdr.Set("Authorization", "Bearer "+key)
+
+	c, _, err := websocket.DefaultDialer.Dial(wsURL, hdr)
+	if err != nil {
+		t.Fatalf("ws dial: %v", err)
+	}
+	defer c.Close()
+	defer c.WriteMessage(websocket.CloseMessage, websocket.FormatCloseMessage(websocket.CloseNormalClosure, ""))
+
+	msg := []byte("hello-ws")
+	if err := c.WriteMessage(websocket.TextMessage, msg); err != nil {
+		t.Fatalf("ws write: %v", err)
+	}
+
+	_, data, err := c.ReadMessage()
+	if err != nil {
+		t.Fatalf("ws read: %v", err)
+	}
+	if string(data) != string(msg) {
+		t.Fatalf("ws echo mismatch: %q", string(data))
+	}
+}
+
+func TestGateway_PubSub_RestPublishToWS(t *testing.T) {
+	key := requireAPIKey(t)
+	base := gatewayBaseURL()
+
+	topic := fmt.Sprintf("e2e-rest-%d", time.Now().UnixNano())
+	wsURL, hdr := toWSURL(base+"/v1/pubsub/ws?topic="+url.QueryEscape(topic)), http.Header{}
+	hdr.Set("Authorization", "Bearer "+key)
+	c, _, err := websocket.DefaultDialer.Dial(wsURL, hdr)
+	if err != nil {
+		t.Fatalf("ws dial: %v", err)
+	}
+	defer c.Close()
+
+	// Publish via REST
+	payload := randomBytes(24)
+	b64 := base64.StdEncoding.EncodeToString(payload)
+	body := fmt.Sprintf(`{"topic":"%s","data_base64":"%s"}`, topic, b64)
+	req, _ := http.NewRequest(http.MethodPost, base+"/v1/pubsub/publish", strings.NewReader(body))
+	req.Header = authHeader(key)
+	resp, err := httpClient().Do(req)
+	if err != nil {
+		t.Fatalf("publish do: %v", err)
+	}
+	resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("publish status: %d", resp.StatusCode)
+	}
+
+	// Expect the message via WS
+	_ = c.SetReadDeadline(time.Now().Add(5 * time.Second))
+	_, data, err := c.ReadMessage()
+	if err != nil {
+		t.Fatalf("ws read: %v", err)
+	}
+	if string(data) != string(payload) {
+		t.Fatalf("payload mismatch: %q != %q", string(data), string(payload))
+	}
+
+	// Topics list should include our topic (without namespace prefix)
+	req2, _ := http.NewRequest(http.MethodGet, base+"/v1/pubsub/topics", nil)
+	req2.Header = authHeader(key)
+	resp2, err := httpClient().Do(req2)
+	if err != nil {
+		t.Fatalf("topics do: %v", err)
+	}
+	defer resp2.Body.Close()
+	if resp2.StatusCode != http.StatusOK {
+		t.Fatalf("topics status: %d", resp2.StatusCode)
+	}
+	var tlist struct {
+		Topics []string `json:"topics"`
+	}
+	if err := json.NewDecoder(resp2.Body).Decode(&tlist); err != nil {
+		t.Fatalf("topics decode: %v", err)
+	}
+	found := false
+	for _, tt := range tlist.Topics {
+		if tt == topic {
+			found = true
+			break
+		}
+	}
+	if !found {
+		t.Fatalf("topic %s not found in topics list", topic)
+	}
+}
+
+func TestGateway_Database_CreateQueryMigrate(t *testing.T) {
+	key := requireAPIKey(t)
+	base := gatewayBaseURL()
+
+	// Create table
+	schema := `CREATE TABLE IF NOT EXISTS e2e_items (id INTEGER PRIMARY KEY AUTOINCREMENT, name TEXT, created_at DATETIME DEFAULT CURRENT_TIMESTAMP)`
+	body := fmt.Sprintf(`{"schema":%q}`, schema)
+	req, _ := http.NewRequest(http.MethodPost, base+"/v1/rqlite/create-table", strings.NewReader(body))
+	req.Header = authHeader(key)
+	resp, err := httpClient().Do(req)
+	if err != nil {
+		t.Fatalf("create-table do: %v", err)
+	}
+	resp.Body.Close()
+	if resp.StatusCode != http.StatusCreated {
+		t.Fatalf("create-table status: %d", resp.StatusCode)
+	}
+
+	// Insert via transaction (simulate migration/data seed)
+	txBody := `{"statements":["INSERT INTO e2e_items(name) VALUES ('one')","INSERT INTO e2e_items(name) VALUES ('two')"]}`
+	req, _ = http.NewRequest(http.MethodPost, base+"/v1/rqlite/transaction", strings.NewReader(txBody))
+	req.Header = authHeader(key)
+	resp, err = httpClient().Do(req)
+	if err != nil {
+		t.Fatalf("tx do: %v", err)
+	}
+	resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("tx status: %d", resp.StatusCode)
+	}
+
+	// Query rows
+	qBody := `{"sql":"SELECT name FROM e2e_items ORDER BY id ASC"}`
+	req, _ = http.NewRequest(http.MethodPost, base+"/v1/rqlite/query", strings.NewReader(qBody))
+	req.Header = authHeader(key)
+	resp, err = httpClient().Do(req)
+	if err != nil {
+		t.Fatalf("query do: %v", err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("query status: %d", resp.StatusCode)
+	}
+	var qr struct {
+		Columns []string `json:"columns"`
+		Rows    [][]any  `json:"rows"`
+		Count   int      `json:"count"`
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&qr); err != nil {
+		t.Fatalf("query decode: %v", err)
+	}
+	if qr.Count < 2 {
+		t.Fatalf("expected at least 2 rows, got %d", qr.Count)
+	}
+
+	// Schema endpoint returns tables
+	req, _ = http.NewRequest(http.MethodGet, base+"/v1/rqlite/schema", nil)
+	req.Header = authHeader(key)
+	resp2, err := httpClient().Do(req)
+	if err != nil {
+		t.Fatalf("schema do: %v", err)
+	}
+	defer resp2.Body.Close()
+	if resp2.StatusCode != http.StatusOK {
+		t.Fatalf("schema status: %d", resp2.StatusCode)
+	}
+}
+
+func TestGateway_Database_DropTable(t *testing.T) {
+	key := requireAPIKey(t)
+	base := gatewayBaseURL()
+
+	table := fmt.Sprintf("e2e_tmp_%d", time.Now().UnixNano())
+	schema := fmt.Sprintf("CREATE TABLE IF NOT EXISTS %s (id INTEGER PRIMARY KEY, note TEXT)", table)
+	// create
+	body := fmt.Sprintf(`{"schema":%q}`, schema)
+	req, _ := http.NewRequest(http.MethodPost, base+"/v1/rqlite/create-table", strings.NewReader(body))
+	req.Header = authHeader(key)
+	resp, err := httpClient().Do(req)
+	if err != nil {
+		t.Fatalf("create-table do: %v", err)
+	}
+	resp.Body.Close()
+	if resp.StatusCode != http.StatusCreated {
+		t.Fatalf("create-table status: %d", resp.StatusCode)
+	}
+	// drop
+	dbody := fmt.Sprintf(`{"table":%q}`, table)
+	req, _ = http.NewRequest(http.MethodPost, base+"/v1/rqlite/drop-table", strings.NewReader(dbody))
+	req.Header = authHeader(key)
+	resp, err = httpClient().Do(req)
+	if err != nil {
+		t.Fatalf("drop-table do: %v", err)
+	}
+	resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("drop-table status: %d", resp.StatusCode)
+	}
+	// verify not in schema
+	req, _ = http.NewRequest(http.MethodGet, base+"/v1/rqlite/schema", nil)
+	req.Header = authHeader(key)
+	resp2, err := httpClient().Do(req)
+	if err != nil {
+		t.Fatalf("schema do: %v", err)
+	}
+	defer resp2.Body.Close()
+	if resp2.StatusCode != http.StatusOK {
+		t.Fatalf("schema status: %d", resp2.StatusCode)
+	}
+	var schemaResp struct {
+		Tables []struct {
+			Name string `json:"name"`
+		} `json:"tables"`
+	}
+	if err := json.NewDecoder(resp2.Body).Decode(&schemaResp); err != nil {
+		t.Fatalf("schema decode: %v", err)
+	}
+	for _, tbl := range schemaResp.Tables {
+		if tbl.Name == table {
+			t.Fatalf("table %s still present after drop", table)
+		}
+	}
+}
+
+func TestGateway_Database_RecreateWithFK(t *testing.T) {
+	key := requireAPIKey(t)
+	base := gatewayBaseURL()
+
+	// base tables
+	orgs := fmt.Sprintf("e2e_orgs_%d", time.Now().UnixNano())
+	users := fmt.Sprintf("e2e_users_%d", time.Now().UnixNano())
+	createOrgs := fmt.Sprintf(`{"schema":%q}`, fmt.Sprintf("CREATE TABLE IF NOT EXISTS %s (id INTEGER PRIMARY KEY, name TEXT)", orgs))
+	createUsers := fmt.Sprintf(`{"schema":%q}`, fmt.Sprintf("CREATE TABLE IF NOT EXISTS %s (id INTEGER PRIMARY KEY, name TEXT, org_id INTEGER, age TEXT)", users))
+
+	for _, body := range []string{createOrgs, createUsers} {
+		req, _ := http.NewRequest(http.MethodPost, base+"/v1/rqlite/create-table", strings.NewReader(body))
+		req.Header = authHeader(key)
+		resp, err := httpClient().Do(req)
+		if err != nil {
+			t.Fatalf("create-table do: %v", err)
+		}
+		resp.Body.Close()
+		if resp.StatusCode != http.StatusCreated {
+			t.Fatalf("create-table status: %d", resp.StatusCode)
+		}
+	}
+	// seed data
+	txSeed := fmt.Sprintf(`{"statements":["INSERT INTO %s(id,name) VALUES (1,'org')","INSERT INTO %s(id,name,org_id,age) VALUES (1,'alice',1,'30')"]}`, orgs, users)
+	req, _ := http.NewRequest(http.MethodPost, base+"/v1/rqlite/transaction", strings.NewReader(txSeed))
+	req.Header = authHeader(key)
+	resp, err := httpClient().Do(req)
+	if err != nil {
+		t.Fatalf("seed tx do: %v", err)
+	}
+	resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("seed tx status: %d", resp.StatusCode)
+	}
+
+	// migrate: change users.age TEXT -> INTEGER and add FK to orgs(id)
+	// Note: Some backends may not support connection-scoped BEGIN/COMMIT or PRAGMA via HTTP.
+	// We apply the standard recreate pattern without explicit PRAGMAs/transaction.
+	txMig := fmt.Sprintf(`{"statements":[
+      "CREATE TABLE %s_new (id INTEGER PRIMARY KEY, name TEXT, org_id INTEGER, age INTEGER, FOREIGN KEY(org_id) REFERENCES %s(id) ON DELETE CASCADE)",
+      "INSERT INTO %s_new (id,name,org_id,age) SELECT id,name,org_id, CAST(age AS INTEGER) FROM %s",
+      "DROP TABLE %s",
+      "ALTER TABLE %s_new RENAME TO %s"
+    ]}`, users, orgs, users, users, users, users, users)
+	req, _ = http.NewRequest(http.MethodPost, base+"/v1/rqlite/transaction", strings.NewReader(txMig))
+	req.Header = authHeader(key)
+	resp, err = httpClient().Do(req)
+	if err != nil {
+		t.Fatalf("mig tx do: %v", err)
+	}
+	resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("mig tx status: %d", resp.StatusCode)
+	}
+
+	// verify schema type change
+	qBody := fmt.Sprintf(`{"sql":"PRAGMA table_info(%s)"}`, users)
+	req, _ = http.NewRequest(http.MethodPost, base+"/v1/rqlite/query", strings.NewReader(qBody))
+	req.Header = authHeader(key)
+	resp, err = httpClient().Do(req)
+	if err != nil {
+		t.Fatalf("pragma do: %v", err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("pragma status: %d", resp.StatusCode)
+	}
+	var qr struct {
+		Columns []string `json:"columns"`
+		Rows    [][]any  `json:"rows"`
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&qr); err != nil {
+		t.Fatalf("pragma decode: %v", err)
+	}
+	// column order: cid,name,type,notnull,dflt_value,pk
+	ageIsInt := false
+	for _, row := range qr.Rows {
+		if len(row) >= 3 && fmt.Sprintf("%v", row[1]) == "age" {
+			tstr := strings.ToUpper(fmt.Sprintf("%v", row[2]))
+			if strings.Contains(tstr, "INT") {
+				ageIsInt = true
+				break
+			}
+		}
+	}
+	if !ageIsInt {
+		// Fallback: inspect CREATE TABLE SQL from sqlite_master
+		qBody2 := fmt.Sprintf(`{"sql":"SELECT sql FROM sqlite_master WHERE type='table' AND name='%s'"}`, users)
+		req2, _ := http.NewRequest(http.MethodPost, base+"/v1/rqlite/query", strings.NewReader(qBody2))
+		req2.Header = authHeader(key)
+		resp3, err := httpClient().Do(req2)
+		if err != nil {
+			t.Fatalf("sqlite_master do: %v", err)
+		}
+		defer resp3.Body.Close()
+		if resp3.StatusCode != http.StatusOK {
+			t.Fatalf("sqlite_master status: %d", resp3.StatusCode)
+		}
+		var qr2 struct {
+			Rows [][]any `json:"rows"`
+		}
+		if err := json.NewDecoder(resp3.Body).Decode(&qr2); err != nil {
+			t.Fatalf("sqlite_master decode: %v", err)
+		}
+		found := false
+		for _, row := range qr2.Rows {
+			if len(row) > 0 {
+				sql := strings.ToUpper(fmt.Sprintf("%v", row[0]))
+				if strings.Contains(sql, "AGE INT") || strings.Contains(sql, "AGE INTEGER") {
+					found = true
+					break
+				}
+			}
+		}
+		if !found {
+			t.Fatalf("age column type not INTEGER after migration")
+		}
+	}
+}
+
+func toWSURL(httpURL string) string {
+	u, err := url.Parse(httpURL)
+	if err != nil {
+		return httpURL
+	}
+	if u.Scheme == "https" {
+		u.Scheme = "wss"
+	} else {
+		u.Scheme = "ws"
+	}
+	return u.String()
+}
+
+func randomBytes(n int) []byte {
+	b := make([]byte, n)
+	_, _ = rand.Read(b)
+	return b
+}

e2e/ipfs_cluster_test.go

@@ -1,400 +0,0 @@
-//go:build e2e
-
-package e2e
-
-import (
-	"bytes"
-	"context"
-	"fmt"
-	"io"
-	"testing"
-	"time"
-
-	"github.com/DeBrosOfficial/network/pkg/ipfs"
-)
-
-func TestIPFSCluster_Health(t *testing.T) {
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-
-	logger := NewTestLogger(t)
-	cfg := ipfs.Config{
-		ClusterAPIURL: GetIPFSClusterURL(),
-		Timeout:       10 * time.Second,
-	}
-
-	client, err := ipfs.NewClient(cfg, logger)
-	if err != nil {
-		t.Fatalf("failed to create IPFS client: %v", err)
-	}
-
-	err = client.Health(ctx)
-	if err != nil {
-		t.Fatalf("health check failed: %v", err)
-	}
-}
-
-func TestIPFSCluster_GetPeerCount(t *testing.T) {
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-
-	logger := NewTestLogger(t)
-	cfg := ipfs.Config{
-		ClusterAPIURL: GetIPFSClusterURL(),
-		Timeout:       10 * time.Second,
-	}
-
-	client, err := ipfs.NewClient(cfg, logger)
-	if err != nil {
-		t.Fatalf("failed to create IPFS client: %v", err)
-	}
-
-	peerCount, err := client.GetPeerCount(ctx)
-	if err != nil {
-		t.Fatalf("get peer count failed: %v", err)
-	}
-
-	if peerCount < 0 {
-		t.Fatalf("expected non-negative peer count, got %d", peerCount)
-	}
-
-	t.Logf("IPFS cluster peers: %d", peerCount)
-}
-
-func TestIPFSCluster_AddFile(t *testing.T) {
-	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
-	defer cancel()
-
-	logger := NewTestLogger(t)
-	cfg := ipfs.Config{
-		ClusterAPIURL: GetIPFSClusterURL(),
-		Timeout:       30 * time.Second,
-	}
-
-	client, err := ipfs.NewClient(cfg, logger)
-	if err != nil {
-		t.Fatalf("failed to create IPFS client: %v", err)
-	}
-
-	content := []byte("IPFS cluster test content")
-	result, err := client.Add(ctx, bytes.NewReader(content), "test.txt")
-	if err != nil {
-		t.Fatalf("add file failed: %v", err)
-	}
-
-	if result.Cid == "" {
-		t.Fatalf("expected non-empty CID")
-	}
-
-	if result.Size != int64(len(content)) {
-		t.Fatalf("expected size %d, got %d", len(content), result.Size)
-	}
-
-	t.Logf("Added file with CID: %s", result.Cid)
-}
-
-func TestIPFSCluster_PinFile(t *testing.T) {
-	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
-	defer cancel()
-
-	logger := NewTestLogger(t)
-	cfg := ipfs.Config{
-		ClusterAPIURL: GetIPFSClusterURL(),
-		Timeout:       30 * time.Second,
-	}
-
-	client, err := ipfs.NewClient(cfg, logger)
-	if err != nil {
-		t.Fatalf("failed to create IPFS client: %v", err)
-	}
-
-	// Add file first
-	content := []byte("IPFS pin test content")
-	addResult, err := client.Add(ctx, bytes.NewReader(content), "pin-test.txt")
-	if err != nil {
-		t.Fatalf("add file failed: %v", err)
-	}
-
-	cid := addResult.Cid
-
-	// Pin the file
-	pinResult, err := client.Pin(ctx, cid, "pinned-file", 1)
-	if err != nil {
-		t.Fatalf("pin file failed: %v", err)
-	}
-
-	if pinResult.Cid != cid {
-		t.Fatalf("expected cid %s, got %s", cid, pinResult.Cid)
-	}
-
-	t.Logf("Pinned file: %s", cid)
-}
-
-func TestIPFSCluster_PinStatus(t *testing.T) {
-	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
-	defer cancel()
-
-	logger := NewTestLogger(t)
-	cfg := ipfs.Config{
-		ClusterAPIURL: GetIPFSClusterURL(),
-		Timeout:       30 * time.Second,
-	}
-
-	client, err := ipfs.NewClient(cfg, logger)
-	if err != nil {
-		t.Fatalf("failed to create IPFS client: %v", err)
-	}
-
-	// Add and pin file
-	content := []byte("IPFS status test content")
-	addResult, err := client.Add(ctx, bytes.NewReader(content), "status-test.txt")
-	if err != nil {
-		t.Fatalf("add file failed: %v", err)
-	}
-
-	cid := addResult.Cid
-
-	pinResult, err := client.Pin(ctx, cid, "status-test", 1)
-	if err != nil {
-		t.Fatalf("pin file failed: %v", err)
-	}
-
-	if pinResult.Cid != cid {
-		t.Fatalf("expected cid %s, got %s", cid, pinResult.Cid)
-	}
-
-	// Give pin time to propagate
-	Delay(1000)
-
-	// Get status
-	status, err := client.PinStatus(ctx, cid)
-	if err != nil {
-		t.Fatalf("get pin status failed: %v", err)
-	}
-
-	if status.Cid != cid {
-		t.Fatalf("expected cid %s, got %s", cid, status.Cid)
-	}
-
-	if status.Name != "status-test" {
-		t.Fatalf("expected name 'status-test', got %s", status.Name)
-	}
-
-	if status.ReplicationFactor < 1 {
-		t.Logf("warning: replication factor is %d, expected >= 1", status.ReplicationFactor)
-	}
-
-	t.Logf("Pin status: %s (replication: %d, peers: %d)", status.Status, status.ReplicationFactor, len(status.Peers))
-}
-
-func TestIPFSCluster_UnpinFile(t *testing.T) {
-	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
-	defer cancel()
-
-	logger := NewTestLogger(t)
-	cfg := ipfs.Config{
-		ClusterAPIURL: GetIPFSClusterURL(),
-		Timeout:       30 * time.Second,
-	}
-
-	client, err := ipfs.NewClient(cfg, logger)
-	if err != nil {
-		t.Fatalf("failed to create IPFS client: %v", err)
-	}
-
-	// Add and pin file
-	content := []byte("IPFS unpin test content")
-	addResult, err := client.Add(ctx, bytes.NewReader(content), "unpin-test.txt")
-	if err != nil {
-		t.Fatalf("add file failed: %v", err)
-	}
-
-	cid := addResult.Cid
-
-	_, err = client.Pin(ctx, cid, "unpin-test", 1)
-	if err != nil {
-		t.Fatalf("pin file failed: %v", err)
-	}
-
-	// Unpin file
-	err = client.Unpin(ctx, cid)
-	if err != nil {
-		t.Fatalf("unpin file failed: %v", err)
-	}
-
-	t.Logf("Unpinned file: %s", cid)
-}
-
-func TestIPFSCluster_GetFile(t *testing.T) {
-	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
-	defer cancel()
-
-	logger := NewTestLogger(t)
-	cfg := ipfs.Config{
-		ClusterAPIURL: GetIPFSClusterURL(),
-		Timeout:       30 * time.Second,
-	}
-
-	client, err := ipfs.NewClient(cfg, logger)
-	if err != nil {
-		t.Fatalf("failed to create IPFS client: %v", err)
-	}
-
-	// Add file
-	content := []byte("IPFS get test content")
-	addResult, err := client.Add(ctx, bytes.NewReader(content), "get-test.txt")
-	if err != nil {
-		t.Fatalf("add file failed: %v", err)
-	}
-
-	cid := addResult.Cid
-
-	// Give time for propagation
-	Delay(1000)
-
-	// Get file
-	rc, err := client.Get(ctx, cid, GetIPFSAPIURL())
-	if err != nil {
-		t.Fatalf("get file failed: %v", err)
-	}
-	defer rc.Close()
-
-	retrievedContent, err := io.ReadAll(rc)
-	if err != nil {
-		t.Fatalf("failed to read content: %v", err)
-	}
-
-	if !bytes.Equal(retrievedContent, content) {
-		t.Fatalf("content mismatch: expected %q, got %q", string(content), string(retrievedContent))
-	}
-
-	t.Logf("Retrieved file: %s (%d bytes)", cid, len(retrievedContent))
-}
-
-func TestIPFSCluster_LargeFile(t *testing.T) {
-	ctx, cancel := context.WithTimeout(context.Background(), 60*time.Second)
-	defer cancel()
-
-	logger := NewTestLogger(t)
-	cfg := ipfs.Config{
-		ClusterAPIURL: GetIPFSClusterURL(),
-		Timeout:       60 * time.Second,
-	}
-
-	client, err := ipfs.NewClient(cfg, logger)
-	if err != nil {
-		t.Fatalf("failed to create IPFS client: %v", err)
-	}
-
-	// Create 5MB file
-	content := bytes.Repeat([]byte("x"), 5*1024*1024)
-	result, err := client.Add(ctx, bytes.NewReader(content), "large.bin")
-	if err != nil {
-		t.Fatalf("add large file failed: %v", err)
-	}
-
-	if result.Cid == "" {
-		t.Fatalf("expected non-empty CID")
-	}
-
-	if result.Size != int64(len(content)) {
-		t.Fatalf("expected size %d, got %d", len(content), result.Size)
-	}
-
-	t.Logf("Added large file with CID: %s (%d bytes)", result.Cid, result.Size)
-}
-
-func TestIPFSCluster_ReplicationFactor(t *testing.T) {
-	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
-	defer cancel()
-
-	logger := NewTestLogger(t)
-	cfg := ipfs.Config{
-		ClusterAPIURL: GetIPFSClusterURL(),
-		Timeout:       30 * time.Second,
-	}
-
-	client, err := ipfs.NewClient(cfg, logger)
-	if err != nil {
-		t.Fatalf("failed to create IPFS client: %v", err)
-	}
-
-	// Add file
-	content := []byte("IPFS replication test content")
-	addResult, err := client.Add(ctx, bytes.NewReader(content), "replication-test.txt")
-	if err != nil {
-		t.Fatalf("add file failed: %v", err)
-	}
-
-	cid := addResult.Cid
-
-	// Pin with specific replication factor
-	replicationFactor := 2
-	pinResult, err := client.Pin(ctx, cid, "replication-test", replicationFactor)
-	if err != nil {
-		t.Fatalf("pin file failed: %v", err)
-	}
-
-	if pinResult.Cid != cid {
-		t.Fatalf("expected cid %s, got %s", cid, pinResult.Cid)
-	}
-
-	// Give time for replication
-	Delay(2000)
-
-	// Check status
-	status, err := client.PinStatus(ctx, cid)
-	if err != nil {
-		t.Fatalf("get pin status failed: %v", err)
-	}
-
-	t.Logf("Replication factor: requested=%d, actual=%d, peers=%d", replicationFactor, status.ReplicationFactor, len(status.Peers))
-}
-
-func TestIPFSCluster_MultipleFiles(t *testing.T) {
-	ctx, cancel := context.WithTimeout(context.Background(), 60*time.Second)
-	defer cancel()
-
-	logger := NewTestLogger(t)
-	cfg := ipfs.Config{
-		ClusterAPIURL: GetIPFSClusterURL(),
-		Timeout:       30 * time.Second,
-	}
-
-	client, err := ipfs.NewClient(cfg, logger)
-	if err != nil {
-		t.Fatalf("failed to create IPFS client: %v", err)
-	}
-
-	// Add multiple files
-	numFiles := 5
-	var cids []string
-
-	for i := 0; i < numFiles; i++ {
-		content := []byte(fmt.Sprintf("File %d", i))
-		result, err := client.Add(ctx, bytes.NewReader(content), fmt.Sprintf("file%d.txt", i))
-		if err != nil {
-			t.Fatalf("add file %d failed: %v", i, err)
-		}
-		cids = append(cids, result.Cid)
-	}
-
-	if len(cids) != numFiles {
-		t.Fatalf("expected %d files added, got %d", numFiles, len(cids))
-	}
-
-	// Verify all files exist
-	for i, cid := range cids {
-		status, err := client.PinStatus(ctx, cid)
-		if err != nil {
-			t.Logf("warning: failed to get status for file %d: %v", i, err)
-			continue
-		}
-
-		if status.Cid != cid {
-			t.Fatalf("expected cid %s, got %s", cid, status.Cid)
-		}
-	}
-
-	t.Logf("Successfully added and verified %d files", numFiles)
-}

e2e/libp2p_connectivity_test.go

@@ -1,294 +0,0 @@
-//go:build e2e
-
-package e2e
-
-import (
-	"context"
-	"net/http"
-	"strings"
-	"testing"
-	"time"
-)
-
-func TestLibP2P_PeerConnectivity(t *testing.T) {
-	SkipIfMissingGateway(t)
-
-	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
-	defer cancel()
-
-	// Create and connect client
-	c := NewNetworkClient(t)
-	if err := c.Connect(); err != nil {
-		t.Fatalf("connect failed: %v", err)
-	}
-	defer c.Disconnect()
-
-	// Verify peer connectivity through the gateway
-	req := &HTTPRequest{
-		Method: http.MethodGet,
-		URL:    GetGatewayURL() + "/v1/network/peers",
-	}
-
-	body, status, err := req.Do(ctx)
-	if err != nil {
-		t.Fatalf("peers request failed: %v", err)
-	}
-
-	if status != http.StatusOK {
-		t.Fatalf("expected status 200, got %d", status)
-	}
-
-	var resp map[string]interface{}
-	if err := DecodeJSON(body, &resp); err != nil {
-		t.Fatalf("failed to decode response: %v", err)
-	}
-
-	peers := resp["peers"].([]interface{})
-	if len(peers) == 0 {
-		t.Logf("warning: no peers connected (cluster may still be initializing)")
-	}
-}
-
-func TestLibP2P_BootstrapPeers(t *testing.T) {
-	SkipIfMissingGateway(t)
-
-	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
-	defer cancel()
-
-	bootstrapPeers := GetBootstrapPeers()
-	if len(bootstrapPeers) == 0 {
-		t.Skipf("E2E_BOOTSTRAP_PEERS not set; skipping")
-	}
-
-	// Create client with bootstrap peers explicitly set
-	c := NewNetworkClient(t)
-	if err := c.Connect(); err != nil {
-		t.Fatalf("connect failed: %v", err)
-	}
-	defer c.Disconnect()
-
-	// Give peer discovery time
-	Delay(2000)
-
-	// Verify we're connected (check via gateway status)
-	req := &HTTPRequest{
-		Method: http.MethodGet,
-		URL:    GetGatewayURL() + "/v1/network/status",
-	}
-
-	body, status, err := req.Do(ctx)
-	if err != nil {
-		t.Fatalf("status request failed: %v", err)
-	}
-
-	if status != http.StatusOK {
-		t.Fatalf("expected status 200, got %d", status)
-	}
-
-	var resp map[string]interface{}
-	if err := DecodeJSON(body, &resp); err != nil {
-		t.Fatalf("failed to decode response: %v", err)
-	}
-
-	if resp["connected"] != true {
-		t.Logf("warning: client not connected to network (cluster may still be initializing)")
-	}
-}
-
-func TestLibP2P_MultipleClientConnections(t *testing.T) {
-	SkipIfMissingGateway(t)
-
-	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
-	defer cancel()
-
-	// Create multiple clients
-	c1 := NewNetworkClient(t)
-	c2 := NewNetworkClient(t)
-	c3 := NewNetworkClient(t)
-
-	if err := c1.Connect(); err != nil {
-		t.Fatalf("c1 connect failed: %v", err)
-	}
-	defer c1.Disconnect()
-
-	if err := c2.Connect(); err != nil {
-		t.Fatalf("c2 connect failed: %v", err)
-	}
-	defer c2.Disconnect()
-
-	if err := c3.Connect(); err != nil {
-		t.Fatalf("c3 connect failed: %v", err)
-	}
-	defer c3.Disconnect()
-
-	// Give peer discovery time
-	Delay(2000)
-
-	// Verify gateway sees multiple peers
-	req := &HTTPRequest{
-		Method: http.MethodGet,
-		URL:    GetGatewayURL() + "/v1/network/peers",
-	}
-
-	body, status, err := req.Do(ctx)
-	if err != nil {
-		t.Fatalf("peers request failed: %v", err)
-	}
-
-	if status != http.StatusOK {
-		t.Fatalf("expected status 200, got %d", status)
-	}
-
-	var resp map[string]interface{}
-	if err := DecodeJSON(body, &resp); err != nil {
-		t.Fatalf("failed to decode response: %v", err)
-	}
-
-	peers := resp["peers"].([]interface{})
-	if len(peers) < 1 {
-		t.Logf("warning: expected at least 1 peer, got %d", len(peers))
-	}
-}
-
-func TestLibP2P_ReconnectAfterDisconnect(t *testing.T) {
-	SkipIfMissingGateway(t)
-
-	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
-	defer cancel()
-
-	c := NewNetworkClient(t)
-
-	// Connect
-	if err := c.Connect(); err != nil {
-		t.Fatalf("connect failed: %v", err)
-	}
-
-	// Verify connected via gateway
-	req1 := &HTTPRequest{
-		Method: http.MethodGet,
-		URL:    GetGatewayURL() + "/v1/network/status",
-	}
-
-	_, status1, err := req1.Do(ctx)
-	if err != nil || status1 != http.StatusOK {
-		t.Logf("warning: gateway check failed before disconnect: status %d, err %v", status1, err)
-	}
-
-	// Disconnect
-	if err := c.Disconnect(); err != nil {
-		t.Logf("warning: disconnect failed: %v", err)
-	}
-
-	// Give time for disconnect to propagate
-	Delay(500)
-
-	// Reconnect
-	if err := c.Connect(); err != nil {
-		t.Fatalf("reconnect failed: %v", err)
-	}
-	defer c.Disconnect()
-
-	// Verify connected via gateway again
-	req2 := &HTTPRequest{
-		Method: http.MethodGet,
-		URL:    GetGatewayURL() + "/v1/network/status",
-	}
-
-	_, status2, err := req2.Do(ctx)
-	if err != nil || status2 != http.StatusOK {
-		t.Logf("warning: gateway check failed after reconnect: status %d, err %v", status2, err)
-	}
-}
-
-func TestLibP2P_PeerDiscovery(t *testing.T) {
-	SkipIfMissingGateway(t)
-
-	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
-	defer cancel()
-
-	// Create client
-	c := NewNetworkClient(t)
-	if err := c.Connect(); err != nil {
-		t.Fatalf("connect failed: %v", err)
-	}
-	defer c.Disconnect()
-
-	// Give peer discovery time
-	Delay(3000)
-
-	// Get peer list
-	req := &HTTPRequest{
-		Method: http.MethodGet,
-		URL:    GetGatewayURL() + "/v1/network/peers",
-	}
-
-	body, status, err := req.Do(ctx)
-	if err != nil {
-		t.Fatalf("peers request failed: %v", err)
-	}
-
-	if status != http.StatusOK {
-		t.Fatalf("expected status 200, got %d", status)
-	}
-
-	var resp map[string]interface{}
-	if err := DecodeJSON(body, &resp); err != nil {
-		t.Fatalf("failed to decode response: %v", err)
-	}
-
-	peers := resp["peers"].([]interface{})
-	if len(peers) == 0 {
-		t.Logf("warning: no peers discovered (cluster may not have multiple nodes)")
-	} else {
-		// Verify peer format (should be multiaddr strings)
-		for _, p := range peers {
-			peerStr := p.(string)
-			if !strings.Contains(peerStr, "/p2p/") && !strings.Contains(peerStr, "/ipfs/") {
-				t.Logf("warning: unexpected peer format: %s", peerStr)
-			}
-		}
-	}
-}
-
-func TestLibP2P_PeerAddressFormat(t *testing.T) {
-	SkipIfMissingGateway(t)
-
-	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
-	defer cancel()
-
-	// Create client
-	c := NewNetworkClient(t)
-	if err := c.Connect(); err != nil {
-		t.Fatalf("connect failed: %v", err)
-	}
-	defer c.Disconnect()
-
-	// Get peer list
-	req := &HTTPRequest{
-		Method: http.MethodGet,
-		URL:    GetGatewayURL() + "/v1/network/peers",
-	}
-
-	body, status, err := req.Do(ctx)
-	if err != nil {
-		t.Fatalf("peers request failed: %v", err)
-	}
-
-	if status != http.StatusOK {
-		t.Fatalf("expected status 200, got %d", status)
-	}
-
-	var resp map[string]interface{}
-	if err := DecodeJSON(body, &resp); err != nil {
-		t.Fatalf("failed to decode response: %v", err)
-	}
-
-	peers := resp["peers"].([]interface{})
-	for _, p := range peers {
-		peerStr := p.(string)
-		// Multiaddrs should start with /
-		if !strings.HasPrefix(peerStr, "/") {
-			t.Fatalf("expected multiaddr format, got %s", peerStr)
-		}
-	}
-}

e2e/network_http_test.go

@@ -1,223 +0,0 @@
-//go:build e2e
-
-package e2e
-
-import (
-	"context"
-	"net/http"
-	"testing"
-	"time"
-)
-
-func TestNetwork_Health(t *testing.T) {
-	SkipIfMissingGateway(t)
-
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-
-	req := &HTTPRequest{
-		Method:   http.MethodGet,
-		URL:      GetGatewayURL() + "/v1/health",
-		SkipAuth: true,
-	}
-
-	body, status, err := req.Do(ctx)
-	if err != nil {
-		t.Fatalf("health check failed: %v", err)
-	}
-
-	if status != http.StatusOK {
-		t.Fatalf("expected status 200, got %d", status)
-	}
-
-	var resp map[string]interface{}
-	if err := DecodeJSON(body, &resp); err != nil {
-		t.Fatalf("failed to decode response: %v", err)
-	}
-
-	if resp["status"] != "ok" {
-		t.Fatalf("expected status 'ok', got %v", resp["status"])
-	}
-}
-
-func TestNetwork_Status(t *testing.T) {
-	SkipIfMissingGateway(t)
-
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-
-	req := &HTTPRequest{
-		Method: http.MethodGet,
-		URL:    GetGatewayURL() + "/v1/network/status",
-	}
-
-	body, status, err := req.Do(ctx)
-	if err != nil {
-		t.Fatalf("status check failed: %v", err)
-	}
-
-	if status != http.StatusOK {
-		t.Fatalf("expected status 200, got %d", status)
-	}
-
-	var resp map[string]interface{}
-	if err := DecodeJSON(body, &resp); err != nil {
-		t.Fatalf("failed to decode response: %v", err)
-	}
-
-	if _, ok := resp["connected"]; !ok {
-		t.Fatalf("expected 'connected' field in response")
-	}
-
-	if _, ok := resp["peer_count"]; !ok {
-		t.Fatalf("expected 'peer_count' field in response")
-	}
-}
-
-func TestNetwork_Peers(t *testing.T) {
-	SkipIfMissingGateway(t)
-
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-
-	req := &HTTPRequest{
-		Method: http.MethodGet,
-		URL:    GetGatewayURL() + "/v1/network/peers",
-	}
-
-	body, status, err := req.Do(ctx)
-	if err != nil {
-		t.Fatalf("peers check failed: %v", err)
-	}
-
-	if status != http.StatusOK {
-		t.Fatalf("expected status 200, got %d", status)
-	}
-
-	var resp map[string]interface{}
-	if err := DecodeJSON(body, &resp); err != nil {
-		t.Fatalf("failed to decode response: %v", err)
-	}
-
-	if _, ok := resp["peers"]; !ok {
-		t.Fatalf("expected 'peers' field in response")
-	}
-}
-
-func TestNetwork_ProxyAnonSuccess(t *testing.T) {
-	SkipIfMissingGateway(t)
-
-	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
-	defer cancel()
-
-	req := &HTTPRequest{
-		Method: http.MethodPost,
-		URL:    GetGatewayURL() + "/v1/proxy/anon",
-		Body: map[string]interface{}{
-			"url":     "https://httpbin.org/get",
-			"method":  "GET",
-			"headers": map[string]string{"User-Agent": "DeBros-E2E-Test/1.0"},
-		},
-	}
-
-	body, status, err := req.Do(ctx)
-	if err != nil {
-		t.Fatalf("proxy anon request failed: %v", err)
-	}
-
-	if status != http.StatusOK {
-		t.Fatalf("expected status 200, got %d: %s", status, string(body))
-	}
-
-	var resp map[string]interface{}
-	if err := DecodeJSON(body, &resp); err != nil {
-		t.Fatalf("failed to decode response: %v", err)
-	}
-
-	if resp["status_code"] != float64(200) {
-		t.Fatalf("expected proxy status 200, got %v", resp["status_code"])
-	}
-
-	if _, ok := resp["body"]; !ok {
-		t.Fatalf("expected 'body' field in response")
-	}
-}
-
-func TestNetwork_ProxyAnonBadURL(t *testing.T) {
-	SkipIfMissingGateway(t)
-
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-
-	req := &HTTPRequest{
-		Method: http.MethodPost,
-		URL:    GetGatewayURL() + "/v1/proxy/anon",
-		Body: map[string]interface{}{
-			"url":    "http://localhost:1/nonexistent",
-			"method": "GET",
-		},
-	}
-
-	_, status, err := req.Do(ctx)
-	if err == nil && status == http.StatusOK {
-		t.Fatalf("expected error for bad URL, got status 200")
-	}
-}
-
-func TestNetwork_ProxyAnonPostRequest(t *testing.T) {
-	SkipIfMissingGateway(t)
-
-	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
-	defer cancel()
-
-	req := &HTTPRequest{
-		Method: http.MethodPost,
-		URL:    GetGatewayURL() + "/v1/proxy/anon",
-		Body: map[string]interface{}{
-			"url":     "https://httpbin.org/post",
-			"method":  "POST",
-			"headers": map[string]string{"User-Agent": "DeBros-E2E-Test/1.0"},
-			"body":    "test_data",
-		},
-	}
-
-	body, status, err := req.Do(ctx)
-	if err != nil {
-		t.Fatalf("proxy anon POST failed: %v", err)
-	}
-
-	if status != http.StatusOK {
-		t.Fatalf("expected status 200, got %d: %s", status, string(body))
-	}
-
-	var resp map[string]interface{}
-	if err := DecodeJSON(body, &resp); err != nil {
-		t.Fatalf("failed to decode response: %v", err)
-	}
-
-	if resp["status_code"] != float64(200) {
-		t.Fatalf("expected proxy status 200, got %v", resp["status_code"])
-	}
-}
-
-func TestNetwork_Unauthorized(t *testing.T) {
-	// Test without API key
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-
-	// Create request without auth
-	req := &HTTPRequest{
-		Method:   http.MethodGet,
-		URL:      GetGatewayURL() + "/v1/network/status",
-		SkipAuth: true,
-	}
-
-	_, status, err := req.Do(ctx)
-	if err != nil {
-		t.Fatalf("request failed: %v", err)
-	}
-
-	if status != http.StatusUnauthorized && status != http.StatusForbidden {
-		t.Logf("warning: expected 401/403, got %d (auth may not be enforced on this endpoint)", status)
-	}
-}

e2e/pubsub_client_test.go

@@ -1,421 +0,0 @@
-//go:build e2e
-
-package e2e
-
-import (
-	"context"
-	"fmt"
-	"sync"
-	"testing"
-	"time"
-)
-
-func newMessageCollector(ctx context.Context, buffer int) (chan []byte, func(string, []byte) error) {
-	if buffer <= 0 {
-		buffer = 1
-	}
-
-	ch := make(chan []byte, buffer)
-	handler := func(_ string, data []byte) error {
-		copied := append([]byte(nil), data...)
-		select {
-		case ch <- copied:
-		case <-ctx.Done():
-		}
-		return nil
-	}
-	return ch, handler
-}
-
-func waitForMessage(ctx context.Context, ch <-chan []byte) ([]byte, error) {
-	select {
-	case msg := <-ch:
-		return msg, nil
-	case <-ctx.Done():
-		return nil, fmt.Errorf("context finished while waiting for pubsub message: %w", ctx.Err())
-	}
-}
-
-func TestPubSub_SubscribePublish(t *testing.T) {
-	SkipIfMissingGateway(t)
-
-	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
-	defer cancel()
-
-	// Create two clients
-	client1 := NewNetworkClient(t)
-	client2 := NewNetworkClient(t)
-
-	if err := client1.Connect(); err != nil {
-		t.Fatalf("client1 connect failed: %v", err)
-	}
-	defer client1.Disconnect()
-
-	if err := client2.Connect(); err != nil {
-		t.Fatalf("client2 connect failed: %v", err)
-	}
-	defer client2.Disconnect()
-
-	topic := GenerateTopic()
-	message := "test-message-from-client1"
-
-	// Subscribe on client2
-	messageCh, handler := newMessageCollector(ctx, 1)
-	if err := client2.PubSub().Subscribe(ctx, topic, handler); err != nil {
-		t.Fatalf("subscribe failed: %v", err)
-	}
-	defer client2.PubSub().Unsubscribe(ctx, topic)
-
-	// Give subscription time to propagate and mesh to form
-	Delay(2000)
-
-	// Publish from client1
-	if err := client1.PubSub().Publish(ctx, topic, []byte(message)); err != nil {
-		t.Fatalf("publish failed: %v", err)
-	}
-
-	// Receive message on client2
-	recvCtx, recvCancel := context.WithTimeout(ctx, 10*time.Second)
-	defer recvCancel()
-
-	msg, err := waitForMessage(recvCtx, messageCh)
-	if err != nil {
-		t.Fatalf("receive failed: %v", err)
-	}
-
-	if string(msg) != message {
-		t.Fatalf("expected message %q, got %q", message, string(msg))
-	}
-}
-
-func TestPubSub_MultipleSubscribers(t *testing.T) {
-	SkipIfMissingGateway(t)
-
-	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
-	defer cancel()
-
-	// Create three clients
-	clientPub := NewNetworkClient(t)
-	clientSub1 := NewNetworkClient(t)
-	clientSub2 := NewNetworkClient(t)
-
-	if err := clientPub.Connect(); err != nil {
-		t.Fatalf("publisher connect failed: %v", err)
-	}
-	defer clientPub.Disconnect()
-
-	if err := clientSub1.Connect(); err != nil {
-		t.Fatalf("subscriber1 connect failed: %v", err)
-	}
-	defer clientSub1.Disconnect()
-
-	if err := clientSub2.Connect(); err != nil {
-		t.Fatalf("subscriber2 connect failed: %v", err)
-	}
-	defer clientSub2.Disconnect()
-
-	topic := GenerateTopic()
-	message1 := "message-for-sub1"
-	message2 := "message-for-sub2"
-
-	// Subscribe on both clients
-	sub1Ch, sub1Handler := newMessageCollector(ctx, 4)
-	if err := clientSub1.PubSub().Subscribe(ctx, topic, sub1Handler); err != nil {
-		t.Fatalf("subscribe1 failed: %v", err)
-	}
-	defer clientSub1.PubSub().Unsubscribe(ctx, topic)
-
-	sub2Ch, sub2Handler := newMessageCollector(ctx, 4)
-	if err := clientSub2.PubSub().Subscribe(ctx, topic, sub2Handler); err != nil {
-		t.Fatalf("subscribe2 failed: %v", err)
-	}
-	defer clientSub2.PubSub().Unsubscribe(ctx, topic)
-
-	// Give subscriptions time to propagate
-	Delay(500)
-
-	// Publish first message
-	if err := clientPub.PubSub().Publish(ctx, topic, []byte(message1)); err != nil {
-		t.Fatalf("publish1 failed: %v", err)
-	}
-
-	// Both subscribers should receive first message
-	recvCtx, recvCancel := context.WithTimeout(ctx, 10*time.Second)
-	defer recvCancel()
-
-	msg1a, err := waitForMessage(recvCtx, sub1Ch)
-	if err != nil {
-		t.Fatalf("sub1 receive1 failed: %v", err)
-	}
-
-	if string(msg1a) != message1 {
-		t.Fatalf("sub1: expected %q, got %q", message1, string(msg1a))
-	}
-
-	msg1b, err := waitForMessage(recvCtx, sub2Ch)
-	if err != nil {
-		t.Fatalf("sub2 receive1 failed: %v", err)
-	}
-
-	if string(msg1b) != message1 {
-		t.Fatalf("sub2: expected %q, got %q", message1, string(msg1b))
-	}
-
-	// Publish second message
-	if err := clientPub.PubSub().Publish(ctx, topic, []byte(message2)); err != nil {
-		t.Fatalf("publish2 failed: %v", err)
-	}
-
-	// Both subscribers should receive second message
-	recvCtx2, recvCancel2 := context.WithTimeout(ctx, 10*time.Second)
-	defer recvCancel2()
-
-	msg2a, err := waitForMessage(recvCtx2, sub1Ch)
-	if err != nil {
-		t.Fatalf("sub1 receive2 failed: %v", err)
-	}
-
-	if string(msg2a) != message2 {
-		t.Fatalf("sub1: expected %q, got %q", message2, string(msg2a))
-	}
-
-	msg2b, err := waitForMessage(recvCtx2, sub2Ch)
-	if err != nil {
-		t.Fatalf("sub2 receive2 failed: %v", err)
-	}
-
-	if string(msg2b) != message2 {
-		t.Fatalf("sub2: expected %q, got %q", message2, string(msg2b))
-	}
-}
-
-func TestPubSub_Deduplication(t *testing.T) {
-	SkipIfMissingGateway(t)
-
-	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
-	defer cancel()
-
-	// Create two clients
-	clientPub := NewNetworkClient(t)
-	clientSub := NewNetworkClient(t)
-
-	if err := clientPub.Connect(); err != nil {
-		t.Fatalf("publisher connect failed: %v", err)
-	}
-	defer clientPub.Disconnect()
-
-	if err := clientSub.Connect(); err != nil {
-		t.Fatalf("subscriber connect failed: %v", err)
-	}
-	defer clientSub.Disconnect()
-
-	topic := GenerateTopic()
-	message := "duplicate-test-message"
-
-	// Subscribe on client
-	messageCh, handler := newMessageCollector(ctx, 3)
-	if err := clientSub.PubSub().Subscribe(ctx, topic, handler); err != nil {
-		t.Fatalf("subscribe failed: %v", err)
-	}
-	defer clientSub.PubSub().Unsubscribe(ctx, topic)
-
-	// Give subscription time to propagate and mesh to form
-	Delay(2000)
-
-	// Publish the same message multiple times
-	for i := 0; i < 3; i++ {
-		if err := clientPub.PubSub().Publish(ctx, topic, []byte(message)); err != nil {
-			t.Fatalf("publish %d failed: %v", i, err)
-		}
-	}
-
-	// Receive messages - should get all (no dedup filter on subscribe)
-	recvCtx, recvCancel := context.WithTimeout(ctx, 5*time.Second)
-	defer recvCancel()
-
-	receivedCount := 0
-	for receivedCount < 3 {
-		if _, err := waitForMessage(recvCtx, messageCh); err != nil {
-			break
-		}
-		receivedCount++
-	}
-
-	if receivedCount < 1 {
-		t.Fatalf("expected to receive at least 1 message, got %d", receivedCount)
-	}
-}
-
-func TestPubSub_ConcurrentPublish(t *testing.T) {
-	SkipIfMissingGateway(t)
-
-	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
-	defer cancel()
-
-	// Create clients
-	clientPub := NewNetworkClient(t)
-	clientSub := NewNetworkClient(t)
-
-	if err := clientPub.Connect(); err != nil {
-		t.Fatalf("publisher connect failed: %v", err)
-	}
-	defer clientPub.Disconnect()
-
-	if err := clientSub.Connect(); err != nil {
-		t.Fatalf("subscriber connect failed: %v", err)
-	}
-	defer clientSub.Disconnect()
-
-	topic := GenerateTopic()
-	numMessages := 10
-
-	// Subscribe
-	messageCh, handler := newMessageCollector(ctx, numMessages)
-	if err := clientSub.PubSub().Subscribe(ctx, topic, handler); err != nil {
-		t.Fatalf("subscribe failed: %v", err)
-	}
-	defer clientSub.PubSub().Unsubscribe(ctx, topic)
-
-	// Give subscription time to propagate and mesh to form
-	Delay(2000)
-
-	// Publish multiple messages concurrently
-	var wg sync.WaitGroup
-	for i := 0; i < numMessages; i++ {
-		wg.Add(1)
-		go func(idx int) {
-			defer wg.Done()
-			msg := fmt.Sprintf("concurrent-msg-%d", idx)
-			if err := clientPub.PubSub().Publish(ctx, topic, []byte(msg)); err != nil {
-				t.Logf("publish %d failed: %v", idx, err)
-			}
-		}(i)
-	}
-	wg.Wait()
-
-	// Receive messages
-	recvCtx, recvCancel := context.WithTimeout(ctx, 10*time.Second)
-	defer recvCancel()
-
-	receivedCount := 0
-	for receivedCount < numMessages {
-		if _, err := waitForMessage(recvCtx, messageCh); err != nil {
-			break
-		}
-		receivedCount++
-	}
-
-	if receivedCount < numMessages {
-		t.Logf("expected %d messages, got %d (some may have been dropped)", numMessages, receivedCount)
-	}
-}
-
-func TestPubSub_TopicIsolation(t *testing.T) {
-	SkipIfMissingGateway(t)
-
-	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
-	defer cancel()
-
-	// Create clients
-	clientPub := NewNetworkClient(t)
-	clientSub := NewNetworkClient(t)
-
-	if err := clientPub.Connect(); err != nil {
-		t.Fatalf("publisher connect failed: %v", err)
-	}
-	defer clientPub.Disconnect()
-
-	if err := clientSub.Connect(); err != nil {
-		t.Fatalf("subscriber connect failed: %v", err)
-	}
-	defer clientSub.Disconnect()
-
-	topic1 := GenerateTopic()
-	topic2 := GenerateTopic()
-
-	// Subscribe to topic1
-	messageCh, handler := newMessageCollector(ctx, 2)
-	if err := clientSub.PubSub().Subscribe(ctx, topic1, handler); err != nil {
-		t.Fatalf("subscribe1 failed: %v", err)
-	}
-	defer clientSub.PubSub().Unsubscribe(ctx, topic1)
-
-	// Give subscription time to propagate and mesh to form
-	Delay(2000)
-
-	// Publish to topic2
-	msg2 := "message-on-topic2"
-	if err := clientPub.PubSub().Publish(ctx, topic2, []byte(msg2)); err != nil {
-		t.Fatalf("publish2 failed: %v", err)
-	}
-
-	// Publish to topic1
-	msg1 := "message-on-topic1"
-	if err := clientPub.PubSub().Publish(ctx, topic1, []byte(msg1)); err != nil {
-		t.Fatalf("publish1 failed: %v", err)
-	}
-
-	// Receive on sub1 - should get msg1 only
-	recvCtx, recvCancel := context.WithTimeout(ctx, 10*time.Second)
-	defer recvCancel()
-
-	msg, err := waitForMessage(recvCtx, messageCh)
-	if err != nil {
-		t.Fatalf("receive failed: %v", err)
-	}
-
-	if string(msg) != msg1 {
-		t.Fatalf("expected %q, got %q", msg1, string(msg))
-	}
-}
-
-func TestPubSub_EmptyMessage(t *testing.T) {
-	SkipIfMissingGateway(t)
-
-	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
-	defer cancel()
-
-	// Create clients
-	clientPub := NewNetworkClient(t)
-	clientSub := NewNetworkClient(t)
-
-	if err := clientPub.Connect(); err != nil {
-		t.Fatalf("publisher connect failed: %v", err)
-	}
-	defer clientPub.Disconnect()
-
-	if err := clientSub.Connect(); err != nil {
-		t.Fatalf("subscriber connect failed: %v", err)
-	}
-	defer clientSub.Disconnect()
-
-	topic := GenerateTopic()
-
-	// Subscribe
-	messageCh, handler := newMessageCollector(ctx, 1)
-	if err := clientSub.PubSub().Subscribe(ctx, topic, handler); err != nil {
-		t.Fatalf("subscribe failed: %v", err)
-	}
-	defer clientSub.PubSub().Unsubscribe(ctx, topic)
-
-	// Give subscription time to propagate and mesh to form
-	Delay(2000)
-
-	// Publish empty message
-	if err := clientPub.PubSub().Publish(ctx, topic, []byte("")); err != nil {
-		t.Fatalf("publish empty failed: %v", err)
-	}
-
-	// Receive on sub - should get empty message
-	recvCtx, recvCancel := context.WithTimeout(ctx, 10*time.Second)
-	defer recvCancel()
-
-	msg, err := waitForMessage(recvCtx, messageCh)
-	if err != nil {
-		t.Fatalf("receive failed: %v", err)
-	}
-
-	if len(msg) != 0 {
-		t.Fatalf("expected empty message, got %q", string(msg))
-	}
-}

e2e/rqlite_http_test.go

@@ -1,446 +0,0 @@
-//go:build e2e
-
-package e2e
-
-import (
-	"context"
-	"fmt"
-	"net/http"
-	"testing"
-	"time"
-)
-
-func TestRQLite_CreateTable(t *testing.T) {
-	SkipIfMissingGateway(t)
-
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-
-	table := GenerateTableName()
-	schema := fmt.Sprintf(
-		"CREATE TABLE IF NOT EXISTS %s (id INTEGER PRIMARY KEY AUTOINCREMENT, name TEXT, created_at DATETIME DEFAULT CURRENT_TIMESTAMP)",
-		table,
-	)
-
-	req := &HTTPRequest{
-		Method: http.MethodPost,
-		URL:    GetGatewayURL() + "/v1/rqlite/create-table",
-		Body: map[string]interface{}{
-			"schema": schema,
-		},
-	}
-
-	body, status, err := req.Do(ctx)
-	if err != nil {
-		t.Fatalf("create table request failed: %v", err)
-	}
-
-	if status != http.StatusCreated && status != http.StatusOK {
-		t.Fatalf("expected status 201 or 200, got %d: %s", status, string(body))
-	}
-}
-
-func TestRQLite_InsertQuery(t *testing.T) {
-	SkipIfMissingGateway(t)
-
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-
-	table := GenerateTableName()
-	schema := fmt.Sprintf(
-		"CREATE TABLE IF NOT EXISTS %s (id INTEGER PRIMARY KEY AUTOINCREMENT, name TEXT)",
-		table,
-	)
-
-	// Create table
-	createReq := &HTTPRequest{
-		Method: http.MethodPost,
-		URL:    GetGatewayURL() + "/v1/rqlite/create-table",
-		Body: map[string]interface{}{
-			"schema": schema,
-		},
-	}
-
-	_, status, err := createReq.Do(ctx)
-	if err != nil || (status != http.StatusCreated && status != http.StatusOK) {
-		t.Fatalf("create table failed: status %d, err %v", status, err)
-	}
-
-	// Insert rows
-	insertReq := &HTTPRequest{
-		Method: http.MethodPost,
-		URL:    GetGatewayURL() + "/v1/rqlite/transaction",
-		Body: map[string]interface{}{
-			"statements": []string{
-				fmt.Sprintf("INSERT INTO %s(name) VALUES ('alice')", table),
-				fmt.Sprintf("INSERT INTO %s(name) VALUES ('bob')", table),
-			},
-		},
-	}
-
-	_, status, err = insertReq.Do(ctx)
-	if err != nil || status != http.StatusOK {
-		t.Fatalf("insert failed: status %d, err %v", status, err)
-	}
-
-	// Query rows
-	queryReq := &HTTPRequest{
-		Method: http.MethodPost,
-		URL:    GetGatewayURL() + "/v1/rqlite/query",
-		Body: map[string]interface{}{
-			"sql": fmt.Sprintf("SELECT name FROM %s ORDER BY id", table),
-		},
-	}
-
-	body, status, err := queryReq.Do(ctx)
-	if err != nil {
-		t.Fatalf("query failed: %v", err)
-	}
-
-	if status != http.StatusOK {
-		t.Fatalf("expected status 200, got %d", status)
-	}
-
-	var queryResp map[string]interface{}
-	if err := DecodeJSON(body, &queryResp); err != nil {
-		t.Fatalf("failed to decode response: %v", err)
-	}
-
-	if queryResp["count"].(float64) < 2 {
-		t.Fatalf("expected at least 2 rows, got %v", queryResp["count"])
-	}
-}
-
-func TestRQLite_DropTable(t *testing.T) {
-	SkipIfMissingGateway(t)
-
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-
-	table := GenerateTableName()
-	schema := fmt.Sprintf(
-		"CREATE TABLE IF NOT EXISTS %s (id INTEGER PRIMARY KEY, note TEXT)",
-		table,
-	)
-
-	// Create table
-	createReq := &HTTPRequest{
-		Method: http.MethodPost,
-		URL:    GetGatewayURL() + "/v1/rqlite/create-table",
-		Body: map[string]interface{}{
-			"schema": schema,
-		},
-	}
-
-	_, status, err := createReq.Do(ctx)
-	if err != nil || (status != http.StatusCreated && status != http.StatusOK) {
-		t.Fatalf("create table failed: status %d, err %v", status, err)
-	}
-
-	// Drop table
-	dropReq := &HTTPRequest{
-		Method: http.MethodPost,
-		URL:    GetGatewayURL() + "/v1/rqlite/drop-table",
-		Body: map[string]interface{}{
-			"table": table,
-		},
-	}
-
-	_, status, err = dropReq.Do(ctx)
-	if err != nil {
-		t.Fatalf("drop table request failed: %v", err)
-	}
-
-	if status != http.StatusOK {
-		t.Fatalf("expected status 200, got %d", status)
-	}
-
-	// Verify table doesn't exist via schema
-	schemaReq := &HTTPRequest{
-		Method: http.MethodGet,
-		URL:    GetGatewayURL() + "/v1/rqlite/schema",
-	}
-
-	body, status, err := schemaReq.Do(ctx)
-	if err != nil || status != http.StatusOK {
-		t.Logf("warning: failed to verify schema after drop: status %d, err %v", status, err)
-		return
-	}
-
-	var schemaResp map[string]interface{}
-	if err := DecodeJSON(body, &schemaResp); err != nil {
-		t.Logf("warning: failed to decode schema response: %v", err)
-		return
-	}
-
-	if tables, ok := schemaResp["tables"].([]interface{}); ok {
-		for _, tbl := range tables {
-			tblMap := tbl.(map[string]interface{})
-			if tblMap["name"] == table {
-				t.Fatalf("table %s still present after drop", table)
-			}
-		}
-	}
-}
-
-func TestRQLite_Schema(t *testing.T) {
-	SkipIfMissingGateway(t)
-
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-
-	req := &HTTPRequest{
-		Method: http.MethodGet,
-		URL:    GetGatewayURL() + "/v1/rqlite/schema",
-	}
-
-	body, status, err := req.Do(ctx)
-	if err != nil {
-		t.Fatalf("schema request failed: %v", err)
-	}
-
-	if status != http.StatusOK {
-		t.Fatalf("expected status 200, got %d", status)
-	}
-
-	var resp map[string]interface{}
-	if err := DecodeJSON(body, &resp); err != nil {
-		t.Fatalf("failed to decode response: %v", err)
-	}
-
-	if _, ok := resp["tables"]; !ok {
-		t.Fatalf("expected 'tables' field in response")
-	}
-}
-
-func TestRQLite_MalformedSQL(t *testing.T) {
-	SkipIfMissingGateway(t)
-
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-
-	req := &HTTPRequest{
-		Method: http.MethodPost,
-		URL:    GetGatewayURL() + "/v1/rqlite/query",
-		Body: map[string]interface{}{
-			"sql": "SELECT * FROM nonexistent_table WHERE invalid syntax",
-		},
-	}
-
-	_, status, err := req.Do(ctx)
-	if err != nil {
-		t.Fatalf("request failed: %v", err)
-	}
-
-	// Should get an error response
-	if status == http.StatusOK {
-		t.Fatalf("expected error for malformed SQL, got status 200")
-	}
-}
-
-func TestRQLite_LargeTransaction(t *testing.T) {
-	SkipIfMissingGateway(t)
-
-	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
-	defer cancel()
-
-	table := GenerateTableName()
-	schema := fmt.Sprintf(
-		"CREATE TABLE IF NOT EXISTS %s (id INTEGER PRIMARY KEY AUTOINCREMENT, value INTEGER)",
-		table,
-	)
-
-	// Create table
-	createReq := &HTTPRequest{
-		Method: http.MethodPost,
-		URL:    GetGatewayURL() + "/v1/rqlite/create-table",
-		Body: map[string]interface{}{
-			"schema": schema,
-		},
-	}
-
-	_, status, err := createReq.Do(ctx)
-	if err != nil || (status != http.StatusCreated && status != http.StatusOK) {
-		t.Fatalf("create table failed: status %d, err %v", status, err)
-	}
-
-	// Generate large transaction (50 inserts)
-	var statements []string
-	for i := 0; i < 50; i++ {
-		statements = append(statements, fmt.Sprintf("INSERT INTO %s(value) VALUES (%d)", table, i))
-	}
-
-	txReq := &HTTPRequest{
-		Method: http.MethodPost,
-		URL:    GetGatewayURL() + "/v1/rqlite/transaction",
-		Body: map[string]interface{}{
-			"statements": statements,
-		},
-	}
-
-	_, status, err = txReq.Do(ctx)
-	if err != nil || status != http.StatusOK {
-		t.Fatalf("large transaction failed: status %d, err %v", status, err)
-	}
-
-	// Verify all rows were inserted
-	queryReq := &HTTPRequest{
-		Method: http.MethodPost,
-		URL:    GetGatewayURL() + "/v1/rqlite/query",
-		Body: map[string]interface{}{
-			"sql": fmt.Sprintf("SELECT COUNT(*) as count FROM %s", table),
-		},
-	}
-
-	body, status, err := queryReq.Do(ctx)
-	if err != nil || status != http.StatusOK {
-		t.Fatalf("count query failed: status %d, err %v", status, err)
-	}
-
-	var countResp map[string]interface{}
-	if err := DecodeJSON(body, &countResp); err != nil {
-		t.Fatalf("failed to decode response: %v", err)
-	}
-
-	// Extract count from result
-	if rows, ok := countResp["rows"].([]interface{}); ok && len(rows) > 0 {
-		row := rows[0].([]interface{})
-		if row[0].(float64) != 50 {
-			t.Fatalf("expected 50 rows, got %v", row[0])
-		}
-	}
-}
-
-func TestRQLite_ForeignKeyMigration(t *testing.T) {
-	SkipIfMissingGateway(t)
-
-	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
-	defer cancel()
-
-	orgsTable := GenerateTableName()
-	usersTable := GenerateTableName()
-
-	// Create base tables
-	createOrgsReq := &HTTPRequest{
-		Method: http.MethodPost,
-		URL:    GetGatewayURL() + "/v1/rqlite/create-table",
-		Body: map[string]interface{}{
-			"schema": fmt.Sprintf(
-				"CREATE TABLE IF NOT EXISTS %s (id INTEGER PRIMARY KEY, name TEXT)",
-				orgsTable,
-			),
-		},
-	}
-
-	_, status, err := createOrgsReq.Do(ctx)
-	if err != nil || (status != http.StatusCreated && status != http.StatusOK) {
-		t.Fatalf("create orgs table failed: status %d, err %v", status, err)
-	}
-
-	createUsersReq := &HTTPRequest{
-		Method: http.MethodPost,
-		URL:    GetGatewayURL() + "/v1/rqlite/create-table",
-		Body: map[string]interface{}{
-			"schema": fmt.Sprintf(
-				"CREATE TABLE IF NOT EXISTS %s (id INTEGER PRIMARY KEY, name TEXT, org_id INTEGER, age TEXT)",
-				usersTable,
-			),
-		},
-	}
-
-	_, status, err = createUsersReq.Do(ctx)
-	if err != nil || (status != http.StatusCreated && status != http.StatusOK) {
-		t.Fatalf("create users table failed: status %d, err %v", status, err)
-	}
-
-	// Seed data
-	seedReq := &HTTPRequest{
-		Method: http.MethodPost,
-		URL:    GetGatewayURL() + "/v1/rqlite/transaction",
-		Body: map[string]interface{}{
-			"statements": []string{
-				fmt.Sprintf("INSERT INTO %s(id,name) VALUES (1,'org')", orgsTable),
-				fmt.Sprintf("INSERT INTO %s(id,name,org_id,age) VALUES (1,'alice',1,'30')", usersTable),
-			},
-		},
-	}
-
-	_, status, err = seedReq.Do(ctx)
-	if err != nil || status != http.StatusOK {
-		t.Fatalf("seed transaction failed: status %d, err %v", status, err)
-	}
-
-	// Migrate: change age type and add FK
-	migrationReq := &HTTPRequest{
-		Method: http.MethodPost,
-		URL:    GetGatewayURL() + "/v1/rqlite/transaction",
-		Body: map[string]interface{}{
-			"statements": []string{
-				fmt.Sprintf(
-					"CREATE TABLE %s_new (id INTEGER PRIMARY KEY, name TEXT, org_id INTEGER, age INTEGER, FOREIGN KEY(org_id) REFERENCES %s(id) ON DELETE CASCADE)",
-					usersTable, orgsTable,
-				),
-				fmt.Sprintf(
-					"INSERT INTO %s_new (id,name,org_id,age) SELECT id,name,org_id, CAST(age AS INTEGER) FROM %s",
-					usersTable, usersTable,
-				),
-				fmt.Sprintf("DROP TABLE %s", usersTable),
-				fmt.Sprintf("ALTER TABLE %s_new RENAME TO %s", usersTable, usersTable),
-			},
-		},
-	}
-
-	_, status, err = migrationReq.Do(ctx)
-	if err != nil || status != http.StatusOK {
-		t.Fatalf("migration transaction failed: status %d, err %v", status, err)
-	}
-
-	// Verify data is intact
-	queryReq := &HTTPRequest{
-		Method: http.MethodPost,
-		URL:    GetGatewayURL() + "/v1/rqlite/query",
-		Body: map[string]interface{}{
-			"sql": fmt.Sprintf("SELECT name, org_id, age FROM %s", usersTable),
-		},
-	}
-
-	body, status, err := queryReq.Do(ctx)
-	if err != nil || status != http.StatusOK {
-		t.Fatalf("query after migration failed: status %d, err %v", status, err)
-	}
-
-	var queryResp map[string]interface{}
-	if err := DecodeJSON(body, &queryResp); err != nil {
-		t.Fatalf("failed to decode response: %v", err)
-	}
-
-	if queryResp["count"].(float64) != 1 {
-		t.Fatalf("expected 1 row after migration, got %v", queryResp["count"])
-	}
-}
-
-func TestRQLite_DropNonexistentTable(t *testing.T) {
-	SkipIfMissingGateway(t)
-
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-
-	dropReq := &HTTPRequest{
-		Method: http.MethodPost,
-		URL:    GetGatewayURL() + "/v1/rqlite/drop-table",
-		Body: map[string]interface{}{
-			"table": "nonexistent_table_xyz_" + fmt.Sprintf("%d", time.Now().UnixNano()),
-		},
-	}
-
-	_, status, err := dropReq.Do(ctx)
-	if err != nil {
-		t.Logf("warning: drop nonexistent table request failed: %v", err)
-		return
-	}
-
-	// Should get an error (400 or 404)
-	if status == http.StatusOK {
-		t.Logf("warning: expected error for dropping nonexistent table, got status 200")
-	}
-}

e2e/storage_http_test.go

@@ -1,550 +0,0 @@
-//go:build e2e
-
-package e2e
-
-import (
-	"bytes"
-	"context"
-	"io"
-	"mime/multipart"
-	"net/http"
-	"testing"
-	"time"
-)
-
-// uploadFile is a helper to upload a file to storage
-func uploadFile(t *testing.T, ctx context.Context, content []byte, filename string) string {
-	t.Helper()
-
-	// Create multipart form
-	var buf bytes.Buffer
-	writer := multipart.NewWriter(&buf)
-
-	part, err := writer.CreateFormFile("file", filename)
-	if err != nil {
-		t.Fatalf("failed to create form file: %v", err)
-	}
-
-	if _, err := io.Copy(part, bytes.NewReader(content)); err != nil {
-		t.Fatalf("failed to copy data: %v", err)
-	}
-
-	if err := writer.Close(); err != nil {
-		t.Fatalf("failed to close writer: %v", err)
-	}
-
-	// Create request
-	req, err := http.NewRequestWithContext(ctx, http.MethodPost, GetGatewayURL()+"/v1/storage/upload", &buf)
-	if err != nil {
-		t.Fatalf("failed to create request: %v", err)
-	}
-
-	req.Header.Set("Content-Type", writer.FormDataContentType())
-
-	// Add auth headers
-	if jwt := GetJWT(); jwt != "" {
-		req.Header.Set("Authorization", "Bearer "+jwt)
-	} else if apiKey := GetAPIKey(); apiKey != "" {
-		req.Header.Set("Authorization", "Bearer "+apiKey)
-	}
-
-	client := NewHTTPClient(5 * time.Minute)
-	resp, err := client.Do(req)
-	if err != nil {
-		t.Fatalf("upload request failed: %v", err)
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK {
-		body, _ := io.ReadAll(resp.Body)
-		t.Fatalf("upload failed with status %d: %s", resp.StatusCode, string(body))
-	}
-
-	result, err := DecodeJSONFromReader(resp.Body)
-	if err != nil {
-		t.Fatalf("failed to decode upload response: %v", err)
-	}
-
-	return result["cid"].(string)
-}
-
-// DecodeJSON is a helper to decode JSON from io.ReadCloser
-func DecodeJSONFromReader(rc io.ReadCloser) (map[string]interface{}, error) {
-	defer rc.Close()
-	body, err := io.ReadAll(rc)
-	if err != nil {
-		return nil, err
-	}
-	var result map[string]interface{}
-	err = DecodeJSON(body, &result)
-	return result, err
-}
-
-func TestStorage_UploadText(t *testing.T) {
-	SkipIfMissingGateway(t)
-
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
-	defer cancel()
-
-	content := []byte("Hello, IPFS!")
-	filename := "test.txt"
-
-	// Create multipart form
-	var buf bytes.Buffer
-	writer := multipart.NewWriter(&buf)
-
-	part, err := writer.CreateFormFile("file", filename)
-	if err != nil {
-		t.Fatalf("failed to create form file: %v", err)
-	}
-
-	if _, err := io.Copy(part, bytes.NewReader(content)); err != nil {
-		t.Fatalf("failed to copy data: %v", err)
-	}
-
-	if err := writer.Close(); err != nil {
-		t.Fatalf("failed to close writer: %v", err)
-	}
-
-	// Create request
-	req, err := http.NewRequestWithContext(ctx, http.MethodPost, GetGatewayURL()+"/v1/storage/upload", &buf)
-	if err != nil {
-		t.Fatalf("failed to create request: %v", err)
-	}
-
-	req.Header.Set("Content-Type", writer.FormDataContentType())
-
-	if apiKey := GetAPIKey(); apiKey != "" {
-		req.Header.Set("Authorization", "Bearer "+apiKey)
-	}
-
-	client := NewHTTPClient(5 * time.Minute)
-	resp, err := client.Do(req)
-	if err != nil {
-		t.Fatalf("upload request failed: %v", err)
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK {
-		body, _ := io.ReadAll(resp.Body)
-		t.Fatalf("upload failed with status %d: %s", resp.StatusCode, string(body))
-	}
-
-	var result map[string]interface{}
-	body, _ := io.ReadAll(resp.Body)
-	if err := DecodeJSON(body, &result); err != nil {
-		t.Fatalf("failed to decode response: %v", err)
-	}
-
-	if result["cid"] == nil {
-		t.Fatalf("expected cid in response")
-	}
-
-	if result["name"] != filename {
-		t.Fatalf("expected name %q, got %v", filename, result["name"])
-	}
-
-	if result["size"] == nil || result["size"].(float64) <= 0 {
-		t.Fatalf("expected positive size")
-	}
-}
-
-func TestStorage_UploadBinary(t *testing.T) {
-	SkipIfMissingGateway(t)
-
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
-	defer cancel()
-
-	// PNG header
-	content := []byte{0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a}
-	filename := "test.png"
-
-	// Create multipart form
-	var buf bytes.Buffer
-	writer := multipart.NewWriter(&buf)
-
-	part, err := writer.CreateFormFile("file", filename)
-	if err != nil {
-		t.Fatalf("failed to create form file: %v", err)
-	}
-
-	if _, err := io.Copy(part, bytes.NewReader(content)); err != nil {
-		t.Fatalf("failed to copy data: %v", err)
-	}
-
-	if err := writer.Close(); err != nil {
-		t.Fatalf("failed to close writer: %v", err)
-	}
-
-	// Create request
-	req, err := http.NewRequestWithContext(ctx, http.MethodPost, GetGatewayURL()+"/v1/storage/upload", &buf)
-	if err != nil {
-		t.Fatalf("failed to create request: %v", err)
-	}
-
-	req.Header.Set("Content-Type", writer.FormDataContentType())
-
-	if apiKey := GetAPIKey(); apiKey != "" {
-		req.Header.Set("Authorization", "Bearer "+apiKey)
-	}
-
-	client := NewHTTPClient(5 * time.Minute)
-	resp, err := client.Do(req)
-	if err != nil {
-		t.Fatalf("upload request failed: %v", err)
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK {
-		body, _ := io.ReadAll(resp.Body)
-		t.Fatalf("upload failed with status %d: %s", resp.StatusCode, string(body))
-	}
-
-	var result map[string]interface{}
-	body, _ := io.ReadAll(resp.Body)
-	if err := DecodeJSON(body, &result); err != nil {
-		t.Fatalf("failed to decode response: %v", err)
-	}
-
-	if result["cid"] == nil {
-		t.Fatalf("expected cid in response")
-	}
-}
-
-func TestStorage_UploadLarge(t *testing.T) {
-	SkipIfMissingGateway(t)
-
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
-	defer cancel()
-
-	// Create 1MB file
-	content := bytes.Repeat([]byte("x"), 1024*1024)
-	filename := "large.bin"
-
-	// Create multipart form
-	var buf bytes.Buffer
-	writer := multipart.NewWriter(&buf)
-
-	part, err := writer.CreateFormFile("file", filename)
-	if err != nil {
-		t.Fatalf("failed to create form file: %v", err)
-	}
-
-	if _, err := io.Copy(part, bytes.NewReader(content)); err != nil {
-		t.Fatalf("failed to copy data: %v", err)
-	}
-
-	if err := writer.Close(); err != nil {
-		t.Fatalf("failed to close writer: %v", err)
-	}
-
-	// Create request
-	req, err := http.NewRequestWithContext(ctx, http.MethodPost, GetGatewayURL()+"/v1/storage/upload", &buf)
-	if err != nil {
-		t.Fatalf("failed to create request: %v", err)
-	}
-
-	req.Header.Set("Content-Type", writer.FormDataContentType())
-
-	if apiKey := GetAPIKey(); apiKey != "" {
-		req.Header.Set("Authorization", "Bearer "+apiKey)
-	}
-
-	client := NewHTTPClient(5 * time.Minute)
-	resp, err := client.Do(req)
-	if err != nil {
-		t.Fatalf("upload request failed: %v", err)
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK {
-		body, _ := io.ReadAll(resp.Body)
-		t.Fatalf("upload failed with status %d: %s", resp.StatusCode, string(body))
-	}
-
-	var result map[string]interface{}
-	body, _ := io.ReadAll(resp.Body)
-	if err := DecodeJSON(body, &result); err != nil {
-		t.Fatalf("failed to decode response: %v", err)
-	}
-
-	if result["size"] != float64(1024*1024) {
-		t.Fatalf("expected size %d, got %v", 1024*1024, result["size"])
-	}
-}
-
-func TestStorage_PinUnpin(t *testing.T) {
-	SkipIfMissingGateway(t)
-
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
-	defer cancel()
-
-	content := []byte("test content for pinning")
-
-	// Upload file first
-	var buf bytes.Buffer
-	writer := multipart.NewWriter(&buf)
-
-	part, err := writer.CreateFormFile("file", "pin-test.txt")
-	if err != nil {
-		t.Fatalf("failed to create form file: %v", err)
-	}
-
-	if _, err := io.Copy(part, bytes.NewReader(content)); err != nil {
-		t.Fatalf("failed to copy data: %v", err)
-	}
-
-	if err := writer.Close(); err != nil {
-		t.Fatalf("failed to close writer: %v", err)
-	}
-
-	// Create upload request
-	req, err := http.NewRequestWithContext(ctx, http.MethodPost, GetGatewayURL()+"/v1/storage/upload", &buf)
-	if err != nil {
-		t.Fatalf("failed to create request: %v", err)
-	}
-
-	req.Header.Set("Content-Type", writer.FormDataContentType())
-
-	if apiKey := GetAPIKey(); apiKey != "" {
-		req.Header.Set("Authorization", "Bearer "+apiKey)
-	}
-
-	client := NewHTTPClient(5 * time.Minute)
-	resp, err := client.Do(req)
-	if err != nil {
-		t.Fatalf("upload failed: %v", err)
-	}
-	defer resp.Body.Close()
-
-	var uploadResult map[string]interface{}
-	body, _ := io.ReadAll(resp.Body)
-	if err := DecodeJSON(body, &uploadResult); err != nil {
-		t.Fatalf("failed to decode upload response: %v", err)
-	}
-
-	cid := uploadResult["cid"].(string)
-
-	// Pin the file
-	pinReq := &HTTPRequest{
-		Method: http.MethodPost,
-		URL:    GetGatewayURL() + "/v1/storage/pin",
-		Body: map[string]interface{}{
-			"cid":  cid,
-			"name": "pinned-file",
-		},
-	}
-
-	body2, status, err := pinReq.Do(ctx)
-	if err != nil {
-		t.Fatalf("pin failed: %v", err)
-	}
-
-	if status != http.StatusOK {
-		t.Fatalf("expected status 200, got %d: %s", status, string(body2))
-	}
-
-	var pinResult map[string]interface{}
-	if err := DecodeJSON(body2, &pinResult); err != nil {
-		t.Fatalf("failed to decode pin response: %v", err)
-	}
-
-	if pinResult["cid"] != cid {
-		t.Fatalf("expected cid %s, got %v", cid, pinResult["cid"])
-	}
-
-	// Unpin the file
-	unpinReq := &HTTPRequest{
-		Method: http.MethodDelete,
-		URL:    GetGatewayURL() + "/v1/storage/unpin/" + cid,
-	}
-
-	body3, status, err := unpinReq.Do(ctx)
-	if err != nil {
-		t.Fatalf("unpin failed: %v", err)
-	}
-
-	if status != http.StatusOK {
-		t.Fatalf("expected status 200, got %d: %s", status, string(body3))
-	}
-}
-
-func TestStorage_Status(t *testing.T) {
-	SkipIfMissingGateway(t)
-
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
-	defer cancel()
-
-	content := []byte("test content for status")
-
-	// Upload file first
-	var buf bytes.Buffer
-	writer := multipart.NewWriter(&buf)
-
-	part, err := writer.CreateFormFile("file", "status-test.txt")
-	if err != nil {
-		t.Fatalf("failed to create form file: %v", err)
-	}
-
-	if _, err := io.Copy(part, bytes.NewReader(content)); err != nil {
-		t.Fatalf("failed to copy data: %v", err)
-	}
-
-	if err := writer.Close(); err != nil {
-		t.Fatalf("failed to close writer: %v", err)
-	}
-
-	// Create upload request
-	req, err := http.NewRequestWithContext(ctx, http.MethodPost, GetGatewayURL()+"/v1/storage/upload", &buf)
-	if err != nil {
-		t.Fatalf("failed to create request: %v", err)
-	}
-
-	req.Header.Set("Content-Type", writer.FormDataContentType())
-
-	if apiKey := GetAPIKey(); apiKey != "" {
-		req.Header.Set("Authorization", "Bearer "+apiKey)
-	}
-
-	client := NewHTTPClient(5 * time.Minute)
-	resp, err := client.Do(req)
-	if err != nil {
-		t.Fatalf("upload failed: %v", err)
-	}
-	defer resp.Body.Close()
-
-	var uploadResult map[string]interface{}
-	body, _ := io.ReadAll(resp.Body)
-	if err := DecodeJSON(body, &uploadResult); err != nil {
-		t.Fatalf("failed to decode upload response: %v", err)
-	}
-
-	cid := uploadResult["cid"].(string)
-
-	// Get status
-	statusReq := &HTTPRequest{
-		Method: http.MethodGet,
-		URL:    GetGatewayURL() + "/v1/storage/status/" + cid,
-	}
-
-	statusBody, status, err := statusReq.Do(ctx)
-	if err != nil {
-		t.Fatalf("status request failed: %v", err)
-	}
-
-	if status != http.StatusOK {
-		t.Fatalf("expected status 200, got %d", status)
-	}
-
-	var statusResult map[string]interface{}
-	if err := DecodeJSON(statusBody, &statusResult); err != nil {
-		t.Fatalf("failed to decode status response: %v", err)
-	}
-
-	if statusResult["cid"] != cid {
-		t.Fatalf("expected cid %s, got %v", cid, statusResult["cid"])
-	}
-}
-
-func TestStorage_InvalidCID(t *testing.T) {
-	SkipIfMissingGateway(t)
-
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-
-	statusReq := &HTTPRequest{
-		Method: http.MethodGet,
-		URL:    GetGatewayURL() + "/v1/storage/status/QmInvalidCID123456789",
-	}
-
-	_, status, err := statusReq.Do(ctx)
-	if err != nil {
-		t.Fatalf("status request failed: %v", err)
-	}
-
-	if status != http.StatusNotFound {
-		t.Logf("warning: expected status 404 for invalid CID, got %d", status)
-	}
-}
-
-func TestStorage_GetByteRange(t *testing.T) {
-	SkipIfMissingGateway(t)
-
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
-	defer cancel()
-
-	content := []byte("0123456789abcdefghijklmnopqrstuvwxyz")
-
-	// Upload file first
-	var buf bytes.Buffer
-	writer := multipart.NewWriter(&buf)
-
-	part, err := writer.CreateFormFile("file", "range-test.txt")
-	if err != nil {
-		t.Fatalf("failed to create form file: %v", err)
-	}
-
-	if _, err := io.Copy(part, bytes.NewReader(content)); err != nil {
-		t.Fatalf("failed to copy data: %v", err)
-	}
-
-	if err := writer.Close(); err != nil {
-		t.Fatalf("failed to close writer: %v", err)
-	}
-
-	// Create upload request
-	req, err := http.NewRequestWithContext(ctx, http.MethodPost, GetGatewayURL()+"/v1/storage/upload", &buf)
-	if err != nil {
-		t.Fatalf("failed to create request: %v", err)
-	}
-
-	req.Header.Set("Content-Type", writer.FormDataContentType())
-
-	if apiKey := GetAPIKey(); apiKey != "" {
-		req.Header.Set("Authorization", "Bearer "+apiKey)
-	}
-
-	client := NewHTTPClient(5 * time.Minute)
-	resp, err := client.Do(req)
-	if err != nil {
-		t.Fatalf("upload failed: %v", err)
-	}
-	defer resp.Body.Close()
-
-	var uploadResult map[string]interface{}
-	body, _ := io.ReadAll(resp.Body)
-	if err := DecodeJSON(body, &uploadResult); err != nil {
-		t.Fatalf("failed to decode upload response: %v", err)
-	}
-
-	cid := uploadResult["cid"].(string)
-
-	// Get full content
-	getReq, err := http.NewRequestWithContext(ctx, http.MethodGet, GetGatewayURL()+"/v1/storage/get/"+cid, nil)
-	if err != nil {
-		t.Fatalf("failed to create get request: %v", err)
-	}
-
-	if apiKey := GetAPIKey(); apiKey != "" {
-		getReq.Header.Set("Authorization", "Bearer "+apiKey)
-	}
-
-	resp, err = client.Do(getReq)
-	if err != nil {
-		t.Fatalf("get request failed: %v", err)
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK {
-		t.Fatalf("expected status 200, got %d", resp.StatusCode)
-	}
-
-	retrievedContent, err := io.ReadAll(resp.Body)
-	if err != nil {
-		t.Fatalf("failed to read response body: %v", err)
-	}
-
-	if !bytes.Equal(retrievedContent, content) {
-		t.Fatalf("content mismatch: expected %q, got %q", string(content), string(retrievedContent))
-	}
-}

examples/basic_usage.go

@@ -0,0 +1,151 @@
+package main
+
+import (
+	"context"
+	"log"
+	"time"
+
+	"github.com/DeBrosOfficial/network/pkg/client"
+)
+
+func main() {
+	// Create client configuration
+	config := client.DefaultClientConfig("example_app")
+	config.BootstrapPeers = []string{
+		"/ip4/127.0.0.1/tcp/4001/p2p/QmBootstrap1",
+	}
+
+	// Create network client
+	networkClient, err := client.NewClient(config)
+	if err != nil {
+		log.Fatalf("Failed to create network client: %v", err)
+	}
+
+	// Connect to network
+	if err := networkClient.Connect(); err != nil {
+		log.Fatalf("Failed to connect to network: %v", err)
+	}
+	defer networkClient.Disconnect()
+
+	log.Printf("Connected to network successfully!")
+
+	// Example: Database operations
+	demonstrateDatabase(networkClient)
+
+	// Example: Pub/Sub messaging
+	demonstratePubSub(networkClient)
+
+	// Example: Network information
+	demonstrateNetworkInfo(networkClient)
+
+	log.Printf("Example completed successfully!")
+}
+
+func demonstrateDatabase(client client.NetworkClient) {
+	ctx := context.Background()
+	db := client.Database()
+
+	log.Printf("=== Database Operations ===")
+
+	// Create a table
+	schema := `
+		CREATE TABLE IF NOT EXISTS messages (
+			id INTEGER PRIMARY KEY,
+			content TEXT NOT NULL,
+			timestamp DATETIME DEFAULT CURRENT_TIMESTAMP
+		)
+	`
+	if err := db.CreateTable(ctx, schema); err != nil {
+		log.Printf("Error creating table: %v", err)
+		return
+	}
+	log.Printf("Table created successfully")
+
+	// Insert some data
+	insertSQL := "INSERT INTO messages (content) VALUES (?)"
+	result, err := db.Query(ctx, insertSQL, "Hello, distributed world!")
+	if err != nil {
+		log.Printf("Error inserting data: %v", err)
+		return
+	}
+	log.Printf("Data inserted, result: %+v", result)
+
+	// Query data
+	selectSQL := "SELECT * FROM messages"
+	result, err = db.Query(ctx, selectSQL)
+	if err != nil {
+		log.Printf("Error querying data: %v", err)
+		return
+	}
+	log.Printf("Query result: %+v", result)
+}
+
+func demonstratePubSub(client client.NetworkClient) {
+	ctx := context.Background()
+	pubsub := client.PubSub()
+
+	log.Printf("=== Pub/Sub Operations ===")
+
+	// Subscribe to a topic
+	topic := "notifications"
+	handler := func(topic string, data []byte) error {
+		log.Printf("Received message on topic '%s': %s", topic, string(data))
+		return nil
+	}
+
+	if err := pubsub.Subscribe(ctx, topic, handler); err != nil {
+		log.Printf("Error subscribing: %v", err)
+		return
+	}
+	log.Printf("Subscribed to topic: %s", topic)
+
+	// Publish a message
+	message := []byte("Hello from pub/sub!")
+	if err := pubsub.Publish(ctx, topic, message); err != nil {
+		log.Printf("Error publishing: %v", err)
+		return
+	}
+	log.Printf("Message published")
+
+	// Wait a bit for message delivery
+	time.Sleep(time.Millisecond * 100)
+
+	// List topics
+	topics, err := pubsub.ListTopics(ctx)
+	if err != nil {
+		log.Printf("Error listing topics: %v", err)
+		return
+	}
+	log.Printf("Subscribed topics: %v", topics)
+}
+
+func demonstrateNetworkInfo(client client.NetworkClient) {
+	ctx := context.Background()
+	network := client.Network()
+
+	log.Printf("=== Network Information ===")
+
+	// Get network status
+	status, err := network.GetStatus(ctx)
+	if err != nil {
+		log.Printf("Error getting status: %v", err)
+		return
+	}
+	log.Printf("Network status: %+v", status)
+
+	// Get peers
+	peers, err := network.GetPeers(ctx)
+	if err != nil {
+		log.Printf("Error getting peers: %v", err)
+		return
+	}
+	log.Printf("Connected peers: %+v", peers)
+
+	// Get client health
+	health, err := client.Health()
+	if err != nil {
+		log.Printf("Error getting health: %v", err)
+		return
+	}
+	log.Printf("Client health: %+v", health)
+}

examples/sdk-typescript/README.md

@@ -0,0 +1,23 @@
+# DeBros Gateway TypeScript SDK (Minimal Example)
+
+Minimal, dependency-light wrapper around the HTTP Gateway.
+
+Usage:
+
+```bash
+npm i
+export GATEWAY_BASE_URL=http://127.0.0.1:6001
+export GATEWAY_API_KEY=your_api_key
+```
+
+```ts
+import { GatewayClient } from './src/client';
+
+const c = new GatewayClient(process.env.GATEWAY_BASE_URL!, process.env.GATEWAY_API_KEY!);
+await c.createTable('CREATE TABLE users (id INTEGER PRIMARY KEY, name TEXT)');
+await c.transaction([
+  'INSERT INTO users (id,name) VALUES (1,\'Alice\')'
+]);
+const res = await c.query('SELECT name FROM users WHERE id = ?', [1]);
+console.log(res.rows);
+```

examples/sdk-typescript/package.json

@@ -0,0 +1,17 @@
+{
+  "name": "debros-gateway-sdk",
+  "version": "0.1.0",
+  "private": true,
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "scripts": {
+    "build": "tsc -p tsconfig.json"
+  },
+  "dependencies": {
+    "isomorphic-ws": "^5.0.0"
+  },
+  "devDependencies": {
+    "typescript": "^5.5.4"
+  }
+}

examples/sdk-typescript/src/client.ts

@@ -0,0 +1,154 @@
+import WebSocket from "isomorphic-ws";
+
+export class GatewayClient {
+  constructor(
+    private baseUrl: string,
+    private apiKey: string,
+    private http = fetch
+  ) {}
+
+  private headers(json = true): Record<string, string> {
+    const h: Record<string, string> = { "X-API-Key": this.apiKey };
+    if (json) h["Content-Type"] = "application/json";
+    return h;
+  }
+
+  // Database
+  async createTable(schema: string): Promise<void> {
+    const r = await this.http(`${this.baseUrl}/v1/rqlite/create-table`, {
+      method: "POST",
+      headers: this.headers(),
+      body: JSON.stringify({ schema }),
+    });
+    if (!r.ok) throw new Error(`createTable failed: ${r.status}`);
+  }
+
+  async dropTable(table: string): Promise<void> {
+    const r = await this.http(`${this.baseUrl}/v1/rqlite/drop-table`, {
+      method: "POST",
+      headers: this.headers(),
+      body: JSON.stringify({ table }),
+    });
+    if (!r.ok) throw new Error(`dropTable failed: ${r.status}`);
+  }
+
+  async query<T = any>(sql: string, args: any[] = []): Promise<{ rows: T[] }> {
+    const r = await this.http(`${this.baseUrl}/v1/rqlite/query`, {
+      method: "POST",
+      headers: this.headers(),
+      body: JSON.stringify({ sql, args }),
+    });
+    if (!r.ok) throw new Error(`query failed: ${r.status}`);
+    return r.json();
+  }
+
+  async transaction(statements: string[]): Promise<void> {
+    const r = await this.http(`${this.baseUrl}/v1/rqlite/transaction`, {
+      method: "POST",
+      headers: this.headers(),
+      body: JSON.stringify({ statements }),
+    });
+    if (!r.ok) throw new Error(`transaction failed: ${r.status}`);
+  }
+
+  async schema(): Promise<any> {
+    const r = await this.http(`${this.baseUrl}/v1/rqlite/schema`, {
+      headers: this.headers(false),
+    });
+    if (!r.ok) throw new Error(`schema failed: ${r.status}`);
+    return r.json();
+  }
+
+  // Storage
+  async put(key: string, value: Uint8Array | string): Promise<void> {
+    const body =
+      typeof value === "string" ? new TextEncoder().encode(value) : value;
+    const r = await this.http(
+      `${this.baseUrl}/v1/storage/put?key=${encodeURIComponent(key)}`,
+      {
+        method: "POST",
+        headers: { "X-API-Key": this.apiKey },
+        body,
+      }
+    );
+    if (!r.ok) throw new Error(`put failed: ${r.status}`);
+  }
+
+  async get(key: string): Promise<Uint8Array> {
+    const r = await this.http(
+      `${this.baseUrl}/v1/storage/get?key=${encodeURIComponent(key)}`,
+      {
+        headers: { "X-API-Key": this.apiKey },
+      }
+    );
+    if (!r.ok) throw new Error(`get failed: ${r.status}`);
+    const buf = new Uint8Array(await r.arrayBuffer());
+    return buf;
+  }
+
+  async exists(key: string): Promise<boolean> {
+    const r = await this.http(
+      `${this.baseUrl}/v1/storage/exists?key=${encodeURIComponent(key)}`,
+      {
+        headers: this.headers(false),
+      }
+    );
+    if (!r.ok) throw new Error(`exists failed: ${r.status}`);
+    const j = await r.json();
+    return !!j.exists;
+  }
+
+  async list(prefix = ""): Promise<string[]> {
+    const r = await this.http(
+      `${this.baseUrl}/v1/storage/list?prefix=${encodeURIComponent(prefix)}`,
+      {
+        headers: this.headers(false),
+      }
+    );
+    if (!r.ok) throw new Error(`list failed: ${r.status}`);
+    const j = await r.json();
+    return j.keys || [];
+  }
+
+  async delete(key: string): Promise<void> {
+    const r = await this.http(`${this.baseUrl}/v1/storage/delete`, {
+      method: "POST",
+      headers: this.headers(),
+      body: JSON.stringify({ key }),
+    });
+    if (!r.ok) throw new Error(`delete failed: ${r.status}`);
+  }
+
+  // PubSub (minimal)
+  subscribe(
+    topic: string,
+    onMessage: (data: Uint8Array) => void
+  ): { close: () => void } {
+    const url = new URL(`${this.baseUrl.replace(/^http/, "ws")}/v1/pubsub/ws`);
+    url.searchParams.set("topic", topic);
+    const ws = new WebSocket(url.toString(), {
+      headers: { "X-API-Key": this.apiKey },
+    } as any);
+    ws.binaryType = "arraybuffer";
+    ws.onmessage = (ev: any) => {
+      const data =
+        ev.data instanceof ArrayBuffer
+          ? new Uint8Array(ev.data)
+          : new TextEncoder().encode(String(ev.data));
+      onMessage(data);
+    };
+    return { close: () => ws.close() };
+  }
+
+  async publish(topic: string, data: Uint8Array | string): Promise<void> {
+    const bytes =
+      typeof data === "string" ? new TextEncoder().encode(data) : data;
+    const b64 = Buffer.from(bytes).toString("base64");
+    const r = await this.http(`${this.baseUrl}/v1/pubsub/publish`, {
+      method: "POST",
+      headers: this.headers(),
+      body: JSON.stringify({ topic, data_base64: b64 }),
+    });
+    if (!r.ok) throw new Error(`publish failed: ${r.status}`);
+  }
+}

examples/sdk-typescript/tsconfig.json

@@ -0,0 +1,12 @@
+{
+  "compilerOptions": {
+    "target": "ES2020",
+    "module": "ES2020",
+    "declaration": true,
+    "outDir": "dist",
+    "rootDir": "src",
+    "strict": true,
+    "moduleResolution": "Node"
+  },
+  "include": ["src/**/*"]
+}

go.mod

@@ -5,66 +5,38 @@ go 1.23.8
 toolchain go1.24.1
 
 require (
-	github.com/charmbracelet/bubbles v0.20.0
-	github.com/charmbracelet/bubbletea v1.2.4
-	github.com/charmbracelet/lipgloss v1.0.0
 	github.com/ethereum/go-ethereum v1.13.14
-	github.com/go-chi/chi/v5 v5.2.3
 	github.com/gorilla/websocket v1.5.3
 	github.com/libp2p/go-libp2p v0.41.1
 	github.com/libp2p/go-libp2p-pubsub v0.14.2
 	github.com/mackerelio/go-osstat v0.2.6
-	github.com/mattn/go-sqlite3 v1.14.32
 	github.com/multiformats/go-multiaddr v0.15.0
-	github.com/olric-data/olric v0.7.0
 	github.com/rqlite/gorqlite v0.0.0-20250609141355-ac86a4a1c9a8
 	go.uber.org/zap v1.27.0
-	golang.org/x/crypto v0.40.0
 	golang.org/x/net v0.42.0
-	gopkg.in/yaml.v2 v2.4.0
 	gopkg.in/yaml.v3 v3.0.1
 )
 
 require (
-	github.com/RoaringBitmap/roaring v1.9.4 // indirect
-	github.com/armon/go-metrics v0.4.1 // indirect
-	github.com/atotto/clipboard v0.1.4 // indirect
-	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
 	github.com/benbjohnson/clock v1.3.5 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
-	github.com/bits-and-blooms/bitset v1.22.0 // indirect
 	github.com/btcsuite/btcd/btcec/v2 v2.2.0 // indirect
-	github.com/buraksezer/consistent v0.10.0 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
-	github.com/charmbracelet/x/ansi v0.4.5 // indirect
-	github.com/charmbracelet/x/term v0.2.1 // indirect
 	github.com/containerd/cgroups v1.1.0 // indirect
 	github.com/coreos/go-systemd/v22 v22.5.0 // indirect
 	github.com/davidlazar/go-crypto v0.0.0-20200604182044-b73af7476f6c // indirect
 	github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0 // indirect
-	github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
 	github.com/docker/go-units v0.5.0 // indirect
 	github.com/elastic/gosigar v0.14.3 // indirect
-	github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect
 	github.com/flynn/noise v1.1.0 // indirect
 	github.com/francoispqt/gojay v1.2.13 // indirect
 	github.com/go-task/slim-sprig/v3 v3.0.0 // indirect
 	github.com/godbus/dbus/v5 v5.1.0 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
-	github.com/google/btree v1.1.3 // indirect
 	github.com/google/gopacket v1.1.19 // indirect
 	github.com/google/pprof v0.0.0-20250208200701-d0013a598941 // indirect
 	github.com/google/uuid v1.6.0 // indirect
-	github.com/hashicorp/errwrap v1.1.0 // indirect
-	github.com/hashicorp/go-immutable-radix v1.3.1 // indirect
-	github.com/hashicorp/go-metrics v0.5.4 // indirect
-	github.com/hashicorp/go-msgpack/v2 v2.1.3 // indirect
-	github.com/hashicorp/go-multierror v1.1.1 // indirect
-	github.com/hashicorp/go-sockaddr v1.0.7 // indirect
-	github.com/hashicorp/golang-lru v1.0.2 // indirect
 	github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
-	github.com/hashicorp/logutils v1.0.0 // indirect
-	github.com/hashicorp/memberlist v0.5.3 // indirect
 	github.com/holiman/uint256 v1.2.4 // indirect
 	github.com/huin/goupnp v1.3.0 // indirect
 	github.com/ipfs/go-cid v0.5.0 // indirect
@@ -81,20 +53,13 @@ require (
 	github.com/libp2p/go-netroute v0.2.2 // indirect
 	github.com/libp2p/go-reuseport v0.4.0 // indirect
 	github.com/libp2p/go-yamux/v5 v5.0.0 // indirect
-	github.com/lucasb-eyer/go-colorful v1.2.0 // indirect
 	github.com/marten-seemann/tcp v0.0.0-20210406111302-dfbc87cc63fd // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
-	github.com/mattn/go-localereader v0.0.1 // indirect
-	github.com/mattn/go-runewidth v0.0.16 // indirect
 	github.com/miekg/dns v1.1.66 // indirect
 	github.com/mikioh/tcpinfo v0.0.0-20190314235526-30a79bb1804b // indirect
 	github.com/mikioh/tcpopt v0.0.0-20190314235656-172688c1accc // indirect
 	github.com/minio/sha256-simd v1.0.1 // indirect
 	github.com/mr-tron/base58 v1.2.0 // indirect
-	github.com/mschoch/smat v0.2.0 // indirect
-	github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 // indirect
-	github.com/muesli/cancelreader v0.2.2 // indirect
-	github.com/muesli/termenv v0.15.2 // indirect
 	github.com/multiformats/go-base32 v0.1.0 // indirect
 	github.com/multiformats/go-base36 v0.2.0 // indirect
 	github.com/multiformats/go-multiaddr-dns v0.4.1 // indirect
@@ -136,21 +101,14 @@ require (
 	github.com/quic-go/quic-go v0.50.1 // indirect
 	github.com/quic-go/webtransport-go v0.8.1-0.20241018022711-4ac2c9250e66 // indirect
 	github.com/raulk/go-watchdog v1.3.0 // indirect
-	github.com/redis/go-redis/v9 v9.8.0 // indirect
-	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/rogpeppe/go-internal v1.13.1 // indirect
-	github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529 // indirect
 	github.com/spaolacci/murmur3 v1.1.0 // indirect
-	github.com/tidwall/btree v1.7.0 // indirect
-	github.com/tidwall/match v1.1.1 // indirect
-	github.com/tidwall/redcon v1.6.2 // indirect
-	github.com/vmihailenco/msgpack/v5 v5.4.1 // indirect
-	github.com/vmihailenco/tagparser/v2 v2.0.0 // indirect
 	github.com/wlynxg/anet v0.0.5 // indirect
 	go.uber.org/dig v1.18.0 // indirect
 	go.uber.org/fx v1.23.0 // indirect
 	go.uber.org/mock v0.5.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
+	golang.org/x/crypto v0.40.0 // indirect
 	golang.org/x/exp v0.0.0-20250718183923-645b1fa84792 // indirect
 	golang.org/x/mod v0.26.0 // indirect
 	golang.org/x/sync v0.16.0 // indirect

go.sum

@@ -8,59 +8,22 @@ dmitri.shuralyov.com/service/change v0.0.0-20181023043359-a85b471d5412/go.mod h1
 dmitri.shuralyov.com/state v0.0.0-20180228185332-28bcc343414c/go.mod h1:0PRwlb0D6DFvNNtx+9ybjezNCa8XF0xaYcETyp6rHWU=
 git.apache.org/thrift.git v0.0.0-20180902110319-2566ecd5d999/go.mod h1:fPE2ZNJGynbRyZ4dJvy6G277gSllfV2HJqblrnkyeyg=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
-github.com/DataDog/datadog-go v3.2.0+incompatible/go.mod h1:LButxg5PwREeZtORoXG3tL4fMGNddJ+vMq1mwgfaqoQ=
-github.com/RoaringBitmap/roaring v1.9.4 h1:yhEIoH4YezLYT04s1nHehNO64EKFTop/wBhxv2QzDdQ=
-github.com/RoaringBitmap/roaring v1.9.4/go.mod h1:6AXUsoIEzDTFFQCe1RbGA6uFONMhvejWj5rqITANK90=
-github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
-github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
-github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
-github.com/alecthomas/units v0.0.0-20190717042225-c3de453c63f4/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
-github.com/alecthomas/units v0.0.0-20190924025748-f65c72e2690d/go.mod h1:rBZYJk541a8SKzHPHnH3zbiI+7dagKZ0cgpgrD7Fyho=
 github.com/anmitsu/go-shlex v0.0.0-20161002113705-648efa622239/go.mod h1:2FmKhYUyUczH0OGQWaF5ceTx0UBShxjsH6f8oGKYe2c=
-github.com/armon/go-metrics v0.4.1 h1:hR91U9KYmb6bLBYLQjyM+3j+rcd/UhE+G78SFnF8gJA=
-github.com/armon/go-metrics v0.4.1/go.mod h1:E6amYzXo6aW1tqzoZGT755KkbgrJsSdpwZ+3JqfkOG4=
-github.com/atotto/clipboard v0.1.4 h1:EH0zSVneZPSuFR11BlR9YppQTVDbh5+16AmcJi4g1z4=
-github.com/atotto/clipboard v0.1.4/go.mod h1:ZY9tmq7sm5xIbd9bOK4onWV4S6X0u6GY7Vn0Yu86PYI=
-github.com/aymanbagabas/go-osc52/v2 v2.0.1 h1:HwpRHbFMcZLEVr42D4p7XBqjyuxQH5SMiErDT4WkJ2k=
-github.com/aymanbagabas/go-osc52/v2 v2.0.1/go.mod h1:uYgXzlJ7ZpABp8OJ+exZzJJhRNQ2ASbcXHWsFqH8hp8=
 github.com/benbjohnson/clock v1.3.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
 github.com/benbjohnson/clock v1.3.5 h1:VvXlSJBzZpA/zum6Sj74hxwYI2DIxRWuNIoXAzHZz5o=
 github.com/benbjohnson/clock v1.3.5/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
 github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
-github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
-github.com/bits-and-blooms/bitset v1.12.0/go.mod h1:7hO7Gc7Pp1vODcmWvKMRA9BNmbv6a/7QIWpPxHddWR8=
-github.com/bits-and-blooms/bitset v1.22.0 h1:Tquv9S8+SGaS3EhyA+up3FXzmkhxPGjQQCkcs2uw7w4=
-github.com/bits-and-blooms/bitset v1.22.0/go.mod h1:7hO7Gc7Pp1vODcmWvKMRA9BNmbv6a/7QIWpPxHddWR8=
 github.com/bradfitz/go-smtpd v0.0.0-20170404230938-deb6d6237625/go.mod h1:HYsPBTaaSFSlLx/70C2HPIMNZpVV8+vt/A+FMnYP11g=
-github.com/bsm/ginkgo/v2 v2.12.0 h1:Ny8MWAHyOepLGlLKYmXG4IEkioBysk6GpaRTLC8zwWs=
-github.com/bsm/ginkgo/v2 v2.12.0/go.mod h1:SwYbGRRDovPVboqFv0tPTcG1sN61LM1Z4ARdbAV9g4c=
-github.com/bsm/gomega v1.27.10 h1:yeMWxP2pV2fG3FgAODIY8EiRE3dy0aeFYt4l7wh6yKA=
-github.com/bsm/gomega v1.27.10/go.mod h1:JyEr/xRbxbtgWNi8tIEVPUYZ5Dzef52k01W3YH0H+O0=
 github.com/btcsuite/btcd/btcec/v2 v2.2.0 h1:fzn1qaOt32TuLjFlkzYSsBC35Q3KUjT1SwPxiMSCF5k=
 github.com/btcsuite/btcd/btcec/v2 v2.2.0/go.mod h1:U7MHm051Al6XmscBQ0BoNydpOTsFAn707034b5nY8zU=
 github.com/btcsuite/btcd/chaincfg/chainhash v1.0.1 h1:q0rUy8C/TYNBQS1+CGKw68tLOFYSNEs0TFnxxnS9+4U=
 github.com/btcsuite/btcd/chaincfg/chainhash v1.0.1/go.mod h1:7SFka0XMvUgj3hfZtydOrQY2mwhPclbT2snogU7SQQc=
 github.com/buger/jsonparser v0.0.0-20181115193947-bf1c66bbce23/go.mod h1:bbYlZJ7hK1yFx9hf58LP0zeX7UjIGs20ufpu3evjr+s=
-github.com/buraksezer/consistent v0.10.0 h1:hqBgz1PvNLC5rkWcEBVAL9dFMBWz6I0VgUCW25rrZlU=
-github.com/buraksezer/consistent v0.10.0/go.mod h1:6BrVajWq7wbKZlTOUPs/XVfR8c0maujuPowduSpZqmw=
-github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/charmbracelet/bubbles v0.20.0 h1:jSZu6qD8cRQ6k9OMfR1WlM+ruM8fkPWkHvQWD9LIutE=
-github.com/charmbracelet/bubbles v0.20.0/go.mod h1:39slydyswPy+uVOHZ5x/GjwVAFkCsV8IIVy+4MhzwwU=
-github.com/charmbracelet/bubbletea v1.2.4 h1:KN8aCViA0eps9SCOThb2/XPIlea3ANJLUkv3KnQRNCE=
-github.com/charmbracelet/bubbletea v1.2.4/go.mod h1:Qr6fVQw+wX7JkWWkVyXYk/ZUQ92a6XNekLXa3rR18MM=
-github.com/charmbracelet/lipgloss v1.0.0 h1:O7VkGDvqEdGi93X+DeqsQ7PKHDgtQfF8j8/O2qFMQNg=
-github.com/charmbracelet/lipgloss v1.0.0/go.mod h1:U5fy9Z+C38obMs+T+tJqst9VGzlOYGj4ri9reL3qUlo=
-github.com/charmbracelet/x/ansi v0.4.5 h1:LqK4vwBNaXw2AyGIICa5/29Sbdq58GbGdFngSexTdRM=
-github.com/charmbracelet/x/ansi v0.4.5/go.mod h1:dk73KoMTT5AX5BsX0KrqhsTqAnhZZoCBjs7dGWp4Ktw=
-github.com/charmbracelet/x/term v0.2.1 h1:AQeHeLZ1OqSXhrAWpYUtZyX1T3zVxfpZuEQMIQaGIAQ=
-github.com/charmbracelet/x/term v0.2.1/go.mod h1:oQ4enTYFV7QN4m0i9mzHrViD7TQKvNEEkHUMCmsxdUg=
 github.com/cilium/ebpf v0.2.0/go.mod h1:To2CFviqOWL/M0gIMsvSMlqe7em/l1ALkX1PyjrX2Qs=
-github.com/circonus-labs/circonus-gometrics v2.3.1+incompatible/go.mod h1:nmEj6Dob7S7YxXgwXpfOuvO54S+tGdZdw9fuRZt25Ag=
-github.com/circonus-labs/circonusllhist v0.1.3/go.mod h1:kMXHVDlOchFAehlya5ePtbp5jckzBHf4XRpQvBOLI+I=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
 github.com/containerd/cgroups v0.0.0-20201119153540-4cbc285b3327/go.mod h1:ZJeTFisyysqgcCdecO57Dj79RfL0LNeGiFUqLYQRYLE=
 github.com/containerd/cgroups v1.1.0 h1:v8rEWFl6EoqHB+swVNjVoCJE8o3jX7e8nqBGPLaDFBM=
@@ -80,8 +43,6 @@ github.com/decred/dcrd/crypto/blake256 v1.1.0 h1:zPMNGQCm0g4QTY27fOCorQW7EryeQ/U
 github.com/decred/dcrd/crypto/blake256 v1.1.0/go.mod h1:2OfgNZ5wDpcsFmHmCK5gZTPcCXqlm2ArzUIkw9czNJo=
 github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0 h1:NMZiJj8QnKe1LgsbDayM4UoHwbvwDRwnI3hwNaAHRnc=
 github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0/go.mod h1:ZXNYxsqcloTdSy/rNShjYzMhyjf0LaoftYK0p+A3h40=
-github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f h1:lO4WD4F/rVNCu3HqELle0jiPLLBs70cWOduZpkS1E78=
-github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f/go.mod h1:cuUVRXasLTGF7a8hSLbxyZXjz+1KgoB3wDUb6vlszIc=
 github.com/docker/go-units v0.4.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
 github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
 github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
@@ -89,8 +50,6 @@ github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25Kn
 github.com/elastic/gosigar v0.12.0/go.mod h1:iXRIGg2tLnu7LBdpqzyQfGDEidKCfWcCMS0WKyPWoMs=
 github.com/elastic/gosigar v0.14.3 h1:xwkKwPia+hSfg9GqrCUKYdId102m9qTJIIr7egmK/uo=
 github.com/elastic/gosigar v0.14.3/go.mod h1:iXRIGg2tLnu7LBdpqzyQfGDEidKCfWcCMS0WKyPWoMs=
-github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f h1:Y/CXytFA4m6baUTXGLOoWe4PQhGxaX0KpnayAqC48p4=
-github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f/go.mod h1:vw97MGsxSvLiUE2X8qFplwetxpGLQrlU1Q9AUEIzCaM=
 github.com/ethereum/go-ethereum v1.13.14 h1:EwiY3FZP94derMCIam1iW4HFVrSgIcpsu0HwTQtm6CQ=
 github.com/ethereum/go-ethereum v1.13.14/go.mod h1:TN8ZiHrdJwSe8Cb6x+p0hs5CxhJZPbqB7hHkaUXcmIU=
 github.com/flynn/go-shlex v0.0.0-20150515145356-3f9db97f8568/go.mod h1:xEzjJPgXI435gkrCt3MPfRiAkVrwSbHsst4LCFVfpJc=
@@ -101,18 +60,9 @@ github.com/francoispqt/gojay v1.2.13/go.mod h1:ehT5mTG4ua4581f1++1WLG0vPdaA9HaiD
 github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
 github.com/gliderlabs/ssh v0.1.1/go.mod h1:U7qILu1NlMHj9FlMhZLlkCdDnU1DBEAqr0aevW3Awn0=
-github.com/go-chi/chi/v5 v5.2.3 h1:WQIt9uxdsAbgIYgid+BpYc+liqQZGMHRaUwp0JUcvdE=
-github.com/go-chi/chi/v5 v5.2.3/go.mod h1:L2yAIGWB3H+phAw1NxKwWM+7eUH/lU8pOMm5hHcoops=
 github.com/go-errors/errors v1.0.1/go.mod h1:f4zRHt4oKfwPJE5k8C9vpYG+aDHdBFUsgrm6/TyX73Q=
-github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
-github.com/go-kit/kit v0.9.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
-github.com/go-kit/log v0.1.0/go.mod h1:zbhenjAZHb184qTLMA9ZjW7ThYL0H2mk7Q6pNt4vbaY=
-github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
-github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
-github.com/go-logfmt/logfmt v0.5.0/go.mod h1:wCYkCAKZfumFQihp8CzCvQ3paCTfi41vtzG1KdI/P7A=
 github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
 github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
-github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
 github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
 github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
 github.com/godbus/dbus/v5 v5.0.3/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
@@ -129,29 +79,13 @@ github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfb
 github.com/golang/mock v1.2.0/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
 github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
-github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
-github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
-github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=
-github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
-github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
-github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
 github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
-github.com/google/btree v1.1.3 h1:CVpQJjYgC4VbzxeGVHfvZrv1ctoYCAI8vbl07Fcxlyg=
-github.com/google/btree v1.1.3/go.mod h1:qOPhT0dTNdNzV6Z/lhRX0YXUafgPLFUh+gZMl761Gm4=
 github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
-github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
-github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
-github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/go-github v17.0.0+incompatible/go.mod h1:zLgOLi98H3fifZn+44m+umXrS52loVEgC2AApnigrVQ=
 github.com/google/go-querystring v1.0.0/go.mod h1:odCYkC5MyYFN7vkCjXpyrEuKhc/BUO6wN/zVPAxq5ck=
-github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/gopacket v1.1.19 h1:ves8RnFZPGiFnTS0uPQStjwru6uO6h+nlr9j6fL7kF8=
 github.com/google/gopacket v1.1.19/go.mod h1:iJ8V8n6KS+z2U1A8pUwu8bW5SyEMkXJB8Yo/Vo+TKTo=
 github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs=
@@ -167,33 +101,8 @@ github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aN
 github.com/gorilla/websocket v1.5.3/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
 github.com/gregjones/httpcache v0.0.0-20180305231024-9cad4c3443a7/go.mod h1:FecbI9+v66THATjSRHfNgh1IVFe/9kFxbXtjV0ctIMA=
 github.com/grpc-ecosystem/grpc-gateway v1.5.0/go.mod h1:RSKVYQBd5MCa4OVpNdGskqpgL2+G+NZTnrVHpWWfpdw=
-github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
-github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
-github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
-github.com/hashicorp/go-cleanhttp v0.5.0/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=
-github.com/hashicorp/go-immutable-radix v1.0.0/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60=
-github.com/hashicorp/go-immutable-radix v1.3.1 h1:DKHmCUm2hRBK510BaiZlwvpD40f8bJFeZnpfm2KLowc=
-github.com/hashicorp/go-immutable-radix v1.3.1/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60=
-github.com/hashicorp/go-metrics v0.5.4 h1:8mmPiIJkTPPEbAiV97IxdAGNdRdaWwVap1BU6elejKY=
-github.com/hashicorp/go-metrics v0.5.4/go.mod h1:CG5yz4NZ/AI/aQt9Ucm/vdBnbh7fvmv4lxZ350i+QQI=
-github.com/hashicorp/go-msgpack/v2 v2.1.3 h1:cB1w4Zrk0O3jQBTcFMKqYQWRFfsSQ/TYKNyUUVyCP2c=
-github.com/hashicorp/go-msgpack/v2 v2.1.3/go.mod h1:SjlwKKFnwBXvxD/I1bEcfJIBbEJ+MCUn39TxymNR5ZU=
-github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
-github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
-github.com/hashicorp/go-retryablehttp v0.5.3/go.mod h1:9B5zBasrRhHXnJnui7y6sL7es7NDiJgTc6Er0maI1Xs=
-github.com/hashicorp/go-sockaddr v1.0.7 h1:G+pTkSO01HpR5qCxg7lxfsFEZaG+C0VssTy/9dbT+Fw=
-github.com/hashicorp/go-sockaddr v1.0.7/go.mod h1:FZQbEYa1pxkQ7WLpyXJ6cbjpT8q0YgQaK/JakXqGyWw=
-github.com/hashicorp/go-uuid v1.0.0 h1:RS8zrF7PhGwyNPOtxSClXXj9HA8feRnJzgnI1RJCSnM=
-github.com/hashicorp/go-uuid v1.0.0/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
-github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
-github.com/hashicorp/golang-lru v1.0.2 h1:dV3g9Z/unq5DpblPpw+Oqcv4dU/1omnb4Ok8iPY6p1c=
-github.com/hashicorp/golang-lru v1.0.2/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4=
 github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
 github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
-github.com/hashicorp/logutils v1.0.0 h1:dLEQVugN8vlakKOUE3ihGLTZJRB4j+M2cdTm/ORI65Y=
-github.com/hashicorp/logutils v1.0.0/go.mod h1:QIAnNjmIWmVIIkWDTG1z5v++HQmx9WQRO+LraFDTW64=
-github.com/hashicorp/memberlist v0.5.3 h1:tQ1jOCypD0WvMemw/ZhhtH+PWpzcftQvgCorLu0hndk=
-github.com/hashicorp/memberlist v0.5.3/go.mod h1:h60o12SZn/ua/j0B6iKAZezA4eDaGsIuPO70eOaJ6WE=
 github.com/holiman/uint256 v1.2.4 h1:jUc4Nk8fm9jZabQuqr2JzednajVmBpC+oiTiXZJEApU=
 github.com/holiman/uint256 v1.2.4/go.mod h1:EOMSn4q6Nyt9P6efbI3bueV4e1b3dGlUCXeiRV4ng7E=
 github.com/huin/goupnp v1.3.0 h1:UvLUlWDNpoUdYzb2TCn+MuTWtcjXKSza2n6CBdQ0xXc=
@@ -207,14 +116,8 @@ github.com/jackpal/go-nat-pmp v1.0.2/go.mod h1:QPH045xvCAeXUZOxsnwmrtiCoxIr9eob+
 github.com/jbenet/go-temp-err-catcher v0.1.0 h1:zpb3ZH6wIE8Shj2sKS+khgRvf7T7RABoLk/+KKHggpk=
 github.com/jbenet/go-temp-err-catcher v0.1.0/go.mod h1:0kJRvmDZXNMIiJirNPEYfhpPwbGVtZVWC34vc5WLsDk=
 github.com/jellevandenhooff/dkim v0.0.0-20150330215556-f50fe3d243e1/go.mod h1:E0B/fFc00Y+Rasa88328GlI/XbtyysCtTHZS8h7IrBU=
-github.com/jpillora/backoff v1.0.0/go.mod h1:J/6gKK9jxlEcS3zixgDgUAsiuZ7yrSoa/FX5e0EB2j4=
 github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
-github.com/json-iterator/go v1.1.9/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
-github.com/json-iterator/go v1.1.10/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
-github.com/json-iterator/go v1.1.11/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
 github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1:6v2b51hI/fHJwM22ozAgKL4VKDeJcHhJFhtBdhmNjmU=
-github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w=
-github.com/julienschmidt/httprouter v1.3.0/go.mod h1:JR6WtHb+2LUe8TCKY3cZOxFyyO8IZAc4RVcycCCAKdM=
 github.com/kisielk/errcheck v1.2.0/go.mod h1:/BMXB+zMLi60iA8Vv6Ksmxu/1UDYcXs4uQLJ+jE2L00=
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
@@ -222,11 +125,8 @@ github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zt
 github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
 github.com/klauspost/cpuid/v2 v2.2.10 h1:tBs3QSyvjDyFTq3uoc/9xFpCuOsJQFNPiAhYdw2skhE=
 github.com/klauspost/cpuid/v2 v2.2.10/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
-github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
-github.com/konsorten/go-windows-terminal-sequences v1.0.3/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/koron/go-ssdp v0.0.5 h1:E1iSMxIs4WqxTbIBLtmNBeOOC+1sCIXQeqTWVnpmwhk=
 github.com/koron/go-ssdp v0.0.5/go.mod h1:Qm59B7hpKpDqfyRNWRNr00jGwLdXjDyZh6y7rH6VS0w=
-github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
@@ -256,8 +156,6 @@ github.com/libp2p/go-reuseport v0.4.0 h1:nR5KU7hD0WxXCJbmw7r2rhRYruNRl2koHw8fQsc
 github.com/libp2p/go-reuseport v0.4.0/go.mod h1:ZtI03j/wO5hZVDFo2jKywN6bYKWLOy8Se6DrI2E1cLU=
 github.com/libp2p/go-yamux/v5 v5.0.0 h1:2djUh96d3Jiac/JpGkKs4TO49YhsfLopAoryfPmf+Po=
 github.com/libp2p/go-yamux/v5 v5.0.0/go.mod h1:en+3cdX51U0ZslwRdRLrvQsdayFt3TSUKvBGErzpWbU=
-github.com/lucasb-eyer/go-colorful v1.2.0 h1:1nnpGOrhyZZuNyfu1QjKiUICQ74+3FNCN69Aj6K7nkY=
-github.com/lucasb-eyer/go-colorful v1.2.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
 github.com/lunixbochs/vtclean v1.0.0/go.mod h1:pHhQNgMf3btfWnGBVipUOjRYhoOsdGqdm/+2c2E2WMI=
 github.com/mackerelio/go-osstat v0.2.6 h1:gs4U8BZeS1tjrL08tt5VUliVvSWP26Ai2Ob8Lr7f2i0=
 github.com/mackerelio/go-osstat v0.2.6/go.mod h1:lRy8V9ZuHpuRVZh+vyTkODeDPl3/d5MgXHtLSaqG8bA=
@@ -266,12 +164,6 @@ github.com/marten-seemann/tcp v0.0.0-20210406111302-dfbc87cc63fd h1:br0buuQ854V8
 github.com/marten-seemann/tcp v0.0.0-20210406111302-dfbc87cc63fd/go.mod h1:QuCEs1Nt24+FYQEqAAncTDPJIuGs+LxK1MCiFL25pMU=
 github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
-github.com/mattn/go-localereader v0.0.1 h1:ygSAOl7ZXTx4RdPYinUpg6W99U8jWvWi9Ye2JC/oIi4=
-github.com/mattn/go-localereader v0.0.1/go.mod h1:8fBrzywKY7BI3czFoHkuzRoWE9C+EiG4R1k4Cjx5p88=
-github.com/mattn/go-runewidth v0.0.16 h1:E5ScNMtiwvlvB5paMFdw9p4kSQzbXFikJ5SQO6TULQc=
-github.com/mattn/go-runewidth v0.0.16/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
-github.com/mattn/go-sqlite3 v1.14.32 h1:JD12Ag3oLy1zQA+BNn74xRgaBbdhbNIDYvQUEuuErjs=
-github.com/mattn/go-sqlite3 v1.14.32/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
 github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
 github.com/microcosm-cc/bluemonday v1.0.1/go.mod h1:hsXNsILzKxV+sX77C5b8FSuKF00vh2OMYv+xgHpAMF4=
 github.com/miekg/dns v1.1.66 h1:FeZXOS3VCVsKnEAd+wBkjMC3D2K+ww66Cq3VnCINuJE=
@@ -286,21 +178,11 @@ github.com/minio/blake2b-simd v0.0.0-20160723061019-3f5f724cb5b1/go.mod h1:pD8Rv
 github.com/minio/sha256-simd v0.1.1-0.20190913151208-6de447530771/go.mod h1:B5e1o+1/KgNmWrSQK08Y6Z1Vb5pwIktudl0J58iy0KM=
 github.com/minio/sha256-simd v1.0.1 h1:6kaan5IFmwTNynnKKpDHe6FWHohJOHhCPchzK49dzMM=
 github.com/minio/sha256-simd v1.0.1/go.mod h1:Pz6AKMiUdngCLpeTL/RJY1M9rUuPMYujV5xJjtbRSN8=
-github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
-github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
 github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
 github.com/mr-tron/base58 v1.1.2/go.mod h1:BinMc/sQntlIE1frQmRFPUoPA1Zkr8VRgBdjWI2mNwc=
 github.com/mr-tron/base58 v1.2.0 h1:T/HDJBh4ZCPbU39/+c3rRvE0uKBQlU27+QI8LJ4t64o=
 github.com/mr-tron/base58 v1.2.0/go.mod h1:BinMc/sQntlIE1frQmRFPUoPA1Zkr8VRgBdjWI2mNwc=
-github.com/mschoch/smat v0.2.0 h1:8imxQsjDm8yFEAVBe7azKmKSgzSkZXDuKkSq9374khM=
-github.com/mschoch/smat v0.2.0/go.mod h1:kc9mz7DoBKqDyiRL7VZN8KvXQMWeTaVnttLRXOlotKw=
-github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 h1:ZK8zHtRHOkbHy6Mmr5D264iyp3TiX5OmNcI5cIARiQI=
-github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6/go.mod h1:CJlz5H+gyd6CUWT45Oy4q24RdLyn7Md9Vj2/ldJBSIo=
-github.com/muesli/cancelreader v0.2.2 h1:3I4Kt4BQjOR54NavqnDogx/MIoWBFa0StPA8ELUXHmA=
-github.com/muesli/cancelreader v0.2.2/go.mod h1:3XuTXfFS2VjM+HTLZY9Ak0l6eUKfijIfMUZ4EgX0QYo=
-github.com/muesli/termenv v0.15.2 h1:GohcuySI0QmI3wN8Ok9PtKGkgkFIk7y6Vpb5PvrY+Wo=
-github.com/muesli/termenv v0.15.2/go.mod h1:Epx+iuz8sNs7mNKhxzH4fWXGNpZwUaJKRS1noLXviQ8=
 github.com/multiformats/go-base32 v0.1.0 h1:pVx9xoSPqEIQG8o+UbAe7DNi51oej1NtK+aGkbLYxPE=
 github.com/multiformats/go-base32 v0.1.0/go.mod h1:Kj3tFY6zNr+ABYMqeUNeGvkIC/UYgtWibDcT0rExnbI=
 github.com/multiformats/go-base36 v0.2.0 h1:lFsAbNOGeKtuKozrtBsAkSVhv1p9D0/qedU9rQyccr0=
@@ -325,12 +207,8 @@ github.com/multiformats/go-varint v0.0.7 h1:sWSGR+f/eu5ABZA2ZpYKBILXTTs9JWpdEM/n
 github.com/multiformats/go-varint v0.0.7/go.mod h1:r8PUYw/fD/SjBCiKOoDlGF6QawOELpZAu9eioSos/OU=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
-github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
-github.com/mwitkow/go-conntrack v0.0.0-20190716064945-2f068394615f/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
 github.com/neelance/astrewrite v0.0.0-20160511093645-99348263ae86/go.mod h1:kHJEU3ofeGjhHklVoIGuVj85JJwZ6kWPaJwCIxgnFmo=
 github.com/neelance/sourcemap v0.0.0-20151028013722-8c68805598ab/go.mod h1:Qr6/a/Q4r9LP1IltGz7tA7iOK1WonHEYhu1HRBA7ZiM=
-github.com/olric-data/olric v0.7.0 h1:EKN2T6ZTtdu8Un0jV0KOWVxWm9odptJpefmDivfZdjE=
-github.com/olric-data/olric v0.7.0/go.mod h1:+ZnPpgc8JkNkza8rETCKGn0P/QPF6HhZY0EbCKAOslo=
 github.com/onsi/ginkgo/v2 v2.22.2 h1:/3X8Panh8/WwhU/3Ssa6rCKqPLuAkVY2I0RoyDLySlU=
 github.com/onsi/ginkgo/v2 v2.22.2/go.mod h1:oeMosUL+8LtarXBHu/c0bx2D/K9zyQ6uX3cTyztHwsk=
 github.com/onsi/gomega v1.36.2 h1:koNYke6TVk6ZmnyHrCXba/T/MoLBXFjeC1PtvYgw0A8=
@@ -339,8 +217,6 @@ github.com/opencontainers/runtime-spec v1.0.2/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/
 github.com/opencontainers/runtime-spec v1.2.0 h1:z97+pHb3uELt/yiAWD691HNHQIF07bE7dzrbT927iTk=
 github.com/opencontainers/runtime-spec v1.2.0/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
 github.com/openzipkin/zipkin-go v0.1.1/go.mod h1:NtoC/o8u3JlF1lSlyPNswIbeQH9bJTmOf0Erfk+hxe8=
-github.com/pascaldekloe/goe v0.1.0 h1:cBOtyMzM9HTpWjXfbbunk26uA6nG3a8n06Wieeh0MwY=
-github.com/pascaldekloe/goe v0.1.0/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc=
 github.com/pbnjay/memory v0.0.0-20210728143218-7b4eea64cf58 h1:onHthvaw9LFnH4t2DcNVpwGmV9E1BkGknEliJkfwQj0=
 github.com/pbnjay/memory v0.0.0-20210728143218-7b4eea64cf58/go.mod h1:DXv8WO4yhMYhSNPKjeNKa5WY9YCIEBRbNzFFPJbWO6Y=
 github.com/pion/datachannel v1.5.10 h1:ly0Q26K1i6ZkGf42W7D4hQYR90pZwzFOjTq5AuCKk4o=
@@ -385,38 +261,21 @@ github.com/pion/turn/v4 v4.0.0 h1:qxplo3Rxa9Yg1xXDxxH8xaqcyGUtbHYw4QSCvmFWvhM=
 github.com/pion/turn/v4 v4.0.0/go.mod h1:MuPDkm15nYSklKpN8vWJ9W2M0PlyQZqYt1McGuxG7mA=
 github.com/pion/webrtc/v4 v4.0.10 h1:Hq/JLjhqLxi+NmCtE8lnRPDr8H4LcNvwg8OxVcdv56Q=
 github.com/pion/webrtc/v4 v4.0.10/go.mod h1:ViHLVaNpiuvaH8pdiuQxuA9awuE6KVzAXx3vVWilOck=
-github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/prometheus/client_golang v0.8.0/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
-github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
-github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5FsnadC4Ky3P0J6CfImo=
-github.com/prometheus/client_golang v1.4.0/go.mod h1:e9GMxYsXl05ICDXkRhurwBS4Q3OK1iX/F2sw+iXX5zU=
-github.com/prometheus/client_golang v1.7.1/go.mod h1:PY5Wy2awLA44sXw4AOSfFBetzPP4j5+D6mVACh+pe2M=
-github.com/prometheus/client_golang v1.11.1/go.mod h1:Z6t4BnS23TR94PD6BsDNk8yVqroYurpAkEiz0P2BEV0=
 github.com/prometheus/client_golang v1.22.0 h1:rb93p9lokFEsctTys46VnV1kLCDpVZ0a/Y92Vm0Zc6Q=
 github.com/prometheus/client_golang v1.22.0/go.mod h1:R7ljNsLXhuQXYZYtw6GAE9AZg8Y7vEW5scdCXrWRXC0=
 github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
-github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
-github.com/prometheus/client_model v0.2.0/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
 github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
 github.com/prometheus/common v0.0.0-20180801064454-c7de2306084e/go.mod h1:daVV7qP5qjZbuso7PdcryaAu0sAZbrN9i7WWcTMWvro=
-github.com/prometheus/common v0.4.1/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
-github.com/prometheus/common v0.9.1/go.mod h1:yhUN8i9wzaXS3w1O07YhxHEBxD+W35wd8bs7vj7HSQ4=
-github.com/prometheus/common v0.10.0/go.mod h1:Tlit/dnDKsSWFlCLTWaA1cyBgKHSMdTB80sz/V91rCo=
-github.com/prometheus/common v0.26.0/go.mod h1:M7rCNAaPfAosfx8veZJCuw84e35h3Cfd9VFqTh1DIvc=
 github.com/prometheus/common v0.63.0 h1:YR/EIY1o3mEFP/kZCD7iDMnLPlGyuU2Gb3HIcXnA98k=
 github.com/prometheus/common v0.63.0/go.mod h1:VVFF/fBIoToEnWRVkYoXEkq3R3paCoxG9PXP74SnV18=
 github.com/prometheus/procfs v0.0.0-20180725123919-05ee40e3a273/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
-github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
-github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
-github.com/prometheus/procfs v0.0.8/go.mod h1:7Qr8sr6344vo1JqZ6HhLceV9o3AJ1Ff+GxbHq6oeK9A=
-github.com/prometheus/procfs v0.1.3/go.mod h1:lV6e/gmhEcM9IjHGsFOCxxuZ+z1YqCvr4OA4YeYWdaU=
-github.com/prometheus/procfs v0.6.0/go.mod h1:cz+aTbrPOrUb4q7XlbU9ygM+/jj0fzG6c1xBZuNvfVA=
 github.com/prometheus/procfs v0.16.1 h1:hZ15bTNuirocR6u0JZ6BAHHmwS1p8B4P6MRqxtzMyRg=
 github.com/prometheus/procfs v0.16.1/go.mod h1:teAbpZRB1iIAJYREa1LsoWUXykVXA1KlTmWl8x/U+Is=
 github.com/quic-go/qpack v0.5.1 h1:giqksBPnT/HDtZ6VhtFKgoLOWmlyo9Ei6u9PqzIMbhI=
@@ -427,19 +286,12 @@ github.com/quic-go/webtransport-go v0.8.1-0.20241018022711-4ac2c9250e66 h1:4WFk6
 github.com/quic-go/webtransport-go v0.8.1-0.20241018022711-4ac2c9250e66/go.mod h1:Vp72IJajgeOL6ddqrAhmp7IM9zbTcgkQxD/YdxrVwMw=
 github.com/raulk/go-watchdog v1.3.0 h1:oUmdlHxdkXRJlwfG0O9omj8ukerm8MEQavSiDTEtBsk=
 github.com/raulk/go-watchdog v1.3.0/go.mod h1:fIvOnLbF0b0ZwkB9YU4mOW9Did//4vPZtDqv66NfsMU=
-github.com/redis/go-redis/v9 v9.8.0 h1:q3nRvjrlge/6UD7eTu/DSg2uYiU2mCL0G/uzBWqhicI=
-github.com/redis/go-redis/v9 v9.8.0/go.mod h1:huWgSWd8mW6+m0VPhJjSSQ+d6Nh1VICQ6Q5lHuCH/Iw=
-github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
-github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
-github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
 github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII=
 github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o=
 github.com/rqlite/gorqlite v0.0.0-20250609141355-ac86a4a1c9a8 h1:BoxiqWvhprOB2isgM59s8wkgKwAoyQH66Twfmof41oE=
 github.com/rqlite/gorqlite v0.0.0-20250609141355-ac86a4a1c9a8/go.mod h1:xF/KoXmrRyahPfo5L7Szb5cAAUl53dMWBh9cMruGEZg=
 github.com/russross/blackfriday v1.5.2/go.mod h1:JO/DiYxRf+HjHt06OyowR9PTA263kcR/rfWxYHBV53g=
 github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
-github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529 h1:nn5Wsu0esKSJiIVhscUtVbo7ada43DJhG55ua/hjS5I=
-github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529/go.mod h1:DxrIzT+xaE7yg65j358z/aeFdxmN0P9QXhEzd20vsDc=
 github.com/sergi/go-diff v1.0.0/go.mod h1:0CfEIISq7TuYL3j771MWULgwwjU+GofnZX9QAmXWZgo=
 github.com/shurcooL/component v0.0.0-20170202220835-f88ec8f54cc4/go.mod h1:XhFIlyj5a1fBNx5aJTbKoIq0mNaPvOagO+HjB3EtxrY=
 github.com/shurcooL/events v0.0.0-20181021180414-410e4ca65f48/go.mod h1:5u70Mqkb5O5cxEA8nxTsgrgLehJeAw6Oc4Ab1c/P1HM=
@@ -464,22 +316,16 @@ github.com/shurcooL/sanitized_anchor_name v0.0.0-20170918181015-86672fcb3f95/go.
 github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
 github.com/shurcooL/users v0.0.0-20180125191416-49c67e49c537/go.mod h1:QJTqeLYEDaXHZDBsXlPCDqdhQuJkuw4NOtaxYe3xii4=
 github.com/shurcooL/webdavfs v0.0.0-20170829043945-18c3829fa133/go.mod h1:hKmq5kWdCj2z2KEozexVbfEZIWiTjhE0+UjmZgPqehw=
-github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
-github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
-github.com/sirupsen/logrus v1.6.0/go.mod h1:7uNnSEd1DgxDLC74fIahvMZmmYsHGZGEOFrfsX/uA88=
 github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
 github.com/sourcegraph/annotate v0.0.0-20160123013949-f4cad6c6324d/go.mod h1:UdhH50NIW0fCiwBSr0co2m7BnFLdv4fQTgdqdJTHFeE=
 github.com/sourcegraph/syntaxhighlight v0.0.0-20170531221838-bd320f5d308e/go.mod h1:HuIsMU8RRBOtsCgI77wP899iHVBQpCmg4ErYMZB+2IA=
 github.com/spaolacci/murmur3 v1.1.0 h1:7c1g84S4BPRrfL5Xrdp6fOJ206sU9y293DDHaoy0bLI=
 github.com/spaolacci/murmur3 v1.1.0/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
-github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
-github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.3/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
@@ -487,21 +333,9 @@ github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXl
 github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
 github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/tarm/serial v0.0.0-20180830185346-98f6abe2eb07/go.mod h1:kDXzergiv9cbyO7IOYJZWg1U88JhDg3PB6klq9Hg2pA=
-github.com/tidwall/btree v1.1.0/go.mod h1:TzIRzen6yHbibdSfK6t8QimqbUnoxUSrZfeW7Uob0q4=
-github.com/tidwall/btree v1.7.0 h1:L1fkJH/AuEh5zBnnBbmTwQ5Lt+bRJ5A8EWecslvo9iI=
-github.com/tidwall/btree v1.7.0/go.mod h1:twD9XRA5jj9VUQGELzDO4HPQTNJsoWWfYEL+EUQ2cKY=
-github.com/tidwall/match v1.1.1 h1:+Ho715JplO36QYgwN9PGYNhgZvoUSc9X2c80KVTi+GA=
-github.com/tidwall/match v1.1.1/go.mod h1:eRSPERbgtNPcGhD8UCthc6PmLEQXEWd3PRB5JTxsfmM=
-github.com/tidwall/redcon v1.6.2 h1:5qfvrrybgtO85jnhSravmkZyC0D+7WstbfCs3MmPhow=
-github.com/tidwall/redcon v1.6.2/go.mod h1:p5Wbsgeyi2VSTBWOcA5vRXrOb9arFTcU2+ZzFjqV75Y=
-github.com/tv42/httpunix v0.0.0-20150427012821-b75d8614f926/go.mod h1:9ESjWnEqriFuLhtthL60Sar/7RFoluCcXsuvEwTV5KM=
 github.com/urfave/cli v1.22.2/go.mod h1:Gos4lmkARVdJ6EkW0WaNv/tZAAMe9V7XWyB60NtXRu0=
 github.com/viant/assertly v0.4.8/go.mod h1:aGifi++jvCrUaklKEKT0BU95igDNaqkvz+49uaYMPRU=
 github.com/viant/toolbox v0.24.0/go.mod h1:OxMCG57V0PXuIP2HNQrtJf2CjqdmbrOx5EkMILuUhzM=
-github.com/vmihailenco/msgpack/v5 v5.4.1 h1:cQriyiUvjTwOHg8QZaPihLWeRAAVoCpE00IUPn0Bjt8=
-github.com/vmihailenco/msgpack/v5 v5.4.1/go.mod h1:GaZTsDaehaPpQVyxrf5mtQlH+pc21PIudVV/E3rRQok=
-github.com/vmihailenco/tagparser/v2 v2.0.0 h1:y09buUbR+b5aycVFQs/g70pqKVZNBmxwAhO7/IwNM9g=
-github.com/vmihailenco/tagparser/v2 v2.0.0/go.mod h1:Wri+At7QHww0WTrCBeu4J6bNtoV6mEfg5OIWRZA9qds=
 github.com/wlynxg/anet v0.0.3/go.mod h1:eay5PRQr7fIVAMbTbchTnO9gG65Hg/uYGdc7mguHxoA=
 github.com/wlynxg/anet v0.0.5 h1:J3VJGi1gvo0JwZ/P1/Yc/8p63SoW98B5dHkYDmpgvvU=
 github.com/wlynxg/anet v0.0.5/go.mod h1:eay5PRQr7fIVAMbTbchTnO9gG65Hg/uYGdc7mguHxoA=
@@ -523,7 +357,6 @@ go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=
 go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
 go4.org v0.0.0-20180809161055-417644f6feb5/go.mod h1:MkTOUMDaeVYJUOUsaDXIhWPZYa1yOyC1qaOBpL57BhE=
 golang.org/x/build v0.0.0-20190111050920-041ab4dc3f9d/go.mod h1:OWs+y06UdEOHN4y+MfF/py+xQ/tYqIWW03b70/CG9Rw=
-golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20181030102418-4d3f4d9ffa16/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20190313024323-a1f597ede03a/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
@@ -557,15 +390,12 @@ golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73r
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20181029044818-c44066c5c816/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20181106065722-10aee1819953/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190313220215-9f648a60d977/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190613194153-d28f0bde5980/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200625001655-4c5254603344/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20210119194325-5f4716e94777/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
@@ -589,7 +419,6 @@ golang.org/x/sync v0.0.0-20190227155943-e225da77a7e6/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -597,28 +426,17 @@ golang.org/x/sync v0.16.0 h1:ycBJEhp9p4vXvUZNszeOq0kGTPghopOL8q0fq3vstxw=
 golang.org/x/sync v0.16.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
 golang.org/x/sys v0.0.0-20180810173357-98c5dad5d1a0/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20181029174526-d69651ed3497/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190316082340-a2f829d7f35f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190422165155-953cdadca894/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200106162015-b016eb3dc98e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200122134326-e047566fdf82/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200124204421-9fbb57f87de9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200602225109-6fdc65e7d980/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200615200032-f1bc736245b1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200625212154-ddb9806d33ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210603081109-ebe580a85c40/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -638,7 +456,6 @@ golang.org/x/term v0.11.0/go.mod h1:zC9APTIj3jG3FdV/Ons+XE1riIZXG4aZ4GTHiPZJPIU=
 golang.org/x/term v0.16.0/go.mod h1:yn7UURbUtPyrVJPGPq404EukNFxcm/foM+bV/bfcDsY=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
@@ -685,29 +502,15 @@ google.golang.org/grpc v1.14.0/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmE
 google.golang.org/grpc v1.16.0/go.mod h1:0JHn/cJsOMiMfNA9+DeHDlAU7KAAB5GDlYFpa9MZMio=
 google.golang.org/grpc v1.17.0/go.mod h1:6QZJwpn2B+Zp71q/5VxRsJ6NXXVCE5NRUHRo+f3cWCs=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
-google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
-google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
-google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
-google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE=
-google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo=
-google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.36.6 h1:z1NpPI8ku2WgiWnf+t9wTPsn6eP1L7ksHUlkfLvd9xY=
 google.golang.org/protobuf v1.36.6/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY=
-gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
 gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.5/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
-gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

pkg/anyoneproxy/socks.go

@@ -19,7 +19,7 @@ var disabled bool
 func SetDisabled(v bool) { disabled = v }
 
 // Enabled reports whether Anyone proxy routing is active.
-// Defaults to true, using SOCKS5 at localhost:9050, unless explicitly disabled
+// Defaults to true, using SOCKS5 at 127.0.0.1:9050, unless explicitly disabled
 // via SetDisabled(true) or environment variable ANYONE_DISABLE=1.
 // ANYONE_SOCKS5 may override the proxy address.
 func Enabled() bool {
@@ -31,7 +31,7 @@ func Enabled() bool {
 
 // socksAddr returns the SOCKS5 address to use for proxying (host:port).
 func socksAddr() string {
-	return "localhost:9050"
+	return "127.0.0.1:9050"
 }
 
 // socksContextDialer implements tcp.ContextDialer over a SOCKS5 proxy.
@@ -57,7 +57,7 @@ func (d *socksContextDialer) DialContext(ctx context.Context, network, address s
 
 // DialerForAddr returns a tcp.DialerForAddr that routes through the Anyone SOCKS5 proxy.
 // It automatically BYPASSES the proxy for loopback, private, and link-local addresses
-// to allow local/dev networking (e.g. localhost, 10.0.0.0/8, 192.168.0.0/16, fc00::/7, fe80::/10).
+// to allow local/dev networking (e.g. 127.0.0.1, 10.0.0.0/8, 192.168.0.0/16, fc00::/7, fe80::/10).
 func DialerForAddr() tcp.DialerForAddr {
 	return func(raddr ma.Multiaddr) (tcp.ContextDialer, error) {
 		// Prefer direct dialing for local/private targets

pkg/auth/credentials.go

@@ -34,15 +34,15 @@ func GetCredentialsPath() (string, error) {
 		return "", fmt.Errorf("failed to get home directory: %w", err)
 	}
 
-	oramaDir := filepath.Join(homeDir, ".orama")
+	debrosDir := filepath.Join(homeDir, ".debros")
-	if err := os.MkdirAll(oramaDir, 0700); err != nil {
+	if err := os.MkdirAll(debrosDir, 0700); err != nil {
-		return "", fmt.Errorf("failed to create .orama directory: %w", err)
+		return "", fmt.Errorf("failed to create .debros directory: %w", err)
 	}
 
-	return filepath.Join(oramaDir, "credentials.json"), nil
+	return filepath.Join(debrosDir, "credentials.json"), nil
 }
 
-// LoadCredentials loads credentials from ~/.orama/credentials.json
+// LoadCredentials loads credentials from ~/.debros/credentials.json
 func LoadCredentials() (*CredentialStore, error) {
 	credPath, err := GetCredentialsPath()
 	if err != nil {
@@ -80,7 +80,7 @@ func LoadCredentials() (*CredentialStore, error) {
 	return &store, nil
 }
 
-// SaveCredentials saves credentials to ~/.orama/credentials.json
+// SaveCredentials saves credentials to ~/.debros/credentials.json
 func (store *CredentialStore) SaveCredentials() error {
 	credPath, err := GetCredentialsPath()
 	if err != nil {

pkg/auth/simple_auth.go

@@ -1,144 +0,0 @@
-package auth
-
-import (
-	"bufio"
-	"bytes"
-	"encoding/json"
-	"fmt"
-	"io"
-	"net/http"
-	"os"
-	"strings"
-	"time"
-
-	"github.com/DeBrosOfficial/network/pkg/tlsutil"
-)
-
-// PerformSimpleAuthentication performs a simple authentication flow where the user
-// provides a wallet address and receives an API key without signature verification
-func PerformSimpleAuthentication(gatewayURL string) (*Credentials, error) {
-	reader := bufio.NewReader(os.Stdin)
-
-	fmt.Println("\n🔐 Simple Wallet Authentication")
-	fmt.Println("================================")
-
-	// Read wallet address
-	fmt.Print("Enter your wallet address (0x...): ")
-	walletInput, err := reader.ReadString('\n')
-	if err != nil {
-		return nil, fmt.Errorf("failed to read wallet address: %w", err)
-	}
-
-	wallet := strings.TrimSpace(walletInput)
-	if wallet == "" {
-		return nil, fmt.Errorf("wallet address cannot be empty")
-	}
-
-	// Validate wallet format (basic check)
-	if !strings.HasPrefix(wallet, "0x") && !strings.HasPrefix(wallet, "0X") {
-		wallet = "0x" + wallet
-	}
-
-	if !ValidateWalletAddress(wallet) {
-		return nil, fmt.Errorf("invalid wallet address format")
-	}
-
-	// Read namespace (optional)
-	fmt.Print("Enter namespace (press Enter for 'default'): ")
-	nsInput, err := reader.ReadString('\n')
-	if err != nil {
-		return nil, fmt.Errorf("failed to read namespace: %w", err)
-	}
-
-	namespace := strings.TrimSpace(nsInput)
-	if namespace == "" {
-		namespace = "default"
-	}
-
-	fmt.Printf("\n✅ Wallet: %s\n", wallet)
-	fmt.Printf("✅ Namespace: %s\n", namespace)
-	fmt.Println("⏳ Requesting API key from gateway...")
-
-	// Request API key from gateway
-	apiKey, err := requestAPIKeyFromGateway(gatewayURL, wallet, namespace)
-	if err != nil {
-		return nil, fmt.Errorf("failed to request API key: %w", err)
-	}
-
-	// Create credentials
-	creds := &Credentials{
-		APIKey:    apiKey,
-		Namespace: namespace,
-		UserID:    wallet,
-		Wallet:    wallet,
-		IssuedAt:  time.Now(),
-	}
-
-	fmt.Printf("\n🎉 Authentication successful!\n")
-	fmt.Printf("📝 API Key: %s\n", creds.APIKey)
-
-	return creds, nil
-}
-
-// requestAPIKeyFromGateway calls the gateway's simple-key endpoint to generate an API key
-func requestAPIKeyFromGateway(gatewayURL, wallet, namespace string) (string, error) {
-	reqBody := map[string]string{
-		"wallet":    wallet,
-		"namespace": namespace,
-	}
-
-	payload, err := json.Marshal(reqBody)
-	if err != nil {
-		return "", fmt.Errorf("failed to marshal request: %w", err)
-	}
-
-	endpoint := gatewayURL + "/v1/auth/simple-key"
-
-	// Extract domain from URL for TLS configuration
-	// This uses tlsutil which handles Let's Encrypt staging certificates for *.debros.network
-	domain := extractDomainFromURL(gatewayURL)
-	client := tlsutil.NewHTTPClientForDomain(30*time.Second, domain)
-
-	resp, err := client.Post(endpoint, "application/json", bytes.NewReader(payload))
-	if err != nil {
-		return "", fmt.Errorf("failed to call gateway: %w", err)
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK {
-		body, _ := io.ReadAll(resp.Body)
-		return "", fmt.Errorf("gateway returned status %d: %s", resp.StatusCode, string(body))
-	}
-
-	var respBody map[string]interface{}
-	if err := json.NewDecoder(resp.Body).Decode(&respBody); err != nil {
-		return "", fmt.Errorf("failed to decode response: %w", err)
-	}
-
-	apiKey, ok := respBody["api_key"].(string)
-	if !ok || apiKey == "" {
-		return "", fmt.Errorf("no api_key in response")
-	}
-
-	return apiKey, nil
-}
-
-// extractDomainFromURL extracts the domain from a URL
-// Removes protocol (https://, http://), path, and port components
-func extractDomainFromURL(url string) string {
-	// Remove protocol prefixes
-	url = strings.TrimPrefix(url, "https://")
-	url = strings.TrimPrefix(url, "http://")
-
-	// Remove path component
-	if idx := strings.Index(url, "/"); idx != -1 {
-		url = url[:idx]
-	}
-
-	// Remove port component
-	if idx := strings.Index(url, ":"); idx != -1 {
-		url = url[:idx]
-	}
-
-	return url
-}

pkg/auth/wallet.go

@@ -199,7 +199,7 @@ func (as *AuthServer) handleCallback(w http.ResponseWriter, r *http.Request) {
             %s
         </div>
 
-        <p>Your credentials have been saved securely to <code>~/.orama/credentials.json</code></p>
+        <p>Your credentials have been saved securely to <code>~/.debros/credentials.json</code></p>
         <p><strong>You can now close this browser window and return to your terminal.</strong></p>
     </div>
 </body>

pkg/certutil/cert_manager.go

@@ -1,257 +0,0 @@
-// Package certutil provides utilities for managing self-signed certificates
-package certutil
-
-import (
-	"crypto/rand"
-	"crypto/rsa"
-	"crypto/tls"
-	"crypto/x509"
-	"crypto/x509/pkix"
-	"encoding/pem"
-	"fmt"
-	"math/big"
-	"net"
-	"os"
-	"path/filepath"
-	"time"
-)
-
-// CertificateManager manages self-signed certificates for the network
-type CertificateManager struct {
-	baseDir string
-}
-
-// NewCertificateManager creates a new certificate manager
-func NewCertificateManager(baseDir string) *CertificateManager {
-	return &CertificateManager{
-		baseDir: baseDir,
-	}
-}
-
-// EnsureCACertificate creates or loads the CA certificate
-func (cm *CertificateManager) EnsureCACertificate() ([]byte, []byte, error) {
-	caCertPath := filepath.Join(cm.baseDir, "ca.crt")
-	caKeyPath := filepath.Join(cm.baseDir, "ca.key")
-
-	// Check if CA already exists
-	if _, err := os.Stat(caCertPath); err == nil {
-		certPEM, err := os.ReadFile(caCertPath)
-		if err != nil {
-			return nil, nil, fmt.Errorf("failed to read CA certificate: %w", err)
-		}
-		keyPEM, err := os.ReadFile(caKeyPath)
-		if err != nil {
-			return nil, nil, fmt.Errorf("failed to read CA key: %w", err)
-		}
-		return certPEM, keyPEM, nil
-	}
-
-	// Create new CA certificate
-	certPEM, keyPEM, err := cm.generateCACertificate()
-	if err != nil {
-		return nil, nil, err
-	}
-
-	// Ensure directory exists
-	if err := os.MkdirAll(cm.baseDir, 0700); err != nil {
-		return nil, nil, fmt.Errorf("failed to create cert directory: %w", err)
-	}
-
-	// Write to files
-	if err := os.WriteFile(caCertPath, certPEM, 0644); err != nil {
-		return nil, nil, fmt.Errorf("failed to write CA certificate: %w", err)
-	}
-	if err := os.WriteFile(caKeyPath, keyPEM, 0600); err != nil {
-		return nil, nil, fmt.Errorf("failed to write CA key: %w", err)
-	}
-
-	return certPEM, keyPEM, nil
-}
-
-// EnsureNodeCertificate creates or loads a node certificate signed by the CA
-func (cm *CertificateManager) EnsureNodeCertificate(hostname string, caCertPEM, caKeyPEM []byte) ([]byte, []byte, error) {
-	certPath := filepath.Join(cm.baseDir, fmt.Sprintf("%s.crt", hostname))
-	keyPath := filepath.Join(cm.baseDir, fmt.Sprintf("%s.key", hostname))
-
-	// Check if certificate already exists
-	if _, err := os.Stat(certPath); err == nil {
-		certData, err := os.ReadFile(certPath)
-		if err != nil {
-			return nil, nil, fmt.Errorf("failed to read certificate: %w", err)
-		}
-		keyData, err := os.ReadFile(keyPath)
-		if err != nil {
-			return nil, nil, fmt.Errorf("failed to read key: %w", err)
-		}
-		return certData, keyData, nil
-	}
-
-	// Create new certificate
-	certPEM, keyPEM, err := cm.generateNodeCertificate(hostname, caCertPEM, caKeyPEM)
-	if err != nil {
-		return nil, nil, err
-	}
-
-	// Write to files
-	if err := os.WriteFile(certPath, certPEM, 0644); err != nil {
-		return nil, nil, fmt.Errorf("failed to write certificate: %w", err)
-	}
-	if err := os.WriteFile(keyPath, keyPEM, 0600); err != nil {
-		return nil, nil, fmt.Errorf("failed to write key: %w", err)
-	}
-
-	return certPEM, keyPEM, nil
-}
-
-// generateCACertificate generates a self-signed CA certificate
-func (cm *CertificateManager) generateCACertificate() ([]byte, []byte, error) {
-	// Generate private key
-	privateKey, err := rsa.GenerateKey(rand.Reader, 4096)
-	if err != nil {
-		return nil, nil, fmt.Errorf("failed to generate private key: %w", err)
-	}
-
-	// Create certificate template
-	template := x509.Certificate{
-		SerialNumber: big.NewInt(1),
-		Subject: pkix.Name{
-			CommonName:   "DeBros Network Root CA",
-			Organization: []string{"DeBros"},
-		},
-		NotBefore:             time.Now(),
-		NotAfter:              time.Now().AddDate(10, 0, 0), // 10 year validity
-		KeyUsage:              x509.KeyUsageCertSign | x509.KeyUsageCRLSign,
-		ExtKeyUsage:           []x509.ExtKeyUsage{},
-		BasicConstraintsValid: true,
-		IsCA:                  true,
-	}
-
-	// Self-sign the certificate
-	certDER, err := x509.CreateCertificate(rand.Reader, &template, &template, &privateKey.PublicKey, privateKey)
-	if err != nil {
-		return nil, nil, fmt.Errorf("failed to create certificate: %w", err)
-	}
-
-	// Encode certificate to PEM
-	certPEM := pem.EncodeToMemory(&pem.Block{
-		Type:  "CERTIFICATE",
-		Bytes: certDER,
-	})
-
-	// Encode private key to PEM
-	keyDER, err := x509.MarshalPKCS8PrivateKey(privateKey)
-	if err != nil {
-		return nil, nil, fmt.Errorf("failed to marshal private key: %w", err)
-	}
-
-	keyPEM := pem.EncodeToMemory(&pem.Block{
-		Type:  "PRIVATE KEY",
-		Bytes: keyDER,
-	})
-
-	return certPEM, keyPEM, nil
-}
-
-// generateNodeCertificate generates a certificate signed by the CA
-func (cm *CertificateManager) generateNodeCertificate(hostname string, caCertPEM, caKeyPEM []byte) ([]byte, []byte, error) {
-	// Parse CA certificate and key
-	caCert, caKey, err := cm.parseCACertificate(caCertPEM, caKeyPEM)
-	if err != nil {
-		return nil, nil, err
-	}
-
-	// Generate node private key
-	privateKey, err := rsa.GenerateKey(rand.Reader, 2048)
-	if err != nil {
-		return nil, nil, fmt.Errorf("failed to generate private key: %w", err)
-	}
-
-	// Create certificate template
-	template := x509.Certificate{
-		SerialNumber: big.NewInt(time.Now().UnixNano()),
-		Subject: pkix.Name{
-			CommonName: hostname,
-		},
-		NotBefore:   time.Now(),
-		NotAfter:    time.Now().AddDate(5, 0, 0), // 5 year validity
-		KeyUsage:    x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment,
-		ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
-		DNSNames:    []string{hostname},
-	}
-
-	// Add wildcard support if hostname contains *.debros.network
-	if hostname == "*.debros.network" {
-		template.DNSNames = []string{"*.debros.network", "debros.network"}
-	} else if hostname == "debros.network" {
-		template.DNSNames = []string{"*.debros.network", "debros.network"}
-	}
-
-	// Try to parse as IP address for IP-based certificates
-	if ip := net.ParseIP(hostname); ip != nil {
-		template.IPAddresses = []net.IP{ip}
-		template.DNSNames = nil
-	}
-
-	// Sign certificate with CA
-	certDER, err := x509.CreateCertificate(rand.Reader, &template, caCert, &privateKey.PublicKey, caKey)
-	if err != nil {
-		return nil, nil, fmt.Errorf("failed to create certificate: %w", err)
-	}
-
-	// Encode certificate to PEM
-	certPEM := pem.EncodeToMemory(&pem.Block{
-		Type:  "CERTIFICATE",
-		Bytes: certDER,
-	})
-
-	// Encode private key to PEM
-	keyDER, err := x509.MarshalPKCS8PrivateKey(privateKey)
-	if err != nil {
-		return nil, nil, fmt.Errorf("failed to marshal private key: %w", err)
-	}
-
-	keyPEM := pem.EncodeToMemory(&pem.Block{
-		Type:  "PRIVATE KEY",
-		Bytes: keyDER,
-	})
-
-	return certPEM, keyPEM, nil
-}
-
-// parseCACertificate parses CA certificate and key from PEM
-func (cm *CertificateManager) parseCACertificate(caCertPEM, caKeyPEM []byte) (*x509.Certificate, *rsa.PrivateKey, error) {
-	// Parse CA certificate
-	certBlock, _ := pem.Decode(caCertPEM)
-	if certBlock == nil {
-		return nil, nil, fmt.Errorf("failed to parse CA certificate PEM")
-	}
-
-	caCert, err := x509.ParseCertificate(certBlock.Bytes)
-	if err != nil {
-		return nil, nil, fmt.Errorf("failed to parse CA certificate: %w", err)
-	}
-
-	// Parse CA private key
-	keyBlock, _ := pem.Decode(caKeyPEM)
-	if keyBlock == nil {
-		return nil, nil, fmt.Errorf("failed to parse CA key PEM")
-	}
-
-	caKey, err := x509.ParsePKCS8PrivateKey(keyBlock.Bytes)
-	if err != nil {
-		return nil, nil, fmt.Errorf("failed to parse CA key: %w", err)
-	}
-
-	rsaKey, ok := caKey.(*rsa.PrivateKey)
-	if !ok {
-		return nil, nil, fmt.Errorf("CA key is not RSA")
-	}
-
-	return caCert, rsaKey, nil
-}
-
-// LoadTLSCertificate loads a TLS certificate from PEM files
-func LoadTLSCertificate(certPEM, keyPEM []byte) (tls.Certificate, error) {
-	return tls.X509KeyPair(certPEM, keyPEM)
-}
-

pkg/cli/auth_commands.go

@@ -1,230 +0,0 @@
-package cli
-
-import (
-	"bufio"
-	"fmt"
-	"os"
-	"strings"
-
-	"github.com/DeBrosOfficial/network/pkg/auth"
-)
-
-// HandleAuthCommand handles authentication commands
-func HandleAuthCommand(args []string) {
-	if len(args) == 0 {
-		showAuthHelp()
-		return
-	}
-
-	subcommand := args[0]
-	switch subcommand {
-	case "login":
-		handleAuthLogin()
-	case "logout":
-		handleAuthLogout()
-	case "whoami":
-		handleAuthWhoami()
-	case "status":
-		handleAuthStatus()
-	default:
-		fmt.Fprintf(os.Stderr, "Unknown auth command: %s\n", subcommand)
-		showAuthHelp()
-		os.Exit(1)
-	}
-}
-
-func showAuthHelp() {
-	fmt.Printf("🔐 Authentication Commands\n\n")
-	fmt.Printf("Usage: dbn auth <subcommand>\n\n")
-	fmt.Printf("Subcommands:\n")
-	fmt.Printf("  login      - Authenticate by providing your wallet address\n")
-	fmt.Printf("  logout     - Clear stored credentials\n")
-	fmt.Printf("  whoami     - Show current authentication status\n")
-	fmt.Printf("  status     - Show detailed authentication info\n\n")
-	fmt.Printf("Examples:\n")
-	fmt.Printf("  dbn auth login          # Enter wallet address interactively\n")
-	fmt.Printf("  dbn auth whoami         # Check who you're logged in as\n")
-	fmt.Printf("  dbn auth status         # View detailed authentication info\n")
-	fmt.Printf("  dbn auth logout         # Clear all stored credentials\n\n")
-	fmt.Printf("Environment Variables:\n")
-	fmt.Printf("  DEBROS_GATEWAY_URL - Gateway URL (overrides environment config)\n\n")
-	fmt.Printf("Authentication Flow:\n")
-	fmt.Printf("  1. Run 'dbn auth login'\n")
-	fmt.Printf("  2. Enter your wallet address when prompted\n")
-	fmt.Printf("  3. Enter your namespace (or press Enter for 'default')\n")
-	fmt.Printf("  4. An API key will be generated and saved to ~/.orama/credentials.json\n\n")
-	fmt.Printf("Note: Authentication uses the currently active environment.\n")
-	fmt.Printf("      Use 'dbn env current' to see your active environment.\n")
-}
-
-func handleAuthLogin() {
-	// Prompt for node selection
-	gatewayURL := promptForGatewayURL()
-	fmt.Printf("🔐 Authenticating with gateway at: %s\n", gatewayURL)
-
-	// Use the simple authentication flow
-	creds, err := auth.PerformSimpleAuthentication(gatewayURL)
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "❌ Authentication failed: %v\n", err)
-		os.Exit(1)
-	}
-
-	// Save credentials to file
-	if err := auth.SaveCredentialsForDefaultGateway(creds); err != nil {
-		fmt.Fprintf(os.Stderr, "❌ Failed to save credentials: %v\n", err)
-		os.Exit(1)
-	}
-
-	credsPath, _ := auth.GetCredentialsPath()
-	fmt.Printf("✅ Authentication successful!\n")
-	fmt.Printf("📁 Credentials saved to: %s\n", credsPath)
-	fmt.Printf("🎯 Wallet: %s\n", creds.Wallet)
-	fmt.Printf("🏢 Namespace: %s\n", creds.Namespace)
-	fmt.Printf("🔑 API Key: %s\n", creds.APIKey)
-}
-
-func handleAuthLogout() {
-	if err := auth.ClearAllCredentials(); err != nil {
-		fmt.Fprintf(os.Stderr, "❌ Failed to clear credentials: %v\n", err)
-		os.Exit(1)
-	}
-	fmt.Println("✅ Logged out successfully - all credentials have been cleared")
-}
-
-func handleAuthWhoami() {
-	store, err := auth.LoadCredentials()
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "❌ Failed to load credentials: %v\n", err)
-		os.Exit(1)
-	}
-
-	gatewayURL := getGatewayURL()
-	creds, exists := store.GetCredentialsForGateway(gatewayURL)
-
-	if !exists || !creds.IsValid() {
-		fmt.Println("❌ Not authenticated - run 'dbn auth login' to authenticate")
-		os.Exit(1)
-	}
-
-	fmt.Println("✅ Authenticated")
-	fmt.Printf("  Wallet:    %s\n", creds.Wallet)
-	fmt.Printf("  Namespace: %s\n", creds.Namespace)
-	fmt.Printf("  Issued At: %s\n", creds.IssuedAt.Format("2006-01-02 15:04:05"))
-	if !creds.ExpiresAt.IsZero() {
-		fmt.Printf("  Expires At: %s\n", creds.ExpiresAt.Format("2006-01-02 15:04:05"))
-	}
-	if !creds.LastUsedAt.IsZero() {
-		fmt.Printf("  Last Used: %s\n", creds.LastUsedAt.Format("2006-01-02 15:04:05"))
-	}
-	if creds.Plan != "" {
-		fmt.Printf("  Plan:      %s\n", creds.Plan)
-	}
-}
-
-func handleAuthStatus() {
-	store, err := auth.LoadCredentials()
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "❌ Failed to load credentials: %v\n", err)
-		os.Exit(1)
-	}
-
-	gatewayURL := getGatewayURL()
-	creds, exists := store.GetCredentialsForGateway(gatewayURL)
-
-	// Show active environment
-	env, err := GetActiveEnvironment()
-	if err == nil {
-		fmt.Printf("🌍 Active Environment: %s\n", env.Name)
-	}
-
-	fmt.Println("🔐 Authentication Status")
-	fmt.Printf("  Gateway URL: %s\n", gatewayURL)
-
-	if !exists || creds == nil {
-		fmt.Println("  Status:     ❌ Not authenticated")
-		return
-	}
-
-	if !creds.IsValid() {
-		fmt.Println("  Status:     ⚠️  Credentials expired")
-		if !creds.ExpiresAt.IsZero() {
-			fmt.Printf("  Expired At: %s\n", creds.ExpiresAt.Format("2006-01-02 15:04:05"))
-		}
-		return
-	}
-
-	fmt.Println("  Status:     ✅ Authenticated")
-	fmt.Printf("  Wallet:     %s\n", creds.Wallet)
-	fmt.Printf("  Namespace:  %s\n", creds.Namespace)
-	if !creds.ExpiresAt.IsZero() {
-		fmt.Printf("  Expires:    %s\n", creds.ExpiresAt.Format("2006-01-02 15:04:05"))
-	}
-	if !creds.LastUsedAt.IsZero() {
-		fmt.Printf("  Last Used:  %s\n", creds.LastUsedAt.Format("2006-01-02 15:04:05"))
-	}
-}
-
-// promptForGatewayURL interactively prompts for the gateway URL
-// Allows user to choose between local node or remote node by domain
-func promptForGatewayURL() string {
-	// Check environment variable first (allows override without prompting)
-	if url := os.Getenv("DEBROS_GATEWAY_URL"); url != "" {
-		return url
-	}
-
-	reader := bufio.NewReader(os.Stdin)
-
-	fmt.Println("\n🌐 Node Connection")
-	fmt.Println("==================")
-	fmt.Println("1. Local node (localhost:6001)")
-	fmt.Println("2. Remote node (enter domain)")
-	fmt.Print("\nSelect option [1/2]: ")
-
-	choice, _ := reader.ReadString('\n')
-	choice = strings.TrimSpace(choice)
-
-	if choice == "1" || choice == "" {
-		return "http://localhost:6001"
-	}
-
-	if choice != "2" {
-		fmt.Println("⚠️  Invalid option, using localhost")
-		return "http://localhost:6001"
-	}
-
-	fmt.Print("Enter node domain (e.g., node-hk19de.debros.network): ")
-	domain, _ := reader.ReadString('\n')
-	domain = strings.TrimSpace(domain)
-
-	if domain == "" {
-		fmt.Println("⚠️  No domain entered, using localhost")
-		return "http://localhost:6001"
-	}
-
-	// Remove any protocol prefix if user included it
-	domain = strings.TrimPrefix(domain, "https://")
-	domain = strings.TrimPrefix(domain, "http://")
-	// Remove trailing slash
-	domain = strings.TrimSuffix(domain, "/")
-
-	// Use HTTPS for remote domains
-	return fmt.Sprintf("https://%s", domain)
-}
-
-// getGatewayURL returns the gateway URL based on environment or env var
-// Used by other commands that don't need interactive node selection
-func getGatewayURL() string {
-	// Check environment variable first (for backwards compatibility)
-	if url := os.Getenv("DEBROS_GATEWAY_URL"); url != "" {
-		return url
-	}
-
-	// Get from active environment
-	env, err := GetActiveEnvironment()
-	if err == nil {
-		return env.GatewayURL
-	}
-
-	// Fallback to default (node-1)
-	return "http://localhost:6001"
-}

pkg/cli/basic_commands.go

@@ -1,423 +0,0 @@
-package cli
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"os"
-	"strconv"
-	"time"
-
-	"github.com/DeBrosOfficial/network/pkg/auth"
-	"github.com/DeBrosOfficial/network/pkg/client"
-)
-
-// HandleHealthCommand handles the health command
-func HandleHealthCommand(format string, timeout time.Duration) {
-	cli, err := createClient()
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "Failed to create client: %v\n", err)
-		os.Exit(1)
-	}
-	defer cli.Disconnect()
-
-	health, err := cli.Health()
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "Failed to get health: %v\n", err)
-		os.Exit(1)
-	}
-
-	if format == "json" {
-		printJSON(health)
-	} else {
-		printHealth(health)
-	}
-}
-
-// HandlePeersCommand handles the peers command
-func HandlePeersCommand(format string, timeout time.Duration) {
-	cli, err := createClient()
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "Failed to create client: %v\n", err)
-		os.Exit(1)
-	}
-	defer cli.Disconnect()
-
-	ctx, cancel := context.WithTimeout(context.Background(), timeout)
-	defer cancel()
-
-	peers, err := cli.Network().GetPeers(ctx)
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "Failed to get peers: %v\n", err)
-		os.Exit(1)
-	}
-
-	if format == "json" {
-		printJSON(peers)
-	} else {
-		printPeers(peers)
-	}
-}
-
-// HandleStatusCommand handles the status command
-func HandleStatusCommand(format string, timeout time.Duration) {
-	cli, err := createClient()
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "Failed to create client: %v\n", err)
-		os.Exit(1)
-	}
-	defer cli.Disconnect()
-
-	ctx, cancel := context.WithTimeout(context.Background(), timeout)
-	defer cancel()
-
-	status, err := cli.Network().GetStatus(ctx)
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "Failed to get status: %v\n", err)
-		os.Exit(1)
-	}
-
-	if format == "json" {
-		printJSON(status)
-	} else {
-		printStatus(status)
-	}
-}
-
-// HandleQueryCommand handles the query command
-func HandleQueryCommand(sql, format string, timeout time.Duration) {
-	// Ensure user is authenticated
-	_ = ensureAuthenticated()
-
-	cli, err := createClient()
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "Failed to create client: %v\n", err)
-		os.Exit(1)
-	}
-	defer cli.Disconnect()
-
-	ctx, cancel := context.WithTimeout(context.Background(), timeout)
-	defer cancel()
-
-	result, err := cli.Database().Query(ctx, sql)
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "Failed to execute query: %v\n", err)
-		os.Exit(1)
-	}
-
-	if format == "json" {
-		printJSON(result)
-	} else {
-		printQueryResult(result)
-	}
-}
-
-// HandleConnectCommand handles the connect command
-func HandleConnectCommand(peerAddr string, timeout time.Duration) {
-	cli, err := createClient()
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "Failed to create client: %v\n", err)
-		os.Exit(1)
-	}
-	defer cli.Disconnect()
-
-	ctx, cancel := context.WithTimeout(context.Background(), timeout)
-	defer cancel()
-
-	err = cli.Network().ConnectToPeer(ctx, peerAddr)
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "Failed to connect to peer: %v\n", err)
-		os.Exit(1)
-	}
-
-	fmt.Printf("✅ Connected to peer: %s\n", peerAddr)
-}
-
-// HandlePeerIDCommand handles the peer-id command
-func HandlePeerIDCommand(format string, timeout time.Duration) {
-	cli, err := createClient()
-	if err == nil {
-		defer cli.Disconnect()
-		ctx, cancel := context.WithTimeout(context.Background(), timeout)
-		defer cancel()
-
-		if status, err := cli.Network().GetStatus(ctx); err == nil {
-			if format == "json" {
-				printJSON(map[string]string{"peer_id": status.NodeID})
-			} else {
-				fmt.Printf("🆔 Peer ID: %s\n", status.NodeID)
-			}
-			return
-		}
-	}
-
-	fmt.Fprintf(os.Stderr, "❌ Could not find peer ID. Make sure the node is running or identity files exist.\n")
-	os.Exit(1)
-}
-
-// HandlePubSubCommand handles pubsub commands
-func HandlePubSubCommand(args []string, format string, timeout time.Duration) {
-	if len(args) == 0 {
-		fmt.Fprintf(os.Stderr, "Usage: dbn pubsub <publish|subscribe|topics> [args...]\n")
-		os.Exit(1)
-	}
-
-	// Ensure user is authenticated
-	_ = ensureAuthenticated()
-
-	cli, err := createClient()
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "Failed to create client: %v\n", err)
-		os.Exit(1)
-	}
-	defer cli.Disconnect()
-
-	ctx, cancel := context.WithTimeout(context.Background(), timeout)
-	defer cancel()
-
-	subcommand := args[0]
-	switch subcommand {
-	case "publish":
-		if len(args) < 3 {
-			fmt.Fprintf(os.Stderr, "Usage: dbn pubsub publish <topic> <message>\n")
-			os.Exit(1)
-		}
-		err := cli.PubSub().Publish(ctx, args[1], []byte(args[2]))
-		if err != nil {
-			fmt.Fprintf(os.Stderr, "Failed to publish message: %v\n", err)
-			os.Exit(1)
-		}
-		fmt.Printf("✅ Published message to topic: %s\n", args[1])
-
-	case "subscribe":
-		if len(args) < 2 {
-			fmt.Fprintf(os.Stderr, "Usage: dbn pubsub subscribe <topic> [duration]\n")
-			os.Exit(1)
-		}
-		duration := 30 * time.Second
-		if len(args) > 2 {
-			if d, err := time.ParseDuration(args[2]); err == nil {
-				duration = d
-			}
-		}
-
-		ctx, cancel := context.WithTimeout(context.Background(), duration)
-		defer cancel()
-
-		fmt.Printf("🔔 Subscribing to topic '%s' for %v...\n", args[1], duration)
-
-		messageHandler := func(topic string, data []byte) error {
-			fmt.Printf("📨 [%s] %s: %s\n", time.Now().Format("15:04:05"), topic, string(data))
-			return nil
-		}
-
-		err := cli.PubSub().Subscribe(ctx, args[1], messageHandler)
-		if err != nil {
-			fmt.Fprintf(os.Stderr, "Failed to subscribe: %v\n", err)
-			os.Exit(1)
-		}
-
-		<-ctx.Done()
-		fmt.Printf("✅ Subscription ended\n")
-
-	case "topics":
-		topics, err := cli.PubSub().ListTopics(ctx)
-		if err != nil {
-			fmt.Fprintf(os.Stderr, "Failed to list topics: %v\n", err)
-			os.Exit(1)
-		}
-		if format == "json" {
-			printJSON(topics)
-		} else {
-			for _, topic := range topics {
-				fmt.Println(topic)
-			}
-		}
-
-	default:
-		fmt.Fprintf(os.Stderr, "Unknown pubsub command: %s\n", subcommand)
-		os.Exit(1)
-	}
-}
-
-// Helper functions
-
-func createClient() (client.NetworkClient, error) {
-	config := client.DefaultClientConfig("dbn")
-
-	// Use active environment's gateway URL
-	gatewayURL := getGatewayURL()
-	config.GatewayURL = gatewayURL
-
-	// Try to get peer configuration from active environment
-	env, err := GetActiveEnvironment()
-	if err == nil && env != nil {
-		// Environment loaded successfully - gateway URL already set above
-		_ = env // Reserve for future peer configuration
-	}
-
-	// Check for existing credentials using enhanced authentication
-	creds, err := auth.GetValidEnhancedCredentials()
-	if err != nil {
-		// No valid credentials found, use the enhanced authentication flow
-		newCreds, authErr := auth.GetOrPromptForCredentials(gatewayURL)
-		if authErr != nil {
-			return nil, fmt.Errorf("authentication failed: %w", authErr)
-		}
-
-		creds = newCreds
-	}
-
-	// Configure client with API key
-	config.APIKey = creds.APIKey
-
-	// Update last used time - the enhanced store handles saving automatically
-	creds.UpdateLastUsed()
-
-	networkClient, err := client.NewClient(config)
-	if err != nil {
-		return nil, err
-	}
-
-	if err := networkClient.Connect(); err != nil {
-		return nil, err
-	}
-
-	return networkClient, nil
-}
-
-func ensureAuthenticated() *auth.Credentials {
-	gatewayURL := getGatewayURL()
-
-	credentials, err := auth.GetOrPromptForCredentials(gatewayURL)
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "Authentication failed: %v\n", err)
-		os.Exit(1)
-	}
-
-	return credentials
-}
-
-func printHealth(health *client.HealthStatus) {
-	fmt.Printf("🏥 Network Health\n")
-	fmt.Printf("Status: %s\n", getStatusEmoji(health.Status)+health.Status)
-	fmt.Printf("Last Updated: %s\n", health.LastUpdated.Format("2006-01-02 15:04:05"))
-	fmt.Printf("Response Time: %v\n", health.ResponseTime)
-	fmt.Printf("\nChecks:\n")
-	for check, status := range health.Checks {
-		emoji := "✅"
-		if status != "ok" {
-			emoji = "❌"
-		}
-		fmt.Printf("  %s %s: %s\n", emoji, check, status)
-	}
-}
-
-func printPeers(peers []client.PeerInfo) {
-	fmt.Printf("👥 Connected Peers (%d)\n\n", len(peers))
-	if len(peers) == 0 {
-		fmt.Printf("No peers connected\n")
-		return
-	}
-
-	for i, peer := range peers {
-		connEmoji := "🔴"
-		if peer.Connected {
-			connEmoji = "🟢"
-		}
-		fmt.Printf("%d. %s %s\n", i+1, connEmoji, peer.ID)
-		fmt.Printf("   Addresses: %v\n", peer.Addresses)
-		fmt.Printf("   Last Seen: %s\n", peer.LastSeen.Format("2006-01-02 15:04:05"))
-		fmt.Println()
-	}
-}
-
-func printStatus(status *client.NetworkStatus) {
-	fmt.Printf("🌐 Network Status\n")
-	fmt.Printf("Node ID: %s\n", status.NodeID)
-	fmt.Printf("Connected: %s\n", getBoolEmoji(status.Connected)+strconv.FormatBool(status.Connected))
-	fmt.Printf("Peer Count: %d\n", status.PeerCount)
-	fmt.Printf("Database Size: %s\n", formatBytes(status.DatabaseSize))
-	fmt.Printf("Uptime: %v\n", status.Uptime.Round(time.Second))
-}
-
-func printQueryResult(result *client.QueryResult) {
-	fmt.Printf("📊 Query Result\n")
-	fmt.Printf("Rows: %d\n\n", result.Count)
-
-	if len(result.Rows) == 0 {
-		fmt.Printf("No data returned\n")
-		return
-	}
-
-	// Print header
-	for i, col := range result.Columns {
-		if i > 0 {
-			fmt.Printf(" | ")
-		}
-		fmt.Printf("%-15s", col)
-	}
-	fmt.Println()
-
-	// Print separator
-	for i := range result.Columns {
-		if i > 0 {
-			fmt.Printf("-+-")
-		}
-		fmt.Printf("%-15s", "---------------")
-	}
-	fmt.Println()
-
-	// Print rows
-	for _, row := range result.Rows {
-		for i, cell := range row {
-			if i > 0 {
-				fmt.Printf(" | ")
-			}
-			fmt.Printf("%-15v", cell)
-		}
-		fmt.Println()
-	}
-}
-
-func printJSON(data interface{}) {
-	jsonData, err := json.MarshalIndent(data, "", "  ")
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "Failed to marshal JSON: %v\n", err)
-		return
-	}
-	fmt.Println(string(jsonData))
-}
-
-func getStatusEmoji(status string) string {
-	switch status {
-	case "healthy":
-		return "🟢 "
-	case "degraded":
-		return "🟡 "
-	case "unhealthy":
-		return "🔴 "
-	default:
-		return "⚪ "
-	}
-}
-
-func getBoolEmoji(b bool) string {
-	if b {
-		return "✅ "
-	}
-	return "❌ "
-}
-
-func formatBytes(bytes int64) string {
-	const unit = 1024
-	if bytes < unit {
-		return fmt.Sprintf("%d B", bytes)
-	}
-	div, exp := int64(unit), 0
-	for n := bytes / unit; n >= unit; n /= unit {
-		div *= unit
-		exp++
-	}
-	return fmt.Sprintf("%.1f %cB", float64(bytes)/float64(div), "KMGTPE"[exp])
-}

pkg/cli/dev_commands.go

@@ -1,197 +0,0 @@
-package cli
-
-import (
-	"context"
-	"fmt"
-	"os"
-	"os/exec"
-	"path/filepath"
-
-	"github.com/DeBrosOfficial/network/pkg/environments/development"
-)
-
-// HandleDevCommand handles the dev command group
-func HandleDevCommand(args []string) {
-	if len(args) == 0 {
-		showDevHelp()
-		return
-	}
-
-	subcommand := args[0]
-	subargs := args[1:]
-
-	switch subcommand {
-	case "up":
-		handleDevUp(subargs)
-	case "down":
-		handleDevDown(subargs)
-	case "status":
-		handleDevStatus(subargs)
-	case "logs":
-		handleDevLogs(subargs)
-	case "help":
-		showDevHelp()
-	default:
-		fmt.Fprintf(os.Stderr, "Unknown dev subcommand: %s\n", subcommand)
-		showDevHelp()
-		os.Exit(1)
-	}
-}
-
-func showDevHelp() {
-	fmt.Printf("🚀 Development Environment Commands\n\n")
-	fmt.Printf("Usage: orama dev <subcommand> [options]\n\n")
-	fmt.Printf("Subcommands:\n")
-	fmt.Printf("  up                - Start development environment (5 nodes + gateway)\n")
-	fmt.Printf("  down              - Stop all development services\n")
-	fmt.Printf("  status            - Show status of running services\n")
-	fmt.Printf("  logs <component>  - Tail logs for a component\n")
-	fmt.Printf("  help              - Show this help\n\n")
-	fmt.Printf("Examples:\n")
-	fmt.Printf("  orama dev up\n")
-	fmt.Printf("  orama dev down\n")
-	fmt.Printf("  orama dev status\n")
-	fmt.Printf("  orama dev logs node-1 --follow\n")
-}
-
-func handleDevUp(args []string) {
-	ctx := context.Background()
-
-	// Get home directory and .orama path
-	homeDir, err := os.UserHomeDir()
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "❌ Failed to get home directory: %v\n", err)
-		os.Exit(1)
-	}
-	oramaDir := filepath.Join(homeDir, ".orama")
-
-	// Step 1: Check dependencies
-	fmt.Printf("📋 Checking dependencies...\n\n")
-	checker := development.NewDependencyChecker()
-	if _, err := checker.CheckAll(); err != nil {
-		fmt.Fprintf(os.Stderr, "❌ %v\n", err)
-		os.Exit(1)
-	}
-	fmt.Printf("✓ All required dependencies available\n\n")
-
-	// Step 2: Check ports
-	fmt.Printf("🔌 Checking port availability...\n\n")
-	portChecker := development.NewPortChecker()
-	if _, err := portChecker.CheckAll(); err != nil {
-		fmt.Fprintf(os.Stderr, "❌ %v\n\n", err)
-		fmt.Fprintf(os.Stderr, "Port mapping:\n")
-		for port, service := range development.PortMap() {
-			fmt.Fprintf(os.Stderr, "  %d - %s\n", port, service)
-		}
-		fmt.Fprintf(os.Stderr, "\n")
-		os.Exit(1)
-	}
-	fmt.Printf("✓ All required ports available\n\n")
-
-	// Step 3: Ensure configs
-	fmt.Printf("⚙️  Preparing configuration files...\n\n")
-	ensurer := development.NewConfigEnsurer(oramaDir)
-	if err := ensurer.EnsureAll(); err != nil {
-		fmt.Fprintf(os.Stderr, "❌ Failed to prepare configs: %v\n", err)
-		os.Exit(1)
-	}
-	fmt.Printf("\n")
-
-	// Step 4: Start services
-	pm := development.NewProcessManager(oramaDir, os.Stdout)
-	if err := pm.StartAll(ctx); err != nil {
-		fmt.Fprintf(os.Stderr, "❌ Error starting services: %v\n", err)
-		os.Exit(1)
-	}
-
-	// Step 5: Show summary
-	fmt.Printf("🎉 Development environment is running!\n\n")
-	fmt.Printf("Key endpoints:\n")
-	fmt.Printf("  Gateway:              http://localhost:6001\n")
-	fmt.Printf("  Node-1 IPFS:          http://localhost:4501\n")
-	fmt.Printf("  Node-2 IPFS:          http://localhost:4502\n")
-	fmt.Printf("  Node-3 IPFS:          http://localhost:4503\n")
-	fmt.Printf("  Node-4 IPFS:          http://localhost:4504\n")
-	fmt.Printf("  Node-5 IPFS:          http://localhost:4505\n")
-	fmt.Printf("  Anon SOCKS:           127.0.0.1:9050\n")
-	fmt.Printf("  Olric Cache:          http://localhost:3320\n\n")
-	fmt.Printf("Useful commands:\n")
-	fmt.Printf("  orama dev status       - Show status\n")
-	fmt.Printf("  orama dev logs node-1  - Node-1 logs\n")
-	fmt.Printf("  orama dev logs node-2  - Node-2 logs\n")
-	fmt.Printf("  orama dev down         - Stop all services\n\n")
-	fmt.Printf("Logs directory: %s/logs\n\n", oramaDir)
-}
-
-func handleDevDown(args []string) {
-	homeDir, err := os.UserHomeDir()
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "❌ Failed to get home directory: %v\n", err)
-		os.Exit(1)
-	}
-	oramaDir := filepath.Join(homeDir, ".orama")
-
-	pm := development.NewProcessManager(oramaDir, os.Stdout)
-	ctx := context.Background()
-
-	if err := pm.StopAll(ctx); err != nil {
-		fmt.Fprintf(os.Stderr, "⚠️  Error stopping services: %v\n", err)
-		os.Exit(1)
-	}
-
-	fmt.Printf("✅ All services have been stopped\n\n")
-}
-
-func handleDevStatus(args []string) {
-	homeDir, err := os.UserHomeDir()
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "❌ Failed to get home directory: %v\n", err)
-		os.Exit(1)
-	}
-	oramaDir := filepath.Join(homeDir, ".orama")
-
-	pm := development.NewProcessManager(oramaDir, os.Stdout)
-	ctx := context.Background()
-
-	pm.Status(ctx)
-}
-
-func handleDevLogs(args []string) {
-	if len(args) == 0 {
-		fmt.Fprintf(os.Stderr, "Usage: dbn dev logs <component> [--follow]\n")
-		fmt.Fprintf(os.Stderr, "\nComponents: node-1, node-2, node-3, node-4, node-5, gateway, ipfs-node-1, ipfs-node-2, ipfs-node-3, ipfs-node-4, ipfs-node-5, olric, anon\n")
-		os.Exit(1)
-	}
-
-	component := args[0]
-	follow := len(args) > 1 && args[1] == "--follow"
-
-	homeDir, err := os.UserHomeDir()
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "❌ Failed to get home directory: %v\n", err)
-		os.Exit(1)
-	}
-	oramaDir := filepath.Join(homeDir, ".orama")
-
-	logPath := filepath.Join(oramaDir, "logs", fmt.Sprintf("%s.log", component))
-	if _, err := os.Stat(logPath); os.IsNotExist(err) {
-		fmt.Fprintf(os.Stderr, "❌ Log file not found: %s\n", logPath)
-		os.Exit(1)
-	}
-
-	if follow {
-		// Run tail -f
-		tailCmd := fmt.Sprintf("tail -f %s", logPath)
-		fmt.Printf("Following %s (press Ctrl+C to stop)...\n\n", logPath)
-		// syscall.Exec doesn't work in all environments, use exec.Command instead
-		cmd := exec.Command("sh", "-c", tailCmd)
-		cmd.Stdout = os.Stdout
-		cmd.Stderr = os.Stderr
-		cmd.Stdin = os.Stdin
-		cmd.Run()
-	} else {
-		// Cat the file
-		data, _ := os.ReadFile(logPath)
-		fmt.Print(string(data))
-	}
-}

pkg/cli/env_commands.go

@@ -1,142 +0,0 @@
-package cli
-
-import (
-	"fmt"
-	"os"
-)
-
-// HandleEnvCommand handles the 'env' command and its subcommands
-func HandleEnvCommand(args []string) {
-	if len(args) == 0 {
-		showEnvHelp()
-		return
-	}
-
-	subcommand := args[0]
-	subargs := args[1:]
-
-	switch subcommand {
-	case "list":
-		handleEnvList()
-	case "current":
-		handleEnvCurrent()
-	case "switch":
-		handleEnvSwitch(subargs)
-	case "enable":
-		handleEnvEnable(subargs)
-	case "help":
-		showEnvHelp()
-	default:
-		fmt.Fprintf(os.Stderr, "Unknown env subcommand: %s\n", subcommand)
-		showEnvHelp()
-		os.Exit(1)
-	}
-}
-
-func showEnvHelp() {
-	fmt.Printf("🌍 Environment Management Commands\n\n")
-	fmt.Printf("Usage: dbn env <subcommand>\n\n")
-	fmt.Printf("Subcommands:\n")
-	fmt.Printf("  list       - List all available environments\n")
-	fmt.Printf("  current    - Show current active environment\n")
-	fmt.Printf("  switch     - Switch to a different environment\n")
-	fmt.Printf("  enable     - Alias for 'switch' (e.g., 'devnet enable')\n\n")
-	fmt.Printf("Available Environments:\n")
-	fmt.Printf("  local      - Local development (http://localhost:6001)\n")
-	fmt.Printf("  devnet     - Development network (https://devnet.orama.network)\n")
-	fmt.Printf("  testnet    - Test network (https://testnet.orama.network)\n\n")
-	fmt.Printf("Examples:\n")
-	fmt.Printf("  dbn env list\n")
-	fmt.Printf("  dbn env current\n")
-	fmt.Printf("  dbn env switch devnet\n")
-	fmt.Printf("  dbn env enable testnet\n")
-	fmt.Printf("  dbn devnet enable      # Shorthand for switch to devnet\n")
-	fmt.Printf("  dbn testnet enable     # Shorthand for switch to testnet\n")
-}
-
-func handleEnvList() {
-	// Initialize environments if needed
-	if err := InitializeEnvironments(); err != nil {
-		fmt.Fprintf(os.Stderr, "❌ Failed to initialize environments: %v\n", err)
-		os.Exit(1)
-	}
-
-	envConfig, err := LoadEnvironmentConfig()
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "❌ Failed to load environment config: %v\n", err)
-		os.Exit(1)
-	}
-
-	fmt.Printf("🌍 Available Environments:\n\n")
-	for _, env := range envConfig.Environments {
-		active := ""
-		if env.Name == envConfig.ActiveEnvironment {
-			active = " ✅ (active)"
-		}
-		fmt.Printf("  %s%s\n", env.Name, active)
-		fmt.Printf("    Gateway: %s\n", env.GatewayURL)
-		fmt.Printf("    Description: %s\n\n", env.Description)
-	}
-}
-
-func handleEnvCurrent() {
-	// Initialize environments if needed
-	if err := InitializeEnvironments(); err != nil {
-		fmt.Fprintf(os.Stderr, "❌ Failed to initialize environments: %v\n", err)
-		os.Exit(1)
-	}
-
-	env, err := GetActiveEnvironment()
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "❌ Failed to get active environment: %v\n", err)
-		os.Exit(1)
-	}
-
-	fmt.Printf("✅ Current Environment: %s\n", env.Name)
-	fmt.Printf("   Gateway URL: %s\n", env.GatewayURL)
-	fmt.Printf("   Description: %s\n", env.Description)
-}
-
-func handleEnvSwitch(args []string) {
-	if len(args) == 0 {
-		fmt.Fprintf(os.Stderr, "Usage: dbn env switch <environment>\n")
-		fmt.Fprintf(os.Stderr, "Available: local, devnet, testnet\n")
-		os.Exit(1)
-	}
-
-	envName := args[0]
-
-	// Initialize environments if needed
-	if err := InitializeEnvironments(); err != nil {
-		fmt.Fprintf(os.Stderr, "❌ Failed to initialize environments: %v\n", err)
-		os.Exit(1)
-	}
-
-	// Get old environment
-	oldEnv, _ := GetActiveEnvironment()
-
-	// Switch environment
-	if err := SwitchEnvironment(envName); err != nil {
-		fmt.Fprintf(os.Stderr, "❌ Failed to switch environment: %v\n", err)
-		os.Exit(1)
-	}
-
-	// Get new environment
-	newEnv, err := GetActiveEnvironment()
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "❌ Failed to get new environment: %v\n", err)
-		os.Exit(1)
-	}
-
-	if oldEnv != nil && oldEnv.Name != newEnv.Name {
-		fmt.Printf("✅ Switched environment: %s → %s\n", oldEnv.Name, newEnv.Name)
-	} else {
-		fmt.Printf("✅ Environment set to: %s\n", newEnv.Name)
-	}
-	fmt.Printf("   Gateway URL: %s\n", newEnv.GatewayURL)
-}
-
-func handleEnvEnable(args []string) {
-	// 'enable' is just an alias for 'switch'
-	handleEnvSwitch(args)
-}

pkg/cli/environment.go

@@ -1,191 +0,0 @@
-package cli
-
-import (
-	"encoding/json"
-	"fmt"
-	"os"
-	"path/filepath"
-
-	"github.com/DeBrosOfficial/network/pkg/config"
-)
-
-// Environment represents a DeBros network environment
-type Environment struct {
-	Name        string `json:"name"`
-	GatewayURL  string `json:"gateway_url"`
-	Description string `json:"description"`
-	IsActive    bool   `json:"is_active"`
-}
-
-// EnvironmentConfig stores all configured environments
-type EnvironmentConfig struct {
-	Environments      []Environment `json:"environments"`
-	ActiveEnvironment string        `json:"active_environment"`
-}
-
-// Default environments
-var DefaultEnvironments = []Environment{
-	{
-		Name:        "local",
-		GatewayURL:  "http://localhost:6001",
-		Description: "Local development environment (node-1)",
-		IsActive:    true,
-	},
-	{
-		Name:        "devnet",
-		GatewayURL:  "https://devnet.orama.network",
-		Description: "Development network (testnet)",
-		IsActive:    false,
-	},
-	{
-		Name:        "testnet",
-		GatewayURL:  "https://testnet.orama.network",
-		Description: "Test network (staging)",
-		IsActive:    false,
-	},
-}
-
-// GetEnvironmentConfigPath returns the path to the environment config file
-func GetEnvironmentConfigPath() (string, error) {
-	configDir, err := config.ConfigDir()
-	if err != nil {
-		return "", fmt.Errorf("failed to get config directory: %w", err)
-	}
-	return filepath.Join(configDir, "environments.json"), nil
-}
-
-// LoadEnvironmentConfig loads the environment configuration
-func LoadEnvironmentConfig() (*EnvironmentConfig, error) {
-	path, err := GetEnvironmentConfigPath()
-	if err != nil {
-		return nil, err
-	}
-
-	// If file doesn't exist, return default config
-	if _, err := os.Stat(path); os.IsNotExist(err) {
-		return &EnvironmentConfig{
-			Environments:      DefaultEnvironments,
-			ActiveEnvironment: "local",
-		}, nil
-	}
-
-	data, err := os.ReadFile(path)
-	if err != nil {
-		return nil, fmt.Errorf("failed to read environment config: %w", err)
-	}
-
-	var envConfig EnvironmentConfig
-	if err := json.Unmarshal(data, &envConfig); err != nil {
-		return nil, fmt.Errorf("failed to parse environment config: %w", err)
-	}
-
-	return &envConfig, nil
-}
-
-// SaveEnvironmentConfig saves the environment configuration
-func SaveEnvironmentConfig(envConfig *EnvironmentConfig) error {
-	path, err := GetEnvironmentConfigPath()
-	if err != nil {
-		return err
-	}
-
-	// Ensure config directory exists
-	configDir := filepath.Dir(path)
-	if err := os.MkdirAll(configDir, 0755); err != nil {
-		return fmt.Errorf("failed to create config directory: %w", err)
-	}
-
-	data, err := json.MarshalIndent(envConfig, "", "  ")
-	if err != nil {
-		return fmt.Errorf("failed to marshal environment config: %w", err)
-	}
-
-	if err := os.WriteFile(path, data, 0644); err != nil {
-		return fmt.Errorf("failed to write environment config: %w", err)
-	}
-
-	return nil
-}
-
-// GetActiveEnvironment returns the currently active environment
-func GetActiveEnvironment() (*Environment, error) {
-	envConfig, err := LoadEnvironmentConfig()
-	if err != nil {
-		return nil, err
-	}
-
-	for _, env := range envConfig.Environments {
-		if env.Name == envConfig.ActiveEnvironment {
-			return &env, nil
-		}
-	}
-
-	// Fallback to local if active environment not found
-	for _, env := range envConfig.Environments {
-		if env.Name == "local" {
-			return &env, nil
-		}
-	}
-
-	return nil, fmt.Errorf("no active environment found")
-}
-
-// SwitchEnvironment switches to a different environment
-func SwitchEnvironment(name string) error {
-	envConfig, err := LoadEnvironmentConfig()
-	if err != nil {
-		return err
-	}
-
-	// Check if environment exists
-	found := false
-	for _, env := range envConfig.Environments {
-		if env.Name == name {
-			found = true
-			break
-		}
-	}
-
-	if !found {
-		return fmt.Errorf("environment '%s' not found", name)
-	}
-
-	envConfig.ActiveEnvironment = name
-	return SaveEnvironmentConfig(envConfig)
-}
-
-// GetEnvironmentByName returns an environment by name
-func GetEnvironmentByName(name string) (*Environment, error) {
-	envConfig, err := LoadEnvironmentConfig()
-	if err != nil {
-		return nil, err
-	}
-
-	for _, env := range envConfig.Environments {
-		if env.Name == name {
-			return &env, nil
-		}
-	}
-
-	return nil, fmt.Errorf("environment '%s' not found", name)
-}
-
-// InitializeEnvironments initializes the environment config with defaults
-func InitializeEnvironments() error {
-	path, err := GetEnvironmentConfigPath()
-	if err != nil {
-		return err
-	}
-
-	// Don't overwrite existing config
-	if _, err := os.Stat(path); err == nil {
-		return nil
-	}
-
-	envConfig := &EnvironmentConfig{
-		Environments:      DefaultEnvironments,
-		ActiveEnvironment: "local",
-	}
-
-	return SaveEnvironmentConfig(envConfig)
-}

pkg/cli/prod_commands_test.go

@@ -1,172 +0,0 @@
-package cli
-
-import (
-	"testing"
-)
-
-// TestProdCommandFlagParsing verifies that prod command flags are parsed correctly
-// Note: The installer now uses --vps-ip presence to determine if it's a first node (no --bootstrap flag)
-// First node: has --vps-ip but no --peers or --join
-// Joining node: has --vps-ip, --peers, and --cluster-secret
-func TestProdCommandFlagParsing(t *testing.T) {
-	tests := []struct {
-		name          string
-		args          []string
-		expectVPSIP   string
-		expectDomain  string
-		expectPeers   string
-		expectJoin    string
-		expectSecret  string
-		expectBranch  string
-		isFirstNode   bool // first node = no peers and no join address
-	}{
-		{
-			name:        "first node (creates new cluster)",
-			args:        []string{"install", "--vps-ip", "10.0.0.1", "--domain", "node-1.example.com"},
-			expectVPSIP: "10.0.0.1",
-			expectDomain: "node-1.example.com",
-			isFirstNode: true,
-		},
-		{
-			name:         "joining node with peers",
-			args:         []string{"install", "--vps-ip", "10.0.0.2", "--peers", "/ip4/10.0.0.1/tcp/4001/p2p/Qm123", "--cluster-secret", "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"},
-			expectVPSIP:  "10.0.0.2",
-			expectPeers:  "/ip4/10.0.0.1/tcp/4001/p2p/Qm123",
-			expectSecret: "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
-			isFirstNode:  false,
-		},
-		{
-			name:        "joining node with join address",
-			args:        []string{"install", "--vps-ip", "10.0.0.3", "--join", "10.0.0.1:7001", "--cluster-secret", "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"},
-			expectVPSIP: "10.0.0.3",
-			expectJoin:  "10.0.0.1:7001",
-			expectSecret: "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
-			isFirstNode: false,
-		},
-		{
-			name:         "with nightly branch",
-			args:         []string{"install", "--vps-ip", "10.0.0.4", "--branch", "nightly"},
-			expectVPSIP:  "10.0.0.4",
-			expectBranch: "nightly",
-			isFirstNode:  true,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			// Extract flags manually to verify parsing logic
-			var vpsIP, domain, peersStr, joinAddr, clusterSecret, branch string
-
-			for i, arg := range tt.args {
-				switch arg {
-				case "--vps-ip":
-					if i+1 < len(tt.args) {
-						vpsIP = tt.args[i+1]
-					}
-				case "--domain":
-					if i+1 < len(tt.args) {
-						domain = tt.args[i+1]
-					}
-				case "--peers":
-					if i+1 < len(tt.args) {
-						peersStr = tt.args[i+1]
-					}
-				case "--join":
-					if i+1 < len(tt.args) {
-						joinAddr = tt.args[i+1]
-					}
-				case "--cluster-secret":
-					if i+1 < len(tt.args) {
-						clusterSecret = tt.args[i+1]
-					}
-				case "--branch":
-					if i+1 < len(tt.args) {
-						branch = tt.args[i+1]
-					}
-				}
-			}
-
-			// First node detection: no peers and no join address
-			isFirstNode := peersStr == "" && joinAddr == ""
-
-			if vpsIP != tt.expectVPSIP {
-				t.Errorf("expected vpsIP=%q, got %q", tt.expectVPSIP, vpsIP)
-			}
-			if domain != tt.expectDomain {
-				t.Errorf("expected domain=%q, got %q", tt.expectDomain, domain)
-			}
-			if peersStr != tt.expectPeers {
-				t.Errorf("expected peers=%q, got %q", tt.expectPeers, peersStr)
-			}
-			if joinAddr != tt.expectJoin {
-				t.Errorf("expected join=%q, got %q", tt.expectJoin, joinAddr)
-			}
-			if clusterSecret != tt.expectSecret {
-				t.Errorf("expected clusterSecret=%q, got %q", tt.expectSecret, clusterSecret)
-			}
-			if branch != tt.expectBranch {
-				t.Errorf("expected branch=%q, got %q", tt.expectBranch, branch)
-			}
-			if isFirstNode != tt.isFirstNode {
-				t.Errorf("expected isFirstNode=%v, got %v", tt.isFirstNode, isFirstNode)
-			}
-		})
-	}
-}
-
-// TestNormalizePeers tests the peer multiaddr normalization
-func TestNormalizePeers(t *testing.T) {
-	tests := []struct {
-		name        string
-		input       string
-		expectCount int
-		expectError bool
-	}{
-		{
-			name:        "empty string",
-			input:       "",
-			expectCount: 0,
-			expectError: false,
-		},
-	{
-		name:        "single peer",
-		input:       "/ip4/10.0.0.1/tcp/4001/p2p/12D3KooWHbcFcrGPXKUrHcxvd8MXEeUzRYyvY8fQcpEBxncSUwhj",
-		expectCount: 1,
-		expectError: false,
-	},
-	{
-		name:        "multiple peers",
-		input:       "/ip4/10.0.0.1/tcp/4001/p2p/12D3KooWHbcFcrGPXKUrHcxvd8MXEeUzRYyvY8fQcpEBxncSUwhj,/ip4/10.0.0.2/tcp/4001/p2p/12D3KooWJzL4SHW3o7sZpzjfEPJzC6Ky7gKvJxY8vQVDR2jHc8F1",
-		expectCount: 2,
-		expectError: false,
-	},
-	{
-		name:        "duplicate peers deduplicated",
-		input:       "/ip4/10.0.0.1/tcp/4001/p2p/12D3KooWHbcFcrGPXKUrHcxvd8MXEeUzRYyvY8fQcpEBxncSUwhj,/ip4/10.0.0.1/tcp/4001/p2p/12D3KooWHbcFcrGPXKUrHcxvd8MXEeUzRYyvY8fQcpEBxncSUwhj",
-		expectCount: 1,
-		expectError: false,
-	},
-		{
-			name:        "invalid multiaddr",
-			input:       "not-a-multiaddr",
-			expectCount: 0,
-			expectError: true,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			peers, err := normalizePeers(tt.input)
-			
-			if tt.expectError && err == nil {
-				t.Errorf("expected error but got none")
-			}
-			if !tt.expectError && err != nil {
-				t.Errorf("unexpected error: %v", err)
-			}
-			if len(peers) != tt.expectCount {
-				t.Errorf("expected %d peers, got %d", tt.expectCount, len(peers))
-			}
-		})
-	}
-}

pkg/client/client.go

@@ -35,7 +35,6 @@ type Client struct {
 	database *DatabaseClientImpl
 	network  *NetworkInfoImpl
 	pubsub   *pubSubBridge
-	storage  *StorageClientImpl
 
 	// State
 	connected bool
@@ -71,7 +70,6 @@ func NewClient(config *ClientConfig) (NetworkClient, error) {
 	// Initialize components (will be configured when connected)
 	client.database = &DatabaseClientImpl{client: client}
 	client.network = &NetworkInfoImpl{client: client}
-	client.storage = &StorageClientImpl{client: client}
 
 	return client, nil
 }
@@ -91,11 +89,6 @@ func (c *Client) Network() NetworkInfo {
 	return c.network
 }
 
-// Storage returns the storage client
-func (c *Client) Storage() StorageClient {
-	return c.storage
-}
-
 // Config returns a snapshot copy of the client's configuration
 func (c *Client) Config() *ClientConfig {
 	c.mu.RLock()
@@ -165,8 +158,6 @@ func (c *Client) Connect() error {
 	var ps *libp2ppubsub.PubSub
 	ps, err = libp2ppubsub.NewGossipSub(context.Background(), h,
 		libp2ppubsub.WithPeerExchange(true),
-		libp2ppubsub.WithFloodPublish(true), // Ensure messages reach all peers, not just mesh
-		libp2ppubsub.WithDirectPeers(nil),   // Enable direct peer connections
 	)
 	if err != nil {
 		h.Close()
@@ -195,49 +186,49 @@ func (c *Client) Connect() error {
 	c.pubsub = &pubSubBridge{client: c, adapter: adapter}
 	c.logger.Info("Pubsub bridge created successfully")
 
-	c.logger.Info("Starting peer connections...")
+	c.logger.Info("Starting bootstrap peer connections...")
 
-	// Connect to peers FIRST
+	// Connect to bootstrap peers FIRST
 	ctx, cancel := context.WithTimeout(context.Background(), c.config.ConnectTimeout)
 	defer cancel()
 
-	peersConnected := 0
+	bootstrapPeersConnected := 0
-	for _, peerAddr := range c.config.BootstrapPeers {
+	for _, bootstrapAddr := range c.config.BootstrapPeers {
-		c.logger.Info("Attempting to connect to peer", zap.String("addr", peerAddr))
+		c.logger.Info("Attempting to connect to bootstrap peer", zap.String("addr", bootstrapAddr))
-		if err := c.connectToPeer(ctx, peerAddr); err != nil {
+		if err := c.connectToBootstrap(ctx, bootstrapAddr); err != nil {
-			c.logger.Warn("Failed to connect to peer",
+			c.logger.Warn("Failed to connect to bootstrap peer",
-				zap.String("addr", peerAddr),
+				zap.String("addr", bootstrapAddr),
 				zap.Error(err))
 			continue
 		}
-		peersConnected++
+		bootstrapPeersConnected++
-		c.logger.Info("Successfully connected to peer", zap.String("addr", peerAddr))
+		c.logger.Info("Successfully connected to bootstrap peer", zap.String("addr", bootstrapAddr))
 	}
 
-	if peersConnected == 0 {
+	if bootstrapPeersConnected == 0 {
-		c.logger.Warn("No peers connected, continuing anyway")
+		c.logger.Warn("No bootstrap peers connected, continuing anyway")
 	} else {
-		c.logger.Info("Peer connections completed", zap.Int("connected_count", peersConnected))
+		c.logger.Info("Bootstrap peer connections completed", zap.Int("connected_count", bootstrapPeersConnected))
 	}
 
-	c.logger.Info("Adding peers to peerstore...")
+	c.logger.Info("Adding bootstrap peers to peerstore...")
 
-	// Add peers to peerstore so we can connect to them later
+	// Add bootstrap peers to peerstore so we can connect to them later
-	for _, peerAddr := range c.config.BootstrapPeers {
+	for _, bootstrapAddr := range c.config.BootstrapPeers {
-		if ma, err := multiaddr.NewMultiaddr(peerAddr); err == nil {
+		if ma, err := multiaddr.NewMultiaddr(bootstrapAddr); err == nil {
 			if peerInfo, err := peer.AddrInfoFromP2pAddr(ma); err == nil {
 				c.host.Peerstore().AddAddrs(peerInfo.ID, peerInfo.Addrs, time.Hour*24)
-				c.logger.Debug("Added peer to peerstore",
+				c.logger.Debug("Added bootstrap peer to peerstore",
 					zap.String("peer", peerInfo.ID.String()))
 			}
 		}
 	}
-	c.logger.Info("Peers added to peerstore")
+	c.logger.Info("Bootstrap peers added to peerstore")
 
 	c.logger.Info("Starting connection monitoring...")
 
 	// Client is a lightweight P2P participant - no discovery needed
-	// We only connect to known peers and let nodes handle discovery
+	// We only connect to known bootstrap peers and let nodes handle discovery
 	c.logger.Debug("Client configured as lightweight P2P participant (no discovery)")
 
 	// Start minimal connection monitoring

pkg/client/connect_bootstrap.go

@@ -9,8 +9,8 @@ import (
 	"go.uber.org/zap"
 )
 
-// connectToPeer connects to a peer address
+// connectToBootstrap connects to a bootstrap peer
-func (c *Client) connectToPeer(ctx context.Context, addr string) error {
+func (c *Client) connectToBootstrap(ctx context.Context, addr string) error {
 	ma, err := multiaddr.NewMultiaddr(addr)
 	if err != nil {
 		return fmt.Errorf("invalid multiaddr: %w", err)
@@ -20,14 +20,14 @@ func (c *Client) connectToPeer(ctx context.Context, addr string) error {
 	peerInfo, err := peer.AddrInfoFromP2pAddr(ma)
 	if err != nil {
 		// If there's no peer ID, we can't connect
-		c.logger.Warn("Peer address missing peer ID, skipping",
+		c.logger.Warn("Bootstrap address missing peer ID, skipping",
 			zap.String("addr", addr))
 		return nil
 	}
 
-	// Avoid dialing ourselves: if the peer address resolves to our own peer ID, skip.
+	// Avoid dialing ourselves: if the bootstrap address resolves to our own peer ID, skip.
 	if c.host != nil && peerInfo.ID == c.host.ID() {
-		c.logger.Debug("Skipping peer address because it resolves to self",
+		c.logger.Debug("Skipping bootstrap address because it resolves to self",
 			zap.String("addr", addr),
 			zap.String("peer_id", peerInfo.ID.String()))
 		return nil
@@ -38,7 +38,7 @@ func (c *Client) connectToPeer(ctx context.Context, addr string) error {
 		return fmt.Errorf("failed to connect to peer: %w", err)
 	}
 
-	c.logger.Debug("Connected to peer",
+	c.logger.Debug("Connected to bootstrap peer",
 		zap.String("peer_id", peerInfo.ID.String()),
 		zap.String("addr", addr))
 

pkg/client/defaults.go

@@ -9,24 +9,9 @@ import (
 	"github.com/multiformats/go-multiaddr"
 )
 
-// DefaultBootstrapPeers returns the default peer multiaddrs.
+// DefaultBootstrapPeers returns the library's default bootstrap peer multiaddrs.
 // These can be overridden by environment variables or config.
 func DefaultBootstrapPeers() []string {
-	// Check environment variable first
-	if envPeers := os.Getenv("DEBROS_BOOTSTRAP_PEERS"); envPeers != "" {
-		peers := splitCSVOrSpace(envPeers)
-		// Filter out empty strings
-		result := make([]string, 0, len(peers))
-		for _, p := range peers {
-			if p != "" {
-				result = append(result, p)
-			}
-		}
-		if len(result) > 0 {
-			return result
-		}
-	}
-
 	defaultCfg := config.DefaultConfig()
 	return defaultCfg.Discovery.BootstrapPeers
 }
@@ -48,7 +33,7 @@ func DefaultDatabaseEndpoints() []string {
 		}
 	}
 
-	// Try to derive from configured peers if available
+	// Try to derive from bootstrap peers if available
 	peers := DefaultBootstrapPeers()
 	if len(peers) > 0 {
 		endpoints := make([]string, 0, len(peers))

pkg/client/defaults_test.go

@@ -10,15 +10,10 @@ import (
 func TestDefaultBootstrapPeersNonEmpty(t *testing.T) {
 	old := os.Getenv("DEBROS_BOOTSTRAP_PEERS")
 	t.Cleanup(func() { os.Setenv("DEBROS_BOOTSTRAP_PEERS", old) })
-	// Set a valid peer
+	_ = os.Setenv("DEBROS_BOOTSTRAP_PEERS", "") // ensure not set
-	validPeer := "/ip4/127.0.0.1/tcp/4001/p2p/12D3KooWHbcFcrGPXKUrHcxvd8MXEeUzRYyvY8fQcpEBxncSUwhj"
-	_ = os.Setenv("DEBROS_BOOTSTRAP_PEERS", validPeer)
 	peers := DefaultBootstrapPeers()
 	if len(peers) == 0 {
-		t.Fatalf("expected non-empty default peers")
+		t.Fatalf("expected non-empty default bootstrap peers")
-	}
-	if peers[0] != validPeer {
-		t.Fatalf("expected peer %s, got %s", validPeer, peers[0])
 	}
 }
 
@@ -50,10 +45,7 @@ func TestNormalizeEndpoints(t *testing.T) {
 }
 
 func TestEndpointFromMultiaddr(t *testing.T) {
-	ma, err := multiaddr.NewMultiaddr("/ip4/127.0.0.1/tcp/4001")
+	ma, _ := multiaddr.NewMultiaddr("/ip4/127.0.0.1/tcp/4001")
-	if err != nil {
-		t.Fatalf("failed to create multiaddr: %v", err)
-	}
 	if ep := endpointFromMultiaddr(ma, 5001); ep != "http://127.0.0.1:5001" {
 		t.Fatalf("unexpected endpoint: %s", ep)
 	}

pkg/client/implementations.go

@@ -2,9 +2,7 @@ package client
 
 import (
 	"context"
-	"encoding/json"
 	"fmt"
-	"net/http"
 	"strings"
 	"sync"
 	"time"
@@ -162,31 +160,17 @@ func (d *DatabaseClientImpl) isWriteOperation(sql string) bool {
 func (d *DatabaseClientImpl) clearConnection() {
 	d.mu.Lock()
 	defer d.mu.Unlock()
-	if d.connection != nil {
+	d.connection = nil
-		d.connection.Close()
-		d.connection = nil
-	}
 }
 
 // getRQLiteConnection returns a connection to RQLite, creating one if needed
 func (d *DatabaseClientImpl) getRQLiteConnection() (*gorqlite.Connection, error) {
-	d.mu.RLock()
-	conn := d.connection
-	d.mu.RUnlock()
-
-	if conn != nil {
-		return conn, nil
-	}
-
-	newConn, err := d.connectToAvailableNode()
-	if err != nil {
-		return nil, err
-	}
-
 	d.mu.Lock()
-	d.connection = newConn
+	defer d.mu.Unlock()
-	d.mu.Unlock()
+
-	return newConn, nil
+	// Always try to get a fresh connection to handle leadership changes
+	// and node failures gracefully
+	return d.connectToAvailableNode()
 }
 
 // getRQLiteNodes returns a list of RQLite node URLs with precedence:
@@ -243,6 +227,7 @@ func (d *DatabaseClientImpl) connectToAvailableNode() (*gorqlite.Connection, err
 			continue
 		}
 
+		d.connection = conn
 		return conn, nil
 	}
 
@@ -506,100 +491,15 @@ func (n *NetworkInfoImpl) GetStatus(ctx context.Context) (*NetworkStatus, error)
 		}
 	}
 
-	// Try to get IPFS peer info (optional - don't fail if unavailable)
-	ipfsInfo := queryIPFSPeerInfo()
-
-	// Try to get IPFS Cluster peer info (optional - don't fail if unavailable)
-	ipfsClusterInfo := queryIPFSClusterPeerInfo()
-
 	return &NetworkStatus{
 		NodeID:       host.ID().String(),
-		PeerID:       host.ID().String(),
 		Connected:    true,
 		PeerCount:    len(connectedPeers),
 		DatabaseSize: dbSize,
 		Uptime:       time.Since(n.client.startTime),
-		IPFS:         ipfsInfo,
-		IPFSCluster:  ipfsClusterInfo,
 	}, nil
 }
 
-// queryIPFSPeerInfo queries the local IPFS API for peer information
-// Returns nil if IPFS is not running or unavailable
-func queryIPFSPeerInfo() *IPFSPeerInfo {
-	// IPFS API typically runs on port 4501 in our setup
-	client := &http.Client{Timeout: 2 * time.Second}
-	resp, err := client.Post("http://localhost:4501/api/v0/id", "", nil)
-	if err != nil {
-		return nil // IPFS not available
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK {
-		return nil
-	}
-
-	var result struct {
-		ID        string   `json:"ID"`
-		Addresses []string `json:"Addresses"`
-	}
-	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
-		return nil
-	}
-
-	// Filter addresses to only include public/routable ones
-	var swarmAddrs []string
-	for _, addr := range result.Addresses {
-		// Skip loopback and private addresses for external discovery
-		if !strings.Contains(addr, "127.0.0.1") && !strings.Contains(addr, "/ip6/::1") {
-			swarmAddrs = append(swarmAddrs, addr)
-		}
-	}
-
-	return &IPFSPeerInfo{
-		PeerID:         result.ID,
-		SwarmAddresses: swarmAddrs,
-	}
-}
-
-// queryIPFSClusterPeerInfo queries the local IPFS Cluster API for peer information
-// Returns nil if IPFS Cluster is not running or unavailable
-func queryIPFSClusterPeerInfo() *IPFSClusterPeerInfo {
-	// IPFS Cluster API typically runs on port 9094 in our setup
-	client := &http.Client{Timeout: 2 * time.Second}
-	resp, err := client.Get("http://localhost:9094/id")
-	if err != nil {
-		return nil // IPFS Cluster not available
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK {
-		return nil
-	}
-
-	var result struct {
-		ID        string   `json:"id"`
-		Addresses []string `json:"addresses"`
-	}
-	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
-		return nil
-	}
-
-	// Filter addresses to only include public/routable ones for cluster discovery
-	var clusterAddrs []string
-	for _, addr := range result.Addresses {
-		// Skip loopback addresses - only keep routable addresses
-		if !strings.Contains(addr, "127.0.0.1") && !strings.Contains(addr, "/ip6/::1") {
-			clusterAddrs = append(clusterAddrs, addr)
-		}
-	}
-
-	return &IPFSClusterPeerInfo{
-		PeerID:    result.ID,
-		Addresses: clusterAddrs,
-	}
-}
-
 // ConnectToPeer connects to a specific peer
 func (n *NetworkInfoImpl) ConnectToPeer(ctx context.Context, peerAddr string) error {
 	if !n.client.isConnected() {

pkg/client/interface.go

@@ -3,7 +3,6 @@ package client
 import (
 	"context"
 	"fmt"
-	"io"
 	"time"
 )
 
@@ -18,9 +17,6 @@ type NetworkClient interface {
 	// Network information
 	Network() NetworkInfo
 
-	// Storage operations (IPFS)
-	Storage() StorageClient
-
 	// Lifecycle
 	Connect() error
 	Disconnect() error
@@ -55,24 +51,6 @@ type NetworkInfo interface {
 	DisconnectFromPeer(ctx context.Context, peerID string) error
 }
 
-// StorageClient provides IPFS storage operations
-type StorageClient interface {
-	// Upload uploads content to IPFS and pins it
-	Upload(ctx context.Context, reader io.Reader, name string) (*StorageUploadResult, error)
-
-	// Pin pins an existing CID
-	Pin(ctx context.Context, cid string, name string) (*StoragePinResult, error)
-
-	// Status gets the pin status for a CID
-	Status(ctx context.Context, cid string) (*StorageStatus, error)
-
-	// Get retrieves content from IPFS by CID
-	Get(ctx context.Context, cid string) (io.ReadCloser, error)
-
-	// Unpin removes a pin from a CID
-	Unpin(ctx context.Context, cid string) error
-}
-
 // MessageHandler is called when a pub/sub message is received
 type MessageHandler func(topic string, data []byte) error
 
@@ -114,26 +92,11 @@ type PeerInfo struct {
 
 // NetworkStatus contains overall network status
 type NetworkStatus struct {
-	NodeID       string               `json:"node_id"`
+	NodeID       string        `json:"node_id"`
-	PeerID       string               `json:"peer_id"`
+	Connected    bool          `json:"connected"`
-	Connected    bool                 `json:"connected"`
+	PeerCount    int           `json:"peer_count"`
-	PeerCount    int                  `json:"peer_count"`
+	DatabaseSize int64         `json:"database_size"`
-	DatabaseSize int64                `json:"database_size"`
+	Uptime       time.Duration `json:"uptime"`
-	Uptime       time.Duration        `json:"uptime"`
-	IPFS         *IPFSPeerInfo        `json:"ipfs,omitempty"`
-	IPFSCluster  *IPFSClusterPeerInfo `json:"ipfs_cluster,omitempty"`
-}
-
-// IPFSPeerInfo contains IPFS peer information for discovery
-type IPFSPeerInfo struct {
-	PeerID         string   `json:"peer_id"`
-	SwarmAddresses []string `json:"swarm_addresses"`
-}
-
-// IPFSClusterPeerInfo contains IPFS Cluster peer information for cluster discovery
-type IPFSClusterPeerInfo struct {
-	PeerID    string   `json:"peer_id"`    // Cluster peer ID (different from IPFS peer ID)
-	Addresses []string `json:"addresses"`  // Cluster multiaddresses (e.g., /ip4/x.x.x.x/tcp/9098)
 }
 
 // HealthStatus contains health check information
@@ -144,38 +107,12 @@ type HealthStatus struct {
 	ResponseTime time.Duration     `json:"response_time"`
 }
 
-// StorageUploadResult represents the result of uploading content to IPFS
-type StorageUploadResult struct {
-	Cid  string `json:"cid"`
-	Name string `json:"name"`
-	Size int64  `json:"size"`
-}
-
-// StoragePinResult represents the result of pinning a CID
-type StoragePinResult struct {
-	Cid  string `json:"cid"`
-	Name string `json:"name"`
-}
-
-// StorageStatus represents the status of a pinned CID
-type StorageStatus struct {
-	Cid               string   `json:"cid"`
-	Name              string   `json:"name"`
-	Status            string   `json:"status"` // "pinned", "pinning", "queued", "unpinned", "error"
-	ReplicationMin    int      `json:"replication_min"`
-	ReplicationMax    int      `json:"replication_max"`
-	ReplicationFactor int      `json:"replication_factor"`
-	Peers             []string `json:"peers"`
-	Error             string   `json:"error,omitempty"`
-}
-
 // ClientConfig represents configuration for network clients
 type ClientConfig struct {
 	AppName           string        `json:"app_name"`
 	DatabaseName      string        `json:"database_name"`
-	BootstrapPeers    []string      `json:"peers"`
+	BootstrapPeers    []string      `json:"bootstrap_peers"`
 	DatabaseEndpoints []string      `json:"database_endpoints"`
-	GatewayURL        string        `json:"gateway_url"` // Gateway URL for HTTP API access (e.g., "http://localhost:6001")
 	ConnectTimeout    time.Duration `json:"connect_timeout"`
 	RetryAttempts     int           `json:"retry_attempts"`
 	RetryDelay        time.Duration `json:"retry_delay"`
@@ -195,7 +132,6 @@ func DefaultClientConfig(appName string) *ClientConfig {
 		DatabaseName:      fmt.Sprintf("%s_db", appName),
 		BootstrapPeers:    peers,
 		DatabaseEndpoints: endpoints,
-		GatewayURL:        "http://localhost:6001",
 		ConnectTimeout:    time.Second * 30,
 		RetryAttempts:     3,
 		RetryDelay:        time.Second * 5,

pkg/client/storage_client.go

@@ -1,245 +0,0 @@
-package client
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"fmt"
-	"io"
-	"mime/multipart"
-	"net/http"
-	"strings"
-	"time"
-)
-
-// StorageClientImpl implements StorageClient using HTTP requests to the gateway
-type StorageClientImpl struct {
-	client *Client
-}
-
-// Upload uploads content to IPFS and pins it
-func (s *StorageClientImpl) Upload(ctx context.Context, reader io.Reader, name string) (*StorageUploadResult, error) {
-	if err := s.client.requireAccess(ctx); err != nil {
-		return nil, fmt.Errorf("authentication required: %w", err)
-	}
-
-	gatewayURL := s.getGatewayURL()
-
-	// Create multipart form
-	var buf bytes.Buffer
-	writer := multipart.NewWriter(&buf)
-
-	// Add file field
-	part, err := writer.CreateFormFile("file", name)
-	if err != nil {
-		return nil, fmt.Errorf("failed to create form file: %w", err)
-	}
-
-	if _, err := io.Copy(part, reader); err != nil {
-		return nil, fmt.Errorf("failed to copy data: %w", err)
-	}
-
-	if err := writer.Close(); err != nil {
-		return nil, fmt.Errorf("failed to close writer: %w", err)
-	}
-
-	// Create request
-	req, err := http.NewRequestWithContext(ctx, "POST", gatewayURL+"/v1/storage/upload", &buf)
-	if err != nil {
-		return nil, fmt.Errorf("failed to create request: %w", err)
-	}
-
-	req.Header.Set("Content-Type", writer.FormDataContentType())
-	s.addAuthHeaders(req)
-
-	// Execute request
-	client := &http.Client{Timeout: 5 * time.Minute} // Large timeout for file uploads
-	resp, err := client.Do(req)
-	if err != nil {
-		return nil, fmt.Errorf("request failed: %w", err)
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK {
-		body, _ := io.ReadAll(resp.Body)
-		return nil, fmt.Errorf("upload failed with status %d: %s", resp.StatusCode, string(body))
-	}
-
-	var result StorageUploadResult
-	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
-		return nil, fmt.Errorf("failed to decode response: %w", err)
-	}
-
-	return &result, nil
-}
-
-// Pin pins an existing CID
-func (s *StorageClientImpl) Pin(ctx context.Context, cid string, name string) (*StoragePinResult, error) {
-	if err := s.client.requireAccess(ctx); err != nil {
-		return nil, fmt.Errorf("authentication required: %w", err)
-	}
-
-	gatewayURL := s.getGatewayURL()
-
-	reqBody := map[string]interface{}{
-		"cid": cid,
-	}
-	if name != "" {
-		reqBody["name"] = name
-	}
-
-	jsonBody, err := json.Marshal(reqBody)
-	if err != nil {
-		return nil, fmt.Errorf("failed to marshal request: %w", err)
-	}
-
-	req, err := http.NewRequestWithContext(ctx, "POST", gatewayURL+"/v1/storage/pin", bytes.NewReader(jsonBody))
-	if err != nil {
-		return nil, fmt.Errorf("failed to create request: %w", err)
-	}
-
-	req.Header.Set("Content-Type", "application/json")
-	s.addAuthHeaders(req)
-
-	client := &http.Client{Timeout: 60 * time.Second}
-	resp, err := client.Do(req)
-	if err != nil {
-		return nil, fmt.Errorf("request failed: %w", err)
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK {
-		body, _ := io.ReadAll(resp.Body)
-		return nil, fmt.Errorf("pin failed with status %d: %s", resp.StatusCode, string(body))
-	}
-
-	var result StoragePinResult
-	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
-		return nil, fmt.Errorf("failed to decode response: %w", err)
-	}
-
-	return &result, nil
-}
-
-// Status gets the pin status for a CID
-func (s *StorageClientImpl) Status(ctx context.Context, cid string) (*StorageStatus, error) {
-	if err := s.client.requireAccess(ctx); err != nil {
-		return nil, fmt.Errorf("authentication required: %w", err)
-	}
-
-	gatewayURL := s.getGatewayURL()
-
-	req, err := http.NewRequestWithContext(ctx, "GET", gatewayURL+"/v1/storage/status/"+cid, nil)
-	if err != nil {
-		return nil, fmt.Errorf("failed to create request: %w", err)
-	}
-
-	s.addAuthHeaders(req)
-
-	client := &http.Client{Timeout: 30 * time.Second}
-	resp, err := client.Do(req)
-	if err != nil {
-		return nil, fmt.Errorf("request failed: %w", err)
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK {
-		body, _ := io.ReadAll(resp.Body)
-		return nil, fmt.Errorf("status failed with status %d: %s", resp.StatusCode, string(body))
-	}
-
-	var result StorageStatus
-	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
-		return nil, fmt.Errorf("failed to decode response: %w", err)
-	}
-
-	return &result, nil
-}
-
-// Get retrieves content from IPFS by CID
-func (s *StorageClientImpl) Get(ctx context.Context, cid string) (io.ReadCloser, error) {
-	if err := s.client.requireAccess(ctx); err != nil {
-		return nil, fmt.Errorf("authentication required: %w", err)
-	}
-
-	gatewayURL := s.getGatewayURL()
-
-	req, err := http.NewRequestWithContext(ctx, "GET", gatewayURL+"/v1/storage/get/"+cid, nil)
-	if err != nil {
-		return nil, fmt.Errorf("failed to create request: %w", err)
-	}
-
-	s.addAuthHeaders(req)
-
-	client := &http.Client{Timeout: 5 * time.Minute} // Large timeout for file downloads
-	resp, err := client.Do(req)
-	if err != nil {
-		return nil, fmt.Errorf("request failed: %w", err)
-	}
-
-	if resp.StatusCode != http.StatusOK {
-		resp.Body.Close()
-		return nil, fmt.Errorf("get failed with status %d", resp.StatusCode)
-	}
-
-	return resp.Body, nil
-}
-
-// Unpin removes a pin from a CID
-func (s *StorageClientImpl) Unpin(ctx context.Context, cid string) error {
-	if err := s.client.requireAccess(ctx); err != nil {
-		return fmt.Errorf("authentication required: %w", err)
-	}
-
-	gatewayURL := s.getGatewayURL()
-
-	req, err := http.NewRequestWithContext(ctx, "DELETE", gatewayURL+"/v1/storage/unpin/"+cid, nil)
-	if err != nil {
-		return fmt.Errorf("failed to create request: %w", err)
-	}
-
-	s.addAuthHeaders(req)
-
-	client := &http.Client{Timeout: 30 * time.Second}
-	resp, err := client.Do(req)
-	if err != nil {
-		return fmt.Errorf("request failed: %w", err)
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK {
-		body, _ := io.ReadAll(resp.Body)
-		return fmt.Errorf("unpin failed with status %d: %s", resp.StatusCode, string(body))
-	}
-
-	return nil
-}
-
-// getGatewayURL returns the gateway URL from config, defaulting to localhost:6001
-func (s *StorageClientImpl) getGatewayURL() string {
-	cfg := s.client.Config()
-	if cfg != nil && cfg.GatewayURL != "" {
-		return strings.TrimSuffix(cfg.GatewayURL, "/")
-	}
-	return "http://localhost:6001"
-}
-
-// addAuthHeaders adds authentication headers to the request
-func (s *StorageClientImpl) addAuthHeaders(req *http.Request) {
-	cfg := s.client.Config()
-	if cfg == nil {
-		return
-	}
-
-	// Prefer JWT if available
-	if cfg.JWT != "" {
-		req.Header.Set("Authorization", "Bearer "+cfg.JWT)
-		return
-	}
-
-	// Fallback to API key
-	if cfg.APIKey != "" {
-		req.Header.Set("Authorization", "Bearer "+cfg.APIKey)
-		req.Header.Set("X-API-Key", cfg.APIKey)
-	}
-}

pkg/client/storage_client_test.go

@@ -1,378 +0,0 @@
-package client
-
-import (
-	"context"
-	"encoding/json"
-	"io"
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"testing"
-)
-
-func TestStorageClientImpl_Upload(t *testing.T) {
-	t.Run("success", func(t *testing.T) {
-		expectedCID := "QmUpload123"
-		expectedName := "test.txt"
-		expectedSize := int64(100)
-
-		server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			if r.URL.Path != "/v1/storage/upload" {
-				t.Errorf("Expected path '/v1/storage/upload', got %s", r.URL.Path)
-			}
-
-			// Verify multipart form
-			if err := r.ParseMultipartForm(32 << 20); err != nil {
-				t.Errorf("Failed to parse multipart form: %v", err)
-				return
-			}
-
-			file, header, err := r.FormFile("file")
-			if err != nil {
-				t.Errorf("Failed to get file: %v", err)
-				return
-			}
-			defer file.Close()
-
-			if header.Filename != expectedName {
-				t.Errorf("Expected filename %s, got %s", expectedName, header.Filename)
-			}
-
-			response := StorageUploadResult{
-				Cid:  expectedCID,
-				Name: expectedName,
-				Size: expectedSize,
-			}
-			w.Header().Set("Content-Type", "application/json")
-			json.NewEncoder(w).Encode(response)
-		}))
-		defer server.Close()
-
-		cfg := &ClientConfig{
-			GatewayURL: server.URL,
-			AppName:    "test-app",
-			APIKey:     "ak_test:test-app", // Required for requireAccess check
-		}
-		client := &Client{config: cfg}
-		storage := &StorageClientImpl{client: client}
-
-		reader := strings.NewReader("test content")
-		result, err := storage.Upload(context.Background(), reader, expectedName)
-		if err != nil {
-			t.Fatalf("Failed to upload: %v", err)
-		}
-
-		if result.Cid != expectedCID {
-			t.Errorf("Expected CID %s, got %s", expectedCID, result.Cid)
-		}
-		if result.Name != expectedName {
-			t.Errorf("Expected name %s, got %s", expectedName, result.Name)
-		}
-		if result.Size != expectedSize {
-			t.Errorf("Expected size %d, got %d", expectedSize, result.Size)
-		}
-	})
-
-	t.Run("server_error", func(t *testing.T) {
-		server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			w.WriteHeader(http.StatusInternalServerError)
-			w.Write([]byte("internal error"))
-		}))
-		defer server.Close()
-
-		cfg := &ClientConfig{
-			GatewayURL: server.URL,
-			AppName:    "test-app",
-		}
-		client := &Client{config: cfg}
-		storage := &StorageClientImpl{client: client}
-
-		reader := strings.NewReader("test")
-		_, err := storage.Upload(context.Background(), reader, "test.txt")
-		if err == nil {
-			t.Error("Expected error for server error")
-		}
-	})
-
-	t.Run("missing_credentials", func(t *testing.T) {
-		cfg := &ClientConfig{
-			GatewayURL: "http://localhost:6001",
-			// No AppName, JWT, or APIKey
-		}
-		client := &Client{config: cfg}
-		storage := &StorageClientImpl{client: client}
-
-		reader := strings.NewReader("test")
-		_, err := storage.Upload(context.Background(), reader, "test.txt")
-		if err == nil {
-			t.Error("Expected error for missing credentials")
-		}
-	})
-}
-
-func TestStorageClientImpl_Pin(t *testing.T) {
-	t.Run("success", func(t *testing.T) {
-		expectedCID := "QmPin123"
-		expectedName := "pinned-file"
-
-		server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			if r.URL.Path != "/v1/storage/pin" {
-				t.Errorf("Expected path '/v1/storage/pin', got %s", r.URL.Path)
-			}
-
-			var reqBody map[string]interface{}
-			if err := json.NewDecoder(r.Body).Decode(&reqBody); err != nil {
-				t.Errorf("Failed to decode request: %v", err)
-				return
-			}
-
-			if reqBody["cid"] != expectedCID {
-				t.Errorf("Expected CID %s, got %v", expectedCID, reqBody["cid"])
-			}
-
-			response := StoragePinResult{
-				Cid:  expectedCID,
-				Name: expectedName,
-			}
-			w.Header().Set("Content-Type", "application/json")
-			json.NewEncoder(w).Encode(response)
-		}))
-		defer server.Close()
-
-		cfg := &ClientConfig{
-			GatewayURL: server.URL,
-			AppName:    "test-app",
-			APIKey:     "ak_test:test-app", // Required for requireAccess check
-		}
-		client := &Client{config: cfg}
-		storage := &StorageClientImpl{client: client}
-
-		result, err := storage.Pin(context.Background(), expectedCID, expectedName)
-		if err != nil {
-			t.Fatalf("Failed to pin: %v", err)
-		}
-
-		if result.Cid != expectedCID {
-			t.Errorf("Expected CID %s, got %s", expectedCID, result.Cid)
-		}
-		if result.Name != expectedName {
-			t.Errorf("Expected name %s, got %s", expectedName, result.Name)
-		}
-	})
-}
-
-func TestStorageClientImpl_Status(t *testing.T) {
-	t.Run("success", func(t *testing.T) {
-		expectedCID := "QmStatus123"
-
-		server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			if !strings.HasPrefix(r.URL.Path, "/v1/storage/status/") {
-				t.Errorf("Expected path '/v1/storage/status/', got %s", r.URL.Path)
-			}
-
-			response := StorageStatus{
-				Cid:               expectedCID,
-				Name:              "test-file",
-				Status:            "pinned",
-				ReplicationMin:    3,
-				ReplicationMax:    3,
-				ReplicationFactor: 3,
-				Peers:             []string{"peer1", "peer2", "peer3"},
-			}
-			w.Header().Set("Content-Type", "application/json")
-			json.NewEncoder(w).Encode(response)
-		}))
-		defer server.Close()
-
-		cfg := &ClientConfig{
-			GatewayURL: server.URL,
-			AppName:    "test-app",
-			APIKey:     "ak_test:test-app", // Required for requireAccess check
-		}
-		client := &Client{config: cfg}
-		storage := &StorageClientImpl{client: client}
-
-		status, err := storage.Status(context.Background(), expectedCID)
-		if err != nil {
-			t.Fatalf("Failed to get status: %v", err)
-		}
-
-		if status.Cid != expectedCID {
-			t.Errorf("Expected CID %s, got %s", expectedCID, status.Cid)
-		}
-		if status.Status != "pinned" {
-			t.Errorf("Expected status 'pinned', got %s", status.Status)
-		}
-	})
-}
-
-func TestStorageClientImpl_Get(t *testing.T) {
-	t.Run("success", func(t *testing.T) {
-		expectedCID := "QmGet123"
-		expectedContent := "test content"
-
-		server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			if !strings.HasPrefix(r.URL.Path, "/v1/storage/get/") {
-				t.Errorf("Expected path '/v1/storage/get/', got %s", r.URL.Path)
-			}
-			w.Write([]byte(expectedContent))
-		}))
-		defer server.Close()
-
-		cfg := &ClientConfig{
-			GatewayURL: server.URL,
-			AppName:    "test-app",
-			APIKey:     "ak_test:test-app", // Required for requireAccess check
-		}
-		client := &Client{config: cfg}
-		storage := &StorageClientImpl{client: client}
-
-		reader, err := storage.Get(context.Background(), expectedCID)
-		if err != nil {
-			t.Fatalf("Failed to get content: %v", err)
-		}
-		defer reader.Close()
-
-		data, err := io.ReadAll(reader)
-		if err != nil {
-			t.Fatalf("Failed to read content: %v", err)
-		}
-
-		if string(data) != expectedContent {
-			t.Errorf("Expected content %s, got %s", expectedContent, string(data))
-		}
-	})
-}
-
-func TestStorageClientImpl_Unpin(t *testing.T) {
-	t.Run("success", func(t *testing.T) {
-		expectedCID := "QmUnpin123"
-
-		server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			if !strings.HasPrefix(r.URL.Path, "/v1/storage/unpin/") {
-				t.Errorf("Expected path '/v1/storage/unpin/', got %s", r.URL.Path)
-			}
-			if r.Method != "DELETE" {
-				t.Errorf("Expected method DELETE, got %s", r.Method)
-			}
-			w.WriteHeader(http.StatusOK)
-		}))
-		defer server.Close()
-
-		cfg := &ClientConfig{
-			GatewayURL: server.URL,
-			AppName:    "test-app",
-			APIKey:     "ak_test:test-app", // Required for requireAccess check
-		}
-		client := &Client{config: cfg}
-		storage := &StorageClientImpl{client: client}
-
-		err := storage.Unpin(context.Background(), expectedCID)
-		if err != nil {
-			t.Fatalf("Failed to unpin: %v", err)
-		}
-	})
-}
-
-func TestStorageClientImpl_getGatewayURL(t *testing.T) {
-	storage := &StorageClientImpl{}
-
-	t.Run("from_config", func(t *testing.T) {
-		cfg := &ClientConfig{GatewayURL: "http://custom:6001"}
-		client := &Client{config: cfg}
-		storage.client = client
-
-		url := storage.getGatewayURL()
-		if url != "http://custom:6001" {
-			t.Errorf("Expected 'http://custom:6001', got %s", url)
-		}
-	})
-
-	t.Run("default", func(t *testing.T) {
-		cfg := &ClientConfig{}
-		client := &Client{config: cfg}
-		storage.client = client
-
-		url := storage.getGatewayURL()
-		if url != "http://localhost:6001" {
-			t.Errorf("Expected 'http://localhost:6001', got %s", url)
-		}
-	})
-
-	t.Run("nil_config", func(t *testing.T) {
-		client := &Client{config: nil}
-		storage.client = client
-
-		url := storage.getGatewayURL()
-		if url != "http://localhost:6001" {
-			t.Errorf("Expected 'http://localhost:6001', got %s", url)
-		}
-	})
-}
-
-func TestStorageClientImpl_addAuthHeaders(t *testing.T) {
-	t.Run("jwt_preferred", func(t *testing.T) {
-		cfg := &ClientConfig{
-			JWT:    "test-jwt-token",
-			APIKey: "test-api-key",
-		}
-		client := &Client{config: cfg}
-		storage := &StorageClientImpl{client: client}
-
-		req := httptest.NewRequest("POST", "/test", nil)
-		storage.addAuthHeaders(req)
-
-		auth := req.Header.Get("Authorization")
-		if auth != "Bearer test-jwt-token" {
-			t.Errorf("Expected JWT in Authorization header, got %s", auth)
-		}
-	})
-
-	t.Run("apikey_fallback", func(t *testing.T) {
-		cfg := &ClientConfig{
-			APIKey: "test-api-key",
-		}
-		client := &Client{config: cfg}
-		storage := &StorageClientImpl{client: client}
-
-		req := httptest.NewRequest("POST", "/test", nil)
-		storage.addAuthHeaders(req)
-
-		auth := req.Header.Get("Authorization")
-		if auth != "Bearer test-api-key" {
-			t.Errorf("Expected API key in Authorization header, got %s", auth)
-		}
-
-		apiKey := req.Header.Get("X-API-Key")
-		if apiKey != "test-api-key" {
-			t.Errorf("Expected API key in X-API-Key header, got %s", apiKey)
-		}
-	})
-
-	t.Run("no_auth", func(t *testing.T) {
-		cfg := &ClientConfig{}
-		client := &Client{config: cfg}
-		storage := &StorageClientImpl{client: client}
-
-		req := httptest.NewRequest("POST", "/test", nil)
-		storage.addAuthHeaders(req)
-
-		auth := req.Header.Get("Authorization")
-		if auth != "" {
-			t.Errorf("Expected no Authorization header, got %s", auth)
-		}
-	})
-
-	t.Run("nil_config", func(t *testing.T) {
-		client := &Client{config: nil}
-		storage := &StorageClientImpl{client: client}
-
-		req := httptest.NewRequest("POST", "/test", nil)
-		storage.addAuthHeaders(req)
-
-		auth := req.Header.Get("Authorization")
-		if auth != "" {
-			t.Errorf("Expected no Authorization header, got %s", auth)
-		}
-	})
-}

pkg/config/config.go

@@ -8,21 +8,20 @@ import (
 
 // Config represents the main configuration for a network node
 type Config struct {
-	Node        NodeConfig        `yaml:"node"`
+	Node      NodeConfig      `yaml:"node"`
-	Database    DatabaseConfig    `yaml:"database"`
+	Database  DatabaseConfig  `yaml:"database"`
-	Discovery   DiscoveryConfig   `yaml:"discovery"`
+	Discovery DiscoveryConfig `yaml:"discovery"`
-	Security    SecurityConfig    `yaml:"security"`
+	Security  SecurityConfig  `yaml:"security"`
-	Logging     LoggingConfig     `yaml:"logging"`
+	Logging   LoggingConfig   `yaml:"logging"`
-	HTTPGateway HTTPGatewayConfig `yaml:"http_gateway"`
 }
 
 // NodeConfig contains node-specific configuration
 type NodeConfig struct {
 	ID              string   `yaml:"id"`               // Auto-generated if empty
+	Type            string   `yaml:"type"`             // "bootstrap" or "node"
 	ListenAddresses []string `yaml:"listen_addresses"` // LibP2P listen addresses
 	DataDir         string   `yaml:"data_dir"`         // Data directory
 	MaxConnections  int      `yaml:"max_connections"`  // Maximum peer connections
-	Domain          string   `yaml:"domain"`           // Domain for this node (e.g., node-1.orama.network)
 }
 
 // DatabaseConfig contains database-related configuration
@@ -37,55 +36,13 @@ type DatabaseConfig struct {
 	RQLitePort        int    `yaml:"rqlite_port"`         // RQLite HTTP API port
 	RQLiteRaftPort    int    `yaml:"rqlite_raft_port"`    // RQLite Raft consensus port
 	RQLiteJoinAddress string `yaml:"rqlite_join_address"` // Address to join RQLite cluster
-
-	// RQLite node-to-node TLS encryption (for inter-node Raft communication)
-	// See: https://rqlite.io/docs/guides/security/#encrypting-node-to-node-communication
-	NodeCert     string `yaml:"node_cert"`      // Path to X.509 certificate for node-to-node communication
-	NodeKey      string `yaml:"node_key"`       // Path to X.509 private key for node-to-node communication
-	NodeCACert   string `yaml:"node_ca_cert"`   // Path to CA certificate (optional, uses system CA if not set)
-	NodeNoVerify bool   `yaml:"node_no_verify"` // Skip certificate verification (for testing/self-signed certs)
-
-	// Dynamic discovery configuration (always enabled)
-	ClusterSyncInterval time.Duration `yaml:"cluster_sync_interval"` // default: 30s
-	PeerInactivityLimit time.Duration `yaml:"peer_inactivity_limit"` // default: 24h
-	MinClusterSize      int           `yaml:"min_cluster_size"`      // default: 1
-
-	// Olric cache configuration
-	OlricHTTPPort       int `yaml:"olric_http_port"`       // Olric HTTP API port (default: 3320)
-	OlricMemberlistPort int `yaml:"olric_memberlist_port"` // Olric memberlist port (default: 3322)
-
-	// IPFS storage configuration
-	IPFS IPFSConfig `yaml:"ipfs"`
-}
-
-// IPFSConfig contains IPFS storage configuration
-type IPFSConfig struct {
-	// ClusterAPIURL is the IPFS Cluster HTTP API URL (e.g., "http://localhost:9094")
-	// If empty, IPFS storage is disabled for this node
-	ClusterAPIURL string `yaml:"cluster_api_url"`
-
-	// APIURL is the IPFS HTTP API URL for content retrieval (e.g., "http://localhost:5001")
-	// If empty, defaults to "http://localhost:5001"
-	APIURL string `yaml:"api_url"`
-
-	// Timeout for IPFS operations
-	// If zero, defaults to 60 seconds
-	Timeout time.Duration `yaml:"timeout"`
-
-	// ReplicationFactor is the replication factor for pinned content
-	// If zero, defaults to 3
-	ReplicationFactor int `yaml:"replication_factor"`
-
-	// EnableEncryption enables client-side encryption before upload
-	// Defaults to true
-	EnableEncryption bool `yaml:"enable_encryption"`
 }
 
 // DiscoveryConfig contains peer discovery configuration
 type DiscoveryConfig struct {
-	BootstrapPeers    []string      `yaml:"bootstrap_peers"`    // Peer addresses to connect to
+	BootstrapPeers    []string      `yaml:"bootstrap_peers"`    // Bootstrap peer addresses
 	DiscoveryInterval time.Duration `yaml:"discovery_interval"` // Discovery announcement interval
-	BootstrapPort     int           `yaml:"bootstrap_port"`     // Default port for peer discovery
+	BootstrapPort     int           `yaml:"bootstrap_port"`     // Default port for bootstrap nodes
 	HttpAdvAddress    string        `yaml:"http_adv_address"`   // HTTP advertisement address
 	RaftAdvAddress    string        `yaml:"raft_adv_address"`   // Raft advertisement
 	NodeNamespace     string        `yaml:"node_namespace"`     // Namespace for node identifiers
@@ -105,56 +62,6 @@ type LoggingConfig struct {
 	OutputFile string `yaml:"output_file"` // Empty for stdout
 }
 
-// HTTPGatewayConfig contains HTTP reverse proxy gateway configuration
-type HTTPGatewayConfig struct {
-	Enabled    bool                   `yaml:"enabled"`     // Enable HTTP gateway
-	ListenAddr string                 `yaml:"listen_addr"` // Address to listen on (e.g., ":8080")
-	NodeName   string                 `yaml:"node_name"`   // Node name for routing
-	Routes     map[string]RouteConfig `yaml:"routes"`      // Service routes
-	HTTPS      HTTPSConfig            `yaml:"https"`       // HTTPS/TLS configuration
-	SNI        SNIConfig              `yaml:"sni"`         // SNI-based TCP routing configuration
-
-	// Full gateway configuration (for API, auth, pubsub)
-	ClientNamespace   string        `yaml:"client_namespace"`    // Namespace for network client
-	RQLiteDSN         string        `yaml:"rqlite_dsn"`          // RQLite database DSN
-	OlricServers      []string      `yaml:"olric_servers"`       // List of Olric server addresses
-	OlricTimeout      time.Duration `yaml:"olric_timeout"`       // Timeout for Olric operations
-	IPFSClusterAPIURL string        `yaml:"ipfs_cluster_api_url"` // IPFS Cluster API URL
-	IPFSAPIURL        string        `yaml:"ipfs_api_url"`        // IPFS API URL
-	IPFSTimeout       time.Duration `yaml:"ipfs_timeout"`        // Timeout for IPFS operations
-}
-
-// HTTPSConfig contains HTTPS/TLS configuration for the gateway
-type HTTPSConfig struct {
-	Enabled        bool   `yaml:"enabled"`         // Enable HTTPS (port 443)
-	Domain         string `yaml:"domain"`          // Primary domain (e.g., node-123.orama.network)
-	AutoCert       bool   `yaml:"auto_cert"`       // Use Let's Encrypt for automatic certificate
-	UseSelfSigned  bool   `yaml:"use_self_signed"` // Use self-signed certificates (pre-generated)
-	CertFile       string `yaml:"cert_file"`       // Path to certificate file (if not using auto_cert)
-	KeyFile        string `yaml:"key_file"`        // Path to key file (if not using auto_cert)
-	CacheDir       string `yaml:"cache_dir"`       // Directory for Let's Encrypt certificate cache
-	HTTPPort       int    `yaml:"http_port"`       // HTTP port for ACME challenge (default: 80)
-	HTTPSPort      int    `yaml:"https_port"`      // HTTPS port (default: 443)
-	Email          string `yaml:"email"`           // Email for Let's Encrypt account
-}
-
-// SNIConfig contains SNI-based TCP routing configuration for port 7001
-type SNIConfig struct {
-	Enabled    bool              `yaml:"enabled"`     // Enable SNI-based TCP routing
-	ListenAddr string            `yaml:"listen_addr"` // Address to listen on (e.g., ":7001")
-	Routes     map[string]string `yaml:"routes"`      // SNI hostname -> backend address mapping
-	CertFile   string            `yaml:"cert_file"`   // Path to certificate file
-	KeyFile    string            `yaml:"key_file"`    // Path to key file
-}
-
-// RouteConfig defines a single reverse proxy route
-type RouteConfig struct {
-	PathPrefix string        `yaml:"path_prefix"` // URL path prefix (e.g., "/rqlite/http")
-	BackendURL string        `yaml:"backend_url"` // Backend service URL
-	Timeout    time.Duration `yaml:"timeout"`     // Request timeout
-	WebSocket  bool          `yaml:"websocket"`   // Support WebSocket upgrades
-}
-
 // ClientConfig represents configuration for network clients
 type ClientConfig struct {
 	AppName        string        `yaml:"app_name"`
@@ -181,6 +88,7 @@ func (c *Config) ParseMultiaddrs() ([]multiaddr.Multiaddr, error) {
 func DefaultConfig() *Config {
 	return &Config{
 		Node: NodeConfig{
+			Type: "node",
 			ListenAddresses: []string{
 				"/ip4/0.0.0.0/tcp/4001", // TCP only - compatible with Anyone proxy/SOCKS5
 			},
@@ -197,28 +105,15 @@ func DefaultConfig() *Config {
 			// RQLite-specific configuration
 			RQLitePort:        5001,
 			RQLiteRaftPort:    7001,
-			RQLiteJoinAddress: "", // Empty for first node (creates cluster)
+			RQLiteJoinAddress: "", // Empty for bootstrap node
-
-			// Dynamic discovery (always enabled)
-			ClusterSyncInterval: 30 * time.Second,
-			PeerInactivityLimit: 24 * time.Hour,
-			MinClusterSize:      1,
-
-			// Olric cache configuration
-			OlricHTTPPort:       3320,
-			OlricMemberlistPort: 3322,
-
-			// IPFS storage configuration
-			IPFS: IPFSConfig{
-				ClusterAPIURL:     "", // Empty = disabled
-				APIURL:            "http://localhost:5001",
-				Timeout:           60 * time.Second,
-				ReplicationFactor: 3,
-				EnableEncryption:  true,
-			},
 		},
 		Discovery: DiscoveryConfig{
-			BootstrapPeers:    []string{},
+			BootstrapPeers: []string{
+				"/ip4/217.76.54.178/tcp/4001/p2p/12D3KooWKZnirPwNT4URtNSWK45f6vLkEs4xyUZ792F8Uj1oYnm1",
+				"/ip4/51.83.128.181/tcp/4001/p2p/12D3KooWBn2Zf1R8v9pEfmz7hDZ5b3oADxfejA3zJBYzKRCzgvhR",
+				"/ip4/155.133.27.199/tcp/4001/p2p/12D3KooWC69SBzM5QUgrLrfLWUykE8au32X5LwT7zwv9bixrQPm1",
+				"/ip4/217.76.56.2/tcp/4001/p2p/12D3KooWEiqJHvznxqJ5p2y8mUs6Ky6dfU1xTYFQbyKRCABfcZz4",
+			},
 			BootstrapPort:     4001,             // Default LibP2P port
 			DiscoveryInterval: time.Second * 15, // Back to 15 seconds for testing
 			HttpAdvAddress:    "",
@@ -232,18 +127,5 @@ func DefaultConfig() *Config {
 			Level:  "info",
 			Format: "console",
 		},
-		HTTPGateway: HTTPGatewayConfig{
-			Enabled:           true,
-			ListenAddr:        ":8080",
-			NodeName:          "default",
-			Routes:            make(map[string]RouteConfig),
-			ClientNamespace:   "default",
-			RQLiteDSN:         "http://localhost:5001",
-			OlricServers:      []string{"localhost:3320"},
-			OlricTimeout:      10 * time.Second,
-			IPFSClusterAPIURL: "http://localhost:9094",
-			IPFSAPIURL:        "http://localhost:5001",
-			IPFSTimeout:       60 * time.Second,
-		},
 	}
 }

pkg/config/paths.go

@@ -1,77 +0,0 @@
-package config
-
-import (
-	"fmt"
-	"os"
-	"path/filepath"
-)
-
-// ConfigDir returns the path to the DeBros config directory (~/.orama).
-func ConfigDir() (string, error) {
-	home, err := os.UserHomeDir()
-	if err != nil {
-		return "", fmt.Errorf("failed to determine home directory: %w", err)
-	}
-	return filepath.Join(home, ".orama"), nil
-}
-
-// EnsureConfigDir creates the config directory if it does not exist.
-func EnsureConfigDir() (string, error) {
-	dir, err := ConfigDir()
-	if err != nil {
-		return "", err
-	}
-	if err := os.MkdirAll(dir, 0700); err != nil {
-		return "", fmt.Errorf("failed to create config directory %s: %w", dir, err)
-	}
-	return dir, nil
-}
-
-// DefaultPath returns the path to the config file for the given component name.
-// component should be e.g., "node.yaml", "gateway.yaml"
-// It checks ~/.orama/data/, ~/.orama/configs/, and ~/.orama/ for backward compatibility.
-// If component is already an absolute path, it returns it as-is.
-func DefaultPath(component string) (string, error) {
-	// If component is already an absolute path, return it directly
-	if filepath.IsAbs(component) {
-		return component, nil
-	}
-
-	dir, err := ConfigDir()
-	if err != nil {
-		return "", err
-	}
-
-	var gatewayDefault string
-	// For gateway.yaml, check data/ directory first (production location)
-	if component == "gateway.yaml" {
-		dataPath := filepath.Join(dir, "data", component)
-		if _, err := os.Stat(dataPath); err == nil {
-			return dataPath, nil
-		}
-		// Remember the preferred default so we can still fall back to legacy paths
-		gatewayDefault = dataPath
-	}
-
-	// First check in ~/.orama/configs/ (production installer location)
-	configsPath := filepath.Join(dir, "configs", component)
-	if _, err := os.Stat(configsPath); err == nil {
-		return configsPath, nil
-	}
-
-	// Fallback to ~/.orama/ (legacy/development location)
-	legacyPath := filepath.Join(dir, component)
-	if _, err := os.Stat(legacyPath); err == nil {
-		return legacyPath, nil
-	}
-
-	if gatewayDefault != "" {
-		// If we preferred the data path (gateway.yaml) but didn't find it anywhere else,
-		// return the data path so error messages point to the production location.
-		return gatewayDefault, nil
-	}
-
-	// Return configs path as default (even if it doesn't exist yet)
-	// This allows the error message to show the expected production location
-	return configsPath, nil
-}

pkg/config/validate.go

@@ -1,587 +0,0 @@
-package config
-
-import (
-	"fmt"
-	"net"
-	"os"
-	"path/filepath"
-	"strconv"
-	"strings"
-	"time"
-
-	"github.com/multiformats/go-multiaddr"
-	manet "github.com/multiformats/go-multiaddr/net"
-)
-
-// ValidationError represents a single validation error with context.
-type ValidationError struct {
-	Path    string // e.g., "discovery.bootstrap_peers[0]" or "discovery.peers[0]"
-	Message string // e.g., "invalid multiaddr"
-	Hint    string // e.g., "expected /ip{4,6}/.../tcp/<port>/p2p/<peerID>"
-}
-
-func (e ValidationError) Error() string {
-	if e.Hint != "" {
-		return fmt.Sprintf("%s: %s; %s", e.Path, e.Message, e.Hint)
-	}
-	return fmt.Sprintf("%s: %s", e.Path, e.Message)
-}
-
-// Validate performs comprehensive validation of the entire config.
-// It aggregates all errors and returns them, allowing the caller to print all issues at once.
-func (c *Config) Validate() []error {
-	var errs []error
-
-	// Validate node config
-	errs = append(errs, c.validateNode()...)
-	// Validate database config
-	errs = append(errs, c.validateDatabase()...)
-	// Validate discovery config
-	errs = append(errs, c.validateDiscovery()...)
-	// Validate security config
-	errs = append(errs, c.validateSecurity()...)
-	// Validate logging config
-	errs = append(errs, c.validateLogging()...)
-	// Cross-field validations
-	errs = append(errs, c.validateCrossFields()...)
-
-	return errs
-}
-
-func (c *Config) validateNode() []error {
-	var errs []error
-	nc := c.Node
-
-	// Validate node ID (required for RQLite cluster membership)
-	if nc.ID == "" {
-		errs = append(errs, ValidationError{
-			Path:    "node.id",
-			Message: "must not be empty (required for cluster membership)",
-			Hint:    "will be auto-generated if empty, but explicit ID recommended",
-		})
-	}
-
-	// Validate listen_addresses
-	if len(nc.ListenAddresses) == 0 {
-		errs = append(errs, ValidationError{
-			Path:    "node.listen_addresses",
-			Message: "must not be empty",
-		})
-	}
-
-	seen := make(map[string]bool)
-	for i, addr := range nc.ListenAddresses {
-		path := fmt.Sprintf("node.listen_addresses[%d]", i)
-
-		// Parse as multiaddr
-		ma, err := multiaddr.NewMultiaddr(addr)
-		if err != nil {
-			errs = append(errs, ValidationError{
-				Path:    path,
-				Message: fmt.Sprintf("invalid multiaddr: %v", err),
-				Hint:    "expected /ip{4,6}/.../ tcp/<port>",
-			})
-			continue
-		}
-
-		// Check for TCP and valid port
-		tcpAddr, err := manet.ToNetAddr(ma)
-		if err != nil {
-			errs = append(errs, ValidationError{
-				Path:    path,
-				Message: fmt.Sprintf("cannot convert multiaddr to network address: %v", err),
-				Hint:    "ensure multiaddr contains /tcp/<port>",
-			})
-			continue
-		}
-
-		tcpPort := tcpAddr.(*net.TCPAddr).Port
-		if tcpPort < 1 || tcpPort > 65535 {
-			errs = append(errs, ValidationError{
-				Path:    path,
-				Message: fmt.Sprintf("invalid TCP port %d", tcpPort),
-				Hint:    "port must be between 1 and 65535",
-			})
-		}
-
-		if seen[addr] {
-			errs = append(errs, ValidationError{
-				Path:    path,
-				Message: "duplicate listen address",
-			})
-		}
-		seen[addr] = true
-	}
-
-	// Validate data_dir
-	if nc.DataDir == "" {
-		errs = append(errs, ValidationError{
-			Path:    "node.data_dir",
-			Message: "must not be empty",
-		})
-	} else {
-		if err := validateDataDir(nc.DataDir); err != nil {
-			errs = append(errs, ValidationError{
-				Path:    "node.data_dir",
-				Message: err.Error(),
-			})
-		}
-	}
-
-	// Validate max_connections
-	if nc.MaxConnections <= 0 {
-		errs = append(errs, ValidationError{
-			Path:    "node.max_connections",
-			Message: fmt.Sprintf("must be > 0; got %d", nc.MaxConnections),
-		})
-	}
-
-	return errs
-}
-
-func (c *Config) validateDatabase() []error {
-	var errs []error
-	dc := c.Database
-
-	// Validate data_dir
-	if dc.DataDir == "" {
-		errs = append(errs, ValidationError{
-			Path:    "database.data_dir",
-			Message: "must not be empty",
-		})
-	} else {
-		if err := validateDataDir(dc.DataDir); err != nil {
-			errs = append(errs, ValidationError{
-				Path:    "database.data_dir",
-				Message: err.Error(),
-			})
-		}
-	}
-
-	// Validate replication_factor
-	if dc.ReplicationFactor < 1 {
-		errs = append(errs, ValidationError{
-			Path:    "database.replication_factor",
-			Message: fmt.Sprintf("must be >= 1; got %d", dc.ReplicationFactor),
-		})
-	} else if dc.ReplicationFactor%2 == 0 {
-		// Warn about even replication factor (Raft best practice: odd)
-		// For now we log a note but don't error
-		_ = fmt.Sprintf("note: database.replication_factor %d is even; Raft recommends odd numbers for quorum", dc.ReplicationFactor)
-	}
-
-	// Validate shard_count
-	if dc.ShardCount < 1 {
-		errs = append(errs, ValidationError{
-			Path:    "database.shard_count",
-			Message: fmt.Sprintf("must be >= 1; got %d", dc.ShardCount),
-		})
-	}
-
-	// Validate max_database_size
-	if dc.MaxDatabaseSize < 0 {
-		errs = append(errs, ValidationError{
-			Path:    "database.max_database_size",
-			Message: fmt.Sprintf("must be >= 0; got %d", dc.MaxDatabaseSize),
-		})
-	}
-
-	// Validate rqlite_port
-	if dc.RQLitePort < 1 || dc.RQLitePort > 65535 {
-		errs = append(errs, ValidationError{
-			Path:    "database.rqlite_port",
-			Message: fmt.Sprintf("must be between 1 and 65535; got %d", dc.RQLitePort),
-		})
-	}
-
-	// Validate rqlite_raft_port
-	if dc.RQLiteRaftPort < 1 || dc.RQLiteRaftPort > 65535 {
-		errs = append(errs, ValidationError{
-			Path:    "database.rqlite_raft_port",
-			Message: fmt.Sprintf("must be between 1 and 65535; got %d", dc.RQLiteRaftPort),
-		})
-	}
-
-	// Ports must differ
-	if dc.RQLitePort == dc.RQLiteRaftPort {
-		errs = append(errs, ValidationError{
-			Path:    "database.rqlite_raft_port",
-			Message: fmt.Sprintf("must differ from database.rqlite_port (%d)", dc.RQLitePort),
-		})
-	}
-
-	// Validate rqlite_join_address format if provided (optional for all nodes)
-	// The first node in a cluster won't have a join address; subsequent nodes will
-	if dc.RQLiteJoinAddress != "" {
-		if err := validateHostPort(dc.RQLiteJoinAddress); err != nil {
-			errs = append(errs, ValidationError{
-				Path:    "database.rqlite_join_address",
-				Message: err.Error(),
-				Hint:    "expected format: host:port",
-			})
-		}
-	}
-
-	// Validate cluster_sync_interval
-	if dc.ClusterSyncInterval != 0 && dc.ClusterSyncInterval < 10*time.Second {
-		errs = append(errs, ValidationError{
-			Path:    "database.cluster_sync_interval",
-			Message: fmt.Sprintf("must be >= 10s or 0 (for default); got %v", dc.ClusterSyncInterval),
-			Hint:    "recommended: 30s",
-		})
-	}
-
-	// Validate peer_inactivity_limit
-	if dc.PeerInactivityLimit != 0 {
-		if dc.PeerInactivityLimit < time.Hour {
-			errs = append(errs, ValidationError{
-				Path:    "database.peer_inactivity_limit",
-				Message: fmt.Sprintf("must be >= 1h or 0 (for default); got %v", dc.PeerInactivityLimit),
-				Hint:    "recommended: 24h",
-			})
-		} else if dc.PeerInactivityLimit > 7*24*time.Hour {
-			errs = append(errs, ValidationError{
-				Path:    "database.peer_inactivity_limit",
-				Message: fmt.Sprintf("must be <= 7d; got %v", dc.PeerInactivityLimit),
-				Hint:    "recommended: 24h",
-			})
-		}
-	}
-
-	// Validate min_cluster_size
-	if dc.MinClusterSize < 1 {
-		errs = append(errs, ValidationError{
-			Path:    "database.min_cluster_size",
-			Message: fmt.Sprintf("must be >= 1; got %d", dc.MinClusterSize),
-		})
-	}
-
-	return errs
-}
-
-func (c *Config) validateDiscovery() []error {
-	var errs []error
-	disc := c.Discovery
-
-	// Validate discovery_interval
-	if disc.DiscoveryInterval <= 0 {
-		errs = append(errs, ValidationError{
-			Path:    "discovery.discovery_interval",
-			Message: fmt.Sprintf("must be > 0; got %v", disc.DiscoveryInterval),
-		})
-	}
-
-	// Validate peer discovery port
-	if disc.BootstrapPort < 1 || disc.BootstrapPort > 65535 {
-		errs = append(errs, ValidationError{
-			Path:    "discovery.bootstrap_port",
-			Message: fmt.Sprintf("must be between 1 and 65535; got %d", disc.BootstrapPort),
-		})
-	}
-
-	// Validate peer addresses (optional - all nodes are unified peers now)
-	// Validate each peer multiaddr
-	seenPeers := make(map[string]bool)
-	for i, peer := range disc.BootstrapPeers {
-		path := fmt.Sprintf("discovery.bootstrap_peers[%d]", i)
-
-		_, err := multiaddr.NewMultiaddr(peer)
-		if err != nil {
-			errs = append(errs, ValidationError{
-				Path:    path,
-				Message: fmt.Sprintf("invalid multiaddr: %v", err),
-				Hint:    "expected /ip{4,6}/.../tcp/<port>/p2p/<peerID>",
-			})
-			continue
-		}
-
-		// Check for /p2p/ component
-		if !strings.Contains(peer, "/p2p/") {
-			errs = append(errs, ValidationError{
-				Path:    path,
-				Message: "missing /p2p/<peerID> component",
-				Hint:    "expected /ip{4,6}/.../tcp/<port>/p2p/<peerID>",
-			})
-		}
-
-		// Extract TCP port by parsing the multiaddr string directly
-		// Look for /tcp/ in the peer string
-		tcpPortStr := extractTCPPort(peer)
-		if tcpPortStr == "" {
-			errs = append(errs, ValidationError{
-				Path:    path,
-				Message: "missing /tcp/<port> component",
-				Hint:    "expected /ip{4,6}/.../tcp/<port>/p2p/<peerID>",
-			})
-			continue
-		}
-
-		tcpPort, err := strconv.Atoi(tcpPortStr)
-		if err != nil || tcpPort < 1 || tcpPort > 65535 {
-			errs = append(errs, ValidationError{
-				Path:    path,
-				Message: fmt.Sprintf("invalid TCP port %s", tcpPortStr),
-				Hint:    "port must be between 1 and 65535",
-			})
-		}
-
-		if seenPeers[peer] {
-			errs = append(errs, ValidationError{
-				Path:    path,
-				Message: "duplicate peer",
-			})
-		}
-		seenPeers[peer] = true
-	}
-
-	// Validate http_adv_address (required for cluster discovery)
-	if disc.HttpAdvAddress == "" {
-		errs = append(errs, ValidationError{
-			Path:    "discovery.http_adv_address",
-			Message: "required for RQLite cluster discovery",
-			Hint:    "set to your public HTTP address (e.g., 51.83.128.181:5001)",
-		})
-	} else {
-		if err := validateHostOrHostPort(disc.HttpAdvAddress); err != nil {
-			errs = append(errs, ValidationError{
-				Path:    "discovery.http_adv_address",
-				Message: err.Error(),
-				Hint:    "expected format: host or host:port",
-			})
-		}
-	}
-
-	// Validate raft_adv_address (required for cluster discovery)
-	if disc.RaftAdvAddress == "" {
-		errs = append(errs, ValidationError{
-			Path:    "discovery.raft_adv_address",
-			Message: "required for RQLite cluster discovery",
-			Hint:    "set to your public Raft address (e.g., 51.83.128.181:7001)",
-		})
-	} else {
-		if err := validateHostOrHostPort(disc.RaftAdvAddress); err != nil {
-			errs = append(errs, ValidationError{
-				Path:    "discovery.raft_adv_address",
-				Message: err.Error(),
-				Hint:    "expected format: host or host:port",
-			})
-		}
-	}
-
-	return errs
-}
-
-func (c *Config) validateSecurity() []error {
-	var errs []error
-	sec := c.Security
-
-	// Validate logging level
-	if sec.EnableTLS {
-		if sec.PrivateKeyFile == "" {
-			errs = append(errs, ValidationError{
-				Path:    "security.private_key_file",
-				Message: "required when enable_tls is true",
-			})
-		} else {
-			if err := validateFileReadable(sec.PrivateKeyFile); err != nil {
-				errs = append(errs, ValidationError{
-					Path:    "security.private_key_file",
-					Message: err.Error(),
-				})
-			}
-		}
-
-		if sec.CertificateFile == "" {
-			errs = append(errs, ValidationError{
-				Path:    "security.certificate_file",
-				Message: "required when enable_tls is true",
-			})
-		} else {
-			if err := validateFileReadable(sec.CertificateFile); err != nil {
-				errs = append(errs, ValidationError{
-					Path:    "security.certificate_file",
-					Message: err.Error(),
-				})
-			}
-		}
-	}
-
-	return errs
-}
-
-func (c *Config) validateLogging() []error {
-	var errs []error
-	log := c.Logging
-
-	// Validate level
-	validLevels := map[string]bool{"debug": true, "info": true, "warn": true, "error": true}
-	if !validLevels[log.Level] {
-		errs = append(errs, ValidationError{
-			Path:    "logging.level",
-			Message: fmt.Sprintf("invalid value %q", log.Level),
-			Hint:    "allowed values: debug, info, warn, error",
-		})
-	}
-
-	// Validate format
-	validFormats := map[string]bool{"json": true, "console": true}
-	if !validFormats[log.Format] {
-		errs = append(errs, ValidationError{
-			Path:    "logging.format",
-			Message: fmt.Sprintf("invalid value %q", log.Format),
-			Hint:    "allowed values: json, console",
-		})
-	}
-
-	// Validate output_file
-	if log.OutputFile != "" {
-		dir := filepath.Dir(log.OutputFile)
-		if dir != "" && dir != "." {
-			if err := validateDirWritable(dir); err != nil {
-				errs = append(errs, ValidationError{
-					Path:    "logging.output_file",
-					Message: fmt.Sprintf("parent directory not writable: %v", err),
-				})
-			}
-		}
-	}
-
-	return errs
-}
-
-func (c *Config) validateCrossFields() []error {
-	var errs []error
-	return errs
-}
-
-// Helper validation functions
-
-func validateDataDir(path string) error {
-	if path == "" {
-		return fmt.Errorf("must not be empty")
-	}
-
-	// Expand ~ to home directory
-	expandedPath := os.ExpandEnv(path)
-	if strings.HasPrefix(expandedPath, "~") {
-		home, err := os.UserHomeDir()
-		if err != nil {
-			return fmt.Errorf("cannot determine home directory: %v", err)
-		}
-		expandedPath = filepath.Join(home, expandedPath[1:])
-	}
-
-	if info, err := os.Stat(expandedPath); err == nil {
-		// Directory exists; check if it's a directory and writable
-		if !info.IsDir() {
-			return fmt.Errorf("path exists but is not a directory")
-		}
-		// Try to write a test file to check permissions
-		testFile := filepath.Join(expandedPath, ".write_test")
-		if err := os.WriteFile(testFile, []byte(""), 0644); err != nil {
-			return fmt.Errorf("directory not writable: %v", err)
-		}
-		os.Remove(testFile)
-	} else if os.IsNotExist(err) {
-		// Directory doesn't exist; check if parent is writable
-		parent := filepath.Dir(expandedPath)
-		if parent == "" || parent == "." {
-			parent = "."
-		}
-		// Allow parent not existing - it will be created at runtime
-		if info, err := os.Stat(parent); err != nil {
-			if !os.IsNotExist(err) {
-				return fmt.Errorf("parent directory not accessible: %v", err)
-			}
-			// Parent doesn't exist either - that's ok, will be created
-		} else if !info.IsDir() {
-			return fmt.Errorf("parent path is not a directory")
-		} else {
-			// Parent exists, check if writable
-			if err := validateDirWritable(parent); err != nil {
-				return fmt.Errorf("parent directory not writable: %v", err)
-			}
-		}
-	} else {
-		return fmt.Errorf("cannot access path: %v", err)
-	}
-
-	return nil
-}
-
-func validateDirWritable(path string) error {
-	info, err := os.Stat(path)
-	if err != nil {
-		return fmt.Errorf("cannot access directory: %v", err)
-	}
-	if !info.IsDir() {
-		return fmt.Errorf("path is not a directory")
-	}
-
-	// Try to write a test file
-	testFile := filepath.Join(path, ".write_test")
-	if err := os.WriteFile(testFile, []byte(""), 0644); err != nil {
-		return fmt.Errorf("directory not writable: %v", err)
-	}
-	os.Remove(testFile)
-
-	return nil
-}
-
-func validateFileReadable(path string) error {
-	_, err := os.Stat(path)
-	if err != nil {
-		return fmt.Errorf("cannot read file: %v", err)
-	}
-	return nil
-}
-
-func validateHostPort(hostPort string) error {
-	parts := strings.Split(hostPort, ":")
-	if len(parts) != 2 {
-		return fmt.Errorf("expected format host:port")
-	}
-
-	host := parts[0]
-	port := parts[1]
-
-	if host == "" {
-		return fmt.Errorf("host must not be empty")
-	}
-
-	portNum, err := strconv.Atoi(port)
-	if err != nil || portNum < 1 || portNum > 65535 {
-		return fmt.Errorf("port must be a number between 1 and 65535; got %q", port)
-	}
-
-	return nil
-}
-
-func validateHostOrHostPort(addr string) error {
-	// Try to parse as host:port first
-	if strings.Contains(addr, ":") {
-		return validateHostPort(addr)
-	}
-
-	// Otherwise just check if it's a valid hostname/IP
-	if addr == "" {
-		return fmt.Errorf("address must not be empty")
-	}
-
-	return nil
-}
-
-func extractTCPPort(multiaddrStr string) string {
-	// Look for the /tcp/ protocol code
-	parts := strings.Split(multiaddrStr, "/")
-	for i := 0; i < len(parts); i++ {
-		if parts[i] == "tcp" {
-			// The port is the next part
-			if i+1 < len(parts) {
-				return parts[i+1]
-			}
-			break
-		}
-	}
-	return ""
-}

pkg/config/validate_test.go

@@ -1,372 +0,0 @@
-package config
-
-import (
-	"testing"
-	"time"
-)
-
-// validConfigForNode returns a valid config
-func validConfigForNode() *Config {
-	validPeer := "/ip4/127.0.0.1/tcp/4001/p2p/12D3KooWHbcFcrGPXKUrHcxvd8MXEeUzRYyvY8fQcpEBxncSUwhj"
-	cfg := &Config{
-		Node: NodeConfig{
-			ID:              "test-node-id",
-			ListenAddresses: []string{"/ip4/0.0.0.0/tcp/4001"},
-			DataDir:         ".",
-			MaxConnections:  50,
-		},
-		Database: DatabaseConfig{
-			DataDir:           ".",
-			ReplicationFactor: 3,
-			ShardCount:        16,
-			MaxDatabaseSize:   1024,
-			BackupInterval:    1 * time.Hour,
-			RQLitePort:        5001,
-			RQLiteRaftPort:    7001,
-			MinClusterSize:    1,
-			RQLiteJoinAddress: "", // Optional - first node creates cluster, others join
-		},
-		Discovery: DiscoveryConfig{
-			BootstrapPeers:    []string{validPeer},
-			DiscoveryInterval: 15 * time.Second,
-			BootstrapPort:     4001,
-			HttpAdvAddress:    "localhost:5001",
-			RaftAdvAddress:    "localhost:7001",
-			NodeNamespace:     "default",
-		},
-		Logging: LoggingConfig{
-			Level:  "info",
-			Format: "console",
-		},
-	}
-
-	return cfg
-}
-
-func TestValidateListenAddresses(t *testing.T) {
-	tests := []struct {
-		name        string
-		addresses   []string
-		shouldError bool
-	}{
-		{"valid single", []string{"/ip4/0.0.0.0/tcp/4001"}, false},
-		{"valid ipv6", []string{"/ip6/::/tcp/4001"}, false},
-		{"invalid port", []string{"/ip4/0.0.0.0/tcp/99999"}, true},
-		{"invalid port zero", []string{"/ip4/0.0.0.0/tcp/0"}, true},
-		{"invalid multiaddr", []string{"invalid"}, true},
-		{"empty", []string{}, true},
-		{"duplicate", []string{"/ip4/0.0.0.0/tcp/4001", "/ip4/0.0.0.0/tcp/4001"}, true},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			cfg := validConfigForNode()
-			cfg.Node.ListenAddresses = tt.addresses
-			errs := cfg.Validate()
-			if tt.shouldError && len(errs) == 0 {
-				t.Errorf("expected error, got none")
-			}
-			if !tt.shouldError && len(errs) > 0 {
-				t.Errorf("unexpected errors: %v", errs)
-			}
-		})
-	}
-}
-
-func TestValidateReplicationFactor(t *testing.T) {
-	tests := []struct {
-		name        string
-		replication int
-		shouldError bool
-	}{
-		{"valid 1", 1, false},
-		{"valid 3", 3, false},
-		{"valid even", 2, false}, // warn but not error
-		{"invalid zero", 0, true},
-		{"invalid negative", -1, true},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			cfg := validConfigForNode()
-			cfg.Database.ReplicationFactor = tt.replication
-			errs := cfg.Validate()
-			if tt.shouldError && len(errs) == 0 {
-				t.Errorf("expected error, got none")
-			}
-			if !tt.shouldError && len(errs) > 0 {
-				t.Errorf("unexpected errors: %v", errs)
-			}
-		})
-	}
-}
-
-func TestValidateRQLitePorts(t *testing.T) {
-	tests := []struct {
-		name        string
-		httpPort    int
-		raftPort    int
-		shouldError bool
-	}{
-		{"valid different", 5001, 7001, false},
-		{"invalid same", 5001, 5001, true},
-		{"invalid http port zero", 0, 7001, true},
-		{"invalid raft port zero", 5001, 0, true},
-		{"invalid http port too high", 99999, 7001, true},
-		{"invalid raft port too high", 5001, 99999, true},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			cfg := validConfigForNode()
-			cfg.Database.RQLitePort = tt.httpPort
-			cfg.Database.RQLiteRaftPort = tt.raftPort
-			errs := cfg.Validate()
-			if tt.shouldError && len(errs) == 0 {
-				t.Errorf("expected error, got none")
-			}
-			if !tt.shouldError && len(errs) > 0 {
-				t.Errorf("unexpected errors: %v", errs)
-			}
-		})
-	}
-}
-
-func TestValidateRQLiteJoinAddress(t *testing.T) {
-	tests := []struct {
-		name        string
-		joinAddr    string
-		shouldError bool
-	}{
-		{"node with join", "localhost:5001", false},
-		{"node without join", "", false}, // Join address is optional (first node creates cluster)
-		{"invalid join format", "localhost", true},
-		{"invalid join port", "localhost:99999", true},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			cfg := validConfigForNode()
-			cfg.Database.RQLiteJoinAddress = tt.joinAddr
-			errs := cfg.Validate()
-			if tt.shouldError && len(errs) == 0 {
-				t.Errorf("expected error, got none")
-			}
-			if !tt.shouldError && len(errs) > 0 {
-				t.Errorf("unexpected errors: %v", errs)
-			}
-		})
-	}
-}
-
-func TestValidatePeerAddresses(t *testing.T) {
-	validPeer := "/ip4/127.0.0.1/tcp/4001/p2p/12D3KooWHbcFcrGPXKUrHcxvd8MXEeUzRYyvY8fQcpEBxncSUwhj"
-	tests := []struct {
-		name        string
-		peers       []string
-		shouldError bool
-	}{
-		{"node with peer", []string{validPeer}, false},
-		{"node without peer", []string{}, false}, // All nodes are unified peers - bootstrap peers optional
-		{"invalid multiaddr", []string{"invalid"}, true},
-		{"missing p2p", []string{"/ip4/127.0.0.1/tcp/4001"}, true},
-		{"duplicate peer", []string{validPeer, validPeer}, true},
-		{"invalid port", []string{"/ip4/127.0.0.1/tcp/99999/p2p/12D3KooWHbcFcrGPXKUrHcxvd8MXEeUzRYyvY8fQcpEBxncSUwhj"}, true},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			cfg := validConfigForNode()
-			cfg.Discovery.BootstrapPeers = tt.peers
-			errs := cfg.Validate()
-			if tt.shouldError && len(errs) == 0 {
-				t.Errorf("expected error, got none")
-			}
-			if !tt.shouldError && len(errs) > 0 {
-				t.Errorf("unexpected errors: %v", errs)
-			}
-		})
-	}
-}
-
-func TestValidateLoggingLevel(t *testing.T) {
-	tests := []struct {
-		name        string
-		level       string
-		shouldError bool
-	}{
-		{"debug", "debug", false},
-		{"info", "info", false},
-		{"warn", "warn", false},
-		{"error", "error", false},
-		{"invalid", "verbose", true},
-		{"empty", "", true},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			cfg := validConfigForNode()
-			cfg.Logging.Level = tt.level
-			errs := cfg.Validate()
-			if tt.shouldError && len(errs) == 0 {
-				t.Errorf("expected error, got none")
-			}
-			if !tt.shouldError && len(errs) > 0 {
-				t.Errorf("unexpected errors: %v", errs)
-			}
-		})
-	}
-}
-
-func TestValidateLoggingFormat(t *testing.T) {
-	tests := []struct {
-		name        string
-		format      string
-		shouldError bool
-	}{
-		{"json", "json", false},
-		{"console", "console", false},
-		{"invalid", "text", true},
-		{"empty", "", true},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			cfg := validConfigForNode()
-			cfg.Logging.Format = tt.format
-			errs := cfg.Validate()
-			if tt.shouldError && len(errs) == 0 {
-				t.Errorf("expected error, got none")
-			}
-			if !tt.shouldError && len(errs) > 0 {
-				t.Errorf("unexpected errors: %v", errs)
-			}
-		})
-	}
-}
-
-func TestValidateMaxConnections(t *testing.T) {
-	tests := []struct {
-		name        string
-		maxConn     int
-		shouldError bool
-	}{
-		{"valid 50", 50, false},
-		{"valid 1", 1, false},
-		{"invalid zero", 0, true},
-		{"invalid negative", -1, true},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			cfg := validConfigForNode()
-			cfg.Node.MaxConnections = tt.maxConn
-			errs := cfg.Validate()
-			if tt.shouldError && len(errs) == 0 {
-				t.Errorf("expected error, got none")
-			}
-			if !tt.shouldError && len(errs) > 0 {
-				t.Errorf("unexpected errors: %v", errs)
-			}
-		})
-	}
-}
-
-func TestValidateDiscoveryInterval(t *testing.T) {
-	tests := []struct {
-		name        string
-		interval    time.Duration
-		shouldError bool
-	}{
-		{"valid 15s", 15 * time.Second, false},
-		{"valid 1s", 1 * time.Second, false},
-		{"invalid zero", 0, true},
-		{"invalid negative", -5 * time.Second, true},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			cfg := validConfigForNode()
-			cfg.Discovery.DiscoveryInterval = tt.interval
-			errs := cfg.Validate()
-			if tt.shouldError && len(errs) == 0 {
-				t.Errorf("expected error, got none")
-			}
-			if !tt.shouldError && len(errs) > 0 {
-				t.Errorf("unexpected errors: %v", errs)
-			}
-		})
-	}
-}
-
-func TestValidatePeerDiscoveryPort(t *testing.T) {
-	tests := []struct {
-		name        string
-		port        int
-		shouldError bool
-	}{
-		{"valid 4001", 4001, false},
-		{"valid 4002", 4002, false},
-		{"invalid zero", 0, true},
-		{"invalid too high", 99999, true},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			cfg := validConfigForNode()
-			cfg.Discovery.BootstrapPort = tt.port
-			errs := cfg.Validate()
-			if tt.shouldError && len(errs) == 0 {
-				t.Errorf("expected error, got none")
-			}
-			if !tt.shouldError && len(errs) > 0 {
-				t.Errorf("unexpected errors: %v", errs)
-			}
-		})
-	}
-}
-
-func TestValidateCompleteConfig(t *testing.T) {
-	// Test a complete valid config
-	validCfg := &Config{
-		Node: NodeConfig{
-			ID:              "node1",
-			ListenAddresses: []string{"/ip4/0.0.0.0/tcp/4002"},
-			DataDir:         ".",
-			MaxConnections:  50,
-		},
-		Database: DatabaseConfig{
-			DataDir:           ".",
-			ReplicationFactor: 3,
-			ShardCount:        16,
-			MaxDatabaseSize:   1073741824,
-			BackupInterval:    24 * time.Hour,
-			RQLitePort:        5002,
-			RQLiteRaftPort:    7002,
-			RQLiteJoinAddress: "localhost:7001",
-			MinClusterSize:    1,
-		},
-		Discovery: DiscoveryConfig{
-			BootstrapPeers: []string{
-				"/ip4/127.0.0.1/tcp/4001/p2p/12D3KooWHbcFcrGPXKUrHcxvd8MXEeUzRYyvY8fQcpEBxncSUwhj",
-			},
-			DiscoveryInterval: 15 * time.Second,
-			BootstrapPort:     4001,
-			HttpAdvAddress:    "localhost:5001",
-			RaftAdvAddress:    "localhost:7001",
-			NodeNamespace:     "default",
-		},
-		Security: SecurityConfig{
-			EnableTLS: false,
-		},
-		Logging: LoggingConfig{
-			Level:  "info",
-			Format: "console",
-		},
-	}
-
-	errs := validCfg.Validate()
-	if len(errs) > 0 {
-		t.Errorf("valid config should not have errors: %v", errs)
-	}
-}

pkg/config/yaml.go

@@ -1,19 +0,0 @@
-package config
-
-import (
-	"fmt"
-	"io"
-
-	"gopkg.in/yaml.v3"
-)
-
-// DecodeStrict decodes YAML from a reader and rejects any unknown fields.
-// This ensures the YAML only contains recognized configuration keys.
-func DecodeStrict(r io.Reader, out interface{}) error {
-	decoder := yaml.NewDecoder(r)
-	decoder.KnownFields(true)
-	if err := decoder.Decode(out); err != nil {
-		return fmt.Errorf("invalid config: %w", err)
-	}
-	return nil
-}

pkg/discovery/discovery.go

@@ -5,8 +5,6 @@ import (
 	"encoding/json"
 	"errors"
 	"io"
-	"strconv"
-	"strings"
 	"time"
 
 	"github.com/libp2p/go-libp2p/core/host"
@@ -26,8 +24,7 @@ type PeerExchangeRequest struct {
 
 // PeerExchangeResponse represents a list of peers to exchange
 type PeerExchangeResponse struct {
-	Peers          []PeerInfo          `json:"peers"`
+	Peers []PeerInfo `json:"peers"`
-	RQLiteMetadata *RQLiteNodeMetadata `json:"rqlite_metadata,omitempty"`
 }
 
 // PeerInfo contains peer identity and addresses
@@ -41,10 +38,9 @@ type PeerInfo struct {
 // interface{} to remain source-compatible with previous call sites that
 // passed a DHT instance. The value is ignored.
 type Manager struct {
-	host                host.Host
+	host   host.Host
-	logger              *zap.Logger
+	logger *zap.Logger
-	cancel              context.CancelFunc
+	cancel context.CancelFunc
-	failedPeerExchanges map[peer.ID]time.Time // Track failed peer exchange attempts to suppress repeated warnings
 }
 
 // Config contains discovery configuration
@@ -59,10 +55,8 @@ type Config struct {
 // previously passed a DHT instance can continue to do so; the value is ignored.
 func NewManager(h host.Host, _ interface{}, logger *zap.Logger) *Manager {
 	return &Manager{
-		host:                h,
+		host:   h,
-		logger:              logger.With(zap.String("component", "peer-discovery")),
+		logger: logger,
-		cancel:              nil,
-		failedPeerExchanges: make(map[peer.ID]time.Time),
 	}
 }
 
@@ -116,40 +110,9 @@ func (d *Manager) handlePeerExchangeStream(s network.Stream) {
 			continue
 		}
 
-		// Filter addresses to only include port 4001 (standard libp2p port)
-		// This prevents including non-libp2p service ports (like RQLite ports) in peer exchange
-		const libp2pPort = 4001
-		filteredAddrs := make([]multiaddr.Multiaddr, 0)
-		filteredCount := 0
-		for _, addr := range addrs {
-			// Extract TCP port from multiaddr
-			port, err := addr.ValueForProtocol(multiaddr.P_TCP)
-			if err == nil {
-				portNum, err := strconv.Atoi(port)
-				if err == nil {
-					// Only include addresses with port 4001
-					if portNum == libp2pPort {
-						filteredAddrs = append(filteredAddrs, addr)
-					} else {
-						filteredCount++
-					}
-				}
-				// Skip addresses with unparseable ports
-			} else {
-				// Skip non-TCP addresses (libp2p uses TCP)
-				filteredCount++
-			}
-		}
-
-		// If no addresses remain after filtering, skip this peer
-		// (Filtering is routine - no need to log every occurrence)
-		if len(filteredAddrs) == 0 {
-			continue
-		}
-
 		// Convert addresses to strings
-		addrStrs := make([]string, len(filteredAddrs))
+		addrStrs := make([]string, len(addrs))
-		for i, addr := range filteredAddrs {
+		for i, addr := range addrs {
 			addrStrs[i] = addr.String()
 		}
 
@@ -160,16 +123,6 @@ func (d *Manager) handlePeerExchangeStream(s network.Stream) {
 		added++
 	}
 
-	// Add RQLite metadata if available
-	if val, err := d.host.Peerstore().Get(d.host.ID(), "rqlite_metadata"); err == nil {
-		if jsonData, ok := val.([]byte); ok {
-			var metadata RQLiteNodeMetadata
-			if err := json.Unmarshal(jsonData, &metadata); err == nil {
-				resp.RQLiteMetadata = &metadata
-			}
-		}
-	}
-
 	// Send response
 	encoder := json.NewEncoder(s)
 	if err := encoder.Encode(&resp); err != nil {
@@ -177,7 +130,8 @@ func (d *Manager) handlePeerExchangeStream(s network.Stream) {
 		return
 	}
 
-	// Response sent - routine operation, no need to log
+	d.logger.Debug("Sent peer exchange response",
+		zap.Int("peer_count", len(resp.Peers)))
 }
 
 // Start begins periodic peer discovery
@@ -214,12 +168,15 @@ func (d *Manager) Stop() {
 }
 
 // discoverPeers discovers and connects to new peers using non-DHT strategies:
-//   - Peerstore entries (peers added to peerstore by the caller)
+//   - Peerstore entries (bootstrap peers added to peerstore by the caller)
 //   - Peer exchange: query currently connected peers' peerstore entries
 func (d *Manager) discoverPeers(ctx context.Context, config Config) {
 	connectedPeers := d.host.Network().Peers()
 	initialCount := len(connectedPeers)
 
+	d.logger.Debug("Starting peer discovery",
+		zap.Int("current_peers", initialCount))
+
 	newConnections := 0
 
 	// Strategy 1: Try to connect to peers learned from the host's peerstore
@@ -232,17 +189,16 @@ func (d *Manager) discoverPeers(ctx context.Context, config Config) {
 
 	finalPeerCount := len(d.host.Network().Peers())
 
-	// Summary log: only log if there were changes or new connections
 	if newConnections > 0 || finalPeerCount != initialCount {
-		d.logger.Debug("Discovery summary",
+		d.logger.Debug("Peer discovery completed",
-			zap.Int("connected", finalPeerCount),
+			zap.Int("new_connections", newConnections),
-			zap.Int("new", newConnections),
+			zap.Int("initial_peers", initialCount),
-			zap.Int("was", initialCount))
+			zap.Int("final_peers", finalPeerCount))
 	}
 }
 
 // discoverViaPeerstore attempts to connect to peers found in the host's peerstore.
-// This is useful for peers that have been pre-populated into the peerstore.
+// This is useful for bootstrap peers that have been pre-populated into the peerstore.
 func (d *Manager) discoverViaPeerstore(ctx context.Context, maxConnections int) int {
 	if maxConnections <= 0 {
 		return 0
@@ -252,10 +208,7 @@ func (d *Manager) discoverViaPeerstore(ctx context.Context, maxConnections int)
 
 	// Iterate over peerstore known peers
 	peers := d.host.Peerstore().Peers()
-
+	d.logger.Debug("Peerstore contains peers", zap.Int("count", len(peers)))
-	// Only connect to peers on our standard LibP2P port to avoid cross-connecting
-	// with IPFS/IPFS Cluster instances that use different ports
-	const libp2pPort = 4001
 
 	for _, pid := range peers {
 		if connected >= maxConnections {
@@ -270,24 +223,6 @@ func (d *Manager) discoverViaPeerstore(ctx context.Context, maxConnections int)
 			continue
 		}
 
-		// Filter peers to only include those with addresses on our port (4001)
-		// This prevents attempting to connect to IPFS (port 4101) or IPFS Cluster (port 9096/9098)
-		peerInfo := d.host.Peerstore().PeerInfo(pid)
-		hasValidPort := false
-		for _, addr := range peerInfo.Addrs {
-			if port, err := addr.ValueForProtocol(multiaddr.P_TCP); err == nil {
-				if portNum, err := strconv.Atoi(port); err == nil && portNum == libp2pPort {
-					hasValidPort = true
-					break
-				}
-			}
-		}
-
-		// Skip peers without valid port 4001 addresses
-		if !hasValidPort {
-			continue
-		}
-
 		// Try to connect
 		if err := d.connectToPeer(ctx, pid); err == nil {
 			connected++
@@ -310,8 +245,8 @@ func (d *Manager) discoverViaPeerExchange(ctx context.Context, maxConnections in
 		return 0
 	}
 
-	exchangedPeers := 0
+	d.logger.Debug("Starting peer exchange with connected peers",
-	metadataCollected := 0
+		zap.Int("num_peers", len(connectedPeers)))
 
 	for _, peerID := range connectedPeers {
 		if connected >= maxConnections {
@@ -324,13 +259,9 @@ func (d *Manager) discoverViaPeerExchange(ctx context.Context, maxConnections in
 			continue
 		}
 
-		exchangedPeers++
+		d.logger.Debug("Received peer list from peer",
-		// Check if we got RQLite metadata
+			zap.String("from_peer", peerID.String()[:8]+"..."),
-		if val, err := d.host.Peerstore().Get(peerID, "rqlite_metadata"); err == nil {
+			zap.Int("peer_count", len(peers)))
-			if _, ok := val.([]byte); ok {
-				metadataCollected++
-			}
-		}
 
 		// Try to connect to discovered peers
 		for _, peerInfo := range peers {
@@ -355,8 +286,7 @@ func (d *Manager) discoverViaPeerExchange(ctx context.Context, maxConnections in
 				continue
 			}
 
-			// Parse and filter addresses to only include port 4001 (standard libp2p port)
+			// Parse addresses
-			const libp2pPort = 4001
 			addrs := make([]multiaddr.Multiaddr, 0, len(peerInfo.Addrs))
 			for _, addrStr := range peerInfo.Addrs {
 				ma, err := multiaddr.NewMultiaddr(addrStr)
@@ -364,55 +294,36 @@ func (d *Manager) discoverViaPeerExchange(ctx context.Context, maxConnections in
 					d.logger.Debug("Failed to parse multiaddr", zap.Error(err))
 					continue
 				}
-				// Only include addresses with port 4001
+				addrs = append(addrs, ma)
-				port, err := ma.ValueForProtocol(multiaddr.P_TCP)
-				if err == nil {
-					portNum, err := strconv.Atoi(port)
-					if err == nil && portNum == libp2pPort {
-						addrs = append(addrs, ma)
-					}
-					// Skip addresses with wrong ports
-				}
-				// Skip non-TCP addresses
 			}
 
 			if len(addrs) == 0 {
-				// Skip peers without valid addresses - no need to log every occurrence
 				continue
 			}
 
-			// Add to peerstore (only valid addresses with port 4001)
+			// Add to peerstore
 			d.host.Peerstore().AddAddrs(parsedID, addrs, time.Hour*24)
 
 			// Try to connect
-			connectCtx, cancel := context.WithTimeout(ctx, 20*time.Second)
+			connectCtx, cancel := context.WithTimeout(ctx, 15*time.Second)
 			peerAddrInfo := peer.AddrInfo{ID: parsedID, Addrs: addrs}
 
 			if err := d.host.Connect(connectCtx, peerAddrInfo); err != nil {
 				cancel()
-				// Only log connection failures for debugging - errors are still useful
+				d.logger.Debug("Failed to connect to discovered peer",
-				d.logger.Debug("Connect failed",
+					zap.String("peer_id", parsedID.String()[:8]+"..."),
-					zap.String("peer", parsedID.String()[:8]+"..."),
 					zap.Error(err))
 				continue
 			}
 			cancel()
 
-			d.logger.Info("Connected",
+			d.logger.Info("Successfully connected to discovered peer",
-				zap.String("peer", parsedID.String()[:8]+"..."),
+				zap.String("peer_id", parsedID.String()[:8]+"..."),
-				zap.String("from", peerID.String()[:8]+"..."))
+				zap.String("discovered_from", peerID.String()[:8]+"..."))
 			connected++
 		}
 	}
 
-	// Summary log for peer exchange
-	if exchangedPeers > 0 {
-		d.logger.Debug("Exchange summary",
-			zap.Int("exchanged_with", exchangedPeers),
-			zap.Int("metadata_collected", metadataCollected),
-			zap.Int("new_connections", connected))
-	}
-
 	return connected
 }
 
@@ -421,30 +332,13 @@ func (d *Manager) requestPeersFromPeer(ctx context.Context, peerID peer.ID, limi
 	// Open a stream to the peer
 	stream, err := d.host.NewStream(ctx, peerID, PeerExchangeProtocol)
 	if err != nil {
-		// Check if this is a "protocols not supported" error (expected for lightweight clients like gateway)
+		d.logger.Debug("Failed to open peer exchange stream",
-		if strings.Contains(err.Error(), "protocols not supported") {
+			zap.String("peer_id", peerID.String()[:8]+"..."),
-			// This is a lightweight client (gateway, etc.) that doesn't support peer exchange - expected behavior
+			zap.Error(err))
-			// Track it to avoid repeated attempts, but don't log as it's not an error
-			d.failedPeerExchanges[peerID] = time.Now()
-			return nil
-		}
-
-		// For actual connection errors, log but suppress repeated warnings for the same peer
-		lastFailure, seen := d.failedPeerExchanges[peerID]
-		if !seen || time.Since(lastFailure) > time.Minute {
-			d.logger.Debug("Failed to open peer exchange stream with node",
-				zap.String("peer_id", peerID.String()[:8]+"..."),
-				zap.String("reason", "peer does not support peer exchange protocol or connection failed"),
-				zap.Error(err))
-			d.failedPeerExchanges[peerID] = time.Now()
-		}
 		return nil
 	}
 	defer stream.Close()
 
-	// Clear failure tracking on success
-	delete(d.failedPeerExchanges, peerID)
-
 	// Send request
 	req := PeerExchangeRequest{Limit: limit}
 	encoder := json.NewEncoder(stream)
@@ -469,50 +363,9 @@ func (d *Manager) requestPeersFromPeer(ctx context.Context, peerID peer.ID, limi
 		return nil
 	}
 
-	// Store remote peer's RQLite metadata if available
-	if resp.RQLiteMetadata != nil {
-		metadataJSON, err := json.Marshal(resp.RQLiteMetadata)
-		if err == nil {
-			_ = d.host.Peerstore().Put(peerID, "rqlite_metadata", metadataJSON)
-			// Only log when new metadata is stored (useful for debugging)
-			d.logger.Debug("Metadata stored",
-				zap.String("peer", peerID.String()[:8]+"..."),
-				zap.String("node", resp.RQLiteMetadata.NodeID))
-		}
-	}
-
 	return resp.Peers
 }
 
-// TriggerPeerExchange manually triggers peer exchange with all connected peers
-// This is useful for pre-startup cluster discovery to populate the peerstore with RQLite metadata
-func (d *Manager) TriggerPeerExchange(ctx context.Context) int {
-	connectedPeers := d.host.Network().Peers()
-	if len(connectedPeers) == 0 {
-		d.logger.Debug("No connected peers for peer exchange")
-		return 0
-	}
-
-	metadataCollected := 0
-	for _, peerID := range connectedPeers {
-		// Request peer list from this peer (which includes their RQLite metadata)
-		_ = d.requestPeersFromPeer(ctx, peerID, 50) // Request up to 50 peers
-
-		// Check if we got RQLite metadata from this peer
-		if val, err := d.host.Peerstore().Get(peerID, "rqlite_metadata"); err == nil {
-			if _, ok := val.([]byte); ok {
-				metadataCollected++
-			}
-		}
-	}
-
-	d.logger.Info("Exchange completed",
-		zap.Int("peers", len(connectedPeers)),
-		zap.Int("with_metadata", metadataCollected))
-
-	return metadataCollected
-}
-
 // connectToPeer attempts to connect to a specific peer using its peerstore info.
 func (d *Manager) connectToPeer(ctx context.Context, peerID peer.ID) error {
 	peerInfo := d.host.Peerstore().PeerInfo(peerID)
@@ -528,7 +381,8 @@ func (d *Manager) connectToPeer(ctx context.Context, peerID peer.ID) error {
 		return err
 	}
 
-	// Connection success logged at higher level - no need for duplicate DEBUG log
+	d.logger.Debug("Successfully connected to peer",
+		zap.String("peer_id", peerID.String()[:8]+"..."))
 
 	return nil
 }

pkg/discovery/rqlite_metadata.go

@@ -1,22 +0,0 @@
-package discovery
-
-import (
-	"time"
-)
-
-// RQLiteNodeMetadata contains RQLite-specific information announced via LibP2P
-type RQLiteNodeMetadata struct {
-	NodeID         string    `json:"node_id"`         // RQLite node ID (from config)
-	RaftAddress    string    `json:"raft_address"`    // Raft port address (e.g., "51.83.128.181:7001")
-	HTTPAddress    string    `json:"http_address"`    // HTTP API address (e.g., "51.83.128.181:5001")
-	NodeType       string    `json:"node_type"`       // Node type identifier
-	RaftLogIndex   uint64    `json:"raft_log_index"`  // Current Raft log index (for data comparison)
-	LastSeen       time.Time `json:"last_seen"`       // Updated on every announcement
-	ClusterVersion string    `json:"cluster_version"` // For compatibility checking
-}
-
-// PeerExchangeResponseV2 extends the original response with RQLite metadata
-type PeerExchangeResponseV2 struct {
-	Peers          []PeerInfo          `json:"peers"`
-	RQLiteMetadata *RQLiteNodeMetadata `json:"rqlite_metadata,omitempty"`
-}

pkg/environments/development/checks.go

@@ -1,136 +0,0 @@
-package development
-
-import (
-	"fmt"
-	"net"
-	"os/exec"
-	"strings"
-)
-
-// Dependency represents an external binary dependency
-type Dependency struct {
-	Name        string
-	Command     string
-	MinVersion  string // Optional: if set, try to check version
-	InstallHint string
-}
-
-// DependencyChecker handles dependency validation
-type DependencyChecker struct {
-	dependencies []Dependency
-}
-
-// NewDependencyChecker creates a new dependency checker
-func NewDependencyChecker() *DependencyChecker {
-	return &DependencyChecker{
-		dependencies: []Dependency{
-			{
-				Name:        "IPFS",
-				Command:     "ipfs",
-				MinVersion:  "0.25.0",
-				InstallHint: "Install with: brew install ipfs (macOS) or https://docs.ipfs.tech/install/command-line/",
-			},
-			{
-				Name:        "IPFS Cluster Service",
-				Command:     "ipfs-cluster-service",
-				MinVersion:  "1.0.0",
-				InstallHint: "Install with: go install github.com/ipfs-cluster/ipfs-cluster/cmd/ipfs-cluster-service@latest",
-			},
-			{
-				Name:        "RQLite",
-				Command:     "rqlited",
-				InstallHint: "Install with: brew install rqlite (macOS) or https://github.com/rqlite/rqlite/releases",
-			},
-			{
-				Name:        "Olric Server",
-				Command:     "olric-server",
-				InstallHint: "Install with: go install github.com/olric-data/olric/cmd/olric-server@v0.7.0",
-			},
-			{
-				Name:        "npm (for Anyone)",
-				Command:     "npm",
-				InstallHint: "Install Node.js with: brew install node (macOS) or https://nodejs.org/",
-			},
-			{
-				Name:        "OpenSSL",
-				Command:     "openssl",
-				InstallHint: "Install with: brew install openssl (macOS) - usually pre-installed on Linux",
-			},
-		},
-	}
-}
-
-// CheckAll performs all dependency checks and returns a report
-func (dc *DependencyChecker) CheckAll() ([]string, error) {
-	var missing []string
-	var hints []string
-
-	for _, dep := range dc.dependencies {
-		if _, err := exec.LookPath(dep.Command); err != nil {
-			missing = append(missing, dep.Name)
-			hints = append(hints, fmt.Sprintf("  %s: %s", dep.Name, dep.InstallHint))
-		}
-	}
-
-	if len(missing) == 0 {
-		return nil, nil // All OK
-	}
-
-	errMsg := fmt.Sprintf("Missing %d required dependencies:\n%s\n\nInstall them with:\n%s",
-		len(missing), strings.Join(missing, ", "), strings.Join(hints, "\n"))
-	return missing, fmt.Errorf(errMsg)
-}
-
-// PortChecker validates that required ports are available
-type PortChecker struct {
-	ports []int
-}
-
-// RequiredPorts defines all ports needed for dev environment
-// Computed from DefaultTopology
-var RequiredPorts = DefaultTopology().AllPorts()
-
-// NewPortChecker creates a new port checker with required ports
-func NewPortChecker() *PortChecker {
-	return &PortChecker{
-		ports: RequiredPorts,
-	}
-}
-
-// CheckAll verifies all required ports are available
-func (pc *PortChecker) CheckAll() ([]int, error) {
-	var unavailable []int
-
-	for _, port := range pc.ports {
-		if !isPortAvailable(port) {
-			unavailable = append(unavailable, port)
-		}
-	}
-
-	if len(unavailable) == 0 {
-		return nil, nil // All OK
-	}
-
-	errMsg := fmt.Sprintf("The following ports are unavailable: %v\n\nFree them or stop conflicting services and try again",
-		unavailable)
-	return unavailable, fmt.Errorf(errMsg)
-}
-
-// isPortAvailable checks if a TCP port is available for binding
-func isPortAvailable(port int) bool {
-	// Port 0 is reserved and means "assign any available port"
-	if port == 0 {
-		return false
-	}
-	ln, err := net.Listen("tcp", fmt.Sprintf("127.0.0.1:%d", port))
-	if err != nil {
-		return false
-	}
-	ln.Close()
-	return true
-}
-
-// PortMap provides a human-readable mapping of ports to services
-func PortMap() map[int]string {
-	return DefaultTopology().PortMap()
-}

pkg/environments/development/checks_test.go

@@ -1,92 +0,0 @@
-package development
-
-import (
-	"testing"
-)
-
-func TestPortChecker(t *testing.T) {
-	checker := NewPortChecker()
-
-	if checker == nil {
-		t.Fatal("NewPortChecker returned nil")
-	}
-
-	// Verify all required ports are defined
-	if len(checker.ports) == 0 {
-		t.Fatal("No ports defined in checker")
-	}
-
-	// Check that required port counts match expectations
-	// 5 nodes × 9 ports per node + 4 shared ports = 49
-	expectedPortCount := 49 // Based on RequiredPorts
-	if len(checker.ports) != expectedPortCount {
-		t.Errorf("Expected %d ports, got %d", expectedPortCount, len(checker.ports))
-	}
-}
-
-func TestPortMap(t *testing.T) {
-	portMap := PortMap()
-
-	if len(portMap) == 0 {
-		t.Fatal("PortMap returned empty map")
-	}
-
-	// Check for key ports
-	expectedPorts := []int{4001, 5001, 7001, 6001, 3320, 9050, 9094}
-	for _, port := range expectedPorts {
-		if _, exists := portMap[port]; !exists {
-			t.Errorf("Expected port %d not found in PortMap", port)
-		}
-	}
-
-	// Verify descriptions exist
-	for port, desc := range portMap {
-		if desc == "" {
-			t.Errorf("Port %d has empty description", port)
-		}
-	}
-}
-
-func TestDependencyChecker(t *testing.T) {
-	checker := NewDependencyChecker()
-
-	if checker == nil {
-		t.Fatal("NewDependencyChecker returned nil")
-	}
-
-	// Verify required dependencies are defined
-	if len(checker.dependencies) == 0 {
-		t.Fatal("No dependencies defined in checker")
-	}
-
-	// Expected minimum dependencies
-	expectedDeps := []string{"ipfs", "rqlited", "olric-server", "npm"}
-	for _, expected := range expectedDeps {
-		found := false
-		for _, dep := range checker.dependencies {
-			if dep.Command == expected {
-				found = true
-				if dep.InstallHint == "" {
-					t.Errorf("Dependency %s has no install hint", expected)
-				}
-				break
-			}
-		}
-		if !found {
-			t.Errorf("Expected dependency %s not found", expected)
-		}
-	}
-}
-
-func TestIsPortAvailable(t *testing.T) {
-	// Test with a very high port that should be available
-	highPort := 65432
-	if !isPortAvailable(highPort) {
-		t.Logf("Port %d may be in use (this is non-fatal for testing)", highPort)
-	}
-
-	// Port 0 should not be available (reserved)
-	if isPortAvailable(0) {
-		t.Error("Port 0 should not be available")
-	}
-}

pkg/environments/development/config.go

@@ -1,211 +0,0 @@
-package development
-
-import (
-	"crypto/rand"
-	"encoding/hex"
-	"fmt"
-	"os"
-	"path/filepath"
-	"strings"
-
-	"github.com/DeBrosOfficial/network/pkg/encryption"
-	"github.com/DeBrosOfficial/network/pkg/environments/templates"
-)
-
-// ConfigEnsurer handles all config file creation and validation
-type ConfigEnsurer struct {
-	oramaDir string
-}
-
-// NewConfigEnsurer creates a new config ensurer
-func NewConfigEnsurer(oramaDir string) *ConfigEnsurer {
-	return &ConfigEnsurer{
-		oramaDir: oramaDir,
-	}
-}
-
-// EnsureAll ensures all necessary config files and secrets exist
-func (ce *ConfigEnsurer) EnsureAll() error {
-	// Create directories
-	if err := os.MkdirAll(ce.oramaDir, 0755); err != nil {
-		return fmt.Errorf("failed to create .orama directory: %w", err)
-	}
-
-	if err := os.MkdirAll(filepath.Join(ce.oramaDir, "logs"), 0755); err != nil {
-		return fmt.Errorf("failed to create logs directory: %w", err)
-	}
-
-	// Ensure shared secrets
-	if err := ce.ensureSharedSecrets(); err != nil {
-		return fmt.Errorf("failed to ensure shared secrets: %w", err)
-	}
-
-	// Load topology
-	topology := DefaultTopology()
-
-	// Generate identities for first two nodes and collect their multiaddrs as peer addresses
-	// All nodes use these addresses for initial peer discovery
-	peerAddrs := []string{}
-	for i := 0; i < 2 && i < len(topology.Nodes); i++ {
-		nodeSpec := topology.Nodes[i]
-		addr, err := ce.ensureNodeIdentity(nodeSpec)
-		if err != nil {
-			return fmt.Errorf("failed to ensure identity for %s: %w", nodeSpec.Name, err)
-		}
-		peerAddrs = append(peerAddrs, addr)
-	}
-
-	// Ensure configs for all nodes
-	for _, nodeSpec := range topology.Nodes {
-		if err := ce.ensureNodeConfig(nodeSpec, peerAddrs); err != nil {
-			return fmt.Errorf("failed to ensure config for %s: %w", nodeSpec.Name, err)
-		}
-	}
-
-	// Gateway configuration is now embedded in each node's config
-	// No separate gateway.yaml needed anymore
-
-	// Ensure Olric config
-	if err := ce.ensureOlric(); err != nil {
-		return fmt.Errorf("failed to ensure olric: %w", err)
-	}
-
-	return nil
-}
-
-// ensureSharedSecrets creates cluster secret and swarm key if they don't exist
-func (ce *ConfigEnsurer) ensureSharedSecrets() error {
-	secretPath := filepath.Join(ce.oramaDir, "cluster-secret")
-	if _, err := os.Stat(secretPath); os.IsNotExist(err) {
-		secret := generateRandomHex(64) // 64 hex chars = 32 bytes
-		if err := os.WriteFile(secretPath, []byte(secret), 0600); err != nil {
-			return fmt.Errorf("failed to write cluster secret: %w", err)
-		}
-		fmt.Printf("✓ Generated cluster secret\n")
-	}
-
-	swarmKeyPath := filepath.Join(ce.oramaDir, "swarm.key")
-	if _, err := os.Stat(swarmKeyPath); os.IsNotExist(err) {
-		keyHex := strings.ToUpper(generateRandomHex(64))
-		content := fmt.Sprintf("/key/swarm/psk/1.0.0/\n/base16/\n%s\n", keyHex)
-		if err := os.WriteFile(swarmKeyPath, []byte(content), 0600); err != nil {
-			return fmt.Errorf("failed to write swarm key: %w", err)
-		}
-		fmt.Printf("✓ Generated IPFS swarm key\n")
-	}
-
-	return nil
-}
-
-// ensureNodeIdentity creates or loads a node identity and returns its multiaddr
-func (ce *ConfigEnsurer) ensureNodeIdentity(nodeSpec NodeSpec) (string, error) {
-	nodeDir := filepath.Join(ce.oramaDir, nodeSpec.DataDir)
-	identityPath := filepath.Join(nodeDir, "identity.key")
-
-	// Create identity if missing
-	var peerID string
-	if _, err := os.Stat(identityPath); os.IsNotExist(err) {
-		if err := os.MkdirAll(nodeDir, 0755); err != nil {
-			return "", fmt.Errorf("failed to create node directory: %w", err)
-		}
-
-		info, err := encryption.GenerateIdentity()
-		if err != nil {
-			return "", fmt.Errorf("failed to generate identity: %w", err)
-		}
-
-		if err := encryption.SaveIdentity(info, identityPath); err != nil {
-			return "", fmt.Errorf("failed to save identity: %w", err)
-		}
-
-		peerID = info.PeerID.String()
-		fmt.Printf("✓ Generated %s identity (Peer ID: %s)\n", nodeSpec.Name, peerID)
-	} else {
-		info, err := encryption.LoadIdentity(identityPath)
-		if err != nil {
-			return "", fmt.Errorf("failed to load identity: %w", err)
-		}
-		peerID = info.PeerID.String()
-	}
-
-	// Return multiaddr
-	return fmt.Sprintf("/ip4/127.0.0.1/tcp/%d/p2p/%s", nodeSpec.P2PPort, peerID), nil
-}
-
-// ensureNodeConfig creates or updates a node configuration
-func (ce *ConfigEnsurer) ensureNodeConfig(nodeSpec NodeSpec, peerAddrs []string) error {
-	nodeDir := filepath.Join(ce.oramaDir, nodeSpec.DataDir)
-	configPath := filepath.Join(ce.oramaDir, nodeSpec.ConfigFilename)
-
-	if err := os.MkdirAll(nodeDir, 0755); err != nil {
-		return fmt.Errorf("failed to create node directory: %w", err)
-	}
-
-	// Generate node config (all nodes are unified)
-	data := templates.NodeConfigData{
-		NodeID:             nodeSpec.Name,
-		P2PPort:            nodeSpec.P2PPort,
-		DataDir:            nodeDir,
-		RQLiteHTTPPort:     nodeSpec.RQLiteHTTPPort,
-		RQLiteRaftPort:     nodeSpec.RQLiteRaftPort,
-		RQLiteRaftInternalPort: nodeSpec.RQLiteRaftPort,
-		RQLiteJoinAddress:  nodeSpec.RQLiteJoinTarget,
-		BootstrapPeers:     peerAddrs,
-		ClusterAPIPort:     nodeSpec.ClusterAPIPort,
-		IPFSAPIPort:        nodeSpec.IPFSAPIPort,
-		HTTPAdvAddress:     fmt.Sprintf("localhost:%d", nodeSpec.RQLiteHTTPPort),
-		RaftAdvAddress:     fmt.Sprintf("localhost:%d", nodeSpec.RQLiteRaftPort),
-		UnifiedGatewayPort: nodeSpec.UnifiedGatewayPort,
-	}
-
-	config, err := templates.RenderNodeConfig(data)
-	if err != nil {
-		return fmt.Errorf("failed to render node config: %w", err)
-	}
-
-	if err := os.WriteFile(configPath, []byte(config), 0644); err != nil {
-		return fmt.Errorf("failed to write node config: %w", err)
-	}
-
-	fmt.Printf("✓ Generated %s.yaml\n", nodeSpec.Name)
-
-	return nil
-}
-
-// Gateway configuration is now embedded in each node's config
-// ensureGateway is no longer needed - each node runs its own embedded gateway
-
-// ensureOlric creates Olric config
-func (ce *ConfigEnsurer) ensureOlric() error {
-	configPath := filepath.Join(ce.oramaDir, "olric-config.yaml")
-
-	topology := DefaultTopology()
-	data := templates.OlricConfigData{
-		ServerBindAddr:        "127.0.0.1",
-		HTTPPort:              topology.OlricHTTPPort,
-		MemberlistBindAddr:    "127.0.0.1", // localhost for development
-		MemberlistPort:        topology.OlricMemberPort,
-		MemberlistEnvironment: "local", // development environment
-	}
-
-	config, err := templates.RenderOlricConfig(data)
-	if err != nil {
-		return fmt.Errorf("failed to render olric config: %w", err)
-	}
-
-	if err := os.WriteFile(configPath, []byte(config), 0644); err != nil {
-		return fmt.Errorf("failed to write olric config: %w", err)
-	}
-
-	fmt.Printf("✓ Generated olric-config.yaml\n")
-	return nil
-}
-
-// generateRandomHex generates a random hex string of specified length
-func generateRandomHex(length int) string {
-	bytes := make([]byte, length/2)
-	if _, err := rand.Read(bytes); err != nil {
-		panic(fmt.Sprintf("failed to generate random bytes: %v", err))
-	}
-	return hex.EncodeToString(bytes)
-}

pkg/environments/development/health.go

@@ -1,215 +0,0 @@
-package development
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"io"
-	"net/http"
-	"os/exec"
-	"strings"
-	"time"
-
-	"github.com/DeBrosOfficial/network/pkg/tlsutil"
-)
-
-// HealthCheckResult represents the result of a health check
-type HealthCheckResult struct {
-	Name    string
-	Healthy bool
-	Details string
-}
-
-// IPFSHealthCheck verifies IPFS peer connectivity
-func (pm *ProcessManager) IPFSHealthCheck(ctx context.Context, nodes []ipfsNodeInfo) HealthCheckResult {
-	result := HealthCheckResult{Name: "IPFS Peers"}
-
-	healthyCount := 0
-	for _, node := range nodes {
-		cmd := exec.CommandContext(ctx, "ipfs", "swarm", "peers", "--repo-dir="+node.ipfsPath)
-		output, err := cmd.CombinedOutput()
-		if err != nil {
-			result.Details += fmt.Sprintf("%s: error getting peers (%v); ", node.name, err)
-			continue
-		}
-
-		// Split by newlines and filter empty lines
-		peerLines := strings.Split(strings.TrimSpace(string(output)), "\n")
-		peerCount := 0
-		for _, line := range peerLines {
-			if strings.TrimSpace(line) != "" {
-				peerCount++
-			}
-		}
-
-		// With 5 nodes, expect each node to see at least 3 other peers
-		if peerCount < 3 {
-			result.Details += fmt.Sprintf("%s: only %d peers (want 3+); ", node.name, peerCount)
-		} else {
-			result.Details += fmt.Sprintf("%s: %d peers; ", node.name, peerCount)
-			healthyCount++
-		}
-	}
-
-	// Require all 5 nodes to have healthy peer counts
-	result.Healthy = healthyCount == len(nodes)
-	return result
-}
-
-// RQLiteHealthCheck verifies RQLite cluster formation
-func (pm *ProcessManager) RQLiteHealthCheck(ctx context.Context) HealthCheckResult {
-	result := HealthCheckResult{Name: "RQLite Cluster"}
-
-	topology := DefaultTopology()
-	healthyCount := 0
-
-	for _, nodeSpec := range topology.Nodes {
-		status := pm.checkRQLiteNode(ctx, nodeSpec.Name, nodeSpec.RQLiteHTTPPort)
-		if status.Healthy {
-			healthyCount++
-		}
-		result.Details += fmt.Sprintf("%s: %s; ", nodeSpec.Name, status.Details)
-	}
-
-	// Require at least 3 out of 5 nodes to be healthy for quorum
-	result.Healthy = healthyCount >= 3
-	return result
-}
-
-// checkRQLiteNode queries a single RQLite node's status
-func (pm *ProcessManager) checkRQLiteNode(ctx context.Context, name string, httpPort int) HealthCheckResult {
-	result := HealthCheckResult{Name: fmt.Sprintf("RQLite-%s", name)}
-
-	urlStr := fmt.Sprintf("http://localhost:%d/status", httpPort)
-	client := tlsutil.NewHTTPClient(2 * time.Second)
-	resp, err := client.Get(urlStr)
-	if err != nil {
-		result.Details = fmt.Sprintf("connection failed: %v", err)
-		return result
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK {
-		result.Details = fmt.Sprintf("HTTP %d", resp.StatusCode)
-		return result
-	}
-
-	var status map[string]interface{}
-	if err := json.NewDecoder(resp.Body).Decode(&status); err != nil {
-		result.Details = fmt.Sprintf("decode error: %v", err)
-		return result
-	}
-
-	// Check the store.raft structure (RQLite 8 format)
-	store, ok := status["store"].(map[string]interface{})
-	if !ok {
-		result.Details = "store data not found"
-		return result
-	}
-
-	raft, ok := store["raft"].(map[string]interface{})
-	if !ok {
-		result.Details = "raft data not found"
-		return result
-	}
-
-	// Check if we have a leader
-	leader, hasLeader := raft["leader"].(string)
-	if hasLeader && leader != "" {
-		result.Healthy = true
-		result.Details = "cluster member with leader elected"
-		return result
-	}
-
-	// Check node state - accept both Leader and Follower
-	if state, ok := raft["state"].(string); ok {
-		if state == "Leader" {
-			result.Healthy = true
-			result.Details = "this node is leader"
-			return result
-		}
-		if state == "Follower" {
-			result.Healthy = true
-			result.Details = "this node is follower in cluster"
-			return result
-		}
-		result.Details = fmt.Sprintf("state: %s", state)
-		return result
-	}
-
-	result.Details = "not yet connected"
-	return result
-}
-
-// LibP2PHealthCheck verifies that network nodes have peer connections
-func (pm *ProcessManager) LibP2PHealthCheck(ctx context.Context) HealthCheckResult {
-	result := HealthCheckResult{Name: "LibP2P/Node Peers"}
-
-	// Check that nodes are part of the RQLite cluster and can communicate via LibP2P
-	topology := DefaultTopology()
-	healthyNodes := 0
-
-	for _, nodeSpec := range topology.Nodes {
-		status := pm.checkRQLiteNode(ctx, nodeSpec.Name, nodeSpec.RQLiteHTTPPort)
-		if status.Healthy {
-			healthyNodes++
-			result.Details += fmt.Sprintf("%s: connected; ", nodeSpec.Name)
-		} else {
-			result.Details += fmt.Sprintf("%s: %s; ", nodeSpec.Name, status.Details)
-		}
-	}
-
-	// Healthy if at least 3 nodes report connectivity
-	result.Healthy = healthyNodes >= 3
-	return result
-}
-
-// HealthCheckWithRetry performs a health check with retry logic
-func (pm *ProcessManager) HealthCheckWithRetry(ctx context.Context, nodes []ipfsNodeInfo, retries int, retryInterval time.Duration, timeout time.Duration) bool {
-	fmt.Fprintf(pm.logWriter, "⚕️  Validating cluster health...")
-
-	deadlineCtx, cancel := context.WithTimeout(ctx, timeout)
-	defer cancel()
-
-	spinnerFrames := []string{"⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"}
-	spinnerIndex := 0
-
-	for attempt := 1; attempt <= retries; attempt++ {
-		// Perform all checks
-		ipfsResult := pm.IPFSHealthCheck(deadlineCtx, nodes)
-		rqliteResult := pm.RQLiteHealthCheck(deadlineCtx)
-		libp2pResult := pm.LibP2PHealthCheck(deadlineCtx)
-
-		// All checks must pass
-		if ipfsResult.Healthy && rqliteResult.Healthy && libp2pResult.Healthy {
-			fmt.Fprintf(pm.logWriter, "\r✓ Cluster health validated\n")
-			return true
-		}
-
-		// Show spinner progress
-		fmt.Fprintf(pm.logWriter, "\r%s Validating cluster health... (%d/%d)", spinnerFrames[spinnerIndex%len(spinnerFrames)], attempt, retries)
-		spinnerIndex++
-
-		if attempt < retries {
-			select {
-			case <-time.After(retryInterval):
-				continue
-			case <-deadlineCtx.Done():
-				fmt.Fprintf(pm.logWriter, "\r❌ Health check timeout reached\n")
-				return false
-			}
-		}
-	}
-
-	fmt.Fprintf(pm.logWriter, "\r❌ Health checks failed - services not ready\n")
-	return false
-}
-
-// logHealthCheckResult logs a single health check result
-func (pm *ProcessManager) logHealthCheckResult(w io.Writer, indent string, result HealthCheckResult) {
-	status := "❌"
-	if result.Healthy {
-		status = "✓"
-	}
-	fmt.Fprintf(w, "%s%s %s: %s\n", indent, status, result.Name, result.Details)
-}

pkg/environments/development/topology.go

@@ -1,202 +0,0 @@
-package development
-
-import "fmt"
-
-// NodeSpec defines configuration for a single dev environment node
-type NodeSpec struct {
-	Name              string // node-1, node-2, node-3, node-4, node-5
-	ConfigFilename    string // node-1.yaml, node-2.yaml, etc.
-	DataDir           string // relative path from .orama root
-	P2PPort           int    // LibP2P listen port
-	IPFSAPIPort       int    // IPFS API port
-	IPFSSwarmPort     int    // IPFS Swarm port
-	IPFSGatewayPort   int    // IPFS HTTP Gateway port
-	RQLiteHTTPPort    int    // RQLite HTTP API port
-	RQLiteRaftPort    int    // RQLite Raft consensus port
-	ClusterAPIPort    int    // IPFS Cluster REST API port
-	ClusterPort       int    // IPFS Cluster P2P port
-	UnifiedGatewayPort int   // Unified gateway port (proxies all services)
-	RQLiteJoinTarget  string // which node's RQLite Raft port to join (empty for first node)
-	ClusterJoinTarget string // which node's cluster to join (empty for first node)
-}
-
-// Topology defines the complete development environment topology
-type Topology struct {
-	Nodes           []NodeSpec
-	GatewayPort     int
-	OlricHTTPPort   int
-	OlricMemberPort int
-	AnonSOCKSPort   int
-}
-
-// DefaultTopology returns the default five-node dev environment topology
-func DefaultTopology() *Topology {
-	return &Topology{
-		Nodes: []NodeSpec{
-		{
-			Name:              "node-1",
-			ConfigFilename:    "node-1.yaml",
-			DataDir:           "node-1",
-			P2PPort:           4001,
-			IPFSAPIPort:       4501,
-			IPFSSwarmPort:     4101,
-			IPFSGatewayPort:   7501,
-			RQLiteHTTPPort:    5001,
-			RQLiteRaftPort:    7001,
-			ClusterAPIPort:    9094,
-			ClusterPort:       9096,
-			UnifiedGatewayPort: 6001,
-			RQLiteJoinTarget:  "",       // First node - creates cluster
-			ClusterJoinTarget: "",
-		},
-		{
-			Name:              "node-2",
-			ConfigFilename:    "node-2.yaml",
-			DataDir:           "node-2",
-			P2PPort:           4011,
-			IPFSAPIPort:       4511,
-			IPFSSwarmPort:     4111,
-			IPFSGatewayPort:   7511,
-			RQLiteHTTPPort:    5011,
-			RQLiteRaftPort:    7011,
-			ClusterAPIPort:    9104,
-			ClusterPort:       9106,
-			UnifiedGatewayPort: 6002,
-			RQLiteJoinTarget:  "localhost:7001",
-			ClusterJoinTarget: "localhost:9096",
-		},
-		{
-			Name:              "node-3",
-			ConfigFilename:    "node-3.yaml",
-			DataDir:           "node-3",
-			P2PPort:           4002,
-			IPFSAPIPort:       4502,
-			IPFSSwarmPort:     4102,
-			IPFSGatewayPort:   7502,
-			RQLiteHTTPPort:    5002,
-			RQLiteRaftPort:    7002,
-			ClusterAPIPort:    9114,
-			ClusterPort:       9116,
-			UnifiedGatewayPort: 6003,
-			RQLiteJoinTarget:  "localhost:7001",
-			ClusterJoinTarget: "localhost:9096",
-		},
-		{
-			Name:              "node-4",
-			ConfigFilename:    "node-4.yaml",
-			DataDir:           "node-4",
-			P2PPort:           4003,
-			IPFSAPIPort:       4503,
-			IPFSSwarmPort:     4103,
-			IPFSGatewayPort:   7503,
-			RQLiteHTTPPort:    5003,
-			RQLiteRaftPort:    7003,
-			ClusterAPIPort:    9124,
-			ClusterPort:       9126,
-			UnifiedGatewayPort: 6004,
-			RQLiteJoinTarget:  "localhost:7001",
-			ClusterJoinTarget: "localhost:9096",
-		},
-		{
-			Name:              "node-5",
-			ConfigFilename:    "node-5.yaml",
-			DataDir:           "node-5",
-			P2PPort:           4004,
-			IPFSAPIPort:       4504,
-			IPFSSwarmPort:     4104,
-			IPFSGatewayPort:   7504,
-			RQLiteHTTPPort:    5004,
-			RQLiteRaftPort:    7004,
-			ClusterAPIPort:    9134,
-			ClusterPort:       9136,
-			UnifiedGatewayPort: 6005,
-			RQLiteJoinTarget:  "localhost:7001",
-			ClusterJoinTarget: "localhost:9096",
-		},
-		},
-		GatewayPort:     6000,  // Main gateway on 6000 (nodes use 6001-6005)
-		OlricHTTPPort:   3320,
-		OlricMemberPort: 3322,
-		AnonSOCKSPort:   9050,
-	}
-}
-
-// AllPorts returns a slice of all ports used in the topology
-func (t *Topology) AllPorts() []int {
-	var ports []int
-
-	// Node-specific ports
-	for _, node := range t.Nodes {
-		ports = append(ports,
-			node.P2PPort,
-			node.IPFSAPIPort,
-			node.IPFSSwarmPort,
-			node.IPFSGatewayPort,
-			node.RQLiteHTTPPort,
-			node.RQLiteRaftPort,
-			node.ClusterAPIPort,
-			node.ClusterPort,
-			node.UnifiedGatewayPort,
-		)
-	}
-
-	// Shared service ports
-	ports = append(ports,
-		t.GatewayPort,
-		t.OlricHTTPPort,
-		t.OlricMemberPort,
-		t.AnonSOCKSPort,
-	)
-
-	return ports
-}
-
-// PortMap returns a human-readable mapping of ports to services
-func (t *Topology) PortMap() map[int]string {
-	portMap := make(map[int]string)
-
-	for _, node := range t.Nodes {
-		portMap[node.P2PPort] = fmt.Sprintf("%s P2P", node.Name)
-		portMap[node.IPFSAPIPort] = fmt.Sprintf("%s IPFS API", node.Name)
-		portMap[node.IPFSSwarmPort] = fmt.Sprintf("%s IPFS Swarm", node.Name)
-		portMap[node.IPFSGatewayPort] = fmt.Sprintf("%s IPFS Gateway", node.Name)
-		portMap[node.RQLiteHTTPPort] = fmt.Sprintf("%s RQLite HTTP", node.Name)
-		portMap[node.RQLiteRaftPort] = fmt.Sprintf("%s RQLite Raft", node.Name)
-		portMap[node.ClusterAPIPort] = fmt.Sprintf("%s IPFS Cluster API", node.Name)
-		portMap[node.ClusterPort] = fmt.Sprintf("%s IPFS Cluster P2P", node.Name)
-		portMap[node.UnifiedGatewayPort] = fmt.Sprintf("%s Unified Gateway", node.Name)
-	}
-
-	portMap[t.GatewayPort] = "Gateway"
-	portMap[t.OlricHTTPPort] = "Olric HTTP API"
-	portMap[t.OlricMemberPort] = "Olric Memberlist"
-	portMap[t.AnonSOCKSPort] = "Anon SOCKS Proxy"
-
-	return portMap
-}
-
-// GetFirstNode returns the first node (the one that creates the cluster)
-func (t *Topology) GetFirstNode() *NodeSpec {
-	if len(t.Nodes) > 0 {
-		return &t.Nodes[0]
-	}
-	return nil
-}
-
-// GetJoiningNodes returns all nodes except the first one (they join the cluster)
-func (t *Topology) GetJoiningNodes() []NodeSpec {
-	if len(t.Nodes) > 1 {
-		return t.Nodes[1:]
-	}
-	return nil
-}
-
-// GetNodeByName returns a node by its name, or nil if not found
-func (t *Topology) GetNodeByName(name string) *NodeSpec {
-	for i, node := range t.Nodes {
-		if node.Name == name {
-			return &t.Nodes[i]
-		}
-	}
-	return nil
-}

pkg/environments/production/checks.go

@@ -1,332 +0,0 @@
-package production
-
-import (
-	"fmt"
-	"net"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"runtime"
-	"strconv"
-	"strings"
-	"syscall"
-)
-
-// OSInfo contains detected operating system information
-type OSInfo struct {
-	ID      string // ubuntu, debian, etc.
-	Version string // 22.04, 24.04, 12, etc.
-	Name    string // Full name: "ubuntu 24.04"
-}
-
-// PrivilegeChecker validates root access and user context
-type PrivilegeChecker struct{}
-
-// CheckRoot verifies the process is running as root
-func (pc *PrivilegeChecker) CheckRoot() error {
-	if os.Geteuid() != 0 {
-		return fmt.Errorf("this command must be run as root (use sudo)")
-	}
-	return nil
-}
-
-// CheckLinuxOS verifies the process is running on Linux
-func (pc *PrivilegeChecker) CheckLinuxOS() error {
-	if runtime.GOOS != "linux" {
-		return fmt.Errorf("production setup is only supported on Linux (detected: %s)", runtime.GOOS)
-	}
-	return nil
-}
-
-// OSDetector detects the Linux distribution
-type OSDetector struct{}
-
-// Detect returns information about the detected OS
-func (od *OSDetector) Detect() (*OSInfo, error) {
-	data, err := os.ReadFile("/etc/os-release")
-	if err != nil {
-		return nil, fmt.Errorf("cannot detect operating system: %w", err)
-	}
-
-	lines := strings.Split(string(data), "\n")
-	var id, version string
-
-	for _, line := range lines {
-		line = strings.TrimSpace(line)
-		if strings.HasPrefix(line, "ID=") {
-			id = strings.Trim(strings.TrimPrefix(line, "ID="), "\"")
-		}
-		if strings.HasPrefix(line, "VERSION_ID=") {
-			version = strings.Trim(strings.TrimPrefix(line, "VERSION_ID="), "\"")
-		}
-	}
-
-	if id == "" {
-		return nil, fmt.Errorf("could not detect OS ID from /etc/os-release")
-	}
-
-	name := id
-	if version != "" {
-		name = fmt.Sprintf("%s %s", id, version)
-	}
-
-	return &OSInfo{
-		ID:      id,
-		Version: version,
-		Name:    name,
-	}, nil
-}
-
-// IsSupportedOS checks if the OS is supported for production deployment
-func (od *OSDetector) IsSupportedOS(info *OSInfo) bool {
-	supported := map[string][]string{
-		"ubuntu": {"22.04", "24.04", "25.04"},
-		"debian": {"12"},
-	}
-
-	versions, ok := supported[info.ID]
-	if !ok {
-		return false
-	}
-
-	for _, v := range versions {
-		if info.Version == v {
-			return true
-		}
-	}
-
-	return false
-}
-
-// ArchitectureDetector detects the system architecture
-type ArchitectureDetector struct{}
-
-// Detect returns the detected architecture as a string usable for downloads
-func (ad *ArchitectureDetector) Detect() (string, error) {
-	arch := runtime.GOARCH
-	switch arch {
-	case "amd64":
-		return "amd64", nil
-	case "arm64":
-		return "arm64", nil
-	case "arm":
-		return "arm", nil
-	default:
-		return "", fmt.Errorf("unsupported architecture: %s", arch)
-	}
-}
-
-// DependencyChecker validates external tool availability
-type DependencyChecker struct {
-	skipOptional bool
-}
-
-// NewDependencyChecker creates a new checker
-func NewDependencyChecker(skipOptional bool) *DependencyChecker {
-	return &DependencyChecker{
-		skipOptional: skipOptional,
-	}
-}
-
-// Dependency represents an external binary dependency
-type Dependency struct {
-	Name        string
-	Command     string
-	Optional    bool
-	InstallHint string
-}
-
-// CheckAll validates all required dependencies
-func (dc *DependencyChecker) CheckAll() ([]Dependency, error) {
-	dependencies := []Dependency{
-		{
-			Name:        "curl",
-			Command:     "curl",
-			Optional:    false,
-			InstallHint: "Usually pre-installed; if missing: apt-get install curl",
-		},
-		{
-			Name:        "git",
-			Command:     "git",
-			Optional:    false,
-			InstallHint: "Install with: apt-get install git",
-		},
-		{
-			Name:        "make",
-			Command:     "make",
-			Optional:    false,
-			InstallHint: "Install with: apt-get install make",
-		},
-	}
-
-	var missing []Dependency
-	for _, dep := range dependencies {
-		if _, err := exec.LookPath(dep.Command); err != nil {
-			if !dep.Optional || !dc.skipOptional {
-				missing = append(missing, dep)
-			}
-		}
-	}
-
-	if len(missing) > 0 {
-		errMsg := "missing required dependencies:\n"
-		for _, dep := range missing {
-			errMsg += fmt.Sprintf("  - %s (%s): %s\n", dep.Name, dep.Command, dep.InstallHint)
-		}
-		return missing, fmt.Errorf("%s", errMsg)
-	}
-
-	return nil, nil
-}
-
-// ExternalToolChecker validates external tool versions and availability
-type ExternalToolChecker struct{}
-
-// CheckIPFSAvailable checks if IPFS is available in PATH
-func (etc *ExternalToolChecker) CheckIPFSAvailable() bool {
-	_, err := exec.LookPath("ipfs")
-	return err == nil
-}
-
-// CheckIPFSClusterAvailable checks if IPFS Cluster Service is available
-func (etc *ExternalToolChecker) CheckIPFSClusterAvailable() bool {
-	_, err := exec.LookPath("ipfs-cluster-service")
-	return err == nil
-}
-
-// CheckRQLiteAvailable checks if RQLite is available
-func (etc *ExternalToolChecker) CheckRQLiteAvailable() bool {
-	_, err := exec.LookPath("rqlited")
-	return err == nil
-}
-
-// CheckOlricAvailable checks if Olric Server is available
-func (etc *ExternalToolChecker) CheckOlricAvailable() bool {
-	_, err := exec.LookPath("olric-server")
-	return err == nil
-}
-
-// CheckAnonAvailable checks if Anon is available (optional)
-func (etc *ExternalToolChecker) CheckAnonAvailable() bool {
-	_, err := exec.LookPath("anon")
-	return err == nil
-}
-
-// CheckGoAvailable checks if Go is installed
-func (etc *ExternalToolChecker) CheckGoAvailable() bool {
-	_, err := exec.LookPath("go")
-	return err == nil
-}
-
-// ResourceChecker validates system resources for production deployment
-type ResourceChecker struct{}
-
-// NewResourceChecker creates a new resource checker
-func NewResourceChecker() *ResourceChecker {
-	return &ResourceChecker{}
-}
-
-// CheckDiskSpace validates sufficient disk space (minimum 10GB free)
-func (rc *ResourceChecker) CheckDiskSpace(path string) error {
-	checkPath := path
-
-	// If the path doesn't exist, check the parent directory instead
-	for checkPath != "/" {
-		if _, err := os.Stat(checkPath); err == nil {
-			break
-		}
-		checkPath = filepath.Dir(checkPath)
-	}
-
-	var stat syscall.Statfs_t
-	if err := syscall.Statfs(checkPath, &stat); err != nil {
-		return fmt.Errorf("failed to check disk space: %w", err)
-	}
-
-	// Available space in bytes
-	availableBytes := stat.Bavail * uint64(stat.Bsize)
-	minRequiredBytes := uint64(10 * 1024 * 1024 * 1024) // 10GB
-
-	if availableBytes < minRequiredBytes {
-		availableGB := float64(availableBytes) / (1024 * 1024 * 1024)
-		return fmt.Errorf("insufficient disk space: %.1fGB available, minimum 10GB required", availableGB)
-	}
-
-	return nil
-}
-
-// CheckRAM validates sufficient RAM (minimum 2GB total)
-func (rc *ResourceChecker) CheckRAM() error {
-	data, err := os.ReadFile("/proc/meminfo")
-	if err != nil {
-		return fmt.Errorf("failed to read memory info: %w", err)
-	}
-
-	lines := strings.Split(string(data), "\n")
-	totalKB := uint64(0)
-
-	for _, line := range lines {
-		if strings.HasPrefix(line, "MemTotal:") {
-			parts := strings.Fields(line)
-			if len(parts) >= 2 {
-				if kb, err := strconv.ParseUint(parts[1], 10, 64); err == nil {
-					totalKB = kb
-					break
-				}
-			}
-		}
-	}
-
-	if totalKB == 0 {
-		return fmt.Errorf("could not determine total RAM")
-	}
-
-	minRequiredKB := uint64(2 * 1024 * 1024) // 2GB in KB
-	if totalKB < minRequiredKB {
-		totalGB := float64(totalKB) / (1024 * 1024)
-		return fmt.Errorf("insufficient RAM: %.1fGB total, minimum 2GB required", totalGB)
-	}
-
-	return nil
-}
-
-// CheckCPU validates sufficient CPU cores (minimum 2 cores)
-func (rc *ResourceChecker) CheckCPU() error {
-	cores := runtime.NumCPU()
-	if cores < 2 {
-		return fmt.Errorf("insufficient CPU cores: %d available, minimum 2 required", cores)
-	}
-	return nil
-}
-
-// PortChecker checks if ports are available or in use
-type PortChecker struct{}
-
-// NewPortChecker creates a new port checker
-func NewPortChecker() *PortChecker {
-	return &PortChecker{}
-}
-
-// IsPortInUse checks if a specific port is already in use
-func (pc *PortChecker) IsPortInUse(port int) bool {
-	addr := fmt.Sprintf("localhost:%d", port)
-	conn, err := net.Dial("tcp", addr)
-	if err != nil {
-		// Port is not in use
-		return false
-	}
-	defer conn.Close()
-	// Port is in use
-	return true
-}
-
-// IsPortInUseOnHost checks if a port is in use on a specific host
-func (pc *PortChecker) IsPortInUseOnHost(host string, port int) bool {
-	addr := net.JoinHostPort(host, fmt.Sprintf("%d", port))
-	conn, err := net.Dial("tcp", addr)
-	if err != nil {
-		return false
-	}
-	defer conn.Close()
-	return true
-}

pkg/environments/production/config.go

@@ -1,433 +0,0 @@
-package production
-
-import (
-	"crypto/rand"
-	"encoding/hex"
-	"fmt"
-	"net"
-	"os"
-	"os/exec"
-	"os/user"
-	"path/filepath"
-	"strconv"
-	"strings"
-
-	"github.com/DeBrosOfficial/network/pkg/environments/templates"
-	"github.com/libp2p/go-libp2p/core/crypto"
-	"github.com/libp2p/go-libp2p/core/peer"
-	"github.com/multiformats/go-multiaddr"
-)
-
-// ConfigGenerator manages generation of node, gateway, and service configs
-type ConfigGenerator struct {
-	oramaDir string
-}
-
-// NewConfigGenerator creates a new config generator
-func NewConfigGenerator(oramaDir string) *ConfigGenerator {
-	return &ConfigGenerator{
-		oramaDir: oramaDir,
-	}
-}
-
-// extractIPFromMultiaddr extracts the IP address from a peer multiaddr
-// Supports IP4, IP6, DNS4, DNS6, and DNSADDR protocols
-// Returns the IP address as a string, or empty string if extraction/resolution fails
-func extractIPFromMultiaddr(multiaddrStr string) string {
-	ma, err := multiaddr.NewMultiaddr(multiaddrStr)
-	if err != nil {
-		return ""
-	}
-
-	// First, try to extract direct IP address
-	var ip net.IP
-	var dnsName string
-	multiaddr.ForEach(ma, func(c multiaddr.Component) bool {
-		switch c.Protocol().Code {
-		case multiaddr.P_IP4, multiaddr.P_IP6:
-			ip = net.ParseIP(c.Value())
-			return false // Stop iteration - found IP
-		case multiaddr.P_DNS4, multiaddr.P_DNS6, multiaddr.P_DNSADDR:
-			dnsName = c.Value()
-			// Continue to check for IP, but remember DNS name as fallback
-		}
-		return true
-	})
-
-	// If we found a direct IP, return it
-	if ip != nil {
-		return ip.String()
-	}
-
-	// If we found a DNS name, try to resolve it
-	if dnsName != "" {
-		if resolvedIPs, err := net.LookupIP(dnsName); err == nil && len(resolvedIPs) > 0 {
-			// Prefer IPv4 addresses, but accept IPv6 if that's all we have
-			for _, resolvedIP := range resolvedIPs {
-				if resolvedIP.To4() != nil {
-					return resolvedIP.String()
-				}
-			}
-			// Return first IPv6 address if no IPv4 found
-			return resolvedIPs[0].String()
-		}
-	}
-
-	return ""
-}
-
-// inferPeerIP extracts the IP address from peer multiaddrs
-// Iterates through all peers to find a valid IP (supports DNS resolution)
-// Falls back to vpsIP if provided, otherwise returns empty string
-func inferPeerIP(peers []string, vpsIP string) string {
-	// Try to extract IP from each peer (in order)
-	for _, peer := range peers {
-		if ip := extractIPFromMultiaddr(peer); ip != "" {
-			return ip
-		}
-	}
-	// Fall back to vpsIP if provided
-	if vpsIP != "" {
-		return vpsIP
-	}
-	return ""
-}
-
-// GenerateNodeConfig generates node.yaml configuration (unified architecture)
-func (cg *ConfigGenerator) GenerateNodeConfig(peerAddresses []string, vpsIP string, joinAddress string, domain string, enableHTTPS bool) (string, error) {
-	// Generate node ID from domain or use default
-	nodeID := "node"
-	if domain != "" {
-		// Extract node identifier from domain (e.g., "node-123" from "node-123.orama.network")
-		parts := strings.Split(domain, ".")
-		if len(parts) > 0 {
-			nodeID = parts[0]
-		}
-	}
-
-	// Determine advertise addresses - use vpsIP if provided
-	// When HTTPS is enabled, RQLite uses native TLS on port 7002 (not SNI gateway)
-	// This avoids conflicts between SNI gateway TLS termination and RQLite's native TLS
-	var httpAdvAddr, raftAdvAddr string
-	if vpsIP != "" {
-		httpAdvAddr = net.JoinHostPort(vpsIP, "5001")
-		if enableHTTPS {
-			// Use direct IP:7002 for Raft - RQLite handles TLS natively via -node-cert
-			// This bypasses the SNI gateway which would cause TLS termination conflicts
-			raftAdvAddr = net.JoinHostPort(vpsIP, "7002")
-		} else {
-			raftAdvAddr = net.JoinHostPort(vpsIP, "7001")
-		}
-	} else {
-		// Fallback to localhost if no vpsIP
-		httpAdvAddr = "localhost:5001"
-		raftAdvAddr = "localhost:7001"
-	}
-
-	// Determine RQLite join address
-	// When HTTPS is enabled, use port 7002 (direct RQLite TLS) instead of 7001 (SNI gateway)
-	joinPort := "7001"
-	if enableHTTPS {
-		joinPort = "7002"
-	}
-
-	var rqliteJoinAddr string
-	if joinAddress != "" {
-		// Use explicitly provided join address
-		// If it contains :7001 and HTTPS is enabled, update to :7002
-		if enableHTTPS && strings.Contains(joinAddress, ":7001") {
-			rqliteJoinAddr = strings.Replace(joinAddress, ":7001", ":7002", 1)
-		} else {
-			rqliteJoinAddr = joinAddress
-		}
-	} else if len(peerAddresses) > 0 {
-		// Infer join address from peers
-		peerIP := inferPeerIP(peerAddresses, "")
-		if peerIP != "" {
-			rqliteJoinAddr = net.JoinHostPort(peerIP, joinPort)
-			// Validate that join address doesn't match this node's own raft address (would cause self-join)
-			if rqliteJoinAddr == raftAdvAddr {
-				rqliteJoinAddr = "" // Clear it - this is the first node
-			}
-		}
-	}
-	// If no join address and no peers, this is the first node - it will create the cluster
-
-	// TLS/ACME configuration
-	tlsCacheDir := ""
-	httpPort := 80
-	httpsPort := 443
-	if enableHTTPS {
-		tlsCacheDir = filepath.Join(cg.oramaDir, "tls-cache")
-	}
-
-	// Unified data directory (all nodes equal)
-	// When HTTPS/SNI is enabled, use internal port 7002 for RQLite Raft (SNI gateway listens on 7001)
-	raftInternalPort := 7001
-	if enableHTTPS {
-		raftInternalPort = 7002 // Internal port when SNI is enabled
-	}
-
-	data := templates.NodeConfigData{
-		NodeID:                 nodeID,
-		P2PPort:                4001,
-		DataDir:                filepath.Join(cg.oramaDir, "data"),
-		RQLiteHTTPPort:         5001,
-		RQLiteRaftPort:         7001,                // External SNI port
-		RQLiteRaftInternalPort: raftInternalPort,    // Internal RQLite binding port
-		RQLiteJoinAddress:      rqliteJoinAddr,
-		BootstrapPeers:         peerAddresses,
-		ClusterAPIPort:         9094,
-		IPFSAPIPort:            4501,
-		HTTPAdvAddress:         httpAdvAddr,
-		RaftAdvAddress:         raftAdvAddr,
-		UnifiedGatewayPort:     6001,
-		Domain:                 domain,
-		EnableHTTPS:            enableHTTPS,
-		TLSCacheDir:            tlsCacheDir,
-		HTTPPort:               httpPort,
-		HTTPSPort:              httpsPort,
-	}
-
-	// When HTTPS is enabled, configure RQLite node-to-node TLS encryption
-	// RQLite handles TLS natively on port 7002, bypassing the SNI gateway
-	// This avoids TLS termination conflicts between SNI gateway and RQLite
-	if enableHTTPS && domain != "" {
-		data.NodeCert = filepath.Join(tlsCacheDir, domain+".crt")
-		data.NodeKey = filepath.Join(tlsCacheDir, domain+".key")
-		// Skip verification since nodes may have different domain certificates
-		data.NodeNoVerify = true
-	}
-
-	return templates.RenderNodeConfig(data)
-}
-
-// GenerateGatewayConfig generates gateway.yaml configuration
-func (cg *ConfigGenerator) GenerateGatewayConfig(peerAddresses []string, enableHTTPS bool, domain string, olricServers []string) (string, error) {
-	tlsCacheDir := ""
-	if enableHTTPS {
-		tlsCacheDir = filepath.Join(cg.oramaDir, "tls-cache")
-	}
-
-	data := templates.GatewayConfigData{
-		ListenPort:     6001,
-		BootstrapPeers: peerAddresses,
-		OlricServers:   olricServers,
-		ClusterAPIPort: 9094,
-		IPFSAPIPort:    4501,
-		EnableHTTPS:    enableHTTPS,
-		DomainName:     domain,
-		TLSCacheDir:    tlsCacheDir,
-		RQLiteDSN:      "", // Empty for now, can be configured later
-	}
-	return templates.RenderGatewayConfig(data)
-}
-
-// GenerateOlricConfig generates Olric configuration
-func (cg *ConfigGenerator) GenerateOlricConfig(serverBindAddr string, httpPort int, memberlistBindAddr string, memberlistPort int, memberlistEnv string) (string, error) {
-	data := templates.OlricConfigData{
-		ServerBindAddr:        serverBindAddr,
-		HTTPPort:              httpPort,
-		MemberlistBindAddr:    memberlistBindAddr,
-		MemberlistPort:        memberlistPort,
-		MemberlistEnvironment: memberlistEnv,
-	}
-	return templates.RenderOlricConfig(data)
-}
-
-// SecretGenerator manages generation of shared secrets and keys
-type SecretGenerator struct {
-	oramaDir string
-}
-
-// NewSecretGenerator creates a new secret generator
-func NewSecretGenerator(oramaDir string) *SecretGenerator {
-	return &SecretGenerator{
-		oramaDir: oramaDir,
-	}
-}
-
-// ValidateClusterSecret ensures a cluster secret is 32 bytes of hex
-func ValidateClusterSecret(secret string) error {
-	secret = strings.TrimSpace(secret)
-	if secret == "" {
-		return fmt.Errorf("cluster secret cannot be empty")
-	}
-	if len(secret) != 64 {
-		return fmt.Errorf("cluster secret must be 64 hex characters (32 bytes)")
-	}
-	if _, err := hex.DecodeString(secret); err != nil {
-		return fmt.Errorf("cluster secret must be valid hex: %w", err)
-	}
-	return nil
-}
-
-// EnsureClusterSecret gets or generates the IPFS Cluster secret
-func (sg *SecretGenerator) EnsureClusterSecret() (string, error) {
-	secretPath := filepath.Join(sg.oramaDir, "secrets", "cluster-secret")
-	secretDir := filepath.Dir(secretPath)
-
-	// Ensure secrets directory exists with restricted permissions (0700)
-	if err := os.MkdirAll(secretDir, 0700); err != nil {
-		return "", fmt.Errorf("failed to create secrets directory: %w", err)
-	}
-	// Ensure directory permissions are correct even if it already existed
-	if err := os.Chmod(secretDir, 0700); err != nil {
-		return "", fmt.Errorf("failed to set secrets directory permissions: %w", err)
-	}
-
-	// Try to read existing secret
-	if data, err := os.ReadFile(secretPath); err == nil {
-		secret := strings.TrimSpace(string(data))
-		if len(secret) == 64 {
-			if err := ensureSecretFilePermissions(secretPath); err != nil {
-				return "", err
-			}
-			return secret, nil
-		}
-	}
-
-	// Generate new secret (32 bytes = 64 hex chars)
-	bytes := make([]byte, 32)
-	if _, err := rand.Read(bytes); err != nil {
-		return "", fmt.Errorf("failed to generate cluster secret: %w", err)
-	}
-	secret := hex.EncodeToString(bytes)
-
-	// Write and protect
-	if err := os.WriteFile(secretPath, []byte(secret), 0600); err != nil {
-		return "", fmt.Errorf("failed to save cluster secret: %w", err)
-	}
-	if err := ensureSecretFilePermissions(secretPath); err != nil {
-		return "", err
-	}
-
-	return secret, nil
-}
-
-func ensureSecretFilePermissions(secretPath string) error {
-	if err := os.Chmod(secretPath, 0600); err != nil {
-		return fmt.Errorf("failed to set permissions on %s: %w", secretPath, err)
-	}
-
-	if usr, err := user.Lookup("debros"); err == nil {
-		uid, err := strconv.Atoi(usr.Uid)
-		if err != nil {
-			return fmt.Errorf("failed to parse debros UID: %w", err)
-		}
-		gid, err := strconv.Atoi(usr.Gid)
-		if err != nil {
-			return fmt.Errorf("failed to parse debros GID: %w", err)
-		}
-		if err := os.Chown(secretPath, uid, gid); err != nil {
-			return fmt.Errorf("failed to change ownership of %s: %w", secretPath, err)
-		}
-	}
-
-	return nil
-}
-
-// EnsureSwarmKey gets or generates the IPFS private swarm key
-func (sg *SecretGenerator) EnsureSwarmKey() ([]byte, error) {
-	swarmKeyPath := filepath.Join(sg.oramaDir, "secrets", "swarm.key")
-	secretDir := filepath.Dir(swarmKeyPath)
-
-	// Ensure secrets directory exists with restricted permissions (0700)
-	if err := os.MkdirAll(secretDir, 0700); err != nil {
-		return nil, fmt.Errorf("failed to create secrets directory: %w", err)
-	}
-	// Ensure directory permissions are correct even if it already existed
-	if err := os.Chmod(secretDir, 0700); err != nil {
-		return nil, fmt.Errorf("failed to set secrets directory permissions: %w", err)
-	}
-
-	// Try to read existing key
-	if data, err := os.ReadFile(swarmKeyPath); err == nil {
-		if strings.Contains(string(data), "/key/swarm/psk/1.0.0/") {
-			return data, nil
-		}
-	}
-
-	// Generate new key (32 bytes)
-	keyBytes := make([]byte, 32)
-	if _, err := rand.Read(keyBytes); err != nil {
-		return nil, fmt.Errorf("failed to generate swarm key: %w", err)
-	}
-
-	keyHex := strings.ToUpper(hex.EncodeToString(keyBytes))
-	content := fmt.Sprintf("/key/swarm/psk/1.0.0/\n/base16/\n%s\n", keyHex)
-
-	// Write and protect
-	if err := os.WriteFile(swarmKeyPath, []byte(content), 0600); err != nil {
-		return nil, fmt.Errorf("failed to save swarm key: %w", err)
-	}
-
-	return []byte(content), nil
-}
-
-// EnsureNodeIdentity gets or generates the node's LibP2P identity (unified - no bootstrap/node distinction)
-func (sg *SecretGenerator) EnsureNodeIdentity() (peer.ID, error) {
-	// Unified data directory (no bootstrap/node distinction)
-	keyDir := filepath.Join(sg.oramaDir, "data")
-	keyPath := filepath.Join(keyDir, "identity.key")
-
-	// Ensure data directory exists
-	if err := os.MkdirAll(keyDir, 0755); err != nil {
-		return "", fmt.Errorf("failed to create data directory: %w", err)
-	}
-
-	// Try to read existing key
-	if data, err := os.ReadFile(keyPath); err == nil {
-		priv, err := crypto.UnmarshalPrivateKey(data)
-		if err == nil {
-			pub := priv.GetPublic()
-			peerID, _ := peer.IDFromPublicKey(pub)
-			return peerID, nil
-		}
-	}
-
-	// Generate new identity
-	priv, pub, err := crypto.GenerateKeyPair(crypto.Ed25519, 2048)
-	if err != nil {
-		return "", fmt.Errorf("failed to generate identity: %w", err)
-	}
-
-	peerID, _ := peer.IDFromPublicKey(pub)
-
-	// Marshal and save private key
-	keyData, err := crypto.MarshalPrivateKey(priv)
-	if err != nil {
-		return "", fmt.Errorf("failed to marshal private key: %w", err)
-	}
-
-	if err := os.WriteFile(keyPath, keyData, 0600); err != nil {
-		return "", fmt.Errorf("failed to save identity key: %w", err)
-	}
-
-	return peerID, nil
-}
-
-// SaveConfig writes a configuration file to disk
-func (sg *SecretGenerator) SaveConfig(filename string, content string) error {
-	var configDir string
-	// gateway.yaml goes to data/ directory, other configs go to configs/
-	if filename == "gateway.yaml" {
-		configDir = filepath.Join(sg.oramaDir, "data")
-	} else {
-		configDir = filepath.Join(sg.oramaDir, "configs")
-	}
-
-	if err := os.MkdirAll(configDir, 0755); err != nil {
-		return fmt.Errorf("failed to create config directory: %w", err)
-	}
-
-	configPath := filepath.Join(configDir, filename)
-	if err := os.WriteFile(configPath, []byte(content), 0644); err != nil {
-		return fmt.Errorf("failed to write config %s: %w", filename, err)
-	}
-
-	// Fix ownership
-	exec.Command("chown", "debros:debros", configPath).Run()
-
-	return nil
-}

pkg/environments/production/installers.go

@@ -1,941 +0,0 @@
-package production
-
-import (
-	"encoding/json"
-	"fmt"
-	"io"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"strings"
-)
-
-// BinaryInstaller handles downloading and installing external binaries
-type BinaryInstaller struct {
-	arch      string
-	logWriter io.Writer
-}
-
-// NewBinaryInstaller creates a new binary installer
-func NewBinaryInstaller(arch string, logWriter io.Writer) *BinaryInstaller {
-	return &BinaryInstaller{
-		arch:      arch,
-		logWriter: logWriter,
-	}
-}
-
-// InstallRQLite downloads and installs RQLite
-func (bi *BinaryInstaller) InstallRQLite() error {
-	if _, err := exec.LookPath("rqlited"); err == nil {
-		fmt.Fprintf(bi.logWriter, "  ✓ RQLite already installed\n")
-		return nil
-	}
-
-	fmt.Fprintf(bi.logWriter, "  Installing RQLite...\n")
-
-	version := "8.43.0"
-	tarball := fmt.Sprintf("rqlite-v%s-linux-%s.tar.gz", version, bi.arch)
-	url := fmt.Sprintf("https://github.com/rqlite/rqlite/releases/download/v%s/%s", version, tarball)
-
-	// Download
-	cmd := exec.Command("wget", "-q", url, "-O", "/tmp/"+tarball)
-	if err := cmd.Run(); err != nil {
-		return fmt.Errorf("failed to download RQLite: %w", err)
-	}
-
-	// Extract
-	cmd = exec.Command("tar", "-C", "/tmp", "-xzf", "/tmp/"+tarball)
-	if err := cmd.Run(); err != nil {
-		return fmt.Errorf("failed to extract RQLite: %w", err)
-	}
-
-	// Copy binaries
-	dir := fmt.Sprintf("/tmp/rqlite-v%s-linux-%s", version, bi.arch)
-	if err := exec.Command("cp", dir+"/rqlited", "/usr/local/bin/").Run(); err != nil {
-		return fmt.Errorf("failed to copy rqlited binary: %w", err)
-	}
-	if err := exec.Command("chmod", "+x", "/usr/local/bin/rqlited").Run(); err != nil {
-		fmt.Fprintf(bi.logWriter, "    ⚠️  Warning: failed to chmod rqlited: %v\n", err)
-	}
-
-	// Ensure PATH includes /usr/local/bin
-	os.Setenv("PATH", os.Getenv("PATH")+":/usr/local/bin")
-
-	fmt.Fprintf(bi.logWriter, "  ✓ RQLite installed\n")
-	return nil
-}
-
-// InstallIPFS downloads and installs IPFS (Kubo)
-// Follows official steps from https://docs.ipfs.tech/install/command-line/
-func (bi *BinaryInstaller) InstallIPFS() error {
-	if _, err := exec.LookPath("ipfs"); err == nil {
-		fmt.Fprintf(bi.logWriter, "  ✓ IPFS already installed\n")
-		return nil
-	}
-
-	fmt.Fprintf(bi.logWriter, "  Installing IPFS (Kubo)...\n")
-
-	// Follow official installation steps in order
-	kuboVersion := "v0.38.2"
-	tarball := fmt.Sprintf("kubo_%s_linux-%s.tar.gz", kuboVersion, bi.arch)
-	url := fmt.Sprintf("https://dist.ipfs.tech/kubo/%s/%s", kuboVersion, tarball)
-	tmpDir := "/tmp"
-	tarPath := filepath.Join(tmpDir, tarball)
-	kuboDir := filepath.Join(tmpDir, "kubo")
-
-	// Step 1: Download the Linux binary from dist.ipfs.tech
-	fmt.Fprintf(bi.logWriter, "    Step 1: Downloading Kubo v%s...\n", kuboVersion)
-	cmd := exec.Command("wget", "-q", url, "-O", tarPath)
-	if err := cmd.Run(); err != nil {
-		return fmt.Errorf("failed to download kubo from %s: %w", url, err)
-	}
-
-	// Verify tarball exists
-	if _, err := os.Stat(tarPath); err != nil {
-		return fmt.Errorf("kubo tarball not found after download at %s: %w", tarPath, err)
-	}
-
-	// Step 2: Unzip the file
-	fmt.Fprintf(bi.logWriter, "    Step 2: Extracting Kubo archive...\n")
-	cmd = exec.Command("tar", "-xzf", tarPath, "-C", tmpDir)
-	if err := cmd.Run(); err != nil {
-		return fmt.Errorf("failed to extract kubo tarball: %w", err)
-	}
-
-	// Verify extraction
-	if _, err := os.Stat(kuboDir); err != nil {
-		return fmt.Errorf("kubo directory not found after extraction at %s: %w", kuboDir, err)
-	}
-
-	// Step 3: Move into the kubo folder (cd kubo)
-	fmt.Fprintf(bi.logWriter, "    Step 3: Running installation script...\n")
-
-	// Step 4: Run the installation script (sudo bash install.sh)
-	installScript := filepath.Join(kuboDir, "install.sh")
-	if _, err := os.Stat(installScript); err != nil {
-		return fmt.Errorf("install.sh not found in extracted kubo directory at %s: %w", installScript, err)
-	}
-
-	cmd = exec.Command("bash", installScript)
-	cmd.Dir = kuboDir
-	if output, err := cmd.CombinedOutput(); err != nil {
-		return fmt.Errorf("failed to run install.sh: %v\n%s", err, string(output))
-	}
-
-	// Step 5: Test that Kubo has installed correctly
-	fmt.Fprintf(bi.logWriter, "    Step 5: Verifying installation...\n")
-	cmd = exec.Command("ipfs", "--version")
-	output, err := cmd.CombinedOutput()
-	if err != nil {
-		// ipfs might not be in PATH yet in this process, check file directly
-		ipfsLocations := []string{"/usr/local/bin/ipfs", "/usr/bin/ipfs"}
-		found := false
-		for _, loc := range ipfsLocations {
-			if info, err := os.Stat(loc); err == nil && !info.IsDir() {
-				found = true
-				// Ensure it's executable
-				if info.Mode()&0111 == 0 {
-					os.Chmod(loc, 0755)
-				}
-				break
-			}
-		}
-		if !found {
-			return fmt.Errorf("ipfs binary not found after installation in %v", ipfsLocations)
-		}
-	} else {
-		fmt.Fprintf(bi.logWriter, "      %s", string(output))
-	}
-
-	// Ensure PATH is updated for current process
-	os.Setenv("PATH", os.Getenv("PATH")+":/usr/local/bin")
-
-	fmt.Fprintf(bi.logWriter, "  ✓ IPFS installed successfully\n")
-	return nil
-}
-
-// InstallIPFSCluster downloads and installs IPFS Cluster Service
-func (bi *BinaryInstaller) InstallIPFSCluster() error {
-	if _, err := exec.LookPath("ipfs-cluster-service"); err == nil {
-		fmt.Fprintf(bi.logWriter, "  ✓ IPFS Cluster already installed\n")
-		return nil
-	}
-
-	fmt.Fprintf(bi.logWriter, "  Installing IPFS Cluster Service...\n")
-
-	// Check if Go is available
-	if _, err := exec.LookPath("go"); err != nil {
-		return fmt.Errorf("go not found - required to install IPFS Cluster. Please install Go first")
-	}
-
-	cmd := exec.Command("go", "install", "github.com/ipfs-cluster/ipfs-cluster/cmd/ipfs-cluster-service@latest")
-	cmd.Env = append(os.Environ(), "GOBIN=/usr/local/bin")
-	if err := cmd.Run(); err != nil {
-		return fmt.Errorf("failed to install IPFS Cluster: %w", err)
-	}
-
-	fmt.Fprintf(bi.logWriter, "  ✓ IPFS Cluster installed\n")
-	return nil
-}
-
-// InstallOlric downloads and installs Olric server
-func (bi *BinaryInstaller) InstallOlric() error {
-	if _, err := exec.LookPath("olric-server"); err == nil {
-		fmt.Fprintf(bi.logWriter, "  ✓ Olric already installed\n")
-		return nil
-	}
-
-	fmt.Fprintf(bi.logWriter, "  Installing Olric...\n")
-
-	// Check if Go is available
-	if _, err := exec.LookPath("go"); err != nil {
-		return fmt.Errorf("go not found - required to install Olric. Please install Go first")
-	}
-
-	cmd := exec.Command("go", "install", "github.com/olric-data/olric/cmd/olric-server@v0.7.0")
-	cmd.Env = append(os.Environ(), "GOBIN=/usr/local/bin")
-	if err := cmd.Run(); err != nil {
-		return fmt.Errorf("failed to install Olric: %w", err)
-	}
-
-	fmt.Fprintf(bi.logWriter, "  ✓ Olric installed\n")
-	return nil
-}
-
-// InstallGo downloads and installs Go toolchain
-func (bi *BinaryInstaller) InstallGo() error {
-	if _, err := exec.LookPath("go"); err == nil {
-		fmt.Fprintf(bi.logWriter, "  ✓ Go already installed\n")
-		return nil
-	}
-
-	fmt.Fprintf(bi.logWriter, "  Installing Go...\n")
-
-	goTarball := fmt.Sprintf("go1.22.5.linux-%s.tar.gz", bi.arch)
-	goURL := fmt.Sprintf("https://go.dev/dl/%s", goTarball)
-
-	// Download
-	cmd := exec.Command("wget", "-q", goURL, "-O", "/tmp/"+goTarball)
-	if err := cmd.Run(); err != nil {
-		return fmt.Errorf("failed to download Go: %w", err)
-	}
-
-	// Extract
-	cmd = exec.Command("tar", "-C", "/usr/local", "-xzf", "/tmp/"+goTarball)
-	if err := cmd.Run(); err != nil {
-		return fmt.Errorf("failed to extract Go: %w", err)
-	}
-
-	// Add to PATH
-	newPath := os.Getenv("PATH") + ":/usr/local/go/bin"
-	os.Setenv("PATH", newPath)
-
-	// Verify installation
-	if _, err := exec.LookPath("go"); err != nil {
-		return fmt.Errorf("go installed but not found in PATH after installation")
-	}
-
-	fmt.Fprintf(bi.logWriter, "  ✓ Go installed\n")
-	return nil
-}
-
-// ResolveBinaryPath finds the fully-qualified path to a required executable
-func (bi *BinaryInstaller) ResolveBinaryPath(binary string, extraPaths ...string) (string, error) {
-	// First try to find in PATH
-	if path, err := exec.LookPath(binary); err == nil {
-		if abs, err := filepath.Abs(path); err == nil {
-			return abs, nil
-		}
-		return path, nil
-	}
-
-	// Then try extra candidate paths
-	for _, candidate := range extraPaths {
-		if candidate == "" {
-			continue
-		}
-		if info, err := os.Stat(candidate); err == nil && !info.IsDir() && info.Mode()&0111 != 0 {
-			if abs, err := filepath.Abs(candidate); err == nil {
-				return abs, nil
-			}
-			return candidate, nil
-		}
-	}
-
-	// Not found - generate error message
-	checked := make([]string, 0, len(extraPaths))
-	for _, candidate := range extraPaths {
-		if candidate != "" {
-			checked = append(checked, candidate)
-		}
-	}
-
-	if len(checked) == 0 {
-		return "", fmt.Errorf("required binary %q not found in path", binary)
-	}
-
-	return "", fmt.Errorf("required binary %q not found in path (also checked %s)", binary, strings.Join(checked, ", "))
-}
-
-// InstallDeBrosBinaries clones and builds DeBros binaries
-func (bi *BinaryInstaller) InstallDeBrosBinaries(branch string, oramaHome string, skipRepoUpdate bool) error {
-	fmt.Fprintf(bi.logWriter, "  Building DeBros binaries...\n")
-
-	srcDir := filepath.Join(oramaHome, "src")
-	binDir := filepath.Join(oramaHome, "bin")
-
-	// Ensure directories exist
-	if err := os.MkdirAll(srcDir, 0755); err != nil {
-		return fmt.Errorf("failed to create source directory %s: %w", srcDir, err)
-	}
-	if err := os.MkdirAll(binDir, 0755); err != nil {
-		return fmt.Errorf("failed to create bin directory %s: %w", binDir, err)
-	}
-
-	// Check if source directory has content (either git repo or pre-existing source)
-	hasSourceContent := false
-	if entries, err := os.ReadDir(srcDir); err == nil && len(entries) > 0 {
-		hasSourceContent = true
-	}
-
-	// Check if git repository is already initialized
-	isGitRepo := false
-	if _, err := os.Stat(filepath.Join(srcDir, ".git")); err == nil {
-		isGitRepo = true
-	}
-
-	// Handle repository update/clone based on skipRepoUpdate flag
-	if skipRepoUpdate {
-		fmt.Fprintf(bi.logWriter, "    Skipping repo clone/pull (--no-pull flag)\n")
-		if !hasSourceContent {
-			return fmt.Errorf("cannot skip pull: source directory is empty at %s (need to populate it first)", srcDir)
-		}
-		fmt.Fprintf(bi.logWriter, "    Using existing source at %s (skipping git operations)\n", srcDir)
-		// Skip to build step - don't execute any git commands
-	} else {
-		// Clone repository if not present, otherwise update it
-		if !isGitRepo {
-			fmt.Fprintf(bi.logWriter, "    Cloning repository...\n")
-			cmd := exec.Command("git", "clone", "--branch", branch, "--depth", "1", "https://github.com/DeBrosOfficial/network.git", srcDir)
-			if err := cmd.Run(); err != nil {
-				return fmt.Errorf("failed to clone repository: %w", err)
-			}
-		} else {
-			fmt.Fprintf(bi.logWriter, "    Updating repository to latest changes...\n")
-			if output, err := exec.Command("git", "-C", srcDir, "fetch", "origin", branch).CombinedOutput(); err != nil {
-				return fmt.Errorf("failed to fetch repository updates: %v\n%s", err, string(output))
-			}
-			if output, err := exec.Command("git", "-C", srcDir, "reset", "--hard", "origin/"+branch).CombinedOutput(); err != nil {
-				return fmt.Errorf("failed to reset repository: %v\n%s", err, string(output))
-			}
-			if output, err := exec.Command("git", "-C", srcDir, "clean", "-fd").CombinedOutput(); err != nil {
-				return fmt.Errorf("failed to clean repository: %v\n%s", err, string(output))
-			}
-		}
-	}
-
-	// Build binaries
-	fmt.Fprintf(bi.logWriter, "    Building binaries...\n")
-	cmd := exec.Command("make", "build")
-	cmd.Dir = srcDir
-	cmd.Env = append(os.Environ(), "HOME="+oramaHome, "PATH="+os.Getenv("PATH")+":/usr/local/go/bin")
-	if output, err := cmd.CombinedOutput(); err != nil {
-		return fmt.Errorf("failed to build: %v\n%s", err, string(output))
-	}
-
-	// Copy binaries
-	fmt.Fprintf(bi.logWriter, "    Copying binaries...\n")
-	srcBinDir := filepath.Join(srcDir, "bin")
-
-	// Check if source bin directory exists
-	if _, err := os.Stat(srcBinDir); os.IsNotExist(err) {
-		return fmt.Errorf("source bin directory does not exist at %s - build may have failed", srcBinDir)
-	}
-
-	// Check if there are any files to copy
-	entries, err := os.ReadDir(srcBinDir)
-	if err != nil {
-		return fmt.Errorf("failed to read source bin directory: %w", err)
-	}
-	if len(entries) == 0 {
-		return fmt.Errorf("source bin directory is empty - build may have failed")
-	}
-
-	// Copy each binary individually to avoid wildcard expansion issues
-	for _, entry := range entries {
-		if entry.IsDir() {
-			continue
-		}
-		srcPath := filepath.Join(srcBinDir, entry.Name())
-		dstPath := filepath.Join(binDir, entry.Name())
-
-		// Read source file
-		data, err := os.ReadFile(srcPath)
-		if err != nil {
-			return fmt.Errorf("failed to read binary %s: %w", entry.Name(), err)
-		}
-
-		// Write destination file
-		if err := os.WriteFile(dstPath, data, 0755); err != nil {
-			return fmt.Errorf("failed to write binary %s: %w", entry.Name(), err)
-		}
-	}
-
-	if err := exec.Command("chmod", "-R", "755", binDir).Run(); err != nil {
-		fmt.Fprintf(bi.logWriter, "    ⚠️  Warning: failed to chmod bin directory: %v\n", err)
-	}
-	if err := exec.Command("chown", "-R", "debros:debros", binDir).Run(); err != nil {
-		fmt.Fprintf(bi.logWriter, "    ⚠️  Warning: failed to chown bin directory: %v\n", err)
-	}
-
-	// Grant CAP_NET_BIND_SERVICE to orama-node to allow binding to ports 80/443 without root
-	nodeBinary := filepath.Join(binDir, "orama-node")
-	if _, err := os.Stat(nodeBinary); err == nil {
-		if err := exec.Command("setcap", "cap_net_bind_service=+ep", nodeBinary).Run(); err != nil {
-			fmt.Fprintf(bi.logWriter, "    ⚠️  Warning: failed to setcap on orama-node: %v\n", err)
-			fmt.Fprintf(bi.logWriter, "    ⚠️  Gateway may not be able to bind to port 80/443\n")
-		} else {
-			fmt.Fprintf(bi.logWriter, "    ✓ Set CAP_NET_BIND_SERVICE on orama-node\n")
-		}
-	}
-
-	fmt.Fprintf(bi.logWriter, "  ✓ DeBros binaries installed\n")
-	return nil
-}
-
-// InstallSystemDependencies installs system-level dependencies via apt
-func (bi *BinaryInstaller) InstallSystemDependencies() error {
-	fmt.Fprintf(bi.logWriter, "  Installing system dependencies...\n")
-
-	// Update package list
-	cmd := exec.Command("apt-get", "update")
-	if err := cmd.Run(); err != nil {
-		fmt.Fprintf(bi.logWriter, "    Warning: apt update failed\n")
-	}
-
-	// Install dependencies including Node.js for anyone-client
-	cmd = exec.Command("apt-get", "install", "-y", "curl", "git", "make", "build-essential", "wget", "nodejs", "npm")
-	if err := cmd.Run(); err != nil {
-		return fmt.Errorf("failed to install dependencies: %w", err)
-	}
-
-	fmt.Fprintf(bi.logWriter, "  ✓ System dependencies installed\n")
-	return nil
-}
-
-// IPFSPeerInfo holds IPFS peer information for configuring Peering.Peers
-type IPFSPeerInfo struct {
-	PeerID string
-	Addrs  []string
-}
-
-// IPFSClusterPeerInfo contains IPFS Cluster peer information for cluster peer discovery
-type IPFSClusterPeerInfo struct {
-	PeerID string   // Cluster peer ID (different from IPFS peer ID)
-	Addrs  []string // Cluster multiaddresses (e.g., /ip4/x.x.x.x/tcp/9098)
-}
-
-// InitializeIPFSRepo initializes an IPFS repository for a node (unified - no bootstrap/node distinction)
-// If ipfsPeer is provided, configures Peering.Peers for peer discovery in private networks
-func (bi *BinaryInstaller) InitializeIPFSRepo(ipfsRepoPath string, swarmKeyPath string, apiPort, gatewayPort, swarmPort int, ipfsPeer *IPFSPeerInfo) error {
-	configPath := filepath.Join(ipfsRepoPath, "config")
-	repoExists := false
-	if _, err := os.Stat(configPath); err == nil {
-		repoExists = true
-		fmt.Fprintf(bi.logWriter, "    IPFS repo already exists, ensuring configuration...\n")
-	} else {
-		fmt.Fprintf(bi.logWriter, "    Initializing IPFS repo...\n")
-	}
-
-	if err := os.MkdirAll(ipfsRepoPath, 0755); err != nil {
-		return fmt.Errorf("failed to create IPFS repo directory: %w", err)
-	}
-
-	// Resolve IPFS binary path
-	ipfsBinary, err := bi.ResolveBinaryPath("ipfs", "/usr/local/bin/ipfs", "/usr/bin/ipfs")
-	if err != nil {
-		return err
-	}
-
-	// Initialize IPFS if repo doesn't exist
-	if !repoExists {
-		cmd := exec.Command(ipfsBinary, "init", "--profile=server", "--repo-dir="+ipfsRepoPath)
-		if output, err := cmd.CombinedOutput(); err != nil {
-			return fmt.Errorf("failed to initialize IPFS: %v\n%s", err, string(output))
-		}
-	}
-
-	// Copy swarm key if present
-	swarmKeyExists := false
-	if data, err := os.ReadFile(swarmKeyPath); err == nil {
-		swarmKeyDest := filepath.Join(ipfsRepoPath, "swarm.key")
-		if err := os.WriteFile(swarmKeyDest, data, 0600); err != nil {
-			return fmt.Errorf("failed to copy swarm key: %w", err)
-		}
-		swarmKeyExists = true
-	}
-
-	// Configure IPFS addresses (API, Gateway, Swarm) by modifying the config file directly
-	// This ensures the ports are set correctly and avoids conflicts with RQLite on port 5001
-	fmt.Fprintf(bi.logWriter, "    Configuring IPFS addresses (API: %d, Gateway: %d, Swarm: %d)...\n", apiPort, gatewayPort, swarmPort)
-	if err := bi.configureIPFSAddresses(ipfsRepoPath, apiPort, gatewayPort, swarmPort); err != nil {
-		return fmt.Errorf("failed to configure IPFS addresses: %w", err)
-	}
-
-	// Always disable AutoConf for private swarm when swarm.key is present
-	// This is critical - IPFS will fail to start if AutoConf is enabled on a private network
-	// We do this even for existing repos to fix repos initialized before this fix was applied
-	if swarmKeyExists {
-		fmt.Fprintf(bi.logWriter, "    Disabling AutoConf for private swarm...\n")
-		cmd := exec.Command(ipfsBinary, "config", "--json", "AutoConf.Enabled", "false")
-		cmd.Env = append(os.Environ(), "IPFS_PATH="+ipfsRepoPath)
-		if output, err := cmd.CombinedOutput(); err != nil {
-			return fmt.Errorf("failed to disable AutoConf: %v\n%s", err, string(output))
-		}
-
-		// Clear AutoConf placeholders from config to prevent Kubo startup errors
-		// When AutoConf is disabled, 'auto' placeholders must be replaced with explicit values or empty
-		fmt.Fprintf(bi.logWriter, "    Clearing AutoConf placeholders from IPFS config...\n")
-
-		type configCommand struct {
-			desc string
-			args []string
-		}
-
-		// List of config replacements to clear 'auto' placeholders
-		cleanup := []configCommand{
-			{"clearing Bootstrap peers", []string{"config", "Bootstrap", "--json", "[]"}},
-			{"clearing Routing.DelegatedRouters", []string{"config", "Routing.DelegatedRouters", "--json", "[]"}},
-			{"clearing Ipns.DelegatedPublishers", []string{"config", "Ipns.DelegatedPublishers", "--json", "[]"}},
-			{"clearing DNS.Resolvers", []string{"config", "DNS.Resolvers", "--json", "{}"}},
-		}
-
-		for _, step := range cleanup {
-			fmt.Fprintf(bi.logWriter, "      %s...\n", step.desc)
-			cmd := exec.Command(ipfsBinary, step.args...)
-			cmd.Env = append(os.Environ(), "IPFS_PATH="+ipfsRepoPath)
-			if output, err := cmd.CombinedOutput(); err != nil {
-				return fmt.Errorf("failed while %s: %v\n%s", step.desc, err, string(output))
-			}
-		}
-
-		// Configure Peering.Peers if we have peer info (for private network discovery)
-		if ipfsPeer != nil && ipfsPeer.PeerID != "" && len(ipfsPeer.Addrs) > 0 {
-			fmt.Fprintf(bi.logWriter, "    Configuring Peering.Peers for private network discovery...\n")
-			if err := bi.configureIPFSPeering(ipfsRepoPath, ipfsPeer); err != nil {
-				return fmt.Errorf("failed to configure IPFS peering: %w", err)
-			}
-		}
-	}
-
-	// Fix ownership (best-effort, don't fail if it doesn't work)
-	if err := exec.Command("chown", "-R", "debros:debros", ipfsRepoPath).Run(); err != nil {
-		fmt.Fprintf(bi.logWriter, "    ⚠️  Warning: failed to chown IPFS repo: %v\n", err)
-	}
-
-	return nil
-}
-
-// configureIPFSAddresses configures the IPFS API, Gateway, and Swarm addresses in the config file
-func (bi *BinaryInstaller) configureIPFSAddresses(ipfsRepoPath string, apiPort, gatewayPort, swarmPort int) error {
-	configPath := filepath.Join(ipfsRepoPath, "config")
-
-	// Read existing config
-	data, err := os.ReadFile(configPath)
-	if err != nil {
-		return fmt.Errorf("failed to read IPFS config: %w", err)
-	}
-
-	var config map[string]interface{}
-	if err := json.Unmarshal(data, &config); err != nil {
-		return fmt.Errorf("failed to parse IPFS config: %w", err)
-	}
-
-	// Get existing Addresses section or create new one
-	// This preserves any existing settings like Announce, AppendAnnounce, NoAnnounce
-	addresses, ok := config["Addresses"].(map[string]interface{})
-	if !ok {
-		addresses = make(map[string]interface{})
-	}
-
-	// Update specific address fields while preserving others
-	// Bind API and Gateway to localhost only for security
-	// Swarm binds to all interfaces for peer connections
-	addresses["API"] = []string{
-			fmt.Sprintf("/ip4/127.0.0.1/tcp/%d", apiPort),
-	}
-	addresses["Gateway"] = []string{
-			fmt.Sprintf("/ip4/127.0.0.1/tcp/%d", gatewayPort),
-	}
-	addresses["Swarm"] = []string{
-			fmt.Sprintf("/ip4/0.0.0.0/tcp/%d", swarmPort),
-			fmt.Sprintf("/ip6/::/tcp/%d", swarmPort),
-	}
-
-	config["Addresses"] = addresses
-
-	// Write config back
-	updatedData, err := json.MarshalIndent(config, "", "  ")
-	if err != nil {
-		return fmt.Errorf("failed to marshal IPFS config: %w", err)
-	}
-
-	if err := os.WriteFile(configPath, updatedData, 0600); err != nil {
-		return fmt.Errorf("failed to write IPFS config: %w", err)
-	}
-
-	return nil
-}
-
-// configureIPFSPeering configures Peering.Peers in the IPFS config for private network discovery
-// This allows nodes in a private swarm to find each other even without bootstrap peers
-func (bi *BinaryInstaller) configureIPFSPeering(ipfsRepoPath string, peer *IPFSPeerInfo) error {
-	configPath := filepath.Join(ipfsRepoPath, "config")
-
-	// Read existing config
-	data, err := os.ReadFile(configPath)
-	if err != nil {
-		return fmt.Errorf("failed to read IPFS config: %w", err)
-	}
-
-	var config map[string]interface{}
-	if err := json.Unmarshal(data, &config); err != nil {
-		return fmt.Errorf("failed to parse IPFS config: %w", err)
-	}
-
-	// Get existing Peering section or create new one
-	peering, ok := config["Peering"].(map[string]interface{})
-	if !ok {
-		peering = make(map[string]interface{})
-	}
-
-	// Create peer entry
-	peerEntry := map[string]interface{}{
-		"ID":    peer.PeerID,
-		"Addrs": peer.Addrs,
-	}
-
-	// Set Peering.Peers
-	peering["Peers"] = []interface{}{peerEntry}
-	config["Peering"] = peering
-
-	fmt.Fprintf(bi.logWriter, "      Adding peer: %s (%d addresses)\n", peer.PeerID, len(peer.Addrs))
-
-	// Write config back
-	updatedData, err := json.MarshalIndent(config, "", "  ")
-	if err != nil {
-		return fmt.Errorf("failed to marshal IPFS config: %w", err)
-	}
-
-	if err := os.WriteFile(configPath, updatedData, 0600); err != nil {
-		return fmt.Errorf("failed to write IPFS config: %w", err)
-	}
-
-	return nil
-}
-
-// InitializeIPFSClusterConfig initializes IPFS Cluster configuration (unified - no bootstrap/node distinction)
-// This runs `ipfs-cluster-service init` to create the service.json configuration file.
-// For existing installations, it ensures the cluster secret is up to date.
-// clusterPeers should be in format: ["/ip4/<ip>/tcp/9098/p2p/<cluster-peer-id>"]
-func (bi *BinaryInstaller) InitializeIPFSClusterConfig(clusterPath, clusterSecret string, ipfsAPIPort int, clusterPeers []string) error {
-	serviceJSONPath := filepath.Join(clusterPath, "service.json")
-	configExists := false
-	if _, err := os.Stat(serviceJSONPath); err == nil {
-		configExists = true
-		fmt.Fprintf(bi.logWriter, "    IPFS Cluster config already exists, ensuring it's up to date...\n")
-	} else {
-		fmt.Fprintf(bi.logWriter, "    Preparing IPFS Cluster path...\n")
-	}
-
-	if err := os.MkdirAll(clusterPath, 0755); err != nil {
-		return fmt.Errorf("failed to create IPFS Cluster directory: %w", err)
-	}
-
-	// Fix ownership before running init (best-effort)
-	if err := exec.Command("chown", "-R", "debros:debros", clusterPath).Run(); err != nil {
-		fmt.Fprintf(bi.logWriter, "    ⚠️  Warning: failed to chown cluster path before init: %v\n", err)
-	}
-
-	// Resolve ipfs-cluster-service binary path
-	clusterBinary, err := bi.ResolveBinaryPath("ipfs-cluster-service", "/usr/local/bin/ipfs-cluster-service", "/usr/bin/ipfs-cluster-service")
-	if err != nil {
-		return fmt.Errorf("ipfs-cluster-service binary not found: %w", err)
-	}
-
-	// Initialize cluster config if it doesn't exist
-	if !configExists {
-		// Initialize cluster config with ipfs-cluster-service init
-		// This creates the service.json file with all required sections
-		fmt.Fprintf(bi.logWriter, "    Initializing IPFS Cluster config...\n")
-		cmd := exec.Command(clusterBinary, "init", "--force")
-		cmd.Env = append(os.Environ(), "IPFS_CLUSTER_PATH="+clusterPath)
-		// Pass CLUSTER_SECRET to init so it writes the correct secret to service.json directly
-		if clusterSecret != "" {
-			cmd.Env = append(cmd.Env, "CLUSTER_SECRET="+clusterSecret)
-		}
-		if output, err := cmd.CombinedOutput(); err != nil {
-			return fmt.Errorf("failed to initialize IPFS Cluster config: %v\n%s", err, string(output))
-		}
-	}
-
-	// Always update the cluster secret, IPFS port, and peer addresses (for both new and existing configs)
-	// This ensures existing installations get the secret and port synchronized
-	// We do this AFTER init to ensure our secret takes precedence
-	if clusterSecret != "" {
-		fmt.Fprintf(bi.logWriter, "    Updating cluster secret, IPFS port, and peer addresses...\n")
-		if err := bi.updateClusterConfig(clusterPath, clusterSecret, ipfsAPIPort, clusterPeers); err != nil {
-			return fmt.Errorf("failed to update cluster config: %w", err)
-		}
-
-		// Verify the secret was written correctly
-		if err := bi.verifyClusterSecret(clusterPath, clusterSecret); err != nil {
-			return fmt.Errorf("cluster secret verification failed: %w", err)
-		}
-		fmt.Fprintf(bi.logWriter, "    ✓ Cluster secret verified\n")
-	}
-
-	// Fix ownership again after updates (best-effort)
-	if err := exec.Command("chown", "-R", "debros:debros", clusterPath).Run(); err != nil {
-		fmt.Fprintf(bi.logWriter, "    ⚠️  Warning: failed to chown cluster path after updates: %v\n", err)
-	}
-
-	return nil
-}
-
-// updateClusterConfig updates the secret, IPFS port, and peer addresses in IPFS Cluster service.json
-func (bi *BinaryInstaller) updateClusterConfig(clusterPath, secret string, ipfsAPIPort int, bootstrapClusterPeers []string) error {
-	serviceJSONPath := filepath.Join(clusterPath, "service.json")
-
-	// Read existing config
-	data, err := os.ReadFile(serviceJSONPath)
-	if err != nil {
-		return fmt.Errorf("failed to read service.json: %w", err)
-	}
-
-	// Parse JSON
-	var config map[string]interface{}
-	if err := json.Unmarshal(data, &config); err != nil {
-		return fmt.Errorf("failed to parse service.json: %w", err)
-	}
-
-	// Update cluster secret, listen_multiaddress, and peer addresses
-	if cluster, ok := config["cluster"].(map[string]interface{}); ok {
-		cluster["secret"] = secret
-		// Set consistent listen_multiaddress - port 9098 for cluster LibP2P communication
-		// This MUST match the port used in GetClusterPeerMultiaddr() and peer_addresses
-		cluster["listen_multiaddress"] = []interface{}{"/ip4/0.0.0.0/tcp/9098"}
-		// Configure peer addresses for cluster discovery
-		// This allows nodes to find and connect to each other
-		if len(bootstrapClusterPeers) > 0 {
-			cluster["peer_addresses"] = bootstrapClusterPeers
-		}
-	} else {
-		clusterConfig := map[string]interface{}{
-			"secret":              secret,
-			"listen_multiaddress": []interface{}{"/ip4/0.0.0.0/tcp/9098"},
-		}
-		if len(bootstrapClusterPeers) > 0 {
-			clusterConfig["peer_addresses"] = bootstrapClusterPeers
-		}
-		config["cluster"] = clusterConfig
-	}
-
-	// Update IPFS port in IPFS Proxy configuration
-	ipfsNodeMultiaddr := fmt.Sprintf("/ip4/127.0.0.1/tcp/%d", ipfsAPIPort)
-	if api, ok := config["api"].(map[string]interface{}); ok {
-		if ipfsproxy, ok := api["ipfsproxy"].(map[string]interface{}); ok {
-			ipfsproxy["node_multiaddress"] = ipfsNodeMultiaddr
-		}
-	}
-
-	// Update IPFS port in IPFS Connector configuration
-	if ipfsConnector, ok := config["ipfs_connector"].(map[string]interface{}); ok {
-		if ipfshttp, ok := ipfsConnector["ipfshttp"].(map[string]interface{}); ok {
-			ipfshttp["node_multiaddress"] = ipfsNodeMultiaddr
-		}
-	}
-
-	// Write back
-	updatedData, err := json.MarshalIndent(config, "", "  ")
-	if err != nil {
-		return fmt.Errorf("failed to marshal service.json: %w", err)
-	}
-
-	if err := os.WriteFile(serviceJSONPath, updatedData, 0644); err != nil {
-		return fmt.Errorf("failed to write service.json: %w", err)
-	}
-
-	return nil
-}
-
-// verifyClusterSecret verifies that the secret in service.json matches the expected value
-func (bi *BinaryInstaller) verifyClusterSecret(clusterPath, expectedSecret string) error {
-	serviceJSONPath := filepath.Join(clusterPath, "service.json")
-
-	data, err := os.ReadFile(serviceJSONPath)
-	if err != nil {
-		return fmt.Errorf("failed to read service.json for verification: %w", err)
-	}
-
-	var config map[string]interface{}
-	if err := json.Unmarshal(data, &config); err != nil {
-		return fmt.Errorf("failed to parse service.json for verification: %w", err)
-	}
-
-	if cluster, ok := config["cluster"].(map[string]interface{}); ok {
-		if secret, ok := cluster["secret"].(string); ok {
-			if secret != expectedSecret {
-				return fmt.Errorf("secret mismatch: expected %s, got %s", expectedSecret, secret)
-			}
-			return nil
-		}
-		return fmt.Errorf("secret not found in cluster config")
-	}
-
-	return fmt.Errorf("cluster section not found in service.json")
-}
-
-// GetClusterPeerMultiaddr reads the IPFS Cluster peer ID and returns its multiaddress
-// Returns format: /ip4/<ip>/tcp/9098/p2p/<cluster-peer-id>
-func (bi *BinaryInstaller) GetClusterPeerMultiaddr(clusterPath string, nodeIP string) (string, error) {
-	identityPath := filepath.Join(clusterPath, "identity.json")
-
-	// Read identity file
-	data, err := os.ReadFile(identityPath)
-	if err != nil {
-		return "", fmt.Errorf("failed to read identity.json: %w", err)
-	}
-
-	// Parse JSON
-	var identity map[string]interface{}
-	if err := json.Unmarshal(data, &identity); err != nil {
-		return "", fmt.Errorf("failed to parse identity.json: %w", err)
-	}
-
-	// Get peer ID
-	peerID, ok := identity["id"].(string)
-	if !ok || peerID == "" {
-		return "", fmt.Errorf("peer ID not found in identity.json")
-	}
-
-	// Construct multiaddress: /ip4/<ip>/tcp/9098/p2p/<peer-id>
-	// Port 9098 is the default cluster listen port
-	multiaddr := fmt.Sprintf("/ip4/%s/tcp/9098/p2p/%s", nodeIP, peerID)
-	return multiaddr, nil
-}
-
-// InitializeRQLiteDataDir initializes RQLite data directory
-func (bi *BinaryInstaller) InitializeRQLiteDataDir(dataDir string) error {
-	fmt.Fprintf(bi.logWriter, "    Initializing RQLite data dir...\n")
-
-	if err := os.MkdirAll(dataDir, 0755); err != nil {
-		return fmt.Errorf("failed to create RQLite data directory: %w", err)
-	}
-
-	if err := exec.Command("chown", "-R", "debros:debros", dataDir).Run(); err != nil {
-		fmt.Fprintf(bi.logWriter, "    ⚠️  Warning: failed to chown RQLite data dir: %v\n", err)
-	}
-	return nil
-}
-
-// InstallAnyoneClient installs the anyone-client npm package globally
-func (bi *BinaryInstaller) InstallAnyoneClient() error {
-	// Check if anyone-client is already available via npx (more reliable for scoped packages)
-	// Note: the CLI binary is "anyone-client", not the full scoped package name
-	if cmd := exec.Command("npx", "anyone-client", "--help"); cmd.Run() == nil {
-		fmt.Fprintf(bi.logWriter, "  ✓ anyone-client already installed\n")
-		return nil
-	}
-
-	fmt.Fprintf(bi.logWriter, "  Installing anyone-client...\n")
-
-	// Initialize NPM cache structure to ensure all directories exist
-	// This prevents "mkdir" errors when NPM tries to create nested cache directories
-	fmt.Fprintf(bi.logWriter, "    Initializing NPM cache...\n")
-	
-	// Create nested cache directories with proper permissions
-	debrosHome := "/home/debros"
-	npmCacheDirs := []string{
-		filepath.Join(debrosHome, ".npm"),
-		filepath.Join(debrosHome, ".npm", "_cacache"),
-		filepath.Join(debrosHome, ".npm", "_cacache", "tmp"),
-		filepath.Join(debrosHome, ".npm", "_logs"),
-	}
-	
-	for _, dir := range npmCacheDirs {
-		if err := os.MkdirAll(dir, 0700); err != nil {
-			fmt.Fprintf(bi.logWriter, "    ⚠️  Failed to create %s: %v\n", dir, err)
-			continue
-		}
-		// Fix ownership to debros user (sequential to avoid race conditions)
-		if err := exec.Command("chown", "debros:debros", dir).Run(); err != nil {
-			fmt.Fprintf(bi.logWriter, "    ⚠️  Warning: failed to chown %s: %v\n", dir, err)
-		}
-		if err := exec.Command("chmod", "700", dir).Run(); err != nil {
-			fmt.Fprintf(bi.logWriter, "    ⚠️  Warning: failed to chmod %s: %v\n", dir, err)
-		}
-	}
-	
-	// Recursively fix ownership of entire .npm directory to ensure all nested files are owned by debros
-	if err := exec.Command("chown", "-R", "debros:debros", filepath.Join(debrosHome, ".npm")).Run(); err != nil {
-		fmt.Fprintf(bi.logWriter, "    ⚠️  Warning: failed to chown .npm directory: %v\n", err)
-	}
-	
-	// Run npm cache verify as debros user with proper environment
-	cacheInitCmd := exec.Command("sudo", "-u", "debros", "npm", "cache", "verify", "--silent")
-	cacheInitCmd.Env = append(os.Environ(), "HOME="+debrosHome)
-	if err := cacheInitCmd.Run(); err != nil {
-		fmt.Fprintf(bi.logWriter, "    ⚠️  NPM cache verify warning: %v (continuing anyway)\n", err)
-	}
-
-	// Install anyone-client globally via npm (using scoped package name)
-	cmd := exec.Command("npm", "install", "-g", "@anyone-protocol/anyone-client")
-	if output, err := cmd.CombinedOutput(); err != nil {
-		return fmt.Errorf("failed to install anyone-client: %w\n%s", err, string(output))
-	}
-
-	// Create terms-agreement file to bypass interactive prompt when running as a service
-	termsFile := filepath.Join(debrosHome, "terms-agreement")
-	if err := os.WriteFile(termsFile, []byte("agreed"), 0644); err != nil {
-		fmt.Fprintf(bi.logWriter, "    ⚠️  Warning: failed to create terms-agreement: %v\n", err)
-	} else {
-		if err := exec.Command("chown", "debros:debros", termsFile).Run(); err != nil {
-			fmt.Fprintf(bi.logWriter, "    ⚠️  Warning: failed to chown terms-agreement: %v\n", err)
-		}
-	}
-
-	// Verify installation - try npx with the correct CLI name (anyone-client, not full scoped package name)
-	verifyCmd := exec.Command("npx", "anyone-client", "--help")
-	if err := verifyCmd.Run(); err != nil {
-		// Fallback: check if binary exists in common locations
-		possiblePaths := []string{
-			"/usr/local/bin/anyone-client",
-			"/usr/bin/anyone-client",
-		}
-		found := false
-		for _, path := range possiblePaths {
-			if info, err := os.Stat(path); err == nil && !info.IsDir() {
-				found = true
-				break
-			}
-		}
-		if !found {
-			// Try npm bin -g to find global bin directory
-			cmd := exec.Command("npm", "bin", "-g")
-			if output, err := cmd.Output(); err == nil {
-				npmBinDir := strings.TrimSpace(string(output))
-				candidate := filepath.Join(npmBinDir, "anyone-client")
-				if info, err := os.Stat(candidate); err == nil && !info.IsDir() {
-					found = true
-				}
-			}
-		}
-		if !found {
-			return fmt.Errorf("anyone-client installation verification failed - package may not provide a binary, but npx should work")
-		}
-	}
-
-	fmt.Fprintf(bi.logWriter, "  ✓ anyone-client installed\n")
-	return nil
-}

pkg/environments/production/orchestrator.go

@@ -1,570 +0,0 @@
-package production
-
-import (
-	"fmt"
-	"io"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"strings"
-	"time"
-)
-
-// ProductionSetup orchestrates the entire production deployment
-type ProductionSetup struct {
-	osInfo             *OSInfo
-	arch               string
-	oramaHome         string
-	oramaDir          string
-	logWriter          io.Writer
-	forceReconfigure   bool
-	skipOptionalDeps   bool
-	skipResourceChecks bool
-	privChecker        *PrivilegeChecker
-	osDetector         *OSDetector
-	archDetector       *ArchitectureDetector
-	resourceChecker    *ResourceChecker
-	portChecker        *PortChecker
-	fsProvisioner      *FilesystemProvisioner
-	userProvisioner    *UserProvisioner
-	stateDetector      *StateDetector
-	configGenerator    *ConfigGenerator
-	secretGenerator    *SecretGenerator
-	serviceGenerator   *SystemdServiceGenerator
-	serviceController  *SystemdController
-	binaryInstaller    *BinaryInstaller
-	branch             string
-	skipRepoUpdate     bool
-	NodePeerID         string // Captured during Phase3 for later display
-}
-
-// ReadBranchPreference reads the stored branch preference from disk
-func ReadBranchPreference(oramaDir string) string {
-	branchFile := filepath.Join(oramaDir, ".branch")
-	data, err := os.ReadFile(branchFile)
-	if err != nil {
-		return "main" // Default to main if file doesn't exist
-	}
-	branch := strings.TrimSpace(string(data))
-	if branch == "" {
-		return "main"
-	}
-	return branch
-}
-
-// SaveBranchPreference saves the branch preference to disk
-func SaveBranchPreference(oramaDir, branch string) error {
-	branchFile := filepath.Join(oramaDir, ".branch")
-	if err := os.MkdirAll(oramaDir, 0755); err != nil {
-		return fmt.Errorf("failed to create debros directory: %w", err)
-	}
-	if err := os.WriteFile(branchFile, []byte(branch), 0644); err != nil {
-		return fmt.Errorf("failed to save branch preference: %w", err)
-	}
-	exec.Command("chown", "debros:debros", branchFile).Run()
-	return nil
-}
-
-// NewProductionSetup creates a new production setup orchestrator
-func NewProductionSetup(oramaHome string, logWriter io.Writer, forceReconfigure bool, branch string, skipRepoUpdate bool, skipResourceChecks bool) *ProductionSetup {
-	oramaDir := filepath.Join(oramaHome, ".orama")
-	arch, _ := (&ArchitectureDetector{}).Detect()
-
-	// If branch is empty, try to read from stored preference, otherwise default to main
-	if branch == "" {
-		branch = ReadBranchPreference(oramaDir)
-	}
-
-	return &ProductionSetup{
-		oramaHome:         oramaHome,
-		oramaDir:          oramaDir,
-		logWriter:          logWriter,
-		forceReconfigure:   forceReconfigure,
-		arch:               arch,
-		branch:             branch,
-		skipRepoUpdate:     skipRepoUpdate,
-		skipResourceChecks: skipResourceChecks,
-		privChecker:        &PrivilegeChecker{},
-		osDetector:         &OSDetector{},
-		archDetector:       &ArchitectureDetector{},
-		resourceChecker:    NewResourceChecker(),
-		portChecker:        NewPortChecker(),
-		fsProvisioner:      NewFilesystemProvisioner(oramaHome),
-		userProvisioner:    NewUserProvisioner("debros", oramaHome, "/bin/bash"),
-		stateDetector:      NewStateDetector(oramaDir),
-		configGenerator:    NewConfigGenerator(oramaDir),
-		secretGenerator:    NewSecretGenerator(oramaDir),
-		serviceGenerator:   NewSystemdServiceGenerator(oramaHome, oramaDir),
-		serviceController:  NewSystemdController(),
-		binaryInstaller:    NewBinaryInstaller(arch, logWriter),
-	}
-}
-
-// logf writes a formatted message to the log writer
-func (ps *ProductionSetup) logf(format string, args ...interface{}) {
-	if ps.logWriter != nil {
-		fmt.Fprintf(ps.logWriter, format+"\n", args...)
-	}
-}
-
-// IsUpdate detects if this is an update to an existing installation
-func (ps *ProductionSetup) IsUpdate() bool {
-	return ps.stateDetector.IsConfigured() || ps.stateDetector.HasIPFSData()
-}
-
-// Phase1CheckPrerequisites performs initial environment validation
-func (ps *ProductionSetup) Phase1CheckPrerequisites() error {
-	ps.logf("Phase 1: Checking prerequisites...")
-
-	// Check root
-	if err := ps.privChecker.CheckRoot(); err != nil {
-		return fmt.Errorf("privilege check failed: %w", err)
-	}
-	ps.logf("  ✓ Running as root")
-
-	// Check Linux OS
-	if err := ps.privChecker.CheckLinuxOS(); err != nil {
-		return fmt.Errorf("OS check failed: %w", err)
-	}
-	ps.logf("  ✓ Running on Linux")
-
-	// Detect OS
-	osInfo, err := ps.osDetector.Detect()
-	if err != nil {
-		return fmt.Errorf("failed to detect OS: %w", err)
-	}
-	ps.osInfo = osInfo
-	ps.logf("  ✓ Detected OS: %s", osInfo.Name)
-
-	// Check if supported
-	if !ps.osDetector.IsSupportedOS(osInfo) {
-		ps.logf("  ⚠️  OS %s is not officially supported (Ubuntu 22/24/25, Debian 12)", osInfo.Name)
-		ps.logf("     Proceeding anyway, but issues may occur")
-	}
-
-	// Detect architecture
-	arch, err := ps.archDetector.Detect()
-	if err != nil {
-		return fmt.Errorf("failed to detect architecture: %w", err)
-	}
-	ps.arch = arch
-	ps.logf("  ✓ Detected architecture: %s", arch)
-
-	// Check basic dependencies
-	depChecker := NewDependencyChecker(ps.skipOptionalDeps)
-	if missing, err := depChecker.CheckAll(); err != nil {
-		ps.logf("  ❌ Missing dependencies:")
-		for _, dep := range missing {
-			ps.logf("     - %s: %s", dep.Name, dep.InstallHint)
-		}
-		return err
-	}
-	ps.logf("  ✓ Basic dependencies available")
-
-	// Check system resources
-	if ps.skipResourceChecks {
-		ps.logf("  ⚠️  Skipping system resource checks (disk, RAM, CPU) due to --ignore-resource-checks flag")
-	} else {
-		if err := ps.resourceChecker.CheckDiskSpace(ps.oramaHome); err != nil {
-			ps.logf("  ❌ %v", err)
-			return err
-		}
-		ps.logf("  ✓ Sufficient disk space available")
-
-		if err := ps.resourceChecker.CheckRAM(); err != nil {
-			ps.logf("  ❌ %v", err)
-			return err
-		}
-		ps.logf("  ✓ Sufficient RAM available")
-
-		if err := ps.resourceChecker.CheckCPU(); err != nil {
-			ps.logf("  ❌ %v", err)
-			return err
-		}
-		ps.logf("  ✓ Sufficient CPU cores available")
-	}
-
-	return nil
-}
-
-// Phase2ProvisionEnvironment sets up users and filesystems
-func (ps *ProductionSetup) Phase2ProvisionEnvironment() error {
-	ps.logf("Phase 2: Provisioning environment...")
-
-	// Create debros user
-	if !ps.userProvisioner.UserExists() {
-		if err := ps.userProvisioner.CreateUser(); err != nil {
-			return fmt.Errorf("failed to create debros user: %w", err)
-		}
-		ps.logf("  ✓ Created 'debros' user")
-	} else {
-		ps.logf("  ✓ 'debros' user already exists")
-	}
-
-	// Set up sudoers access if invoked via sudo
-	sudoUser := os.Getenv("SUDO_USER")
-	if sudoUser != "" {
-		if err := ps.userProvisioner.SetupSudoersAccess(sudoUser); err != nil {
-			ps.logf("  ⚠️  Failed to setup sudoers: %v", err)
-		} else {
-			ps.logf("  ✓ Sudoers access configured")
-		}
-	}
-
-	// Create directory structure (unified structure)
-	if err := ps.fsProvisioner.EnsureDirectoryStructure(); err != nil {
-		return fmt.Errorf("failed to create directory structure: %w", err)
-	}
-	ps.logf("  ✓ Directory structure created")
-
-	// Fix ownership
-	if err := ps.fsProvisioner.FixOwnership(); err != nil {
-		return fmt.Errorf("failed to fix ownership: %w", err)
-	}
-	ps.logf("  ✓ Ownership fixed")
-
-	return nil
-}
-
-// Phase2bInstallBinaries installs external binaries and DeBros components
-func (ps *ProductionSetup) Phase2bInstallBinaries() error {
-	ps.logf("Phase 2b: Installing binaries...")
-
-	// Install system dependencies
-	if err := ps.binaryInstaller.InstallSystemDependencies(); err != nil {
-		ps.logf("  ⚠️  System dependencies warning: %v", err)
-	}
-
-	// Install Go if not present
-	if err := ps.binaryInstaller.InstallGo(); err != nil {
-		return fmt.Errorf("failed to install Go: %w", err)
-	}
-
-	// Install binaries
-	if err := ps.binaryInstaller.InstallRQLite(); err != nil {
-		ps.logf("  ⚠️  RQLite install warning: %v", err)
-	}
-
-	if err := ps.binaryInstaller.InstallIPFS(); err != nil {
-		ps.logf("  ⚠️  IPFS install warning: %v", err)
-	}
-
-	if err := ps.binaryInstaller.InstallIPFSCluster(); err != nil {
-		ps.logf("  ⚠️  IPFS Cluster install warning: %v", err)
-	}
-
-	if err := ps.binaryInstaller.InstallOlric(); err != nil {
-		ps.logf("  ⚠️  Olric install warning: %v", err)
-	}
-
-	// Install anyone-client for SOCKS5 proxy
-	if err := ps.binaryInstaller.InstallAnyoneClient(); err != nil {
-		ps.logf("  ⚠️  anyone-client install warning: %v", err)
-	}
-
-	// Install DeBros binaries
-	if err := ps.binaryInstaller.InstallDeBrosBinaries(ps.branch, ps.oramaHome, ps.skipRepoUpdate); err != nil {
-		return fmt.Errorf("failed to install DeBros binaries: %w", err)
-	}
-
-	ps.logf("  ✓ All binaries installed")
-	return nil
-}
-
-// Phase2cInitializeServices initializes service repositories and configurations
-// ipfsPeer can be nil for the first node, or contain peer info for joining nodes
-// ipfsClusterPeer can be nil for the first node, or contain IPFS Cluster peer info for joining nodes
-func (ps *ProductionSetup) Phase2cInitializeServices(peerAddresses []string, vpsIP string, ipfsPeer *IPFSPeerInfo, ipfsClusterPeer *IPFSClusterPeerInfo) error {
-	ps.logf("Phase 2c: Initializing services...")
-
-	// Ensure directories exist (unified structure)
-	if err := ps.fsProvisioner.EnsureDirectoryStructure(); err != nil {
-		return fmt.Errorf("failed to create directories: %w", err)
-	}
-
-	// Build paths - unified data directory (all nodes equal)
-	dataDir := filepath.Join(ps.oramaDir, "data")
-
-	// Initialize IPFS repo with correct path structure
-	// Use port 4501 for API (to avoid conflict with RQLite on 5001), 8080 for gateway (standard), 4101 for swarm (to avoid conflict with LibP2P on 4001)
-	ipfsRepoPath := filepath.Join(dataDir, "ipfs", "repo")
-	if err := ps.binaryInstaller.InitializeIPFSRepo(ipfsRepoPath, filepath.Join(ps.oramaDir, "secrets", "swarm.key"), 4501, 8080, 4101, ipfsPeer); err != nil {
-		return fmt.Errorf("failed to initialize IPFS repo: %w", err)
-	}
-
-	// Initialize IPFS Cluster config (runs ipfs-cluster-service init)
-	clusterPath := filepath.Join(dataDir, "ipfs-cluster")
-	clusterSecret, err := ps.secretGenerator.EnsureClusterSecret()
-	if err != nil {
-		return fmt.Errorf("failed to get cluster secret: %w", err)
-	}
-
-	// Get cluster peer addresses from IPFS Cluster peer info if available
-	var clusterPeers []string
-	if ipfsClusterPeer != nil && ipfsClusterPeer.PeerID != "" {
-		// Construct cluster peer multiaddress using the discovered peer ID
-		// Format: /ip4/<ip>/tcp/9098/p2p/<cluster-peer-id>
-		peerIP := inferPeerIP(peerAddresses, vpsIP)
-		if peerIP != "" {
-			// Construct the bootstrap multiaddress for IPFS Cluster
-			// Note: IPFS Cluster listens on port 9098 for cluster communication
-			clusterBootstrapAddr := fmt.Sprintf("/ip4/%s/tcp/9098/p2p/%s", peerIP, ipfsClusterPeer.PeerID)
-			clusterPeers = []string{clusterBootstrapAddr}
-			ps.logf("  ℹ️  IPFS Cluster will connect to peer: %s", clusterBootstrapAddr)
-		} else if len(ipfsClusterPeer.Addrs) > 0 {
-			// Fallback: use the addresses from discovery (if they include peer ID)
-			for _, addr := range ipfsClusterPeer.Addrs {
-				if strings.Contains(addr, ipfsClusterPeer.PeerID) {
-					clusterPeers = append(clusterPeers, addr)
-				}
-			}
-			if len(clusterPeers) > 0 {
-				ps.logf("  ℹ️  IPFS Cluster will connect to discovered peers: %v", clusterPeers)
-			}
-		}
-	}
-
-	if err := ps.binaryInstaller.InitializeIPFSClusterConfig(clusterPath, clusterSecret, 4501, clusterPeers); err != nil {
-		return fmt.Errorf("failed to initialize IPFS Cluster: %w", err)
-	}
-
-	// Initialize RQLite data directory
-	rqliteDataDir := filepath.Join(dataDir, "rqlite")
-	if err := ps.binaryInstaller.InitializeRQLiteDataDir(rqliteDataDir); err != nil {
-		ps.logf("  ⚠️  RQLite initialization warning: %v", err)
-	}
-
-	// Ensure all directories and files created during service initialization have correct ownership
-	// This is critical because directories/files created as root need to be owned by debros user
-	if err := ps.fsProvisioner.FixOwnership(); err != nil {
-		return fmt.Errorf("failed to fix ownership after service initialization: %w", err)
-	}
-
-	ps.logf("  ✓ Services initialized")
-	return nil
-}
-
-// Phase3GenerateSecrets generates shared secrets and keys
-func (ps *ProductionSetup) Phase3GenerateSecrets() error {
-	ps.logf("Phase 3: Generating secrets...")
-
-	// Cluster secret
-	if _, err := ps.secretGenerator.EnsureClusterSecret(); err != nil {
-		return fmt.Errorf("failed to ensure cluster secret: %w", err)
-	}
-	ps.logf("  ✓ Cluster secret ensured")
-
-	// Swarm key
-	if _, err := ps.secretGenerator.EnsureSwarmKey(); err != nil {
-		return fmt.Errorf("failed to ensure swarm key: %w", err)
-	}
-	ps.logf("  ✓ IPFS swarm key ensured")
-
-	// Node identity (unified architecture)
-	peerID, err := ps.secretGenerator.EnsureNodeIdentity()
-	if err != nil {
-		return fmt.Errorf("failed to ensure node identity: %w", err)
-	}
-	peerIDStr := peerID.String()
-	ps.NodePeerID = peerIDStr // Capture for later display
-	ps.logf("  ✓ Node identity ensured (Peer ID: %s)", peerIDStr)
-
-	return nil
-}
-
-// Phase4GenerateConfigs generates node, gateway, and service configs
-func (ps *ProductionSetup) Phase4GenerateConfigs(peerAddresses []string, vpsIP string, enableHTTPS bool, domain string, joinAddress string) error {
-	if ps.IsUpdate() {
-		ps.logf("Phase 4: Updating configurations...")
-		ps.logf("  (Existing configs will be updated to latest format)")
-	} else {
-		ps.logf("Phase 4: Generating configurations...")
-	}
-
-	// Node config (unified architecture)
-	nodeConfig, err := ps.configGenerator.GenerateNodeConfig(peerAddresses, vpsIP, joinAddress, domain, enableHTTPS)
-	if err != nil {
-		return fmt.Errorf("failed to generate node config: %w", err)
-	}
-
-	configFile := "node.yaml"
-	if err := ps.secretGenerator.SaveConfig(configFile, nodeConfig); err != nil {
-		return fmt.Errorf("failed to save node config: %w", err)
-	}
-	ps.logf("  ✓ Node config generated: %s", configFile)
-
-	// Gateway configuration is now embedded in each node's config
-	// No separate gateway.yaml needed - each node runs its own embedded gateway
-
-	// Olric config:
-	// - HTTP API binds to localhost for security (accessed via gateway)
-	// - Memberlist binds to 0.0.0.0 for cluster communication across nodes
-	// - Environment "lan" for production multi-node clustering
-	olricConfig, err := ps.configGenerator.GenerateOlricConfig(
-		"127.0.0.1", // HTTP API on localhost
-		3320,
-		"0.0.0.0", // Memberlist on all interfaces for clustering
-		3322,
-		"lan", // Production environment
-	)
-	if err != nil {
-		return fmt.Errorf("failed to generate olric config: %w", err)
-	}
-
-	// Create olric config directory
-	olricConfigDir := ps.oramaDir + "/configs/olric"
-	if err := os.MkdirAll(olricConfigDir, 0755); err != nil {
-		return fmt.Errorf("failed to create olric config directory: %w", err)
-	}
-
-	olricConfigPath := olricConfigDir + "/config.yaml"
-	if err := os.WriteFile(olricConfigPath, []byte(olricConfig), 0644); err != nil {
-		return fmt.Errorf("failed to save olric config: %w", err)
-	}
-	exec.Command("chown", "debros:debros", olricConfigPath).Run()
-	ps.logf("  ✓ Olric config generated")
-
-	return nil
-}
-
-// Phase5CreateSystemdServices creates and enables systemd units
-// enableHTTPS determines the RQLite Raft port (7002 when SNI is enabled, 7001 otherwise)
-func (ps *ProductionSetup) Phase5CreateSystemdServices(enableHTTPS bool) error {
-	ps.logf("Phase 5: Creating systemd services...")
-
-	// Validate all required binaries are available before creating services
-	ipfsBinary, err := ps.binaryInstaller.ResolveBinaryPath("ipfs", "/usr/local/bin/ipfs", "/usr/bin/ipfs")
-	if err != nil {
-		return fmt.Errorf("ipfs binary not available: %w", err)
-	}
-	clusterBinary, err := ps.binaryInstaller.ResolveBinaryPath("ipfs-cluster-service", "/usr/local/bin/ipfs-cluster-service", "/usr/bin/ipfs-cluster-service")
-	if err != nil {
-		return fmt.Errorf("ipfs-cluster-service binary not available: %w", err)
-	}
-	olricBinary, err := ps.binaryInstaller.ResolveBinaryPath("olric-server", "/usr/local/bin/olric-server", "/usr/bin/olric-server")
-	if err != nil {
-		return fmt.Errorf("olric-server binary not available: %w", err)
-	}
-
-	// IPFS service (unified - no bootstrap/node distinction)
-	ipfsUnit := ps.serviceGenerator.GenerateIPFSService(ipfsBinary)
-	if err := ps.serviceController.WriteServiceUnit("debros-ipfs.service", ipfsUnit); err != nil {
-		return fmt.Errorf("failed to write IPFS service: %w", err)
-	}
-	ps.logf("  ✓ IPFS service created: debros-ipfs.service")
-
-	// IPFS Cluster service
-	clusterUnit := ps.serviceGenerator.GenerateIPFSClusterService(clusterBinary)
-	if err := ps.serviceController.WriteServiceUnit("debros-ipfs-cluster.service", clusterUnit); err != nil {
-		return fmt.Errorf("failed to write IPFS Cluster service: %w", err)
-	}
-	ps.logf("  ✓ IPFS Cluster service created: debros-ipfs-cluster.service")
-
-	// RQLite is managed internally by each node - no separate systemd service needed
-
-	// Olric service
-	olricUnit := ps.serviceGenerator.GenerateOlricService(olricBinary)
-	if err := ps.serviceController.WriteServiceUnit("debros-olric.service", olricUnit); err != nil {
-		return fmt.Errorf("failed to write Olric service: %w", err)
-	}
-	ps.logf("  ✓ Olric service created")
-
-	// Node service (unified - includes embedded gateway)
-	nodeUnit := ps.serviceGenerator.GenerateNodeService()
-	if err := ps.serviceController.WriteServiceUnit("debros-node.service", nodeUnit); err != nil {
-		return fmt.Errorf("failed to write Node service: %w", err)
-	}
-	ps.logf("  ✓ Node service created: debros-node.service (with embedded gateway)")
-
-	// Anyone Client service (SOCKS5 proxy)
-	anyoneUnit := ps.serviceGenerator.GenerateAnyoneClientService()
-	if err := ps.serviceController.WriteServiceUnit("debros-anyone-client.service", anyoneUnit); err != nil {
-		return fmt.Errorf("failed to write Anyone Client service: %w", err)
-	}
-	ps.logf("  ✓ Anyone Client service created")
-
-	// Reload systemd daemon
-	if err := ps.serviceController.DaemonReload(); err != nil {
-		return fmt.Errorf("failed to reload systemd: %w", err)
-	}
-	ps.logf("  ✓ Systemd daemon reloaded")
-
-	// Enable services (unified names - no bootstrap/node distinction)
-	// Note: debros-gateway.service is no longer needed - each node has an embedded gateway
-	// Note: debros-rqlite.service is NOT created - RQLite is managed by each node internally
-	services := []string{"debros-ipfs.service", "debros-ipfs-cluster.service", "debros-olric.service", "debros-node.service", "debros-anyone-client.service"}
-	for _, svc := range services {
-		if err := ps.serviceController.EnableService(svc); err != nil {
-			ps.logf("  ⚠️  Failed to enable %s: %v", svc, err)
-		} else {
-			ps.logf("  ✓ Service enabled: %s", svc)
-		}
-	}
-
-	// Start services in dependency order
-	ps.logf("  Starting services...")
-
-	// Start infrastructure first (IPFS, Olric, Anyone Client) - RQLite is managed internally by each node
-	infraServices := []string{"debros-ipfs.service", "debros-olric.service"}
-	
-	// Check if port 9050 is already in use (e.g., another anyone-client or similar service)
-	if ps.portChecker.IsPortInUse(9050) {
-		ps.logf("  ℹ️  Port 9050 is already in use (anyone-client or similar service running)")
-		ps.logf("  ℹ️  Skipping debros-anyone-client startup - using existing service")
-	} else {
-		infraServices = append(infraServices, "debros-anyone-client.service")
-	}
-	
-	for _, svc := range infraServices {
-		if err := ps.serviceController.StartService(svc); err != nil {
-			ps.logf("  ⚠️  Failed to start %s: %v", svc, err)
-		} else {
-			ps.logf("    - %s started", svc)
-		}
-	}
-
-	// Wait a moment for infrastructure to stabilize
-	time.Sleep(2 * time.Second)
-
-	// Start IPFS Cluster
-	if err := ps.serviceController.StartService("debros-ipfs-cluster.service"); err != nil {
-		ps.logf("  ⚠️  Failed to start debros-ipfs-cluster.service: %v", err)
-	} else {
-		ps.logf("    - debros-ipfs-cluster.service started")
-	}
-
-	// Start node service (gateway is embedded in node, no separate service needed)
-	if err := ps.serviceController.StartService("debros-node.service"); err != nil {
-		ps.logf("  ⚠️  Failed to start debros-node.service: %v", err)
-	} else {
-		ps.logf("    - debros-node.service started (with embedded gateway)")
-	}
-
-	ps.logf("  ✓ All services started")
-	return nil
-}
-
-// LogSetupComplete logs completion information
-func (ps *ProductionSetup) LogSetupComplete(peerID string) {
-	ps.logf("\n" + strings.Repeat("=", 70))
-	ps.logf("Setup Complete!")
-	ps.logf(strings.Repeat("=", 70))
-	ps.logf("\nNode Peer ID: %s", peerID)
-	ps.logf("\nService Management:")
-	ps.logf("  systemctl status debros-ipfs")
-	ps.logf("  journalctl -u debros-node -f")
-	ps.logf("  tail -f %s/logs/node.log", ps.oramaDir)
-	ps.logf("\nLog Files:")
-	ps.logf("  %s/logs/ipfs.log", ps.oramaDir)
-	ps.logf("  %s/logs/ipfs-cluster.log", ps.oramaDir)
-	ps.logf("  %s/logs/olric.log", ps.oramaDir)
-	ps.logf("  %s/logs/node.log", ps.oramaDir)
-	ps.logf("  %s/logs/gateway.log", ps.oramaDir)
-	ps.logf("  %s/logs/anyone-client.log", ps.oramaDir)
-	ps.logf("\nStart All Services:")
-	ps.logf("  systemctl start debros-ipfs debros-ipfs-cluster debros-olric debros-anyone-client debros-node")
-	ps.logf("\nVerify Installation:")
-	ps.logf("  curl http://localhost:6001/health")
-	ps.logf("  curl http://localhost:5001/status")
-	ps.logf("  # Anyone Client SOCKS5 proxy on localhost:9050\n")
-}

pkg/environments/production/provisioner.go

@@ -1,257 +0,0 @@
-package production
-
-import (
-	"fmt"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"strings"
-)
-
-// FilesystemProvisioner manages directory creation and permissions
-type FilesystemProvisioner struct {
-	oramaHome string
-	oramaDir  string
-	logWriter  interface{} // Can be io.Writer for logging
-}
-
-// NewFilesystemProvisioner creates a new provisioner
-func NewFilesystemProvisioner(oramaHome string) *FilesystemProvisioner {
-	return &FilesystemProvisioner{
-		oramaHome: oramaHome,
-		oramaDir:  filepath.Join(oramaHome, ".orama"),
-	}
-}
-
-// EnsureDirectoryStructure creates all required directories (unified structure)
-func (fp *FilesystemProvisioner) EnsureDirectoryStructure() error {
-	// All directories needed for unified node structure
-	dirs := []string{
-		fp.oramaDir,
-		filepath.Join(fp.oramaDir, "configs"),
-		filepath.Join(fp.oramaDir, "secrets"),
-		filepath.Join(fp.oramaDir, "data"),
-		filepath.Join(fp.oramaDir, "data", "ipfs", "repo"),
-		filepath.Join(fp.oramaDir, "data", "ipfs-cluster"),
-		filepath.Join(fp.oramaDir, "data", "rqlite"),
-		filepath.Join(fp.oramaDir, "logs"),
-		filepath.Join(fp.oramaDir, "tls-cache"),
-		filepath.Join(fp.oramaDir, "backups"),
-		filepath.Join(fp.oramaHome, "bin"),
-		filepath.Join(fp.oramaHome, "src"),
-		filepath.Join(fp.oramaHome, ".npm"),
-	}
-
-	for _, dir := range dirs {
-		if err := os.MkdirAll(dir, 0755); err != nil {
-			return fmt.Errorf("failed to create directory %s: %w", dir, err)
-		}
-	}
-
-	// Remove any stray cluster-secret file from root .orama directory
-	// The correct location is .orama/secrets/cluster-secret
-	strayClusterSecret := filepath.Join(fp.oramaDir, "cluster-secret")
-	if _, err := os.Stat(strayClusterSecret); err == nil {
-		if err := os.Remove(strayClusterSecret); err != nil {
-			return fmt.Errorf("failed to remove stray cluster-secret file: %w", err)
-		}
-	}
-
-	// Create log files with correct permissions so systemd can write to them
-	logsDir := filepath.Join(fp.oramaDir, "logs")
-	logFiles := []string{
-		"olric.log",
-		"gateway.log",
-		"ipfs.log",
-		"ipfs-cluster.log",
-		"node.log",
-		"anyone-client.log",
-	}
-
-	for _, logFile := range logFiles {
-		logPath := filepath.Join(logsDir, logFile)
-		// Create empty file if it doesn't exist
-		if _, err := os.Stat(logPath); os.IsNotExist(err) {
-			if err := os.WriteFile(logPath, []byte{}, 0644); err != nil {
-				return fmt.Errorf("failed to create log file %s: %w", logPath, err)
-			}
-		}
-	}
-
-	return nil
-}
-
-// FixOwnership changes ownership of .orama directory to debros user
-func (fp *FilesystemProvisioner) FixOwnership() error {
-	// Fix entire .orama directory recursively (includes all data, configs, logs, etc.)
-	cmd := exec.Command("chown", "-R", "debros:debros", fp.oramaDir)
-	if output, err := cmd.CombinedOutput(); err != nil {
-		return fmt.Errorf("failed to set ownership for %s: %w\nOutput: %s", fp.oramaDir, err, string(output))
-	}
-
-	// Also fix home directory ownership
-	cmd = exec.Command("chown", "debros:debros", fp.oramaHome)
-	if output, err := cmd.CombinedOutput(); err != nil {
-		return fmt.Errorf("failed to set ownership for %s: %w\nOutput: %s", fp.oramaHome, err, string(output))
-	}
-
-	// Fix bin directory
-	binDir := filepath.Join(fp.oramaHome, "bin")
-	cmd = exec.Command("chown", "-R", "debros:debros", binDir)
-	if output, err := cmd.CombinedOutput(); err != nil {
-		return fmt.Errorf("failed to set ownership for %s: %w\nOutput: %s", binDir, err, string(output))
-	}
-
-	// Fix npm cache directory
-	npmDir := filepath.Join(fp.oramaHome, ".npm")
-	cmd = exec.Command("chown", "-R", "debros:debros", npmDir)
-	if output, err := cmd.CombinedOutput(); err != nil {
-		return fmt.Errorf("failed to set ownership for %s: %w\nOutput: %s", npmDir, err, string(output))
-	}
-
-	return nil
-}
-
-// UserProvisioner manages system user creation and sudoers setup
-type UserProvisioner struct {
-	username string
-	home     string
-	shell    string
-}
-
-// NewUserProvisioner creates a new user provisioner
-func NewUserProvisioner(username, home, shell string) *UserProvisioner {
-	if shell == "" {
-		shell = "/bin/bash"
-	}
-	return &UserProvisioner{
-		username: username,
-		home:     home,
-		shell:    shell,
-	}
-}
-
-// UserExists checks if the system user exists
-func (up *UserProvisioner) UserExists() bool {
-	cmd := exec.Command("id", up.username)
-	return cmd.Run() == nil
-}
-
-// CreateUser creates the system user
-func (up *UserProvisioner) CreateUser() error {
-	if up.UserExists() {
-		return nil // User already exists
-	}
-
-	cmd := exec.Command("useradd", "-r", "-m", "-s", up.shell, "-d", up.home, up.username)
-	if err := cmd.Run(); err != nil {
-		return fmt.Errorf("failed to create user %s: %w", up.username, err)
-	}
-
-	return nil
-}
-
-// SetupSudoersAccess creates sudoers rule for the invoking user
-func (up *UserProvisioner) SetupSudoersAccess(invokerUser string) error {
-	if invokerUser == "" {
-		return nil // Skip if no invoker
-	}
-
-	sudoersRule := fmt.Sprintf("%s ALL=(debros) NOPASSWD: ALL\n", invokerUser)
-	sudoersFile := "/etc/sudoers.d/debros-access"
-
-	// Check if rule already exists
-	if existing, err := os.ReadFile(sudoersFile); err == nil {
-		if strings.Contains(string(existing), invokerUser) {
-			return nil // Rule already set
-		}
-	}
-
-	// Write sudoers rule
-	if err := os.WriteFile(sudoersFile, []byte(sudoersRule), 0440); err != nil {
-		return fmt.Errorf("failed to create sudoers rule: %w", err)
-	}
-
-	// Validate sudoers file
-	cmd := exec.Command("visudo", "-c", "-f", sudoersFile)
-	if err := cmd.Run(); err != nil {
-		os.Remove(sudoersFile) // Clean up on validation failure
-		return fmt.Errorf("sudoers rule validation failed: %w", err)
-	}
-
-	return nil
-}
-
-// StateDetector checks for existing production state
-type StateDetector struct {
-	oramaDir string
-}
-
-// NewStateDetector creates a state detector
-func NewStateDetector(oramaDir string) *StateDetector {
-	return &StateDetector{
-		oramaDir: oramaDir,
-	}
-}
-
-// IsConfigured checks if basic configs exist
-func (sd *StateDetector) IsConfigured() bool {
-	nodeConfig := filepath.Join(sd.oramaDir, "configs", "node.yaml")
-	gatewayConfig := filepath.Join(sd.oramaDir, "configs", "gateway.yaml")
-	_, err1 := os.Stat(nodeConfig)
-	_, err2 := os.Stat(gatewayConfig)
-	return err1 == nil || err2 == nil
-}
-
-// HasSecrets checks if cluster secret and swarm key exist
-func (sd *StateDetector) HasSecrets() bool {
-	clusterSecret := filepath.Join(sd.oramaDir, "secrets", "cluster-secret")
-	swarmKey := filepath.Join(sd.oramaDir, "secrets", "swarm.key")
-	_, err1 := os.Stat(clusterSecret)
-	_, err2 := os.Stat(swarmKey)
-	return err1 == nil && err2 == nil
-}
-
-// HasIPFSData checks if IPFS repo is initialized (unified path)
-func (sd *StateDetector) HasIPFSData() bool {
-	// Check unified path first
-	ipfsRepoPath := filepath.Join(sd.oramaDir, "data", "ipfs", "repo", "config")
-	if _, err := os.Stat(ipfsRepoPath); err == nil {
-		return true
-	}
-	// Fallback: check legacy bootstrap path for migration
-	legacyPath := filepath.Join(sd.oramaDir, "data", "bootstrap", "ipfs", "repo", "config")
-	_, err := os.Stat(legacyPath)
-	return err == nil
-}
-
-// HasRQLiteData checks if RQLite data exists (unified path)
-func (sd *StateDetector) HasRQLiteData() bool {
-	// Check unified path first
-	rqliteDataPath := filepath.Join(sd.oramaDir, "data", "rqlite")
-	if info, err := os.Stat(rqliteDataPath); err == nil && info.IsDir() {
-		return true
-	}
-	// Fallback: check legacy bootstrap path for migration
-	legacyPath := filepath.Join(sd.oramaDir, "data", "bootstrap", "rqlite")
-	info, err := os.Stat(legacyPath)
-	return err == nil && info.IsDir()
-}
-
-// CheckBinaryInstallation checks if required binaries are in PATH
-func (sd *StateDetector) CheckBinaryInstallation() error {
-	binaries := []string{"ipfs", "ipfs-cluster-service", "rqlited", "olric-server"}
-	var missing []string
-
-	for _, bin := range binaries {
-		if _, err := exec.LookPath(bin); err != nil {
-			missing = append(missing, bin)
-		}
-	}
-
-	if len(missing) > 0 {
-		return fmt.Errorf("missing binaries: %s", strings.Join(missing, ", "))
-	}
-
-	return nil
-}

pkg/environments/production/services.go

@@ -1,412 +0,0 @@
-package production
-
-import (
-	"fmt"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"strings"
-)
-
-// SystemdServiceGenerator generates systemd unit files
-type SystemdServiceGenerator struct {
-	oramaHome string
-	oramaDir  string
-}
-
-// NewSystemdServiceGenerator creates a new service generator
-func NewSystemdServiceGenerator(oramaHome, oramaDir string) *SystemdServiceGenerator {
-	return &SystemdServiceGenerator{
-		oramaHome: oramaHome,
-		oramaDir:  oramaDir,
-	}
-}
-
-// GenerateIPFSService generates the IPFS daemon systemd unit
-func (ssg *SystemdServiceGenerator) GenerateIPFSService(ipfsBinary string) string {
-	ipfsRepoPath := filepath.Join(ssg.oramaDir, "data", "ipfs", "repo")
-	logFile := filepath.Join(ssg.oramaDir, "logs", "ipfs.log")
-
-	return fmt.Sprintf(`[Unit]
-Description=IPFS Daemon
-After=network-online.target
-Wants=network-online.target
-
-[Service]
-Type=simple
-User=debros
-Group=debros
-Environment=HOME=%[1]s
-Environment=IPFS_PATH=%[2]s
-ExecStartPre=/bin/bash -c 'if [ -f %[3]s/secrets/swarm.key ] && [ ! -f %[2]s/swarm.key ]; then cp %[3]s/secrets/swarm.key %[2]s/swarm.key && chmod 600 %[2]s/swarm.key; fi'
-ExecStart=%[5]s daemon --enable-pubsub-experiment --repo-dir=%[2]s
-Restart=always
-RestartSec=5
-StandardOutput=append:%[4]s
-StandardError=append:%[4]s
-SyslogIdentifier=debros-ipfs
-
-NoNewPrivileges=yes
-PrivateTmp=yes
-ProtectSystem=strict
-ProtectHome=read-only
-ProtectKernelTunables=yes
-ProtectKernelModules=yes
-ProtectControlGroups=yes
-RestrictRealtime=yes
-RestrictSUIDSGID=yes
-ReadWritePaths=%[3]s
-
-[Install]
-WantedBy=multi-user.target
-`, ssg.oramaHome, ipfsRepoPath, ssg.oramaDir, logFile, ipfsBinary)
-}
-
-// GenerateIPFSClusterService generates the IPFS Cluster systemd unit
-func (ssg *SystemdServiceGenerator) GenerateIPFSClusterService(clusterBinary string) string {
-	clusterPath := filepath.Join(ssg.oramaDir, "data", "ipfs-cluster")
-	logFile := filepath.Join(ssg.oramaDir, "logs", "ipfs-cluster.log")
-	
-	// Read cluster secret from file to pass to daemon
-	clusterSecretPath := filepath.Join(ssg.oramaDir, "secrets", "cluster-secret")
-	clusterSecret := ""
-	if data, err := os.ReadFile(clusterSecretPath); err == nil {
-		clusterSecret = strings.TrimSpace(string(data))
-	}
-
-	return fmt.Sprintf(`[Unit]
-Description=IPFS Cluster Service
-After=debros-ipfs.service
-Wants=debros-ipfs.service
-Requires=debros-ipfs.service
-
-[Service]
-Type=simple
-User=debros
-Group=debros
-WorkingDirectory=%[1]s
-Environment=HOME=%[1]s
-Environment=IPFS_CLUSTER_PATH=%[2]s
-Environment=CLUSTER_SECRET=%[5]s
-ExecStartPre=/bin/bash -c 'mkdir -p %[2]s && chmod 700 %[2]s'
-ExecStart=%[4]s daemon
-Restart=always
-RestartSec=5
-StandardOutput=append:%[3]s
-StandardError=append:%[3]s
-SyslogIdentifier=debros-ipfs-cluster
-
-NoNewPrivileges=yes
-PrivateTmp=yes
-ProtectSystem=strict
-ProtectHome=read-only
-ProtectKernelTunables=yes
-ProtectKernelModules=yes
-ProtectControlGroups=yes
-RestrictRealtime=yes
-RestrictSUIDSGID=yes
-ReadWritePaths=%[1]s
-
-[Install]
-WantedBy=multi-user.target
-`, ssg.oramaHome, clusterPath, logFile, clusterBinary, clusterSecret)
-}
-
-// GenerateRQLiteService generates the RQLite systemd unit
-func (ssg *SystemdServiceGenerator) GenerateRQLiteService(rqliteBinary string, httpPort, raftPort int, joinAddr string, advertiseIP string) string {
-	dataDir := filepath.Join(ssg.oramaDir, "data", "rqlite")
-	logFile := filepath.Join(ssg.oramaDir, "logs", "rqlite.log")
-
-	// Use public IP for advertise if provided, otherwise default to localhost
-	if advertiseIP == "" {
-		advertiseIP = "127.0.0.1"
-	}
-
-	// Bind RQLite to localhost only - external access via SNI gateway
-	args := fmt.Sprintf(
-		`-http-addr 127.0.0.1:%d -http-adv-addr %s:%d -raft-adv-addr %s:%d -raft-addr 127.0.0.1:%d`,
-		httpPort, advertiseIP, httpPort, advertiseIP, raftPort, raftPort,
-	)
-
-	if joinAddr != "" {
-		args += fmt.Sprintf(` -join %s -join-attempts 30 -join-interval 10s`, joinAddr)
-	}
-
-	args += fmt.Sprintf(` %s`, dataDir)
-
-	return fmt.Sprintf(`[Unit]
-Description=RQLite Database
-After=network-online.target
-Wants=network-online.target
-
-[Service]
-Type=simple
-User=debros
-Group=debros
-Environment=HOME=%[1]s
-ExecStart=%[5]s %[2]s
-Restart=always
-RestartSec=5
-StandardOutput=append:%[3]s
-StandardError=append:%[3]s
-SyslogIdentifier=debros-rqlite
-
-NoNewPrivileges=yes
-PrivateTmp=yes
-ProtectSystem=strict
-ProtectHome=read-only
-ProtectKernelTunables=yes
-ProtectKernelModules=yes
-ProtectControlGroups=yes
-RestrictRealtime=yes
-RestrictSUIDSGID=yes
-ReadWritePaths=%[4]s
-
-[Install]
-WantedBy=multi-user.target
-`, ssg.oramaHome, args, logFile, dataDir, rqliteBinary)
-}
-
-// GenerateOlricService generates the Olric systemd unit
-func (ssg *SystemdServiceGenerator) GenerateOlricService(olricBinary string) string {
-	olricConfigPath := filepath.Join(ssg.oramaDir, "configs", "olric", "config.yaml")
-	logFile := filepath.Join(ssg.oramaDir, "logs", "olric.log")
-
-	return fmt.Sprintf(`[Unit]
-Description=Olric Cache Server
-After=network-online.target
-Wants=network-online.target
-
-[Service]
-Type=simple
-User=debros
-Group=debros
-Environment=HOME=%[1]s
-Environment=OLRIC_SERVER_CONFIG=%[2]s
-ExecStart=%[5]s
-Restart=always
-RestartSec=5
-StandardOutput=append:%[3]s
-StandardError=append:%[3]s
-SyslogIdentifier=olric
-
-NoNewPrivileges=yes
-PrivateTmp=yes
-ProtectSystem=strict
-ProtectHome=read-only
-ProtectKernelTunables=yes
-ProtectKernelModules=yes
-ProtectControlGroups=yes
-RestrictRealtime=yes
-RestrictSUIDSGID=yes
-ReadWritePaths=%[4]s
-
-[Install]
-WantedBy=multi-user.target
-`, ssg.oramaHome, olricConfigPath, logFile, ssg.oramaDir, olricBinary)
-}
-
-// GenerateNodeService generates the DeBros Node systemd unit
-func (ssg *SystemdServiceGenerator) GenerateNodeService() string {
-	configFile := "node.yaml"
-	logFile := filepath.Join(ssg.oramaDir, "logs", "node.log")
-	// Note: systemd StandardOutput/StandardError paths should not contain substitution variables
-	// Use absolute paths directly as they will be resolved by systemd at runtime
-
-	return fmt.Sprintf(`[Unit]
-Description=DeBros Network Node
-After=debros-ipfs-cluster.service debros-olric.service
-Wants=debros-ipfs-cluster.service debros-olric.service
-
-[Service]
-Type=simple
-User=debros
-Group=debros
-WorkingDirectory=%[1]s
-Environment=HOME=%[1]s
-ExecStart=%[1]s/bin/orama-node --config %[2]s/configs/%[3]s
-Restart=always
-RestartSec=5
-StandardOutput=append:%[4]s
-StandardError=append:%[4]s
-SyslogIdentifier=debros-node
-
-AmbientCapabilities=CAP_NET_BIND_SERVICE
-CapabilityBoundingSet=CAP_NET_BIND_SERVICE
-
-PrivateTmp=yes
-ProtectSystem=strict
-ProtectHome=read-only
-ProtectKernelTunables=yes
-ProtectKernelModules=yes
-ProtectControlGroups=yes
-RestrictRealtime=yes
-RestrictSUIDSGID=yes
-ReadWritePaths=%[2]s
-
-[Install]
-WantedBy=multi-user.target
-`, ssg.oramaHome, ssg.oramaDir, configFile, logFile)
-}
-
-// GenerateGatewayService generates the DeBros Gateway systemd unit
-func (ssg *SystemdServiceGenerator) GenerateGatewayService() string {
-	logFile := filepath.Join(ssg.oramaDir, "logs", "gateway.log")
-	return fmt.Sprintf(`[Unit]
-Description=DeBros Gateway
-After=debros-node.service debros-olric.service
-Wants=debros-node.service debros-olric.service
-
-[Service]
-Type=simple
-User=debros
-Group=debros
-WorkingDirectory=%[1]s
-Environment=HOME=%[1]s
-ExecStart=%[1]s/bin/gateway --config %[2]s/data/gateway.yaml
-Restart=always
-RestartSec=5
-StandardOutput=append:%[3]s
-StandardError=append:%[3]s
-SyslogIdentifier=debros-gateway
-
-AmbientCapabilities=CAP_NET_BIND_SERVICE
-CapabilityBoundingSet=CAP_NET_BIND_SERVICE
-
-# Note: NoNewPrivileges is omitted because it conflicts with AmbientCapabilities
-# The service needs CAP_NET_BIND_SERVICE to bind to privileged ports (80, 443)
-PrivateTmp=yes
-ProtectSystem=strict
-ProtectHome=read-only
-ProtectKernelTunables=yes
-ProtectKernelModules=yes
-ProtectControlGroups=yes
-RestrictRealtime=yes
-RestrictSUIDSGID=yes
-ReadWritePaths=%[2]s
-
-[Install]
-WantedBy=multi-user.target
-`, ssg.oramaHome, ssg.oramaDir, logFile)
-}
-
-// GenerateAnyoneClientService generates the Anyone Client SOCKS5 proxy systemd unit
-func (ssg *SystemdServiceGenerator) GenerateAnyoneClientService() string {
-	logFile := filepath.Join(ssg.oramaDir, "logs", "anyone-client.log")
-
-	return fmt.Sprintf(`[Unit]
-Description=Anyone Client SOCKS5 Proxy
-After=network-online.target
-Wants=network-online.target
-
-[Service]
-Type=simple
-User=debros
-Group=debros
-Environment=HOME=%[1]s
-Environment=PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/local/lib/node_modules/.bin
-WorkingDirectory=%[1]s
-ExecStart=/usr/bin/npx anyone-client
-Restart=always
-RestartSec=5
-StandardOutput=append:%[2]s
-StandardError=append:%[2]s
-SyslogIdentifier=anyone-client
-
-NoNewPrivileges=yes
-PrivateTmp=yes
-ProtectSystem=strict
-ProtectHome=no
-ProtectKernelTunables=yes
-ProtectKernelModules=yes
-ProtectControlGroups=yes
-RestrictRealtime=yes
-RestrictSUIDSGID=yes
-ReadWritePaths=%[3]s
-
-[Install]
-WantedBy=multi-user.target
-`, ssg.oramaHome, logFile, ssg.oramaDir)
-}
-
-// SystemdController manages systemd service operations
-type SystemdController struct {
-	systemdDir string
-}
-
-// NewSystemdController creates a new controller
-func NewSystemdController() *SystemdController {
-	return &SystemdController{
-		systemdDir: "/etc/systemd/system",
-	}
-}
-
-// WriteServiceUnit writes a systemd unit file
-func (sc *SystemdController) WriteServiceUnit(name string, content string) error {
-	unitPath := filepath.Join(sc.systemdDir, name)
-	if err := os.WriteFile(unitPath, []byte(content), 0644); err != nil {
-		return fmt.Errorf("failed to write unit file %s: %w", name, err)
-	}
-	return nil
-}
-
-// DaemonReload reloads the systemd daemon
-func (sc *SystemdController) DaemonReload() error {
-	cmd := exec.Command("systemctl", "daemon-reload")
-	if err := cmd.Run(); err != nil {
-		return fmt.Errorf("failed to reload systemd daemon: %w", err)
-	}
-	return nil
-}
-
-// EnableService enables a service to start on boot
-func (sc *SystemdController) EnableService(name string) error {
-	cmd := exec.Command("systemctl", "enable", name)
-	if err := cmd.Run(); err != nil {
-		return fmt.Errorf("failed to enable service %s: %w", name, err)
-	}
-	return nil
-}
-
-// StartService starts a service immediately
-func (sc *SystemdController) StartService(name string) error {
-	cmd := exec.Command("systemctl", "start", name)
-	if err := cmd.Run(); err != nil {
-		return fmt.Errorf("failed to start service %s: %w", name, err)
-	}
-	return nil
-}
-
-// RestartService restarts a service
-func (sc *SystemdController) RestartService(name string) error {
-	cmd := exec.Command("systemctl", "restart", name)
-	if err := cmd.Run(); err != nil {
-		return fmt.Errorf("failed to restart service %s: %w", name, err)
-	}
-	return nil
-}
-
-// StopService stops a service
-func (sc *SystemdController) StopService(name string) error {
-	cmd := exec.Command("systemctl", "stop", name)
-	if err := cmd.Run(); err != nil {
-		return fmt.Errorf("failed to stop service %s: %w", name, err)
-	}
-	return nil
-}
-
-// StatusService gets the status of a service
-func (sc *SystemdController) StatusService(name string) (bool, error) {
-	cmd := exec.Command("systemctl", "is-active", "--quiet", name)
-	err := cmd.Run()
-	if err == nil {
-		return true, nil
-	}
-
-	// Check for "inactive" vs actual error
-	if strings.Contains(err.Error(), "exit status 3") {
-		return false, nil // Service is inactive
-	}
-
-	return false, fmt.Errorf("failed to check service status %s: %w", name, err)
-}

pkg/environments/production/services_test.go

@@ -1,109 +0,0 @@
-package production
-
-import (
-	"strings"
-	"testing"
-)
-
-// TestGenerateRQLiteService verifies RQLite service generation with advertise IP and join address
-func TestGenerateRQLiteService(t *testing.T) {
-	tests := []struct {
-		name              string
-		joinAddr          string
-		advertiseIP       string
-		expectJoinInUnit  bool
-		expectAdvertiseIP string
-	}{
-		{
-			name:              "first node with localhost advertise",
-			joinAddr:          "",
-			advertiseIP:       "",
-			expectJoinInUnit:  false,
-			expectAdvertiseIP: "127.0.0.1",
-		},
-		{
-			name:              "first node with public IP advertise",
-			joinAddr:          "",
-			advertiseIP:       "10.0.0.1",
-			expectJoinInUnit:  false,
-			expectAdvertiseIP: "10.0.0.1",
-		},
-		{
-			name:              "node joining cluster",
-			joinAddr:          "10.0.0.1:7001",
-			advertiseIP:       "10.0.0.2",
-			expectJoinInUnit:  true,
-			expectAdvertiseIP: "10.0.0.2",
-		},
-		{
-			name:              "node with localhost (should still include join)",
-			joinAddr:          "localhost:7001",
-			advertiseIP:       "127.0.0.1",
-			expectJoinInUnit:  true,
-			expectAdvertiseIP: "127.0.0.1",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			ssg := &SystemdServiceGenerator{
-				oramaHome: "/home/debros",
-				oramaDir:  "/home/debros/.orama",
-			}
-
-			unit := ssg.GenerateRQLiteService("/usr/local/bin/rqlited", 5001, 7001, tt.joinAddr, tt.advertiseIP)
-
-			// Check advertise IP is present
-			expectedAdvertise := tt.expectAdvertiseIP + ":5001"
-			if !strings.Contains(unit, expectedAdvertise) {
-				t.Errorf("expected advertise address %q in unit, got:\n%s", expectedAdvertise, unit)
-			}
-
-			// Check raft advertise IP is present
-			expectedRaftAdvertise := tt.expectAdvertiseIP + ":7001"
-			if !strings.Contains(unit, expectedRaftAdvertise) {
-				t.Errorf("expected raft advertise address %q in unit, got:\n%s", expectedRaftAdvertise, unit)
-			}
-
-			// Check join flag presence
-			hasJoin := strings.Contains(unit, "-join")
-			if hasJoin != tt.expectJoinInUnit {
-				t.Errorf("expected join in unit: %v, hasJoin: %v\nUnit:\n%s", tt.expectJoinInUnit, hasJoin, unit)
-			}
-
-			if tt.expectJoinInUnit && tt.joinAddr != "" && !strings.Contains(unit, tt.joinAddr) {
-				t.Errorf("expected join address %q in unit, not found", tt.joinAddr)
-			}
-		})
-	}
-}
-
-// TestGenerateRQLiteServiceArgs verifies the ExecStart command arguments
-func TestGenerateRQLiteServiceArgs(t *testing.T) {
-	ssg := &SystemdServiceGenerator{
-		oramaHome: "/home/debros",
-		oramaDir:  "/home/debros/.orama",
-	}
-
-	unit := ssg.GenerateRQLiteService("/usr/local/bin/rqlited", 5001, 7001, "10.0.0.1:7001", "10.0.0.2")
-
-	// Verify essential flags are present (localhost binding for security)
-	if !strings.Contains(unit, "-http-addr 127.0.0.1:5001") {
-		t.Error("missing -http-addr 127.0.0.1:5001")
-	}
-	if !strings.Contains(unit, "-http-adv-addr 10.0.0.2:5001") {
-		t.Error("missing -http-adv-addr 10.0.0.2:5001")
-	}
-	if !strings.Contains(unit, "-raft-addr 127.0.0.1:7001") {
-		t.Error("missing -raft-addr 127.0.0.1:7001")
-	}
-	if !strings.Contains(unit, "-raft-adv-addr 10.0.0.2:7001") {
-		t.Error("missing -raft-adv-addr 10.0.0.2:7001")
-	}
-	if !strings.Contains(unit, "-join 10.0.0.1:7001") {
-		t.Error("missing -join 10.0.0.1:7001")
-	}
-	if !strings.Contains(unit, "-join-attempts 30") {
-		t.Error("missing -join-attempts 30")
-	}
-}

pkg/environments/templates/gateway.yaml

@@ -1,19 +0,0 @@
-listen_addr: ":{{.ListenPort}}"
-client_namespace: "default"
-rqlite_dsn: "{{.RQLiteDSN}}"
-bootstrap_peers:
-{{range .BootstrapPeers}}  - "{{.}}"
-{{end}}
-enable_https: {{.EnableHTTPS}}
-{{if .EnableHTTPS}}domain_name: "{{.DomainName}}"
-tls_cache_dir: "{{.TLSCacheDir}}"
-{{end}}
-olric_servers:
-{{range .OlricServers}}  - "{{.}}"
-{{end}}
-olric_timeout: "10s"
-ipfs_cluster_api_url: "http://localhost:{{.ClusterAPIPort}}"
-ipfs_api_url: "http://localhost:{{.IPFSAPIPort}}"
-ipfs_timeout: "60s"
-ipfs_replication_factor: 3
-

pkg/environments/templates/node.yaml

@@ -1,88 +0,0 @@
-node:
-  id: "{{.NodeID}}"
-  listen_addresses:
-    - "/ip4/0.0.0.0/tcp/{{.P2PPort}}"
-  data_dir: "{{.DataDir}}"
-  max_connections: 50
-  domain: "{{.Domain}}"
-
-database:
-  data_dir: "{{.DataDir}}/rqlite"
-  replication_factor: 3
-  shard_count: 16
-  max_database_size: 1073741824
-  backup_interval: "24h"
-  rqlite_port: {{.RQLiteHTTPPort}}
-  rqlite_raft_port: {{.RQLiteRaftInternalPort}}
-  rqlite_join_address: "{{.RQLiteJoinAddress}}"
-  {{if .NodeCert}}# Node-to-node TLS encryption for Raft communication (direct RQLite TLS on port 7002)
-  node_cert: "{{.NodeCert}}"
-  node_key: "{{.NodeKey}}"
-  {{if .NodeCACert}}node_ca_cert: "{{.NodeCACert}}"
-  {{end}}{{if .NodeNoVerify}}node_no_verify: true
-  {{end}}{{end}}cluster_sync_interval: "30s"
-  peer_inactivity_limit: "24h"
-  min_cluster_size: 1
-  ipfs:
-    cluster_api_url: "http://localhost:{{.ClusterAPIPort}}"
-    api_url: "http://localhost:{{.IPFSAPIPort}}"
-    timeout: "60s"
-    replication_factor: 3
-    enable_encryption: true
-
-discovery:
-  bootstrap_peers:
-{{range .BootstrapPeers}}    - "{{.}}"
-{{end}}
-  discovery_interval: "15s"
-  bootstrap_port: {{.P2PPort}}
-  http_adv_address: "{{.HTTPAdvAddress}}"
-  raft_adv_address: "{{.RaftAdvAddress}}"
-  node_namespace: "default"
-
-security:
-  enable_tls: false
-
-logging:
-  level: "info"
-  format: "console"
-
-http_gateway:
-  enabled: true
-  listen_addr: "{{if .EnableHTTPS}}:{{.HTTPSPort}}{{else}}:{{.UnifiedGatewayPort}}{{end}}"
-  node_name: "{{.NodeID}}"
-  
-  {{if .EnableHTTPS}}https:
-    enabled: true
-    domain: "{{.Domain}}"
-    auto_cert: true
-    cache_dir: "{{.TLSCacheDir}}"
-    http_port: {{.HTTPPort}}
-    https_port: {{.HTTPSPort}}
-    email: "admin@{{.Domain}}"
-  {{end}}
-  
-  {{if .EnableHTTPS}}sni:
-    enabled: true
-    listen_addr: ":{{.RQLiteRaftPort}}"
-    cert_file: "{{.TLSCacheDir}}/{{.Domain}}.crt"
-    key_file: "{{.TLSCacheDir}}/{{.Domain}}.key"
-    routes:
-      # Note: Raft traffic bypasses SNI gateway - RQLite uses native TLS on port 7002
-      ipfs.{{.Domain}}: "localhost:4101"
-      ipfs-cluster.{{.Domain}}: "localhost:9098"
-      olric.{{.Domain}}: "localhost:3322"
-  {{end}}
-  
-  # Full gateway configuration (for API, auth, pubsub, and internal service routing)
-  client_namespace: "default"
-  rqlite_dsn: "http://localhost:{{.RQLiteHTTPPort}}"
-  olric_servers:
-    - "127.0.0.1:3320"
-  olric_timeout: "10s"
-  ipfs_cluster_api_url: "http://localhost:{{.ClusterAPIPort}}"
-  ipfs_api_url: "http://localhost:{{.IPFSAPIPort}}"
-  ipfs_timeout: "60s"
-  
-  # Routes for internal service reverse proxy (kept for backwards compatibility but not used by full gateway)
-  routes: {}

pkg/environments/templates/olric.yaml

@@ -1,8 +0,0 @@
-server:
-  bindAddr: "{{.ServerBindAddr}}"
-  bindPort: { { .HTTPPort } }
-
-memberlist:
-  environment: { { .MemberlistEnvironment } }
-  bindAddr: "{{.MemberlistBindAddr}}"
-  bindPort: { { .MemberlistPort } }

pkg/environments/templates/render.go

@@ -1,174 +0,0 @@
-package templates
-
-import (
-	"bytes"
-	"embed"
-	"fmt"
-	"regexp"
-	"text/template"
-)
-
-//go:embed *.yaml *.service
-var templatesFS embed.FS
-
-// NodeConfigData holds parameters for node.yaml rendering (unified - no bootstrap/node distinction)
-type NodeConfigData struct {
-	NodeID                 string
-	P2PPort                int
-	DataDir                string
-	RQLiteHTTPPort         int
-	RQLiteRaftPort         int // External Raft port for advertisement (7001 for SNI)
-	RQLiteRaftInternalPort int // Internal Raft port for local binding (7002 when SNI enabled)
-	RQLiteJoinAddress      string   // Optional: join address for joining existing cluster
-	BootstrapPeers         []string // List of peer multiaddrs to connect to
-	ClusterAPIPort         int
-	IPFSAPIPort            int    // Default: 4501
-	HTTPAdvAddress         string // Advertised HTTP address (IP:port)
-	RaftAdvAddress         string // Advertised Raft address (IP:port or domain:port for SNI)
-	UnifiedGatewayPort     int    // Unified gateway port for all node services
-	Domain                 string // Domain for this node (e.g., node-123.orama.network)
-	EnableHTTPS            bool   // Enable HTTPS/TLS with ACME
-	TLSCacheDir            string // Directory for ACME certificate cache
-	HTTPPort               int    // HTTP port for ACME challenges (usually 80)
-	HTTPSPort              int    // HTTPS port (usually 443)
-
-	// Node-to-node TLS encryption for RQLite Raft communication
-	// Required when using SNI gateway for Raft traffic routing
-	NodeCert     string // Path to X.509 certificate for node-to-node communication
-	NodeKey      string // Path to X.509 private key for node-to-node communication
-	NodeCACert   string // Path to CA certificate (optional)
-	NodeNoVerify bool   // Skip certificate verification (for self-signed certs)
-}
-
-// GatewayConfigData holds parameters for gateway.yaml rendering
-type GatewayConfigData struct {
-	ListenPort     int
-	BootstrapPeers []string
-	OlricServers   []string
-	ClusterAPIPort int
-	IPFSAPIPort    int // Default: 4501
-	EnableHTTPS    bool
-	DomainName     string
-	TLSCacheDir    string
-	RQLiteDSN      string
-}
-
-// OlricConfigData holds parameters for olric.yaml rendering
-type OlricConfigData struct {
-	ServerBindAddr        string // HTTP API bind address (127.0.0.1 for security)
-	HTTPPort              int
-	MemberlistBindAddr    string // Memberlist bind address (0.0.0.0 for clustering)
-	MemberlistPort        int
-	MemberlistEnvironment string // "local", "lan", or "wan"
-}
-
-// SystemdIPFSData holds parameters for systemd IPFS service rendering
-type SystemdIPFSData struct {
-	HomeDir      string
-	IPFSRepoPath string
-	SecretsDir   string
-	OramaDir    string
-}
-
-// SystemdIPFSClusterData holds parameters for systemd IPFS Cluster service rendering
-type SystemdIPFSClusterData struct {
-	HomeDir     string
-	ClusterPath string
-	OramaDir   string
-}
-
-// SystemdOlricData holds parameters for systemd Olric service rendering
-type SystemdOlricData struct {
-	HomeDir    string
-	ConfigPath string
-	OramaDir  string
-}
-
-// SystemdNodeData holds parameters for systemd Node service rendering
-type SystemdNodeData struct {
-	HomeDir    string
-	ConfigFile string
-	OramaDir  string
-}
-
-// SystemdGatewayData holds parameters for systemd Gateway service rendering
-type SystemdGatewayData struct {
-	HomeDir   string
-	OramaDir string
-}
-
-// RenderNodeConfig renders the node config template with the given data
-func RenderNodeConfig(data NodeConfigData) (string, error) {
-	return renderTemplate("node.yaml", data)
-}
-
-// RenderGatewayConfig renders the gateway config template with the given data
-func RenderGatewayConfig(data GatewayConfigData) (string, error) {
-	return renderTemplate("gateway.yaml", data)
-}
-
-// RenderOlricConfig renders the olric config template with the given data
-func RenderOlricConfig(data OlricConfigData) (string, error) {
-	return renderTemplate("olric.yaml", data)
-}
-
-// RenderIPFSService renders the IPFS systemd service template
-func RenderIPFSService(data SystemdIPFSData) (string, error) {
-	return renderTemplate("systemd_ipfs.service", data)
-}
-
-// RenderIPFSClusterService renders the IPFS Cluster systemd service template
-func RenderIPFSClusterService(data SystemdIPFSClusterData) (string, error) {
-	return renderTemplate("systemd_ipfs_cluster.service", data)
-}
-
-// RenderOlricService renders the Olric systemd service template
-func RenderOlricService(data SystemdOlricData) (string, error) {
-	return renderTemplate("systemd_olric.service", data)
-}
-
-// RenderNodeService renders the DeBros Node systemd service template
-func RenderNodeService(data SystemdNodeData) (string, error) {
-	return renderTemplate("systemd_node.service", data)
-}
-
-// RenderGatewayService renders the DeBros Gateway systemd service template
-func RenderGatewayService(data SystemdGatewayData) (string, error) {
-	return renderTemplate("systemd_gateway.service", data)
-}
-
-// normalizeTemplate normalizes template placeholders from spaced format { { .Var } } to {{.Var}}
-func normalizeTemplate(content string) string {
-	// Match patterns like { { .Variable } } or { {.Variable} } or { { .Variable} } etc.
-	// and convert them to {{.Variable}}
-	// Pattern matches: { { .Something } } -> {{.Something}}
-	// This regex specifically matches Go template variables (starting with .)
-	re := regexp.MustCompile(`\{\s*\{\s*(\.\S+)\s*\}\s*\}`)
-	normalized := re.ReplaceAllString(content, "{{$1}}")
-	return normalized
-}
-
-// renderTemplate is a helper that renders any template from the embedded FS
-func renderTemplate(name string, data interface{}) (string, error) {
-	// Read template content
-	tmplBytes, err := templatesFS.ReadFile(name)
-	if err != nil {
-		return "", fmt.Errorf("failed to read template %s: %w", name, err)
-	}
-
-	// Normalize template content to handle both { { .Var } } and {{.Var}} formats
-	normalizedContent := normalizeTemplate(string(tmplBytes))
-
-	// Parse normalized template
-	tmpl, err := template.New(name).Parse(normalizedContent)
-	if err != nil {
-		return "", fmt.Errorf("failed to parse template %s: %w", name, err)
-	}
-
-	var buf bytes.Buffer
-	if err := tmpl.Execute(&buf, data); err != nil {
-		return "", fmt.Errorf("failed to render template %s: %w", name, err)
-	}
-
-	return buf.String(), nil
-}

pkg/environments/templates/render_test.go

@@ -1,133 +0,0 @@
-package templates
-
-import (
-	"strings"
-	"testing"
-)
-
-func TestRenderNodeConfig(t *testing.T) {
-	bootstrapMultiaddr := "/ip4/127.0.0.1/tcp/4001/p2p/Qm1234567890"
-	data := NodeConfigData{
-		NodeID:            "node2",
-		P2PPort:           4002,
-		DataDir:           "/home/debros/.orama/node2",
-		RQLiteHTTPPort:    5002,
-		RQLiteRaftPort:    7002,
-		RQLiteJoinAddress: "localhost:5001",
-		BootstrapPeers:    []string{bootstrapMultiaddr},
-		ClusterAPIPort:    9104,
-		IPFSAPIPort:       5002,
-	}
-
-	result, err := RenderNodeConfig(data)
-	if err != nil {
-		t.Fatalf("RenderNodeConfig failed: %v", err)
-	}
-
-	// Check for required fields
-	checks := []string{
-		"id: \"node2\"",
-		"tcp/4002",
-		"rqlite_port: 5002",
-		"rqlite_join_address: \"localhost:5001\"",
-		bootstrapMultiaddr,
-		"cluster_api_url: \"http://localhost:9104\"",
-	}
-
-	for _, check := range checks {
-		if !strings.Contains(result, check) {
-			t.Errorf("Node config missing: %s", check)
-		}
-	}
-}
-
-func TestRenderGatewayConfig(t *testing.T) {
-	bootstrapMultiaddr := "/ip4/127.0.0.1/tcp/4001/p2p/Qm1234567890"
-	data := GatewayConfigData{
-		ListenPort:     6001,
-		BootstrapPeers: []string{bootstrapMultiaddr},
-		OlricServers:   []string{"127.0.0.1:3320"},
-		ClusterAPIPort: 9094,
-		IPFSAPIPort:    5001,
-	}
-
-	result, err := RenderGatewayConfig(data)
-	if err != nil {
-		t.Fatalf("RenderGatewayConfig failed: %v", err)
-	}
-
-	// Check for required fields
-	checks := []string{
-		"listen_addr: \":6001\"",
-		bootstrapMultiaddr,
-		"127.0.0.1:3320",
-		"ipfs_cluster_api_url: \"http://localhost:9094\"",
-		"ipfs_api_url: \"http://localhost:5001\"",
-	}
-
-	for _, check := range checks {
-		if !strings.Contains(result, check) {
-			t.Errorf("Gateway config missing: %s", check)
-		}
-	}
-}
-
-func TestRenderOlricConfig(t *testing.T) {
-	data := OlricConfigData{
-		ServerBindAddr:        "127.0.0.1",
-		HTTPPort:              3320,
-		MemberlistBindAddr:    "0.0.0.0",
-		MemberlistPort:        3322,
-		MemberlistEnvironment: "lan",
-	}
-
-	result, err := RenderOlricConfig(data)
-	if err != nil {
-		t.Fatalf("RenderOlricConfig failed: %v", err)
-	}
-
-	// Check for required fields
-	checks := []string{
-		"bindAddr: \"127.0.0.1\"",
-		"bindPort: 3320",
-		"memberlist",
-		"bindPort: 3322",
-		"environment: lan",
-	}
-
-	for _, check := range checks {
-		if !strings.Contains(result, check) {
-			t.Errorf("Olric config missing: %s", check)
-		}
-	}
-}
-
-func TestRenderWithMultipleBootstrapPeers(t *testing.T) {
-	peers := []string{
-		"/ip4/127.0.0.1/tcp/4001/p2p/Qm1111",
-		"/ip4/127.0.0.1/tcp/4002/p2p/Qm2222",
-	}
-
-	data := NodeConfigData{
-		NodeID:            "node-test",
-		P2PPort:           4002,
-		DataDir:           "/test/data",
-		RQLiteHTTPPort:    5002,
-		RQLiteRaftPort:    7002,
-		RQLiteJoinAddress: "localhost:5001",
-		BootstrapPeers:    peers,
-		ClusterAPIPort:    9104,
-		IPFSAPIPort:       5002,
-	}
-
-	result, err := RenderNodeConfig(data)
-	if err != nil {
-		t.Fatalf("RenderNodeConfig with multiple peers failed: %v", err)
-	}
-
-	for _, peer := range peers {
-		if !strings.Contains(result, peer) {
-			t.Errorf("Bootstrap peer missing: %s", peer)
-		}
-	}
-}

pkg/environments/templates/systemd_gateway.service

@@ -1,29 +0,0 @@
-[Unit]
-Description=DeBros Gateway
-After=debros-node.service
-Wants=debros-node.service
-
-[Service]
-Type=simple
-User=debros
-Group=debros
-WorkingDirectory={{.HomeDir}}
-Environment=HOME={{.HomeDir}}
-ExecStart={{.HomeDir}}/bin/gateway --config {{.OramaDir}}/data/gateway.yaml
-Restart=always
-RestartSec=5
-StandardOutput=journal
-StandardError=journal
-SyslogIdentifier=debros-gateway
-
-AmbientCapabilities=CAP_NET_BIND_SERVICE
-CapabilityBoundingSet=CAP_NET_BIND_SERVICE
-
-NoNewPrivileges=yes
-PrivateTmp=yes
-ProtectSystem=strict
-ReadWritePaths={{.OramaDir}}
-
-[Install]
-WantedBy=multi-user.target
-

pkg/environments/templates/systemd_ipfs.service

@@ -1,27 +0,0 @@
-[Unit]
-Description=IPFS Daemon ({{.NodeType}})
-After=network-online.target
-Wants=network-online.target
-
-[Service]
-Type=simple
-User=debros
-Group=debros
-Environment=HOME={{.HomeDir}}
-Environment=IPFS_PATH={{.IPFSRepoPath}}
-ExecStartPre=/bin/bash -c 'if [ -f {{.SecretsDir}}/swarm.key ] && [ ! -f {{.IPFSRepoPath}}/swarm.key ]; then cp {{.SecretsDir}}/swarm.key {{.IPFSRepoPath}}/swarm.key && chmod 600 {{.IPFSRepoPath}}/swarm.key; fi'
-ExecStart=/usr/bin/ipfs daemon --enable-pubsub-experiment --repo-dir={{.IPFSRepoPath}}
-Restart=always
-RestartSec=5
-StandardOutput=journal
-StandardError=journal
-SyslogIdentifier=ipfs-{{.NodeType}}
-
-NoNewPrivileges=yes
-PrivateTmp=yes
-ProtectSystem=strict
-ReadWritePaths={{.OramaDir}}
-
-[Install]
-WantedBy=multi-user.target
-

pkg/environments/templates/systemd_ipfs_cluster.service

@@ -1,28 +0,0 @@
-[Unit]
-Description=IPFS Cluster Service ({{.NodeType}})
-After=debros-ipfs-{{.NodeType}}.service
-Wants=debros-ipfs-{{.NodeType}}.service
-Requires=debros-ipfs-{{.NodeType}}.service
-
-[Service]
-Type=simple
-User=debros
-Group=debros
-WorkingDirectory={{.HomeDir}}
-Environment=HOME={{.HomeDir}}
-Environment=CLUSTER_PATH={{.ClusterPath}}
-ExecStart=/usr/local/bin/ipfs-cluster-service daemon --config {{.ClusterPath}}/service.json
-Restart=always
-RestartSec=5
-StandardOutput=journal
-StandardError=journal
-SyslogIdentifier=ipfs-cluster-{{.NodeType}}
-
-NoNewPrivileges=yes
-PrivateTmp=yes
-ProtectSystem=strict
-ReadWritePaths={{.OramaDir}}
-
-[Install]
-WantedBy=multi-user.target
-

pkg/environments/templates/systemd_node.service

@@ -1,27 +0,0 @@
-[Unit]
-Description=DeBros Network Node ({{.NodeType}})
-After=debros-ipfs-cluster-{{.NodeType}}.service
-Wants=debros-ipfs-cluster-{{.NodeType}}.service
-Requires=debros-ipfs-cluster-{{.NodeType}}.service
-
-[Service]
-Type=simple
-User=debros
-Group=debros
-WorkingDirectory={{.HomeDir}}
-Environment=HOME={{.HomeDir}}
-ExecStart={{.HomeDir}}/bin/orama-node --config {{.OramaDir}}/configs/{{.ConfigFile}}
-Restart=always
-RestartSec=5
-StandardOutput=journal
-StandardError=journal
-SyslogIdentifier=debros-node-{{.NodeType}}
-
-NoNewPrivileges=yes
-PrivateTmp=yes
-ProtectSystem=strict
-ReadWritePaths={{.OramaDir}}
-
-[Install]
-WantedBy=multi-user.target
-

pkg/environments/templates/systemd_olric.service

@@ -1,26 +0,0 @@
-[Unit]
-Description=Olric Cache Server
-After=network-online.target
-Wants=network-online.target
-
-[Service]
-Type=simple
-User=debros
-Group=debros
-Environment=HOME={{.HomeDir}}
-Environment=OLRIC_SERVER_CONFIG={{.ConfigPath}}
-ExecStart=/usr/local/bin/olric-server
-Restart=always
-RestartSec=5
-StandardOutput=journal
-StandardError=journal
-SyslogIdentifier=olric
-
-NoNewPrivileges=yes
-PrivateTmp=yes
-ProtectSystem=strict
-ReadWritePaths={{.OramaDir}}
-
-[Install]
-WantedBy=multi-user.target
-

pkg/gateway/anon_proxy_handler.go

@@ -1,264 +0,0 @@
-package gateway
-
-import (
-	"encoding/base64"
-	"encoding/json"
-	"fmt"
-	"io"
-	"net/http"
-	"net/url"
-	"strings"
-	"time"
-
-	"github.com/DeBrosOfficial/network/pkg/anyoneproxy"
-	"github.com/DeBrosOfficial/network/pkg/logging"
-	"go.uber.org/zap"
-)
-
-// anonProxyRequest represents the JSON payload for proxy requests
-type anonProxyRequest struct {
-	URL     string            `json:"url"`
-	Method  string            `json:"method"`
-	Headers map[string]string `json:"headers,omitempty"`
-	Body    string            `json:"body,omitempty"`
-}
-
-// anonProxyResponse represents the JSON response from proxy requests
-type anonProxyResponse struct {
-	StatusCode int               `json:"status_code"`
-	Headers    map[string]string `json:"headers"`
-	Body       string            `json:"body"`
-	Error      string            `json:"error,omitempty"`
-}
-
-const (
-	maxProxyRequestSize = 10 * 1024 * 1024 // 10MB
-	maxProxyTimeout     = 60 * time.Second
-)
-
-// anonProxyHandler handles proxied HTTP requests through the Anyone network
-func (g *Gateway) anonProxyHandler(w http.ResponseWriter, r *http.Request) {
-	// Only accept POST requests
-	if r.Method != http.MethodPost {
-		writeError(w, http.StatusMethodNotAllowed, "only POST method is allowed")
-		return
-	}
-
-	// Limit request body size
-	r.Body = http.MaxBytesReader(w, r.Body, maxProxyRequestSize)
-
-	// Parse request payload
-	var req anonProxyRequest
-	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		writeError(w, http.StatusBadRequest, fmt.Sprintf("invalid JSON payload: %v", err))
-		return
-	}
-
-	// Validate URL
-	targetURL, err := url.Parse(req.URL)
-	if err != nil {
-		writeError(w, http.StatusBadRequest, fmt.Sprintf("invalid URL: %v", err))
-		return
-	}
-
-	// Only allow HTTPS for external requests
-	if targetURL.Scheme != "https" && targetURL.Scheme != "http" {
-		writeError(w, http.StatusBadRequest, "only http/https schemes are allowed")
-		return
-	}
-
-	// Block requests to private/local addresses
-	if isPrivateOrLocalHost(targetURL.Host) {
-		writeError(w, http.StatusForbidden, "requests to private/local addresses are not allowed")
-		return
-	}
-
-	// Validate HTTP method
-	method := strings.ToUpper(req.Method)
-	if method == "" {
-		method = "GET"
-	}
-	allowedMethods := map[string]bool{
-		"GET":    true,
-		"POST":   true,
-		"PUT":    true,
-		"DELETE": true,
-		"PATCH":  true,
-		"HEAD":   true,
-	}
-	if !allowedMethods[method] {
-		writeError(w, http.StatusBadRequest, fmt.Sprintf("method %s not allowed", method))
-		return
-	}
-
-	// Check if Anyone proxy is running (after all validation)
-	if !anyoneproxy.Running() {
-		g.logger.ComponentWarn(logging.ComponentGeneral, "Anyone proxy not available",
-			zap.String("socks_addr", anyoneproxy.Address()))
-		writeJSON(w, http.StatusServiceUnavailable, anonProxyResponse{
-			Error: fmt.Sprintf("Anyone proxy not available at %s", anyoneproxy.Address()),
-		})
-		return
-	}
-
-	// Create HTTP client with Anyone proxy
-	client := anyoneproxy.NewHTTPClient()
-	client.Timeout = maxProxyTimeout
-
-	// Create the proxied request
-	var bodyReader io.Reader
-	if req.Body != "" {
-		bodyReader = strings.NewReader(req.Body)
-	}
-
-	proxyReq, err := http.NewRequestWithContext(r.Context(), method, req.URL, bodyReader)
-	if err != nil {
-		writeError(w, http.StatusInternalServerError, fmt.Sprintf("failed to create request: %v", err))
-		return
-	}
-
-	// Copy headers, excluding hop-by-hop headers
-	for key, value := range req.Headers {
-		if !isHopByHopHeader(key) {
-			proxyReq.Header.Set(key, value)
-		}
-	}
-
-	// Set default User-Agent if not provided
-	if proxyReq.Header.Get("User-Agent") == "" {
-		proxyReq.Header.Set("User-Agent", "DeBros-Gateway/1.0")
-	}
-
-	// Log the proxy request
-	g.logger.ComponentInfo(logging.ComponentGeneral, "proxying request through Anyone",
-		zap.String("method", method),
-		zap.String("url", req.URL),
-		zap.String("socks_addr", anyoneproxy.Address()))
-
-	// Execute the request
-	start := time.Now()
-	resp, err := client.Do(proxyReq)
-	duration := time.Since(start)
-
-	if err != nil {
-		g.logger.ComponentError(logging.ComponentGeneral, "proxy request failed",
-			zap.Error(err),
-			zap.String("url", req.URL),
-			zap.Duration("duration", duration))
-		writeJSON(w, http.StatusBadGateway, anonProxyResponse{
-			Error: fmt.Sprintf("proxy request failed: %v", err),
-		})
-		return
-	}
-	defer resp.Body.Close()
-
-	// Read response body
-	respBody, err := io.ReadAll(io.LimitReader(resp.Body, maxProxyRequestSize))
-	if err != nil {
-		g.logger.ComponentError(logging.ComponentGeneral, "failed to read proxy response",
-			zap.Error(err))
-		writeJSON(w, http.StatusBadGateway, anonProxyResponse{
-			Error: fmt.Sprintf("failed to read response: %v", err),
-		})
-		return
-	}
-
-	// Extract response headers (excluding hop-by-hop)
-	respHeaders := make(map[string]string)
-	for key, values := range resp.Header {
-		if !isHopByHopHeader(key) && len(values) > 0 {
-			respHeaders[key] = values[0]
-		}
-	}
-
-	g.logger.ComponentInfo(logging.ComponentGeneral, "proxy request completed",
-		zap.String("url", req.URL),
-		zap.Int("status", resp.StatusCode),
-		zap.Int("bytes", len(respBody)),
-		zap.Duration("duration", duration))
-
-	// Base64-encode the body to safely handle binary data in JSON
-	// This prevents corruption when binary data is converted to a string
-	bodyBase64 := base64.StdEncoding.EncodeToString(respBody)
-
-	// Return the proxied response
-	writeJSON(w, http.StatusOK, anonProxyResponse{
-		StatusCode: resp.StatusCode,
-		Headers:    respHeaders,
-		Body:       bodyBase64,
-	})
-}
-
-// isHopByHopHeader returns true for HTTP hop-by-hop headers that should not be forwarded
-func isHopByHopHeader(header string) bool {
-	hopByHop := map[string]bool{
-		"Connection":          true,
-		"Keep-Alive":          true,
-		"Proxy-Authenticate":  true,
-		"Proxy-Authorization": true,
-		"Te":                  true,
-		"Trailers":            true,
-		"Transfer-Encoding":   true,
-		"Upgrade":             true,
-	}
-	return hopByHop[http.CanonicalHeaderKey(header)]
-}
-
-// isPrivateOrLocalHost checks if a host is private, local, or loopback
-func isPrivateOrLocalHost(host string) bool {
-	// Strip port if present, handling IPv6 addresses properly
-	// IPv6 addresses in URLs are bracketed: [::1]:8080
-	if strings.HasPrefix(host, "[") {
-		// IPv6 address with brackets
-		if idx := strings.LastIndex(host, "]"); idx != -1 {
-			if idx+1 < len(host) && host[idx+1] == ':' {
-				// Port present, strip it
-				host = host[1:idx] // Remove brackets and port
-			} else {
-				// No port, just remove brackets
-				host = host[1:idx]
-			}
-		}
-	} else {
-		// IPv4 or hostname, check for port
-		if idx := strings.LastIndex(host, ":"); idx != -1 {
-			// Check if it's an IPv6 address without brackets (contains multiple colons)
-			colonCount := strings.Count(host, ":")
-			if colonCount == 1 {
-				// Single colon, likely IPv4 with port
-				host = host[:idx]
-			}
-			// If multiple colons, it's IPv6 without brackets and no port
-			// Leave host as-is
-		}
-	}
-
-	// Check for localhost variants
-	if host == "localhost" || host == "::1" {
-		return true
-	}
-
-	// Check common private ranges (basic check)
-	if strings.HasPrefix(host, "10.") ||
-		strings.HasPrefix(host, "192.168.") ||
-		strings.HasPrefix(host, "172.16.") ||
-		strings.HasPrefix(host, "172.17.") ||
-		strings.HasPrefix(host, "172.18.") ||
-		strings.HasPrefix(host, "172.19.") ||
-		strings.HasPrefix(host, "172.20.") ||
-		strings.HasPrefix(host, "172.21.") ||
-		strings.HasPrefix(host, "172.22.") ||
-		strings.HasPrefix(host, "172.23.") ||
-		strings.HasPrefix(host, "172.24.") ||
-		strings.HasPrefix(host, "172.25.") ||
-		strings.HasPrefix(host, "172.26.") ||
-		strings.HasPrefix(host, "172.27.") ||
-		strings.HasPrefix(host, "172.28.") ||
-		strings.HasPrefix(host, "172.29.") ||
-		strings.HasPrefix(host, "172.30.") ||
-		strings.HasPrefix(host, "172.31.") {
-		return true
-	}
-
-	return false
-}

pkg/gateway/anon_proxy_handler_test.go

@@ -1,189 +0,0 @@
-package gateway
-
-import (
-	"bytes"
-	"encoding/json"
-	"net/http"
-	"net/http/httptest"
-	"testing"
-
-	"github.com/DeBrosOfficial/network/pkg/logging"
-)
-
-func newTestGateway(t *testing.T) *Gateway {
-	logger, err := logging.NewColoredLogger(logging.ComponentGeneral, true)
-	if err != nil {
-		t.Fatalf("Failed to create logger: %v", err)
-	}
-	return &Gateway{logger: logger}
-}
-
-func TestAnonProxyHandler_MethodValidation(t *testing.T) {
-	gw := newTestGateway(t)
-
-	// Test GET request (should fail - only POST allowed)
-	req := httptest.NewRequest(http.MethodGet, "/v1/proxy/anon", nil)
-	w := httptest.NewRecorder()
-
-	gw.anonProxyHandler(w, req)
-
-	if w.Code != http.StatusMethodNotAllowed {
-		t.Errorf("Expected status %d, got %d", http.StatusMethodNotAllowed, w.Code)
-	}
-}
-
-func TestAnonProxyHandler_InvalidJSON(t *testing.T) {
-	gw := newTestGateway(t)
-
-	// Test invalid JSON
-	req := httptest.NewRequest(http.MethodPost, "/v1/proxy/anon", bytes.NewBufferString("invalid json"))
-	w := httptest.NewRecorder()
-
-	gw.anonProxyHandler(w, req)
-
-	if w.Code != http.StatusBadRequest {
-		t.Errorf("Expected status %d, got %d", http.StatusBadRequest, w.Code)
-	}
-}
-
-func TestAnonProxyHandler_InvalidURL(t *testing.T) {
-	gw := newTestGateway(t)
-
-	tests := []struct {
-		name    string
-		payload anonProxyRequest
-	}{
-		{
-			name: "invalid URL scheme",
-			payload: anonProxyRequest{
-				URL:    "ftp://example.com",
-				Method: "GET",
-			},
-		},
-		{
-			name: "malformed URL",
-			payload: anonProxyRequest{
-				URL:    "://invalid",
-				Method: "GET",
-			},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			body, _ := json.Marshal(tt.payload)
-			req := httptest.NewRequest(http.MethodPost, "/v1/proxy/anon", bytes.NewBuffer(body))
-			w := httptest.NewRecorder()
-
-			gw.anonProxyHandler(w, req)
-
-			if w.Code != http.StatusBadRequest {
-				t.Errorf("Expected status %d, got %d", http.StatusBadRequest, w.Code)
-			}
-		})
-	}
-}
-
-func TestAnonProxyHandler_PrivateAddressBlocking(t *testing.T) {
-	gw := newTestGateway(t)
-
-	tests := []struct {
-		name string
-		url  string
-	}{
-		{"localhost", "http://localhost/test"},
-		{"localhost", "http://localhost/test"},
-		{"private 10.x", "http://10.0.0.1/test"},
-		{"private 192.168.x", "http://192.168.1.1/test"},
-		{"private 172.16.x", "http://172.16.0.1/test"},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			payload := anonProxyRequest{
-				URL:    tt.url,
-				Method: "GET",
-			}
-			body, _ := json.Marshal(payload)
-			req := httptest.NewRequest(http.MethodPost, "/v1/proxy/anon", bytes.NewBuffer(body))
-			w := httptest.NewRecorder()
-
-			gw.anonProxyHandler(w, req)
-
-			if w.Code != http.StatusForbidden {
-				t.Errorf("Expected status %d for %s, got %d", http.StatusForbidden, tt.url, w.Code)
-			}
-		})
-	}
-}
-
-func TestAnonProxyHandler_InvalidMethod(t *testing.T) {
-	gw := newTestGateway(t)
-
-	payload := anonProxyRequest{
-		URL:    "https://example.com",
-		Method: "INVALID",
-	}
-	body, _ := json.Marshal(payload)
-	req := httptest.NewRequest(http.MethodPost, "/v1/proxy/anon", bytes.NewBuffer(body))
-	w := httptest.NewRecorder()
-
-	gw.anonProxyHandler(w, req)
-
-	if w.Code != http.StatusBadRequest {
-		t.Errorf("Expected status %d, got %d", http.StatusBadRequest, w.Code)
-	}
-}
-
-func TestIsHopByHopHeader(t *testing.T) {
-	tests := []struct {
-		header   string
-		expected bool
-	}{
-		{"Connection", true},
-		{"Keep-Alive", true},
-		{"Proxy-Authorization", true},
-		{"Transfer-Encoding", true},
-		{"Upgrade", true},
-		{"Content-Type", false},
-		{"Authorization", false},
-		{"User-Agent", false},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.header, func(t *testing.T) {
-			result := isHopByHopHeader(tt.header)
-			if result != tt.expected {
-				t.Errorf("isHopByHopHeader(%s) = %v, want %v", tt.header, result, tt.expected)
-			}
-		})
-	}
-}
-
-func TestIsPrivateOrLocalHost(t *testing.T) {
-	tests := []struct {
-		host     string
-		expected bool
-	}{
-		{"localhost", true},
-		{"localhost", true},
-		{"::1", true},
-		{"10.0.0.1", true},
-		{"192.168.1.1", true},
-		{"172.16.0.1", true},
-		{"172.31.255.255", true},
-		{"example.com", false},
-		{"8.8.8.8", false},
-		{"1.1.1.1", false},
-		{"172.32.0.1", false}, // Not in private range
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.host, func(t *testing.T) {
-			result := isPrivateOrLocalHost(tt.host)
-			if result != tt.expected {
-				t.Errorf("isPrivateOrLocalHost(%s) = %v, want %v", tt.host, result, tt.expected)
-			}
-		})
-	}
-}

pkg/gateway/auth_handlers.go

@@ -1,13 +1,11 @@
 package gateway
 
 import (
-	"crypto/ed25519"
 	"crypto/rand"
 	"encoding/base64"
 	"encoding/hex"
 	"encoding/json"
 	"fmt"
-	"math/big"
 	"net/http"
 	"strconv"
 	"strings"
@@ -114,11 +112,9 @@ func (g *Gateway) challengeHandler(w http.ResponseWriter, r *http.Request) {
 	nsID := nres.Rows[0][0]
 
 	// Store nonce with 5 minute expiry
-	// Normalize wallet address to lowercase for case-insensitive comparison
-	walletLower := strings.ToLower(strings.TrimSpace(req.Wallet))
 	if _, err := db.Query(internalCtx,
 		"INSERT INTO nonces(namespace_id, wallet, nonce, purpose, expires_at) VALUES (?, ?, ?, ?, datetime('now', '+5 minutes'))",
-		nsID, walletLower, nonce, req.Purpose,
+		nsID, req.Wallet, nonce, req.Purpose,
 	); err != nil {
 		writeError(w, http.StatusInternalServerError, err.Error())
 		return
@@ -147,7 +143,6 @@ func (g *Gateway) verifyHandler(w http.ResponseWriter, r *http.Request) {
 		Nonce     string `json:"nonce"`
 		Signature string `json:"signature"`
 		Namespace string `json:"namespace"`
-		ChainType string `json:"chain_type"` // "ETH" or "SOL", defaults to "ETH"
 	}
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
 		writeError(w, http.StatusBadRequest, "invalid json body")
@@ -173,102 +168,44 @@ func (g *Gateway) verifyHandler(w http.ResponseWriter, r *http.Request) {
 		writeError(w, http.StatusInternalServerError, err.Error())
 		return
 	}
-	// Normalize wallet address to lowercase for case-insensitive comparison
+	q := "SELECT id FROM nonces WHERE namespace_id = ? AND wallet = ? AND nonce = ? AND used_at IS NULL AND (expires_at IS NULL OR expires_at > datetime('now')) LIMIT 1"
-	walletLower := strings.ToLower(strings.TrimSpace(req.Wallet))
+	nres, err := db.Query(internalCtx, q, nsID, req.Wallet, req.Nonce)
-	q := "SELECT id FROM nonces WHERE namespace_id = ? AND LOWER(wallet) = LOWER(?) AND nonce = ? AND used_at IS NULL AND (expires_at IS NULL OR expires_at > datetime('now')) LIMIT 1"
-	nres, err := db.Query(internalCtx, q, nsID, walletLower, req.Nonce)
 	if err != nil || nres == nil || nres.Count == 0 {
 		writeError(w, http.StatusBadRequest, "invalid or expired nonce")
 		return
 	}
 	nonceID := nres.Rows[0][0]
 
-	// Determine chain type (default to ETH for backward compatibility)
+	// EVM personal_sign verification of the nonce
-	chainType := strings.ToUpper(strings.TrimSpace(req.ChainType))
+	// Hash: keccak256("\x19Ethereum Signed Message:\n" + len(nonce) + nonce)
-	if chainType == "" {
+	msg := []byte(req.Nonce)
-		chainType = "ETH"
+	prefix := []byte("\x19Ethereum Signed Message:\n" + strconv.Itoa(len(msg)))
+	hash := ethcrypto.Keccak256(prefix, msg)
+
+	// Decode signature (expects 65-byte r||s||v, hex with optional 0x)
+	sigHex := strings.TrimSpace(req.Signature)
+	if strings.HasPrefix(sigHex, "0x") || strings.HasPrefix(sigHex, "0X") {
+		sigHex = sigHex[2:]
 	}
-
+	sig, err := hex.DecodeString(sigHex)
-	// Verify signature based on chain type
+	if err != nil || len(sig) != 65 {
-	var verified bool
+		writeError(w, http.StatusBadRequest, "invalid signature format")
-	var verifyErr error
-
-	switch chainType {
-	case "ETH":
-		// EVM personal_sign verification of the nonce
-		msg := []byte(req.Nonce)
-		prefix := []byte("\x19Ethereum Signed Message:\n" + strconv.Itoa(len(msg)))
-		hash := ethcrypto.Keccak256(prefix, msg)
-
-		// Decode signature (expects 65-byte r||s||v, hex with optional 0x)
-		sigHex := strings.TrimSpace(req.Signature)
-		if strings.HasPrefix(sigHex, "0x") || strings.HasPrefix(sigHex, "0X") {
-			sigHex = sigHex[2:]
-		}
-		sig, err := hex.DecodeString(sigHex)
-		if err != nil || len(sig) != 65 {
-			writeError(w, http.StatusBadRequest, "invalid signature format")
-			return
-		}
-		// Normalize V to 0/1 as expected by geth
-		if sig[64] >= 27 {
-			sig[64] -= 27
-		}
-		pub, err := ethcrypto.SigToPub(hash, sig)
-		if err != nil {
-			writeError(w, http.StatusUnauthorized, "signature recovery failed")
-			return
-		}
-		addr := ethcrypto.PubkeyToAddress(*pub).Hex()
-		want := strings.ToLower(strings.TrimPrefix(strings.TrimPrefix(req.Wallet, "0x"), "0X"))
-		got := strings.ToLower(strings.TrimPrefix(strings.TrimPrefix(addr, "0x"), "0X"))
-		if got != want {
-			writeError(w, http.StatusUnauthorized, "signature does not match wallet")
-			return
-		}
-		verified = true
-
-	case "SOL":
-		// Solana uses Ed25519 signatures
-		// Signature is base64-encoded, public key is the wallet address (base58)
-
-		// Decode base64 signature (Solana signatures are 64 bytes)
-		sig, err := base64.StdEncoding.DecodeString(req.Signature)
-		if err != nil {
-			writeError(w, http.StatusBadRequest, fmt.Sprintf("invalid base64 signature: %v", err))
-			return
-		}
-		if len(sig) != 64 {
-			writeError(w, http.StatusBadRequest, fmt.Sprintf("invalid signature length: expected 64 bytes, got %d", len(sig)))
-			return
-		}
-
-		// Decode base58 public key (Solana wallet address)
-		pubKeyBytes, err := base58Decode(req.Wallet)
-		if err != nil {
-			writeError(w, http.StatusBadRequest, fmt.Sprintf("invalid wallet address: %v", err))
-			return
-		}
-		if len(pubKeyBytes) != 32 {
-			writeError(w, http.StatusBadRequest, fmt.Sprintf("invalid public key length: expected 32 bytes, got %d", len(pubKeyBytes)))
-			return
-		}
-
-		// Verify Ed25519 signature
-		message := []byte(req.Nonce)
-		if !ed25519.Verify(ed25519.PublicKey(pubKeyBytes), message, sig) {
-			writeError(w, http.StatusUnauthorized, "signature verification failed")
-			return
-		}
-		verified = true
-
-	default:
-		writeError(w, http.StatusBadRequest, fmt.Sprintf("unsupported chain type: %s (must be ETH or SOL)", chainType))
 		return
 	}
-
+	// Normalize V to 0/1 as expected by geth
-	if !verified {
+	if sig[64] >= 27 {
-		writeError(w, http.StatusUnauthorized, fmt.Sprintf("signature verification failed: %v", verifyErr))
+		sig[64] -= 27
+	}
+	pub, err := ethcrypto.SigToPub(hash, sig)
+	if err != nil {
+		writeError(w, http.StatusUnauthorized, "signature recovery failed")
+		return
+	}
+	addr := ethcrypto.PubkeyToAddress(*pub).Hex()
+	want := strings.ToLower(strings.TrimPrefix(strings.TrimPrefix(req.Wallet, "0x"), "0X"))
+	got := strings.ToLower(strings.TrimPrefix(strings.TrimPrefix(addr, "0x"), "0X"))
+	if got != want {
+		writeError(w, http.StatusUnauthorized, "signature does not match wallet")
 		return
 	}
 
@@ -298,45 +235,6 @@ func (g *Gateway) verifyHandler(w http.ResponseWriter, r *http.Request) {
 		writeError(w, http.StatusInternalServerError, err.Error())
 		return
 	}
-
-	// Ensure API key exists for this (namespace, wallet) and record ownerships
-	// This is done automatically after successful verification; no second nonce needed
-	var apiKey string
-
-	// Try existing linkage
-	r1, err := db.Query(internalCtx,
-		"SELECT api_keys.key FROM wallet_api_keys JOIN api_keys ON wallet_api_keys.api_key_id = api_keys.id WHERE wallet_api_keys.namespace_id = ? AND LOWER(wallet_api_keys.wallet) = LOWER(?) LIMIT 1",
-		nsID, req.Wallet,
-	)
-	if err == nil && r1 != nil && r1.Count > 0 && len(r1.Rows) > 0 && len(r1.Rows[0]) > 0 {
-		if s, ok := r1.Rows[0][0].(string); ok {
-			apiKey = s
-		} else {
-			b, _ := json.Marshal(r1.Rows[0][0])
-			_ = json.Unmarshal(b, &apiKey)
-		}
-	}
-
-	if strings.TrimSpace(apiKey) == "" {
-		// Create new API key with format ak_<random>:<namespace>
-		buf := make([]byte, 18)
-		if _, err := rand.Read(buf); err == nil {
-			apiKey = "ak_" + base64.RawURLEncoding.EncodeToString(buf) + ":" + ns
-			if _, err := db.Query(internalCtx, "INSERT INTO api_keys(key, name, namespace_id) VALUES (?, ?, ?)", apiKey, "", nsID); err == nil {
-				// Link wallet -> api_key
-				rid, err := db.Query(internalCtx, "SELECT id FROM api_keys WHERE key = ? LIMIT 1", apiKey)
-				if err == nil && rid != nil && rid.Count > 0 && len(rid.Rows) > 0 && len(rid.Rows[0]) > 0 {
-					apiKeyID := rid.Rows[0][0]
-					_, _ = db.Query(internalCtx, "INSERT OR IGNORE INTO wallet_api_keys(namespace_id, wallet, api_key_id) VALUES (?, ?, ?)", nsID, strings.ToLower(req.Wallet), apiKeyID)
-				}
-			}
-		}
-	}
-
-	// Record ownerships (best-effort)
-	_, _ = db.Query(internalCtx, "INSERT OR IGNORE INTO namespace_ownership(namespace_id, owner_type, owner_id) VALUES (?, 'api_key', ?)", nsID, apiKey)
-	_, _ = db.Query(internalCtx, "INSERT OR IGNORE INTO namespace_ownership(namespace_id, owner_type, owner_id) VALUES (?, 'wallet', ?)", nsID, req.Wallet)
-
 	writeJSON(w, http.StatusOK, map[string]any{
 		"access_token":       token,
 		"token_type":         "Bearer",
@@ -344,7 +242,6 @@ func (g *Gateway) verifyHandler(w http.ResponseWriter, r *http.Request) {
 		"refresh_token":      refresh,
 		"subject":            req.Wallet,
 		"namespace":          ns,
-		"api_key":            apiKey,
 		"nonce":              req.Nonce,
 		"signature_verified": true,
 	})
@@ -399,10 +296,8 @@ func (g *Gateway) issueAPIKeyHandler(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	// Validate nonce exists and not used/expired
-	// Normalize wallet address to lowercase for case-insensitive comparison
+	q := "SELECT id FROM nonces WHERE namespace_id = ? AND wallet = ? AND nonce = ? AND used_at IS NULL AND (expires_at IS NULL OR expires_at > datetime('now')) LIMIT 1"
-	walletLower := strings.ToLower(strings.TrimSpace(req.Wallet))
+	nres, err := db.Query(internalCtx, q, nsID, req.Wallet, req.Nonce)
-	q := "SELECT id FROM nonces WHERE namespace_id = ? AND LOWER(wallet) = LOWER(?) AND nonce = ? AND used_at IS NULL AND (expires_at IS NULL OR expires_at > datetime('now')) LIMIT 1"
-	nres, err := db.Query(internalCtx, q, nsID, walletLower, req.Nonce)
 	if err != nil || nres == nil || nres.Count == 0 {
 		writeError(w, http.StatusBadRequest, "invalid or expired nonce")
 		return
@@ -1130,143 +1025,3 @@ func (g *Gateway) logoutHandler(w http.ResponseWriter, r *http.Request) {
 
 	writeError(w, http.StatusBadRequest, "nothing to revoke: provide refresh_token or all=true")
 }
-
-// simpleAPIKeyHandler creates an API key directly from a wallet address without signature verification
-// This is a simplified flow for development/testing
-// Requires: POST { wallet, namespace }
-func (g *Gateway) simpleAPIKeyHandler(w http.ResponseWriter, r *http.Request) {
-	if g.client == nil {
-		writeError(w, http.StatusServiceUnavailable, "client not initialized")
-		return
-	}
-	if r.Method != http.MethodPost {
-		writeError(w, http.StatusMethodNotAllowed, "method not allowed")
-		return
-	}
-
-	var req struct {
-		Wallet    string `json:"wallet"`
-		Namespace string `json:"namespace"`
-	}
-
-	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		writeError(w, http.StatusBadRequest, "invalid json body")
-		return
-	}
-
-	if strings.TrimSpace(req.Wallet) == "" {
-		writeError(w, http.StatusBadRequest, "wallet is required")
-		return
-	}
-
-	ns := strings.TrimSpace(req.Namespace)
-	if ns == "" {
-		ns = strings.TrimSpace(g.cfg.ClientNamespace)
-		if ns == "" {
-			ns = "default"
-		}
-	}
-
-	ctx := r.Context()
-	internalCtx := client.WithInternalAuth(ctx)
-	db := g.client.Database()
-
-	// Resolve or create namespace
-	if _, err := db.Query(internalCtx, "INSERT OR IGNORE INTO namespaces(name) VALUES (?)", ns); err != nil {
-		writeError(w, http.StatusInternalServerError, err.Error())
-		return
-	}
-
-	nres, err := db.Query(internalCtx, "SELECT id FROM namespaces WHERE name = ? LIMIT 1", ns)
-	if err != nil || nres == nil || nres.Count == 0 || len(nres.Rows) == 0 || len(nres.Rows[0]) == 0 {
-		writeError(w, http.StatusInternalServerError, "failed to resolve namespace")
-		return
-	}
-	nsID := nres.Rows[0][0]
-
-	// Check if api key already exists for (namespace, wallet)
-	var apiKey string
-	r1, err := db.Query(internalCtx,
-		"SELECT api_keys.key FROM wallet_api_keys JOIN api_keys ON wallet_api_keys.api_key_id = api_keys.id WHERE wallet_api_keys.namespace_id = ? AND LOWER(wallet_api_keys.wallet) = LOWER(?) LIMIT 1",
-		nsID, req.Wallet,
-	)
-	if err == nil && r1 != nil && r1.Count > 0 && len(r1.Rows) > 0 && len(r1.Rows[0]) > 0 {
-		if s, ok := r1.Rows[0][0].(string); ok {
-			apiKey = s
-		} else {
-			b, _ := json.Marshal(r1.Rows[0][0])
-			_ = json.Unmarshal(b, &apiKey)
-		}
-	}
-
-	// If no existing key, create a new one
-	if strings.TrimSpace(apiKey) == "" {
-		buf := make([]byte, 18)
-		if _, err := rand.Read(buf); err != nil {
-			writeError(w, http.StatusInternalServerError, "failed to generate api key")
-			return
-		}
-		apiKey = "ak_" + base64.RawURLEncoding.EncodeToString(buf) + ":" + ns
-
-		if _, err := db.Query(internalCtx, "INSERT INTO api_keys(key, name, namespace_id) VALUES (?, ?, ?)", apiKey, "", nsID); err != nil {
-			writeError(w, http.StatusInternalServerError, err.Error())
-			return
-		}
-
-		// Link wallet to api key
-		rid, err := db.Query(internalCtx, "SELECT id FROM api_keys WHERE key = ? LIMIT 1", apiKey)
-		if err == nil && rid != nil && rid.Count > 0 && len(rid.Rows) > 0 && len(rid.Rows[0]) > 0 {
-			apiKeyID := rid.Rows[0][0]
-			_, _ = db.Query(internalCtx, "INSERT OR IGNORE INTO wallet_api_keys(namespace_id, wallet, api_key_id) VALUES (?, ?, ?)", nsID, strings.ToLower(req.Wallet), apiKeyID)
-		}
-	}
-
-	// Record ownerships (best-effort)
-	_, _ = db.Query(internalCtx, "INSERT OR IGNORE INTO namespace_ownership(namespace_id, owner_type, owner_id) VALUES (?, 'api_key', ?)", nsID, apiKey)
-	_, _ = db.Query(internalCtx, "INSERT OR IGNORE INTO namespace_ownership(namespace_id, owner_type, owner_id) VALUES (?, 'wallet', ?)", nsID, req.Wallet)
-
-	writeJSON(w, http.StatusOK, map[string]any{
-		"api_key":   apiKey,
-		"namespace": ns,
-		"wallet":    strings.ToLower(strings.TrimPrefix(strings.TrimPrefix(req.Wallet, "0x"), "0X")),
-		"created":   time.Now().Format(time.RFC3339),
-	})
-}
-
-// base58Decode decodes a base58-encoded string (Bitcoin alphabet)
-// Used for decoding Solana public keys (base58-encoded 32-byte ed25519 public keys)
-func base58Decode(encoded string) ([]byte, error) {
-	const alphabet = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz"
-
-	// Build reverse lookup map
-	lookup := make(map[rune]int)
-	for i, c := range alphabet {
-		lookup[c] = i
-	}
-
-	// Convert to big integer
-	num := big.NewInt(0)
-	base := big.NewInt(58)
-
-	for _, c := range encoded {
-		val, ok := lookup[c]
-		if !ok {
-			return nil, fmt.Errorf("invalid base58 character: %c", c)
-		}
-		num.Mul(num, base)
-		num.Add(num, big.NewInt(int64(val)))
-	}
-
-	// Convert to bytes
-	decoded := num.Bytes()
-
-	// Add leading zeros for each leading '1' in the input
-	for _, c := range encoded {
-		if c != '1' {
-			break
-		}
-		decoded = append([]byte{0}, decoded...)
-	}
-
-	return decoded, nil
-}

pkg/gateway/cache_handlers.go

@@ -1,462 +0,0 @@
-package gateway
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"net/http"
-	"strings"
-	"time"
-
-	"github.com/DeBrosOfficial/network/pkg/logging"
-	olriclib "github.com/olric-data/olric"
-	"go.uber.org/zap"
-)
-
-// Cache HTTP handlers for Olric distributed cache
-
-func (g *Gateway) cacheHealthHandler(w http.ResponseWriter, r *http.Request) {
-	client := g.getOlricClient()
-	if client == nil {
-		writeError(w, http.StatusServiceUnavailable, "Olric cache client not initialized")
-		return
-	}
-
-	ctx, cancel := context.WithTimeout(r.Context(), 5*time.Second)
-	defer cancel()
-
-	err := client.Health(ctx)
-	if err != nil {
-		writeError(w, http.StatusServiceUnavailable, fmt.Sprintf("cache health check failed: %v", err))
-		return
-	}
-
-	writeJSON(w, http.StatusOK, map[string]any{
-		"status":  "ok",
-		"service": "olric",
-	})
-}
-
-func (g *Gateway) cacheGetHandler(w http.ResponseWriter, r *http.Request) {
-	client := g.getOlricClient()
-	if client == nil {
-		writeError(w, http.StatusServiceUnavailable, "Olric cache client not initialized")
-		return
-	}
-
-	if r.Method != http.MethodPost {
-		writeError(w, http.StatusMethodNotAllowed, "method not allowed")
-		return
-	}
-
-	var req struct {
-		DMap string `json:"dmap"` // Distributed map name
-		Key  string `json:"key"`  // Key to retrieve
-	}
-
-	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		writeError(w, http.StatusBadRequest, "invalid json body")
-		return
-	}
-
-	if strings.TrimSpace(req.DMap) == "" || strings.TrimSpace(req.Key) == "" {
-		writeError(w, http.StatusBadRequest, "dmap and key are required")
-		return
-	}
-
-	ctx, cancel := context.WithTimeout(r.Context(), 10*time.Second)
-	defer cancel()
-
-	olricCluster := client.GetClient()
-	dm, err := olricCluster.NewDMap(req.DMap)
-	if err != nil {
-		writeError(w, http.StatusInternalServerError, fmt.Sprintf("failed to create DMap: %v", err))
-		return
-	}
-
-	gr, err := dm.Get(ctx, req.Key)
-	if err != nil {
-		// Check for key not found error - handle both wrapped and direct errors
-		if errors.Is(err, olriclib.ErrKeyNotFound) || err.Error() == "key not found" || strings.Contains(err.Error(), "key not found") {
-			writeError(w, http.StatusNotFound, "key not found")
-			return
-		}
-		g.logger.ComponentError(logging.ComponentGeneral, "failed to get key from cache",
-			zap.String("dmap", req.DMap),
-			zap.String("key", req.Key),
-			zap.Error(err))
-		writeError(w, http.StatusInternalServerError, fmt.Sprintf("failed to get key: %v", err))
-		return
-	}
-
-	value, err := decodeValueFromOlric(gr)
-	if err != nil {
-		g.logger.ComponentError(logging.ComponentGeneral, "failed to decode value from cache",
-			zap.String("dmap", req.DMap),
-			zap.String("key", req.Key),
-			zap.Error(err))
-		writeError(w, http.StatusInternalServerError, fmt.Sprintf("failed to decode value: %v", err))
-		return
-	}
-
-	writeJSON(w, http.StatusOK, map[string]any{
-		"key":   req.Key,
-		"value": value,
-		"dmap":  req.DMap,
-	})
-}
-
-// decodeValueFromOlric decodes a value from Olric GetResponse
-// Handles JSON-serialized complex types and basic types (string, number, bool)
-func decodeValueFromOlric(gr *olriclib.GetResponse) (any, error) {
-	var value any
-
-	// First, try to get as bytes (for JSON-serialized complex types)
-	var bytesVal []byte
-	if err := gr.Scan(&bytesVal); err == nil && len(bytesVal) > 0 {
-		// Try to deserialize as JSON
-		var jsonVal any
-		if err := json.Unmarshal(bytesVal, &jsonVal); err == nil {
-			value = jsonVal
-		} else {
-			// If JSON unmarshal fails, treat as string
-			value = string(bytesVal)
-		}
-	} else {
-		// Try as string (for simple string values)
-		if strVal, err := gr.String(); err == nil {
-			value = strVal
-		} else {
-			// Fallback: try to scan as any type
-			var anyVal any
-			if err := gr.Scan(&anyVal); err == nil {
-				value = anyVal
-			} else {
-				// Last resort: try String() again, ignoring error
-				strVal, _ := gr.String()
-				value = strVal
-			}
-		}
-	}
-
-	return value, nil
-}
-
-func (g *Gateway) cacheMultiGetHandler(w http.ResponseWriter, r *http.Request) {
-	client := g.getOlricClient()
-	if client == nil {
-		writeError(w, http.StatusServiceUnavailable, "Olric cache client not initialized")
-		return
-	}
-
-	if r.Method != http.MethodPost {
-		writeError(w, http.StatusMethodNotAllowed, "method not allowed")
-		return
-	}
-
-	var req struct {
-		DMap string   `json:"dmap"` // Distributed map name
-		Keys []string `json:"keys"` // Keys to retrieve
-	}
-
-	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		writeError(w, http.StatusBadRequest, "invalid json body")
-		return
-	}
-
-	if strings.TrimSpace(req.DMap) == "" {
-		writeError(w, http.StatusBadRequest, "dmap is required")
-		return
-	}
-
-	if len(req.Keys) == 0 {
-		writeError(w, http.StatusBadRequest, "keys array is required and cannot be empty")
-		return
-	}
-
-	ctx, cancel := context.WithTimeout(r.Context(), 30*time.Second)
-	defer cancel()
-
-	olricCluster := client.GetClient()
-	dm, err := olricCluster.NewDMap(req.DMap)
-	if err != nil {
-		writeError(w, http.StatusInternalServerError, fmt.Sprintf("failed to create DMap: %v", err))
-		return
-	}
-
-	// Get all keys and collect results
-	var results []map[string]any
-	for _, key := range req.Keys {
-		if strings.TrimSpace(key) == "" {
-			continue // Skip empty keys
-		}
-
-		gr, err := dm.Get(ctx, key)
-		if err != nil {
-			// Skip keys that are not found - don't include them in results
-			// This matches the SDK's expectation that only found keys are returned
-			if err == olriclib.ErrKeyNotFound {
-				continue
-			}
-			// For other errors, log but continue with other keys
-			// We don't want one bad key to fail the entire request
-			continue
-		}
-
-		value, err := decodeValueFromOlric(gr)
-		if err != nil {
-			// If we can't decode, skip this key
-			continue
-		}
-
-		results = append(results, map[string]any{
-			"key":   key,
-			"value": value,
-		})
-	}
-
-	writeJSON(w, http.StatusOK, map[string]any{
-		"results": results,
-		"dmap":    req.DMap,
-	})
-}
-
-func (g *Gateway) cachePutHandler(w http.ResponseWriter, r *http.Request) {
-	client := g.getOlricClient()
-	if client == nil {
-		writeError(w, http.StatusServiceUnavailable, "Olric cache client not initialized")
-		return
-	}
-
-	if r.Method != http.MethodPost {
-		writeError(w, http.StatusMethodNotAllowed, "method not allowed")
-		return
-	}
-
-	var req struct {
-		DMap  string `json:"dmap"`  // Distributed map name
-		Key   string `json:"key"`   // Key to store
-		Value any    `json:"value"` // Value to store
-		TTL   string `json:"ttl"`   // Optional TTL (duration string like "1h", "30m")
-	}
-
-	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		writeError(w, http.StatusBadRequest, "invalid json body")
-		return
-	}
-
-	if strings.TrimSpace(req.DMap) == "" || strings.TrimSpace(req.Key) == "" {
-		writeError(w, http.StatusBadRequest, "dmap and key are required")
-		return
-	}
-
-	if req.Value == nil {
-		writeError(w, http.StatusBadRequest, "value is required")
-		return
-	}
-
-	ctx, cancel := context.WithTimeout(r.Context(), 10*time.Second)
-	defer cancel()
-
-	olricCluster := client.GetClient()
-	dm, err := olricCluster.NewDMap(req.DMap)
-	if err != nil {
-		writeError(w, http.StatusInternalServerError, fmt.Sprintf("failed to create DMap: %v", err))
-		return
-	}
-
-	// TODO: TTL support - need to check Olric v0.7 API for TTL/expiry options
-	// For now, ignore TTL if provided
-	if req.TTL != "" {
-		_, err := time.ParseDuration(req.TTL)
-		if err != nil {
-			writeError(w, http.StatusBadRequest, fmt.Sprintf("invalid ttl format: %v", err))
-			return
-		}
-		// TTL parsing succeeded but not yet implemented in API
-		// Will be added once we confirm the correct Olric API method
-	}
-
-	// Serialize complex types (maps, slices) to JSON bytes for Olric storage
-	// Olric can handle basic types (string, number, bool) directly, but complex
-	// types need to be serialized to bytes
-	var valueToStore any
-	switch req.Value.(type) {
-	case map[string]any:
-		// Serialize maps to JSON bytes
-		jsonBytes, err := json.Marshal(req.Value)
-		if err != nil {
-			writeError(w, http.StatusInternalServerError, fmt.Sprintf("failed to marshal value: %v", err))
-			return
-		}
-		valueToStore = jsonBytes
-	case []any:
-		// Serialize slices to JSON bytes
-		jsonBytes, err := json.Marshal(req.Value)
-		if err != nil {
-			writeError(w, http.StatusInternalServerError, fmt.Sprintf("failed to marshal value: %v", err))
-			return
-		}
-		valueToStore = jsonBytes
-	case string:
-		// Basic string type can be stored directly
-		valueToStore = req.Value
-	case float64:
-		// Basic number type can be stored directly
-		valueToStore = req.Value
-	case int:
-		// Basic int type can be stored directly
-		valueToStore = req.Value
-	case int64:
-		// Basic int64 type can be stored directly
-		valueToStore = req.Value
-	case bool:
-		// Basic bool type can be stored directly
-		valueToStore = req.Value
-	case nil:
-		// Nil can be stored directly
-		valueToStore = req.Value
-	default:
-		// For any other type, serialize to JSON to be safe
-		jsonBytes, err := json.Marshal(req.Value)
-		if err != nil {
-			writeError(w, http.StatusInternalServerError, fmt.Sprintf("failed to marshal value: %v", err))
-			return
-		}
-		valueToStore = jsonBytes
-	}
-
-	err = dm.Put(ctx, req.Key, valueToStore)
-	if err != nil {
-		writeError(w, http.StatusInternalServerError, fmt.Sprintf("failed to put key: %v", err))
-		return
-	}
-
-	writeJSON(w, http.StatusOK, map[string]any{
-		"status": "ok",
-		"key":    req.Key,
-		"dmap":   req.DMap,
-	})
-}
-
-func (g *Gateway) cacheDeleteHandler(w http.ResponseWriter, r *http.Request) {
-	client := g.getOlricClient()
-	if client == nil {
-		writeError(w, http.StatusServiceUnavailable, "Olric cache client not initialized")
-		return
-	}
-
-	if r.Method != http.MethodPost {
-		writeError(w, http.StatusMethodNotAllowed, "method not allowed")
-		return
-	}
-
-	var req struct {
-		DMap string `json:"dmap"` // Distributed map name
-		Key  string `json:"key"`  // Key to delete
-	}
-
-	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		writeError(w, http.StatusBadRequest, "invalid json body")
-		return
-	}
-
-	if strings.TrimSpace(req.DMap) == "" || strings.TrimSpace(req.Key) == "" {
-		writeError(w, http.StatusBadRequest, "dmap and key are required")
-		return
-	}
-
-	ctx, cancel := context.WithTimeout(r.Context(), 10*time.Second)
-	defer cancel()
-
-	olricCluster := client.GetClient()
-	dm, err := olricCluster.NewDMap(req.DMap)
-	if err != nil {
-		writeError(w, http.StatusInternalServerError, fmt.Sprintf("failed to create DMap: %v", err))
-		return
-	}
-
-	deletedCount, err := dm.Delete(ctx, req.Key)
-	if err != nil {
-		// Check for key not found error - handle both wrapped and direct errors
-		if errors.Is(err, olriclib.ErrKeyNotFound) || err.Error() == "key not found" || strings.Contains(err.Error(), "key not found") {
-			writeError(w, http.StatusNotFound, "key not found")
-			return
-		}
-		writeError(w, http.StatusInternalServerError, fmt.Sprintf("failed to delete key: %v", err))
-		return
-	}
-	if deletedCount == 0 {
-		writeError(w, http.StatusNotFound, "key not found")
-		return
-	}
-
-	writeJSON(w, http.StatusOK, map[string]any{
-		"status": "ok",
-		"key":    req.Key,
-		"dmap":   req.DMap,
-	})
-}
-
-func (g *Gateway) cacheScanHandler(w http.ResponseWriter, r *http.Request) {
-	client := g.getOlricClient()
-	if client == nil {
-		writeError(w, http.StatusServiceUnavailable, "Olric cache client not initialized")
-		return
-	}
-
-	if r.Method != http.MethodPost {
-		writeError(w, http.StatusMethodNotAllowed, "method not allowed")
-		return
-	}
-
-	var req struct {
-		DMap  string `json:"dmap"`  // Distributed map name
-		Match string `json:"match"` // Optional regex pattern to match keys
-	}
-
-	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		writeError(w, http.StatusBadRequest, "invalid json body")
-		return
-	}
-
-	if strings.TrimSpace(req.DMap) == "" {
-		writeError(w, http.StatusBadRequest, "dmap is required")
-		return
-	}
-
-	ctx, cancel := context.WithTimeout(r.Context(), 30*time.Second)
-	defer cancel()
-
-	olricCluster := client.GetClient()
-	dm, err := olricCluster.NewDMap(req.DMap)
-	if err != nil {
-		writeError(w, http.StatusInternalServerError, fmt.Sprintf("failed to create DMap: %v", err))
-		return
-	}
-
-	var iterator olriclib.Iterator
-	if req.Match != "" {
-		iterator, err = dm.Scan(ctx, olriclib.Match(req.Match))
-	} else {
-		iterator, err = dm.Scan(ctx)
-	}
-
-	if err != nil {
-		writeError(w, http.StatusInternalServerError, fmt.Sprintf("failed to scan: %v", err))
-		return
-	}
-	defer iterator.Close()
-
-	var keys []string
-	for iterator.Next() {
-		keys = append(keys, iterator.Key())
-	}
-
-	writeJSON(w, http.StatusOK, map[string]any{
-		"keys":  keys,
-		"count": len(keys),
-		"dmap":  req.DMap,
-	})
-}

pkg/gateway/cache_handlers_test.go

@@ -1,202 +0,0 @@
-package gateway
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"net/http"
-	"net/http/httptest"
-	"testing"
-	"time"
-
-	"github.com/DeBrosOfficial/network/pkg/logging"
-	"github.com/DeBrosOfficial/network/pkg/olric"
-	"go.uber.org/zap"
-)
-
-func TestCacheHealthHandler(t *testing.T) {
-	// Create a test logger
-	logger, _ := logging.NewDefaultLogger(logging.ComponentGeneral)
-
-	// Create gateway without Olric client (should return service unavailable)
-	cfg := &Config{
-		ListenAddr:      ":6001",
-		ClientNamespace: "test",
-	}
-	gw := &Gateway{
-		logger: logger,
-		cfg:    cfg,
-	}
-
-	req := httptest.NewRequest("GET", "/v1/cache/health", nil)
-	w := httptest.NewRecorder()
-
-	gw.cacheHealthHandler(w, req)
-
-	if w.Code != http.StatusServiceUnavailable {
-		t.Errorf("expected status %d, got %d", http.StatusServiceUnavailable, w.Code)
-	}
-
-	var resp map[string]any
-	if err := json.NewDecoder(w.Body).Decode(&resp); err != nil {
-		t.Fatalf("failed to decode response: %v", err)
-	}
-
-	if resp["error"] == nil {
-		t.Error("expected error in response")
-	}
-}
-
-func TestCacheGetHandler_MissingClient(t *testing.T) {
-	logger, _ := logging.NewDefaultLogger(logging.ComponentGeneral)
-
-	cfg := &Config{
-		ListenAddr:      ":6001",
-		ClientNamespace: "test",
-	}
-	gw := &Gateway{
-		logger: logger,
-		cfg:    cfg,
-	}
-
-	reqBody := map[string]string{
-		"dmap": "test-dmap",
-		"key":  "test-key",
-	}
-	bodyBytes, _ := json.Marshal(reqBody)
-	req := httptest.NewRequest("POST", "/v1/cache/get", bytes.NewReader(bodyBytes))
-	w := httptest.NewRecorder()
-
-	gw.cacheGetHandler(w, req)
-
-	if w.Code != http.StatusServiceUnavailable {
-		t.Errorf("expected status %d, got %d", http.StatusServiceUnavailable, w.Code)
-	}
-}
-
-func TestCacheGetHandler_InvalidBody(t *testing.T) {
-	logger, _ := logging.NewDefaultLogger(logging.ComponentGeneral)
-
-	cfg := &Config{
-		ListenAddr:      ":6001",
-		ClientNamespace: "test",
-	}
-	gw := &Gateway{
-		logger:      logger,
-		cfg:         cfg,
-		olricClient: &olric.Client{}, // Mock client
-	}
-
-	req := httptest.NewRequest("POST", "/v1/cache/get", bytes.NewReader([]byte("invalid json")))
-	w := httptest.NewRecorder()
-
-	gw.cacheGetHandler(w, req)
-
-	if w.Code != http.StatusBadRequest {
-		t.Errorf("expected status %d, got %d", http.StatusBadRequest, w.Code)
-	}
-}
-
-func TestCachePutHandler_MissingFields(t *testing.T) {
-	logger, _ := logging.NewDefaultLogger(logging.ComponentGeneral)
-
-	cfg := &Config{
-		ListenAddr:      ":6001",
-		ClientNamespace: "test",
-	}
-	gw := &Gateway{
-		logger:      logger,
-		cfg:         cfg,
-		olricClient: &olric.Client{},
-	}
-
-	// Test missing dmap
-	reqBody := map[string]string{
-		"key": "test-key",
-	}
-	bodyBytes, _ := json.Marshal(reqBody)
-	req := httptest.NewRequest("POST", "/v1/cache/put", bytes.NewReader(bodyBytes))
-	w := httptest.NewRecorder()
-
-	gw.cachePutHandler(w, req)
-
-	if w.Code != http.StatusBadRequest {
-		t.Errorf("expected status %d, got %d", http.StatusBadRequest, w.Code)
-	}
-
-	// Test missing key
-	reqBody = map[string]string{
-		"dmap": "test-dmap",
-	}
-	bodyBytes, _ = json.Marshal(reqBody)
-	req = httptest.NewRequest("POST", "/v1/cache/put", bytes.NewReader(bodyBytes))
-	w = httptest.NewRecorder()
-
-	gw.cachePutHandler(w, req)
-
-	if w.Code != http.StatusBadRequest {
-		t.Errorf("expected status %d, got %d", http.StatusBadRequest, w.Code)
-	}
-}
-
-func TestCacheDeleteHandler_WrongMethod(t *testing.T) {
-	logger, _ := logging.NewDefaultLogger(logging.ComponentGeneral)
-
-	cfg := &Config{
-		ListenAddr:      ":6001",
-		ClientNamespace: "test",
-	}
-	gw := &Gateway{
-		logger:      logger,
-		cfg:         cfg,
-		olricClient: &olric.Client{},
-	}
-
-	req := httptest.NewRequest("GET", "/v1/cache/delete", nil)
-	w := httptest.NewRecorder()
-
-	gw.cacheDeleteHandler(w, req)
-
-	if w.Code != http.StatusMethodNotAllowed {
-		t.Errorf("expected status %d, got %d", http.StatusMethodNotAllowed, w.Code)
-	}
-}
-
-func TestCacheScanHandler_InvalidBody(t *testing.T) {
-	logger, _ := logging.NewDefaultLogger(logging.ComponentGeneral)
-
-	cfg := &Config{
-		ListenAddr:      ":6001",
-		ClientNamespace: "test",
-	}
-	gw := &Gateway{
-		logger:      logger,
-		cfg:         cfg,
-		olricClient: &olric.Client{},
-	}
-
-	req := httptest.NewRequest("POST", "/v1/cache/scan", bytes.NewReader([]byte("invalid")))
-	w := httptest.NewRecorder()
-
-	gw.cacheScanHandler(w, req)
-
-	if w.Code != http.StatusBadRequest {
-		t.Errorf("expected status %d, got %d", http.StatusBadRequest, w.Code)
-	}
-}
-
-// Test Olric client wrapper
-func TestOlricClientConfig(t *testing.T) {
-	logger := zap.NewNop()
-
-	// Test default servers
-	cfg := olric.Config{}
-	client, err := olric.NewClient(cfg, logger)
-	if err == nil {
-		// If client creation succeeds, test that it has default servers
-		// This will fail if Olric server is not running, which is expected in tests
-		ctx, cancel := context.WithTimeout(context.Background(), 1*time.Second)
-		defer cancel()
-		_ = client.Close(ctx)
-	}
-}

pkg/gateway/config_validate.go

@@ -1,187 +0,0 @@
-package gateway
-
-import (
-	"fmt"
-	"net"
-	"net/url"
-	"strconv"
-	"strings"
-
-	"github.com/multiformats/go-multiaddr"
-)
-
-// ValidateConfig performs comprehensive validation of gateway configuration.
-// It returns aggregated errors, allowing the caller to print all issues at once.
-func (c *Config) ValidateConfig() []error {
-	var errs []error
-
-	// Validate listen_addr
-	if c.ListenAddr == "" {
-		errs = append(errs, fmt.Errorf("gateway.listen_addr: must not be empty"))
-	} else {
-		if err := validateListenAddr(c.ListenAddr); err != nil {
-			errs = append(errs, fmt.Errorf("gateway.listen_addr: %v", err))
-		}
-	}
-
-	// Validate client_namespace
-	if c.ClientNamespace == "" {
-		errs = append(errs, fmt.Errorf("gateway.client_namespace: must not be empty"))
-	}
-
-	// Validate bootstrap_peers if provided
-	seenPeers := make(map[string]bool)
-	for i, peer := range c.BootstrapPeers {
-		path := fmt.Sprintf("gateway.bootstrap_peers[%d]", i)
-
-		_, err := multiaddr.NewMultiaddr(peer)
-		if err != nil {
-			errs = append(errs, fmt.Errorf("%s: invalid multiaddr: %v; expected /ip{4,6}/.../tcp/<port>/p2p/<peerID>", path, err))
-			continue
-		}
-
-		// Check for /p2p/ component
-		if !strings.Contains(peer, "/p2p/") {
-			errs = append(errs, fmt.Errorf("%s: missing /p2p/<peerID> component; expected /ip{4,6}/.../tcp/<port>/p2p/<peerID>", path))
-		}
-
-		// Extract TCP port by parsing the multiaddr string directly
-		tcpPortStr := extractTCPPort(peer)
-		if tcpPortStr == "" {
-			errs = append(errs, fmt.Errorf("%s: missing /tcp/<port> component; expected /ip{4,6}/.../tcp/<port>/p2p/<peerID>", path))
-			continue
-		}
-
-		tcpPort, err := strconv.Atoi(tcpPortStr)
-		if err != nil || tcpPort < 1 || tcpPort > 65535 {
-			errs = append(errs, fmt.Errorf("%s: invalid TCP port %s; port must be between 1 and 65535", path, tcpPortStr))
-		}
-
-		if seenPeers[peer] {
-			errs = append(errs, fmt.Errorf("%s: duplicate bootstrap peer", path))
-		}
-		seenPeers[peer] = true
-	}
-
-	// Validate rqlite_dsn if provided
-	if c.RQLiteDSN != "" {
-		if err := validateRQLiteDSN(c.RQLiteDSN); err != nil {
-			errs = append(errs, fmt.Errorf("gateway.rqlite_dsn: %v", err))
-		}
-	}
-
-	// Validate HTTPS configuration
-	if c.EnableHTTPS {
-		if c.DomainName == "" {
-			errs = append(errs, fmt.Errorf("gateway.domain_name: must be set when enable_https is true"))
-		} else {
-			// Basic domain validation
-			if !isValidDomainName(c.DomainName) {
-				errs = append(errs, fmt.Errorf("gateway.domain_name: invalid domain format"))
-			}
-		}
-		if c.TLSCacheDir == "" {
-			errs = append(errs, fmt.Errorf("gateway.tls_cache_dir: must be set when enable_https is true"))
-		}
-	}
-
-	return errs
-}
-
-// validateListenAddr checks if a listen address is valid (host:port format)
-func validateListenAddr(addr string) error {
-	host, port, err := net.SplitHostPort(addr)
-	if err != nil {
-		return fmt.Errorf("invalid format; expected host:port")
-	}
-
-	portNum, err := strconv.Atoi(port)
-	if err != nil || portNum < 1 || portNum > 65535 {
-		return fmt.Errorf("port must be a number between 1 and 65535; got %q", port)
-	}
-
-	// Allow empty host (for wildcard binds like :6001)
-	if host != "" && net.ParseIP(host) == nil {
-		// Try as hostname (may fail later during bind, but basic validation)
-		_, err := net.LookupHost(host)
-		if err != nil {
-			// Not an IP; assume it's a valid hostname for now
-		}
-	}
-
-	return nil
-}
-
-// validateRQLiteDSN checks if an RQLite DSN is a valid URL
-func validateRQLiteDSN(dsn string) error {
-	u, err := url.Parse(dsn)
-	if err != nil {
-		return fmt.Errorf("invalid URL: %v", err)
-	}
-
-	if u.Scheme != "http" && u.Scheme != "https" {
-		return fmt.Errorf("scheme must be http or https; got %q", u.Scheme)
-	}
-
-	if u.Host == "" {
-		return fmt.Errorf("host must not be empty")
-	}
-
-	return nil
-}
-
-// extractTCPPort extracts the TCP port from a multiaddr string.
-// It assumes the multiaddr is in the format /ip{4,6}/.../tcp/<port>/p2p/<peerID>.
-func extractTCPPort(multiaddrStr string) string {
-	// Find the last /tcp/ component
-	lastTCPIndex := strings.LastIndex(multiaddrStr, "/tcp/")
-	if lastTCPIndex == -1 {
-		return ""
-	}
-
-	// Extract the port part after /tcp/
-	portPart := multiaddrStr[lastTCPIndex+len("/tcp/"):]
-
-	// Find the first / component after the port part
-	firstSlashIndex := strings.Index(portPart, "/")
-	if firstSlashIndex == -1 {
-		return portPart
-	}
-
-	return portPart[:firstSlashIndex]
-}
-
-// isValidDomainName validates a domain name format
-func isValidDomainName(domain string) bool {
-	domain = strings.TrimSpace(domain)
-	if domain == "" {
-		return false
-	}
-
-	// Basic validation: domain should contain at least one dot
-	// and not start/end with dot or hyphen
-	if !strings.Contains(domain, ".") {
-		return false
-	}
-
-	if strings.HasPrefix(domain, ".") || strings.HasSuffix(domain, ".") {
-		return false
-	}
-
-	if strings.HasPrefix(domain, "-") || strings.HasSuffix(domain, "-") {
-		return false
-	}
-
-	// Check for valid characters (letters, numbers, dots, hyphens)
-	for _, char := range domain {
-		if !((char >= 'a' && char <= 'z') ||
-			(char >= 'A' && char <= 'Z') ||
-			(char >= '0' && char <= '9') ||
-			char == '.' ||
-			char == '-') {
-			return false
-		}
-	}
-
-	return true
-}

pkg/gateway/gateway.go

@@ -5,91 +5,40 @@ import (
 	"crypto/rand"
 	"crypto/rsa"
 	"database/sql"
-	"fmt"
-	"net"
-	"os"
-	"path/filepath"
 	"strconv"
-	"strings"
-	"sync"
 	"time"
 
 	"github.com/DeBrosOfficial/network/pkg/client"
-	"github.com/DeBrosOfficial/network/pkg/config"
-	"github.com/DeBrosOfficial/network/pkg/ipfs"
 	"github.com/DeBrosOfficial/network/pkg/logging"
-	"github.com/DeBrosOfficial/network/pkg/olric"
 	"github.com/DeBrosOfficial/network/pkg/rqlite"
-	"github.com/multiformats/go-multiaddr"
 	"go.uber.org/zap"
 
 	_ "github.com/rqlite/gorqlite/stdlib"
 )
 
-const (
-	olricInitMaxAttempts    = 5
-	olricInitInitialBackoff = 500 * time.Millisecond
-	olricInitMaxBackoff     = 5 * time.Second
-)
-
 // Config holds configuration for the gateway server
 type Config struct {
 	ListenAddr      string
 	ClientNamespace string
 	BootstrapPeers  []string
-	NodePeerID      string // The node's actual peer ID from its identity file
 
 	// Optional DSN for rqlite database/sql driver, e.g. "http://localhost:4001"
 	// If empty, defaults to "http://localhost:4001".
 	RQLiteDSN string
-
-	// HTTPS configuration
-	EnableHTTPS bool   // Enable HTTPS with ACME (Let's Encrypt)
-	DomainName  string // Domain name for HTTPS certificate
-	TLSCacheDir string // Directory to cache TLS certificates (default: ~/.orama/tls-cache)
-
-	// Olric cache configuration
-	OlricServers []string      // List of Olric server addresses (e.g., ["localhost:3320"]). If empty, defaults to ["localhost:3320"]
-	OlricTimeout time.Duration // Timeout for Olric operations (default: 10s)
-
-	// IPFS Cluster configuration
-	IPFSClusterAPIURL     string        // IPFS Cluster HTTP API URL (e.g., "http://localhost:9094"). If empty, gateway will discover from node configs
-	IPFSAPIURL            string        // IPFS HTTP API URL for content retrieval (e.g., "http://localhost:5001"). If empty, gateway will discover from node configs
-	IPFSTimeout           time.Duration // Timeout for IPFS operations (default: 60s)
-	IPFSReplicationFactor int           // Replication factor for pins (default: 3)
-	IPFSEnableEncryption  bool          // Enable client-side encryption before upload (default: true, discovered from node configs)
 }
 
 type Gateway struct {
-	logger       *logging.ColoredLogger
+	logger     *logging.ColoredLogger
-	cfg          *Config
+	cfg        *Config
-	client       client.NetworkClient
+	client     client.NetworkClient
-	nodePeerID   string // The node's actual peer ID from its identity file (overrides client's peer ID)
+	startedAt  time.Time
-	startedAt    time.Time
+	signingKey *rsa.PrivateKey
-	signingKey   *rsa.PrivateKey
+	keyID      string
-	keyID        string
 
 	// rqlite SQL connection and HTTP ORM gateway
 	sqlDB     *sql.DB
 	ormClient rqlite.Client
 	ormHTTP   *rqlite.HTTPGateway
-
-	// Olric cache client
-	olricClient *olric.Client
-	olricMu     sync.RWMutex
-
-	// IPFS storage client
-	ipfsClient ipfs.IPFSClient
-
-	// Local pub/sub bypass for same-gateway subscribers
-	localSubscribers map[string][]*localSubscriber // topic+namespace -> subscribers
-	mu               sync.RWMutex
-}
-
-// localSubscriber represents a WebSocket subscriber for local message delivery
-type localSubscriber struct {
-	msgChan   chan []byte
-	namespace string
 }
 
 // New creates and initializes a new Gateway instance
@@ -117,17 +66,15 @@ func New(logger *logging.ColoredLogger, cfg *Config) (*Gateway, error) {
 
 	logger.ComponentInfo(logging.ComponentClient, "Network client connected",
 		zap.String("namespace", cliCfg.AppName),
-		zap.Int("peer_count", len(cliCfg.BootstrapPeers)),
+		zap.Int("bootstrap_peer_count", len(cliCfg.BootstrapPeers)),
 	)
 
 	logger.ComponentInfo(logging.ComponentGeneral, "Creating gateway instance...")
 	gw := &Gateway{
-		logger:           logger,
+		logger:    logger,
-		cfg:              cfg,
+		cfg:       cfg,
-		client:           c,
+		client:    c,
-		nodePeerID:       cfg.NodePeerID,
+		startedAt: time.Now(),
-		startedAt:        time.Now(),
-		localSubscribers: make(map[string][]*localSubscriber),
 	}
 
 	logger.ComponentInfo(logging.ComponentGeneral, "Generating RSA signing key...")
@@ -149,155 +96,16 @@ func New(logger *logging.ColoredLogger, cfg *Config) (*Gateway, error) {
 	if dbErr != nil {
 		logger.ComponentWarn(logging.ComponentGeneral, "failed to open rqlite sql db; http orm gateway disabled", zap.Error(dbErr))
 	} else {
-		// Configure connection pool with proper timeouts and limits
-		db.SetMaxOpenConns(25)                 // Maximum number of open connections
-		db.SetMaxIdleConns(5)                  // Maximum number of idle connections
-		db.SetConnMaxLifetime(5 * time.Minute) // Maximum lifetime of a connection
-		db.SetConnMaxIdleTime(2 * time.Minute) // Maximum idle time before closing
-
 		gw.sqlDB = db
 		orm := rqlite.NewClient(db)
 		gw.ormClient = orm
 		gw.ormHTTP = rqlite.NewHTTPGateway(orm, "/v1/db")
-		// Set a reasonable timeout for HTTP requests (30 seconds)
-		gw.ormHTTP.Timeout = 30 * time.Second
 		logger.ComponentInfo(logging.ComponentGeneral, "RQLite ORM HTTP gateway ready",
 			zap.String("dsn", dsn),
 			zap.String("base_path", "/v1/db"),
-			zap.Duration("timeout", gw.ormHTTP.Timeout),
 		)
 	}
 
-	logger.ComponentInfo(logging.ComponentGeneral, "Initializing Olric cache client...")
-
-	// Discover Olric servers dynamically from LibP2P peers if not explicitly configured
-	olricServers := cfg.OlricServers
-	if len(olricServers) == 0 {
-		logger.ComponentInfo(logging.ComponentGeneral, "Olric servers not configured, discovering from LibP2P peers...")
-		discovered := discoverOlricServers(c, logger.Logger)
-		if len(discovered) > 0 {
-			olricServers = discovered
-			logger.ComponentInfo(logging.ComponentGeneral, "Discovered Olric servers from LibP2P peers",
-				zap.Strings("servers", olricServers))
-		} else {
-			// Fallback to localhost for local development
-			olricServers = []string{"localhost:3320"}
-			logger.ComponentInfo(logging.ComponentGeneral, "No Olric servers discovered, using localhost fallback")
-		}
-	} else {
-		logger.ComponentInfo(logging.ComponentGeneral, "Using explicitly configured Olric servers",
-			zap.Strings("servers", olricServers))
-	}
-
-	olricCfg := olric.Config{
-		Servers: olricServers,
-		Timeout: cfg.OlricTimeout,
-	}
-	olricClient, olricErr := initializeOlricClientWithRetry(olricCfg, logger)
-	if olricErr != nil {
-		logger.ComponentWarn(logging.ComponentGeneral, "failed to initialize Olric cache client; cache endpoints disabled", zap.Error(olricErr))
-		gw.startOlricReconnectLoop(olricCfg)
-	} else {
-		gw.setOlricClient(olricClient)
-		logger.ComponentInfo(logging.ComponentGeneral, "Olric cache client ready",
-			zap.Strings("servers", olricCfg.Servers),
-			zap.Duration("timeout", olricCfg.Timeout),
-		)
-	}
-
-	logger.ComponentInfo(logging.ComponentGeneral, "Initializing IPFS Cluster client...")
-
-	// Discover IPFS endpoints from node configs if not explicitly configured
-	ipfsClusterURL := cfg.IPFSClusterAPIURL
-	ipfsAPIURL := cfg.IPFSAPIURL
-	ipfsTimeout := cfg.IPFSTimeout
-	ipfsReplicationFactor := cfg.IPFSReplicationFactor
-	ipfsEnableEncryption := cfg.IPFSEnableEncryption
-
-	if ipfsClusterURL == "" {
-		logger.ComponentInfo(logging.ComponentGeneral, "IPFS Cluster URL not configured, discovering from node configs...")
-		discovered := discoverIPFSFromNodeConfigs(logger.Logger)
-		if discovered.clusterURL != "" {
-			ipfsClusterURL = discovered.clusterURL
-			ipfsAPIURL = discovered.apiURL
-			if discovered.timeout > 0 {
-				ipfsTimeout = discovered.timeout
-			}
-			if discovered.replicationFactor > 0 {
-				ipfsReplicationFactor = discovered.replicationFactor
-			}
-			ipfsEnableEncryption = discovered.enableEncryption
-			logger.ComponentInfo(logging.ComponentGeneral, "Discovered IPFS endpoints from node configs",
-				zap.String("cluster_url", ipfsClusterURL),
-				zap.String("api_url", ipfsAPIURL),
-				zap.Bool("encryption_enabled", ipfsEnableEncryption))
-		} else {
-			// Fallback to localhost defaults
-			ipfsClusterURL = "http://localhost:9094"
-			ipfsAPIURL = "http://localhost:5001"
-			ipfsEnableEncryption = true // Default to true
-			logger.ComponentInfo(logging.ComponentGeneral, "No IPFS config found in node configs, using localhost defaults")
-		}
-	}
-
-	if ipfsAPIURL == "" {
-		ipfsAPIURL = "http://localhost:5001"
-	}
-	if ipfsTimeout == 0 {
-		ipfsTimeout = 60 * time.Second
-	}
-	if ipfsReplicationFactor == 0 {
-		ipfsReplicationFactor = 3
-	}
-	if !cfg.IPFSEnableEncryption && !ipfsEnableEncryption {
-		// Only disable if explicitly set to false in both places
-		ipfsEnableEncryption = false
-	} else {
-		// Default to true if not explicitly disabled
-		ipfsEnableEncryption = true
-	}
-
-	ipfsCfg := ipfs.Config{
-		ClusterAPIURL: ipfsClusterURL,
-		Timeout:       ipfsTimeout,
-	}
-	ipfsClient, ipfsErr := ipfs.NewClient(ipfsCfg, logger.Logger)
-	if ipfsErr != nil {
-		logger.ComponentWarn(logging.ComponentGeneral, "failed to initialize IPFS Cluster client; storage endpoints disabled", zap.Error(ipfsErr))
-	} else {
-		gw.ipfsClient = ipfsClient
-
-		// Check peer count and warn if insufficient (use background context to avoid blocking)
-		ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
-		defer cancel()
-		if peerCount, err := ipfsClient.GetPeerCount(ctx); err == nil {
-			if peerCount < ipfsReplicationFactor {
-				logger.ComponentWarn(logging.ComponentGeneral, "insufficient cluster peers for replication factor",
-					zap.Int("peer_count", peerCount),
-					zap.Int("replication_factor", ipfsReplicationFactor),
-					zap.String("message", "Some pin operations may fail until more peers join the cluster"))
-			} else {
-				logger.ComponentInfo(logging.ComponentGeneral, "IPFS Cluster peer count sufficient",
-					zap.Int("peer_count", peerCount),
-					zap.Int("replication_factor", ipfsReplicationFactor))
-			}
-		} else {
-			logger.ComponentWarn(logging.ComponentGeneral, "failed to get cluster peer count", zap.Error(err))
-		}
-
-		logger.ComponentInfo(logging.ComponentGeneral, "IPFS Cluster client ready",
-			zap.String("cluster_api_url", ipfsCfg.ClusterAPIURL),
-			zap.String("ipfs_api_url", ipfsAPIURL),
-			zap.Duration("timeout", ipfsCfg.Timeout),
-			zap.Int("replication_factor", ipfsReplicationFactor),
-			zap.Bool("encryption_enabled", ipfsEnableEncryption),
-		)
-	}
-	// Store IPFS settings in gateway for use by handlers
-	gw.cfg.IPFSAPIURL = ipfsAPIURL
-	gw.cfg.IPFSReplicationFactor = ipfsReplicationFactor
-	gw.cfg.IPFSEnableEncryption = ipfsEnableEncryption
-
 	logger.ComponentInfo(logging.ComponentGeneral, "Gateway creation completed, returning...")
 	return gw, nil
 }
@@ -317,266 +125,4 @@ func (g *Gateway) Close() {
 	if g.sqlDB != nil {
 		_ = g.sqlDB.Close()
 	}
-	if client := g.getOlricClient(); client != nil {
-		ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
-		defer cancel()
-		if err := client.Close(ctx); err != nil {
-			g.logger.ComponentWarn(logging.ComponentGeneral, "error during Olric client close", zap.Error(err))
-		}
-	}
-	if g.ipfsClient != nil {
-		ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
-		defer cancel()
-		if err := g.ipfsClient.Close(ctx); err != nil {
-			g.logger.ComponentWarn(logging.ComponentGeneral, "error during IPFS client close", zap.Error(err))
-		}
-	}
-}
-
-// getLocalSubscribers returns all local subscribers for a given topic and namespace
-func (g *Gateway) getLocalSubscribers(topic, namespace string) []*localSubscriber {
-	topicKey := namespace + "." + topic
-	if subs, ok := g.localSubscribers[topicKey]; ok {
-		return subs
-	}
-	return nil
-}
-
-func (g *Gateway) setOlricClient(client *olric.Client) {
-	g.olricMu.Lock()
-	defer g.olricMu.Unlock()
-	g.olricClient = client
-}
-
-func (g *Gateway) getOlricClient() *olric.Client {
-	g.olricMu.RLock()
-	defer g.olricMu.RUnlock()
-	return g.olricClient
-}
-
-func (g *Gateway) startOlricReconnectLoop(cfg olric.Config) {
-	go func() {
-		retryDelay := 5 * time.Second
-		for {
-			client, err := initializeOlricClientWithRetry(cfg, g.logger)
-			if err == nil {
-				g.setOlricClient(client)
-				g.logger.ComponentInfo(logging.ComponentGeneral, "Olric cache client connected after background retries",
-					zap.Strings("servers", cfg.Servers),
-					zap.Duration("timeout", cfg.Timeout))
-				return
-			}
-
-			g.logger.ComponentWarn(logging.ComponentGeneral, "Olric cache client reconnect failed",
-				zap.Duration("retry_in", retryDelay),
-				zap.Error(err))
-
-			time.Sleep(retryDelay)
-			if retryDelay < olricInitMaxBackoff {
-				retryDelay *= 2
-				if retryDelay > olricInitMaxBackoff {
-					retryDelay = olricInitMaxBackoff
-				}
-			}
-		}
-	}()
-}
-
-func initializeOlricClientWithRetry(cfg olric.Config, logger *logging.ColoredLogger) (*olric.Client, error) {
-	backoff := olricInitInitialBackoff
-
-	for attempt := 1; attempt <= olricInitMaxAttempts; attempt++ {
-		client, err := olric.NewClient(cfg, logger.Logger)
-		if err == nil {
-			if attempt > 1 {
-				logger.ComponentInfo(logging.ComponentGeneral, "Olric cache client initialized after retries",
-					zap.Int("attempts", attempt))
-			}
-			return client, nil
-		}
-
-		logger.ComponentWarn(logging.ComponentGeneral, "Olric cache client init attempt failed",
-			zap.Int("attempt", attempt),
-			zap.Duration("retry_in", backoff),
-			zap.Error(err))
-
-		if attempt == olricInitMaxAttempts {
-			return nil, fmt.Errorf("failed to initialize Olric cache client after %d attempts: %w", attempt, err)
-		}
-
-		time.Sleep(backoff)
-		backoff *= 2
-		if backoff > olricInitMaxBackoff {
-			backoff = olricInitMaxBackoff
-		}
-	}
-
-	return nil, fmt.Errorf("failed to initialize Olric cache client")
-}
-
-// discoverOlricServers discovers Olric server addresses from LibP2P peers
-// Returns a list of IP:port addresses where Olric servers are expected to run (port 3320)
-func discoverOlricServers(networkClient client.NetworkClient, logger *zap.Logger) []string {
-	// Get network info to access peer information
-	networkInfo := networkClient.Network()
-	if networkInfo == nil {
-		logger.Debug("Network info not available for Olric discovery")
-		return nil
-	}
-
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
-	defer cancel()
-
-	peers, err := networkInfo.GetPeers(ctx)
-	if err != nil {
-		logger.Debug("Failed to get peers for Olric discovery", zap.Error(err))
-		return nil
-	}
-
-	olricServers := make([]string, 0)
-	seen := make(map[string]bool)
-
-	for _, peer := range peers {
-		for _, addrStr := range peer.Addresses {
-			// Parse multiaddr
-			ma, err := multiaddr.NewMultiaddr(addrStr)
-			if err != nil {
-				continue
-			}
-
-			// Extract IP address
-			var ip string
-			if ipv4, err := ma.ValueForProtocol(multiaddr.P_IP4); err == nil && ipv4 != "" {
-				ip = ipv4
-			} else if ipv6, err := ma.ValueForProtocol(multiaddr.P_IP6); err == nil && ipv6 != "" {
-				ip = ipv6
-			} else {
-				continue
-			}
-
-			// Skip localhost loopback addresses (we'll use localhost:3320 as fallback)
-			if ip == "localhost" || ip == "::1" {
-				continue
-			}
-
-			// Build Olric server address (standard port 3320)
-			olricAddr := net.JoinHostPort(ip, "3320")
-			if !seen[olricAddr] {
-				olricServers = append(olricServers, olricAddr)
-				seen[olricAddr] = true
-			}
-		}
-	}
-
-	// Also check peers from config
-	if cfg := networkClient.Config(); cfg != nil {
-		for _, peerAddr := range cfg.BootstrapPeers {
-			ma, err := multiaddr.NewMultiaddr(peerAddr)
-			if err != nil {
-				continue
-			}
-
-			var ip string
-			if ipv4, err := ma.ValueForProtocol(multiaddr.P_IP4); err == nil && ipv4 != "" {
-				ip = ipv4
-			} else if ipv6, err := ma.ValueForProtocol(multiaddr.P_IP6); err == nil && ipv6 != "" {
-				ip = ipv6
-			} else {
-				continue
-			}
-
-			// Skip localhost
-			if ip == "localhost" || ip == "::1" {
-				continue
-			}
-
-			olricAddr := net.JoinHostPort(ip, "3320")
-			if !seen[olricAddr] {
-				olricServers = append(olricServers, olricAddr)
-				seen[olricAddr] = true
-			}
-		}
-	}
-
-	// If we found servers, log them
-	if len(olricServers) > 0 {
-		logger.Info("Discovered Olric servers from LibP2P network",
-			zap.Strings("servers", olricServers))
-	}
-
-	return olricServers
-}
-
-// ipfsDiscoveryResult holds discovered IPFS configuration
-type ipfsDiscoveryResult struct {
-	clusterURL        string
-	apiURL            string
-	timeout           time.Duration
-	replicationFactor int
-	enableEncryption  bool
-}
-
-// discoverIPFSFromNodeConfigs discovers IPFS configuration from node.yaml files
-// Checks node-1.yaml through node-5.yaml for IPFS configuration
-func discoverIPFSFromNodeConfigs(logger *zap.Logger) ipfsDiscoveryResult {
-	homeDir, err := os.UserHomeDir()
-	if err != nil {
-		logger.Debug("Failed to get home directory for IPFS discovery", zap.Error(err))
-		return ipfsDiscoveryResult{}
-	}
-
-	configDir := filepath.Join(homeDir, ".orama")
-
-	// Try all node config files for IPFS settings
-	configFiles := []string{"node-1.yaml", "node-2.yaml", "node-3.yaml", "node-4.yaml", "node-5.yaml"}
-
-	for _, filename := range configFiles {
-		configPath := filepath.Join(configDir, filename)
-		data, err := os.ReadFile(configPath)
-		if err != nil {
-			continue
-		}
-
-		var nodeCfg config.Config
-		if err := config.DecodeStrict(strings.NewReader(string(data)), &nodeCfg); err != nil {
-			logger.Debug("Failed to parse node config for IPFS discovery",
-				zap.String("file", filename), zap.Error(err))
-			continue
-		}
-
-		// Check if IPFS is configured
-		if nodeCfg.Database.IPFS.ClusterAPIURL != "" {
-			result := ipfsDiscoveryResult{
-				clusterURL:        nodeCfg.Database.IPFS.ClusterAPIURL,
-				apiURL:            nodeCfg.Database.IPFS.APIURL,
-				timeout:           nodeCfg.Database.IPFS.Timeout,
-				replicationFactor: nodeCfg.Database.IPFS.ReplicationFactor,
-				enableEncryption:  nodeCfg.Database.IPFS.EnableEncryption,
-			}
-
-			if result.apiURL == "" {
-				result.apiURL = "http://localhost:5001"
-			}
-			if result.timeout == 0 {
-				result.timeout = 60 * time.Second
-			}
-			if result.replicationFactor == 0 {
-				result.replicationFactor = 3
-			}
-			// Default encryption to true if not set
-			if !result.enableEncryption {
-				result.enableEncryption = true
-			}
-
-			logger.Info("Discovered IPFS config from node config",
-				zap.String("file", filename),
-				zap.String("cluster_url", result.clusterURL),
-				zap.String("api_url", result.apiURL),
-				zap.Bool("encryption_enabled", result.enableEncryption))
-
-			return result
-		}
-	}
-
-	return ipfsDiscoveryResult{}
 }

pkg/gateway/http_gateway.go

@@ -1,257 +0,0 @@
-package gateway
-
-import (
-	"context"
-	"fmt"
-	"net"
-	"net/http"
-	"net/http/httputil"
-	"net/url"
-	"strings"
-	"sync"
-	"time"
-
-	"github.com/go-chi/chi/v5"
-	"github.com/go-chi/chi/v5/middleware"
-	"go.uber.org/zap"
-
-	"github.com/DeBrosOfficial/network/pkg/config"
-	"github.com/DeBrosOfficial/network/pkg/logging"
-)
-
-// HTTPGateway is the main reverse proxy router
-type HTTPGateway struct {
-	logger         *logging.ColoredLogger
-	config         *config.HTTPGatewayConfig
-	router         chi.Router
-	reverseProxies map[string]*httputil.ReverseProxy
-	mu             sync.RWMutex
-	server         *http.Server
-}
-
-// NewHTTPGateway creates a new HTTP reverse proxy gateway
-func NewHTTPGateway(logger *logging.ColoredLogger, cfg *config.HTTPGatewayConfig) (*HTTPGateway, error) {
-	if !cfg.Enabled {
-		return nil, nil
-	}
-
-	if logger == nil {
-		var err error
-		logger, err = logging.NewColoredLogger(logging.ComponentGeneral, true)
-		if err != nil {
-			return nil, fmt.Errorf("failed to create logger: %w", err)
-		}
-	}
-
-	gateway := &HTTPGateway{
-		logger:         logger,
-		config:         cfg,
-		router:         chi.NewRouter(),
-		reverseProxies: make(map[string]*httputil.ReverseProxy),
-	}
-
-	// Set up router middleware
-	gateway.router.Use(middleware.RequestID)
-	gateway.router.Use(middleware.Logger)
-	gateway.router.Use(middleware.Recoverer)
-	gateway.router.Use(middleware.Timeout(30 * time.Second))
-
-	// Add health check endpoint
-	gateway.router.Get("/health", func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Content-Type", "application/json")
-		w.WriteHeader(http.StatusOK)
-		fmt.Fprintf(w, `{"status":"ok","node":"%s"}`, cfg.NodeName)
-	})
-
-	// Initialize reverse proxies and routes
-	if err := gateway.initializeRoutes(); err != nil {
-		return nil, fmt.Errorf("failed to initialize routes: %w", err)
-	}
-
-	gateway.logger.ComponentInfo(logging.ComponentGeneral, "HTTP Gateway initialized",
-		zap.String("node_name", cfg.NodeName),
-		zap.String("listen_addr", cfg.ListenAddr),
-		zap.Int("routes", len(cfg.Routes)),
-	)
-
-	return gateway, nil
-}
-
-// initializeRoutes sets up all reverse proxy routes
-func (hg *HTTPGateway) initializeRoutes() error {
-	hg.mu.Lock()
-	defer hg.mu.Unlock()
-
-	for routeName, routeConfig := range hg.config.Routes {
-		// Validate backend URL
-		_, err := url.Parse(routeConfig.BackendURL)
-		if err != nil {
-			return fmt.Errorf("invalid backend URL for route %s: %w", routeName, err)
-		}
-
-		// Create reverse proxy with custom transport
-		proxy := &httputil.ReverseProxy{
-			Rewrite: func(r *httputil.ProxyRequest) {
-				// Keep original host for Host header
-				r.Out.Host = r.In.Host
-				// Set X-Forwarded-For header for logging
-				r.Out.Header.Set("X-Forwarded-For", getClientIP(r.In))
-			},
-			ErrorHandler: hg.proxyErrorHandler(routeName),
-		}
-
-		// Set timeout on transport
-		if routeConfig.Timeout > 0 {
-			proxy.Transport = &http.Transport{
-				Dial: (&net.Dialer{
-					Timeout: routeConfig.Timeout,
-				}).Dial,
-				ResponseHeaderTimeout: routeConfig.Timeout,
-			}
-		}
-
-		hg.reverseProxies[routeName] = proxy
-
-		// Register route handler
-		hg.registerRouteHandler(routeName, routeConfig, proxy)
-
-		hg.logger.ComponentInfo(logging.ComponentGeneral, "Route initialized",
-			zap.String("name", routeName),
-			zap.String("path", routeConfig.PathPrefix),
-			zap.String("backend", routeConfig.BackendURL),
-		)
-	}
-
-	return nil
-}
-
-// registerRouteHandler registers a route handler with the router
-func (hg *HTTPGateway) registerRouteHandler(name string, routeConfig config.RouteConfig, proxy *httputil.ReverseProxy) {
-	pathPrefix := strings.TrimSuffix(routeConfig.PathPrefix, "/")
-
-	// Use Mount instead of Route for wildcard path handling
-	hg.router.Mount(pathPrefix, http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
-		hg.handleProxyRequest(w, req, routeConfig, proxy)
-	}))
-}
-
-// handleProxyRequest handles a reverse proxy request
-func (hg *HTTPGateway) handleProxyRequest(w http.ResponseWriter, req *http.Request, routeConfig config.RouteConfig, proxy *httputil.ReverseProxy) {
-	// Strip path prefix before forwarding
-	originalPath := req.URL.Path
-	pathPrefix := strings.TrimSuffix(routeConfig.PathPrefix, "/")
-
-	if strings.HasPrefix(req.URL.Path, pathPrefix) {
-		// Remove the prefix but keep leading slash
-		strippedPath := strings.TrimPrefix(req.URL.Path, pathPrefix)
-		if strippedPath == "" {
-			strippedPath = "/"
-		}
-		req.URL.Path = strippedPath
-	}
-
-	// Update request URL to point to backend
-	backendURL, _ := url.Parse(routeConfig.BackendURL)
-	req.URL.Scheme = backendURL.Scheme
-	req.URL.Host = backendURL.Host
-
-	// Log the proxy request
-	hg.logger.ComponentInfo(logging.ComponentGeneral, "Proxy request",
-		zap.String("original_path", originalPath),
-		zap.String("stripped_path", req.URL.Path),
-		zap.String("backend", routeConfig.BackendURL),
-		zap.String("method", req.Method),
-		zap.String("client_ip", getClientIP(req)),
-	)
-
-	// Handle WebSocket upgrades if configured
-	if routeConfig.WebSocket && isWebSocketRequest(req) {
-		hg.logger.ComponentInfo(logging.ComponentGeneral, "WebSocket upgrade detected",
-			zap.String("path", originalPath),
-		)
-	}
-
-	// Forward the request
-	proxy.ServeHTTP(w, req)
-}
-
-// proxyErrorHandler returns an error handler for the reverse proxy
-func (hg *HTTPGateway) proxyErrorHandler(routeName string) func(http.ResponseWriter, *http.Request, error) {
-	return func(w http.ResponseWriter, r *http.Request, err error) {
-		hg.logger.ComponentError(logging.ComponentGeneral, "Proxy error",
-			zap.String("route", routeName),
-			zap.String("path", r.URL.Path),
-			zap.String("method", r.Method),
-			zap.Error(err),
-		)
-
-		w.Header().Set("Content-Type", "application/json")
-		w.WriteHeader(http.StatusBadGateway)
-		fmt.Fprintf(w, `{"error":"gateway error","route":"%s","detail":"%s"}`, routeName, err.Error())
-	}
-}
-
-// Start starts the HTTP gateway server
-func (hg *HTTPGateway) Start(ctx context.Context) error {
-	if hg == nil || !hg.config.Enabled {
-		return nil
-	}
-
-	hg.server = &http.Server{
-		Addr:    hg.config.ListenAddr,
-		Handler: hg.router,
-	}
-
-	// Listen for connections
-	listener, err := net.Listen("tcp", hg.config.ListenAddr)
-	if err != nil {
-		return fmt.Errorf("failed to listen on %s: %w", hg.config.ListenAddr, err)
-	}
-
-	hg.logger.ComponentInfo(logging.ComponentGeneral, "HTTP Gateway server starting",
-		zap.String("node_name", hg.config.NodeName),
-		zap.String("listen_addr", hg.config.ListenAddr),
-	)
-
-	// Serve in a goroutine
-	go func() {
-		if err := hg.server.Serve(listener); err != nil && err != http.ErrServerClosed {
-			hg.logger.ComponentError(logging.ComponentGeneral, "HTTP Gateway server error", zap.Error(err))
-		}
-	}()
-
-	// Wait for context cancellation
-	<-ctx.Done()
-	return hg.Stop()
-}
-
-// Stop gracefully stops the HTTP gateway server
-func (hg *HTTPGateway) Stop() error {
-	if hg == nil || hg.server == nil {
-		return nil
-	}
-
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-
-	hg.logger.ComponentInfo(logging.ComponentGeneral, "HTTP Gateway shutting down")
-
-	if err := hg.server.Shutdown(ctx); err != nil {
-		hg.logger.ComponentError(logging.ComponentGeneral, "HTTP Gateway shutdown error", zap.Error(err))
-		return err
-	}
-
-	hg.logger.ComponentInfo(logging.ComponentGeneral, "HTTP Gateway shutdown complete")
-	return nil
-}
-
-// Router returns the chi router for testing or extension
-func (hg *HTTPGateway) Router() chi.Router {
-	return hg.router
-}
-
-// isWebSocketRequest checks if a request is a WebSocket upgrade request
-func isWebSocketRequest(r *http.Request) bool {
-	return r.Header.Get("Connection") == "Upgrade" &&
-		r.Header.Get("Upgrade") == "websocket"
-}

pkg/gateway/http_helpers.go

@@ -1,11 +1,11 @@
 package gateway
 
 import (
-	"bufio"
+    "bufio"
-	"encoding/json"
+    "encoding/json"
-	"fmt"
+    "fmt"
-	"net"
+    "net"
-	"net/http"
+    "net/http"
 )
 
 type statusResponseWriter struct {
@@ -28,23 +28,23 @@ func (w *statusResponseWriter) Write(b []byte) (int, error) {
 // Ensure websocket upgrades work by preserving Hijacker/Flusher/Pusher
 // interfaces when the underlying ResponseWriter supports them.
 func (w *statusResponseWriter) Hijack() (net.Conn, *bufio.ReadWriter, error) {
-	if h, ok := w.ResponseWriter.(http.Hijacker); ok {
+    if h, ok := w.ResponseWriter.(http.Hijacker); ok {
-		return h.Hijack()
+        return h.Hijack()
-	}
+    }
-	return nil, nil, fmt.Errorf("hijacker not supported")
+    return nil, nil, fmt.Errorf("hijacker not supported")
 }
 
 func (w *statusResponseWriter) Flush() {
-	if f, ok := w.ResponseWriter.(http.Flusher); ok {
+    if f, ok := w.ResponseWriter.(http.Flusher); ok {
-		f.Flush()
+        f.Flush()
-	}
+    }
 }
 
 func (w *statusResponseWriter) Push(target string, opts *http.PushOptions) error {
-	if p, ok := w.ResponseWriter.(http.Pusher); ok {
+    if p, ok := w.ResponseWriter.(http.Pusher); ok {
-		return p.Push(target, opts)
+        return p.Push(target, opts)
-	}
+    }
-	return http.ErrNotSupported
+    return http.ErrNotSupported
 }
 
 // writeJSON writes JSON with status code

pkg/gateway/https.go

@@ -1,237 +0,0 @@
-package gateway
-
-import (
-	"context"
-	"crypto/tls"
-	"fmt"
-	"net/http"
-	"strings"
-	"time"
-
-	"go.uber.org/zap"
-	"golang.org/x/crypto/acme"
-	"golang.org/x/crypto/acme/autocert"
-
-	"github.com/DeBrosOfficial/network/pkg/config"
-	"github.com/DeBrosOfficial/network/pkg/logging"
-)
-
-// HTTPSGateway extends HTTPGateway with HTTPS/TLS support
-type HTTPSGateway struct {
-	*HTTPGateway
-	httpsConfig *config.HTTPSConfig
-	certManager *autocert.Manager
-	httpsServer *http.Server
-	httpServer  *http.Server // For ACME challenge and redirect
-}
-
-// NewHTTPSGateway creates a new HTTPS gateway with Let's Encrypt autocert
-func NewHTTPSGateway(logger *logging.ColoredLogger, cfg *config.HTTPGatewayConfig) (*HTTPSGateway, error) {
-	// First create the base HTTP gateway
-	base, err := NewHTTPGateway(logger, cfg)
-	if err != nil {
-		return nil, err
-	}
-	if base == nil {
-		return nil, nil
-	}
-
-	if !cfg.HTTPS.Enabled {
-		// Return base gateway wrapped in HTTPSGateway for consistent interface
-		return &HTTPSGateway{HTTPGateway: base}, nil
-	}
-
-	gateway := &HTTPSGateway{
-		HTTPGateway: base,
-		httpsConfig: &cfg.HTTPS,
-	}
-
-	// Check if using self-signed certificates or Let's Encrypt
-	if cfg.HTTPS.UseSelfSigned || (cfg.HTTPS.CertFile != "" && cfg.HTTPS.KeyFile != "") {
-		// Using self-signed or pre-existing certificates
-		logger.ComponentInfo(logging.ComponentGeneral, "Using self-signed or pre-configured certificates for HTTPS",
-			zap.String("domain", cfg.HTTPS.Domain),
-			zap.String("cert_file", cfg.HTTPS.CertFile),
-			zap.String("key_file", cfg.HTTPS.KeyFile),
-		)
-		// Don't set certManager - will use CertFile/KeyFile from config
-	} else if cfg.HTTPS.AutoCert {
-		// Use Let's Encrypt STAGING (consistent with SNI gateway)
-		cacheDir := cfg.HTTPS.CacheDir
-		if cacheDir == "" {
-			cacheDir = "/home/debros/.orama/tls-cache"
-		}
-
-		// Use Let's Encrypt STAGING - provides higher rate limits for testing/development
-		directoryURL := "https://acme-staging-v02.api.letsencrypt.org/directory"
-		logger.ComponentWarn(logging.ComponentGeneral,
-			"Using Let's Encrypt STAGING - certificates will not be trusted by production clients",
-			zap.String("domain", cfg.HTTPS.Domain),
-		)
-
-		gateway.certManager = &autocert.Manager{
-			Prompt:     autocert.AcceptTOS,
-			HostPolicy: autocert.HostWhitelist(cfg.HTTPS.Domain),
-			Cache:      autocert.DirCache(cacheDir),
-			Email:      cfg.HTTPS.Email,
-			Client: &acme.Client{
-				DirectoryURL: directoryURL,
-			},
-		}
-
-		logger.ComponentInfo(logging.ComponentGeneral, "Let's Encrypt autocert configured",
-			zap.String("domain", cfg.HTTPS.Domain),
-			zap.String("cache_dir", cacheDir),
-			zap.String("acme_environment", "staging"),
-		)
-	}
-
-	return gateway, nil
-}
-
-// Start starts both HTTP (for ACME) and HTTPS servers
-func (g *HTTPSGateway) Start(ctx context.Context) error {
-	if g == nil {
-		return nil
-	}
-
-	// If HTTPS is not enabled, just start the base HTTP gateway
-	if !g.httpsConfig.Enabled {
-		return g.HTTPGateway.Start(ctx)
-	}
-
-	httpPort := g.httpsConfig.HTTPPort
-	if httpPort == 0 {
-		httpPort = 80
-	}
-	httpsPort := g.httpsConfig.HTTPSPort
-	if httpsPort == 0 {
-		httpsPort = 443
-	}
-
-	// Start HTTP server for ACME challenge and redirect
-	g.httpServer = &http.Server{
-		Addr:    fmt.Sprintf(":%d", httpPort),
-		Handler: g.httpHandler(),
-	}
-
-	go func() {
-		g.logger.ComponentInfo(logging.ComponentGeneral, "HTTP server starting (ACME/redirect)",
-			zap.Int("port", httpPort),
-		)
-		if err := g.httpServer.ListenAndServe(); err != nil && err != http.ErrServerClosed {
-			g.logger.ComponentError(logging.ComponentGeneral, "HTTP server error", zap.Error(err))
-		}
-	}()
-
-	// Set up TLS config
-	tlsConfig := &tls.Config{
-		MinVersion: tls.VersionTLS12,
-	}
-
-	if g.certManager != nil {
-		tlsConfig.GetCertificate = g.certManager.GetCertificate
-	} else if g.httpsConfig.CertFile != "" && g.httpsConfig.KeyFile != "" {
-		cert, err := tls.LoadX509KeyPair(g.httpsConfig.CertFile, g.httpsConfig.KeyFile)
-		if err != nil {
-			return fmt.Errorf("failed to load TLS certificate: %w", err)
-		}
-		tlsConfig.Certificates = []tls.Certificate{cert}
-	} else {
-		return fmt.Errorf("HTTPS enabled but no certificate source configured")
-	}
-
-	// Start HTTPS server
-	g.httpsServer = &http.Server{
-		Addr:      fmt.Sprintf(":%d", httpsPort),
-		Handler:   g.router,
-		TLSConfig: tlsConfig,
-	}
-
-	listener, err := tls.Listen("tcp", g.httpsServer.Addr, tlsConfig)
-	if err != nil {
-		return fmt.Errorf("failed to create TLS listener: %w", err)
-	}
-
-	g.logger.ComponentInfo(logging.ComponentGeneral, "HTTPS Gateway starting",
-		zap.String("domain", g.httpsConfig.Domain),
-		zap.Int("port", httpsPort),
-	)
-
-	go func() {
-		if err := g.httpsServer.Serve(listener); err != nil && err != http.ErrServerClosed {
-			g.logger.ComponentError(logging.ComponentGeneral, "HTTPS server error", zap.Error(err))
-		}
-	}()
-
-	// Wait for context cancellation
-	<-ctx.Done()
-	return g.Stop()
-}
-
-// httpHandler returns a handler for the HTTP server (ACME challenge + redirect)
-func (g *HTTPSGateway) httpHandler() http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		// Handle ACME challenge
-		if g.certManager != nil && strings.HasPrefix(r.URL.Path, "/.well-known/acme-challenge/") {
-			g.certManager.HTTPHandler(nil).ServeHTTP(w, r)
-			return
-		}
-
-		// Redirect HTTP to HTTPS
-		httpsPort := g.httpsConfig.HTTPSPort
-		if httpsPort == 0 {
-			httpsPort = 443
-		}
-
-		target := "https://" + r.Host + r.URL.RequestURI()
-		if httpsPort != 443 {
-			host := r.Host
-			if idx := strings.LastIndex(host, ":"); idx > 0 {
-				host = host[:idx]
-			}
-			target = fmt.Sprintf("https://%s:%d%s", host, httpsPort, r.URL.RequestURI())
-		}
-
-		http.Redirect(w, r, target, http.StatusMovedPermanently)
-	})
-}
-
-// Stop gracefully stops both HTTP and HTTPS servers
-func (g *HTTPSGateway) Stop() error {
-	if g == nil {
-		return nil
-	}
-
-	g.logger.ComponentInfo(logging.ComponentGeneral, "HTTPS Gateway shutting down")
-
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-
-	var errs []error
-
-	if g.httpServer != nil {
-		if err := g.httpServer.Shutdown(ctx); err != nil {
-			errs = append(errs, fmt.Errorf("HTTP server shutdown: %w", err))
-		}
-	}
-
-	if g.httpsServer != nil {
-		if err := g.httpsServer.Shutdown(ctx); err != nil {
-			errs = append(errs, fmt.Errorf("HTTPS server shutdown: %w", err))
-		}
-	}
-
-	if g.HTTPGateway.server != nil {
-		if err := g.HTTPGateway.Stop(); err != nil {
-			errs = append(errs, fmt.Errorf("base gateway shutdown: %w", err))
-		}
-	}
-
-	if len(errs) > 0 {
-		return fmt.Errorf("shutdown errors: %v", errs)
-	}
-
-	g.logger.ComponentInfo(logging.ComponentGeneral, "HTTPS Gateway shutdown complete")
-	return nil
-}

pkg/gateway/middleware.go

@@ -131,40 +131,27 @@ func (g *Gateway) authMiddleware(next http.Handler) http.Handler {
 }
 
 // extractAPIKey extracts API key from Authorization, X-API-Key header, or query parameters
-// Note: Bearer tokens that look like JWTs (have 2 dots) are skipped (they're JWTs, handled separately)
-// X-API-Key header is preferred when both Authorization and X-API-Key are present
 func extractAPIKey(r *http.Request) string {
-	// Prefer X-API-Key header (most explicit) - check this first
+	// Prefer Authorization header
+	auth := r.Header.Get("Authorization")
+	if auth != "" {
+		// Support "Bearer <token>" and "ApiKey <token>"
+		lower := strings.ToLower(auth)
+		if strings.HasPrefix(lower, "bearer ") {
+			return strings.TrimSpace(auth[len("Bearer "):])
+		}
+		if strings.HasPrefix(lower, "apikey ") {
+			return strings.TrimSpace(auth[len("ApiKey "):])
+		}
+		// If header has no scheme, treat the whole value as token (lenient for dev)
+		if !strings.Contains(auth, " ") {
+			return strings.TrimSpace(auth)
+		}
+	}
+	// Fallback to X-API-Key header
 	if v := strings.TrimSpace(r.Header.Get("X-API-Key")); v != "" {
 		return v
 	}
-
-	// Check Authorization header for ApiKey scheme or non-JWT Bearer tokens
-	auth := r.Header.Get("Authorization")
-	if auth != "" {
-		lower := strings.ToLower(auth)
-		if strings.HasPrefix(lower, "bearer ") {
-			tok := strings.TrimSpace(auth[len("Bearer "):])
-			// Skip Bearer tokens that look like JWTs (have 2 dots) - they're JWTs
-			// But allow Bearer tokens that don't look like JWTs (for backward compatibility)
-			if strings.Count(tok, ".") == 2 {
-				// This is a JWT, skip it
-			} else {
-				// This doesn't look like a JWT, treat as API key (backward compatibility)
-				return tok
-			}
-		} else if strings.HasPrefix(lower, "apikey ") {
-			return strings.TrimSpace(auth[len("ApiKey "):])
-		} else if !strings.Contains(auth, " ") {
-			// If header has no scheme, treat the whole value as token (lenient for dev)
-			// But skip if it looks like a JWT (has 2 dots)
-			tok := strings.TrimSpace(auth)
-			if strings.Count(tok, ".") != 2 {
-				return tok
-			}
-		}
-	}
-
 	// Fallback to query parameter (for WebSocket support)
 	if v := strings.TrimSpace(r.URL.Query().Get("api_key")); v != "" {
 		return v
@@ -178,13 +165,8 @@ func extractAPIKey(r *http.Request) string {
 
 // isPublicPath returns true for routes that should be accessible without API key auth
 func isPublicPath(p string) bool {
-	// Allow ACME challenges for Let's Encrypt certificate provisioning
-	if strings.HasPrefix(p, "/.well-known/acme-challenge/") {
-		return true
-	}
-
 	switch p {
-	case "/health", "/v1/health", "/status", "/v1/status", "/v1/auth/jwks", "/.well-known/jwks.json", "/v1/version", "/v1/auth/login", "/v1/auth/challenge", "/v1/auth/verify", "/v1/auth/register", "/v1/auth/refresh", "/v1/auth/logout", "/v1/auth/api-key", "/v1/auth/simple-key", "/v1/network/status", "/v1/network/peers":
+	case "/health", "/v1/health", "/status", "/v1/status", "/v1/auth/jwks", "/.well-known/jwks.json", "/v1/version", "/v1/auth/login", "/v1/auth/challenge", "/v1/auth/verify", "/v1/auth/register", "/v1/auth/refresh", "/v1/auth/logout", "/v1/auth/api-key":
 		return true
 	default:
 		return false
@@ -232,8 +214,6 @@ func (g *Gateway) authorizationMiddleware(next http.Handler) http.Handler {
 		// Identify actor from context
 		ownerType := ""
 		ownerID := ""
-		apiKeyFallback := ""
-
 		if v := ctx.Value(ctxKeyJWT); v != nil {
 			if claims, ok := v.(*jwtClaims); ok && claims != nil && strings.TrimSpace(claims.Sub) != "" {
 				// Determine subject type.
@@ -257,13 +237,6 @@ func (g *Gateway) authorizationMiddleware(next http.Handler) http.Handler {
 					ownerID = strings.TrimSpace(s)
 				}
 			}
-		} else if ownerType == "wallet" {
-			// If we have a JWT wallet, also capture the API key as fallback
-			if v := ctx.Value(ctxKeyAPIKey); v != nil {
-				if s, ok := v.(string); ok && strings.TrimSpace(s) != "" {
-					apiKeyFallback = strings.TrimSpace(s)
-				}
-			}
 		}
 
 		if ownerType == "" || ownerID == "" {
@@ -271,12 +244,6 @@ func (g *Gateway) authorizationMiddleware(next http.Handler) http.Handler {
 			return
 		}
 
-		g.logger.ComponentInfo("gateway", "namespace auth check",
-			zap.String("namespace", ns),
-			zap.String("owner_type", ownerType),
-			zap.String("owner_id", ownerID),
-		)
-
 		// Check ownership in DB using internal auth context
 		db := g.client.Database()
 		internalCtx := client.WithInternalAuth(ctx)
@@ -294,12 +261,6 @@ func (g *Gateway) authorizationMiddleware(next http.Handler) http.Handler {
 
 		q := "SELECT 1 FROM namespace_ownership WHERE namespace_id = ? AND owner_type = ? AND owner_id = ? LIMIT 1"
 		res, err := db.Query(internalCtx, q, nsID, ownerType, ownerID)
-
-		// If primary owner check fails and we have a JWT wallet with API key fallback, try the API key
-		if (err != nil || res == nil || res.Count == 0) && ownerType == "wallet" && apiKeyFallback != "" {
-			res, err = db.Query(internalCtx, q, nsID, "api_key", apiKeyFallback)
-		}
-
 		if err != nil || res == nil || res.Count == 0 {
 			writeError(w, http.StatusForbidden, "forbidden: not an owner of namespace")
 			return
@@ -321,9 +282,6 @@ func requiresNamespaceOwnership(p string) bool {
 	if strings.HasPrefix(p, "/v1/rqlite/") {
 		return true
 	}
-	if strings.HasPrefix(p, "/v1/proxy/") {
-		return true
-	}
 	return false
 }
 

pkg/gateway/middleware_test.go

@@ -26,3 +26,12 @@ func TestExtractAPIKey(t *testing.T) {
 		t.Fatalf("got %q", got)
 	}
 }
+
+func TestValidateNamespaceParam(t *testing.T) {
+	g := &Gateway{}
+	r := httptest.NewRequest(http.MethodGet, "/v1/storage/get?namespace=ns1&key=k", nil)
+	// no context namespace: should be false
+	if g.validateNamespaceParam(r) {
+		t.Fatalf("expected false without context ns")
+	}
+}

pkg/gateway/pubsub_handlers.go

@@ -1,16 +1,14 @@
 package gateway
 
 import (
-	"context"
+	"crypto/sha256"
 	"encoding/base64"
+	"encoding/hex"
 	"encoding/json"
-	"fmt"
 	"net/http"
 	"time"
 
 	"github.com/DeBrosOfficial/network/pkg/client"
-	"github.com/DeBrosOfficial/network/pkg/pubsub"
-	"go.uber.org/zap"
 
 	"github.com/gorilla/websocket"
 )
@@ -60,103 +58,53 @@ func (g *Gateway) pubsubWebsocketHandler(w http.ResponseWriter, r *http.Request)
 
 	// Channel to deliver PubSub messages to WS writer
 	msgs := make(chan []byte, 128)
-
-	// NEW: Register as local subscriber for direct message delivery
-	localSub := &localSubscriber{
-		msgChan:   msgs,
-		namespace: ns,
-	}
-	topicKey := fmt.Sprintf("%s.%s", ns, topic)
-
-	g.mu.Lock()
-	g.localSubscribers[topicKey] = append(g.localSubscribers[topicKey], localSub)
-	subscriberCount := len(g.localSubscribers[topicKey])
-	g.mu.Unlock()
-
-	g.logger.ComponentInfo("gateway", "pubsub ws: registered local subscriber",
-		zap.String("topic", topic),
-		zap.String("namespace", ns),
-		zap.Int("total_subscribers", subscriberCount))
-
-	// Unregister on close
-	defer func() {
-		g.mu.Lock()
-		subs := g.localSubscribers[topicKey]
-		for i, sub := range subs {
-			if sub == localSub {
-				g.localSubscribers[topicKey] = append(subs[:i], subs[i+1:]...)
-				break
-			}
-		}
-		remainingCount := len(g.localSubscribers[topicKey])
-		if remainingCount == 0 {
-			delete(g.localSubscribers, topicKey)
-		}
-		g.mu.Unlock()
-		g.logger.ComponentInfo("gateway", "pubsub ws: unregistered local subscriber",
-			zap.String("topic", topic),
-			zap.Int("remaining_subscribers", remainingCount))
-	}()
-
 	// Use internal auth context when interacting with client to avoid circular auth requirements
 	ctx := client.WithInternalAuth(r.Context())
-	// Apply namespace isolation
+	// Subscribe to the topic; push data into msgs with simple per-connection de-dup
-	ctx = pubsub.WithNamespace(ctx, ns)
+	recent := make(map[string]time.Time)
+	h := func(_ string, data []byte) error {
+		// Drop duplicates seen in the last 2 seconds
+		sum := sha256.Sum256(data)
+		key := hex.EncodeToString(sum[:])
+		if t, ok := recent[key]; ok && time.Since(t) < 2*time.Second {
+			return nil
+		}
+		recent[key] = time.Now()
+		select {
+		case msgs <- data:
+			return nil
+		default:
+			// Drop if client is slow to avoid blocking network
+			return nil
+		}
+	}
+	if err := g.client.PubSub().Subscribe(ctx, topic, h); err != nil {
+		g.logger.ComponentWarn("gateway", "pubsub ws: subscribe failed")
+		writeError(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+	defer func() { _ = g.client.PubSub().Unsubscribe(ctx, topic) }()
 
-	// Writer loop - START THIS FIRST before libp2p subscription
+	// no extra fan-out; rely on libp2p subscription
+
+	// Writer loop
 	done := make(chan struct{})
 	go func() {
-		g.logger.ComponentInfo("gateway", "pubsub ws: writer goroutine started",
-			zap.String("topic", topic))
-		defer g.logger.ComponentInfo("gateway", "pubsub ws: writer goroutine exiting",
-			zap.String("topic", topic))
 		ticker := time.NewTicker(30 * time.Second)
 		defer ticker.Stop()
 		for {
 			select {
 			case b, ok := <-msgs:
 				if !ok {
-					g.logger.ComponentWarn("gateway", "pubsub ws: message channel closed",
-						zap.String("topic", topic))
 					_ = conn.WriteControl(websocket.CloseMessage, []byte{}, time.Now().Add(5*time.Second))
 					close(done)
 					return
 				}
-
-				g.logger.ComponentInfo("gateway", "pubsub ws: sending message to client",
-					zap.String("topic", topic),
-					zap.Int("data_len", len(b)))
-
-				// Format message as JSON envelope with data (base64 encoded), timestamp, and topic
-				// This matches the SDK's Message interface: {data: string, timestamp: number, topic: string}
-				envelope := map[string]interface{}{
-					"data":      base64.StdEncoding.EncodeToString(b),
-					"timestamp": time.Now().UnixMilli(),
-					"topic":     topic,
-				}
-				envelopeJSON, err := json.Marshal(envelope)
-				if err != nil {
-					g.logger.ComponentWarn("gateway", "pubsub ws: failed to marshal envelope",
-						zap.String("topic", topic),
-						zap.Error(err))
-					continue
-				}
-
-				g.logger.ComponentDebug("gateway", "pubsub ws: envelope created",
-					zap.String("topic", topic),
-					zap.Int("envelope_len", len(envelopeJSON)))
-
 				conn.SetWriteDeadline(time.Now().Add(30 * time.Second))
-				if err := conn.WriteMessage(websocket.TextMessage, envelopeJSON); err != nil {
+				if err := conn.WriteMessage(websocket.BinaryMessage, b); err != nil {
-					g.logger.ComponentWarn("gateway", "pubsub ws: failed to write to websocket",
-						zap.String("topic", topic),
-						zap.Error(err))
 					close(done)
 					return
 				}
-
-				g.logger.ComponentInfo("gateway", "pubsub ws: message sent successfully",
-					zap.String("topic", topic))
 			case <-ticker.C:
 				// Ping keepalive
 				_ = conn.WriteControl(websocket.PingMessage, []byte("ping"), time.Now().Add(5*time.Second))
@@ -167,42 +115,6 @@ func (g *Gateway) pubsubWebsocketHandler(w http.ResponseWriter, r *http.Request)
 		}
 	}()
 
-	// Subscribe to libp2p for cross-node messages (in background, non-blocking)
-	go func() {
-		h := func(_ string, data []byte) error {
-			g.logger.ComponentInfo("gateway", "pubsub ws: received message from libp2p",
-				zap.String("topic", topic),
-				zap.Int("data_len", len(data)))
-
-			select {
-			case msgs <- data:
-				g.logger.ComponentInfo("gateway", "pubsub ws: forwarded to client",
-					zap.String("topic", topic),
-					zap.String("source", "libp2p"))
-				return nil
-			default:
-				// Drop if client is slow to avoid blocking network
-				g.logger.ComponentWarn("gateway", "pubsub ws: client slow, dropping message",
-					zap.String("topic", topic))
-				return nil
-			}
-		}
-		if err := g.client.PubSub().Subscribe(ctx, topic, h); err != nil {
-			g.logger.ComponentWarn("gateway", "pubsub ws: libp2p subscribe failed (will use local-only)",
-				zap.String("topic", topic),
-				zap.Error(err))
-			return
-		}
-		g.logger.ComponentInfo("gateway", "pubsub ws: libp2p subscription established",
-			zap.String("topic", topic))
-
-		// Keep subscription alive until done
-		<-done
-		_ = g.client.PubSub().Unsubscribe(ctx, topic)
-		g.logger.ComponentInfo("gateway", "pubsub ws: libp2p subscription closed",
-			zap.String("topic", topic))
-	}()
-
 	// Reader loop: treat any client message as publish to the same topic
 	for {
 		mt, data, err := conn.ReadMessage()
@@ -212,17 +124,6 @@ func (g *Gateway) pubsubWebsocketHandler(w http.ResponseWriter, r *http.Request)
 		if mt != websocket.TextMessage && mt != websocket.BinaryMessage {
 			continue
 		}
-
-		// Filter out WebSocket heartbeat messages
-		// Don't publish them to the topic
-		var msg map[string]interface{}
-		if err := json.Unmarshal(data, &msg); err == nil {
-			if msgType, ok := msg["type"].(string); ok && msgType == "ping" {
-				g.logger.ComponentInfo("gateway", "pubsub ws: filtering out heartbeat ping")
-				continue
-			}
-		}
-
 		if err := g.client.PubSub().Publish(ctx, topic, data); err != nil {
 			// Best-effort notify client
 			_ = conn.WriteMessage(websocket.TextMessage, []byte("publish_error"))
@@ -259,54 +160,11 @@ func (g *Gateway) pubsubPublishHandler(w http.ResponseWriter, r *http.Request) {
 		writeError(w, http.StatusBadRequest, "invalid base64 data")
 		return
 	}
-
+	if err := g.client.PubSub().Publish(client.WithInternalAuth(r.Context()), body.Topic, data); err != nil {
-	// NEW: Check for local websocket subscribers FIRST and deliver directly
+		writeError(w, http.StatusInternalServerError, err.Error())
-	g.mu.RLock()
+		return
-	localSubs := g.getLocalSubscribers(body.Topic, ns)
-	g.mu.RUnlock()
-
-	localDeliveryCount := 0
-	if len(localSubs) > 0 {
-		for _, sub := range localSubs {
-			select {
-			case sub.msgChan <- data:
-				localDeliveryCount++
-				g.logger.ComponentDebug("gateway", "delivered to local subscriber",
-					zap.String("topic", body.Topic))
-			default:
-				// Drop if buffer full
-				g.logger.ComponentWarn("gateway", "local subscriber buffer full, dropping message",
-					zap.String("topic", body.Topic))
-			}
-		}
 	}
-
+	// rely on libp2p to deliver to WS subscribers
-	g.logger.ComponentInfo("gateway", "pubsub publish: processing message",
-		zap.String("topic", body.Topic),
-		zap.String("namespace", ns),
-		zap.Int("data_len", len(data)),
-		zap.Int("local_subscribers", len(localSubs)),
-		zap.Int("local_delivered", localDeliveryCount))
-
-	// Publish to libp2p asynchronously for cross-node delivery
-	// This prevents blocking the HTTP response if libp2p network is slow
-	go func() {
-		publishCtx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-		defer cancel()
-
-		ctx := pubsub.WithNamespace(client.WithInternalAuth(publishCtx), ns)
-		if err := g.client.PubSub().Publish(ctx, body.Topic, data); err != nil {
-			g.logger.ComponentWarn("gateway", "async libp2p publish failed",
-				zap.String("topic", body.Topic),
-				zap.Error(err))
-		} else {
-			g.logger.ComponentDebug("gateway", "async libp2p publish succeeded",
-				zap.String("topic", body.Topic))
-		}
-	}()
-
-	// Return immediately after local delivery
-	// Local WebSocket subscribers already received the message
 	writeJSON(w, http.StatusOK, map[string]any{"status": "ok"})
 }
 
@@ -321,9 +179,7 @@ func (g *Gateway) pubsubTopicsHandler(w http.ResponseWriter, r *http.Request) {
 		writeError(w, http.StatusForbidden, "namespace not resolved")
 		return
 	}
-	// Apply namespace isolation
+	all, err := g.client.PubSub().ListTopics(client.WithInternalAuth(r.Context()))
-	ctx := pubsub.WithNamespace(client.WithInternalAuth(r.Context()), ns)
-	all, err := g.client.PubSub().ListTopics(ctx)
 	if err != nil {
 		writeError(w, http.StatusInternalServerError, err.Error())
 		return

pkg/gateway/push_notifications.go

@@ -1,183 +0,0 @@
-package gateway
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"fmt"
-	"io"
-	"net/http"
-	"time"
-
-	"go.uber.org/zap"
-)
-
-// PushNotificationService handles sending push notifications via Expo
-type PushNotificationService struct {
-	logger *zap.Logger
-	client *http.Client
-}
-
-// ExpoTicket represents the response from Expo API
-type ExpoTicket struct {
-	ID    string `json:"id"`
-	Error string `json:"error,omitempty"`
-}
-
-// ExpoPushMessage represents a message to send via Expo
-type ExpoPushMessage struct {
-	To       string                 `json:"to"`
-	Title    string                 `json:"title"`
-	Body     string                 `json:"body"`
-	Data     map[string]interface{} `json:"data,omitempty"`
-	Sound    string                 `json:"sound,omitempty"`
-	Badge    int                    `json:"badge,omitempty"`
-	Priority string                 `json:"priority,omitempty"`
-	// iOS specific
-	MutableContent bool   `json:"mutableContent,omitempty"`
-	IosIcon        string `json:"iosIcon,omitempty"`
-	// Android specific
-	AndroidBigLargeIcon string `json:"androidBigLargeIcon,omitempty"`
-	ChannelID           string `json:"channelId,omitempty"`
-}
-
-// NewPushNotificationService creates a new push notification service
-func NewPushNotificationService(logger *zap.Logger) *PushNotificationService {
-	return &PushNotificationService{
-		logger: logger,
-		client: &http.Client{
-			Timeout: 10 * time.Second,
-		},
-	}
-}
-
-// SendNotification sends a push notification via Expo
-func (pns *PushNotificationService) SendNotification(
-	ctx context.Context,
-	expoPushToken string,
-	title string,
-	body string,
-	data map[string]interface{},
-	avatarURL string,
-) error {
-	if expoPushToken == "" {
-		return fmt.Errorf("empty expo push token")
-	}
-
-	message := ExpoPushMessage{
-		To:       expoPushToken,
-		Title:    title,
-		Body:     body,
-		Data:     data,
-		Sound:    "default",
-		Priority: "high",
-		// Enable mutable content for iOS to allow Notification Service Extension
-		MutableContent:      true,
-		ChannelID:           "messages",
-		AndroidBigLargeIcon: avatarURL,
-	}
-
-	// For iOS, include avatar in data so Notification Service Extension can fetch it
-	if avatarURL != "" {
-		if message.Data == nil {
-			message.Data = make(map[string]interface{})
-		}
-		message.Data["avatar_url"] = avatarURL
-	}
-
-	return pns.sendExpoRequest(ctx, message)
-}
-
-// SendBulkNotifications sends notifications to multiple users
-func (pns *PushNotificationService) SendBulkNotifications(
-	ctx context.Context,
-	expoPushTokens []string,
-	title string,
-	body string,
-	data map[string]interface{},
-	avatarURL string,
-) []error {
-	errors := make([]error, 0)
-
-	for _, token := range expoPushTokens {
-		if err := pns.SendNotification(ctx, token, title, body, data, avatarURL); err != nil {
-			errors = append(errors, fmt.Errorf("failed to send to token %s: %w", token, err))
-		}
-	}
-
-	return errors
-}
-
-// sendExpoRequest sends a request to the Expo push notification API
-func (pns *PushNotificationService) sendExpoRequest(ctx context.Context, message ExpoPushMessage) error {
-	const expoAPIURL = "https://exp.host/--/api/v2/push/send"
-
-	body, err := json.Marshal(message)
-	if err != nil {
-		pns.logger.Error("failed to marshal push notification",
-			zap.Error(err),
-			zap.String("to", message.To))
-		return fmt.Errorf("marshal error: %w", err)
-	}
-
-	req, err := http.NewRequestWithContext(ctx, http.MethodPost, expoAPIURL, bytes.NewBuffer(body))
-	if err != nil {
-		pns.logger.Error("failed to create push notification request",
-			zap.Error(err),
-			zap.String("to", message.To))
-		return fmt.Errorf("request creation error: %w", err)
-	}
-
-	req.Header.Set("Content-Type", "application/json")
-
-	resp, err := pns.client.Do(req)
-	if err != nil {
-		pns.logger.Error("failed to send push notification",
-			zap.Error(err),
-			zap.String("to", message.To))
-		return fmt.Errorf("send error: %w", err)
-	}
-	defer resp.Body.Close()
-
-	respBody, err := io.ReadAll(resp.Body)
-	if err != nil {
-		pns.logger.Error("failed to read push notification response",
-			zap.Error(err),
-			zap.String("to", message.To))
-		return fmt.Errorf("response read error: %w", err)
-	}
-
-	// Check for API errors
-	if resp.StatusCode != http.StatusOK {
-		pns.logger.Warn("push notification API error",
-			zap.Int("status_code", resp.StatusCode),
-			zap.String("response", string(respBody)),
-			zap.String("to", message.To))
-		return fmt.Errorf("API returned status %d: %s", resp.StatusCode, string(respBody))
-	}
-
-	// Parse response
-	var tickets []ExpoTicket
-	if err := json.Unmarshal(respBody, &tickets); err != nil {
-		pns.logger.Error("failed to parse push notification response",
-			zap.Error(err),
-			zap.String("response", string(respBody)))
-		return fmt.Errorf("parse error: %w", err)
-	}
-
-	// Check for errors in tickets
-	for _, ticket := range tickets {
-		if ticket.Error != "" {
-			pns.logger.Warn("push notification error in ticket",
-				zap.String("error", ticket.Error),
-				zap.String("to", message.To))
-			return fmt.Errorf("ticket error: %s", ticket.Error)
-		}
-	}
-
-	pns.logger.Info("push notification sent successfully",
-		zap.String("to", message.To),
-		zap.String("title", message.Title))
-
-	return nil
-}