.githooks/pre-push

@@ -8,7 +8,7 @@ NOCOLOR='\033[0m'
 
 # Run tests before push
 echo -e "\n${CYAN}Running tests...${NOCOLOR}"
-cd "$(git rev-parse --show-toplevel)/core" && go test ./...
+go test ./...   # Runs all tests in your repo
 status=$?
 if [ $status -ne 0 ]; then
   echo -e "${RED}Push aborted: some tests failed.${NOCOLOR}"

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -1,91 +0,0 @@
-name: Bug Report
-description: Report a bug in Orama Network
-labels: ["bug"]
-body:
-  - type: markdown
-    attributes:
-      value: |
-        Thanks for reporting a bug! Please fill out the sections below.
-
-        **Security issues:** If this is a security vulnerability, do NOT open an issue. Email security@orama.io instead.
-
-  - type: input
-    id: version
-    attributes:
-      label: Orama version
-      description: "Run `orama version` to find this"
-      placeholder: "v0.18.0-beta"
-    validations:
-      required: true
-
-  - type: dropdown
-    id: component
-    attributes:
-      label: Component
-      options:
-        - Gateway / API
-        - CLI (orama command)
-        - WireGuard / Networking
-        - RQLite / Storage
-        - Olric / Caching
-        - IPFS / Pinning
-        - CoreDNS
-        - OramaOS
-        - Other
-    validations:
-      required: true
-
-  - type: textarea
-    id: description
-    attributes:
-      label: Description
-      description: A clear description of the bug
-    validations:
-      required: true
-
-  - type: textarea
-    id: steps
-    attributes:
-      label: Steps to reproduce
-      description: Minimal steps to reproduce the behavior
-      placeholder: |
-        1. Run `orama ...`
-        2. See error
-    validations:
-      required: true
-
-  - type: textarea
-    id: expected
-    attributes:
-      label: Expected behavior
-      description: What you expected to happen
-    validations:
-      required: true
-
-  - type: textarea
-    id: actual
-    attributes:
-      label: Actual behavior
-      description: What actually happened (include error messages and logs if any)
-    validations:
-      required: true
-
-  - type: textarea
-    id: environment
-    attributes:
-      label: Environment
-      description: OS, Go version, deployment environment, etc.
-      placeholder: |
-        - OS: Ubuntu 22.04
-        - Go: 1.23
-        - Environment: sandbox
-    validations:
-      required: false
-
-  - type: textarea
-    id: context
-    attributes:
-      label: Additional context
-      description: Logs, screenshots, monitor reports, or anything else that might help
-    validations:
-      required: false

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -1,49 +0,0 @@
-name: Feature Request
-description: Suggest a new feature or improvement
-labels: ["enhancement"]
-body:
-  - type: markdown
-    attributes:
-      value: |
-        Thanks for the suggestion! Please describe what you'd like to see.
-
-  - type: dropdown
-    id: component
-    attributes:
-      label: Component
-      options:
-        - Gateway / API
-        - CLI (orama command)
-        - WireGuard / Networking
-        - RQLite / Storage
-        - Olric / Caching
-        - IPFS / Pinning
-        - CoreDNS
-        - OramaOS
-        - Other
-    validations:
-      required: true
-
-  - type: textarea
-    id: problem
-    attributes:
-      label: Problem
-      description: What problem does this solve? Why do you need it?
-    validations:
-      required: true
-
-  - type: textarea
-    id: solution
-    attributes:
-      label: Proposed solution
-      description: How do you think this should work?
-    validations:
-      required: true
-
-  - type: textarea
-    id: alternatives
-    attributes:
-      label: Alternatives considered
-      description: Any workarounds or alternative approaches you've thought of
-    validations:
-      required: false

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,31 +0,0 @@
-## Summary
-
-<!-- What does this PR do? Keep it to 1-3 bullet points. -->
-
-## Motivation
-
-<!-- Why is this change needed? Link to an issue if applicable. -->
-
-## Test plan
-
-<!-- How did you verify this works? -->
-
-- [ ] `make test` passes
-- [ ] Tested on sandbox/staging environment
-
-## Distributed system impact
-
-<!-- Does this change affect any of the following? If yes, explain. -->
-
-- [ ] Raft quorum / RQLite
-- [ ] WireGuard mesh / networking
-- [ ] Olric gossip / caching
-- [ ] Service startup ordering
-- [ ] Rolling upgrade compatibility
-
-## Checklist
-
-- [ ] Tests added for new functionality or bug fix
-- [ ] No debug code (`fmt.Println`, `log.Println`) left behind
-- [ ] Docs updated (if user-facing behavior changed)
-- [ ] Errors wrapped with context (`fmt.Errorf("...: %w", err)`)

.github/workflows/publish-sdk.yml

@@ -1,80 +0,0 @@
-name: Publish SDK to npm
-
-on:
-  workflow_dispatch:
-    inputs:
-      version:
-        description: "Version to publish (e.g., 1.0.0). Leave empty to use package.json version."
-        required: false
-      dry-run:
-        description: "Dry run (don't actually publish)"
-        type: boolean
-        default: false
-
-permissions:
-  contents: write
-
-jobs:
-  publish:
-    name: Build & Publish @debros/orama
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: sdk
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Set up Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: "20"
-          registry-url: "https://registry.npmjs.org"
-
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-
-      - name: Bump version
-        if: inputs.version != ''
-        run: npm version ${{ inputs.version }} --no-git-tag-version
-
-      - name: Typecheck
-        run: pnpm typecheck
-
-      - name: Build
-        run: pnpm build
-
-      - name: Run unit tests
-        run: pnpm vitest run tests/unit
-
-      - name: Publish (dry run)
-        if: inputs.dry-run == true
-        run: npm publish --access public --dry-run
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-
-      - name: Publish
-        if: inputs.dry-run == false
-        run: npm publish --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-
-      - name: Get published version
-        if: inputs.dry-run == false
-        id: version
-        run: echo "version=$(node -p "require('./package.json').version")" >> $GITHUB_OUTPUT
-
-      - name: Create git tag
-        if: inputs.dry-run == false
-        working-directory: .
-        run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-          git tag "sdk/v${{ steps.version.outputs.version }}"
-          git push origin "sdk/v${{ steps.version.outputs.version }}"

.github/workflows/release-apt.yml

@@ -28,8 +28,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: "1.24"
-          cache-dependency-path: core/go.sum
+          go-version: "1.23"
 
       - name: Get version
         id: version
@@ -47,7 +46,6 @@ jobs:
         uses: docker/setup-qemu-action@v3
 
       - name: Build binary
-        working-directory: core
         env:
           GOARCH: ${{ matrix.arch }}
           CGO_ENABLED: 0
@@ -73,7 +71,7 @@ jobs:
           mkdir -p ${PKG_NAME}/usr/local/bin
 
           # Copy binaries
-          cp core/build/usr/local/bin/* ${PKG_NAME}/usr/local/bin/
+          cp build/usr/local/bin/* ${PKG_NAME}/usr/local/bin/
           chmod 755 ${PKG_NAME}/usr/local/bin/*
 
           # Create control file

.github/workflows/release.yaml

@@ -23,8 +23,8 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v4
         with:
-          go-version: '1.24'
-          cache-dependency-path: core/go.sum
+          go-version: '1.21'
+          cache: true
       
       - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@v5

.gitignore

@@ -1,90 +1,114 @@
-# === Global ===
+# Binaries for programs and plugins
+*.exe
+*.exe~
+*.dll
+*.so
+*.dylib
+
+# Test binary, built with `go test -c`
+*.test
+
+# Output of the go coverage tool, specifically when used with LiteIDE
+*.out
+
+# Dependency directories (remove the comment below to include it)
+# vendor/
+
+# Go workspace file
+go.work
+
+# Built binaries
+bin/
+dist/
+
+# IDE and editor files
+.vscode/
+.idea/
+*.swp
+*.swo
+*~
+
+# OS generated files
 .DS_Store
+.codex/
+redeploy-6.sh
 .DS_Store?
 ._*
 .Spotlight-V100
 .Trashes
 ehthumbs.db
 Thumbs.db
-*.swp
-*.swo
-*~
 
-# IDE
-.vscode/
-.idea/
-.cursor/
+# Log files
+*.log
 
-# Environment & credentials
+# Environment variables
 .env
-.env.*
-!.env.example
-.mcp.json
-.claude/
-.codex/
+.env.local
+.env.*.local
 
-# === Core (Go) ===
-core/phantom-auth/
-core/bin/
-core/bin-linux/
-core/dist/
-core/orama-cli-linux
-core/keys_backup/
-core/.gocache/
-core/configs/
-core/data/*
-core/tmp/
-core/temp/
-core/results/
-core/rnd/
-core/vps.txt
-core/coverage.txt
-core/coverage.html
-core/profile.out
-core/e2e/config.yaml
-core/scripts/remote-nodes.conf
+# E2E test config (contains production credentials)
+e2e/config.yaml
 
-# Go build artifacts
-*.exe
-*.exe~
-*.dll
-*.so
-*.dylib
-*.test
-*.out
+# Temporary files
+tmp/
+temp/
+*.tmp
+
+# Coverage reports
+coverage.txt
+coverage.html
+profile.out
+
+# Build artifacts
 *.deb
 *.rpm
 *.tar.gz
 *.zip
-go.work
 
-# Logs
-*.log
-
-# Databases
-*.db
-
-# === Website ===
-website/node_modules/
-website/dist/
-website/invest-api/invest-api
-website/invest-api/*.db
-website/invest-api/*.db-shm
-website/invest-api/*.db-wal
-
-# === SDK (TypeScript) ===
-sdk/node_modules/
-sdk/dist/
-sdk/coverage/
-
-# === Vault (Zig) ===
-vault/.zig-cache/
-vault/zig-out/
-
-# === OS ===
-os/output/
-
-# === Local development ===
-.dev/
+# Local development files
 .local/
 local/
+
+data/*
+./bootstrap
+./node
+data/bootstrap/rqlite/
+
+.env.*
+
+configs/
+
+.dev/
+
+.gocache/
+
+.claude/
+.mcp.json
+.cursor/
+
+# Remote node credentials
+scripts/remote-nodes.conf
+
+orama-cli-linux
+
+rnd/
+
+keys_backup/
+
+vps.txt
+
+bin-linux/
+
+website/
+
+terms-agreement
+
+./cli
+./inspector
+
+results/
+
+phantom-auth/
+
+*.db

.goreleaser.yaml

@@ -9,13 +9,11 @@ env:
 
 before:
   hooks:
-    - cmd: go mod tidy
-      dir: core
+    - go mod tidy
 
 builds:
   # orama CLI binary
   - id: orama
-    dir: core
     main: ./cmd/cli
     binary: orama
     goos:
@@ -33,7 +31,6 @@ builds:
 
   # orama-node binary (Linux only for apt)
   - id: orama-node
-    dir: core
     main: ./cmd/node
     binary: orama-node
     goos:
@@ -87,7 +84,7 @@ nfpms:
     section: utils
     priority: optional
     contents:
-      - src: ./core/README.md
+      - src: ./README.md
         dst: /usr/share/doc/orama/README.md
     deb:
       lintian_overrides:
@@ -109,7 +106,7 @@ nfpms:
     section: net
     priority: optional
     contents:
-      - src: ./core/README.md
+      - src: ./README.md
         dst: /usr/share/doc/orama-node/README.md
     deb:
       lintian_overrides:

CONTRIBUTING.md

@@ -1,78 +1,47 @@
-# Contributing to Orama Network
+# Contributing to DeBros Network
 
-Thanks for helping improve the network! This monorepo contains multiple projects — pick the one relevant to your contribution.
+Thanks for helping improve the network! This guide covers setup, local dev, tests, and PR guidelines.
 
-## Repository Structure
+## Requirements
 
-| Package | Language | Build |
-|---------|----------|-------|
-| `core/` | Go 1.24+ | `make core-build` |
-| `website/` | TypeScript (pnpm) | `make website-build` |
-| `vault/` | Zig 0.14+ | `make vault-build` |
-| `os/` | Go + Buildroot | `make os-build` |
+- Go 1.22+ (1.23 recommended)
+- RQLite (optional for local runs; the Makefile starts nodes with embedded setup)
+- Make (optional)
 
 ## Setup
 
 ```bash
 git clone https://github.com/DeBrosOfficial/network.git
 cd network
-```
-
-### Core (Go)
-
-```bash
-cd core
 make deps
-make build
-make test
 ```
 
-### Website
+## Build, Test, Lint
+
+- Build: `make build`
+- Test: `make test`
+- Format/Vet: `make fmt vet` (or `make lint`)
+
+````
+
+Useful CLI commands:
 
 ```bash
-cd website
-pnpm install
-pnpm dev
-```
+./bin/orama health
+./bin/orama peers
+./bin/orama status
+````
 
-### Vault (Zig)
+## Versioning
 
-```bash
-cd vault
-zig build
-zig build test
-```
+- The CLI reports its version via `orama version`.
+- Releases are tagged (e.g., `v0.18.0-beta`) and published via GoReleaser.
 
 ## Pull Requests
 
-1. Fork and create a topic branch from `main`.
-2. Ensure `make test` passes for affected packages.
-3. Include tests for new functionality or bug fixes.
-4. Keep PRs focused — one concern per PR.
-5. Write a clear description: motivation, approach, and how you tested it.
-6. Update docs if you're changing user-facing behavior.
-
-## Code Style
-
-### Go (core/, os/)
-
-- Follow standard Go conventions
-- Run `make lint` before submitting
-- Wrap errors with context: `fmt.Errorf("failed to X: %w", err)`
-- No magic values — use named constants
-
-### TypeScript (website/)
-
-- TypeScript strict mode
-- Follow existing patterns in the codebase
-
-### Zig (vault/)
-
-- Follow standard Zig conventions
-- Run `zig build test` before submitting
-
-## Security
-
-If you find a security vulnerability, **do not open a public issue**. Email security@debros.io instead.
+1. Fork and create a topic branch.
+2. Ensure `make build test` passes; include tests for new functionality.
+3. Keep PRs focused and well-described (motivation, approach, testing).
+4. Update README/docs for behavior changes.
 
 Thank you for contributing!

Makefile

@@ -1,66 +1,176 @@
-# Orama Monorepo
-# Delegates to sub-project Makefiles
+TEST?=./...
 
-.PHONY: help build test clean
+.PHONY: test
+test:
+	@echo Running tests...
+	go test -v $(TEST)
 
-# === Core (Go network) ===
-.PHONY: core core-build core-test core-clean core-lint
-core: core-build
+# Gateway-focused E2E tests assume gateway and nodes are already running
+# Auto-discovers configuration from ~/.orama and queries database for API key
+# No environment variables required
+.PHONY: test-e2e test-e2e-deployments test-e2e-fullstack test-e2e-https test-e2e-quick test-e2e-prod test-e2e-shared test-e2e-cluster test-e2e-integration test-e2e-production
 
-core-build:
-	$(MAKE) -C core build
+# Production E2E tests - includes production-only tests
+test-e2e-prod:
+	@if [ -z "$$ORAMA_GATEWAY_URL" ]; then \
+		echo "❌ ORAMA_GATEWAY_URL not set"; \
+		echo "Usage: ORAMA_GATEWAY_URL=https://dbrs.space make test-e2e-prod"; \
+		exit 1; \
+	fi
+	@echo "Running E2E tests (including production-only) against $$ORAMA_GATEWAY_URL..."
+	go test -v -tags "e2e production" -timeout 30m ./e2e/...
 
-core-test:
-	$(MAKE) -C core test
+# Generic e2e target
+test-e2e:
+	@echo "Running comprehensive E2E tests..."
+	@echo "Auto-discovering configuration from ~/.orama..."
+	go test -v -tags e2e -timeout 30m ./e2e/...
 
-core-lint:
-	$(MAKE) -C core lint
+test-e2e-deployments:
+	@echo "Running deployment E2E tests..."
+	go test -v -tags e2e -timeout 15m ./e2e/deployments/...
 
-core-clean:
-	$(MAKE) -C core clean
+test-e2e-fullstack:
+	@echo "Running fullstack E2E tests..."
+	go test -v -tags e2e -timeout 20m -run "TestFullStack" ./e2e/...
 
-# === Website ===
-.PHONY: website website-dev website-build
-website-dev:
-	cd website && pnpm dev
+test-e2e-https:
+	@echo "Running HTTPS/external access E2E tests..."
+	go test -v -tags e2e -timeout 10m -run "TestHTTPS" ./e2e/...
 
-website-build:
-	cd website && pnpm build
+test-e2e-shared:
+	@echo "Running shared E2E tests..."
+	go test -v -tags e2e -timeout 10m ./e2e/shared/...
 
-# === SDK (TypeScript) ===
-.PHONY: sdk sdk-build sdk-test
-sdk: sdk-build
+test-e2e-cluster:
+	@echo "Running cluster E2E tests..."
+	go test -v -tags e2e -timeout 15m ./e2e/cluster/...
 
-sdk-build:
-	cd sdk && pnpm install && pnpm build
+test-e2e-integration:
+	@echo "Running integration E2E tests..."
+	go test -v -tags e2e -timeout 20m ./e2e/integration/...
 
-sdk-test:
-	cd sdk && pnpm test
+test-e2e-production:
+	@echo "Running production-only E2E tests..."
+	go test -v -tags "e2e production" -timeout 15m ./e2e/production/...
 
-# === Vault (Zig) ===
-.PHONY: vault vault-build vault-test
-vault-build:
-	cd vault && zig build
+test-e2e-quick:
+	@echo "Running quick E2E smoke tests..."
+	go test -v -tags e2e -timeout 5m -run "TestStatic|TestHealth" ./e2e/...
 
-vault-test:
-	cd vault && zig build test
+# Network - Distributed P2P Database System
+# Makefile for development and build tasks
 
-# === OS ===
-.PHONY: os os-build
-os-build:
-	$(MAKE) -C os
+.PHONY: build clean test deps tidy fmt vet lint install-hooks redeploy-devnet redeploy-testnet release health
 
-# === Aggregate ===
-build: core-build
-test: core-test
-clean: core-clean
+VERSION := 0.111.0
+COMMIT  ?= $(shell git rev-parse --short HEAD 2>/dev/null || echo unknown)
+DATE    ?= $(shell date -u +%Y-%m-%dT%H:%M:%SZ)
+LDFLAGS := -X 'main.version=$(VERSION)' -X 'main.commit=$(COMMIT)' -X 'main.date=$(DATE)'
+LDFLAGS_LINUX := -s -w $(LDFLAGS)
 
+# Build targets
+build: deps
+	@echo "Building network executables (version=$(VERSION))..."
+	@mkdir -p bin
+	go build -ldflags "$(LDFLAGS)" -o bin/identity ./cmd/identity
+	go build -ldflags "$(LDFLAGS)" -o bin/orama-node ./cmd/node
+	go build -ldflags "$(LDFLAGS)" -o bin/orama ./cmd/cli/
+	# Inject gateway build metadata via pkg path variables
+	go build -ldflags "$(LDFLAGS) -X 'github.com/DeBrosOfficial/network/pkg/gateway.BuildVersion=$(VERSION)' -X 'github.com/DeBrosOfficial/network/pkg/gateway.BuildCommit=$(COMMIT)' -X 'github.com/DeBrosOfficial/network/pkg/gateway.BuildTime=$(DATE)'" -o bin/gateway ./cmd/gateway
+	@echo "Build complete! Run ./bin/orama version"
+
+# Cross-compile CLI for Linux (only binary needed locally; VPS builds everything else from source)
+build-linux: deps
+	@echo "Cross-compiling CLI for linux/amd64 (version=$(VERSION))..."
+	@mkdir -p bin-linux
+	GOOS=linux GOARCH=amd64 go build -ldflags "$(LDFLAGS_LINUX)" -trimpath -o bin-linux/orama ./cmd/cli/
+	@echo "✓ CLI built at bin-linux/orama"
+	@echo ""
+	@echo "Next steps:"
+	@echo "  ./scripts/generate-source-archive.sh"
+	@echo "  ./bin/orama install --vps-ip <ip> --nameserver --domain ..."
+
+# Install git hooks
+install-hooks:
+	@echo "Installing git hooks..."
+	@bash scripts/install-hooks.sh
+
+# Clean build artifacts
+clean:
+	@echo "Cleaning build artifacts..."
+	rm -rf bin/
+	rm -rf data/
+	@echo "Clean complete!"
+
+# Deploy to devnet (build + rolling upgrade all nodes)
+redeploy-devnet:
+	@bash scripts/redeploy.sh --devnet
+
+# Deploy to devnet without rebuilding
+redeploy-devnet-quick:
+	@bash scripts/redeploy.sh --devnet --no-build
+
+# Deploy to testnet (build + rolling upgrade all nodes)
+redeploy-testnet:
+	@bash scripts/redeploy.sh --testnet
+
+# Deploy to testnet without rebuilding
+redeploy-testnet-quick:
+	@bash scripts/redeploy.sh --testnet --no-build
+
+# Interactive release workflow (tag + push)
+release:
+	@bash scripts/release.sh
+
+# Check health of all nodes in an environment
+# Usage: make health ENV=devnet
+health:
+	@if [ -z "$(ENV)" ]; then \
+		echo "Usage: make health ENV=devnet|testnet"; \
+		exit 1; \
+	fi
+	@while IFS='|' read -r env host pass role key; do \
+		[ -z "$$env" ] && continue; \
+		case "$$env" in \#*) continue;; esac; \
+		env="$$(echo "$$env" | xargs)"; \
+		[ "$$env" != "$(ENV)" ] && continue; \
+		role="$$(echo "$$role" | xargs)"; \
+		bash scripts/check-node-health.sh "$$host" "$$pass" "$$host ($$role)"; \
+	done < scripts/remote-nodes.conf
+
+# Help
 help:
-	@echo "Orama Monorepo"
+	@echo "Available targets:"
+	@echo "  build         - Build all executables"
+	@echo "  clean         - Clean build artifacts"
+	@echo "  test          - Run unit tests"
 	@echo ""
-	@echo "  Core (Go):     make core-build | core-test | core-lint | core-clean"
-	@echo "  Website:       make website-dev | website-build"
-	@echo "  Vault (Zig):   make vault-build | vault-test"
-	@echo "  OS:            make os-build"
+	@echo "E2E Testing:"
+	@echo "  make test-e2e-prod        - Run all E2E tests incl. production-only (needs ORAMA_GATEWAY_URL)"
+	@echo "  make test-e2e-shared      - Run shared E2E tests (cache, storage, pubsub, auth)"
+	@echo "  make test-e2e-cluster     - Run cluster E2E tests (libp2p, olric, rqlite, namespace)"
+	@echo "  make test-e2e-integration - Run integration E2E tests (fullstack, persistence, concurrency)"
+	@echo "  make test-e2e-deployments - Run deployment E2E tests"
+	@echo "  make test-e2e-production  - Run production-only E2E tests (DNS, HTTPS, cross-node)"
+	@echo "  make test-e2e-quick       - Quick smoke tests (static deploys, health checks)"
+	@echo "  make test-e2e             - Generic E2E tests (auto-discovers config)"
 	@echo ""
-	@echo "  Aggregate:     make build | test | clean  (delegates to core)"
+	@echo "  Example:"
+	@echo "    ORAMA_GATEWAY_URL=https://orama-devnet.network make test-e2e-prod"
+	@echo ""
+	@echo "Deployment:"
+	@echo "  make redeploy-devnet       - Build + rolling deploy to all devnet nodes"
+	@echo "  make redeploy-devnet-quick - Deploy to devnet without rebuilding"
+	@echo "  make redeploy-testnet      - Build + rolling deploy to all testnet nodes"
+	@echo "  make redeploy-testnet-quick- Deploy to testnet without rebuilding"
+	@echo "  make health ENV=devnet     - Check health of all nodes in an environment"
+	@echo "  make release               - Interactive release workflow (tag + push)"
+	@echo ""
+	@echo "Maintenance:"
+	@echo "  deps          - Download dependencies"
+	@echo "  tidy          - Tidy dependencies"
+	@echo "  fmt           - Format code"
+	@echo "  vet           - Vet code"
+	@echo "  lint          - Lint code (fmt + vet)"
+	@echo "  help          - Show this help"

README.md

@@ -1,50 +1,461 @@
-# Orama Network
+# Orama Network - Distributed P2P Platform
 
-A decentralized infrastructure platform combining distributed SQL, IPFS storage, caching, serverless WASM execution, and privacy relay — all managed through a unified API gateway.
+A high-performance API Gateway and distributed platform built in Go. Provides a unified HTTP/HTTPS API for distributed SQL (RQLite), distributed caching (Olric), decentralized storage (IPFS), pub/sub messaging, and serverless WebAssembly execution.
 
-## Packages
+**Architecture:** Modular Gateway / Edge Proxy following SOLID principles
 
-| Package | Language | Description |
-|---------|----------|-------------|
-| [core/](core/) | Go | API gateway, distributed node, CLI, and client SDK |
-| [sdk/](sdk/) | TypeScript | `@debros/orama` — JavaScript/TypeScript SDK ([npm](https://www.npmjs.com/package/@debros/orama)) |
-| [website/](website/) | TypeScript | Marketing website and invest portal |
-| [vault/](vault/) | Zig | Distributed secrets vault (Shamir's Secret Sharing) |
-| [os/](os/) | Go + Buildroot | OramaOS — hardened minimal Linux for network nodes |
+## Features
+
+- **🔐 Authentication** - Wallet signatures, API keys, JWT tokens
+- **💾 Storage** - IPFS-based decentralized file storage with encryption
+- **⚡ Cache** - Distributed cache with Olric (in-memory key-value)
+- **🗄️ Database** - RQLite distributed SQL with Raft consensus + Per-namespace SQLite databases
+- **📡 Pub/Sub** - Real-time messaging via LibP2P and WebSocket
+- **⚙️ Serverless** - WebAssembly function execution with host functions
+- **🌐 HTTP Gateway** - Unified REST API with automatic HTTPS (Let's Encrypt)
+- **📦 Client SDK** - Type-safe Go SDK for all services
+- **🚀 App Deployments** - Deploy React, Next.js, Go, Node.js apps with automatic domains
+- **🗄️ SQLite Databases** - Per-namespace isolated databases with IPFS backups
+
+## Application Deployments
+
+Deploy full-stack applications with automatic domain assignment and namespace isolation.
+
+### Deploy a React App
+
+```bash
+# Build your app
+cd my-react-app
+npm run build
+
+# Deploy to Orama Network
+orama deploy static ./dist --name my-app
+
+# Your app is now live at: https://my-app.orama.network
+```
+
+### Deploy Next.js with SSR
+
+```bash
+cd my-nextjs-app
+
+# Ensure next.config.js has: output: 'standalone'
+npm run build
+orama deploy nextjs . --name my-nextjs --ssr
+
+# Live at: https://my-nextjs.orama.network
+```
+
+### Deploy Go Backend
+
+```bash
+# Build for Linux (name binary 'app' for auto-detection)
+GOOS=linux GOARCH=amd64 go build -o app main.go
+
+# Deploy (must implement /health endpoint)
+orama deploy go ./app --name my-api
+
+# API live at: https://my-api.orama.network
+```
+
+### Create SQLite Database
+
+```bash
+# Create database
+orama db create my-database
+
+# Create schema
+orama db query my-database "CREATE TABLE users (id INT, name TEXT)"
+
+# Insert data
+orama db query my-database "INSERT INTO users VALUES (1, 'Alice')"
+
+# Query data
+orama db query my-database "SELECT * FROM users"
+
+# Backup to IPFS
+orama db backup my-database
+```
+
+### Full-Stack Example
+
+Deploy a complete app with React frontend, Go backend, and SQLite database:
+
+```bash
+# 1. Create database
+orama db create myapp-db
+orama db query myapp-db "CREATE TABLE users (id INT PRIMARY KEY, name TEXT)"
+
+# 2. Deploy Go backend (connects to database)
+GOOS=linux GOARCH=amd64 go build -o api main.go
+orama deploy go ./api --name myapp-api
+
+# 3. Deploy React frontend (calls backend API)
+cd frontend && npm run build
+orama deploy static ./dist --name myapp
+
+# Access:
+# Frontend: https://myapp.orama.network
+# Backend: https://myapp-api.orama.network
+```
+
+**📖 Full Guide**: See [Deployment Guide](docs/DEPLOYMENT_GUIDE.md) for complete documentation, examples, and best practices.
 
 ## Quick Start
 
+### Building
+
 ```bash
-# Build the core network binaries
-make core-build
-
-# Run tests
-make core-test
-
-# Start website dev server
-make website-dev
-
-# Build vault
-make vault-build
+# Build all binaries
+make build
 ```
 
+## CLI Commands
+
+### Authentication
+
+```bash
+orama auth login            # Authenticate with wallet
+orama auth status           # Check authentication
+orama auth logout           # Clear credentials
+```
+
+### Application Deployments
+
+```bash
+# Deploy applications
+orama deploy static <path> --name myapp       # React, Vue, static sites
+orama deploy nextjs <path> --name myapp --ssr # Next.js with SSR (requires output: 'standalone')
+orama deploy go <path> --name myapp           # Go binaries (must have /health endpoint)
+orama deploy nodejs <path> --name myapp       # Node.js apps (must have /health endpoint)
+
+# Manage deployments
+orama app list                               # List all deployments
+orama app get <name>                         # Get deployment details
+orama app logs <name> --follow               # View logs
+orama app delete <name>                      # Delete deployment
+orama app rollback <name> --version 1        # Rollback to version
+```
+
+### SQLite Databases
+
+```bash
+orama db create <name>                   # Create database
+orama db query <name> "SELECT * FROM t"  # Execute SQL query
+orama db list                            # List all databases
+orama db backup <name>                   # Backup to IPFS
+orama db backups <name>                  # List backups
+```
+
+### Environment Management
+
+```bash
+orama env list              # List available environments
+orama env current           # Show active environment
+orama env use <name>        # Switch environment
+```
+
+## Serverless Functions (WASM)
+
+Orama supports high-performance serverless function execution using WebAssembly (WASM). Functions are isolated, secure, and can interact with network services like the distributed cache.
+
+### 1. Build Functions
+
+Functions must be compiled to WASM. We recommend using [TinyGo](https://tinygo.org/).
+
+```bash
+# Build example functions to examples/functions/bin/
+./examples/functions/build.sh
+```
+
+### 2. Deployment
+
+Deploy your compiled `.wasm` file to the network via the Gateway.
+
+```bash
+# Deploy a function
+curl -X POST https://your-node.example.com/v1/functions \
+  -H "Authorization: Bearer <your_api_key>" \
+  -F "name=hello-world" \
+  -F "namespace=default" \
+  -F "wasm=@./examples/functions/bin/hello.wasm"
+```
+
+### 3. Invocation
+
+Trigger your function with a JSON payload. The function receives the payload via `stdin` and returns its response via `stdout`.
+
+```bash
+# Invoke via HTTP
+curl -X POST https://your-node.example.com/v1/functions/hello-world/invoke \
+  -H "Authorization: Bearer <your_api_key>" \
+  -H "Content-Type: application/json" \
+  -d '{"name": "Developer"}'
+```
+
+### 4. Management
+
+```bash
+# List all functions in a namespace
+curl https://your-node.example.com/v1/functions?namespace=default
+
+# Delete a function
+curl -X DELETE https://your-node.example.com/v1/functions/hello-world?namespace=default
+```
+
+## Production Deployment
+
+### Prerequisites
+
+- Ubuntu 22.04+ or Debian 12+
+- `amd64` or `arm64` architecture
+- 4GB RAM, 50GB SSD, 2 CPU cores
+
+### Required Ports
+
+**External (must be open in firewall):**
+
+- **80** - HTTP (ACME/Let's Encrypt certificate challenges)
+- **443** - HTTPS (Main gateway API endpoint)
+- **4101** - IPFS Swarm (peer connections)
+- **7001** - RQLite Raft (cluster consensus)
+
+**Internal (bound to localhost, no firewall needed):**
+
+- 4501 - IPFS API
+- 5001 - RQLite HTTP API
+- 6001 - Unified Gateway
+- 8080 - IPFS Gateway
+- 9050 - Anyone SOCKS5 proxy
+- 9094 - IPFS Cluster API
+- 3320/3322 - Olric Cache
+
+**Anyone Relay Mode (optional, for earning rewards):**
+
+- 9001 - Anyone ORPort (relay traffic, must be open externally)
+
+### Anyone Network Integration
+
+Orama Network integrates with the [Anyone Protocol](https://anyone.io) for anonymous routing. By default, nodes run as **clients** (consuming the network). Optionally, you can run as a **relay operator** to earn rewards.
+
+**Client Mode (Default):**
+- Routes traffic through Anyone network for anonymity
+- SOCKS5 proxy on localhost:9050
+- No rewards, just consumes network
+
+**Relay Mode (Earn Rewards):**
+- Provide bandwidth to the Anyone network
+- Earn $ANYONE tokens as a relay operator
+- Requires 100 $ANYONE tokens in your wallet
+- Requires ORPort (9001) open to the internet
+
+```bash
+# Install as relay operator (earn rewards)
+sudo orama node install --vps-ip <IP> --domain <domain> \
+  --anyone-relay \
+  --anyone-nickname "MyRelay" \
+  --anyone-contact "operator@email.com" \
+  --anyone-wallet "0x1234...abcd"
+
+# With exit relay (legal implications apply)
+sudo orama node install --vps-ip <IP> --domain <domain> \
+  --anyone-relay \
+  --anyone-exit \
+  --anyone-nickname "MyExitRelay" \
+  --anyone-contact "operator@email.com" \
+  --anyone-wallet "0x1234...abcd"
+
+# Migrate existing Anyone installation
+sudo orama node install --vps-ip <IP> --domain <domain> \
+  --anyone-relay \
+  --anyone-migrate \
+  --anyone-nickname "MyRelay" \
+  --anyone-contact "operator@email.com" \
+  --anyone-wallet "0x1234...abcd"
+```
+
+**Important:** After installation, register your relay at [dashboard.anyone.io](https://dashboard.anyone.io) to start earning rewards.
+
+### Installation
+
+**macOS (Homebrew):**
+
+```bash
+brew install DeBrosOfficial/tap/orama
+```
+
+**Linux (Debian/Ubuntu):**
+
+```bash
+# Download and install the latest .deb package
+curl -sL https://github.com/DeBrosOfficial/network/releases/latest/download/orama_$(curl -s https://api.github.com/repos/DeBrosOfficial/network/releases/latest | grep tag_name | cut -d '"' -f 4 | tr -d 'v')_linux_amd64.deb -o orama.deb
+sudo dpkg -i orama.deb
+```
+
+**From Source:**
+
+```bash
+go install github.com/DeBrosOfficial/network/cmd/cli@latest
+```
+
+**Setup (after installation):**
+
+```bash
+sudo orama node install --interactive
+```
+
+### Service Management
+
+```bash
+# Status
+sudo orama node status
+
+# Control services
+sudo orama node start
+sudo orama node stop
+sudo orama node restart
+
+# Diagnose issues
+sudo orama node doctor
+
+# View logs
+orama node logs node --follow
+orama node logs gateway --follow
+orama node logs ipfs --follow
+```
+
+### Upgrade
+
+```bash
+# Upgrade to latest version
+sudo orama node upgrade --restart
+```
+
+## Configuration
+
+All configuration lives in `~/.orama/`:
+
+- `configs/node.yaml` - Node configuration
+- `configs/gateway.yaml` - Gateway configuration
+- `configs/olric.yaml` - Cache configuration
+- `secrets/` - Keys and certificates
+- `data/` - Service data directories
+
+## Troubleshooting
+
+### Services Not Starting
+
+```bash
+# Check status
+systemctl status orama-node
+
+# View logs
+journalctl -u orama-node -f
+
+# Check log files
+tail -f /opt/orama/.orama/logs/node.log
+```
+
+### Port Conflicts
+
+```bash
+# Check what's using specific ports
+sudo lsof -i :443   # HTTPS Gateway
+sudo lsof -i :7001  # TCP/SNI Gateway
+sudo lsof -i :6001  # Internal Gateway
+```
+
+### RQLite Cluster Issues
+
+```bash
+# Connect to RQLite CLI
+rqlite -H localhost -p 5001
+
+# Check cluster status
+.nodes
+.status
+.ready
+
+# Check consistency level
+.consistency
+```
+
+### Reset Installation
+
+```bash
+# Production reset (⚠️ DESTROYS DATA)
+sudo orama node uninstall
+sudo rm -rf /opt/orama/.orama
+sudo orama node install
+```
+
+## HTTP Gateway API
+
+### Main Gateway Endpoints
+
+- `GET /health` - Health status
+- `GET /v1/status` - Full status
+- `GET /v1/version` - Version info
+- `POST /v1/rqlite/exec` - Execute SQL
+- `POST /v1/rqlite/query` - Query database
+- `GET /v1/rqlite/schema` - Get schema
+- `POST /v1/pubsub/publish` - Publish message
+- `GET /v1/pubsub/topics` - List topics
+- `GET /v1/pubsub/ws?topic=<name>` - WebSocket subscribe
+- `POST /v1/functions` - Deploy function (multipart/form-data)
+- `POST /v1/functions/{name}/invoke` - Invoke function
+- `GET /v1/functions` - List functions
+- `DELETE /v1/functions/{name}` - Delete function
+- `GET /v1/functions/{name}/logs` - Get function logs
+
+See `openapi/gateway.yaml` for complete API specification.
+
 ## Documentation
 
-| Document | Description |
-|----------|-------------|
-| [Architecture](core/docs/ARCHITECTURE.md) | System architecture and design patterns |
-| [Deployment Guide](core/docs/DEPLOYMENT_GUIDE.md) | Deploy apps, databases, and domains |
-| [Dev & Deploy](core/docs/DEV_DEPLOY.md) | Building, deploying to VPS, rolling upgrades |
-| [Security](core/docs/SECURITY.md) | Security hardening and threat model |
-| [Monitoring](core/docs/MONITORING.md) | Cluster health monitoring |
-| [Client SDK](core/docs/CLIENT_SDK.md) | Go SDK documentation |
-| [Serverless](core/docs/SERVERLESS.md) | WASM serverless functions |
-| [Common Problems](core/docs/COMMON_PROBLEMS.md) | Troubleshooting known issues |
+- **[Deployment Guide](docs/DEPLOYMENT_GUIDE.md)** - Deploy React, Next.js, Go apps and manage databases
+- **[Architecture Guide](docs/ARCHITECTURE.md)** - System architecture and design patterns
+- **[Client SDK](docs/CLIENT_SDK.md)** - Go SDK documentation and examples
+- **[Gateway API](docs/GATEWAY_API.md)** - Complete HTTP API reference
+- **[Security Deployment](docs/SECURITY_DEPLOYMENT_GUIDE.md)** - Production security hardening
+- **[Testing Plan](docs/TESTING_PLAN.md)** - Comprehensive testing strategy and implementation
+
+## Resources
+
+- [RQLite Documentation](https://rqlite.io/docs/)
+- [IPFS Documentation](https://docs.ipfs.tech/)
+- [LibP2P Documentation](https://docs.libp2p.io/)
+- [WebAssembly](https://webassembly.org/)
+- [GitHub Repository](https://github.com/DeBrosOfficial/network)
+- [Issue Tracker](https://github.com/DeBrosOfficial/network/issues)
+
+## Project Structure
+
+```
+network/
+├── cmd/              # Binary entry points
+│   ├── cli/         # CLI tool
+│   ├── gateway/     # HTTP Gateway
+│   ├── node/        # P2P Node
+├── pkg/              # Core packages
+│   ├── gateway/     # Gateway implementation
+│   │   └── handlers/ # HTTP handlers by domain
+│   ├── client/      # Go SDK
+│   ├── serverless/  # WASM engine
+│   ├── rqlite/      # Database ORM
+│   ├── contracts/   # Interface definitions
+│   ├── httputil/    # HTTP utilities
+│   └── errors/      # Error handling
+├── docs/            # Documentation
+├── e2e/             # End-to-end tests
+└── examples/        # Example code
+```
 
 ## Contributing
 
-See [CONTRIBUTING.md](CONTRIBUTING.md) for setup, development, and PR guidelines.
+Contributions are welcome! This project follows:
+- **SOLID Principles** - Single responsibility, open/closed, etc.
+- **DRY Principle** - Don't repeat yourself
+- **Clean Architecture** - Clear separation of concerns
+- **Test Coverage** - Unit and E2E tests required
 
-## License
-
-[AGPL-3.0](LICENSE)
+See our architecture docs for design patterns and guidelines.

cmd/cli/root.go

@@ -9,7 +9,6 @@ import (
 	// Command groups
 	"github.com/DeBrosOfficial/network/pkg/cli/cmd/app"
 	"github.com/DeBrosOfficial/network/pkg/cli/cmd/authcmd"
-	"github.com/DeBrosOfficial/network/pkg/cli/cmd/buildcmd"
 	"github.com/DeBrosOfficial/network/pkg/cli/cmd/dbcmd"
 	deploycmd "github.com/DeBrosOfficial/network/pkg/cli/cmd/deploy"
 	"github.com/DeBrosOfficial/network/pkg/cli/cmd/envcmd"
@@ -18,7 +17,6 @@ import (
 	"github.com/DeBrosOfficial/network/pkg/cli/cmd/monitorcmd"
 	"github.com/DeBrosOfficial/network/pkg/cli/cmd/namespacecmd"
 	"github.com/DeBrosOfficial/network/pkg/cli/cmd/node"
-	"github.com/DeBrosOfficial/network/pkg/cli/cmd/sandboxcmd"
 )
 
 // version metadata populated via -ldflags at build time
@@ -85,12 +83,6 @@ and interacting with the Orama distributed network.`,
 	// Serverless function commands
 	rootCmd.AddCommand(functioncmd.Cmd)
 
-	// Build command (cross-compile binary archive)
-	rootCmd.AddCommand(buildcmd.Cmd)
-
-	// Sandbox command (ephemeral Hetzner Cloud clusters)
-	rootCmd.AddCommand(sandboxcmd.Cmd)
-
 	return rootCmd
 }
 

cmd/gateway/config.go

@@ -69,13 +69,6 @@ func parseGatewayConfig(logger *logging.ColoredLogger) *gateway.Config {
 	}
 
 	// Load YAML
-	type yamlWebRTCCfg struct {
-		Enabled    bool   `yaml:"enabled"`
-		SFUPort    int    `yaml:"sfu_port"`
-		TURNDomain string `yaml:"turn_domain"`
-		TURNSecret string `yaml:"turn_secret"`
-	}
-
 	type yamlCfg struct {
 		ListenAddr            string   `yaml:"listen_addr"`
 		ClientNamespace       string   `yaml:"client_namespace"`
@@ -91,7 +84,6 @@ func parseGatewayConfig(logger *logging.ColoredLogger) *gateway.Config {
 		IPFSAPIURL            string   `yaml:"ipfs_api_url"`
 		IPFSTimeout           string   `yaml:"ipfs_timeout"`
 		IPFSReplicationFactor int      `yaml:"ipfs_replication_factor"`
-		WebRTC                yamlWebRTCCfg `yaml:"webrtc"`
 	}
 
 	data, err := os.ReadFile(configPath)
@@ -200,18 +192,6 @@ func parseGatewayConfig(logger *logging.ColoredLogger) *gateway.Config {
 		cfg.IPFSReplicationFactor = y.IPFSReplicationFactor
 	}
 
-	// WebRTC configuration
-	cfg.WebRTCEnabled = y.WebRTC.Enabled
-	if y.WebRTC.SFUPort > 0 {
-		cfg.SFUPort = y.WebRTC.SFUPort
-	}
-	if v := strings.TrimSpace(y.WebRTC.TURNDomain); v != "" {
-		cfg.TURNDomain = v
-	}
-	if v := strings.TrimSpace(y.WebRTC.TURNSecret); v != "" {
-		cfg.TURNSecret = v
-	}
-
 	// Validate configuration
 	if errs := cfg.ValidateConfig(); len(errs) > 0 {
 		fmt.Fprintf(os.Stderr, "\nGateway configuration errors (%d):\n", len(errs))

core/.env.example

@@ -1,8 +0,0 @@
-# OpenRouter API Key for changelog generation
-# Get your API key from https://openrouter.ai/keys
-OPENROUTER_API_KEY=your-api-key-here
-
-# ZeroSSL API Key for TLS certificates (alternative to Let's Encrypt)
-# Get your free API key from https://app.zerossl.com/developer
-# If not set, Caddy will use Let's Encrypt as the default CA
-ZEROSSL_API_KEY=

core/Makefile

@@ -1,181 +0,0 @@
-TEST?=./...
-
-.PHONY: test
-test:
-	@echo Running tests...
-	go test -v $(TEST)
-
-# Gateway-focused E2E tests assume gateway and nodes are already running
-# Auto-discovers configuration from ~/.orama and queries database for API key
-# No environment variables required
-.PHONY: test-e2e test-e2e-deployments test-e2e-fullstack test-e2e-https test-e2e-quick test-e2e-prod test-e2e-shared test-e2e-cluster test-e2e-integration test-e2e-production
-
-# Production E2E tests - includes production-only tests
-test-e2e-prod:
-	@if [ -z "$$ORAMA_GATEWAY_URL" ]; then \
-		echo "❌ ORAMA_GATEWAY_URL not set"; \
-		echo "Usage: ORAMA_GATEWAY_URL=https://dbrs.space make test-e2e-prod"; \
-		exit 1; \
-	fi
-	@echo "Running E2E tests (including production-only) against $$ORAMA_GATEWAY_URL..."
-	go test -v -tags "e2e production" -timeout 30m ./e2e/...
-
-# Generic e2e target
-test-e2e:
-	@echo "Running comprehensive E2E tests..."
-	@echo "Auto-discovering configuration from ~/.orama..."
-	go test -v -tags e2e -timeout 30m ./e2e/...
-
-test-e2e-deployments:
-	@echo "Running deployment E2E tests..."
-	go test -v -tags e2e -timeout 15m ./e2e/deployments/...
-
-test-e2e-fullstack:
-	@echo "Running fullstack E2E tests..."
-	go test -v -tags e2e -timeout 20m -run "TestFullStack" ./e2e/...
-
-test-e2e-https:
-	@echo "Running HTTPS/external access E2E tests..."
-	go test -v -tags e2e -timeout 10m -run "TestHTTPS" ./e2e/...
-
-test-e2e-shared:
-	@echo "Running shared E2E tests..."
-	go test -v -tags e2e -timeout 10m ./e2e/shared/...
-
-test-e2e-cluster:
-	@echo "Running cluster E2E tests..."
-	go test -v -tags e2e -timeout 15m ./e2e/cluster/...
-
-test-e2e-integration:
-	@echo "Running integration E2E tests..."
-	go test -v -tags e2e -timeout 20m ./e2e/integration/...
-
-test-e2e-production:
-	@echo "Running production-only E2E tests..."
-	go test -v -tags "e2e production" -timeout 15m ./e2e/production/...
-
-test-e2e-quick:
-	@echo "Running quick E2E smoke tests..."
-	go test -v -tags e2e -timeout 5m -run "TestStatic|TestHealth" ./e2e/...
-
-# Network - Distributed P2P Database System
-# Makefile for development and build tasks
-
-.PHONY: build clean test deps tidy fmt vet lint install-hooks push-devnet push-testnet rollout-devnet rollout-testnet release
-
-VERSION := 0.120.0
-COMMIT  ?= $(shell git rev-parse --short HEAD 2>/dev/null || echo unknown)
-DATE    ?= $(shell date -u +%Y-%m-%dT%H:%M:%SZ)
-LDFLAGS := -X 'main.version=$(VERSION)' -X 'main.commit=$(COMMIT)' -X 'main.date=$(DATE)'
-LDFLAGS_LINUX := -s -w $(LDFLAGS)
-
-# Build targets
-build: deps
-	@echo "Building network executables (version=$(VERSION))..."
-	@mkdir -p bin
-	go build -ldflags "$(LDFLAGS)" -o bin/identity ./cmd/identity
-	go build -ldflags "$(LDFLAGS)" -o bin/orama-node ./cmd/node
-	go build -ldflags "$(LDFLAGS)" -o bin/orama ./cmd/cli/
-	# Inject gateway build metadata via pkg path variables
-	go build -ldflags "$(LDFLAGS) -X 'github.com/DeBrosOfficial/network/pkg/gateway.BuildVersion=$(VERSION)' -X 'github.com/DeBrosOfficial/network/pkg/gateway.BuildCommit=$(COMMIT)' -X 'github.com/DeBrosOfficial/network/pkg/gateway.BuildTime=$(DATE)'" -o bin/gateway ./cmd/gateway
-	go build -ldflags "$(LDFLAGS)" -o bin/sfu ./cmd/sfu
-	go build -ldflags "$(LDFLAGS)" -o bin/turn ./cmd/turn
-	@echo "Build complete! Run ./bin/orama version"
-
-# Cross-compile CLI for Linux (only binary needed locally; VPS builds everything else from source)
-build-linux: deps
-	@echo "Cross-compiling CLI for linux/amd64 (version=$(VERSION))..."
-	@mkdir -p bin-linux
-	GOOS=linux GOARCH=amd64 go build -ldflags "$(LDFLAGS_LINUX)" -trimpath -o bin-linux/orama ./cmd/cli/
-	@echo "✓ CLI built at bin-linux/orama"
-	@echo ""
-	@echo "Prefer 'make build-archive' for full pre-built binary archive."
-
-# Build pre-compiled binary archive for deployment (all binaries + deps)
-build-archive: deps
-	@echo "Building binary archive (version=$(VERSION))..."
-	go build -ldflags "$(LDFLAGS)" -o bin/orama ./cmd/cli/
-	./bin/orama build --output /tmp/orama-$(VERSION)-linux-amd64.tar.gz
-
-# Install git hooks
-install-hooks:
-	@echo "Installing git hooks..."
-	@bash scripts/install-hooks.sh
-
-# Install orama CLI to ~/.local/bin and configure PATH
-install: build
-	@bash scripts/install.sh
-
-# Clean build artifacts
-clean:
-	@echo "Cleaning build artifacts..."
-	rm -rf bin/
-	rm -rf data/
-	@echo "Clean complete!"
-
-# Push binary archive to devnet nodes (fanout distribution)
-push-devnet:
-	./bin/orama node push --env devnet
-
-# Push binary archive to testnet nodes (fanout distribution)
-push-testnet:
-	./bin/orama node push --env testnet
-
-# Full rollout to devnet (build + push + rolling upgrade)
-rollout-devnet:
-	./bin/orama node rollout --env devnet --yes
-
-# Full rollout to testnet (build + push + rolling upgrade)
-rollout-testnet:
-	./bin/orama node rollout --env testnet --yes
-
-# Interactive release workflow (tag + push)
-release:
-	@bash scripts/release.sh
-
-# Check health of all nodes in an environment
-# Usage: make health ENV=devnet
-health:
-	@if [ -z "$(ENV)" ]; then \
-		echo "Usage: make health ENV=devnet|testnet"; \
-		exit 1; \
-	fi
-	./bin/orama monitor report --env $(ENV)
-
-# Help
-help:
-	@echo "Available targets:"
-	@echo "  build         - Build all executables"
-	@echo "  install       - Build and install 'orama' CLI to ~/.local/bin"
-	@echo "  clean         - Clean build artifacts"
-	@echo "  test          - Run unit tests"
-	@echo ""
-	@echo "E2E Testing:"
-	@echo "  make test-e2e-prod        - Run all E2E tests incl. production-only (needs ORAMA_GATEWAY_URL)"
-	@echo "  make test-e2e-shared      - Run shared E2E tests (cache, storage, pubsub, auth)"
-	@echo "  make test-e2e-cluster     - Run cluster E2E tests (libp2p, olric, rqlite, namespace)"
-	@echo "  make test-e2e-integration - Run integration E2E tests (fullstack, persistence, concurrency)"
-	@echo "  make test-e2e-deployments - Run deployment E2E tests"
-	@echo "  make test-e2e-production  - Run production-only E2E tests (DNS, HTTPS, cross-node)"
-	@echo "  make test-e2e-quick       - Quick smoke tests (static deploys, health checks)"
-	@echo "  make test-e2e             - Generic E2E tests (auto-discovers config)"
-	@echo ""
-	@echo "  Example:"
-	@echo "    ORAMA_GATEWAY_URL=https://orama-devnet.network make test-e2e-prod"
-	@echo ""
-	@echo "Deployment:"
-	@echo "  make build-archive         - Build pre-compiled binary archive for deployment"
-	@echo "  make push-devnet           - Push binary archive to devnet nodes"
-	@echo "  make push-testnet          - Push binary archive to testnet nodes"
-	@echo "  make rollout-devnet        - Full rollout: build + push + rolling upgrade (devnet)"
-	@echo "  make rollout-testnet       - Full rollout: build + push + rolling upgrade (testnet)"
-	@echo "  make health ENV=devnet     - Check health of all nodes in an environment"
-	@echo "  make release               - Interactive release workflow (tag + push)"
-	@echo ""
-	@echo "Maintenance:"
-	@echo "  deps          - Download dependencies"
-	@echo "  tidy          - Tidy dependencies"
-	@echo "  fmt           - Format code"
-	@echo "  vet           - Vet code"
-	@echo "  lint          - Lint code (fmt + vet)"
-	@echo "  help          - Show this help"

core/cmd/sfu/config.go

@@ -1,118 +0,0 @@
-package main
-
-import (
-	"flag"
-	"fmt"
-	"os"
-	"path/filepath"
-	"strings"
-
-	"github.com/DeBrosOfficial/network/pkg/config"
-	"github.com/DeBrosOfficial/network/pkg/logging"
-	"github.com/DeBrosOfficial/network/pkg/sfu"
-	"go.uber.org/zap"
-)
-
-// newSFUServer creates a new SFU server from config and logger.
-// Wrapper to keep main.go clean and avoid importing sfu in main.
-func newSFUServer(cfg *sfu.Config, logger *zap.Logger) (*sfu.Server, error) {
-	return sfu.NewServer(cfg, logger)
-}
-
-func parseSFUConfig(logger *logging.ColoredLogger) *sfu.Config {
-	configFlag := flag.String("config", "", "Config file path (absolute path or filename in ~/.orama)")
-	flag.Parse()
-
-	var configPath string
-	var err error
-	if *configFlag != "" {
-		if filepath.IsAbs(*configFlag) {
-			configPath = *configFlag
-		} else {
-			configPath, err = config.DefaultPath(*configFlag)
-			if err != nil {
-				logger.ComponentError(logging.ComponentSFU, "Failed to determine config path", zap.Error(err))
-				fmt.Fprintf(os.Stderr, "Configuration error: %v\n", err)
-				os.Exit(1)
-			}
-		}
-	} else {
-		configPath, err = config.DefaultPath("sfu.yaml")
-		if err != nil {
-			logger.ComponentError(logging.ComponentSFU, "Failed to determine config path", zap.Error(err))
-			fmt.Fprintf(os.Stderr, "Configuration error: %v\n", err)
-			os.Exit(1)
-		}
-	}
-
-	type yamlTURNServer struct {
-		Host   string `yaml:"host"`
-		Port   int    `yaml:"port"`
-		Secure bool   `yaml:"secure"`
-	}
-
-	type yamlCfg struct {
-		ListenAddr        string           `yaml:"listen_addr"`
-		Namespace         string           `yaml:"namespace"`
-		MediaPortStart    int              `yaml:"media_port_start"`
-		MediaPortEnd      int              `yaml:"media_port_end"`
-		TURNServers       []yamlTURNServer `yaml:"turn_servers"`
-		TURNSecret        string           `yaml:"turn_secret"`
-		TURNCredentialTTL int              `yaml:"turn_credential_ttl"`
-		RQLiteDSN         string           `yaml:"rqlite_dsn"`
-	}
-
-	data, err := os.ReadFile(configPath)
-	if err != nil {
-		logger.ComponentError(logging.ComponentSFU, "Config file not found",
-			zap.String("path", configPath), zap.Error(err))
-		fmt.Fprintf(os.Stderr, "\nConfig file not found at %s\n", configPath)
-		os.Exit(1)
-	}
-
-	var y yamlCfg
-	if err := config.DecodeStrict(strings.NewReader(string(data)), &y); err != nil {
-		logger.ComponentError(logging.ComponentSFU, "Failed to parse SFU config", zap.Error(err))
-		fmt.Fprintf(os.Stderr, "Configuration parse error: %v\n", err)
-		os.Exit(1)
-	}
-
-	var turnServers []sfu.TURNServerConfig
-	for _, ts := range y.TURNServers {
-		turnServers = append(turnServers, sfu.TURNServerConfig{
-			Host:   ts.Host,
-			Port:   ts.Port,
-			Secure: ts.Secure,
-		})
-	}
-
-	cfg := &sfu.Config{
-		ListenAddr:        y.ListenAddr,
-		Namespace:         y.Namespace,
-		MediaPortStart:    y.MediaPortStart,
-		MediaPortEnd:      y.MediaPortEnd,
-		TURNServers:       turnServers,
-		TURNSecret:        y.TURNSecret,
-		TURNCredentialTTL: y.TURNCredentialTTL,
-		RQLiteDSN:         y.RQLiteDSN,
-	}
-
-	if errs := cfg.Validate(); len(errs) > 0 {
-		fmt.Fprintf(os.Stderr, "\nSFU configuration errors (%d):\n", len(errs))
-		for _, e := range errs {
-			fmt.Fprintf(os.Stderr, "  - %s\n", e)
-		}
-		fmt.Fprintf(os.Stderr, "\nPlease fix the configuration and try again.\n")
-		os.Exit(1)
-	}
-
-	logger.ComponentInfo(logging.ComponentSFU, "Loaded SFU configuration",
-		zap.String("path", configPath),
-		zap.String("listen_addr", cfg.ListenAddr),
-		zap.String("namespace", cfg.Namespace),
-		zap.Int("media_ports", cfg.MediaPortEnd-cfg.MediaPortStart),
-		zap.Int("turn_servers", len(cfg.TURNServers)),
-	)
-
-	return cfg
-}

core/cmd/sfu/main.go

@@ -1,61 +0,0 @@
-package main
-
-import (
-	"errors"
-	"net/http"
-	"os"
-	"os/signal"
-	"syscall"
-	"time"
-
-	"github.com/DeBrosOfficial/network/pkg/logging"
-	"go.uber.org/zap"
-)
-
-var (
-	version = "dev"
-	commit  = "unknown"
-)
-
-func main() {
-	logger, err := logging.NewColoredLogger(logging.ComponentSFU, true)
-	if err != nil {
-		panic(err)
-	}
-
-	logger.ComponentInfo(logging.ComponentSFU, "Starting SFU server",
-		zap.String("version", version),
-		zap.String("commit", commit))
-
-	cfg := parseSFUConfig(logger)
-
-	server, err := newSFUServer(cfg, logger.Logger)
-	if err != nil {
-		logger.ComponentError(logging.ComponentSFU, "Failed to create SFU server", zap.Error(err))
-		os.Exit(1)
-	}
-
-	// Start HTTP server in background
-	go func() {
-		if err := server.ListenAndServe(); err != nil && !errors.Is(err, http.ErrServerClosed) {
-			logger.ComponentError(logging.ComponentSFU, "SFU server error", zap.Error(err))
-			os.Exit(1)
-		}
-	}()
-
-	// Wait for termination signal
-	quit := make(chan os.Signal, 1)
-	signal.Notify(quit, os.Interrupt, syscall.SIGTERM)
-	sig := <-quit
-
-	logger.ComponentInfo(logging.ComponentSFU, "Shutdown signal received", zap.String("signal", sig.String()))
-
-	// Graceful drain: notify peers and wait
-	server.Drain(30 * time.Second)
-
-	if err := server.Close(); err != nil {
-		logger.ComponentError(logging.ComponentSFU, "Error during shutdown", zap.Error(err))
-	}
-
-	logger.ComponentInfo(logging.ComponentSFU, "SFU server shutdown complete")
-}

core/cmd/turn/config.go

@@ -1,100 +0,0 @@
-package main
-
-import (
-	"flag"
-	"fmt"
-	"os"
-	"path/filepath"
-	"strings"
-
-	"github.com/DeBrosOfficial/network/pkg/config"
-	"github.com/DeBrosOfficial/network/pkg/logging"
-	"github.com/DeBrosOfficial/network/pkg/turn"
-	"go.uber.org/zap"
-)
-
-func parseTURNConfig(logger *logging.ColoredLogger) *turn.Config {
-	configFlag := flag.String("config", "", "Config file path (absolute path or filename in ~/.orama)")
-	flag.Parse()
-
-	var configPath string
-	var err error
-	if *configFlag != "" {
-		if filepath.IsAbs(*configFlag) {
-			configPath = *configFlag
-		} else {
-			configPath, err = config.DefaultPath(*configFlag)
-			if err != nil {
-				logger.ComponentError(logging.ComponentTURN, "Failed to determine config path", zap.Error(err))
-				fmt.Fprintf(os.Stderr, "Configuration error: %v\n", err)
-				os.Exit(1)
-			}
-		}
-	} else {
-		configPath, err = config.DefaultPath("turn.yaml")
-		if err != nil {
-			logger.ComponentError(logging.ComponentTURN, "Failed to determine config path", zap.Error(err))
-			fmt.Fprintf(os.Stderr, "Configuration error: %v\n", err)
-			os.Exit(1)
-		}
-	}
-
-	type yamlCfg struct {
-		ListenAddr      string `yaml:"listen_addr"`
-		TURNSListenAddr string `yaml:"turns_listen_addr"`
-		PublicIP        string `yaml:"public_ip"`
-		Realm           string `yaml:"realm"`
-		AuthSecret      string `yaml:"auth_secret"`
-		RelayPortStart  int    `yaml:"relay_port_start"`
-		RelayPortEnd    int    `yaml:"relay_port_end"`
-		Namespace       string `yaml:"namespace"`
-		TLSCertPath     string `yaml:"tls_cert_path"`
-		TLSKeyPath      string `yaml:"tls_key_path"`
-	}
-
-	data, err := os.ReadFile(configPath)
-	if err != nil {
-		logger.ComponentError(logging.ComponentTURN, "Config file not found",
-			zap.String("path", configPath), zap.Error(err))
-		fmt.Fprintf(os.Stderr, "\nConfig file not found at %s\n", configPath)
-		os.Exit(1)
-	}
-
-	var y yamlCfg
-	if err := config.DecodeStrict(strings.NewReader(string(data)), &y); err != nil {
-		logger.ComponentError(logging.ComponentTURN, "Failed to parse TURN config", zap.Error(err))
-		fmt.Fprintf(os.Stderr, "Configuration parse error: %v\n", err)
-		os.Exit(1)
-	}
-
-	cfg := &turn.Config{
-		ListenAddr:      y.ListenAddr,
-		TURNSListenAddr: y.TURNSListenAddr,
-		PublicIP:        y.PublicIP,
-		Realm:           y.Realm,
-		AuthSecret:      y.AuthSecret,
-		RelayPortStart:  y.RelayPortStart,
-		RelayPortEnd:    y.RelayPortEnd,
-		Namespace:       y.Namespace,
-		TLSCertPath:     y.TLSCertPath,
-		TLSKeyPath:      y.TLSKeyPath,
-	}
-
-	if errs := cfg.Validate(); len(errs) > 0 {
-		fmt.Fprintf(os.Stderr, "\nTURN configuration errors (%d):\n", len(errs))
-		for _, e := range errs {
-			fmt.Fprintf(os.Stderr, "  - %s\n", e)
-		}
-		fmt.Fprintf(os.Stderr, "\nPlease fix the configuration and try again.\n")
-		os.Exit(1)
-	}
-
-	logger.ComponentInfo(logging.ComponentTURN, "Loaded TURN configuration",
-		zap.String("path", configPath),
-		zap.String("listen_addr", cfg.ListenAddr),
-		zap.String("namespace", cfg.Namespace),
-		zap.String("realm", cfg.Realm),
-	)
-
-	return cfg
-}

core/cmd/turn/main.go

@@ -1,48 +0,0 @@
-package main
-
-import (
-	"os"
-	"os/signal"
-	"syscall"
-
-	"github.com/DeBrosOfficial/network/pkg/logging"
-	"github.com/DeBrosOfficial/network/pkg/turn"
-	"go.uber.org/zap"
-)
-
-var (
-	version = "dev"
-	commit  = "unknown"
-)
-
-func main() {
-	logger, err := logging.NewColoredLogger(logging.ComponentTURN, true)
-	if err != nil {
-		panic(err)
-	}
-
-	logger.ComponentInfo(logging.ComponentTURN, "Starting TURN server",
-		zap.String("version", version),
-		zap.String("commit", commit))
-
-	cfg := parseTURNConfig(logger)
-
-	server, err := turn.NewServer(cfg, logger.Logger)
-	if err != nil {
-		logger.ComponentError(logging.ComponentTURN, "Failed to start TURN server", zap.Error(err))
-		os.Exit(1)
-	}
-
-	// Wait for termination signal
-	quit := make(chan os.Signal, 1)
-	signal.Notify(quit, os.Interrupt, syscall.SIGTERM)
-	sig := <-quit
-
-	logger.ComponentInfo(logging.ComponentTURN, "Shutdown signal received", zap.String("signal", sig.String()))
-
-	if err := server.Close(); err != nil {
-		logger.ComponentError(logging.ComponentTURN, "Error during shutdown", zap.Error(err))
-	}
-
-	logger.ComponentInfo(logging.ComponentTURN, "TURN server shutdown complete")
-}

core/docs/ORAMAOS_DEPLOYMENT.md

@@ -1,233 +0,0 @@
-# OramaOS Deployment Guide
-
-OramaOS is a custom minimal Linux image built with Buildroot. It replaces the standard Ubuntu-based node deployment for mainnet, devnet, and testnet environments. Sandbox clusters remain on Ubuntu for development convenience.
-
-## What is OramaOS?
-
-OramaOS is a locked-down operating system designed specifically for Orama node operators. Key properties:
-
-- **No SSH, no shell** — operators cannot access the filesystem or run commands on the machine
-- **LUKS full-disk encryption** — the data partition is encrypted; the key is split via Shamir's Secret Sharing across peer nodes
-- **Read-only rootfs** — the OS image uses SquashFS with dm-verity integrity verification
-- **A/B partition updates** — signed OS images are applied atomically with automatic rollback on failure
-- **Service sandboxing** — each service runs in its own Linux namespace with seccomp syscall filtering
-- **Signed binaries** — all updates are cryptographically signed with the Orama rootwallet
-
-## Architecture
-
-```
-Partition Layout:
-  /dev/sda1 — ESP (EFI System Partition, systemd-boot)
-  /dev/sda2 — rootfs-A (SquashFS, read-only, dm-verity)
-  /dev/sda3 — rootfs-B (standby, for A/B updates)
-  /dev/sda4 — data (LUKS2 encrypted, ext4)
-
-Boot Flow:
-  systemd-boot → dm-verity rootfs → orama-agent → WireGuard → services
-```
-
-The **orama-agent** is the only root process. It manages:
-- Boot sequence and LUKS key reconstruction
-- WireGuard tunnel setup
-- Service lifecycle (start, stop, restart in sandboxed namespaces)
-- Command reception from the Gateway over WireGuard
-- OS updates (download, verify signature, A/B swap, reboot)
-
-## Enrollment Flow
-
-OramaOS nodes join the cluster through an enrollment process (different from the Ubuntu `orama node install` flow):
-
-### Step 1: Flash OramaOS to VPS
-
-Download the OramaOS image and flash it to your VPS:
-
-```bash
-# Download image (URL provided upon acceptance)
-wget https://releases.orama.network/oramaos-v1.0.0-amd64.qcow2
-
-# Flash to VPS (provider-specific — Hetzner, Vultr, etc.)
-# Most providers support uploading custom images via their dashboard
-```
-
-### Step 2: First Boot — Enrollment Mode
-
-On first boot, the agent:
-1. Generates a random 8-character registration code
-2. Starts a temporary HTTP server on port 9999
-3. Opens an outbound WebSocket to the Gateway
-4. Waits for enrollment to complete
-
-The registration code is displayed on the VPS console (if available) and served at `http://<vps-ip>:9999/`.
-
-### Step 3: Run Enrollment from CLI
-
-On your local machine (where you have the `orama` CLI and rootwallet):
-
-```bash
-# Generate an invite token on any existing cluster node
-orama node invite --expiry 24h
-
-# Enroll the OramaOS node
-orama node enroll --node-ip <vps-public-ip> --token <invite-token> --gateway <gateway-url>
-```
-
-The enrollment command:
-1. Fetches the registration code from the node (port 9999)
-2. Sends the code + invite token to the Gateway
-3. Gateway validates everything, assigns a WireGuard IP, and pushes config to the node
-4. Node configures WireGuard, formats the LUKS-encrypted data partition
-5. LUKS key is split via Shamir and distributed to peer vault-guardians
-6. Services start in sandboxed namespaces
-7. Port 9999 closes permanently
-
-### Step 4: Verify
-
-```bash
-# Check the node is online and healthy
-orama monitor report --env <env>
-```
-
-## Genesis Node
-
-The first OramaOS node in a cluster is the **genesis node**. It has a special boot path because there are no peers yet for Shamir key distribution:
-
-1. Genesis generates a LUKS key and encrypts the data partition
-2. The LUKS key is encrypted with a rootwallet-derived key and stored on the unencrypted rootfs
-3. On reboot (before enough peers exist), the operator must manually unlock:
-
-```bash
-orama node unlock --genesis --node-ip <wg-ip>
-```
-
-This command:
-1. Fetches the encrypted genesis key from the node
-2. Decrypts it using the rootwallet (`rw decrypt`)
-3. Sends the decrypted LUKS key to the agent over WireGuard
-
-Once 5+ peers have joined, the genesis node distributes Shamir shares to peers, deletes the local encrypted key, and transitions to normal Shamir-based unlock. After this transition, `orama node unlock` is no longer needed.
-
-## Normal Reboot (Shamir Unlock)
-
-When an enrolled OramaOS node reboots:
-
-1. Agent starts, brings up WireGuard
-2. Contacts peer vault-guardians over WireGuard
-3. Fetches K Shamir shares (K = threshold, typically `max(3, N/3)`)
-4. Reconstructs LUKS key via Lagrange interpolation over GF(256)
-5. Decrypts and mounts data partition
-6. Starts all services
-7. Zeros key from memory
-
-If not enough peers are available, the agent enters a degraded "waiting for peers" state and retries with exponential backoff (1s, 2s, 4s, 8s, 16s, max 5 retries per cycle).
-
-## Node Management
-
-Since OramaOS has no SSH, all management happens through the Gateway API:
-
-```bash
-# Check node status
-curl "https://gateway.example.com/v1/node/status?node_id=<id>"
-
-# Send a command (e.g., restart a service)
-curl -X POST "https://gateway.example.com/v1/node/command?node_id=<id>" \
-  -H "Content-Type: application/json" \
-  -d '{"action":"restart","service":"rqlite"}'
-
-# View logs
-curl "https://gateway.example.com/v1/node/logs?node_id=<id>&service=gateway&lines=100"
-
-# Graceful node departure
-curl -X POST "https://gateway.example.com/v1/node/leave" \
-  -H "Content-Type: application/json" \
-  -d '{"node_id":"<id>"}'
-```
-
-The Gateway proxies these requests to the agent over WireGuard (port 9998). The agent is never directly accessible from the public internet.
-
-## OS Updates
-
-OramaOS uses an A/B partition scheme for atomic, rollback-safe updates:
-
-1. Agent periodically checks for new versions
-2. Downloads the signed image (P2P over WireGuard between nodes)
-3. Verifies the rootwallet EVM signature against the embedded public key
-4. Writes to the standby partition (if running from A, writes to B)
-5. Sets systemd-boot to boot from B with `tries_left=3`
-6. Reboots
-7. If B boots successfully (agent starts, WG connects, services healthy): marks B as "good"
-8. If B fails 3 times: systemd-boot automatically falls back to A
-
-No operator intervention is needed for updates. Failed updates are automatically rolled back.
-
-## Service Sandboxing
-
-Each service on OramaOS runs in an isolated environment:
-
-- **Mount namespace** — each service only sees its own data directory as writable; everything else is read-only
-- **UTS namespace** — isolated hostname
-- **Dedicated UID/GID** — each service runs as a different user (not root)
-- **Seccomp filtering** — per-service syscall allowlist (initially in audit mode, then enforce mode)
-
-Services and their sandbox profiles:
-| Service | Writable Path | Extra Syscalls |
-|---------|--------------|----------------|
-| RQLite | `/opt/orama/.orama/data/rqlite` | fsync, fdatasync (Raft + SQLite WAL) |
-| Olric | `/opt/orama/.orama/data/olric` | sendmmsg, recvmmsg (gossip) |
-| IPFS | `/opt/orama/.orama/data/ipfs` | sendfile, splice (data transfer) |
-| Gateway | `/opt/orama/.orama/data/gateway` | sendfile, splice (HTTP) |
-| CoreDNS | `/opt/orama/.orama/data/coredns` | sendmmsg, recvmmsg (DNS) |
-
-## OramaOS vs Ubuntu Deployment
-
-| Feature | Ubuntu | OramaOS |
-|---------|--------|---------|
-| SSH access | Yes | No |
-| Shell access | Yes | No |
-| Disk encryption | No | LUKS2 (Shamir) |
-| OS updates | Manual (`orama node upgrade`) | Automatic (signed, A/B) |
-| Service isolation | systemd only | Namespaces + seccomp |
-| Rootfs integrity | None | dm-verity |
-| Binary signing | Optional | Required |
-| Operator data access | Full | None |
-| Environments | All (including sandbox) | Mainnet, devnet, testnet |
-
-## Cleaning / Factory Reset
-
-OramaOS nodes cannot be cleaned with the standard `orama node clean` command (no SSH access). Instead:
-
-- **Graceful departure:** `orama node leave` via the Gateway API — stops services, redistributes Shamir shares, removes WG peer
-- **Factory reset:** Reflash the OramaOS image on the VPS via the hosting provider's dashboard
-- **Data is unrecoverable:** Since the LUKS key is distributed across peers, reflashing destroys all data permanently
-
-## Troubleshooting
-
-### Node stuck in enrollment mode
-The node boots but enrollment never completes.
-
-**Check:** Can you reach `http://<vps-ip>:9999/` from your machine? If not, the VPS firewall may be blocking port 9999.
-
-**Fix:** Ensure port 9999 is open in the VPS provider's firewall. OramaOS opens it automatically via its internal firewall, but external provider firewalls (Hetzner, AWS security groups) must be configured separately.
-
-### LUKS unlock fails (not enough peers)
-After reboot, the node can't reconstruct its LUKS key.
-
-**Check:** How many peer nodes are online? The node needs at least K peers (threshold) to be reachable over WireGuard.
-
-**Fix:** Ensure enough cluster nodes are online. If this is the genesis node and fewer than 5 peers exist, use:
-```bash
-orama node unlock --genesis --node-ip <wg-ip>
-```
-
-### Update failed, node rolled back
-The node applied an update but reverted to the previous version.
-
-**Check:** The agent logs will show why the new partition failed to boot (accessible via `GET /v1/node/logs?service=agent`).
-
-**Common causes:** Corrupted download (signature verification should catch this), hardware issue, or incompatible configuration.
-
-### Services not starting after reboot
-The node rebooted and LUKS unlocked, but services are unhealthy.
-
-**Check:** `GET /v1/node/status` — which services are down?
-
-**Fix:** Try restarting the specific service via `POST /v1/node/command` with `{"action":"restart","service":"<name>"}`. If the issue persists, check service logs.

core/docs/SANDBOX.md

@@ -1,208 +0,0 @@
-# Sandbox: Ephemeral Hetzner Cloud Clusters
-
-Spin up temporary 5-node Orama clusters on Hetzner Cloud for development and testing. Total cost: ~€0.04/hour.
-
-## Quick Start
-
-```bash
-# One-time setup (API key, domain, floating IPs, SSH key)
-orama sandbox setup
-
-# Create a cluster (~5 minutes)
-orama sandbox create --name my-feature
-
-# Check health
-orama sandbox status
-
-# SSH into a node
-orama sandbox ssh 1
-
-# Deploy code changes
-orama sandbox rollout
-
-# Tear it down
-orama sandbox destroy
-```
-
-## Prerequisites
-
-### 1. Hetzner Cloud Account
-
-Create a project at [console.hetzner.cloud](https://console.hetzner.cloud) and generate an API token with read/write permissions under **Security > API Tokens**.
-
-### 2. Domain with Glue Records
-
-You need a domain (or subdomain) that points to Hetzner Floating IPs. The `orama sandbox setup` wizard will guide you through this.
-
-**Example:** Using `sbx.dbrs.space`
-
-At your domain registrar:
-1. Create glue records (Personal DNS Servers):
-   - `ns1.sbx.dbrs.space` → `<floating-ip-1>`
-   - `ns2.sbx.dbrs.space` → `<floating-ip-2>`
-2. Set custom nameservers for `sbx.dbrs.space`:
-   - `ns1.sbx.dbrs.space`
-   - `ns2.sbx.dbrs.space`
-
-DNS propagation can take up to 48 hours.
-
-### 3. Binary Archive
-
-Build the binary archive before creating a cluster:
-
-```bash
-orama build
-```
-
-This creates `/tmp/orama-<version>-linux-amd64.tar.gz` with all pre-compiled binaries.
-
-## Setup
-
-Run the interactive setup wizard:
-
-```bash
-orama sandbox setup
-```
-
-This will:
-1. Prompt for your Hetzner API token and validate it
-2. Ask for your sandbox domain
-3. Create or reuse 2 Hetzner Floating IPs (~$0.005/hr each)
-4. Create a firewall with sandbox rules
-5. Create a rootwallet SSH entry (`sandbox/root`) if it doesn't exist
-6. Upload the wallet-derived public key to Hetzner
-7. Display DNS configuration instructions
-
-Config is saved to `~/.orama/sandbox.yaml`.
-
-## Commands
-
-### `orama sandbox create [--name <name>]`
-
-Creates a new 5-node cluster. If `--name` is omitted, a random name is generated (e.g., "swift-falcon").
-
-**Cluster layout:**
-- Nodes 1-2: Nameservers (CoreDNS + Caddy + all services)
-- Nodes 3-5: Regular nodes (all services except CoreDNS)
-
-**Phases:**
-1. Provision 5 CX22 servers on Hetzner (parallel, ~90s)
-2. Assign floating IPs to nameserver nodes (~10s)
-3. Upload binary archive to all nodes (parallel, ~60s)
-4. Install genesis node + generate invite tokens (~120s)
-5. Join remaining 4 nodes (serial with health checks, ~180s)
-6. Verify cluster health (~15s)
-
-**One sandbox at a time.** Since the floating IPs are shared, only one sandbox can own the nameservers. Destroy the active sandbox before creating a new one.
-
-### `orama sandbox destroy [--name <name>] [--force]`
-
-Tears down a cluster:
-1. Unassigns floating IPs
-2. Deletes all 5 servers (parallel)
-3. Removes state file
-
-Use `--force` to skip confirmation.
-
-### `orama sandbox list`
-
-Lists all sandboxes with their status. Also checks Hetzner for orphaned servers that don't have a corresponding state file.
-
-### `orama sandbox status [--name <name>]`
-
-Shows per-node health including:
-- Service status (active/inactive)
-- RQLite role (Leader/Follower)
-- Cluster summary (commit index, voter count)
-
-### `orama sandbox rollout [--name <name>]`
-
-Deploys code changes:
-1. Uses the latest binary archive from `/tmp/` (run `orama build` first)
-2. Pushes to all nodes
-3. Rolling upgrade: followers first, leader last, 15s between nodes
-
-### `orama sandbox ssh <node-number>`
-
-Opens an interactive SSH session to a sandbox node (1-5).
-
-```bash
-orama sandbox ssh 1    # SSH into node 1 (genesis/ns1)
-orama sandbox ssh 3    # SSH into node 3 (regular node)
-```
-
-## Architecture
-
-### Floating IPs
-
-Hetzner Floating IPs are persistent IPv4 addresses that can be reassigned between servers. They solve the DNS chicken-and-egg problem:
-
-- Glue records at the registrar point to 2 Floating IPs (configured once)
-- Each new sandbox assigns the Floating IPs to its nameserver nodes
-- DNS works instantly — no propagation delay between clusters
-
-### SSH Authentication
-
-Sandbox uses a rootwallet-derived SSH key (`sandbox/root` vault entry), the same mechanism as production. The wallet must be unlocked (`rw unlock`) before running sandbox commands that use SSH. The public key is uploaded to Hetzner during setup and injected into every server at creation time.
-
-### Server Naming
-
-Servers: `sbx-<name>-<N>` (e.g., `sbx-swift-falcon-1` through `sbx-swift-falcon-5`)
-
-### State Files
-
-Sandbox state is stored at `~/.orama/sandboxes/<name>.yaml`. This tracks server IDs, IPs, roles, and cluster status.
-
-## Cost
-
-| Resource | Cost | Qty | Total |
-|----------|------|-----|-------|
-| CX22 (2 vCPU, 4GB) | €0.006/hr | 5 | €0.03/hr |
-| Floating IPv4 | €0.005/hr | 2 | €0.01/hr |
-| **Total** | | | **~€0.04/hr** |
-
-Servers are billed per hour. Floating IPs are billed as long as they exist (even unassigned). Destroy the sandbox when not in use to save on server costs.
-
-## Troubleshooting
-
-### "sandbox not configured"
-
-Run `orama sandbox setup` first.
-
-### "no binary archive found"
-
-Run `orama build` to create the binary archive.
-
-### "sandbox X is already active"
-
-Only one sandbox can be active at a time. Destroy it first:
-```bash
-orama sandbox destroy --name <name>
-```
-
-### Server creation fails
-
-Check:
-- Hetzner API token is valid and has read/write permissions
-- You haven't hit Hetzner's server limit (default: 10 per project)
-- The selected location has CX22 capacity
-
-### Genesis install fails
-
-SSH into the node to debug:
-```bash
-orama sandbox ssh 1
-journalctl -u orama-node -f
-```
-
-The sandbox will be left in "error" state. You can destroy and recreate it.
-
-### DNS not resolving
-
-1. Verify glue records are configured at your registrar
-2. Check propagation: `dig NS sbx.dbrs.space @8.8.8.8`
-3. Propagation can take 24-48 hours for new domains
-
-### Orphaned servers
-
-If `orama sandbox list` shows orphaned servers, delete them manually at [console.hetzner.cloud](https://console.hetzner.cloud). Sandbox servers are labeled `orama-sandbox=<name>` for easy identification.

core/docs/SECURITY.md

@@ -1,194 +0,0 @@
-# Security Hardening
-
-This document describes all security measures applied to the Orama Network, covering both Phase 1 (service hardening on existing Ubuntu nodes) and Phase 2 (OramaOS locked-down image).
-
-## Phase 1: Service Hardening
-
-These measures apply to all nodes (Ubuntu and OramaOS).
-
-### Network Isolation
-
-**CIDR Validation (Step 1.1)**
-- WireGuard subnet restricted to `10.0.0.0/24` across all components: firewall rules, rate limiter, auth module, and WireGuard PostUp/PostDown iptables rules
-- Prevents other tenants on shared VPS providers from bypassing the firewall via overlapping `10.x.x.x` ranges
-
-**IPv6 Disabled (Step 1.2)**
-- IPv6 disabled system-wide via sysctl: `net.ipv6.conf.all.disable_ipv6=1`
-- Prevents services bound to `0.0.0.0` from being reachable via IPv6 (which had no firewall rules)
-
-### Authentication
-
-**Internal Endpoint Auth (Step 1.3)**
-- `/v1/internal/wg/peers` and `/v1/internal/wg/peer/remove` now require cluster secret validation
-- Peer removal additionally validates the request originates from a WireGuard subnet IP
-
-**RQLite Authentication (Step 1.7)**
-- RQLite runs with `-auth` flag pointing to a credentials file
-- All RQLite HTTP requests include `Authorization: Basic <base64>` headers
-- Credentials generated at cluster genesis, distributed to joining nodes via join response
-- Both the central RQLite client wrapper and the standalone CoreDNS RQLite client send auth
-
-**Olric Gossip Encryption (Step 1.8)**
-- Olric memberlist uses a 32-byte encryption key for all gossip traffic
-- Key generated at genesis, distributed via join response
-- Prevents rogue nodes from joining the gossip ring and poisoning caches
-- Note: encryption is all-or-nothing (coordinated restart required when enabling)
-
-**IPFS Cluster TrustedPeers (Step 1.9)**
-- IPFS Cluster `TrustedPeers` populated with actual cluster peer IDs (was `["*"]`)
-- New peers added to TrustedPeers on all existing nodes during join
-- Prevents unauthorized peers from controlling IPFS pinning
-
-**Vault V1 Auth Enforcement (Step 1.14)**
-- V1 push/pull endpoints require a valid session token when vault-guardian is configured
-- Previously, auth was optional for backward compatibility — any WG peer could read/overwrite Shamir shares
-
-### Token & Key Storage
-
-**Refresh Token Hashing (Step 1.5)**
-- Refresh tokens stored as SHA-256 hashes in RQLite (never plaintext)
-- On lookup: hash the incoming token, query by hash
-- On revocation: hash before revoking (both single-token and by-subject)
-- Existing tokens invalidated on upgrade (users re-authenticate)
-
-**API Key Hashing (Step 1.6)**
-- API keys stored as HMAC-SHA256 hashes using a server-side secret
-- HMAC secret generated at cluster genesis, stored in `~/.orama/secrets/api-key-hmac-secret`
-- On lookup: compute HMAC, query by hash — fast enough for every request (unlike bcrypt)
-- In-memory cache uses raw key as cache key (never persisted)
-- During rolling upgrade: dual lookup (HMAC first, then raw as fallback) until all nodes upgraded
-
-**TURN Secret Encryption (Step 1.15)**
-- TURN shared secrets encrypted at rest in RQLite using AES-256-GCM
-- Encryption key derived via HKDF from the cluster secret with purpose string `"turn-encryption"`
-
-### TLS & Transport
-
-**InsecureSkipVerify Fix (Step 1.10)**
-- During node join, TLS verification uses TOFU (Trust On First Use)
-- Invite token output includes the CA certificate fingerprint (SHA-256)
-- Joining node verifies the server cert fingerprint matches before proceeding
-- After join: CA cert stored locally for future connections
-
-**WebSocket Origin Validation (Step 1.4)**
-- All WebSocket upgraders validate the `Origin` header against the node's configured domain
-- Non-browser clients (no Origin header) are still allowed
-- Prevents cross-site WebSocket hijacking attacks
-
-### Process Isolation
-
-**Dedicated User (Step 1.11)**
-- All services run as the `orama` user (not root)
-- Caddy and CoreDNS get `AmbientCapabilities=CAP_NET_BIND_SERVICE` for ports 80/443 and 53
-- WireGuard stays as root (kernel netlink requires it)
-- vault-guardian already had proper hardening
-
-**systemd Hardening (Step 1.12)**
-- All service units include:
-  ```ini
-  ProtectSystem=strict
-  ProtectHome=yes
-  NoNewPrivileges=yes
-  PrivateDevices=yes
-  ProtectKernelTunables=yes
-  ProtectKernelModules=yes
-  RestrictNamespaces=yes
-  ReadWritePaths=/opt/orama/.orama
-  ```
-- Applied to both template files (`pkg/environments/templates/`) and hardcoded unit generators (`pkg/environments/production/services.go`)
-
-### Supply Chain
-
-**Binary Signing (Step 1.13)**
-- Build archives include `manifest.sig` — a rootwallet EVM signature of the manifest hash
-- During install, the signature is verified against the embedded Orama public key
-- Unsigned or tampered archives are rejected
-
-## Phase 2: OramaOS
-
-These measures apply only to OramaOS nodes (mainnet, devnet, testnet).
-
-### Immutable OS
-
-- **Read-only rootfs** — SquashFS with dm-verity integrity verification
-- **No shell** — `/bin/sh` symlinked to `/bin/false`, no bash/ash/ssh
-- **No SSH** — OpenSSH not included in the image
-- **Minimal packages** — only what's needed for systemd, cryptsetup, and the agent
-
-### Full-Disk Encryption
-
-- **LUKS2** with AES-XTS-Plain64 on the data partition
-- **Shamir's Secret Sharing** over GF(256) — LUKS key split across peer vault-guardians
-- **Adaptive threshold** — K = max(3, N/3) where N is the number of peers
-- **Key zeroing** — LUKS key wiped from memory immediately after use
-- **Malicious share detection** — fetch K+1 shares when possible, verify consistency
-
-### Service Sandboxing
-
-Each service runs in isolated Linux namespaces:
-- **CLONE_NEWNS** — mount namespace (filesystem isolation)
-- **CLONE_NEWUTS** — hostname namespace
-- **Dedicated UID/GID** — each service has its own user
-- **Seccomp filtering** — per-service syscall allowlist
-
-Note: CLONE_NEWPID is intentionally omitted — it makes services PID 1 in their namespace, which changes signal semantics (SIGTERM ignored by default for PID 1).
-
-### Signed Updates
-
-- A/B partition scheme with systemd-boot and boot counting (`tries_left=3`)
-- All updates signed with rootwallet EVM signature (secp256k1 + keccak256)
-- Signer address: `0xb5d8a496c8b2412990d7D467E17727fdF5954afC`
-- P2P distribution over WireGuard between nodes
-- Automatic rollback on 3 consecutive boot failures
-
-### Zero Operator Access
-
-- Operators cannot read data on the machine (LUKS encrypted, no shell)
-- Management only through Gateway API → agent over WireGuard
-- All commands are logged and auditable
-- No root access, no console access, no file system access
-
-## Rollout Strategy
-
-### Phase 1 Batches
-
-```
-Batch 1 (zero-risk, no restart):
-  - CIDR fix
-  - IPv6 disable
-  - Internal endpoint auth
-  - WebSocket origin check
-
-Batch 2 (medium-risk, restart needed):
-  - Hash refresh tokens
-  - Hash API keys
-  - Binary signing
-  - Vault V1 auth enforcement
-  - TURN secret encryption
-
-Batch 3 (high-risk, coordinated rollout):
-  - RQLite auth (followers first, leader last)
-  - Olric encryption (simultaneous restart)
-  - IPFS Cluster TrustedPeers
-
-Batch 4 (infrastructure changes):
-  - InsecureSkipVerify fix
-  - Dedicated user
-  - systemd hardening
-```
-
-### Phase 2
-
-1. Build and test OramaOS image in QEMU
-2. Deploy to sandbox cluster alongside Ubuntu nodes
-3. Verify interop and stability
-4. Gradual migration: testnet → devnet → mainnet (one node at a time, maintaining Raft quorum)
-
-## Verification
-
-All changes verified on sandbox cluster before production deployment:
-
-- `make test` — all unit tests pass
-- `orama monitor report --env sandbox` — full cluster health
-- Manual endpoint testing (e.g., curl without auth → 401)
-- Security-specific checks (IPv6 listeners, RQLite auth, binary signatures)

core/docs/SERVERLESS.md

@@ -1,374 +0,0 @@
-# Serverless Functions
-
-Orama Network runs serverless functions as sandboxed WebAssembly (WASM) modules. Functions are written in Go, compiled to WASM with TinyGo, and executed in an isolated wazero runtime with configurable memory limits and timeouts.
-
-Functions receive input via **stdin** (JSON) and return output via **stdout** (JSON). They can also access Orama services — database, cache, storage, secrets, PubSub, and HTTP — through **host functions** injected by the runtime.
-
-## Quick Start
-
-```bash
-# 1. Scaffold a new function
-orama function init my-function
-
-# 2. Edit your handler
-cd my-function
-# edit function.go
-
-# 3. Build to WASM
-orama function build
-
-# 4. Deploy
-orama function deploy
-
-# 5. Invoke
-orama function invoke my-function --data '{"name": "World"}'
-
-# 6. View logs
-orama function logs my-function
-```
-
-## Project Structure
-
-```
-my-function/
-├── function.go      # Handler code
-└── function.yaml    # Configuration
-```
-
-### function.yaml
-
-```yaml
-name: my-function       # Required. Letters, digits, hyphens, underscores.
-public: false           # Allow unauthenticated invocation (default: false)
-memory: 64              # Memory limit in MB (1-256, default: 64)
-timeout: 30             # Execution timeout in seconds (1-300, default: 30)
-retry:
-  count: 0              # Retry attempts on failure (default: 0)
-  delay: 5              # Seconds between retries (default: 5)
-env:                    # Environment variables (accessible via get_env)
-  MY_VAR: "value"
-```
-
-### function.go (minimal)
-
-```go
-package main
-
-import (
-    "encoding/json"
-    "os"
-)
-
-func main() {
-    // Read JSON input from stdin
-    var input []byte
-    buf := make([]byte, 4096)
-    for {
-        n, err := os.Stdin.Read(buf)
-        if n > 0 {
-            input = append(input, buf[:n]...)
-        }
-        if err != nil {
-            break
-        }
-    }
-
-    var payload map[string]interface{}
-    json.Unmarshal(input, &payload)
-
-    // Process and return JSON output via stdout
-    response := map[string]interface{}{
-        "result": "Hello!",
-    }
-    output, _ := json.Marshal(response)
-    os.Stdout.Write(output)
-}
-```
-
-### Building
-
-Functions are compiled to WASM using [TinyGo](https://tinygo.org/):
-
-```bash
-# Using the CLI (recommended)
-orama function build
-
-# Or manually
-tinygo build -o function.wasm -target wasi function.go
-```
-
-## Host Functions API
-
-Host functions let your WASM code interact with Orama services. They are imported from the `"env"` or `"host"` module (both work) and use a pointer/length ABI for string parameters.
-
-All host functions are registered at runtime by the engine. They are available to every function without additional configuration.
-
-### Context
-
-| Function | Description |
-|----------|-------------|
-| `get_caller_wallet()` → string | Wallet address of the caller (from JWT) |
-| `get_request_id()` → string | Unique invocation ID |
-| `get_env(key)` → string | Environment variable from function.yaml |
-| `get_secret(name)` → string | Decrypted secret value (see [Managing Secrets](#managing-secrets)) |
-
-### Database (RQLite)
-
-| Function | Description |
-|----------|-------------|
-| `db_query(sql, argsJSON)` → JSON | Execute SELECT query. Args as JSON array. Returns JSON array of row objects. |
-| `db_execute(sql, argsJSON)` → int | Execute INSERT/UPDATE/DELETE. Returns affected row count. |
-
-Example query from WASM:
-```
-db_query("SELECT push_token, device_type FROM devices WHERE user_id = ?", '["user123"]')
-→ [{"push_token": "abc...", "device_type": "ios"}]
-```
-
-### Cache (Olric Distributed Cache)
-
-| Function | Description |
-|----------|-------------|
-| `cache_get(key)` → bytes | Get cached value by key. Returns empty on miss. |
-| `cache_set(key, value, ttl)` | Store value with TTL in seconds. |
-| `cache_incr(key)` → int64 | Atomically increment by 1 (init to 0 if missing). |
-| `cache_incr_by(key, delta)` → int64 | Atomically increment by delta. |
-
-### HTTP
-
-| Function | Description |
-|----------|-------------|
-| `http_fetch(method, url, headersJSON, body)` → JSON | Make outbound HTTP request. Headers as JSON object. Returns `{"status": 200, "headers": {...}, "body": "..."}`. Timeout: 30s. |
-
-### PubSub
-
-| Function | Description |
-|----------|-------------|
-| `pubsub_publish(topic, dataJSON)` → bool | Publish message to a PubSub topic. Returns true on success. |
-
-### Logging
-
-| Function | Description |
-|----------|-------------|
-| `log_info(message)` | Log info-level message (captured in invocation logs). |
-| `log_error(message)` | Log error-level message. |
-
-## Managing Secrets
-
-Secrets are encrypted at rest (AES-256-GCM) and scoped to your namespace. Functions read them via `get_secret("name")` at runtime.
-
-### CLI Commands
-
-```bash
-# Set a secret (inline value)
-orama function secrets set APNS_KEY_ID "ABC123DEF"
-
-# Set a secret from a file (useful for PEM keys, certificates)
-orama function secrets set APNS_AUTH_KEY --from-file ./AuthKey_ABC123.p8
-
-# List all secret names (values are never shown)
-orama function secrets list
-
-# Delete a secret
-orama function secrets delete APNS_KEY_ID
-
-# Delete without confirmation
-orama function secrets delete APNS_KEY_ID --force
-```
-
-### How It Works
-
-1. **You set secrets** via the CLI → encrypted and stored in the database
-2. **Functions read secrets** at runtime via `get_secret("name")` → decrypted on demand
-3. **Namespace isolation** → each namespace has its own secret store; functions in namespace A cannot read secrets from namespace B
-
-## PubSub Triggers
-
-Triggers let functions react to events automatically. When a message is published to a PubSub topic, all functions with a trigger on that topic are invoked asynchronously.
-
-### CLI Commands
-
-```bash
-# Add a trigger: invoke "call-push-handler" when messages hit "calls:invite"
-orama function triggers add call-push-handler --topic calls:invite
-
-# List triggers for a function
-orama function triggers list call-push-handler
-
-# Delete a trigger
-orama function triggers delete call-push-handler <trigger-id>
-```
-
-### Trigger Event Payload
-
-When triggered via PubSub, the function receives this JSON via stdin:
-
-```json
-{
-  "topic": "calls:invite",
-  "data": { ... },
-  "namespace": "my-namespace",
-  "trigger_depth": 1,
-  "timestamp": 1708972800
-}
-```
-
-### Depth Limiting
-
-To prevent infinite loops (function A publishes to topic → triggers function A again), trigger depth is tracked. Maximum depth is **5**. If a function's output triggers another function, `trigger_depth` increments. At depth 5, no further triggers fire.
-
-## Function Lifecycle
-
-### Versioning
-
-Each deploy creates a new version. The WASM binary is stored in **IPFS** (content-addressed) and metadata is stored in **RQLite**.
-
-```bash
-# List versions
-orama function versions my-function
-
-# Invoke a specific version
-curl -X POST .../v1/functions/my-function@2/invoke
-```
-
-### Invocation Logging
-
-Every invocation is logged with: request ID, duration, status (success/error/timeout), input/output size, and any `log_info`/`log_error` messages.
-
-```bash
-orama function logs my-function
-```
-
-## CLI Reference
-
-| Command | Description |
-|---------|-------------|
-| `orama function init <name>` | Scaffold a new function project |
-| `orama function build [dir]` | Compile Go to WASM |
-| `orama function deploy [dir]` | Deploy WASM to the network |
-| `orama function invoke <name> --data <json>` | Invoke a function |
-| `orama function list` | List deployed functions |
-| `orama function get <name>` | Get function details |
-| `orama function delete <name>` | Delete a function |
-| `orama function logs <name>` | View invocation logs |
-| `orama function versions <name>` | List function versions |
-| `orama function secrets set <name> <value>` | Set an encrypted secret |
-| `orama function secrets list` | List secret names |
-| `orama function secrets delete <name>` | Delete a secret |
-| `orama function triggers add <fn> --topic <t>` | Add PubSub trigger |
-| `orama function triggers list <fn>` | List triggers |
-| `orama function triggers delete <fn> <id>` | Delete a trigger |
-
-## HTTP API Reference
-
-| Method | Endpoint | Description |
-|--------|----------|-------------|
-| POST | `/v1/functions` | Deploy function (multipart/form-data) |
-| GET | `/v1/functions` | List functions |
-| GET | `/v1/functions/{name}` | Get function info |
-| DELETE | `/v1/functions/{name}` | Delete function |
-| POST | `/v1/functions/{name}/invoke` | Invoke function |
-| GET | `/v1/functions/{name}/versions` | List versions |
-| GET | `/v1/functions/{name}/logs` | Get logs |
-| WS | `/v1/functions/{name}/ws` | WebSocket invoke (streaming) |
-| PUT | `/v1/functions/secrets` | Set a secret |
-| GET | `/v1/functions/secrets` | List secret names |
-| DELETE | `/v1/functions/secrets/{name}` | Delete a secret |
-| POST | `/v1/functions/{name}/triggers` | Add PubSub trigger |
-| GET | `/v1/functions/{name}/triggers` | List triggers |
-| DELETE | `/v1/functions/{name}/triggers/{id}` | Delete trigger |
-| POST | `/v1/invoke/{namespace}/{name}` | Direct invoke (alt endpoint) |
-
-## Example: Call Push Handler
-
-A real-world function that sends VoIP push notifications when a call invite is published to PubSub:
-
-```yaml
-# function.yaml
-name: call-push-handler
-memory: 128
-timeout: 30
-```
-
-```go
-// function.go — triggered by PubSub on "calls:invite"
-package main
-
-import (
-    "encoding/json"
-    "os"
-)
-
-// This function:
-// 1. Receives a call invite event from PubSub trigger
-// 2. Queries the database for the callee's device info
-// 3. Reads push notification credentials from secrets
-// 4. Sends a push notification via http_fetch
-
-func main() {
-    // Read PubSub trigger event from stdin
-    var input []byte
-    buf := make([]byte, 4096)
-    for {
-        n, err := os.Stdin.Read(buf)
-        if n > 0 {
-            input = append(input, buf[:n]...)
-        }
-        if err != nil {
-            break
-        }
-    }
-
-    // Parse the trigger event wrapper
-    var event struct {
-        Topic string          `json:"topic"`
-        Data  json.RawMessage `json:"data"`
-    }
-    json.Unmarshal(input, &event)
-
-    // Parse the actual call invite data
-    var invite struct {
-        CalleeID   string `json:"calleeId"`
-        CallerName string `json:"callerName"`
-        CallType   string `json:"callType"`
-    }
-    json.Unmarshal(event.Data, &invite)
-
-    // At this point, the function would use host functions:
-    //
-    // 1. db_query("SELECT push_token, device_type FROM devices WHERE user_id = ?",
-    //             json.Marshal([]string{invite.CalleeID}))
-    //
-    // 2. get_secret("FCM_SERVER_KEY") for Android push
-    //    get_secret("APNS_KEY_PEM") for iOS push
-    //
-    // 3. http_fetch("POST", "https://fcm.googleapis.com/v1/...", headers, body)
-    //
-    // 4. log_info("Push sent to " + invite.CalleeID)
-    //
-    // Note: Host functions use the WASM ABI (pointer/length).
-    // A Go SDK for ergonomic access is planned.
-
-    response := map[string]interface{}{
-        "status":  "sent",
-        "callee":  invite.CalleeID,
-    }
-    output, _ := json.Marshal(response)
-    os.Stdout.Write(output)
-}
-```
-
-Deploy and wire the trigger:
-```bash
-orama function build
-orama function deploy
-
-# Set push notification secrets
-orama function secrets set FCM_SERVER_KEY "your-fcm-key"
-orama function secrets set APNS_KEY_PEM --from-file ./AuthKey.p8
-orama function secrets set APNS_KEY_ID "ABC123"
-orama function secrets set APNS_TEAM_ID "TEAM456"
-
-# Wire the PubSub trigger
-orama function triggers add call-push-handler --topic calls:invite
-```

core/docs/WEBRTC.md

@@ -1,291 +0,0 @@
-# WebRTC Integration
-
-Real-time voice, video, and data channels for Orama Network namespaces.
-
-## Architecture
-
-```
-Client A                                     Client B
-   │                                            │
-   │  1. Get TURN credentials (REST)            │
-   │  2. Connect WebSocket (signaling)          │
-   │  3. Exchange SDP/ICE via SFU               │
-   │                                            │
-   ▼                                            ▼
-┌──────────┐     UDP relay      ┌──────────┐
-│   TURN   │◄──────────────────►│   TURN   │
-│  Server  │   (public IPs)     │  Server  │
-│  Node 1  │                    │  Node 2  │
-└────┬─────┘                    └────┬─────┘
-     │ WireGuard                     │ WireGuard
-     ▼                               ▼
-┌──────────────────────────────────────────┐
-│              SFU Servers (3 nodes)        │
-│  - WebSocket signaling (WireGuard only)  │
-│  - Pion WebRTC (RTP forwarding)          │
-│  - Room management                       │
-│  - Track publish/subscribe               │
-└──────────────────────────────────────────┘
-```
-
-**Key design decisions:**
-- **TURN-shielded**: SFU binds only to WireGuard IPs. All client media flows through TURN relay.
-- **`iceTransportPolicy: relay`** enforced server-side — no direct peer connections.
-- **Opt-in per namespace** via `orama namespace enable webrtc`.
-- **SFU on all 3 nodes**, **TURN on 2 of 3 nodes** (redundancy without over-provisioning).
-- **Separate port allocation** from existing namespace services.
-
-## Prerequisites
-
-- Namespace must be provisioned with a ready cluster (RQLite + Olric + Gateway running).
-- Command must be run on a cluster node (uses internal gateway endpoint).
-
-## Enable / Disable
-
-```bash
-# Enable WebRTC for a namespace
-orama namespace enable webrtc --namespace myapp
-
-# Check status
-orama namespace webrtc-status --namespace myapp
-
-# Disable WebRTC (stops services, deallocates ports, removes DNS)
-orama namespace disable webrtc --namespace myapp
-```
-
-### What happens on enable:
-1. Generates a per-namespace TURN shared secret (32 bytes, crypto/rand)
-2. Inserts `namespace_webrtc_config` DB record
-3. Allocates WebRTC port blocks on each node (SFU signaling + media range, TURN relay range)
-4. Spawns TURN on 2 nodes (selected by capacity)
-5. Spawns SFU on all 3 nodes
-6. Creates DNS A records: `turn.ns-{name}.{baseDomain}` pointing to TURN node public IPs
-7. Updates cluster state on all nodes (for cold-boot restoration)
-
-### What happens on disable:
-1. Stops SFU on all 3 nodes
-2. Stops TURN on 2 nodes
-3. Deallocates all WebRTC ports
-4. Deletes TURN DNS records
-5. Cleans up DB records (`namespace_webrtc_config`, `webrtc_rooms`)
-6. Updates cluster state
-
-## Client Integration (JavaScript)
-
-### Authentication
-
-All WebRTC endpoints require authentication. Use one of:
-
-```
-# Option A: API Key via header (recommended)
-X-API-Key: <your-namespace-api-key>
-
-# Option B: API Key via Authorization header
-Authorization: ApiKey <your-namespace-api-key>
-
-# Option C: JWT Bearer token
-Authorization: Bearer <jwt>
-```
-
-### 1. Get TURN Credentials
-
-```javascript
-const response = await fetch('https://ns-myapp.orama-devnet.network/v1/webrtc/turn/credentials', {
-  method: 'POST',
-  headers: { 'X-API-Key': apiKey }
-});
-
-const { uris, username, password, ttl } = await response.json();
-// uris: [
-//   "turn:turn.ns-myapp.orama-devnet.network:3478?transport=udp",
-//   "turn:turn.ns-myapp.orama-devnet.network:3478?transport=tcp",
-//   "turns:turn.ns-myapp.orama-devnet.network:5349"
-// ]
-// username: "{expiry_unix}:{namespace}"
-// password: HMAC-SHA1 derived (base64)
-// ttl: 600 (seconds)
-```
-
-### 2. Create PeerConnection
-
-```javascript
-const pc = new RTCPeerConnection({
-  iceServers: [{ urls: uris, username, credential: password }],
-  iceTransportPolicy: 'relay'  // enforced by SFU
-});
-```
-
-### 3. Connect Signaling WebSocket
-
-```javascript
-const ws = new WebSocket(
-  `wss://ns-myapp.orama-devnet.network/v1/webrtc/signal?room=${roomId}&api_key=${apiKey}`
-);
-
-ws.onmessage = (event) => {
-  const msg = JSON.parse(event.data);
-  switch (msg.type) {
-    case 'offer':     handleOffer(msg);     break;
-    case 'answer':    handleAnswer(msg);    break;
-    case 'ice-candidate': handleICE(msg);   break;
-    case 'peer-joined':   handleJoin(msg);  break;
-    case 'peer-left':     handleLeave(msg); break;
-    case 'turn-credentials':
-    case 'refresh-credentials':
-      updateTURN(msg);  // SFU sends refreshed creds at 80% TTL
-      break;
-    case 'server-draining':
-      reconnect();  // SFU shutting down, reconnect to another node
-      break;
-  }
-};
-```
-
-### 4. Room Management (REST)
-
-```javascript
-const headers = { 'X-API-Key': apiKey, 'Content-Type': 'application/json' };
-
-// Create room
-await fetch('/v1/webrtc/rooms', {
-  method: 'POST',
-  headers,
-  body: JSON.stringify({ room_id: 'my-room' })
-});
-
-// List rooms
-const rooms = await fetch('/v1/webrtc/rooms', { headers });
-
-// Close room
-await fetch('/v1/webrtc/rooms?room_id=my-room', {
-  method: 'DELETE',
-  headers
-});
-```
-
-## API Reference
-
-### REST Endpoints
-
-| Method | Path | Auth | Description |
-|--------|------|------|-------------|
-| POST | `/v1/webrtc/turn/credentials` | JWT/API key | Get TURN relay credentials |
-| GET/WS | `/v1/webrtc/signal` | JWT/API key | WebSocket signaling |
-| GET | `/v1/webrtc/rooms` | JWT/API key | List rooms |
-| POST | `/v1/webrtc/rooms` | JWT/API key (owner) | Create room |
-| DELETE | `/v1/webrtc/rooms` | JWT/API key (owner) | Close room |
-
-### Signaling Messages
-
-| Type | Direction | Description |
-|------|-----------|-------------|
-| `join` | Client → SFU | Join room |
-| `offer` | Client ↔ SFU | SDP offer |
-| `answer` | Client ↔ SFU | SDP answer |
-| `ice-candidate` | Client ↔ SFU | ICE candidate |
-| `leave` | Client → SFU | Leave room |
-| `peer-joined` | SFU → Client | New peer notification |
-| `peer-left` | SFU → Client | Peer departure |
-| `turn-credentials` | SFU → Client | Initial TURN credentials |
-| `refresh-credentials` | SFU → Client | Refreshed credentials (at 80% TTL) |
-| `server-draining` | SFU → Client | SFU shutting down |
-
-## Port Allocation
-
-WebRTC uses a **separate port allocation system** from the core namespace ports:
-
-| Service | Port Range | Protocol | Per Namespace |
-|---------|-----------|----------|---------------|
-| SFU signaling | 30000-30099 | TCP (WireGuard only) | 1 port |
-| SFU media (RTP) | 20000-29999 | UDP (WireGuard only) | 500 ports |
-| TURN listen | 3478 | UDP + TCP | fixed |
-| TURNS (TLS) | 5349 | TCP | fixed |
-| TURN relay | 49152-65535 | UDP | 800 ports |
-
-## TURN Credential Protocol
-
-- Credentials use HMAC-SHA1 with a per-namespace shared secret
-- Username format: `{expiry_unix}:{namespace}`
-- Password: `base64(HMAC-SHA1(shared_secret, username))`
-- Default TTL: 600 seconds (10 minutes)
-- SFU proactively sends `refresh-credentials` at 80% of TTL (8 minutes)
-- Clients should update ICE servers on receiving refresh
-
-## TURNS TLS Certificate
-
-TURNS (port 5349) uses TLS. Certificate provisioning:
-
-1. **Let's Encrypt (primary)**: On TURN spawn, the TURN domain is added to the local Caddy instance's Caddyfile. Caddy provisions a Let's Encrypt cert via DNS-01 ACME challenge (using the orama DNS provider). TURN reads the cert from Caddy's storage.
-2. **Self-signed (fallback)**: If Caddy cert provisioning fails (timeout, Caddy not running), a self-signed cert is generated with the node's public IP as SAN.
-
-Caddy auto-renews Let's Encrypt certs at ~60 days. TURN picks up renewed certs on restart.
-
-## Monitoring
-
-```bash
-# Check WebRTC status
-orama namespace webrtc-status --namespace myapp
-
-# Monitor report includes SFU/TURN status
-orama monitor report --env devnet
-
-# Inspector checks WebRTC health
-orama inspector --env devnet
-```
-
-The monitoring report includes per-namespace `sfu_up` and `turn_up` fields. The inspector runs cross-node checks to verify SFU coverage (3 nodes) and TURN redundancy (2 nodes).
-
-## Debugging
-
-```bash
-# SFU logs
-journalctl -u orama-namespace-sfu@myapp -f
-
-# TURN logs
-journalctl -u orama-namespace-turn@myapp -f
-
-# Check service status
-systemctl status orama-namespace-sfu@myapp
-systemctl status orama-namespace-turn@myapp
-```
-
-## Security Model
-
-- **Forced relay**: `iceTransportPolicy: relay` enforced server-side. Clients cannot bypass TURN.
-- **HMAC credentials**: Per-namespace TURN shared secret. Credentials expire after 10 minutes.
-- **Namespace isolation**: Each namespace has its own TURN secret, port ranges, and rooms.
-- **Authentication required**: All WebRTC endpoints require API key or JWT (`X-API-Key` header, `Authorization: ApiKey`, or `Authorization: Bearer`).
-- **Room management**: Creating/closing rooms requires namespace ownership.
-- **SFU on WireGuard only**: SFU binds to 10.0.0.x, never 0.0.0.0. Only reachable via TURN relay.
-- **Permissions-Policy**: `camera=(self), microphone=(self)` — only same-origin can access media devices.
-
-## Firewall
-
-When WebRTC is enabled, the following ports are opened via UFW on TURN nodes:
-
-| Port | Protocol | Purpose |
-|------|----------|---------|
-| 3478 | UDP | TURN standard |
-| 3478 | TCP | TURN TCP fallback (for clients behind UDP-blocking firewalls) |
-| 5349 | TCP | TURNS — TURN over TLS (encrypted, works through strict firewalls/DPI) |
-| 49152-65535 | UDP | TURN relay range (allocated per namespace) |
-
-SFU ports are NOT opened in the firewall — they are WireGuard-internal only.
-
-## Database Tables
-
-| Table | Purpose |
-|-------|---------|
-| `namespace_webrtc_config` | Per-namespace WebRTC config (enabled, TURN secret, node counts) |
-| `webrtc_rooms` | Room-to-SFU-node affinity |
-| `webrtc_port_allocations` | SFU/TURN port tracking |
-
-## Cold Boot Recovery
-
-On node restart, the cluster state file (`cluster_state.json`) includes `has_sfu`, `has_turn`, and port allocation data. The restore process:
-
-1. Core services restore first: RQLite → Olric → Gateway
-2. If `has_turn` is set: fetches TURN shared secret from DB, spawns TURN
-3. If `has_sfu` is set: fetches WebRTC config from DB, spawns SFU with TURN server list
-
-If the DB is unavailable during restore, SFU/TURN restoration is skipped with a warning log. They will be restored on the next successful DB connection.

core/e2e/shared/webrtc_test.go

@@ -1,241 +0,0 @@
-//go:build e2e
-
-package shared_test
-
-import (
-	"bytes"
-	"encoding/json"
-	"net/http"
-	"strings"
-	"testing"
-	"time"
-
-	e2e "github.com/DeBrosOfficial/network/e2e"
-)
-
-// turnCredentialsResponse is the expected response from the TURN credentials endpoint.
-type turnCredentialsResponse struct {
-	URLs       []string `json:"urls"`
-	Username   string   `json:"username"`
-	Credential string   `json:"credential"`
-	TTL        int      `json:"ttl"`
-}
-
-// TestWebRTC_TURNCredentials_RequiresAuth verifies that the TURN credentials endpoint
-// rejects unauthenticated requests.
-func TestWebRTC_TURNCredentials_RequiresAuth(t *testing.T) {
-	e2e.SkipIfMissingGateway(t)
-
-	gatewayURL := e2e.GetGatewayURL()
-	client := e2e.NewHTTPClient(10 * time.Second)
-
-	req, err := http.NewRequest("POST", gatewayURL+"/v1/webrtc/turn/credentials", nil)
-	if err != nil {
-		t.Fatalf("failed to create request: %v", err)
-	}
-
-	resp, err := client.Do(req)
-	if err != nil {
-		t.Fatalf("request failed: %v", err)
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusUnauthorized {
-		t.Fatalf("expected 401 Unauthorized, got %d", resp.StatusCode)
-	}
-}
-
-// TestWebRTC_TURNCredentials_ValidResponse verifies that authenticated requests to the
-// TURN credentials endpoint return a valid credential structure.
-func TestWebRTC_TURNCredentials_ValidResponse(t *testing.T) {
-	e2e.SkipIfMissingGateway(t)
-
-	gatewayURL := e2e.GetGatewayURL()
-	apiKey := e2e.GetAPIKey()
-	if apiKey == "" {
-		t.Skip("no API key configured")
-	}
-	client := e2e.NewHTTPClient(10 * time.Second)
-
-	req, err := http.NewRequest("POST", gatewayURL+"/v1/webrtc/turn/credentials", nil)
-	if err != nil {
-		t.Fatalf("failed to create request: %v", err)
-	}
-	req.Header.Set("Authorization", "Bearer "+apiKey)
-
-	resp, err := client.Do(req)
-	if err != nil {
-		t.Fatalf("request failed: %v", err)
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK {
-		t.Fatalf("expected 200 OK, got %d", resp.StatusCode)
-	}
-
-	var creds turnCredentialsResponse
-	if err := json.NewDecoder(resp.Body).Decode(&creds); err != nil {
-		t.Fatalf("failed to decode response: %v", err)
-	}
-
-	if len(creds.URLs) == 0 {
-		t.Fatal("expected at least one TURN URL")
-	}
-	if creds.Username == "" {
-		t.Fatal("expected non-empty username")
-	}
-	if creds.Credential == "" {
-		t.Fatal("expected non-empty credential")
-	}
-	if creds.TTL <= 0 {
-		t.Fatalf("expected positive TTL, got %d", creds.TTL)
-	}
-}
-
-// TestWebRTC_Rooms_RequiresAuth verifies that the rooms endpoint rejects unauthenticated requests.
-func TestWebRTC_Rooms_RequiresAuth(t *testing.T) {
-	e2e.SkipIfMissingGateway(t)
-
-	gatewayURL := e2e.GetGatewayURL()
-	client := e2e.NewHTTPClient(10 * time.Second)
-
-	req, err := http.NewRequest("GET", gatewayURL+"/v1/webrtc/rooms", nil)
-	if err != nil {
-		t.Fatalf("failed to create request: %v", err)
-	}
-
-	resp, err := client.Do(req)
-	if err != nil {
-		t.Fatalf("request failed: %v", err)
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusUnauthorized {
-		t.Fatalf("expected 401 Unauthorized, got %d", resp.StatusCode)
-	}
-}
-
-// TestWebRTC_Signal_RequiresAuth verifies that the signaling WebSocket rejects
-// unauthenticated connections.
-func TestWebRTC_Signal_RequiresAuth(t *testing.T) {
-	e2e.SkipIfMissingGateway(t)
-
-	gatewayURL := e2e.GetGatewayURL()
-	client := e2e.NewHTTPClient(10 * time.Second)
-
-	// Use regular HTTP GET to the signal endpoint — without auth it should return 401
-	// before WebSocket upgrade
-	req, err := http.NewRequest("GET", gatewayURL+"/v1/webrtc/signal?room=test-room", nil)
-	if err != nil {
-		t.Fatalf("failed to create request: %v", err)
-	}
-
-	resp, err := client.Do(req)
-	if err != nil {
-		t.Fatalf("request failed: %v", err)
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusUnauthorized {
-		t.Fatalf("expected 401, got %d", resp.StatusCode)
-	}
-}
-
-// TestWebRTC_Rooms_CreateAndList verifies room creation and listing with proper auth.
-func TestWebRTC_Rooms_CreateAndList(t *testing.T) {
-	e2e.SkipIfMissingGateway(t)
-
-	gatewayURL := e2e.GetGatewayURL()
-	apiKey := e2e.GetAPIKey()
-	if apiKey == "" {
-		t.Skip("no API key configured")
-	}
-	client := e2e.NewHTTPClient(10 * time.Second)
-
-	roomID := e2e.GenerateUniqueID("e2e-webrtc-room")
-
-	// Create room
-	createBody, _ := json.Marshal(map[string]string{"room_id": roomID})
-	req, err := http.NewRequest("POST", gatewayURL+"/v1/webrtc/rooms", bytes.NewReader(createBody))
-	if err != nil {
-		t.Fatalf("failed to create request: %v", err)
-	}
-	req.Header.Set("Authorization", "Bearer "+apiKey)
-	req.Header.Set("Content-Type", "application/json")
-
-	resp, err := client.Do(req)
-	if err != nil {
-		t.Fatalf("create room failed: %v", err)
-	}
-	resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK && resp.StatusCode != http.StatusCreated {
-		t.Fatalf("expected 200/201, got %d", resp.StatusCode)
-	}
-
-	// List rooms
-	req, err = http.NewRequest("GET", gatewayURL+"/v1/webrtc/rooms", nil)
-	if err != nil {
-		t.Fatalf("failed to create request: %v", err)
-	}
-	req.Header.Set("Authorization", "Bearer "+apiKey)
-
-	resp, err = client.Do(req)
-	if err != nil {
-		t.Fatalf("list rooms failed: %v", err)
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK {
-		t.Fatalf("expected 200, got %d", resp.StatusCode)
-	}
-
-	// Clean up: delete room
-	req, err = http.NewRequest("DELETE", gatewayURL+"/v1/webrtc/rooms?room_id="+roomID, nil)
-	if err != nil {
-		t.Fatalf("failed to create request: %v", err)
-	}
-	req.Header.Set("Authorization", "Bearer "+apiKey)
-
-	resp2, err := client.Do(req)
-	if err != nil {
-		t.Fatalf("delete room failed: %v", err)
-	}
-	resp2.Body.Close()
-}
-
-// TestWebRTC_PermissionsPolicy verifies the Permissions-Policy header allows camera and microphone.
-func TestWebRTC_PermissionsPolicy(t *testing.T) {
-	e2e.SkipIfMissingGateway(t)
-
-	gatewayURL := e2e.GetGatewayURL()
-	apiKey := e2e.GetAPIKey()
-	if apiKey == "" {
-		t.Skip("no API key configured")
-	}
-	client := e2e.NewHTTPClient(10 * time.Second)
-
-	req, err := http.NewRequest("GET", gatewayURL+"/v1/webrtc/rooms", nil)
-	if err != nil {
-		t.Fatalf("failed to create request: %v", err)
-	}
-	req.Header.Set("Authorization", "Bearer "+apiKey)
-
-	resp, err := client.Do(req)
-	if err != nil {
-		t.Fatalf("request failed: %v", err)
-	}
-	defer resp.Body.Close()
-
-	pp := resp.Header.Get("Permissions-Policy")
-	if pp == "" {
-		t.Skip("Permissions-Policy header not set")
-	}
-
-	if !strings.Contains(pp, "camera=(self)") {
-		t.Errorf("Permissions-Policy missing camera=(self), got: %s", pp)
-	}
-	if !strings.Contains(pp, "microphone=(self)") {
-		t.Errorf("Permissions-Policy missing microphone=(self), got: %s", pp)
-	}
-}

core/migrations/018_webrtc_services.sql

@@ -1,96 +0,0 @@
--- Migration 018: WebRTC Services (SFU + TURN) for Namespace Clusters
--- Adds per-namespace WebRTC configuration, room tracking, and port allocation
--- WebRTC is opt-in: enabled via `orama namespace enable webrtc`
-
-BEGIN;
-
--- Per-namespace WebRTC configuration
--- One row per namespace that has WebRTC enabled
-CREATE TABLE IF NOT EXISTS namespace_webrtc_config (
-    id TEXT PRIMARY KEY,                        -- UUID
-    namespace_cluster_id TEXT NOT NULL UNIQUE,   -- FK to namespace_clusters
-    namespace_name TEXT NOT NULL,               -- Cached for easier lookups
-    enabled INTEGER NOT NULL DEFAULT 1,         -- 1 = enabled, 0 = disabled
-
-    -- TURN authentication
-    turn_shared_secret TEXT NOT NULL,           -- HMAC-SHA1 shared secret (base64, 32 bytes)
-    turn_credential_ttl INTEGER NOT NULL DEFAULT 600, -- Credential TTL in seconds (default: 10 min)
-
-    -- Service topology
-    sfu_node_count INTEGER NOT NULL DEFAULT 3,  -- SFU instances (all 3 nodes)
-    turn_node_count INTEGER NOT NULL DEFAULT 2, -- TURN instances (2 of 3 nodes for HA)
-
-    -- Metadata
-    enabled_by TEXT NOT NULL,                   -- Wallet address that enabled WebRTC
-    enabled_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    disabled_at TIMESTAMP,
-
-    FOREIGN KEY (namespace_cluster_id) REFERENCES namespace_clusters(id) ON DELETE CASCADE
-);
-
-CREATE INDEX IF NOT EXISTS idx_webrtc_config_namespace ON namespace_webrtc_config(namespace_name);
-CREATE INDEX IF NOT EXISTS idx_webrtc_config_cluster ON namespace_webrtc_config(namespace_cluster_id);
-
--- WebRTC room tracking
--- Tracks active rooms and their SFU node affinity
-CREATE TABLE IF NOT EXISTS webrtc_rooms (
-    id TEXT PRIMARY KEY,                        -- UUID
-    namespace_cluster_id TEXT NOT NULL,         -- FK to namespace_clusters
-    namespace_name TEXT NOT NULL,               -- Cached for easier lookups
-    room_id TEXT NOT NULL,                      -- Application-defined room identifier
-
-    -- SFU affinity
-    sfu_node_id TEXT NOT NULL,                  -- Node hosting this room's SFU
-    sfu_internal_ip TEXT NOT NULL,              -- WireGuard IP of SFU node
-    sfu_signaling_port INTEGER NOT NULL,        -- SFU WebSocket signaling port
-
-    -- Room state
-    participant_count INTEGER NOT NULL DEFAULT 0,
-    max_participants INTEGER NOT NULL DEFAULT 100,
-    created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    last_activity TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
-
-    -- Prevent duplicate rooms within a namespace
-    UNIQUE(namespace_cluster_id, room_id),
-    FOREIGN KEY (namespace_cluster_id) REFERENCES namespace_clusters(id) ON DELETE CASCADE
-);
-
-CREATE INDEX IF NOT EXISTS idx_webrtc_rooms_namespace ON webrtc_rooms(namespace_name);
-CREATE INDEX IF NOT EXISTS idx_webrtc_rooms_node ON webrtc_rooms(sfu_node_id);
-CREATE INDEX IF NOT EXISTS idx_webrtc_rooms_activity ON webrtc_rooms(last_activity);
-
--- WebRTC port allocations
--- Separate from namespace_port_allocations to avoid breaking existing port blocks
--- Each namespace gets SFU + TURN ports on each node where those services run
-CREATE TABLE IF NOT EXISTS webrtc_port_allocations (
-    id TEXT PRIMARY KEY,                        -- UUID
-    node_id TEXT NOT NULL,                      -- Physical node ID
-    namespace_cluster_id TEXT NOT NULL,         -- FK to namespace_clusters
-    service_type TEXT NOT NULL,                 -- 'sfu' or 'turn'
-
-    -- SFU ports (when service_type = 'sfu')
-    sfu_signaling_port INTEGER,                -- WebSocket signaling port
-    sfu_media_port_start INTEGER,              -- Start of RTP media port range
-    sfu_media_port_end INTEGER,                -- End of RTP media port range
-
-    -- TURN ports (when service_type = 'turn')
-    turn_listen_port INTEGER,                  -- TURN listener port (3478)
-    turn_tls_port INTEGER,                     -- TURN TLS port (443/UDP)
-    turn_relay_port_start INTEGER,             -- Start of relay port range
-    turn_relay_port_end INTEGER,               -- End of relay port range
-
-    allocated_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
-
-    -- Prevent overlapping allocations
-    UNIQUE(node_id, namespace_cluster_id, service_type),
-    FOREIGN KEY (namespace_cluster_id) REFERENCES namespace_clusters(id) ON DELETE CASCADE
-);
-
-CREATE INDEX IF NOT EXISTS idx_webrtc_ports_node ON webrtc_port_allocations(node_id);
-CREATE INDEX IF NOT EXISTS idx_webrtc_ports_cluster ON webrtc_port_allocations(namespace_cluster_id);
-CREATE INDEX IF NOT EXISTS idx_webrtc_ports_type ON webrtc_port_allocations(service_type);
-
--- Mark migration as applied
-INSERT OR IGNORE INTO schema_migrations(version) VALUES (18);
-
-COMMIT;

core/migrations/019_invalidate_plaintext_refresh_tokens.sql

@@ -1,4 +0,0 @@
--- Invalidate all existing refresh tokens.
--- Tokens were stored in plaintext; the application now stores SHA-256 hashes.
--- Users will need to re-authenticate (tokens have 30-day expiry anyway).
-UPDATE refresh_tokens SET revoked_at = datetime('now') WHERE revoked_at IS NULL;

core/pkg/cli/build/archive.go

@@ -1,318 +0,0 @@
-package build
-
-import (
-	"archive/tar"
-	"compress/gzip"
-	"crypto/sha256"
-	"encoding/hex"
-	"encoding/json"
-	"fmt"
-	"io"
-	"net/http"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"strings"
-	"time"
-)
-
-// Manifest describes the contents of a binary archive.
-type Manifest struct {
-	Version   string            `json:"version"`
-	Commit    string            `json:"commit"`
-	Date      string            `json:"date"`
-	Arch      string            `json:"arch"`
-	Checksums map[string]string `json:"checksums"` // filename -> sha256
-}
-
-// generateManifest creates the manifest with SHA256 checksums of all binaries.
-func (b *Builder) generateManifest() (*Manifest, error) {
-	m := &Manifest{
-		Version:   b.version,
-		Commit:    b.commit,
-		Date:      b.date,
-		Arch:      b.flags.Arch,
-		Checksums: make(map[string]string),
-	}
-
-	entries, err := os.ReadDir(b.binDir)
-	if err != nil {
-		return nil, err
-	}
-
-	for _, entry := range entries {
-		if entry.IsDir() {
-			continue
-		}
-		path := filepath.Join(b.binDir, entry.Name())
-		hash, err := sha256File(path)
-		if err != nil {
-			return nil, fmt.Errorf("failed to hash %s: %w", entry.Name(), err)
-		}
-		m.Checksums[entry.Name()] = hash
-	}
-
-	return m, nil
-}
-
-// createArchive creates the tar.gz archive from the build directory.
-func (b *Builder) createArchive(outputPath string, manifest *Manifest) error {
-	fmt.Printf("\nCreating archive: %s\n", outputPath)
-
-	// Write manifest.json to tmpDir
-	manifestData, err := json.MarshalIndent(manifest, "", "  ")
-	if err != nil {
-		return err
-	}
-	if err := os.WriteFile(filepath.Join(b.tmpDir, "manifest.json"), manifestData, 0644); err != nil {
-		return err
-	}
-
-	// Create output file
-	f, err := os.Create(outputPath)
-	if err != nil {
-		return err
-	}
-	defer f.Close()
-
-	gw := gzip.NewWriter(f)
-	defer gw.Close()
-
-	tw := tar.NewWriter(gw)
-	defer tw.Close()
-
-	// Add bin/ directory
-	if err := addDirToTar(tw, b.binDir, "bin"); err != nil {
-		return err
-	}
-
-	// Add systemd/ directory
-	systemdDir := filepath.Join(b.tmpDir, "systemd")
-	if _, err := os.Stat(systemdDir); err == nil {
-		if err := addDirToTar(tw, systemdDir, "systemd"); err != nil {
-			return err
-		}
-	}
-
-	// Add packages/ directory if it exists
-	packagesDir := filepath.Join(b.tmpDir, "packages")
-	if _, err := os.Stat(packagesDir); err == nil {
-		if err := addDirToTar(tw, packagesDir, "packages"); err != nil {
-			return err
-		}
-	}
-
-	// Add manifest.json
-	if err := addFileToTar(tw, filepath.Join(b.tmpDir, "manifest.json"), "manifest.json"); err != nil {
-		return err
-	}
-
-	// Add manifest.sig if it exists (created by --sign)
-	sigPath := filepath.Join(b.tmpDir, "manifest.sig")
-	if _, err := os.Stat(sigPath); err == nil {
-		if err := addFileToTar(tw, sigPath, "manifest.sig"); err != nil {
-			return err
-		}
-	}
-
-	// Print summary
-	fmt.Printf("  bin/:      %d binaries\n", len(manifest.Checksums))
-	fmt.Printf("  systemd/:  namespace templates\n")
-	fmt.Printf("  manifest:  v%s (%s) linux/%s\n", manifest.Version, manifest.Commit, manifest.Arch)
-
-	info, err := f.Stat()
-	if err == nil {
-		fmt.Printf("  size:      %s\n", formatBytes(info.Size()))
-	}
-
-	return nil
-}
-
-// signManifest signs the manifest hash using rootwallet CLI.
-// Produces manifest.sig containing the hex-encoded EVM signature.
-func (b *Builder) signManifest(manifest *Manifest) error {
-	fmt.Printf("\nSigning manifest with rootwallet...\n")
-
-	// Serialize manifest deterministically (compact JSON, sorted keys via json.Marshal)
-	manifestData, err := json.Marshal(manifest)
-	if err != nil {
-		return fmt.Errorf("failed to marshal manifest: %w", err)
-	}
-
-	// Hash the manifest JSON
-	hash := sha256.Sum256(manifestData)
-	hashHex := hex.EncodeToString(hash[:])
-
-	// Call rw sign <hash> --chain evm
-	cmd := exec.Command("rw", "sign", hashHex, "--chain", "evm")
-	var stdout, stderr strings.Builder
-	cmd.Stdout = &stdout
-	cmd.Stderr = &stderr
-
-	if err := cmd.Run(); err != nil {
-		return fmt.Errorf("rw sign failed: %w\n%s", err, stderr.String())
-	}
-
-	signature := strings.TrimSpace(stdout.String())
-	if signature == "" {
-		return fmt.Errorf("rw sign produced empty signature")
-	}
-
-	// Write signature file
-	sigPath := filepath.Join(b.tmpDir, "manifest.sig")
-	if err := os.WriteFile(sigPath, []byte(signature), 0644); err != nil {
-		return fmt.Errorf("failed to write manifest.sig: %w", err)
-	}
-
-	fmt.Printf("  Manifest signed (SHA256: %s...)\n", hashHex[:16])
-	return nil
-}
-
-// addDirToTar adds all files in a directory to the tar archive under the given prefix.
-func addDirToTar(tw *tar.Writer, srcDir, prefix string) error {
-	return filepath.Walk(srcDir, func(path string, info os.FileInfo, err error) error {
-		if err != nil {
-			return err
-		}
-
-		// Calculate relative path
-		relPath, err := filepath.Rel(srcDir, path)
-		if err != nil {
-			return err
-		}
-		tarPath := filepath.Join(prefix, relPath)
-
-		if info.IsDir() {
-			header := &tar.Header{
-				Name:     tarPath + "/",
-				Mode:     0755,
-				Typeflag: tar.TypeDir,
-			}
-			return tw.WriteHeader(header)
-		}
-
-		return addFileToTar(tw, path, tarPath)
-	})
-}
-
-// addFileToTar adds a single file to the tar archive.
-func addFileToTar(tw *tar.Writer, srcPath, tarPath string) error {
-	f, err := os.Open(srcPath)
-	if err != nil {
-		return err
-	}
-	defer f.Close()
-
-	info, err := f.Stat()
-	if err != nil {
-		return err
-	}
-
-	header := &tar.Header{
-		Name: tarPath,
-		Size: info.Size(),
-		Mode: int64(info.Mode()),
-	}
-
-	if err := tw.WriteHeader(header); err != nil {
-		return err
-	}
-
-	_, err = io.Copy(tw, f)
-	return err
-}
-
-// sha256File computes the SHA256 hash of a file.
-func sha256File(path string) (string, error) {
-	f, err := os.Open(path)
-	if err != nil {
-		return "", err
-	}
-	defer f.Close()
-
-	h := sha256.New()
-	if _, err := io.Copy(h, f); err != nil {
-		return "", err
-	}
-	return hex.EncodeToString(h.Sum(nil)), nil
-}
-
-// downloadFile downloads a URL to a local file path.
-func downloadFile(url, destPath string) error {
-	client := &http.Client{Timeout: 5 * time.Minute}
-	resp, err := client.Get(url)
-	if err != nil {
-		return fmt.Errorf("failed to download %s: %w", url, err)
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK {
-		return fmt.Errorf("download %s returned status %d", url, resp.StatusCode)
-	}
-
-	f, err := os.Create(destPath)
-	if err != nil {
-		return err
-	}
-	defer f.Close()
-
-	_, err = io.Copy(f, resp.Body)
-	return err
-}
-
-// extractFileFromTarball extracts a single file from a tar.gz archive.
-func extractFileFromTarball(tarPath, targetFile, destPath string) error {
-	f, err := os.Open(tarPath)
-	if err != nil {
-		return err
-	}
-	defer f.Close()
-
-	gr, err := gzip.NewReader(f)
-	if err != nil {
-		return err
-	}
-	defer gr.Close()
-
-	tr := tar.NewReader(gr)
-	for {
-		header, err := tr.Next()
-		if err == io.EOF {
-			break
-		}
-		if err != nil {
-			return err
-		}
-
-		// Match the target file (strip leading ./ if present)
-		name := strings.TrimPrefix(header.Name, "./")
-		if name == targetFile {
-			out, err := os.OpenFile(destPath, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0755)
-			if err != nil {
-				return err
-			}
-			defer out.Close()
-
-			if _, err := io.Copy(out, tr); err != nil {
-				return err
-			}
-			return nil
-		}
-	}
-
-	return fmt.Errorf("file %s not found in archive %s", targetFile, tarPath)
-}
-
-// formatBytes formats bytes into a human-readable string.
-func formatBytes(b int64) string {
-	const unit = 1024
-	if b < unit {
-		return fmt.Sprintf("%d B", b)
-	}
-	div, exp := int64(unit), 0
-	for n := b / unit; n >= unit; n /= unit {
-		div *= unit
-		exp++
-	}
-	return fmt.Sprintf("%.1f %cB", float64(b)/float64(div), "KMGTPE"[exp])
-}

core/pkg/cli/build/builder.go

@@ -1,829 +0,0 @@
-package build
-
-import (
-	"fmt"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"strings"
-	"time"
-
-	"github.com/DeBrosOfficial/network/pkg/constants"
-)
-
-// oramaBinary defines a binary to cross-compile from the project source.
-type oramaBinary struct {
-	Name    string // output binary name
-	Package string // Go package path relative to project root
-	// Extra ldflags beyond the standard ones
-	ExtraLDFlags string
-}
-
-// Builder orchestrates the entire build process.
-type Builder struct {
-	flags      *Flags
-	projectDir string
-	tmpDir     string
-	binDir     string
-	version    string
-	commit     string
-	date       string
-}
-
-// NewBuilder creates a new Builder.
-func NewBuilder(flags *Flags) *Builder {
-	return &Builder{flags: flags}
-}
-
-// Build runs the full build pipeline.
-func (b *Builder) Build() error {
-	start := time.Now()
-
-	// Find project root
-	projectDir, err := findProjectRoot()
-	if err != nil {
-		return err
-	}
-	b.projectDir = projectDir
-
-	// Read version from Makefile or use "dev"
-	b.version = b.readVersion()
-	b.commit = b.readCommit()
-	b.date = time.Now().UTC().Format("2006-01-02T15:04:05Z")
-
-	// Create temp build directory
-	b.tmpDir, err = os.MkdirTemp("", "orama-build-*")
-	if err != nil {
-		return fmt.Errorf("failed to create temp dir: %w", err)
-	}
-	defer os.RemoveAll(b.tmpDir)
-
-	b.binDir = filepath.Join(b.tmpDir, "bin")
-	if err := os.MkdirAll(b.binDir, 0755); err != nil {
-		return fmt.Errorf("failed to create bin dir: %w", err)
-	}
-
-	fmt.Printf("Building orama %s for linux/%s\n", b.version, b.flags.Arch)
-	fmt.Printf("Project: %s\n\n", b.projectDir)
-
-	// Step 1: Cross-compile Orama binaries
-	if err := b.buildOramaBinaries(); err != nil {
-		return fmt.Errorf("failed to build orama binaries: %w", err)
-	}
-
-	// Step 2: Cross-compile Vault Guardian (Zig)
-	if err := b.buildVaultGuardian(); err != nil {
-		return fmt.Errorf("failed to build vault-guardian: %w", err)
-	}
-
-	// Step 3: Cross-compile Olric
-	if err := b.buildOlric(); err != nil {
-		return fmt.Errorf("failed to build olric: %w", err)
-	}
-
-	// Step 4: Cross-compile IPFS Cluster
-	if err := b.buildIPFSCluster(); err != nil {
-		return fmt.Errorf("failed to build ipfs-cluster: %w", err)
-	}
-
-	// Step 5: Build CoreDNS with RQLite plugin
-	if err := b.buildCoreDNS(); err != nil {
-		return fmt.Errorf("failed to build coredns: %w", err)
-	}
-
-	// Step 6: Build Caddy with Orama DNS module
-	if err := b.buildCaddy(); err != nil {
-		return fmt.Errorf("failed to build caddy: %w", err)
-	}
-
-	// Step 7: Download pre-built IPFS Kubo
-	if err := b.downloadIPFS(); err != nil {
-		return fmt.Errorf("failed to download ipfs: %w", err)
-	}
-
-	// Step 8: Download pre-built RQLite
-	if err := b.downloadRQLite(); err != nil {
-		return fmt.Errorf("failed to download rqlite: %w", err)
-	}
-
-	// Step 9: Copy systemd templates
-	if err := b.copySystemdTemplates(); err != nil {
-		return fmt.Errorf("failed to copy systemd templates: %w", err)
-	}
-
-	// Step 10: Generate manifest
-	manifest, err := b.generateManifest()
-	if err != nil {
-		return fmt.Errorf("failed to generate manifest: %w", err)
-	}
-
-	// Step 11: Sign manifest (optional)
-	if b.flags.Sign {
-		if err := b.signManifest(manifest); err != nil {
-			return fmt.Errorf("failed to sign manifest: %w", err)
-		}
-	}
-
-	// Step 12: Create archive
-	outputPath := b.flags.Output
-	if outputPath == "" {
-		outputPath = fmt.Sprintf("/tmp/orama-%s-linux-%s.tar.gz", b.version, b.flags.Arch)
-	}
-
-	if err := b.createArchive(outputPath, manifest); err != nil {
-		return fmt.Errorf("failed to create archive: %w", err)
-	}
-
-	elapsed := time.Since(start).Round(time.Second)
-	fmt.Printf("\nBuild complete in %s\n", elapsed)
-	fmt.Printf("Archive: %s\n", outputPath)
-
-	return nil
-}
-
-func (b *Builder) buildOramaBinaries() error {
-	fmt.Println("[1/8] Cross-compiling Orama binaries...")
-
-	ldflags := fmt.Sprintf("-s -w -X 'main.version=%s' -X 'main.commit=%s' -X 'main.date=%s'",
-		b.version, b.commit, b.date)
-
-	gatewayLDFlags := fmt.Sprintf("%s -X 'github.com/DeBrosOfficial/network/pkg/gateway.BuildVersion=%s' -X 'github.com/DeBrosOfficial/network/pkg/gateway.BuildCommit=%s' -X 'github.com/DeBrosOfficial/network/pkg/gateway.BuildTime=%s'",
-		ldflags, b.version, b.commit, b.date)
-
-	binaries := []oramaBinary{
-		{Name: "orama", Package: "./cmd/cli/"},
-		{Name: "orama-node", Package: "./cmd/node/"},
-		{Name: "gateway", Package: "./cmd/gateway/", ExtraLDFlags: gatewayLDFlags},
-		{Name: "identity", Package: "./cmd/identity/"},
-		{Name: "sfu", Package: "./cmd/sfu/"},
-		{Name: "turn", Package: "./cmd/turn/"},
-	}
-
-	for _, bin := range binaries {
-		flags := ldflags
-		if bin.ExtraLDFlags != "" {
-			flags = bin.ExtraLDFlags
-		}
-
-		output := filepath.Join(b.binDir, bin.Name)
-		cmd := exec.Command("go", "build",
-			"-ldflags", flags,
-			"-trimpath",
-			"-o", output,
-			bin.Package)
-		cmd.Dir = b.projectDir
-		cmd.Env = b.crossEnv()
-		cmd.Stdout = os.Stdout
-		cmd.Stderr = os.Stderr
-
-		if b.flags.Verbose {
-			fmt.Printf("  go build -o %s %s\n", bin.Name, bin.Package)
-		}
-
-		if err := cmd.Run(); err != nil {
-			return fmt.Errorf("failed to build %s: %w", bin.Name, err)
-		}
-		fmt.Printf("  ✓ %s\n", bin.Name)
-	}
-
-	return nil
-}
-
-func (b *Builder) buildVaultGuardian() error {
-	fmt.Println("[2/8] Cross-compiling Vault Guardian (Zig)...")
-
-	// Ensure zig is available
-	if _, err := exec.LookPath("zig"); err != nil {
-		return fmt.Errorf("zig not found in PATH — install from https://ziglang.org/download/")
-	}
-
-	// Vault source is sibling to orama project
-	vaultDir := filepath.Join(b.projectDir, "..", "orama-vault")
-	if _, err := os.Stat(filepath.Join(vaultDir, "build.zig")); err != nil {
-		return fmt.Errorf("vault source not found at %s — expected orama-vault as sibling directory: %w", vaultDir, err)
-	}
-
-	// Map Go arch to Zig target triple
-	var zigTarget string
-	switch b.flags.Arch {
-	case "amd64":
-		zigTarget = "x86_64-linux-musl"
-	case "arm64":
-		zigTarget = "aarch64-linux-musl"
-	default:
-		return fmt.Errorf("unsupported architecture for vault: %s", b.flags.Arch)
-	}
-
-	if b.flags.Verbose {
-		fmt.Printf("  zig build -Dtarget=%s -Doptimize=ReleaseSafe\n", zigTarget)
-	}
-
-	cmd := exec.Command("zig", "build",
-		fmt.Sprintf("-Dtarget=%s", zigTarget),
-		"-Doptimize=ReleaseSafe")
-	cmd.Dir = vaultDir
-	cmd.Stdout = os.Stdout
-	cmd.Stderr = os.Stderr
-
-	if err := cmd.Run(); err != nil {
-		return fmt.Errorf("zig build failed: %w", err)
-	}
-
-	// Copy output binary to build bin dir
-	src := filepath.Join(vaultDir, "zig-out", "bin", "vault-guardian")
-	dst := filepath.Join(b.binDir, "vault-guardian")
-	if err := copyFile(src, dst); err != nil {
-		return fmt.Errorf("failed to copy vault-guardian binary: %w", err)
-	}
-
-	fmt.Println("  ✓ vault-guardian")
-	return nil
-}
-
-// copyFile copies a file from src to dst, preserving executable permissions.
-func copyFile(src, dst string) error {
-	srcFile, err := os.Open(src)
-	if err != nil {
-		return err
-	}
-	defer srcFile.Close()
-
-	dstFile, err := os.OpenFile(dst, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0755)
-	if err != nil {
-		return err
-	}
-	defer dstFile.Close()
-
-	if _, err := srcFile.WriteTo(dstFile); err != nil {
-		return err
-	}
-	return nil
-}
-
-func (b *Builder) buildOlric() error {
-	fmt.Printf("[3/8] Cross-compiling Olric %s...\n", constants.OlricVersion)
-
-	// go install doesn't support cross-compilation with GOBIN set,
-	// so we create a temporary module and use go build -o instead.
-	tmpDir, err := os.MkdirTemp("", "olric-build-*")
-	if err != nil {
-		return fmt.Errorf("create temp dir: %w", err)
-	}
-	defer os.RemoveAll(tmpDir)
-
-	modInit := exec.Command("go", "mod", "init", "olric-build")
-	modInit.Dir = tmpDir
-	modInit.Stderr = os.Stderr
-	if err := modInit.Run(); err != nil {
-		return fmt.Errorf("go mod init: %w", err)
-	}
-
-	modGet := exec.Command("go", "get",
-		fmt.Sprintf("github.com/olric-data/olric/cmd/olric-server@%s", constants.OlricVersion))
-	modGet.Dir = tmpDir
-	modGet.Env = append(os.Environ(),
-		"GOPROXY=https://proxy.golang.org|direct",
-		"GONOSUMDB=*")
-	modGet.Stderr = os.Stderr
-	if err := modGet.Run(); err != nil {
-		return fmt.Errorf("go get olric: %w", err)
-	}
-
-	cmd := exec.Command("go", "build",
-		"-ldflags", "-s -w",
-		"-trimpath",
-		"-o", filepath.Join(b.binDir, "olric-server"),
-		fmt.Sprintf("github.com/olric-data/olric/cmd/olric-server"))
-	cmd.Dir = tmpDir
-	cmd.Env = append(b.crossEnv(),
-		"GOPROXY=https://proxy.golang.org|direct",
-		"GONOSUMDB=*")
-	cmd.Stdout = os.Stdout
-	cmd.Stderr = os.Stderr
-
-	if err := cmd.Run(); err != nil {
-		return err
-	}
-	fmt.Println("  ✓ olric-server")
-	return nil
-}
-
-func (b *Builder) buildIPFSCluster() error {
-	fmt.Printf("[4/8] Cross-compiling IPFS Cluster %s...\n", constants.IPFSClusterVersion)
-
-	tmpDir, err := os.MkdirTemp("", "ipfs-cluster-build-*")
-	if err != nil {
-		return fmt.Errorf("create temp dir: %w", err)
-	}
-	defer os.RemoveAll(tmpDir)
-
-	modInit := exec.Command("go", "mod", "init", "ipfs-cluster-build")
-	modInit.Dir = tmpDir
-	modInit.Stderr = os.Stderr
-	if err := modInit.Run(); err != nil {
-		return fmt.Errorf("go mod init: %w", err)
-	}
-
-	modGet := exec.Command("go", "get",
-		fmt.Sprintf("github.com/ipfs-cluster/ipfs-cluster/cmd/ipfs-cluster-service@%s", constants.IPFSClusterVersion))
-	modGet.Dir = tmpDir
-	modGet.Env = append(os.Environ(),
-		"GOPROXY=https://proxy.golang.org|direct",
-		"GONOSUMDB=*")
-	modGet.Stderr = os.Stderr
-	if err := modGet.Run(); err != nil {
-		return fmt.Errorf("go get ipfs-cluster: %w", err)
-	}
-
-	cmd := exec.Command("go", "build",
-		"-ldflags", "-s -w",
-		"-trimpath",
-		"-o", filepath.Join(b.binDir, "ipfs-cluster-service"),
-		"github.com/ipfs-cluster/ipfs-cluster/cmd/ipfs-cluster-service")
-	cmd.Dir = tmpDir
-	cmd.Env = append(b.crossEnv(),
-		"GOPROXY=https://proxy.golang.org|direct",
-		"GONOSUMDB=*")
-	cmd.Stdout = os.Stdout
-	cmd.Stderr = os.Stderr
-
-	if err := cmd.Run(); err != nil {
-		return err
-	}
-	fmt.Println("  ✓ ipfs-cluster-service")
-	return nil
-}
-
-func (b *Builder) buildCoreDNS() error {
-	fmt.Printf("[5/8] Building CoreDNS %s with RQLite plugin...\n", constants.CoreDNSVersion)
-
-	buildDir := filepath.Join(b.tmpDir, "coredns-build")
-
-	// Clone CoreDNS
-	fmt.Println("  Cloning CoreDNS...")
-	cmd := exec.Command("git", "clone", "--depth", "1",
-		"--branch", "v"+constants.CoreDNSVersion,
-		"https://github.com/coredns/coredns.git", buildDir)
-	cmd.Stdout = os.Stdout
-	cmd.Stderr = os.Stderr
-	if err := cmd.Run(); err != nil {
-		return fmt.Errorf("failed to clone coredns: %w", err)
-	}
-
-	// Copy RQLite plugin from local source
-	pluginSrc := filepath.Join(b.projectDir, "pkg", "coredns", "rqlite")
-	pluginDst := filepath.Join(buildDir, "plugin", "rqlite")
-	if err := os.MkdirAll(pluginDst, 0755); err != nil {
-		return err
-	}
-
-	entries, err := os.ReadDir(pluginSrc)
-	if err != nil {
-		return fmt.Errorf("failed to read rqlite plugin source at %s: %w", pluginSrc, err)
-	}
-	for _, entry := range entries {
-		if entry.IsDir() || filepath.Ext(entry.Name()) != ".go" {
-			continue
-		}
-		data, err := os.ReadFile(filepath.Join(pluginSrc, entry.Name()))
-		if err != nil {
-			return err
-		}
-		if err := os.WriteFile(filepath.Join(pluginDst, entry.Name()), data, 0644); err != nil {
-			return err
-		}
-	}
-
-	// Write plugin.cfg (same as build-linux-coredns.sh)
-	pluginCfg := `metadata:metadata
-cancel:cancel
-tls:tls
-reload:reload
-nsid:nsid
-bufsize:bufsize
-root:root
-bind:bind
-debug:debug
-trace:trace
-ready:ready
-health:health
-pprof:pprof
-prometheus:metrics
-errors:errors
-log:log
-dnstap:dnstap
-local:local
-dns64:dns64
-acl:acl
-any:any
-chaos:chaos
-loadbalance:loadbalance
-cache:cache
-rewrite:rewrite
-header:header
-dnssec:dnssec
-autopath:autopath
-minimal:minimal
-template:template
-transfer:transfer
-hosts:hosts
-file:file
-auto:auto
-secondary:secondary
-loop:loop
-forward:forward
-grpc:grpc
-erratic:erratic
-whoami:whoami
-on:github.com/coredns/caddy/onevent
-sign:sign
-view:view
-rqlite:rqlite
-`
-	if err := os.WriteFile(filepath.Join(buildDir, "plugin.cfg"), []byte(pluginCfg), 0644); err != nil {
-		return err
-	}
-
-	// Add dependencies
-	fmt.Println("  Adding dependencies...")
-	goPath := os.Getenv("PATH")
-	baseEnv := append(os.Environ(),
-		"PATH="+goPath,
-		"GOPROXY=https://proxy.golang.org|direct",
-		"GONOSUMDB=*")
-
-	for _, dep := range []string{"github.com/miekg/dns@latest", "go.uber.org/zap@latest"} {
-		cmd := exec.Command("go", "get", dep)
-		cmd.Dir = buildDir
-		cmd.Env = baseEnv
-		cmd.Stderr = os.Stderr
-		if err := cmd.Run(); err != nil {
-			return fmt.Errorf("failed to get %s: %w", dep, err)
-		}
-	}
-
-	cmd = exec.Command("go", "mod", "tidy")
-	cmd.Dir = buildDir
-	cmd.Env = baseEnv
-	cmd.Stderr = os.Stderr
-	if err := cmd.Run(); err != nil {
-		return fmt.Errorf("go mod tidy failed: %w", err)
-	}
-
-	// Generate plugin code
-	fmt.Println("  Generating plugin code...")
-	cmd = exec.Command("go", "generate")
-	cmd.Dir = buildDir
-	cmd.Env = baseEnv
-	cmd.Stderr = os.Stderr
-	if err := cmd.Run(); err != nil {
-		return fmt.Errorf("go generate failed: %w", err)
-	}
-
-	// Cross-compile
-	fmt.Println("  Building binary...")
-	cmd = exec.Command("go", "build",
-		"-ldflags", "-s -w",
-		"-trimpath",
-		"-o", filepath.Join(b.binDir, "coredns"))
-	cmd.Dir = buildDir
-	cmd.Env = append(baseEnv,
-		"GOOS=linux",
-		fmt.Sprintf("GOARCH=%s", b.flags.Arch),
-		"CGO_ENABLED=0")
-	cmd.Stdout = os.Stdout
-	cmd.Stderr = os.Stderr
-	if err := cmd.Run(); err != nil {
-		return fmt.Errorf("build failed: %w", err)
-	}
-
-	fmt.Println("  ✓ coredns")
-	return nil
-}
-
-func (b *Builder) buildCaddy() error {
-	fmt.Printf("[6/8] Building Caddy %s with Orama DNS module...\n", constants.CaddyVersion)
-
-	// Ensure xcaddy is available
-	if _, err := exec.LookPath("xcaddy"); err != nil {
-		return fmt.Errorf("xcaddy not found in PATH — install with: go install github.com/caddyserver/xcaddy/cmd/xcaddy@latest")
-	}
-
-	moduleDir := filepath.Join(b.tmpDir, "caddy-dns-orama")
-	if err := os.MkdirAll(moduleDir, 0755); err != nil {
-		return err
-	}
-
-	// Write go.mod
-	goMod := fmt.Sprintf(`module github.com/DeBrosOfficial/caddy-dns-orama
-
-go 1.22
-
-require (
-	github.com/caddyserver/caddy/v2 v2.%s
-	github.com/libdns/libdns v1.1.0
-)
-`, constants.CaddyVersion[2:])
-	if err := os.WriteFile(filepath.Join(moduleDir, "go.mod"), []byte(goMod), 0644); err != nil {
-		return err
-	}
-
-	// Write provider.go — read from the caddy installer's generated code
-	// We inline the same provider code used by the VPS-side caddy installer
-	providerCode := generateCaddyProviderCode()
-	if err := os.WriteFile(filepath.Join(moduleDir, "provider.go"), []byte(providerCode), 0644); err != nil {
-		return err
-	}
-
-	// go mod tidy
-	cmd := exec.Command("go", "mod", "tidy")
-	cmd.Dir = moduleDir
-	cmd.Env = append(os.Environ(),
-		"GOPROXY=https://proxy.golang.org|direct",
-		"GONOSUMDB=*")
-	cmd.Stderr = os.Stderr
-	if err := cmd.Run(); err != nil {
-		return fmt.Errorf("go mod tidy failed: %w", err)
-	}
-
-	// Build with xcaddy
-	fmt.Println("  Building binary...")
-	cmd = exec.Command("xcaddy", "build",
-		"v"+constants.CaddyVersion,
-		"--with", "github.com/DeBrosOfficial/caddy-dns-orama="+moduleDir,
-		"--output", filepath.Join(b.binDir, "caddy"))
-	cmd.Env = append(os.Environ(),
-		"GOOS=linux",
-		fmt.Sprintf("GOARCH=%s", b.flags.Arch),
-		"GOPROXY=https://proxy.golang.org|direct",
-		"GONOSUMDB=*")
-	cmd.Stdout = os.Stdout
-	cmd.Stderr = os.Stderr
-	if err := cmd.Run(); err != nil {
-		return fmt.Errorf("xcaddy build failed: %w", err)
-	}
-
-	fmt.Println("  ✓ caddy")
-	return nil
-}
-
-func (b *Builder) downloadIPFS() error {
-	fmt.Printf("[7/8] Downloading IPFS Kubo %s...\n", constants.IPFSKuboVersion)
-
-	arch := b.flags.Arch
-	tarball := fmt.Sprintf("kubo_%s_linux-%s.tar.gz", constants.IPFSKuboVersion, arch)
-	url := fmt.Sprintf("https://dist.ipfs.tech/kubo/%s/%s", constants.IPFSKuboVersion, tarball)
-	tarPath := filepath.Join(b.tmpDir, tarball)
-
-	if err := downloadFile(url, tarPath); err != nil {
-		return err
-	}
-
-	// Extract ipfs binary from kubo/ipfs
-	if err := extractFileFromTarball(tarPath, "kubo/ipfs", filepath.Join(b.binDir, "ipfs")); err != nil {
-		return err
-	}
-
-	fmt.Println("  ✓ ipfs")
-	return nil
-}
-
-func (b *Builder) downloadRQLite() error {
-	fmt.Printf("[8/8] Downloading RQLite %s...\n", constants.RQLiteVersion)
-
-	arch := b.flags.Arch
-	tarball := fmt.Sprintf("rqlite-v%s-linux-%s.tar.gz", constants.RQLiteVersion, arch)
-	url := fmt.Sprintf("https://github.com/rqlite/rqlite/releases/download/v%s/%s", constants.RQLiteVersion, tarball)
-	tarPath := filepath.Join(b.tmpDir, tarball)
-
-	if err := downloadFile(url, tarPath); err != nil {
-		return err
-	}
-
-	// Extract rqlited binary
-	extractDir := fmt.Sprintf("rqlite-v%s-linux-%s", constants.RQLiteVersion, arch)
-	if err := extractFileFromTarball(tarPath, extractDir+"/rqlited", filepath.Join(b.binDir, "rqlited")); err != nil {
-		return err
-	}
-
-	fmt.Println("  ✓ rqlited")
-	return nil
-}
-
-func (b *Builder) copySystemdTemplates() error {
-	systemdSrc := filepath.Join(b.projectDir, "systemd")
-	systemdDst := filepath.Join(b.tmpDir, "systemd")
-	if err := os.MkdirAll(systemdDst, 0755); err != nil {
-		return err
-	}
-
-	entries, err := os.ReadDir(systemdSrc)
-	if err != nil {
-		return fmt.Errorf("failed to read systemd dir: %w", err)
-	}
-
-	for _, entry := range entries {
-		if entry.IsDir() || !strings.HasSuffix(entry.Name(), ".service") {
-			continue
-		}
-		data, err := os.ReadFile(filepath.Join(systemdSrc, entry.Name()))
-		if err != nil {
-			return err
-		}
-		if err := os.WriteFile(filepath.Join(systemdDst, entry.Name()), data, 0644); err != nil {
-			return err
-		}
-	}
-
-	return nil
-}
-
-// crossEnv returns the environment for cross-compilation.
-func (b *Builder) crossEnv() []string {
-	return append(os.Environ(),
-		"GOOS=linux",
-		fmt.Sprintf("GOARCH=%s", b.flags.Arch),
-		"CGO_ENABLED=0")
-}
-
-func (b *Builder) readVersion() string {
-	// Try to read from Makefile
-	data, err := os.ReadFile(filepath.Join(b.projectDir, "Makefile"))
-	if err != nil {
-		return "dev"
-	}
-	for _, line := range strings.Split(string(data), "\n") {
-		line = strings.TrimSpace(line)
-		if strings.HasPrefix(line, "VERSION") {
-			parts := strings.SplitN(line, ":=", 2)
-			if len(parts) == 2 {
-				return strings.TrimSpace(parts[1])
-			}
-		}
-	}
-	return "dev"
-}
-
-func (b *Builder) readCommit() string {
-	cmd := exec.Command("git", "rev-parse", "--short", "HEAD")
-	cmd.Dir = b.projectDir
-	out, err := cmd.Output()
-	if err != nil {
-		return "unknown"
-	}
-	return strings.TrimSpace(string(out))
-}
-
-// generateCaddyProviderCode returns the Caddy DNS provider Go source.
-// This is the same code used by the VPS-side caddy installer.
-func generateCaddyProviderCode() string {
-	return `// Package orama implements a DNS provider for Caddy that uses the Orama Network
-// gateway's internal ACME API for DNS-01 challenge validation.
-package orama
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"fmt"
-	"net/http"
-	"time"
-
-	"github.com/caddyserver/caddy/v2"
-	"github.com/caddyserver/caddy/v2/caddyconfig/caddyfile"
-	"github.com/libdns/libdns"
-)
-
-func init() {
-	caddy.RegisterModule(Provider{})
-}
-
-// Provider wraps the Orama DNS provider for Caddy.
-type Provider struct {
-	// Endpoint is the URL of the Orama gateway's ACME API
-	// Default: http://localhost:6001/v1/internal/acme
-	Endpoint string ` + "`json:\"endpoint,omitempty\"`" + `
-}
-
-// CaddyModule returns the Caddy module information.
-func (Provider) CaddyModule() caddy.ModuleInfo {
-	return caddy.ModuleInfo{
-		ID:  "dns.providers.orama",
-		New: func() caddy.Module { return new(Provider) },
-	}
-}
-
-// Provision sets up the module.
-func (p *Provider) Provision(ctx caddy.Context) error {
-	if p.Endpoint == "" {
-		p.Endpoint = "http://localhost:6001/v1/internal/acme"
-	}
-	return nil
-}
-
-// UnmarshalCaddyfile parses the Caddyfile configuration.
-func (p *Provider) UnmarshalCaddyfile(d *caddyfile.Dispenser) error {
-	for d.Next() {
-		for d.NextBlock(0) {
-			switch d.Val() {
-			case "endpoint":
-				if !d.NextArg() {
-					return d.ArgErr()
-				}
-				p.Endpoint = d.Val()
-			default:
-				return d.Errf("unrecognized option: %s", d.Val())
-			}
-		}
-	}
-	return nil
-}
-
-// AppendRecords adds records to the zone.
-func (p *Provider) AppendRecords(ctx context.Context, zone string, records []libdns.Record) ([]libdns.Record, error) {
-	var added []libdns.Record
-	for _, rec := range records {
-		rr := rec.RR()
-		if rr.Type != "TXT" {
-			continue
-		}
-		fqdn := rr.Name + "." + zone
-		payload := map[string]string{"fqdn": fqdn, "value": rr.Data}
-		body, err := json.Marshal(payload)
-		if err != nil {
-			return added, fmt.Errorf("failed to marshal request: %w", err)
-		}
-		req, err := http.NewRequestWithContext(ctx, "POST", p.Endpoint+"/present", bytes.NewReader(body))
-		if err != nil {
-			return added, fmt.Errorf("failed to create request: %w", err)
-		}
-		req.Header.Set("Content-Type", "application/json")
-		client := &http.Client{Timeout: 30 * time.Second}
-		resp, err := client.Do(req)
-		if err != nil {
-			return added, fmt.Errorf("failed to present challenge: %w", err)
-		}
-		resp.Body.Close()
-		if resp.StatusCode != http.StatusOK {
-			return added, fmt.Errorf("present failed with status %d", resp.StatusCode)
-		}
-		added = append(added, rec)
-	}
-	return added, nil
-}
-
-// DeleteRecords removes records from the zone.
-func (p *Provider) DeleteRecords(ctx context.Context, zone string, records []libdns.Record) ([]libdns.Record, error) {
-	var deleted []libdns.Record
-	for _, rec := range records {
-		rr := rec.RR()
-		if rr.Type != "TXT" {
-			continue
-		}
-		fqdn := rr.Name + "." + zone
-		payload := map[string]string{"fqdn": fqdn, "value": rr.Data}
-		body, err := json.Marshal(payload)
-		if err != nil {
-			return deleted, fmt.Errorf("failed to marshal request: %w", err)
-		}
-		req, err := http.NewRequestWithContext(ctx, "POST", p.Endpoint+"/cleanup", bytes.NewReader(body))
-		if err != nil {
-			return deleted, fmt.Errorf("failed to create request: %w", err)
-		}
-		req.Header.Set("Content-Type", "application/json")
-		client := &http.Client{Timeout: 30 * time.Second}
-		resp, err := client.Do(req)
-		if err != nil {
-			return deleted, fmt.Errorf("failed to cleanup challenge: %w", err)
-		}
-		resp.Body.Close()
-		if resp.StatusCode != http.StatusOK {
-			return deleted, fmt.Errorf("cleanup failed with status %d", resp.StatusCode)
-		}
-		deleted = append(deleted, rec)
-	}
-	return deleted, nil
-}
-
-// GetRecords returns the records in the zone. Not used for ACME.
-func (p *Provider) GetRecords(ctx context.Context, zone string) ([]libdns.Record, error) {
-	return nil, nil
-}
-
-// SetRecords sets the records in the zone. Not used for ACME.
-func (p *Provider) SetRecords(ctx context.Context, zone string, records []libdns.Record) ([]libdns.Record, error) {
-	return nil, nil
-}
-
-// Interface guards
-var (
-	_ caddy.Module          = (*Provider)(nil)
-	_ caddy.Provisioner     = (*Provider)(nil)
-	_ caddyfile.Unmarshaler = (*Provider)(nil)
-	_ libdns.RecordAppender = (*Provider)(nil)
-	_ libdns.RecordDeleter  = (*Provider)(nil)
-	_ libdns.RecordGetter   = (*Provider)(nil)
-	_ libdns.RecordSetter   = (*Provider)(nil)
-)
-`
-}

core/pkg/cli/build/command.go

@@ -1,82 +0,0 @@
-package build
-
-import (
-	"flag"
-	"fmt"
-	"os"
-	"path/filepath"
-	"runtime"
-)
-
-// Flags represents build command flags.
-type Flags struct {
-	Arch    string
-	Output  string
-	Verbose bool
-	Sign    bool // Sign the archive manifest with rootwallet
-}
-
-// Handle is the entry point for the build command.
-func Handle(args []string) {
-	flags, err := parseFlags(args)
-	if err != nil {
-		if err == flag.ErrHelp {
-			return
-		}
-		fmt.Fprintf(os.Stderr, "Error: %v\n", err)
-		os.Exit(1)
-	}
-
-	b := NewBuilder(flags)
-	if err := b.Build(); err != nil {
-		fmt.Fprintf(os.Stderr, "Error: %v\n", err)
-		os.Exit(1)
-	}
-}
-
-func parseFlags(args []string) (*Flags, error) {
-	fs := flag.NewFlagSet("build", flag.ContinueOnError)
-	fs.SetOutput(os.Stderr)
-
-	flags := &Flags{}
-
-	fs.StringVar(&flags.Arch, "arch", "amd64", "Target architecture (amd64, arm64)")
-	fs.StringVar(&flags.Output, "output", "", "Output archive path (default: /tmp/orama-<version>-linux-<arch>.tar.gz)")
-	fs.BoolVar(&flags.Verbose, "verbose", false, "Verbose output")
-	fs.BoolVar(&flags.Sign, "sign", false, "Sign the manifest with rootwallet (requires rw in PATH)")
-
-	if err := fs.Parse(args); err != nil {
-		return nil, err
-	}
-
-	return flags, nil
-}
-
-// findProjectRoot walks up from the current directory looking for go.mod.
-func findProjectRoot() (string, error) {
-	dir, err := os.Getwd()
-	if err != nil {
-		return "", err
-	}
-
-	for {
-		if _, err := os.Stat(filepath.Join(dir, "go.mod")); err == nil {
-			// Verify it's the network project
-			if _, err := os.Stat(filepath.Join(dir, "cmd", "cli")); err == nil {
-				return dir, nil
-			}
-		}
-		parent := filepath.Dir(dir)
-		if parent == dir {
-			break
-		}
-		dir = parent
-	}
-
-	return "", fmt.Errorf("could not find project root (no go.mod with cmd/cli found)")
-}
-
-// detectHostArch returns the host architecture in Go naming convention.
-func detectHostArch() string {
-	return runtime.GOARCH
-}

core/pkg/cli/cmd/buildcmd/build.go

@@ -1,24 +0,0 @@
-package buildcmd
-
-import (
-	"github.com/DeBrosOfficial/network/pkg/cli/build"
-	"github.com/spf13/cobra"
-)
-
-// Cmd is the top-level build command.
-var Cmd = &cobra.Command{
-	Use:   "build",
-	Short: "Build pre-compiled binary archive for deployment",
-	Long: `Cross-compile all Orama binaries and dependencies for Linux,
-then package them into a deployment archive. The archive includes:
-  - Orama binaries (CLI, node, gateway, identity, SFU, TURN)
-  - Olric, IPFS Kubo, IPFS Cluster, RQLite, CoreDNS, Caddy
-  - Systemd namespace templates
-  - manifest.json with checksums
-
-The resulting archive can be pushed to nodes with 'orama node push'.`,
-	Run: func(cmd *cobra.Command, args []string) {
-		build.Handle(args)
-	},
-	DisableFlagParsing: true,
-}

core/pkg/cli/cmd/namespacecmd/namespace.go

@@ -1,103 +0,0 @@
-package namespacecmd
-
-import (
-	"github.com/DeBrosOfficial/network/pkg/cli"
-	"github.com/spf13/cobra"
-)
-
-// Cmd is the root command for namespace management.
-var Cmd = &cobra.Command{
-	Use:     "namespace",
-	Aliases: []string{"ns"},
-	Short:   "Manage namespaces",
-	Long:    `List, delete, and repair namespaces on the Orama network.`,
-}
-
-var deleteCmd = &cobra.Command{
-	Use:   "delete",
-	Short: "Delete the current namespace and all its resources",
-	Run: func(cmd *cobra.Command, args []string) {
-		forceFlag, _ := cmd.Flags().GetBool("force")
-		var cliArgs []string
-		cliArgs = append(cliArgs, "delete")
-		if forceFlag {
-			cliArgs = append(cliArgs, "--force")
-		}
-		cli.HandleNamespaceCommand(cliArgs)
-	},
-}
-
-var listCmd = &cobra.Command{
-	Use:     "list",
-	Aliases: []string{"ls"},
-	Short:   "List namespaces owned by the current wallet",
-	Run: func(cmd *cobra.Command, args []string) {
-		cli.HandleNamespaceCommand([]string{"list"})
-	},
-}
-
-var repairCmd = &cobra.Command{
-	Use:   "repair <namespace>",
-	Short: "Repair an under-provisioned namespace cluster",
-	Args:  cobra.ExactArgs(1),
-	Run: func(cmd *cobra.Command, args []string) {
-		cli.HandleNamespaceCommand(append([]string{"repair"}, args...))
-	},
-}
-
-var enableCmd = &cobra.Command{
-	Use:   "enable <feature>",
-	Short: "Enable a feature for a namespace",
-	Long:  "Enable a feature for a namespace. Supported features: webrtc",
-	Args:  cobra.ExactArgs(1),
-	Run: func(cmd *cobra.Command, args []string) {
-		ns, _ := cmd.Flags().GetString("namespace")
-		cliArgs := []string{"enable", args[0]}
-		if ns != "" {
-			cliArgs = append(cliArgs, "--namespace", ns)
-		}
-		cli.HandleNamespaceCommand(cliArgs)
-	},
-}
-
-var disableCmd = &cobra.Command{
-	Use:   "disable <feature>",
-	Short: "Disable a feature for a namespace",
-	Long:  "Disable a feature for a namespace. Supported features: webrtc",
-	Args:  cobra.ExactArgs(1),
-	Run: func(cmd *cobra.Command, args []string) {
-		ns, _ := cmd.Flags().GetString("namespace")
-		cliArgs := []string{"disable", args[0]}
-		if ns != "" {
-			cliArgs = append(cliArgs, "--namespace", ns)
-		}
-		cli.HandleNamespaceCommand(cliArgs)
-	},
-}
-
-var webrtcStatusCmd = &cobra.Command{
-	Use:   "webrtc-status",
-	Short: "Show WebRTC service status for a namespace",
-	Run: func(cmd *cobra.Command, args []string) {
-		ns, _ := cmd.Flags().GetString("namespace")
-		cliArgs := []string{"webrtc-status"}
-		if ns != "" {
-			cliArgs = append(cliArgs, "--namespace", ns)
-		}
-		cli.HandleNamespaceCommand(cliArgs)
-	},
-}
-
-func init() {
-	deleteCmd.Flags().Bool("force", false, "Skip confirmation prompt")
-	enableCmd.Flags().String("namespace", "", "Namespace name")
-	disableCmd.Flags().String("namespace", "", "Namespace name")
-	webrtcStatusCmd.Flags().String("namespace", "", "Namespace name")
-
-	Cmd.AddCommand(listCmd)
-	Cmd.AddCommand(deleteCmd)
-	Cmd.AddCommand(repairCmd)
-	Cmd.AddCommand(enableCmd)
-	Cmd.AddCommand(disableCmd)
-	Cmd.AddCommand(webrtcStatusCmd)
-}

core/pkg/cli/cmd/node/clean.go

@@ -1,25 +0,0 @@
-package node
-
-import (
-	"github.com/DeBrosOfficial/network/pkg/cli/production/clean"
-	"github.com/spf13/cobra"
-)
-
-var cleanCmd = &cobra.Command{
-	Use:   "clean",
-	Short: "Clean (wipe) remote nodes for reinstallation",
-	Long: `Remove all Orama data, services, and configuration from remote nodes.
-Anyone relay keys at /var/lib/anon/ are preserved.
-
-This is a DESTRUCTIVE operation. Use --force to skip confirmation.
-
-Examples:
-  orama node clean --env testnet                       # Clean all testnet nodes
-  orama node clean --env testnet --node 1.2.3.4        # Clean specific node
-  orama node clean --env testnet --nuclear              # Also remove shared binaries
-  orama node clean --env testnet --force                # Skip confirmation`,
-	Run: func(cmd *cobra.Command, args []string) {
-		clean.Handle(args)
-	},
-	DisableFlagParsing: true,
-}

core/pkg/cli/cmd/node/enroll.go

@@ -1,26 +0,0 @@
-package node
-
-import (
-	"github.com/DeBrosOfficial/network/pkg/cli/production/enroll"
-	"github.com/spf13/cobra"
-)
-
-var enrollCmd = &cobra.Command{
-	Use:   "enroll",
-	Short: "Enroll an OramaOS node into the cluster",
-	Long: `Enroll a freshly booted OramaOS node into the cluster.
-
-The OramaOS node displays a registration code on port 9999. Provide this code
-along with an invite token to complete enrollment. The Gateway pushes cluster
-configuration (WireGuard, secrets, peer list) to the node.
-
-Usage:
-  orama node enroll --node-ip <ip> --code <code> --token <invite-token> --env <environment>
-
-The node must be reachable over the public internet on port 9999 (enrollment only).
-After enrollment, port 9999 is permanently closed and all communication goes over WireGuard.`,
-	Run: func(cmd *cobra.Command, args []string) {
-		enroll.Handle(args)
-	},
-	DisableFlagParsing: true,
-}

core/pkg/cli/cmd/node/push.go

@@ -1,24 +0,0 @@
-package node
-
-import (
-	"github.com/DeBrosOfficial/network/pkg/cli/production/push"
-	"github.com/spf13/cobra"
-)
-
-var pushCmd = &cobra.Command{
-	Use:   "push",
-	Short: "Push binary archive to remote nodes",
-	Long: `Upload a pre-built binary archive to remote nodes.
-
-By default, uses fanout distribution: uploads to one hub node,
-then distributes to all others via server-to-server SCP.
-
-Examples:
-  orama node push --env devnet          # Fanout to all devnet nodes
-  orama node push --env testnet --node 1.2.3.4  # Single node
-  orama node push --env testnet --direct # Sequential upload to each node`,
-	Run: func(cmd *cobra.Command, args []string) {
-		push.Handle(args)
-	},
-	DisableFlagParsing: true,
-}

core/pkg/cli/cmd/node/recover_raft.go

@@ -1,31 +0,0 @@
-package node
-
-import (
-	"github.com/DeBrosOfficial/network/pkg/cli/production/recover"
-	"github.com/spf13/cobra"
-)
-
-var recoverRaftCmd = &cobra.Command{
-	Use:   "recover-raft",
-	Short: "Recover RQLite cluster from split-brain",
-	Long: `Recover the RQLite Raft cluster from split-brain failure.
-
-Strategy:
-  1. Stop orama-node on ALL nodes simultaneously
-  2. Backup and delete raft/ on non-leader nodes
-  3. Start leader node, wait for Leader state
-  4. Start remaining nodes in batches
-  5. Verify cluster health
-
-The --leader flag must point to the node with the highest commit index.
-
-This is a DESTRUCTIVE operation. Use --force to skip confirmation.
-
-Examples:
-  orama node recover-raft --env testnet --leader 1.2.3.4
-  orama node recover-raft --env devnet --leader 1.2.3.4 --force`,
-	Run: func(cmd *cobra.Command, args []string) {
-		recover.Handle(args)
-	},
-	DisableFlagParsing: true,
-}

core/pkg/cli/cmd/node/rollout.go

@@ -1,22 +0,0 @@
-package node
-
-import (
-	"github.com/DeBrosOfficial/network/pkg/cli/production/rollout"
-	"github.com/spf13/cobra"
-)
-
-var rolloutCmd = &cobra.Command{
-	Use:   "rollout",
-	Short: "Build, push, and rolling upgrade all nodes in an environment",
-	Long: `Full deployment pipeline: build binary archive locally, push to all nodes,
-then perform a rolling upgrade (one node at a time).
-
-Examples:
-  orama node rollout --env testnet             # Full: build + push + rolling upgrade
-  orama node rollout --env testnet --no-build  # Skip build, use existing archive
-  orama node rollout --env testnet --yes       # Skip confirmation`,
-	Run: func(cmd *cobra.Command, args []string) {
-		rollout.Handle(args)
-	},
-	DisableFlagParsing: true,
-}

core/pkg/cli/cmd/node/unlock.go

@@ -1,26 +0,0 @@
-package node
-
-import (
-	"github.com/DeBrosOfficial/network/pkg/cli/production/unlock"
-	"github.com/spf13/cobra"
-)
-
-var unlockCmd = &cobra.Command{
-	Use:   "unlock",
-	Short: "Unlock an OramaOS genesis node",
-	Long: `Manually unlock a genesis OramaOS node that cannot reconstruct its LUKS key
-via Shamir shares (not enough peers online).
-
-This is only needed for the genesis node before enough peers have joined for
-Shamir-based unlock. Once 5+ peers exist, the genesis node transitions to
-normal Shamir unlock and this command is no longer needed.
-
-Usage:
-  orama node unlock --genesis --node-ip <wg-ip>
-
-The node must be reachable over WireGuard on port 9998.`,
-	Run: func(cmd *cobra.Command, args []string) {
-		unlock.Handle(args)
-	},
-	DisableFlagParsing: true,
-}

core/pkg/cli/cmd/sandboxcmd/sandbox.go

@@ -1,140 +0,0 @@
-package sandboxcmd
-
-import (
-	"fmt"
-	"os"
-
-	"github.com/DeBrosOfficial/network/pkg/cli/sandbox"
-	"github.com/spf13/cobra"
-)
-
-// Cmd is the root command for sandbox operations.
-var Cmd = &cobra.Command{
-	Use:   "sandbox",
-	Short: "Manage ephemeral Hetzner Cloud clusters for testing",
-	Long: `Spin up temporary 5-node Orama clusters on Hetzner Cloud for development and testing.
-
-Setup (one-time):
-  orama sandbox setup
-
-Usage:
-  orama sandbox create [--name <name>]     Create a new 5-node cluster
-  orama sandbox destroy [--name <name>]    Tear down a cluster
-  orama sandbox list                       List active sandboxes
-  orama sandbox status [--name <name>]     Show cluster health
-  orama sandbox rollout [--name <name>]    Build + push + rolling upgrade
-  orama sandbox ssh <node-number>          SSH into a sandbox node (1-5)
-  orama sandbox reset                      Delete all infra and config to start fresh`,
-}
-
-var setupCmd = &cobra.Command{
-	Use:   "setup",
-	Short: "Interactive setup: Hetzner API key, domain, floating IPs, SSH key",
-	RunE: func(cmd *cobra.Command, args []string) error {
-		return sandbox.Setup()
-	},
-}
-
-var createCmd = &cobra.Command{
-	Use:   "create",
-	Short: "Create a new 5-node sandbox cluster (~5 min)",
-	RunE: func(cmd *cobra.Command, args []string) error {
-		name, _ := cmd.Flags().GetString("name")
-		return sandbox.Create(name)
-	},
-}
-
-var destroyCmd = &cobra.Command{
-	Use:   "destroy",
-	Short: "Destroy a sandbox cluster and release resources",
-	RunE: func(cmd *cobra.Command, args []string) error {
-		name, _ := cmd.Flags().GetString("name")
-		force, _ := cmd.Flags().GetBool("force")
-		return sandbox.Destroy(name, force)
-	},
-}
-
-var listCmd = &cobra.Command{
-	Use:   "list",
-	Short: "List active sandbox clusters",
-	RunE: func(cmd *cobra.Command, args []string) error {
-		return sandbox.List()
-	},
-}
-
-var statusCmd = &cobra.Command{
-	Use:   "status",
-	Short: "Show cluster health report",
-	RunE: func(cmd *cobra.Command, args []string) error {
-		name, _ := cmd.Flags().GetString("name")
-		return sandbox.Status(name)
-	},
-}
-
-var rolloutCmd = &cobra.Command{
-	Use:   "rollout",
-	Short: "Build + push + rolling upgrade to sandbox cluster",
-	RunE: func(cmd *cobra.Command, args []string) error {
-		name, _ := cmd.Flags().GetString("name")
-		anyoneClient, _ := cmd.Flags().GetBool("anyone-client")
-		return sandbox.Rollout(name, sandbox.RolloutFlags{
-			AnyoneClient: anyoneClient,
-		})
-	},
-}
-
-var resetCmd = &cobra.Command{
-	Use:   "reset",
-	Short: "Delete all sandbox infrastructure and config to start fresh",
-	Long: `Deletes floating IPs, firewall, and SSH key from Hetzner Cloud,
-then removes the local config (~/.orama/sandbox.yaml) and SSH keys.
-
-Use this when you need to switch datacenter locations (floating IPs are
-location-bound) or to completely start over with sandbox setup.`,
-	RunE: func(cmd *cobra.Command, args []string) error {
-		return sandbox.Reset()
-	},
-}
-
-var sshCmd = &cobra.Command{
-	Use:   "ssh <node-number>",
-	Short: "SSH into a sandbox node (1-5)",
-	Args:  cobra.ExactArgs(1),
-	RunE: func(cmd *cobra.Command, args []string) error {
-		name, _ := cmd.Flags().GetString("name")
-		var nodeNum int
-		if _, err := fmt.Sscanf(args[0], "%d", &nodeNum); err != nil {
-			fmt.Fprintf(os.Stderr, "Invalid node number: %s (expected 1-5)\n", args[0])
-			os.Exit(1)
-		}
-		return sandbox.SSHInto(name, nodeNum)
-	},
-}
-
-func init() {
-	// create flags
-	createCmd.Flags().String("name", "", "Sandbox name (random if not specified)")
-
-	// destroy flags
-	destroyCmd.Flags().String("name", "", "Sandbox name (uses active if not specified)")
-	destroyCmd.Flags().Bool("force", false, "Skip confirmation")
-
-	// status flags
-	statusCmd.Flags().String("name", "", "Sandbox name (uses active if not specified)")
-
-	// rollout flags
-	rolloutCmd.Flags().String("name", "", "Sandbox name (uses active if not specified)")
-	rolloutCmd.Flags().Bool("anyone-client", false, "Enable Anyone client (SOCKS5 proxy) on all nodes")
-
-	// ssh flags
-	sshCmd.Flags().String("name", "", "Sandbox name (uses active if not specified)")
-
-	Cmd.AddCommand(setupCmd)
-	Cmd.AddCommand(createCmd)
-	Cmd.AddCommand(destroyCmd)
-	Cmd.AddCommand(listCmd)
-	Cmd.AddCommand(statusCmd)
-	Cmd.AddCommand(rolloutCmd)
-	Cmd.AddCommand(sshCmd)
-	Cmd.AddCommand(resetCmd)
-}

core/pkg/cli/functions/secrets.go

@@ -1,156 +0,0 @@
-package functions
-
-import (
-	"bufio"
-	"bytes"
-	"encoding/json"
-	"fmt"
-	"io"
-	"os"
-	"strings"
-
-	"github.com/spf13/cobra"
-)
-
-var (
-	secretsDeleteForce bool
-	secretsFromFile    string
-)
-
-// SecretsCmd is the parent command for secrets management.
-var SecretsCmd = &cobra.Command{
-	Use:   "secrets",
-	Short: "Manage function secrets",
-	Long: `Set, list, and delete encrypted secrets for your serverless functions.
-
-Functions access secrets at runtime via the get_secret() host function.
-Secrets are scoped to your namespace and encrypted at rest with AES-256-GCM.
-
-Examples:
-  orama function secrets set API_KEY "sk-abc123"
-  orama function secrets set CERT_PEM --from-file ./cert.pem
-  orama function secrets list
-  orama function secrets delete API_KEY`,
-}
-
-// SecretsSetCmd stores an encrypted secret.
-var SecretsSetCmd = &cobra.Command{
-	Use:   "set <name> [value]",
-	Short: "Set a secret",
-	Long:  `Stores an encrypted secret. Functions access it via get_secret("name"). If --from-file is used, value is read from the file instead.`,
-	Args:  cobra.RangeArgs(1, 2),
-	RunE:  runSecretsSet,
-}
-
-// SecretsListCmd lists secret names.
-var SecretsListCmd = &cobra.Command{
-	Use:   "list",
-	Short: "List secret names",
-	Long:  "Lists all secret names in the current namespace. Values are never shown.",
-	Args:  cobra.NoArgs,
-	RunE:  runSecretsList,
-}
-
-// SecretsDeleteCmd deletes a secret.
-var SecretsDeleteCmd = &cobra.Command{
-	Use:   "delete <name>",
-	Short: "Delete a secret",
-	Long:  "Permanently deletes a secret. Functions will no longer be able to access it.",
-	Args:  cobra.ExactArgs(1),
-	RunE:  runSecretsDelete,
-}
-
-func init() {
-	SecretsCmd.AddCommand(SecretsSetCmd)
-	SecretsCmd.AddCommand(SecretsListCmd)
-	SecretsCmd.AddCommand(SecretsDeleteCmd)
-
-	SecretsSetCmd.Flags().StringVar(&secretsFromFile, "from-file", "", "Read secret value from a file")
-	SecretsDeleteCmd.Flags().BoolVarP(&secretsDeleteForce, "force", "f", false, "Skip confirmation prompt")
-}
-
-func runSecretsSet(cmd *cobra.Command, args []string) error {
-	name := args[0]
-
-	var value string
-	if secretsFromFile != "" {
-		data, err := os.ReadFile(secretsFromFile)
-		if err != nil {
-			return fmt.Errorf("failed to read file %s: %w", secretsFromFile, err)
-		}
-		value = string(data)
-	} else if len(args) >= 2 {
-		value = args[1]
-	} else {
-		return fmt.Errorf("secret value required: provide as argument or use --from-file")
-	}
-
-	body, _ := json.Marshal(map[string]string{
-		"name":  name,
-		"value": value,
-	})
-
-	resp, err := apiRequest("PUT", "/v1/functions/secrets", bytes.NewReader(body), "application/json")
-	if err != nil {
-		return err
-	}
-	defer resp.Body.Close()
-
-	respBody, err := io.ReadAll(resp.Body)
-	if err != nil {
-		return fmt.Errorf("failed to read response: %w", err)
-	}
-
-	if resp.StatusCode != 200 {
-		return fmt.Errorf("API error (%d): %s", resp.StatusCode, string(respBody))
-	}
-
-	fmt.Printf("Secret %q set successfully.\n", name)
-	return nil
-}
-
-func runSecretsList(cmd *cobra.Command, args []string) error {
-	result, err := apiGet("/v1/functions/secrets")
-	if err != nil {
-		return err
-	}
-
-	secrets, _ := result["secrets"].([]interface{})
-	if len(secrets) == 0 {
-		fmt.Println("No secrets found.")
-		return nil
-	}
-
-	fmt.Printf("Secrets (%d):\n", len(secrets))
-	for _, s := range secrets {
-		fmt.Printf("  %s\n", s)
-	}
-	return nil
-}
-
-func runSecretsDelete(cmd *cobra.Command, args []string) error {
-	name := args[0]
-
-	if !secretsDeleteForce {
-		fmt.Printf("Are you sure you want to delete secret %q? [y/N] ", name)
-		reader := bufio.NewReader(os.Stdin)
-		answer, _ := reader.ReadString('\n')
-		answer = strings.TrimSpace(strings.ToLower(answer))
-		if answer != "y" && answer != "yes" {
-			fmt.Println("Cancelled.")
-			return nil
-		}
-	}
-
-	result, err := apiDelete("/v1/functions/secrets/" + name)
-	if err != nil {
-		return err
-	}
-
-	if msg, ok := result["message"]; ok {
-		fmt.Println(msg)
-	} else {
-		fmt.Printf("Secret %q deleted.\n", name)
-	}
-	return nil
-}

core/pkg/cli/functions/triggers.go

@@ -1,151 +0,0 @@
-package functions
-
-import (
-	"bytes"
-	"encoding/json"
-	"fmt"
-	"io"
-	"text/tabwriter"
-
-	"github.com/spf13/cobra"
-)
-
-var triggerTopic string
-
-// TriggersCmd is the parent command for trigger management.
-var TriggersCmd = &cobra.Command{
-	Use:   "triggers",
-	Short: "Manage function PubSub triggers",
-	Long: `Add, list, and delete PubSub triggers for your serverless functions.
-
-When a message is published to a topic, all functions with a trigger on
-that topic are automatically invoked with the message as input.
-
-Examples:
-  orama function triggers add my-function --topic calls:invite
-  orama function triggers list my-function
-  orama function triggers delete my-function <trigger-id>`,
-}
-
-// TriggersAddCmd adds a PubSub trigger to a function.
-var TriggersAddCmd = &cobra.Command{
-	Use:   "add <function-name>",
-	Short: "Add a PubSub trigger",
-	Long:  "Registers a PubSub trigger so the function is invoked when a message is published to the topic.",
-	Args:  cobra.ExactArgs(1),
-	RunE:  runTriggersAdd,
-}
-
-// TriggersListCmd lists triggers for a function.
-var TriggersListCmd = &cobra.Command{
-	Use:   "list <function-name>",
-	Short: "List triggers for a function",
-	Args:  cobra.ExactArgs(1),
-	RunE:  runTriggersList,
-}
-
-// TriggersDeleteCmd deletes a trigger.
-var TriggersDeleteCmd = &cobra.Command{
-	Use:   "delete <function-name> <trigger-id>",
-	Short: "Delete a trigger",
-	Args:  cobra.ExactArgs(2),
-	RunE:  runTriggersDelete,
-}
-
-func init() {
-	TriggersCmd.AddCommand(TriggersAddCmd)
-	TriggersCmd.AddCommand(TriggersListCmd)
-	TriggersCmd.AddCommand(TriggersDeleteCmd)
-
-	TriggersAddCmd.Flags().StringVar(&triggerTopic, "topic", "", "PubSub topic to trigger on (required)")
-	TriggersAddCmd.MarkFlagRequired("topic")
-}
-
-func runTriggersAdd(cmd *cobra.Command, args []string) error {
-	funcName := args[0]
-
-	body, _ := json.Marshal(map[string]string{
-		"topic": triggerTopic,
-	})
-
-	resp, err := apiRequest("POST", "/v1/functions/"+funcName+"/triggers", bytes.NewReader(body), "application/json")
-	if err != nil {
-		return err
-	}
-	defer resp.Body.Close()
-
-	respBody, err := io.ReadAll(resp.Body)
-	if err != nil {
-		return fmt.Errorf("failed to read response: %w", err)
-	}
-
-	if resp.StatusCode != 201 && resp.StatusCode != 200 {
-		return fmt.Errorf("API error (%d): %s", resp.StatusCode, string(respBody))
-	}
-
-	var result map[string]interface{}
-	if err := json.Unmarshal(respBody, &result); err != nil {
-		return fmt.Errorf("failed to parse response: %w", err)
-	}
-
-	fmt.Printf("Trigger added: %s → %s (id: %s)\n", triggerTopic, funcName, result["trigger_id"])
-	return nil
-}
-
-func runTriggersList(cmd *cobra.Command, args []string) error {
-	funcName := args[0]
-
-	result, err := apiGet("/v1/functions/" + funcName + "/triggers")
-	if err != nil {
-		return err
-	}
-
-	triggers, _ := result["triggers"].([]interface{})
-	if len(triggers) == 0 {
-		fmt.Printf("No triggers for function %q.\n", funcName)
-		return nil
-	}
-
-	w := tabwriter.NewWriter(cmd.OutOrStdout(), 0, 0, 2, ' ', 0)
-	fmt.Fprintln(w, "ID\tTOPIC\tENABLED")
-	for _, t := range triggers {
-		tr, ok := t.(map[string]interface{})
-		if !ok {
-			continue
-		}
-		id, _ := tr["ID"].(string)
-		if id == "" {
-			id, _ = tr["id"].(string)
-		}
-		topic, _ := tr["Topic"].(string)
-		if topic == "" {
-			topic, _ = tr["topic"].(string)
-		}
-		enabled := true
-		if e, ok := tr["Enabled"].(bool); ok {
-			enabled = e
-		} else if e, ok := tr["enabled"].(bool); ok {
-			enabled = e
-		}
-		fmt.Fprintf(w, "%s\t%s\t%v\n", id, topic, enabled)
-	}
-	w.Flush()
-	return nil
-}
-
-func runTriggersDelete(cmd *cobra.Command, args []string) error {
-	funcName := args[0]
-	triggerID := args[1]
-
-	result, err := apiDelete("/v1/functions/" + funcName + "/triggers/" + triggerID)
-	if err != nil {
-		return err
-	}
-
-	if msg, ok := result["message"]; ok {
-		fmt.Println(msg)
-	} else {
-		fmt.Println("Trigger deleted.")
-	}
-	return nil
-}

core/pkg/cli/namespace_commands.go

@@ -1,495 +0,0 @@
-package cli
-
-import (
-	"bufio"
-	"crypto/tls"
-	"encoding/json"
-	"flag"
-	"fmt"
-	"net/http"
-	"os"
-	"strings"
-
-	"github.com/DeBrosOfficial/network/pkg/auth"
-	"github.com/DeBrosOfficial/network/pkg/constants"
-)
-
-// HandleNamespaceCommand handles namespace management commands
-func HandleNamespaceCommand(args []string) {
-	if len(args) == 0 {
-		showNamespaceHelp()
-		return
-	}
-
-	subcommand := args[0]
-	switch subcommand {
-	case "delete":
-		var force bool
-		fs := flag.NewFlagSet("namespace delete", flag.ExitOnError)
-		fs.BoolVar(&force, "force", false, "Skip confirmation prompt")
-		_ = fs.Parse(args[1:])
-		handleNamespaceDelete(force)
-	case "list":
-		handleNamespaceList()
-	case "repair":
-		if len(args) < 2 {
-			fmt.Fprintf(os.Stderr, "Usage: orama namespace repair <namespace_name>\n")
-			os.Exit(1)
-		}
-		handleNamespaceRepair(args[1])
-	case "enable":
-		if len(args) < 2 {
-			fmt.Fprintf(os.Stderr, "Usage: orama namespace enable <feature> --namespace <name>\n")
-			fmt.Fprintf(os.Stderr, "Features: webrtc\n")
-			os.Exit(1)
-		}
-		handleNamespaceEnable(args[1:])
-	case "disable":
-		if len(args) < 2 {
-			fmt.Fprintf(os.Stderr, "Usage: orama namespace disable <feature> --namespace <name>\n")
-			fmt.Fprintf(os.Stderr, "Features: webrtc\n")
-			os.Exit(1)
-		}
-		handleNamespaceDisable(args[1:])
-	case "webrtc-status":
-		var ns string
-		fs := flag.NewFlagSet("namespace webrtc-status", flag.ExitOnError)
-		fs.StringVar(&ns, "namespace", "", "Namespace name")
-		_ = fs.Parse(args[1:])
-		if ns == "" {
-			fmt.Fprintf(os.Stderr, "Usage: orama namespace webrtc-status --namespace <name>\n")
-			os.Exit(1)
-		}
-		handleNamespaceWebRTCStatus(ns)
-	case "help":
-		showNamespaceHelp()
-	default:
-		fmt.Fprintf(os.Stderr, "Unknown namespace command: %s\n", subcommand)
-		showNamespaceHelp()
-		os.Exit(1)
-	}
-}
-
-func showNamespaceHelp() {
-	fmt.Printf("Namespace Management Commands\n\n")
-	fmt.Printf("Usage: orama namespace <subcommand>\n\n")
-	fmt.Printf("Subcommands:\n")
-	fmt.Printf("  list                          - List namespaces owned by the current wallet\n")
-	fmt.Printf("  delete                        - Delete the current namespace and all its resources\n")
-	fmt.Printf("  repair <namespace>            - Repair an under-provisioned namespace cluster\n")
-	fmt.Printf("  enable webrtc --namespace NS  - Enable WebRTC (SFU + TURN) for a namespace\n")
-	fmt.Printf("  disable webrtc --namespace NS - Disable WebRTC for a namespace\n")
-	fmt.Printf("  webrtc-status --namespace NS  - Show WebRTC service status\n")
-	fmt.Printf("  help                          - Show this help message\n\n")
-	fmt.Printf("Flags:\n")
-	fmt.Printf("  --force       - Skip confirmation prompt (delete only)\n")
-	fmt.Printf("  --namespace   - Namespace name (enable/disable/webrtc-status)\n\n")
-	fmt.Printf("Examples:\n")
-	fmt.Printf("  orama namespace list\n")
-	fmt.Printf("  orama namespace delete\n")
-	fmt.Printf("  orama namespace delete --force\n")
-	fmt.Printf("  orama namespace repair anchat\n")
-	fmt.Printf("  orama namespace enable webrtc --namespace myapp\n")
-	fmt.Printf("  orama namespace disable webrtc --namespace myapp\n")
-	fmt.Printf("  orama namespace webrtc-status --namespace myapp\n")
-}
-
-func handleNamespaceRepair(namespaceName string) {
-	fmt.Printf("Repairing namespace cluster '%s'...\n", namespaceName)
-
-	// Call the internal repair endpoint on the local gateway
-	url := fmt.Sprintf("http://localhost:%d/v1/internal/namespace/repair?namespace=%s", constants.GatewayAPIPort, namespaceName)
-	req, err := http.NewRequest(http.MethodPost, url, nil)
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "Failed to create request: %v\n", err)
-		os.Exit(1)
-	}
-	req.Header.Set("X-Orama-Internal-Auth", "namespace-coordination")
-
-	client := &http.Client{}
-	resp, err := client.Do(req)
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "Failed to connect to local gateway (is the node running?): %v\n", err)
-		os.Exit(1)
-	}
-	defer resp.Body.Close()
-
-	var result map[string]interface{}
-	json.NewDecoder(resp.Body).Decode(&result)
-
-	if resp.StatusCode != http.StatusOK {
-		errMsg := "unknown error"
-		if e, ok := result["error"].(string); ok {
-			errMsg = e
-		}
-		fmt.Fprintf(os.Stderr, "Repair failed: %s\n", errMsg)
-		os.Exit(1)
-	}
-
-	fmt.Printf("Namespace '%s' cluster repaired successfully.\n", namespaceName)
-	if msg, ok := result["message"].(string); ok {
-		fmt.Printf("  %s\n", msg)
-	}
-}
-
-func handleNamespaceDelete(force bool) {
-	// Load credentials
-	store, err := auth.LoadEnhancedCredentials()
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "Failed to load credentials: %v\n", err)
-		os.Exit(1)
-	}
-
-	gatewayURL := getGatewayURL()
-	creds := store.GetDefaultCredential(gatewayURL)
-
-	if creds == nil || !creds.IsValid() {
-		fmt.Fprintf(os.Stderr, "Not authenticated. Run 'orama auth login' first.\n")
-		os.Exit(1)
-	}
-
-	namespace := creds.Namespace
-	if namespace == "" || namespace == "default" {
-		fmt.Fprintf(os.Stderr, "Cannot delete default namespace.\n")
-		os.Exit(1)
-	}
-
-	// Confirm deletion
-	if !force {
-		fmt.Printf("This will permanently delete namespace '%s' and all its resources:\n", namespace)
-		fmt.Printf("  - All deployments and their processes\n")
-		fmt.Printf("  - RQLite cluster (3 nodes)\n")
-		fmt.Printf("  - Olric cache cluster (3 nodes)\n")
-		fmt.Printf("  - Gateway instances\n")
-		fmt.Printf("  - API keys and credentials\n")
-		fmt.Printf("  - IPFS content and DNS records\n\n")
-		fmt.Printf("Type the namespace name to confirm: ")
-
-		scanner := bufio.NewScanner(os.Stdin)
-		scanner.Scan()
-		input := strings.TrimSpace(scanner.Text())
-
-		if input != namespace {
-			fmt.Println("Aborted - namespace name did not match.")
-			os.Exit(1)
-		}
-	}
-
-	fmt.Printf("Deleting namespace '%s'...\n", namespace)
-
-	// Make DELETE request to gateway
-	url := fmt.Sprintf("%s/v1/namespace/delete", gatewayURL)
-	req, err := http.NewRequest(http.MethodDelete, url, nil)
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "Failed to create request: %v\n", err)
-		os.Exit(1)
-	}
-	req.Header.Set("Authorization", "Bearer "+creds.APIKey)
-
-	client := &http.Client{
-		Transport: &http.Transport{
-			TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
-		},
-	}
-	resp, err := client.Do(req)
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "Failed to connect to gateway: %v\n", err)
-		os.Exit(1)
-	}
-	defer resp.Body.Close()
-
-	var result map[string]interface{}
-	json.NewDecoder(resp.Body).Decode(&result)
-
-	if resp.StatusCode != http.StatusOK {
-		errMsg := "unknown error"
-		if e, ok := result["error"].(string); ok {
-			errMsg = e
-		}
-		fmt.Fprintf(os.Stderr, "Failed to delete namespace: %s\n", errMsg)
-		os.Exit(1)
-	}
-
-	fmt.Printf("Namespace '%s' deleted successfully.\n", namespace)
-
-	// Clean up local credentials for the deleted namespace
-	if store.RemoveCredentialByNamespace(gatewayURL, namespace) {
-		if err := store.Save(); err != nil {
-			fmt.Fprintf(os.Stderr, "Warning: failed to clean up local credentials: %v\n", err)
-		} else {
-			fmt.Printf("Local credentials for '%s' cleared.\n", namespace)
-		}
-	}
-
-	fmt.Printf("Run 'orama auth login' to create a new namespace.\n")
-}
-
-func handleNamespaceEnable(args []string) {
-	feature := args[0]
-	if feature != "webrtc" {
-		fmt.Fprintf(os.Stderr, "Unknown feature: %s\nSupported features: webrtc\n", feature)
-		os.Exit(1)
-	}
-
-	var ns string
-	fs := flag.NewFlagSet("namespace enable webrtc", flag.ExitOnError)
-	fs.StringVar(&ns, "namespace", "", "Namespace name")
-	_ = fs.Parse(args[1:])
-
-	if ns == "" {
-		fmt.Fprintf(os.Stderr, "Usage: orama namespace enable webrtc --namespace <name>\n")
-		os.Exit(1)
-	}
-
-	gatewayURL, apiKey := loadAuthForNamespace(ns)
-
-	fmt.Printf("Enabling WebRTC for namespace '%s'...\n", ns)
-	fmt.Printf("This will provision SFU (3 nodes) and TURN (2 nodes) services.\n")
-
-	url := fmt.Sprintf("%s/v1/namespace/webrtc/enable", gatewayURL)
-	req, err := http.NewRequest(http.MethodPost, url, nil)
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "Failed to create request: %v\n", err)
-		os.Exit(1)
-	}
-	req.Header.Set("Authorization", "Bearer "+apiKey)
-
-	client := &http.Client{
-		Transport: &http.Transport{
-			TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
-		},
-	}
-	resp, err := client.Do(req)
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "Failed to connect to gateway: %v\n", err)
-		os.Exit(1)
-	}
-	defer resp.Body.Close()
-
-	var result map[string]interface{}
-	json.NewDecoder(resp.Body).Decode(&result)
-
-	if resp.StatusCode != http.StatusOK {
-		errMsg := "unknown error"
-		if e, ok := result["error"].(string); ok {
-			errMsg = e
-		}
-		fmt.Fprintf(os.Stderr, "Failed to enable WebRTC: %s\n", errMsg)
-		os.Exit(1)
-	}
-
-	fmt.Printf("WebRTC enabled for namespace '%s'.\n", ns)
-	fmt.Printf("  SFU instances: 3 nodes (signaling via WireGuard)\n")
-	fmt.Printf("  TURN instances: 2 nodes (relay on public IPs)\n")
-}
-
-func handleNamespaceDisable(args []string) {
-	feature := args[0]
-	if feature != "webrtc" {
-		fmt.Fprintf(os.Stderr, "Unknown feature: %s\nSupported features: webrtc\n", feature)
-		os.Exit(1)
-	}
-
-	var ns string
-	fs := flag.NewFlagSet("namespace disable webrtc", flag.ExitOnError)
-	fs.StringVar(&ns, "namespace", "", "Namespace name")
-	_ = fs.Parse(args[1:])
-
-	if ns == "" {
-		fmt.Fprintf(os.Stderr, "Usage: orama namespace disable webrtc --namespace <name>\n")
-		os.Exit(1)
-	}
-
-	gatewayURL, apiKey := loadAuthForNamespace(ns)
-
-	fmt.Printf("Disabling WebRTC for namespace '%s'...\n", ns)
-
-	url := fmt.Sprintf("%s/v1/namespace/webrtc/disable", gatewayURL)
-	req, err := http.NewRequest(http.MethodPost, url, nil)
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "Failed to create request: %v\n", err)
-		os.Exit(1)
-	}
-	req.Header.Set("Authorization", "Bearer "+apiKey)
-
-	client := &http.Client{
-		Transport: &http.Transport{
-			TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
-		},
-	}
-	resp, err := client.Do(req)
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "Failed to connect to gateway: %v\n", err)
-		os.Exit(1)
-	}
-	defer resp.Body.Close()
-
-	var result map[string]interface{}
-	json.NewDecoder(resp.Body).Decode(&result)
-
-	if resp.StatusCode != http.StatusOK {
-		errMsg := "unknown error"
-		if e, ok := result["error"].(string); ok {
-			errMsg = e
-		}
-		fmt.Fprintf(os.Stderr, "Failed to disable WebRTC: %s\n", errMsg)
-		os.Exit(1)
-	}
-
-	fmt.Printf("WebRTC disabled for namespace '%s'.\n", ns)
-	fmt.Printf("  SFU and TURN services stopped, ports deallocated, DNS records removed.\n")
-}
-
-func handleNamespaceWebRTCStatus(ns string) {
-	gatewayURL, apiKey := loadAuthForNamespace(ns)
-
-	url := fmt.Sprintf("%s/v1/namespace/webrtc/status", gatewayURL)
-	req, err := http.NewRequest(http.MethodGet, url, nil)
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "Failed to create request: %v\n", err)
-		os.Exit(1)
-	}
-	req.Header.Set("Authorization", "Bearer "+apiKey)
-
-	client := &http.Client{
-		Transport: &http.Transport{
-			TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
-		},
-	}
-	resp, err := client.Do(req)
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "Failed to connect to gateway: %v\n", err)
-		os.Exit(1)
-	}
-	defer resp.Body.Close()
-
-	var result map[string]interface{}
-	json.NewDecoder(resp.Body).Decode(&result)
-
-	if resp.StatusCode != http.StatusOK {
-		errMsg := "unknown error"
-		if e, ok := result["error"].(string); ok {
-			errMsg = e
-		}
-		fmt.Fprintf(os.Stderr, "Failed to get WebRTC status: %s\n", errMsg)
-		os.Exit(1)
-	}
-
-	enabled, _ := result["enabled"].(bool)
-	if !enabled {
-		fmt.Printf("WebRTC is not enabled for namespace '%s'.\n", ns)
-		fmt.Printf("  Enable with: orama namespace enable webrtc --namespace %s\n", ns)
-		return
-	}
-
-	fmt.Printf("WebRTC Status for namespace '%s'\n\n", ns)
-	fmt.Printf("  Enabled:          yes\n")
-	if sfuCount, ok := result["sfu_node_count"].(float64); ok {
-		fmt.Printf("  SFU nodes:        %.0f\n", sfuCount)
-	}
-	if turnCount, ok := result["turn_node_count"].(float64); ok {
-		fmt.Printf("  TURN nodes:       %.0f\n", turnCount)
-	}
-	if ttl, ok := result["turn_credential_ttl"].(float64); ok {
-		fmt.Printf("  TURN cred TTL:    %.0fs\n", ttl)
-	}
-	if enabledBy, ok := result["enabled_by"].(string); ok {
-		fmt.Printf("  Enabled by:       %s\n", enabledBy)
-	}
-	if enabledAt, ok := result["enabled_at"].(string); ok {
-		fmt.Printf("  Enabled at:       %s\n", enabledAt)
-	}
-}
-
-// loadAuthForNamespace loads credentials and returns the gateway URL and API key.
-// Exits with an error message if not authenticated.
-func loadAuthForNamespace(ns string) (gatewayURL, apiKey string) {
-	store, err := auth.LoadEnhancedCredentials()
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "Failed to load credentials: %v\n", err)
-		os.Exit(1)
-	}
-
-	gatewayURL = getGatewayURL()
-	creds := store.GetDefaultCredential(gatewayURL)
-
-	if creds == nil || !creds.IsValid() {
-		fmt.Fprintf(os.Stderr, "Not authenticated. Run 'orama auth login' first.\n")
-		os.Exit(1)
-	}
-
-	return gatewayURL, creds.APIKey
-}
-
-func handleNamespaceList() {
-	// Load credentials
-	store, err := auth.LoadEnhancedCredentials()
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "Failed to load credentials: %v\n", err)
-		os.Exit(1)
-	}
-
-	gatewayURL := getGatewayURL()
-	creds := store.GetDefaultCredential(gatewayURL)
-
-	if creds == nil || !creds.IsValid() {
-		fmt.Fprintf(os.Stderr, "Not authenticated. Run 'orama auth login' first.\n")
-		os.Exit(1)
-	}
-
-	// Make GET request to namespace list endpoint
-	url := fmt.Sprintf("%s/v1/namespace/list", gatewayURL)
-	req, err := http.NewRequest(http.MethodGet, url, nil)
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "Failed to create request: %v\n", err)
-		os.Exit(1)
-	}
-	req.Header.Set("Authorization", "Bearer "+creds.APIKey)
-
-	client := &http.Client{
-		Transport: &http.Transport{
-			TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
-		},
-	}
-	resp, err := client.Do(req)
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "Failed to connect to gateway: %v\n", err)
-		os.Exit(1)
-	}
-	defer resp.Body.Close()
-
-	var result map[string]interface{}
-	json.NewDecoder(resp.Body).Decode(&result)
-
-	if resp.StatusCode != http.StatusOK {
-		errMsg := "unknown error"
-		if e, ok := result["error"].(string); ok {
-			errMsg = e
-		}
-		fmt.Fprintf(os.Stderr, "Failed to list namespaces: %s\n", errMsg)
-		os.Exit(1)
-	}
-
-	namespaces, _ := result["namespaces"].([]interface{})
-	if len(namespaces) == 0 {
-		fmt.Println("No namespaces found.")
-		return
-	}
-
-	activeNS := creds.Namespace
-
-	fmt.Printf("Namespaces (%d):\n\n", len(namespaces))
-	for _, ns := range namespaces {
-		nsMap, _ := ns.(map[string]interface{})
-		name, _ := nsMap["name"].(string)
-		status, _ := nsMap["cluster_status"].(string)
-
-		marker := "  "
-		if name == activeNS {
-			marker = "* "
-		}
-
-		fmt.Printf("%s%-20s  cluster: %s\n", marker, name, status)
-	}
-	fmt.Printf("\n* = active namespace\n")
-}

core/pkg/cli/production/clean/clean.go

@@ -1,189 +0,0 @@
-package clean
-
-import (
-	"bufio"
-	"flag"
-	"fmt"
-	"os"
-	"strings"
-
-	"github.com/DeBrosOfficial/network/pkg/cli/remotessh"
-	"github.com/DeBrosOfficial/network/pkg/inspector"
-)
-
-// Flags holds clean command flags.
-type Flags struct {
-	Env     string // Target environment
-	Node    string // Single node IP
-	Nuclear bool   // Also remove shared binaries
-	Force   bool   // Skip confirmation
-}
-
-// Handle is the entry point for the clean command.
-func Handle(args []string) {
-	flags, err := parseFlags(args)
-	if err != nil {
-		if err == flag.ErrHelp {
-			return
-		}
-		fmt.Fprintf(os.Stderr, "Error: %v\n", err)
-		os.Exit(1)
-	}
-
-	if err := execute(flags); err != nil {
-		fmt.Fprintf(os.Stderr, "Error: %v\n", err)
-		os.Exit(1)
-	}
-}
-
-func parseFlags(args []string) (*Flags, error) {
-	fs := flag.NewFlagSet("clean", flag.ContinueOnError)
-	fs.SetOutput(os.Stderr)
-
-	flags := &Flags{}
-	fs.StringVar(&flags.Env, "env", "", "Target environment (devnet, testnet) [required]")
-	fs.StringVar(&flags.Node, "node", "", "Clean a single node IP only")
-	fs.BoolVar(&flags.Nuclear, "nuclear", false, "Also remove shared binaries (rqlited, ipfs, caddy, etc.)")
-	fs.BoolVar(&flags.Force, "force", false, "Skip confirmation (DESTRUCTIVE)")
-
-	if err := fs.Parse(args); err != nil {
-		return nil, err
-	}
-
-	if flags.Env == "" {
-		return nil, fmt.Errorf("--env is required\nUsage: orama node clean --env <devnet|testnet> --force")
-	}
-
-	return flags, nil
-}
-
-func execute(flags *Flags) error {
-	nodes, err := remotessh.LoadEnvNodes(flags.Env)
-	if err != nil {
-		return err
-	}
-
-	cleanup, err := remotessh.PrepareNodeKeys(nodes)
-	if err != nil {
-		return err
-	}
-	defer cleanup()
-
-	if flags.Node != "" {
-		nodes = remotessh.FilterByIP(nodes, flags.Node)
-		if len(nodes) == 0 {
-			return fmt.Errorf("node %s not found in %s environment", flags.Node, flags.Env)
-		}
-	}
-
-	fmt.Printf("Clean %s: %d node(s)\n", flags.Env, len(nodes))
-	if flags.Nuclear {
-		fmt.Printf("  Mode: NUCLEAR (removes binaries too)\n")
-	}
-	for _, n := range nodes {
-		fmt.Printf("  - %s (%s)\n", n.Host, n.Role)
-	}
-	fmt.Println()
-
-	// Confirm unless --force
-	if !flags.Force {
-		fmt.Printf("This will DESTROY all data on these nodes. Anyone relay keys are preserved.\n")
-		fmt.Printf("Type 'yes' to confirm: ")
-		reader := bufio.NewReader(os.Stdin)
-		input, _ := reader.ReadString('\n')
-		if strings.TrimSpace(input) != "yes" {
-			fmt.Println("Aborted.")
-			return nil
-		}
-		fmt.Println()
-	}
-
-	// Clean each node
-	var failed []string
-	for i, node := range nodes {
-		fmt.Printf("[%d/%d] Cleaning %s...\n", i+1, len(nodes), node.Host)
-		if err := cleanNode(node, flags.Nuclear); err != nil {
-			fmt.Fprintf(os.Stderr, "  ✗ %s: %v\n", node.Host, err)
-			failed = append(failed, node.Host)
-			continue
-		}
-		fmt.Printf("  ✓ %s cleaned\n\n", node.Host)
-	}
-
-	if len(failed) > 0 {
-		return fmt.Errorf("clean failed on %d node(s): %s", len(failed), strings.Join(failed, ", "))
-	}
-
-	fmt.Printf("✓ Clean complete (%d nodes)\n", len(nodes))
-	fmt.Printf("  Anyone relay keys preserved at /var/lib/anon/\n")
-	fmt.Printf("  To reinstall: orama node install --vps-ip <ip> ...\n")
-	return nil
-}
-
-func cleanNode(node inspector.Node, nuclear bool) error {
-	sudo := remotessh.SudoPrefix(node)
-
-	nuclearFlag := ""
-	if nuclear {
-		nuclearFlag = "NUCLEAR=1"
-	}
-
-	// The cleanup script runs on the remote node
-	script := fmt.Sprintf(`%sbash -c '
-%s
-
-# Stop services
-for svc in caddy coredns orama-node orama-gateway orama-ipfs-cluster orama-ipfs orama-olric orama-anyone-relay orama-anyone-client; do
-    systemctl stop "$svc" 2>/dev/null
-    systemctl disable "$svc" 2>/dev/null
-done
-
-# Kill stragglers
-pkill -9 -f "orama-node" 2>/dev/null || true
-pkill -9 -f "olric-server" 2>/dev/null || true
-pkill -9 -f "ipfs" 2>/dev/null || true
-
-# Remove systemd units
-rm -f /etc/systemd/system/orama-*.service
-rm -f /etc/systemd/system/coredns.service
-rm -f /etc/systemd/system/caddy.service
-systemctl daemon-reload 2>/dev/null
-
-# Tear down WireGuard
-ip link delete wg0 2>/dev/null || true
-rm -f /etc/wireguard/wg0.conf
-
-# Reset firewall
-ufw --force reset 2>/dev/null || true
-ufw default deny incoming 2>/dev/null || true
-ufw default allow outgoing 2>/dev/null || true
-ufw allow 22/tcp 2>/dev/null || true
-ufw --force enable 2>/dev/null || true
-
-# Remove data
-rm -rf /opt/orama
-
-# Clean configs
-rm -rf /etc/coredns
-rm -rf /etc/caddy
-rm -f /tmp/orama-*.sh /tmp/network-source.tar.gz /tmp/orama-*.tar.gz
-
-# Nuclear: remove binaries
-if [ -n "$NUCLEAR" ]; then
-    rm -f /usr/local/bin/orama /usr/local/bin/orama-node /usr/local/bin/gateway
-    rm -f /usr/local/bin/identity /usr/local/bin/sfu /usr/local/bin/turn
-    rm -f /usr/local/bin/olric-server /usr/local/bin/ipfs /usr/local/bin/ipfs-cluster-service
-    rm -f /usr/local/bin/rqlited /usr/local/bin/coredns
-    rm -f /usr/bin/caddy
-fi
-
-# Verify Anyone keys preserved
-if [ -d /var/lib/anon ]; then
-    echo "  Anyone relay keys preserved at /var/lib/anon/"
-fi
-
-echo "  Node cleaned successfully"
-'`, sudo, nuclearFlag)
-
-	return remotessh.RunSSHStreaming(node, script)
-}

core/pkg/cli/production/enroll/command.go

@@ -1,123 +0,0 @@
-// Package enroll implements the OramaOS node enrollment command.
-//
-// Flow:
-//  1. Operator fetches registration code from the OramaOS node (port 9999)
-//  2. Operator provides code + invite token to Gateway
-//  3. Gateway validates, generates cluster config, pushes to node
-//  4. Node configures WireGuard, encrypts data partition, starts services
-package enroll
-
-import (
-	"bytes"
-	"encoding/json"
-	"fmt"
-	"io"
-	"net/http"
-	"os"
-	"time"
-)
-
-// Handle processes the enroll command.
-func Handle(args []string) {
-	flags, err := ParseFlags(args)
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "Error: %v\n", err)
-		os.Exit(1)
-	}
-
-	// Step 1: Fetch registration code from the OramaOS node
-	fmt.Printf("Fetching registration code from %s:9999...\n", flags.NodeIP)
-
-	var code string
-	if flags.Code != "" {
-		// Code provided directly — skip fetch
-		code = flags.Code
-	} else {
-		fetchedCode, err := fetchRegistrationCode(flags.NodeIP)
-		if err != nil {
-			fmt.Fprintf(os.Stderr, "Error: could not reach OramaOS node: %v\n", err)
-			fmt.Fprintf(os.Stderr, "Make sure the node is booted and port 9999 is reachable.\n")
-			os.Exit(1)
-		}
-		code = fetchedCode
-	}
-
-	fmt.Printf("Registration code: %s\n", code)
-
-	// Step 2: Send enrollment request to the Gateway
-	fmt.Printf("Sending enrollment to Gateway at %s...\n", flags.GatewayURL)
-
-	if err := enrollWithGateway(flags.GatewayURL, flags.Token, code, flags.NodeIP); err != nil {
-		fmt.Fprintf(os.Stderr, "Error: enrollment failed: %v\n", err)
-		os.Exit(1)
-	}
-
-	fmt.Printf("Node %s enrolled successfully.\n", flags.NodeIP)
-	fmt.Printf("The node is now configuring WireGuard and encrypting its data partition.\n")
-	fmt.Printf("This may take a few minutes. Check status with: orama node status --env %s\n", flags.Env)
-}
-
-// fetchRegistrationCode retrieves the one-time registration code from the OramaOS node.
-func fetchRegistrationCode(nodeIP string) (string, error) {
-	client := &http.Client{Timeout: 10 * time.Second}
-	resp, err := client.Get(fmt.Sprintf("http://%s:9999/", nodeIP))
-	if err != nil {
-		return "", fmt.Errorf("GET failed: %w", err)
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode == http.StatusGone {
-		return "", fmt.Errorf("registration code already served (node may be partially enrolled)")
-	}
-	if resp.StatusCode != http.StatusOK {
-		return "", fmt.Errorf("unexpected status %d", resp.StatusCode)
-	}
-
-	var result struct {
-		Code    string `json:"code"`
-		Expires string `json:"expires"`
-	}
-	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
-		return "", fmt.Errorf("invalid response: %w", err)
-	}
-
-	return result.Code, nil
-}
-
-// enrollWithGateway sends the enrollment request to the Gateway, which validates
-// the code and token, then pushes cluster configuration to the OramaOS node.
-func enrollWithGateway(gatewayURL, token, code, nodeIP string) error {
-	body, _ := json.Marshal(map[string]string{
-		"code":    code,
-		"token":   token,
-		"node_ip": nodeIP,
-	})
-
-	req, err := http.NewRequest("POST", gatewayURL+"/v1/node/enroll", bytes.NewReader(body))
-	if err != nil {
-		return err
-	}
-	req.Header.Set("Content-Type", "application/json")
-	req.Header.Set("Authorization", "Bearer "+token)
-
-	client := &http.Client{Timeout: 60 * time.Second}
-	resp, err := client.Do(req)
-	if err != nil {
-		return fmt.Errorf("request failed: %w", err)
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode == http.StatusUnauthorized {
-		return fmt.Errorf("invalid or expired invite token")
-	}
-	if resp.StatusCode == http.StatusBadRequest {
-		respBody, _ := io.ReadAll(resp.Body)
-		return fmt.Errorf("bad request: %s", string(respBody))
-	}
-	if resp.StatusCode != http.StatusOK {
-		respBody, _ := io.ReadAll(resp.Body)
-		return fmt.Errorf("gateway returned %d: %s", resp.StatusCode, string(respBody))
-	}
-
-	return nil
-}

core/pkg/cli/production/enroll/flags.go

@@ -1,46 +0,0 @@
-package enroll
-
-import (
-	"flag"
-	"fmt"
-	"os"
-)
-
-// Flags holds the parsed command-line flags for the enroll command.
-type Flags struct {
-	NodeIP     string // Public IP of the OramaOS node
-	Code       string // Registration code (optional — fetched automatically if not provided)
-	Token      string // Invite token for cluster joining
-	GatewayURL string // Gateway HTTPS URL
-	Env        string // Environment name (for display only)
-}
-
-// ParseFlags parses the enroll command flags.
-func ParseFlags(args []string) (*Flags, error) {
-	fs := flag.NewFlagSet("enroll", flag.ContinueOnError)
-	fs.SetOutput(os.Stderr)
-
-	flags := &Flags{}
-
-	fs.StringVar(&flags.NodeIP, "node-ip", "", "Public IP of the OramaOS node (required)")
-	fs.StringVar(&flags.Code, "code", "", "Registration code from the node (auto-fetched if not provided)")
-	fs.StringVar(&flags.Token, "token", "", "Invite token for cluster joining (required)")
-	fs.StringVar(&flags.GatewayURL, "gateway", "", "Gateway URL (required, e.g. https://gateway.example.com)")
-	fs.StringVar(&flags.Env, "env", "production", "Environment name")
-
-	if err := fs.Parse(args); err != nil {
-		return nil, err
-	}
-
-	if flags.NodeIP == "" {
-		return nil, fmt.Errorf("--node-ip is required")
-	}
-	if flags.Token == "" {
-		return nil, fmt.Errorf("--token is required")
-	}
-	if flags.GatewayURL == "" {
-		return nil, fmt.Errorf("--gateway is required")
-	}
-
-	return flags, nil
-}

core/pkg/cli/production/push/push.go

@@ -1,261 +0,0 @@
-package push
-
-import (
-	"flag"
-	"fmt"
-	"os"
-	"path/filepath"
-	"strings"
-	"sync"
-
-	"github.com/DeBrosOfficial/network/pkg/cli/remotessh"
-	"github.com/DeBrosOfficial/network/pkg/inspector"
-)
-
-// Flags holds push command flags.
-type Flags struct {
-	Env    string // Target environment (devnet, testnet)
-	Node   string // Single node IP (optional)
-	Direct bool   // Sequential upload to each node (no fanout)
-}
-
-// Handle is the entry point for the push command.
-func Handle(args []string) {
-	flags, err := parseFlags(args)
-	if err != nil {
-		if err == flag.ErrHelp {
-			return
-		}
-		fmt.Fprintf(os.Stderr, "Error: %v\n", err)
-		os.Exit(1)
-	}
-
-	if err := execute(flags); err != nil {
-		fmt.Fprintf(os.Stderr, "Error: %v\n", err)
-		os.Exit(1)
-	}
-}
-
-func parseFlags(args []string) (*Flags, error) {
-	fs := flag.NewFlagSet("push", flag.ContinueOnError)
-	fs.SetOutput(os.Stderr)
-
-	flags := &Flags{}
-	fs.StringVar(&flags.Env, "env", "", "Target environment (devnet, testnet) [required]")
-	fs.StringVar(&flags.Node, "node", "", "Push to a single node IP only")
-	fs.BoolVar(&flags.Direct, "direct", false, "Upload directly to each node (no hub fanout)")
-
-	if err := fs.Parse(args); err != nil {
-		return nil, err
-	}
-
-	if flags.Env == "" {
-		return nil, fmt.Errorf("--env is required\nUsage: orama node push --env <devnet|testnet>")
-	}
-
-	return flags, nil
-}
-
-func execute(flags *Flags) error {
-	// Find archive
-	archivePath := findNewestArchive()
-	if archivePath == "" {
-		return fmt.Errorf("no binary archive found in /tmp/ (run `orama build` first)")
-	}
-
-	info, _ := os.Stat(archivePath)
-	fmt.Printf("Archive: %s (%s)\n", filepath.Base(archivePath), formatBytes(info.Size()))
-
-	// Resolve nodes
-	nodes, err := remotessh.LoadEnvNodes(flags.Env)
-	if err != nil {
-		return err
-	}
-
-	// Prepare wallet-derived SSH keys
-	cleanup, err := remotessh.PrepareNodeKeys(nodes)
-	if err != nil {
-		return err
-	}
-	defer cleanup()
-
-	// Filter to single node if specified
-	if flags.Node != "" {
-		nodes = remotessh.FilterByIP(nodes, flags.Node)
-		if len(nodes) == 0 {
-			return fmt.Errorf("node %s not found in %s environment", flags.Node, flags.Env)
-		}
-	}
-
-	fmt.Printf("Environment: %s (%d nodes)\n\n", flags.Env, len(nodes))
-
-	if flags.Direct || len(nodes) == 1 {
-		return pushDirect(archivePath, nodes)
-	}
-
-	// Load keys into ssh-agent for fanout forwarding
-	if err := remotessh.LoadAgentKeys(nodes); err != nil {
-		return fmt.Errorf("load agent keys for fanout: %w", err)
-	}
-
-	return pushFanout(archivePath, nodes)
-}
-
-// pushDirect uploads the archive to each node sequentially.
-func pushDirect(archivePath string, nodes []inspector.Node) error {
-	remotePath := "/tmp/" + filepath.Base(archivePath)
-
-	for i, node := range nodes {
-		fmt.Printf("[%d/%d] Pushing to %s...\n", i+1, len(nodes), node.Host)
-
-		if err := remotessh.UploadFile(node, archivePath, remotePath); err != nil {
-			return fmt.Errorf("upload to %s failed: %w", node.Host, err)
-		}
-
-		if err := extractOnNode(node, remotePath); err != nil {
-			return fmt.Errorf("extract on %s failed: %w", node.Host, err)
-		}
-
-		fmt.Printf("  ✓ %s done\n\n", node.Host)
-	}
-
-	fmt.Printf("✓ Push complete (%d nodes)\n", len(nodes))
-	return nil
-}
-
-// pushFanout uploads to a hub node, then fans out to all others via agent forwarding.
-func pushFanout(archivePath string, nodes []inspector.Node) error {
-	hub := remotessh.PickHubNode(nodes)
-	remotePath := "/tmp/" + filepath.Base(archivePath)
-
-	// Step 1: Upload to hub
-	fmt.Printf("[hub] Uploading to %s...\n", hub.Host)
-	if err := remotessh.UploadFile(hub, archivePath, remotePath); err != nil {
-		return fmt.Errorf("upload to hub %s failed: %w", hub.Host, err)
-	}
-
-	if err := extractOnNode(hub, remotePath); err != nil {
-		return fmt.Errorf("extract on hub %s failed: %w", hub.Host, err)
-	}
-	fmt.Printf("  ✓ hub %s done\n\n", hub.Host)
-
-	// Step 2: Fan out from hub to remaining nodes in parallel (via agent forwarding)
-	remaining := make([]inspector.Node, 0, len(nodes)-1)
-	for _, n := range nodes {
-		if n.Host != hub.Host {
-			remaining = append(remaining, n)
-		}
-	}
-
-	if len(remaining) == 0 {
-		fmt.Printf("✓ Push complete (1 node)\n")
-		return nil
-	}
-
-	fmt.Printf("[fanout] Distributing from %s to %d nodes...\n", hub.Host, len(remaining))
-
-	var wg sync.WaitGroup
-	errors := make([]error, len(remaining))
-
-	for i, target := range remaining {
-		wg.Add(1)
-		go func(idx int, target inspector.Node) {
-			defer wg.Done()
-
-			// SCP from hub to target (agent forwarding serves the key)
-			scpCmd := fmt.Sprintf("scp -o StrictHostKeyChecking=accept-new -o ConnectTimeout=10 %s %s@%s:%s",
-				remotePath, target.User, target.Host, remotePath)
-
-			if err := remotessh.RunSSHStreaming(hub, scpCmd, remotessh.WithAgentForward()); err != nil {
-				errors[idx] = fmt.Errorf("fanout to %s failed: %w", target.Host, err)
-				return
-			}
-
-			if err := extractOnNodeVia(hub, target, remotePath); err != nil {
-				errors[idx] = fmt.Errorf("extract on %s failed: %w", target.Host, err)
-				return
-			}
-
-			fmt.Printf("  ✓ %s done\n", target.Host)
-		}(i, target)
-	}
-
-	wg.Wait()
-
-	// Check for errors
-	var failed []string
-	for i, err := range errors {
-		if err != nil {
-			fmt.Fprintf(os.Stderr, "  ✗ %s: %v\n", remaining[i].Host, err)
-			failed = append(failed, remaining[i].Host)
-		}
-	}
-
-	if len(failed) > 0 {
-		return fmt.Errorf("push failed on %d node(s): %s", len(failed), strings.Join(failed, ", "))
-	}
-
-	fmt.Printf("\n✓ Push complete (%d nodes)\n", len(nodes))
-	return nil
-}
-
-// extractOnNode extracts the archive on a remote node.
-func extractOnNode(node inspector.Node, remotePath string) error {
-	sudo := remotessh.SudoPrefix(node)
-	cmd := fmt.Sprintf("%smkdir -p /opt/orama && %star xzf %s -C /opt/orama && %srm -f %s",
-		sudo, sudo, remotePath, sudo, remotePath)
-	return remotessh.RunSSHStreaming(node, cmd)
-}
-
-// extractOnNodeVia extracts the archive on a target node by SSHing through the hub.
-// Uses agent forwarding so the hub can authenticate to the target.
-func extractOnNodeVia(hub, target inspector.Node, remotePath string) error {
-	sudo := remotessh.SudoPrefix(target)
-	extractCmd := fmt.Sprintf("%smkdir -p /opt/orama && %star xzf %s -C /opt/orama && %srm -f %s",
-		sudo, sudo, remotePath, sudo, remotePath)
-
-	// SSH from hub to target to extract (agent forwarding serves the key)
-	sshCmd := fmt.Sprintf("ssh -o StrictHostKeyChecking=accept-new -o ConnectTimeout=10 %s@%s '%s'",
-		target.User, target.Host, extractCmd)
-
-	return remotessh.RunSSHStreaming(hub, sshCmd, remotessh.WithAgentForward())
-}
-
-// findNewestArchive finds the newest binary archive in /tmp/.
-func findNewestArchive() string {
-	entries, err := os.ReadDir("/tmp")
-	if err != nil {
-		return ""
-	}
-
-	var best string
-	var bestMod int64
-	for _, entry := range entries {
-		name := entry.Name()
-		if strings.HasPrefix(name, "orama-") && strings.Contains(name, "-linux-") && strings.HasSuffix(name, ".tar.gz") {
-			info, err := entry.Info()
-			if err != nil {
-				continue
-			}
-			if info.ModTime().Unix() > bestMod {
-				best = filepath.Join("/tmp", name)
-				bestMod = info.ModTime().Unix()
-			}
-		}
-	}
-
-	return best
-}
-
-func formatBytes(b int64) string {
-	const unit = 1024
-	if b < unit {
-		return fmt.Sprintf("%d B", b)
-	}
-	div, exp := int64(unit), 0
-	for n := b / unit; n >= unit; n /= unit {
-		div *= unit
-		exp++
-	}
-	return fmt.Sprintf("%.1f %cB", float64(b)/float64(div), "KMGTPE"[exp])
-}

core/pkg/cli/production/recover/recover.go

@@ -1,312 +0,0 @@
-package recover
-
-import (
-	"bufio"
-	"flag"
-	"fmt"
-	"os"
-	"strings"
-	"time"
-
-	"github.com/DeBrosOfficial/network/pkg/cli/remotessh"
-	"github.com/DeBrosOfficial/network/pkg/inspector"
-)
-
-// Flags holds recover-raft command flags.
-type Flags struct {
-	Env    string // Target environment
-	Leader string // Leader node IP (highest commit index)
-	Force  bool   // Skip confirmation
-}
-
-const (
-	raftDir   = "/opt/orama/.orama/data/rqlite/raft"
-	backupDir = "/tmp/rqlite-raft-backup"
-)
-
-// Handle is the entry point for the recover-raft command.
-func Handle(args []string) {
-	flags, err := parseFlags(args)
-	if err != nil {
-		if err == flag.ErrHelp {
-			return
-		}
-		fmt.Fprintf(os.Stderr, "Error: %v\n", err)
-		os.Exit(1)
-	}
-
-	if err := execute(flags); err != nil {
-		fmt.Fprintf(os.Stderr, "Error: %v\n", err)
-		os.Exit(1)
-	}
-}
-
-func parseFlags(args []string) (*Flags, error) {
-	fs := flag.NewFlagSet("recover-raft", flag.ContinueOnError)
-	fs.SetOutput(os.Stderr)
-
-	flags := &Flags{}
-	fs.StringVar(&flags.Env, "env", "", "Target environment (devnet, testnet) [required]")
-	fs.StringVar(&flags.Leader, "leader", "", "Leader node IP (node with highest commit index) [required]")
-	fs.BoolVar(&flags.Force, "force", false, "Skip confirmation (DESTRUCTIVE)")
-
-	if err := fs.Parse(args); err != nil {
-		return nil, err
-	}
-
-	if flags.Env == "" {
-		return nil, fmt.Errorf("--env is required\nUsage: orama node recover-raft --env <devnet|testnet> --leader <ip>")
-	}
-	if flags.Leader == "" {
-		return nil, fmt.Errorf("--leader is required\nUsage: orama node recover-raft --env <devnet|testnet> --leader <ip>")
-	}
-
-	return flags, nil
-}
-
-func execute(flags *Flags) error {
-	nodes, err := remotessh.LoadEnvNodes(flags.Env)
-	if err != nil {
-		return err
-	}
-
-	cleanup, err := remotessh.PrepareNodeKeys(nodes)
-	if err != nil {
-		return err
-	}
-	defer cleanup()
-
-	// Find leader node
-	leaderNodes := remotessh.FilterByIP(nodes, flags.Leader)
-	if len(leaderNodes) == 0 {
-		return fmt.Errorf("leader %s not found in %s environment", flags.Leader, flags.Env)
-	}
-	leader := leaderNodes[0]
-
-	// Separate leader from followers
-	var followers []inspector.Node
-	for _, n := range nodes {
-		if n.Host != leader.Host {
-			followers = append(followers, n)
-		}
-	}
-
-	// Print plan
-	fmt.Printf("Recover Raft: %s (%d nodes)\n", flags.Env, len(nodes))
-	fmt.Printf("  Leader candidate: %s (%s) — raft/ data preserved\n", leader.Host, leader.Role)
-	for _, n := range followers {
-		fmt.Printf("  - %s (%s) — raft/ will be deleted\n", n.Host, n.Role)
-	}
-	fmt.Println()
-
-	// Confirm unless --force
-	if !flags.Force {
-		fmt.Printf("⚠️  THIS WILL:\n")
-		fmt.Printf("  1. Stop orama-node on ALL %d nodes\n", len(nodes))
-		fmt.Printf("  2. DELETE raft/ data on %d nodes (backup to %s)\n", len(followers), backupDir)
-		fmt.Printf("  3. Keep raft/ data ONLY on %s (leader candidate)\n", leader.Host)
-		fmt.Printf("  4. Restart all nodes to reform the cluster\n")
-		fmt.Printf("\nType 'yes' to confirm: ")
-		reader := bufio.NewReader(os.Stdin)
-		input, _ := reader.ReadString('\n')
-		if strings.TrimSpace(input) != "yes" {
-			fmt.Println("Aborted.")
-			return nil
-		}
-		fmt.Println()
-	}
-
-	// Phase 1: Stop orama-node on ALL nodes
-	if err := phase1StopAll(nodes); err != nil {
-		return fmt.Errorf("phase 1 (stop all): %w", err)
-	}
-
-	// Phase 2: Backup and delete raft/ on non-leader nodes
-	if err := phase2ClearFollowers(followers); err != nil {
-		return fmt.Errorf("phase 2 (clear followers): %w", err)
-	}
-	fmt.Printf("  Leader node %s raft/ data preserved.\n\n", leader.Host)
-
-	// Phase 3: Start leader node and wait for Leader state
-	if err := phase3StartLeader(leader); err != nil {
-		return fmt.Errorf("phase 3 (start leader): %w", err)
-	}
-
-	// Phase 4: Start remaining nodes in batches
-	if err := phase4StartFollowers(followers); err != nil {
-		return fmt.Errorf("phase 4 (start followers): %w", err)
-	}
-
-	// Phase 5: Verify cluster health
-	phase5Verify(nodes, leader)
-
-	return nil
-}
-
-func phase1StopAll(nodes []inspector.Node) error {
-	fmt.Printf("== Phase 1: Stopping orama-node on all %d nodes ==\n", len(nodes))
-
-	var failed []inspector.Node
-	for _, node := range nodes {
-		sudo := remotessh.SudoPrefix(node)
-		fmt.Printf("  Stopping %s ... ", node.Host)
-
-		cmd := fmt.Sprintf("%ssystemctl stop orama-node 2>&1 && echo STOPPED", sudo)
-		if err := remotessh.RunSSHStreaming(node, cmd); err != nil {
-			fmt.Printf("FAILED\n")
-			failed = append(failed, node)
-			continue
-		}
-		fmt.Println()
-	}
-
-	// Kill stragglers
-	if len(failed) > 0 {
-		fmt.Printf("\n⚠️  %d nodes failed to stop. Attempting kill...\n", len(failed))
-		for _, node := range failed {
-			sudo := remotessh.SudoPrefix(node)
-			cmd := fmt.Sprintf("%skillall -9 orama-node rqlited 2>/dev/null; echo KILLED", sudo)
-			_ = remotessh.RunSSHStreaming(node, cmd)
-		}
-	}
-
-	fmt.Printf("\nWaiting 5s for processes to fully stop...\n")
-	time.Sleep(5 * time.Second)
-	fmt.Println()
-
-	return nil
-}
-
-func phase2ClearFollowers(followers []inspector.Node) error {
-	fmt.Printf("== Phase 2: Clearing raft state on %d non-leader nodes ==\n", len(followers))
-
-	for _, node := range followers {
-		sudo := remotessh.SudoPrefix(node)
-		fmt.Printf("  Clearing %s ... ", node.Host)
-
-		script := fmt.Sprintf(`%sbash -c '
-rm -rf %s
-if [ -d %s ]; then
-    cp -r %s %s 2>/dev/null || true
-    rm -rf %s
-    echo "CLEARED (backup at %s)"
-else
-    echo "NO_RAFT_DIR (nothing to clear)"
-fi
-'`, sudo, backupDir, raftDir, raftDir, backupDir, raftDir, backupDir)
-
-		if err := remotessh.RunSSHStreaming(node, script); err != nil {
-			fmt.Printf("FAILED: %v\n", err)
-			continue
-		}
-		fmt.Println()
-	}
-
-	return nil
-}
-
-func phase3StartLeader(leader inspector.Node) error {
-	fmt.Printf("== Phase 3: Starting leader node (%s) ==\n", leader.Host)
-
-	sudo := remotessh.SudoPrefix(leader)
-	startCmd := fmt.Sprintf("%ssystemctl start orama-node", sudo)
-	if err := remotessh.RunSSHStreaming(leader, startCmd); err != nil {
-		return fmt.Errorf("failed to start leader node %s: %w", leader.Host, err)
-	}
-
-	fmt.Printf("  Waiting for leader to become Leader...\n")
-	maxWait := 120
-	elapsed := 0
-
-	for elapsed < maxWait {
-		// Check raft state via RQLite status endpoint
-		checkCmd := `curl -s --max-time 3 http://localhost:5001/status 2>/dev/null | python3 -c "
-import sys,json
-try:
-  d=json.load(sys.stdin)
-  print(d.get('store',{}).get('raft',{}).get('state',''))
-except:
-  print('')
-" 2>/dev/null || echo ""`
-
-		// We can't easily capture output from RunSSHStreaming, so we use a simple approach
-		// Check via a combined command that prints a marker
-		stateCheckCmd := fmt.Sprintf(`state=$(%s); echo "RAFT_STATE=$state"`, checkCmd)
-		// Since RunSSHStreaming prints to stdout, we'll poll and let user see the state
-		fmt.Printf("  ... polling (%ds / %ds)\n", elapsed, maxWait)
-
-		// Try to check state - the output goes to stdout via streaming
-		_ = remotessh.RunSSHStreaming(leader, stateCheckCmd)
-
-		time.Sleep(5 * time.Second)
-		elapsed += 5
-	}
-
-	fmt.Printf("  Leader start complete. Check output above for state.\n\n")
-	return nil
-}
-
-func phase4StartFollowers(followers []inspector.Node) error {
-	fmt.Printf("== Phase 4: Starting %d remaining nodes ==\n", len(followers))
-
-	batchSize := 3
-	for i, node := range followers {
-		sudo := remotessh.SudoPrefix(node)
-		fmt.Printf("  Starting %s ... ", node.Host)
-
-		cmd := fmt.Sprintf("%ssystemctl start orama-node && echo STARTED", sudo)
-		if err := remotessh.RunSSHStreaming(node, cmd); err != nil {
-			fmt.Printf("FAILED: %v\n", err)
-			continue
-		}
-		fmt.Println()
-
-		// Batch delay for cluster stability
-		if (i+1)%batchSize == 0 && i+1 < len(followers) {
-			fmt.Printf("  (waiting 15s between batches for cluster stability)\n")
-			time.Sleep(15 * time.Second)
-		}
-	}
-
-	fmt.Println()
-	return nil
-}
-
-func phase5Verify(nodes []inspector.Node, leader inspector.Node) {
-	fmt.Printf("== Phase 5: Waiting for cluster to stabilize ==\n")
-
-	// Wait in 30s increments
-	for _, s := range []int{30, 60, 90, 120} {
-		time.Sleep(30 * time.Second)
-		fmt.Printf("  ... %ds\n", s)
-	}
-
-	fmt.Printf("\n== Cluster status ==\n")
-	for _, node := range nodes {
-		marker := ""
-		if node.Host == leader.Host {
-			marker = " ← LEADER"
-		}
-
-		checkCmd := `curl -s --max-time 5 http://localhost:5001/status 2>/dev/null | python3 -c "
-import sys,json
-try:
-  d=json.load(sys.stdin)
-  r=d.get('store',{}).get('raft',{})
-  n=d.get('store',{}).get('num_nodes','?')
-  print(f'state={r.get(\"state\",\"?\")} commit={r.get(\"commit_index\",\"?\")} leader={r.get(\"leader\",{}).get(\"node_id\",\"?\")} nodes={n}')
-except:
-  print('NO_RESPONSE')
-" 2>/dev/null || echo "SSH_FAILED"`
-
-		fmt.Printf("  %s%s: ", node.Host, marker)
-		_ = remotessh.RunSSHStreaming(node, checkCmd)
-		fmt.Println()
-	}
-
-	fmt.Printf("\n== Recovery complete ==\n\n")
-	fmt.Printf("Next steps:\n")
-	fmt.Printf("  1. Run 'orama monitor report --env <env>' to verify full cluster health\n")
-	fmt.Printf("  2. If some nodes show Candidate state, give them more time (up to 5 min)\n")
-	fmt.Printf("  3. If nodes fail to join, check /opt/orama/.orama/logs/rqlite-node.log on the node\n")
-}

core/pkg/cli/production/rollout/rollout.go

@@ -1,102 +0,0 @@
-package rollout
-
-import (
-	"flag"
-	"fmt"
-	"os"
-	"time"
-
-	"github.com/DeBrosOfficial/network/pkg/cli/build"
-	"github.com/DeBrosOfficial/network/pkg/cli/production/push"
-	"github.com/DeBrosOfficial/network/pkg/cli/production/upgrade"
-)
-
-// Flags holds rollout command flags.
-type Flags struct {
-	Env     string // Target environment (devnet, testnet)
-	NoBuild bool   // Skip the build step
-	Yes     bool   // Skip confirmation
-	Delay   int    // Delay in seconds between nodes
-}
-
-// Handle is the entry point for the rollout command.
-func Handle(args []string) {
-	flags, err := parseFlags(args)
-	if err != nil {
-		if err == flag.ErrHelp {
-			return
-		}
-		fmt.Fprintf(os.Stderr, "Error: %v\n", err)
-		os.Exit(1)
-	}
-
-	if err := execute(flags); err != nil {
-		fmt.Fprintf(os.Stderr, "Error: %v\n", err)
-		os.Exit(1)
-	}
-}
-
-func parseFlags(args []string) (*Flags, error) {
-	fs := flag.NewFlagSet("rollout", flag.ContinueOnError)
-	fs.SetOutput(os.Stderr)
-
-	flags := &Flags{}
-	fs.StringVar(&flags.Env, "env", "", "Target environment (devnet, testnet) [required]")
-	fs.BoolVar(&flags.NoBuild, "no-build", false, "Skip build step (use existing archive)")
-	fs.BoolVar(&flags.Yes, "yes", false, "Skip confirmation")
-	fs.IntVar(&flags.Delay, "delay", 30, "Delay in seconds between nodes during rolling upgrade")
-
-	if err := fs.Parse(args); err != nil {
-		return nil, err
-	}
-
-	if flags.Env == "" {
-		return nil, fmt.Errorf("--env is required\nUsage: orama node rollout --env <devnet|testnet>")
-	}
-
-	return flags, nil
-}
-
-func execute(flags *Flags) error {
-	start := time.Now()
-
-	fmt.Printf("Rollout to %s\n", flags.Env)
-	fmt.Printf("  Build:   %s\n", boolStr(!flags.NoBuild, "yes", "skip"))
-	fmt.Printf("  Delay:   %ds between nodes\n\n", flags.Delay)
-
-	// Step 1: Build
-	if !flags.NoBuild {
-		fmt.Printf("Step 1/3: Building binary archive...\n\n")
-		buildFlags := &build.Flags{
-			Arch: "amd64",
-		}
-		builder := build.NewBuilder(buildFlags)
-		if err := builder.Build(); err != nil {
-			return fmt.Errorf("build failed: %w", err)
-		}
-		fmt.Println()
-	} else {
-		fmt.Printf("Step 1/3: Build skipped (--no-build)\n\n")
-	}
-
-	// Step 2: Push
-	fmt.Printf("Step 2/3: Pushing to all %s nodes...\n\n", flags.Env)
-	push.Handle([]string{"--env", flags.Env})
-
-	fmt.Println()
-
-	// Step 3: Rolling upgrade
-	fmt.Printf("Step 3/3: Rolling upgrade across %s...\n\n", flags.Env)
-	upgrade.Handle([]string{"--env", flags.Env, "--delay", fmt.Sprintf("%d", flags.Delay)})
-
-	elapsed := time.Since(start).Round(time.Second)
-	fmt.Printf("\nRollout complete in %s\n", elapsed)
-	return nil
-}
-
-func boolStr(b bool, trueStr, falseStr string) string {
-	if b {
-		return trueStr
-	}
-	return falseStr
-}

core/pkg/cli/production/unlock/command.go

@@ -1,166 +0,0 @@
-// Package unlock implements the genesis node unlock command.
-//
-// When the genesis OramaOS node reboots before enough peers exist for
-// Shamir-based LUKS key reconstruction, the operator must manually provide
-// the LUKS key. This command reads the encrypted genesis key from the
-// node's rootfs, decrypts it with the rootwallet, and sends it to the agent.
-package unlock
-
-import (
-	"bytes"
-	"encoding/base64"
-	"encoding/json"
-	"flag"
-	"fmt"
-	"io"
-	"net/http"
-	"os"
-	"os/exec"
-	"strings"
-	"time"
-)
-
-// Flags holds parsed command-line flags.
-type Flags struct {
-	NodeIP  string // WireGuard IP of the OramaOS node
-	Genesis bool   // Must be set to confirm genesis unlock
-	KeyFile string // Path to the encrypted genesis key file (optional override)
-}
-
-// Handle processes the unlock command.
-func Handle(args []string) {
-	flags, err := parseFlags(args)
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "Error: %v\n", err)
-		os.Exit(1)
-	}
-
-	if !flags.Genesis {
-		fmt.Fprintf(os.Stderr, "Error: --genesis flag is required to confirm genesis unlock\n")
-		os.Exit(1)
-	}
-
-	// Step 1: Read the encrypted genesis key from the node
-	fmt.Printf("Fetching encrypted genesis key from %s...\n", flags.NodeIP)
-	encKey, err := fetchGenesisKey(flags.NodeIP)
-	if err != nil && flags.KeyFile == "" {
-		fmt.Fprintf(os.Stderr, "Error: could not fetch genesis key from node: %v\n", err)
-		fmt.Fprintf(os.Stderr, "You can provide the key file directly with --key-file\n")
-		os.Exit(1)
-	}
-
-	if flags.KeyFile != "" {
-		data, readErr := os.ReadFile(flags.KeyFile)
-		if readErr != nil {
-			fmt.Fprintf(os.Stderr, "Error: could not read key file: %v\n", readErr)
-			os.Exit(1)
-		}
-		encKey = strings.TrimSpace(string(data))
-	}
-
-	// Step 2: Decrypt with rootwallet
-	fmt.Println("Decrypting genesis key with rootwallet...")
-	luksKey, err := decryptGenesisKey(encKey)
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "Error: decryption failed: %v\n", err)
-		os.Exit(1)
-	}
-
-	// Step 3: Send LUKS key to the agent over WireGuard
-	fmt.Printf("Sending LUKS key to agent at %s:9998...\n", flags.NodeIP)
-	if err := sendUnlockKey(flags.NodeIP, luksKey); err != nil {
-		fmt.Fprintf(os.Stderr, "Error: unlock failed: %v\n", err)
-		os.Exit(1)
-	}
-
-	fmt.Println("Genesis node unlocked successfully.")
-	fmt.Println("The node is decrypting and mounting its data partition.")
-}
-
-func parseFlags(args []string) (*Flags, error) {
-	fs := flag.NewFlagSet("unlock", flag.ContinueOnError)
-	fs.SetOutput(os.Stderr)
-
-	flags := &Flags{}
-	fs.StringVar(&flags.NodeIP, "node-ip", "", "WireGuard IP of the OramaOS node (required)")
-	fs.BoolVar(&flags.Genesis, "genesis", false, "Confirm genesis node unlock")
-	fs.StringVar(&flags.KeyFile, "key-file", "", "Path to encrypted genesis key file (optional)")
-
-	if err := fs.Parse(args); err != nil {
-		return nil, err
-	}
-
-	if flags.NodeIP == "" {
-		return nil, fmt.Errorf("--node-ip is required")
-	}
-
-	return flags, nil
-}
-
-// fetchGenesisKey retrieves the encrypted genesis key from the node.
-// The agent serves it at GET /v1/agent/genesis-key (only during genesis unlock mode).
-func fetchGenesisKey(nodeIP string) (string, error) {
-	client := &http.Client{Timeout: 10 * time.Second}
-	resp, err := client.Get(fmt.Sprintf("http://%s:9998/v1/agent/genesis-key", nodeIP))
-	if err != nil {
-		return "", fmt.Errorf("request failed: %w", err)
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK {
-		body, _ := io.ReadAll(resp.Body)
-		return "", fmt.Errorf("status %d: %s", resp.StatusCode, string(body))
-	}
-
-	var result struct {
-		EncryptedKey string `json:"encrypted_key"`
-	}
-	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
-		return "", fmt.Errorf("invalid response: %w", err)
-	}
-
-	return result.EncryptedKey, nil
-}
-
-// decryptGenesisKey decrypts the AES-256-GCM encrypted LUKS key using rootwallet.
-// The key was encrypted with: AES-256-GCM(luksKey, HKDF(rootwalletKey, "genesis-luks"))
-// For now, we use `rw decrypt` if available, or a local HKDF+AES-GCM implementation.
-func decryptGenesisKey(encryptedKey string) ([]byte, error) {
-	// Try rw decrypt first
-	cmd := exec.Command("rw", "decrypt", encryptedKey, "--purpose", "genesis-luks", "--chain", "evm")
-	output, err := cmd.Output()
-	if err == nil {
-		decoded, decErr := base64.StdEncoding.DecodeString(strings.TrimSpace(string(output)))
-		if decErr != nil {
-			return nil, fmt.Errorf("failed to decode decrypted key: %w", decErr)
-		}
-		return decoded, nil
-	}
-
-	return nil, fmt.Errorf("rw decrypt failed: %w (is rootwallet installed and initialized?)", err)
-}
-
-// sendUnlockKey sends the decrypted LUKS key to the agent's unlock endpoint.
-func sendUnlockKey(nodeIP string, luksKey []byte) error {
-	body, _ := json.Marshal(map[string]string{
-		"key": base64.StdEncoding.EncodeToString(luksKey),
-	})
-
-	client := &http.Client{Timeout: 30 * time.Second}
-	resp, err := client.Post(
-		fmt.Sprintf("http://%s:9998/v1/agent/unlock", nodeIP),
-		"application/json",
-		bytes.NewReader(body),
-	)
-	if err != nil {
-		return fmt.Errorf("request failed: %w", err)
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK {
-		respBody, _ := io.ReadAll(resp.Body)
-		return fmt.Errorf("status %d: %s", resp.StatusCode, string(respBody))
-	}
-
-	return nil
-}

core/pkg/cli/production/upgrade/remote.go

@@ -1,75 +0,0 @@
-package upgrade
-
-import (
-	"fmt"
-	"time"
-
-	"github.com/DeBrosOfficial/network/pkg/cli/remotessh"
-	"github.com/DeBrosOfficial/network/pkg/inspector"
-)
-
-// RemoteUpgrader handles rolling upgrades across remote nodes.
-type RemoteUpgrader struct {
-	flags *Flags
-}
-
-// NewRemoteUpgrader creates a new remote upgrader.
-func NewRemoteUpgrader(flags *Flags) *RemoteUpgrader {
-	return &RemoteUpgrader{flags: flags}
-}
-
-// Execute runs the remote rolling upgrade.
-func (r *RemoteUpgrader) Execute() error {
-	nodes, err := remotessh.LoadEnvNodes(r.flags.Env)
-	if err != nil {
-		return err
-	}
-
-	cleanup, err := remotessh.PrepareNodeKeys(nodes)
-	if err != nil {
-		return err
-	}
-	defer cleanup()
-
-	// Filter to single node if specified
-	if r.flags.NodeFilter != "" {
-		nodes = remotessh.FilterByIP(nodes, r.flags.NodeFilter)
-		if len(nodes) == 0 {
-			return fmt.Errorf("node %s not found in %s environment", r.flags.NodeFilter, r.flags.Env)
-		}
-	}
-
-	fmt.Printf("Rolling upgrade: %s (%d nodes, %ds delay)\n\n", r.flags.Env, len(nodes), r.flags.Delay)
-
-	// Print execution plan
-	for i, node := range nodes {
-		fmt.Printf("  %d. %s (%s)\n", i+1, node.Host, node.Role)
-	}
-	fmt.Println()
-
-	for i, node := range nodes {
-		fmt.Printf("[%d/%d] Upgrading %s (%s)...\n", i+1, len(nodes), node.Host, node.Role)
-
-		if err := r.upgradeNode(node); err != nil {
-			return fmt.Errorf("upgrade failed on %s: %w\nStopping rollout — remaining nodes not upgraded", node.Host, err)
-		}
-
-		fmt.Printf("  ✓ %s upgraded\n", node.Host)
-
-		// Wait between nodes (except after the last one)
-		if i < len(nodes)-1 && r.flags.Delay > 0 {
-			fmt.Printf("  Waiting %ds before next node...\n\n", r.flags.Delay)
-			time.Sleep(time.Duration(r.flags.Delay) * time.Second)
-		}
-	}
-
-	fmt.Printf("\n✓ Rolling upgrade complete (%d nodes)\n", len(nodes))
-	return nil
-}
-
-// upgradeNode runs `orama node upgrade --restart` on a single remote node.
-func (r *RemoteUpgrader) upgradeNode(node inspector.Node) error {
-	sudo := remotessh.SudoPrefix(node)
-	cmd := fmt.Sprintf("%sorama node upgrade --restart", sudo)
-	return remotessh.RunSSHStreaming(node, cmd)
-}

core/pkg/cli/remotessh/config.go

@@ -1,69 +0,0 @@
-package remotessh
-
-import (
-	"fmt"
-	"os"
-	"path/filepath"
-
-	"github.com/DeBrosOfficial/network/pkg/inspector"
-)
-
-// FindNodesConf searches for the nodes.conf file
-// in common locations relative to the current directory or project root.
-func FindNodesConf() string {
-	candidates := []string{
-		"scripts/nodes.conf",
-		"../scripts/nodes.conf",
-		"network/scripts/nodes.conf",
-	}
-
-	// Also check from home dir
-	home, _ := os.UserHomeDir()
-	if home != "" {
-		candidates = append(candidates, filepath.Join(home, ".orama", "nodes.conf"))
-	}
-
-	for _, c := range candidates {
-		if _, err := os.Stat(c); err == nil {
-			return c
-		}
-	}
-	return ""
-}
-
-// LoadEnvNodes loads all nodes for a given environment from nodes.conf.
-// SSHKey fields are NOT set — caller must call PrepareNodeKeys() after this.
-func LoadEnvNodes(env string) ([]inspector.Node, error) {
-	confPath := FindNodesConf()
-	if confPath == "" {
-		return nil, fmt.Errorf("nodes.conf not found (checked scripts/, ../scripts/, network/scripts/)")
-	}
-
-	nodes, err := inspector.LoadNodes(confPath)
-	if err != nil {
-		return nil, fmt.Errorf("failed to load %s: %w", confPath, err)
-	}
-
-	filtered := inspector.FilterByEnv(nodes, env)
-	if len(filtered) == 0 {
-		return nil, fmt.Errorf("no nodes found for environment %q in %s", env, confPath)
-	}
-
-	return filtered, nil
-}
-
-// PickHubNode selects the first node as the hub for fanout distribution.
-func PickHubNode(nodes []inspector.Node) inspector.Node {
-	return nodes[0]
-}
-
-// FilterByIP returns nodes matching the given IP address.
-func FilterByIP(nodes []inspector.Node, ip string) []inspector.Node {
-	var filtered []inspector.Node
-	for _, n := range nodes {
-		if n.Host == ip {
-			filtered = append(filtered, n)
-		}
-	}
-	return filtered
-}

core/pkg/cli/remotessh/ssh.go

@@ -1,104 +0,0 @@
-package remotessh
-
-import (
-	"fmt"
-	"os"
-	"os/exec"
-
-	"github.com/DeBrosOfficial/network/pkg/inspector"
-)
-
-// SSHOption configures SSH command behavior.
-type SSHOption func(*sshOptions)
-
-type sshOptions struct {
-	agentForward   bool
-	noHostKeyCheck bool
-}
-
-// WithAgentForward enables SSH agent forwarding (-A flag).
-// Used by push fanout so the hub can reach targets via the forwarded agent.
-func WithAgentForward() SSHOption {
-	return func(o *sshOptions) { o.agentForward = true }
-}
-
-// WithNoHostKeyCheck disables host key verification and uses /dev/null as known_hosts.
-// Use for ephemeral servers (sandbox) where IPs are frequently recycled.
-func WithNoHostKeyCheck() SSHOption {
-	return func(o *sshOptions) { o.noHostKeyCheck = true }
-}
-
-// UploadFile copies a local file to a remote host via SCP.
-// Requires node.SSHKey to be set (via PrepareNodeKeys).
-func UploadFile(node inspector.Node, localPath, remotePath string, opts ...SSHOption) error {
-	if node.SSHKey == "" {
-		return fmt.Errorf("no SSH key for %s (call PrepareNodeKeys first)", node.Name())
-	}
-
-	var cfg sshOptions
-	for _, o := range opts {
-		o(&cfg)
-	}
-
-	dest := fmt.Sprintf("%s@%s:%s", node.User, node.Host, remotePath)
-
-	args := []string{"-o", "ConnectTimeout=10", "-i", node.SSHKey}
-	if cfg.noHostKeyCheck {
-		args = append([]string{"-o", "StrictHostKeyChecking=no", "-o", "UserKnownHostsFile=/dev/null"}, args...)
-	} else {
-		args = append([]string{"-o", "StrictHostKeyChecking=accept-new"}, args...)
-	}
-	args = append(args, localPath, dest)
-
-	cmd := exec.Command("scp", args...)
-	cmd.Stdout = os.Stdout
-	cmd.Stderr = os.Stderr
-
-	if err := cmd.Run(); err != nil {
-		return fmt.Errorf("SCP to %s failed: %w", node.Host, err)
-	}
-	return nil
-}
-
-// RunSSHStreaming executes a command on a remote host via SSH,
-// streaming stdout/stderr to the local terminal in real-time.
-// Requires node.SSHKey to be set (via PrepareNodeKeys).
-func RunSSHStreaming(node inspector.Node, command string, opts ...SSHOption) error {
-	if node.SSHKey == "" {
-		return fmt.Errorf("no SSH key for %s (call PrepareNodeKeys first)", node.Name())
-	}
-
-	var cfg sshOptions
-	for _, o := range opts {
-		o(&cfg)
-	}
-
-	args := []string{"-o", "ConnectTimeout=10", "-i", node.SSHKey}
-	if cfg.noHostKeyCheck {
-		args = append([]string{"-o", "StrictHostKeyChecking=no", "-o", "UserKnownHostsFile=/dev/null"}, args...)
-	} else {
-		args = append([]string{"-o", "StrictHostKeyChecking=accept-new"}, args...)
-	}
-	if cfg.agentForward {
-		args = append(args, "-A")
-	}
-	args = append(args, fmt.Sprintf("%s@%s", node.User, node.Host), command)
-
-	cmd := exec.Command("ssh", args...)
-	cmd.Stdout = os.Stdout
-	cmd.Stderr = os.Stderr
-	cmd.Stdin = os.Stdin
-
-	if err := cmd.Run(); err != nil {
-		return fmt.Errorf("SSH to %s failed: %w", node.Host, err)
-	}
-	return nil
-}
-
-// SudoPrefix returns "sudo " for non-root users, empty for root.
-func SudoPrefix(node inspector.Node) string {
-	if node.User == "root" {
-		return ""
-	}
-	return "sudo "
-}

core/pkg/cli/remotessh/wallet.go

@@ -1,216 +0,0 @@
-package remotessh
-
-import (
-	"context"
-	"fmt"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"strings"
-
-	"github.com/DeBrosOfficial/network/pkg/inspector"
-	"github.com/DeBrosOfficial/network/pkg/rwagent"
-)
-
-// vaultClient is the interface used by wallet functions to talk to the agent.
-// Defaults to the real rwagent.Client; tests replace it with a mock.
-type vaultClient interface {
-	GetSSHKey(ctx context.Context, host, username, format string) (*rwagent.VaultSSHData, error)
-	CreateSSHEntry(ctx context.Context, host, username string) (*rwagent.VaultSSHData, error)
-}
-
-// newClient creates the default vaultClient. Package-level var for test injection.
-var newClient func() vaultClient = func() vaultClient {
-	return rwagent.New(os.Getenv("RW_AGENT_SOCK"))
-}
-
-// wrapAgentError wraps rwagent errors with user-friendly messages.
-// When the agent is locked, it also triggers the RootWallet desktop app
-// to show the unlock dialog via deep link (best-effort, fire-and-forget).
-func wrapAgentError(err error, action string) error {
-	if rwagent.IsNotRunning(err) {
-		return fmt.Errorf("%s: rootwallet agent is not running — start with: rw agent start && rw agent unlock", action)
-	}
-	if rwagent.IsLocked(err) {
-		return fmt.Errorf("%s: rootwallet agent is locked — unlock timed out after waiting. Unlock via the RootWallet app or run: rw agent unlock", action)
-	}
-	if rwagent.IsApprovalDenied(err) {
-		return fmt.Errorf("%s: rootwallet access denied — approve this app in the RootWallet desktop app", action)
-	}
-	return fmt.Errorf("%s: %w", action, err)
-}
-
-// PrepareNodeKeys resolves wallet-derived SSH keys for all nodes.
-// Retrieves private keys from the rootwallet agent daemon, writes PEMs to
-// temp files, and sets node.SSHKey for each node.
-//
-// The nodes slice is modified in place — each node.SSHKey is set to
-// the path of the temporary key file.
-//
-// Returns a cleanup function that zero-overwrites and removes all temp files.
-// Caller must defer cleanup().
-func PrepareNodeKeys(nodes []inspector.Node) (cleanup func(), err error) {
-	client := newClient()
-	ctx := context.Background()
-
-	// Create temp dir for all keys
-	tmpDir, err := os.MkdirTemp("", "orama-ssh-")
-	if err != nil {
-		return nil, fmt.Errorf("create temp dir: %w", err)
-	}
-
-	// Track resolved keys by host/user to avoid duplicate agent calls
-	keyPaths := make(map[string]string) // "host/user" → temp file path
-	var allKeyPaths []string
-
-	for i := range nodes {
-		var key string
-		if nodes[i].VaultTarget != "" {
-			key = nodes[i].VaultTarget
-		} else {
-			key = nodes[i].Host + "/" + nodes[i].User
-		}
-		if existing, ok := keyPaths[key]; ok {
-			nodes[i].SSHKey = existing
-			continue
-		}
-
-		host, user := parseVaultTarget(key)
-		data, err := client.GetSSHKey(ctx, host, user, "priv")
-		if err != nil {
-			cleanupKeys(tmpDir, allKeyPaths)
-			return nil, wrapAgentError(err, fmt.Sprintf("resolve key for %s", nodes[i].Name()))
-		}
-
-		if !strings.Contains(data.PrivateKey, "BEGIN OPENSSH PRIVATE KEY") {
-			cleanupKeys(tmpDir, allKeyPaths)
-			return nil, fmt.Errorf("agent returned invalid key for %s", nodes[i].Name())
-		}
-
-		// Write PEM to temp file with restrictive perms
-		keyFile := filepath.Join(tmpDir, fmt.Sprintf("id_%d", i))
-		if err := os.WriteFile(keyFile, []byte(data.PrivateKey), 0600); err != nil {
-			cleanupKeys(tmpDir, allKeyPaths)
-			return nil, fmt.Errorf("write key for %s: %w", nodes[i].Name(), err)
-		}
-
-		keyPaths[key] = keyFile
-		allKeyPaths = append(allKeyPaths, keyFile)
-		nodes[i].SSHKey = keyFile
-	}
-
-	cleanup = func() {
-		cleanupKeys(tmpDir, allKeyPaths)
-	}
-	return cleanup, nil
-}
-
-// LoadAgentKeys loads SSH keys for the given nodes into the system ssh-agent.
-// Used by push fanout to enable agent forwarding.
-// Retrieves private keys from the rootwallet agent and pipes them to ssh-add.
-func LoadAgentKeys(nodes []inspector.Node) error {
-	client := newClient()
-	ctx := context.Background()
-
-	// Deduplicate host/user pairs
-	seen := make(map[string]bool)
-	var targets []string
-	for _, n := range nodes {
-		var key string
-		if n.VaultTarget != "" {
-			key = n.VaultTarget
-		} else {
-			key = n.Host + "/" + n.User
-		}
-		if seen[key] {
-			continue
-		}
-		seen[key] = true
-		targets = append(targets, key)
-	}
-
-	if len(targets) == 0 {
-		return nil
-	}
-
-	for _, target := range targets {
-		host, user := parseVaultTarget(target)
-		data, err := client.GetSSHKey(ctx, host, user, "priv")
-		if err != nil {
-			return wrapAgentError(err, fmt.Sprintf("get key for %s", target))
-		}
-
-		// Pipe private key to ssh-add via stdin
-		cmd := exec.Command("ssh-add", "-")
-		cmd.Stdin = strings.NewReader(data.PrivateKey)
-		cmd.Stderr = os.Stderr
-		if err := cmd.Run(); err != nil {
-			return fmt.Errorf("ssh-add failed for %s: %w", target, err)
-		}
-	}
-
-	return nil
-}
-
-// EnsureVaultEntry creates a wallet SSH entry if it doesn't already exist.
-// Checks the rootwallet agent for an existing entry, creates one if not found.
-func EnsureVaultEntry(vaultTarget string) error {
-	client := newClient()
-	ctx := context.Background()
-
-	host, user := parseVaultTarget(vaultTarget)
-
-	// Check if entry already exists
-	_, err := client.GetSSHKey(ctx, host, user, "pub")
-	if err == nil {
-		return nil // entry exists
-	}
-
-	// If not found, create it
-	if rwagent.IsNotFound(err) {
-		_, createErr := client.CreateSSHEntry(ctx, host, user)
-		if createErr != nil {
-			return wrapAgentError(createErr, fmt.Sprintf("create vault entry %s", vaultTarget))
-		}
-		return nil
-	}
-
-	return wrapAgentError(err, fmt.Sprintf("check vault entry %s", vaultTarget))
-}
-
-// ResolveVaultPublicKey returns the OpenSSH public key string for a vault entry.
-func ResolveVaultPublicKey(vaultTarget string) (string, error) {
-	client := newClient()
-	ctx := context.Background()
-
-	host, user := parseVaultTarget(vaultTarget)
-	data, err := client.GetSSHKey(ctx, host, user, "pub")
-	if err != nil {
-		return "", wrapAgentError(err, fmt.Sprintf("get public key for %s", vaultTarget))
-	}
-
-	pubKey := strings.TrimSpace(data.PublicKey)
-	if !strings.HasPrefix(pubKey, "ssh-") {
-		return "", fmt.Errorf("agent returned invalid public key for %s", vaultTarget)
-	}
-	return pubKey, nil
-}
-
-// parseVaultTarget splits a "host/user" vault target string into host and user.
-func parseVaultTarget(target string) (host, user string) {
-	idx := strings.Index(target, "/")
-	if idx < 0 {
-		return target, ""
-	}
-	return target[:idx], target[idx+1:]
-}
-
-// cleanupKeys zero-overwrites and removes all key files, then removes the temp dir.
-func cleanupKeys(tmpDir string, keyPaths []string) {
-	zeros := make([]byte, 512)
-	for _, p := range keyPaths {
-		_ = os.WriteFile(p, zeros, 0600) // zero-overwrite
-		_ = os.Remove(p)
-	}
-	_ = os.Remove(tmpDir)
-}

core/pkg/cli/remotessh/wallet_test.go

@@ -1,376 +0,0 @@
-package remotessh
-
-import (
-	"context"
-	"errors"
-	"os"
-	"strings"
-	"testing"
-
-	"github.com/DeBrosOfficial/network/pkg/inspector"
-	"github.com/DeBrosOfficial/network/pkg/rwagent"
-)
-
-const testPrivateKey = "-----BEGIN OPENSSH PRIVATE KEY-----\nfake-key-data\n-----END OPENSSH PRIVATE KEY-----"
-
-// mockClient implements vaultClient for testing.
-type mockClient struct {
-	getSSHKey      func(ctx context.Context, host, username, format string) (*rwagent.VaultSSHData, error)
-	createSSHEntry func(ctx context.Context, host, username string) (*rwagent.VaultSSHData, error)
-}
-
-func (m *mockClient) GetSSHKey(ctx context.Context, host, username, format string) (*rwagent.VaultSSHData, error) {
-	return m.getSSHKey(ctx, host, username, format)
-}
-
-func (m *mockClient) CreateSSHEntry(ctx context.Context, host, username string) (*rwagent.VaultSSHData, error) {
-	return m.createSSHEntry(ctx, host, username)
-}
-
-// withMockClient replaces newClient for the duration of a test.
-func withMockClient(t *testing.T, mock *mockClient) {
-	t.Helper()
-	orig := newClient
-	newClient = func() vaultClient { return mock }
-	t.Cleanup(func() { newClient = orig })
-}
-
-func TestParseVaultTarget(t *testing.T) {
-	tests := []struct {
-		target   string
-		wantHost string
-		wantUser string
-	}{
-		{"sandbox/root", "sandbox", "root"},
-		{"192.168.1.1/ubuntu", "192.168.1.1", "ubuntu"},
-		{"my-host/my-user", "my-host", "my-user"},
-		{"noslash", "noslash", ""},
-		{"a/b/c", "a", "b/c"},
-		{"", "", ""},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.target, func(t *testing.T) {
-			host, user := parseVaultTarget(tt.target)
-			if host != tt.wantHost {
-				t.Errorf("parseVaultTarget(%q) host = %q, want %q", tt.target, host, tt.wantHost)
-			}
-			if user != tt.wantUser {
-				t.Errorf("parseVaultTarget(%q) user = %q, want %q", tt.target, user, tt.wantUser)
-			}
-		})
-	}
-}
-
-func TestWrapAgentError_notRunning(t *testing.T) {
-	err := wrapAgentError(rwagent.ErrAgentNotRunning, "test action")
-	if !strings.Contains(err.Error(), "not running") {
-		t.Errorf("expected 'not running' message, got: %s", err)
-	}
-	if !strings.Contains(err.Error(), "rw agent start") {
-		t.Errorf("expected actionable hint, got: %s", err)
-	}
-}
-
-func TestWrapAgentError_locked(t *testing.T) {
-	agentErr := &rwagent.AgentError{Code: "AGENT_LOCKED", Message: "agent is locked"}
-	err := wrapAgentError(agentErr, "test action")
-	if !strings.Contains(err.Error(), "locked") {
-		t.Errorf("expected 'locked' message, got: %s", err)
-	}
-	if !strings.Contains(err.Error(), "rw agent unlock") {
-		t.Errorf("expected actionable hint, got: %s", err)
-	}
-}
-
-func TestWrapAgentError_generic(t *testing.T) {
-	err := wrapAgentError(errors.New("some error"), "test action")
-	if !strings.Contains(err.Error(), "test action") {
-		t.Errorf("expected action context, got: %s", err)
-	}
-	if !strings.Contains(err.Error(), "some error") {
-		t.Errorf("expected wrapped error, got: %s", err)
-	}
-}
-
-func TestPrepareNodeKeys_success(t *testing.T) {
-	mock := &mockClient{
-		getSSHKey: func(_ context.Context, host, username, format string) (*rwagent.VaultSSHData, error) {
-			return &rwagent.VaultSSHData{PrivateKey: testPrivateKey}, nil
-		},
-	}
-	withMockClient(t, mock)
-
-	nodes := []inspector.Node{
-		{Host: "10.0.0.1", User: "root"},
-		{Host: "10.0.0.2", User: "root"},
-	}
-
-	cleanup, err := PrepareNodeKeys(nodes)
-	if err != nil {
-		t.Fatalf("PrepareNodeKeys() error = %v", err)
-	}
-	defer cleanup()
-
-	for i, n := range nodes {
-		if n.SSHKey == "" {
-			t.Errorf("node[%d].SSHKey is empty", i)
-			continue
-		}
-		data, err := os.ReadFile(n.SSHKey)
-		if err != nil {
-			t.Errorf("node[%d] key file unreadable: %v", i, err)
-			continue
-		}
-		if !strings.Contains(string(data), "BEGIN OPENSSH PRIVATE KEY") {
-			t.Errorf("node[%d] key file has wrong content", i)
-		}
-	}
-}
-
-func TestPrepareNodeKeys_deduplication(t *testing.T) {
-	callCount := 0
-	mock := &mockClient{
-		getSSHKey: func(_ context.Context, host, username, format string) (*rwagent.VaultSSHData, error) {
-			callCount++
-			return &rwagent.VaultSSHData{PrivateKey: testPrivateKey}, nil
-		},
-	}
-	withMockClient(t, mock)
-
-	nodes := []inspector.Node{
-		{Host: "10.0.0.1", User: "root"},
-		{Host: "10.0.0.1", User: "root"}, // same host/user
-	}
-
-	cleanup, err := PrepareNodeKeys(nodes)
-	if err != nil {
-		t.Fatalf("PrepareNodeKeys() error = %v", err)
-	}
-	defer cleanup()
-
-	if callCount != 1 {
-		t.Errorf("expected 1 agent call (dedup), got %d", callCount)
-	}
-	if nodes[0].SSHKey != nodes[1].SSHKey {
-		t.Error("expected same key path for deduplicated nodes")
-	}
-}
-
-func TestPrepareNodeKeys_vaultTarget(t *testing.T) {
-	var capturedHost, capturedUser string
-	mock := &mockClient{
-		getSSHKey: func(_ context.Context, host, username, format string) (*rwagent.VaultSSHData, error) {
-			capturedHost = host
-			capturedUser = username
-			return &rwagent.VaultSSHData{PrivateKey: testPrivateKey}, nil
-		},
-	}
-	withMockClient(t, mock)
-
-	nodes := []inspector.Node{
-		{Host: "10.0.0.1", User: "root", VaultTarget: "sandbox/admin"},
-	}
-
-	cleanup, err := PrepareNodeKeys(nodes)
-	if err != nil {
-		t.Fatalf("PrepareNodeKeys() error = %v", err)
-	}
-	defer cleanup()
-
-	if capturedHost != "sandbox" || capturedUser != "admin" {
-		t.Errorf("expected host=sandbox user=admin, got host=%s user=%s", capturedHost, capturedUser)
-	}
-}
-
-func TestPrepareNodeKeys_agentNotRunning(t *testing.T) {
-	mock := &mockClient{
-		getSSHKey: func(_ context.Context, _, _, _ string) (*rwagent.VaultSSHData, error) {
-			return nil, rwagent.ErrAgentNotRunning
-		},
-	}
-	withMockClient(t, mock)
-
-	nodes := []inspector.Node{{Host: "10.0.0.1", User: "root"}}
-	_, err := PrepareNodeKeys(nodes)
-	if err == nil {
-		t.Fatal("expected error")
-	}
-	if !strings.Contains(err.Error(), "not running") {
-		t.Errorf("expected 'not running' error, got: %s", err)
-	}
-}
-
-func TestPrepareNodeKeys_invalidKey(t *testing.T) {
-	mock := &mockClient{
-		getSSHKey: func(_ context.Context, _, _, _ string) (*rwagent.VaultSSHData, error) {
-			return &rwagent.VaultSSHData{PrivateKey: "garbage"}, nil
-		},
-	}
-	withMockClient(t, mock)
-
-	nodes := []inspector.Node{{Host: "10.0.0.1", User: "root"}}
-	_, err := PrepareNodeKeys(nodes)
-	if err == nil {
-		t.Fatal("expected error for invalid key")
-	}
-	if !strings.Contains(err.Error(), "invalid key") {
-		t.Errorf("expected 'invalid key' error, got: %s", err)
-	}
-}
-
-func TestPrepareNodeKeys_cleanupOnError(t *testing.T) {
-	callNum := 0
-	mock := &mockClient{
-		getSSHKey: func(_ context.Context, _, _, _ string) (*rwagent.VaultSSHData, error) {
-			callNum++
-			if callNum == 2 {
-				return nil, &rwagent.AgentError{Code: "AGENT_LOCKED", Message: "locked"}
-			}
-			return &rwagent.VaultSSHData{PrivateKey: testPrivateKey}, nil
-		},
-	}
-	withMockClient(t, mock)
-
-	nodes := []inspector.Node{
-		{Host: "10.0.0.1", User: "root"},
-		{Host: "10.0.0.2", User: "root"},
-	}
-
-	_, err := PrepareNodeKeys(nodes)
-	if err == nil {
-		t.Fatal("expected error")
-	}
-
-	// First node's temp file should have been cleaned up
-	if nodes[0].SSHKey != "" {
-		if _, statErr := os.Stat(nodes[0].SSHKey); statErr == nil {
-			t.Error("expected temp key file to be cleaned up on error")
-		}
-	}
-}
-
-func TestPrepareNodeKeys_emptyNodes(t *testing.T) {
-	mock := &mockClient{}
-	withMockClient(t, mock)
-
-	cleanup, err := PrepareNodeKeys(nil)
-	if err != nil {
-		t.Fatalf("expected no error for empty nodes, got: %v", err)
-	}
-	cleanup() // should not panic
-}
-
-func TestEnsureVaultEntry_exists(t *testing.T) {
-	mock := &mockClient{
-		getSSHKey: func(_ context.Context, _, _, _ string) (*rwagent.VaultSSHData, error) {
-			return &rwagent.VaultSSHData{PublicKey: "ssh-ed25519 AAAA..."}, nil
-		},
-	}
-	withMockClient(t, mock)
-
-	if err := EnsureVaultEntry("sandbox/root"); err != nil {
-		t.Fatalf("EnsureVaultEntry() error = %v", err)
-	}
-}
-
-func TestEnsureVaultEntry_creates(t *testing.T) {
-	created := false
-	mock := &mockClient{
-		getSSHKey: func(_ context.Context, _, _, _ string) (*rwagent.VaultSSHData, error) {
-			return nil, &rwagent.AgentError{Code: "NOT_FOUND", Message: "not found"}
-		},
-		createSSHEntry: func(_ context.Context, host, username string) (*rwagent.VaultSSHData, error) {
-			created = true
-			if host != "sandbox" || username != "root" {
-				t.Errorf("unexpected create args: %s/%s", host, username)
-			}
-			return &rwagent.VaultSSHData{PublicKey: "ssh-ed25519 AAAA..."}, nil
-		},
-	}
-	withMockClient(t, mock)
-
-	if err := EnsureVaultEntry("sandbox/root"); err != nil {
-		t.Fatalf("EnsureVaultEntry() error = %v", err)
-	}
-	if !created {
-		t.Error("expected CreateSSHEntry to be called")
-	}
-}
-
-func TestEnsureVaultEntry_locked(t *testing.T) {
-	mock := &mockClient{
-		getSSHKey: func(_ context.Context, _, _, _ string) (*rwagent.VaultSSHData, error) {
-			return nil, &rwagent.AgentError{Code: "AGENT_LOCKED", Message: "locked"}
-		},
-	}
-	withMockClient(t, mock)
-
-	err := EnsureVaultEntry("sandbox/root")
-	if err == nil {
-		t.Fatal("expected error")
-	}
-	if !strings.Contains(err.Error(), "locked") {
-		t.Errorf("expected locked error, got: %s", err)
-	}
-}
-
-func TestResolveVaultPublicKey_success(t *testing.T) {
-	mock := &mockClient{
-		getSSHKey: func(_ context.Context, _, _, format string) (*rwagent.VaultSSHData, error) {
-			if format != "pub" {
-				t.Errorf("expected format=pub, got %s", format)
-			}
-			return &rwagent.VaultSSHData{PublicKey: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAA..."}, nil
-		},
-	}
-	withMockClient(t, mock)
-
-	key, err := ResolveVaultPublicKey("sandbox/root")
-	if err != nil {
-		t.Fatalf("ResolveVaultPublicKey() error = %v", err)
-	}
-	if !strings.HasPrefix(key, "ssh-") {
-		t.Errorf("expected ssh- prefix, got: %s", key)
-	}
-}
-
-func TestResolveVaultPublicKey_invalidFormat(t *testing.T) {
-	mock := &mockClient{
-		getSSHKey: func(_ context.Context, _, _, _ string) (*rwagent.VaultSSHData, error) {
-			return &rwagent.VaultSSHData{PublicKey: "not-a-valid-key"}, nil
-		},
-	}
-	withMockClient(t, mock)
-
-	_, err := ResolveVaultPublicKey("sandbox/root")
-	if err == nil {
-		t.Fatal("expected error for invalid public key")
-	}
-	if !strings.Contains(err.Error(), "invalid public key") {
-		t.Errorf("expected 'invalid public key' error, got: %s", err)
-	}
-}
-
-func TestResolveVaultPublicKey_notFound(t *testing.T) {
-	mock := &mockClient{
-		getSSHKey: func(_ context.Context, _, _, _ string) (*rwagent.VaultSSHData, error) {
-			return nil, &rwagent.AgentError{Code: "NOT_FOUND", Message: "not found"}
-		},
-	}
-	withMockClient(t, mock)
-
-	_, err := ResolveVaultPublicKey("sandbox/root")
-	if err == nil {
-		t.Fatal("expected error")
-	}
-}
-
-func TestLoadAgentKeys_emptyNodes(t *testing.T) {
-	mock := &mockClient{}
-	withMockClient(t, mock)
-
-	if err := LoadAgentKeys(nil); err != nil {
-		t.Fatalf("expected no error for empty nodes, got: %v", err)
-	}
-}

core/pkg/cli/sandbox/config.go

@@ -1,133 +0,0 @@
-package sandbox
-
-import (
-	"fmt"
-	"os"
-	"path/filepath"
-
-	"gopkg.in/yaml.v3"
-)
-
-// Config holds sandbox configuration, stored at ~/.orama/sandbox.yaml.
-type Config struct {
-	HetznerAPIToken string      `yaml:"hetzner_api_token"`
-	Domain          string      `yaml:"domain"`
-	Location        string      `yaml:"location"`    // Hetzner datacenter (default: fsn1)
-	ServerType      string      `yaml:"server_type"` // Hetzner server type (default: cx22)
-	FloatingIPs     []FloatIP   `yaml:"floating_ips"`
-	SSHKey          SSHKeyConfig `yaml:"ssh_key"`
-	FirewallID      int64       `yaml:"firewall_id,omitempty"` // Hetzner firewall resource ID
-}
-
-// FloatIP holds a Hetzner floating IP reference.
-type FloatIP struct {
-	ID int64  `yaml:"id"`
-	IP string `yaml:"ip"`
-}
-
-// SSHKeyConfig holds the wallet vault target and Hetzner resource ID.
-type SSHKeyConfig struct {
-	HetznerID   int64  `yaml:"hetzner_id"`
-	VaultTarget string `yaml:"vault_target"` // e.g. "sandbox/root"
-}
-
-// configDir returns ~/.orama/, creating it if needed.
-func configDir() (string, error) {
-	home, err := os.UserHomeDir()
-	if err != nil {
-		return "", fmt.Errorf("get home directory: %w", err)
-	}
-	dir := filepath.Join(home, ".orama")
-	if err := os.MkdirAll(dir, 0700); err != nil {
-		return "", fmt.Errorf("create config directory: %w", err)
-	}
-	return dir, nil
-}
-
-// configPath returns the full path to ~/.orama/sandbox.yaml.
-func configPath() (string, error) {
-	dir, err := configDir()
-	if err != nil {
-		return "", err
-	}
-	return filepath.Join(dir, "sandbox.yaml"), nil
-}
-
-// LoadConfig reads the sandbox config from ~/.orama/sandbox.yaml.
-// Returns an error if the file doesn't exist (user must run setup first).
-func LoadConfig() (*Config, error) {
-	path, err := configPath()
-	if err != nil {
-		return nil, err
-	}
-
-	data, err := os.ReadFile(path)
-	if err != nil {
-		if os.IsNotExist(err) {
-			return nil, fmt.Errorf("sandbox not configured, run: orama sandbox setup")
-		}
-		return nil, fmt.Errorf("read config: %w", err)
-	}
-
-	var cfg Config
-	if err := yaml.Unmarshal(data, &cfg); err != nil {
-		return nil, fmt.Errorf("parse config %s: %w", path, err)
-	}
-
-	if err := cfg.validate(); err != nil {
-		return nil, fmt.Errorf("invalid config: %w", err)
-	}
-
-	cfg.Defaults()
-
-	return &cfg, nil
-}
-
-// SaveConfig writes the sandbox config to ~/.orama/sandbox.yaml.
-func SaveConfig(cfg *Config) error {
-	path, err := configPath()
-	if err != nil {
-		return err
-	}
-
-	data, err := yaml.Marshal(cfg)
-	if err != nil {
-		return fmt.Errorf("marshal config: %w", err)
-	}
-
-	if err := os.WriteFile(path, data, 0600); err != nil {
-		return fmt.Errorf("write config: %w", err)
-	}
-
-	return nil
-}
-
-// validate checks that required fields are present.
-func (c *Config) validate() error {
-	if c.HetznerAPIToken == "" {
-		return fmt.Errorf("hetzner_api_token is required")
-	}
-	if c.Domain == "" {
-		return fmt.Errorf("domain is required")
-	}
-	if len(c.FloatingIPs) < 2 {
-		return fmt.Errorf("2 floating IPs required, got %d", len(c.FloatingIPs))
-	}
-	if c.SSHKey.VaultTarget == "" {
-		return fmt.Errorf("ssh_key.vault_target is required (run: orama sandbox setup)")
-	}
-	return nil
-}
-
-// Defaults fills in default values for optional fields.
-func (c *Config) Defaults() {
-	if c.Location == "" {
-		c.Location = "nbg1"
-	}
-	if c.ServerType == "" {
-		c.ServerType = "cx23"
-	}
-	if c.SSHKey.VaultTarget == "" {
-		c.SSHKey.VaultTarget = "sandbox/root"
-	}
-}

core/pkg/cli/sandbox/config_test.go

@@ -1,53 +0,0 @@
-package sandbox
-
-import "testing"
-
-func TestConfig_Validate_EmptyVaultTarget(t *testing.T) {
-	cfg := &Config{
-		HetznerAPIToken: "test-token",
-		Domain:          "test.example.com",
-		FloatingIPs:     []FloatIP{{ID: 1, IP: "1.1.1.1"}, {ID: 2, IP: "2.2.2.2"}},
-		SSHKey:          SSHKeyConfig{HetznerID: 1, VaultTarget: ""},
-	}
-	if err := cfg.validate(); err == nil {
-		t.Error("validate() should reject empty VaultTarget")
-	}
-}
-
-func TestConfig_Validate_WithVaultTarget(t *testing.T) {
-	cfg := &Config{
-		HetznerAPIToken: "test-token",
-		Domain:          "test.example.com",
-		FloatingIPs:     []FloatIP{{ID: 1, IP: "1.1.1.1"}, {ID: 2, IP: "2.2.2.2"}},
-		SSHKey:          SSHKeyConfig{HetznerID: 1, VaultTarget: "sandbox/root"},
-	}
-	if err := cfg.validate(); err != nil {
-		t.Errorf("validate() unexpected error: %v", err)
-	}
-}
-
-func TestConfig_Defaults_SetsVaultTarget(t *testing.T) {
-	cfg := &Config{}
-	cfg.Defaults()
-
-	if cfg.SSHKey.VaultTarget != "sandbox/root" {
-		t.Errorf("Defaults() VaultTarget = %q, want sandbox/root", cfg.SSHKey.VaultTarget)
-	}
-	if cfg.Location != "nbg1" {
-		t.Errorf("Defaults() Location = %q, want nbg1", cfg.Location)
-	}
-	if cfg.ServerType != "cx23" {
-		t.Errorf("Defaults() ServerType = %q, want cx23", cfg.ServerType)
-	}
-}
-
-func TestConfig_Defaults_PreservesExistingVaultTarget(t *testing.T) {
-	cfg := &Config{
-		SSHKey: SSHKeyConfig{VaultTarget: "custom/user"},
-	}
-	cfg.Defaults()
-
-	if cfg.SSHKey.VaultTarget != "custom/user" {
-		t.Errorf("Defaults() should preserve existing VaultTarget, got %q", cfg.SSHKey.VaultTarget)
-	}
-}

core/pkg/cli/sandbox/create.go

@@ -1,649 +0,0 @@
-package sandbox
-
-import (
-	"context"
-	"fmt"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"strings"
-	"time"
-
-	"github.com/DeBrosOfficial/network/pkg/cli/remotessh"
-	"github.com/DeBrosOfficial/network/pkg/inspector"
-	"github.com/DeBrosOfficial/network/pkg/rwagent"
-)
-
-// Create orchestrates the creation of a new sandbox cluster.
-func Create(name string) error {
-	cfg, err := LoadConfig()
-	if err != nil {
-		return err
-	}
-
-	// --- Preflight: validate everything BEFORE spending money ---
-	fmt.Println("Preflight checks:")
-
-	// 1. Check for existing active sandbox
-	active, err := FindActiveSandbox()
-	if err != nil {
-		return err
-	}
-	if active != nil {
-		return fmt.Errorf("sandbox %q is already active (status: %s)\nDestroy it first: orama sandbox destroy --name %s",
-			active.Name, active.Status, active.Name)
-	}
-	fmt.Println("  [ok] No active sandbox")
-
-	// 2. Check rootwallet agent is running and unlocked before the slow SSH key call
-	if err := checkAgentReady(); err != nil {
-		return err
-	}
-	fmt.Println("  [ok] Rootwallet agent running and unlocked")
-
-	// 3. Resolve SSH key (may trigger approval prompt in RootWallet app)
-	fmt.Print("  [..] Resolving SSH key from vault...")
-	sshKeyPath, cleanup, err := resolveVaultKeyOnce(cfg.SSHKey.VaultTarget)
-	if err != nil {
-		fmt.Println(" FAILED")
-		return fmt.Errorf("prepare SSH key: %w", err)
-	}
-	defer cleanup()
-	fmt.Println(" ok")
-
-	// 4. Check binary archive — auto-build if missing
-	archivePath := findNewestArchive()
-	if archivePath == "" {
-		fmt.Println("  [--] No binary archive found, building...")
-		if err := autoBuildArchive(); err != nil {
-			return fmt.Errorf("auto-build archive: %w", err)
-		}
-		archivePath = findNewestArchive()
-		if archivePath == "" {
-			return fmt.Errorf("build succeeded but no archive found in /tmp/")
-		}
-	}
-	info, err := os.Stat(archivePath)
-	if err != nil {
-		return fmt.Errorf("stat archive %s: %w", archivePath, err)
-	}
-	fmt.Printf("  [ok] Binary archive: %s (%s)\n", filepath.Base(archivePath), formatBytes(info.Size()))
-
-	// 5. Verify Hetzner API token works
-	client := NewHetznerClient(cfg.HetznerAPIToken)
-	if err := client.ValidateToken(); err != nil {
-		return fmt.Errorf("hetzner API: %w\n     Check your token in ~/.orama/sandbox.yaml", err)
-	}
-	fmt.Println("  [ok] Hetzner API token valid")
-
-	fmt.Println()
-
-	// --- All preflight checks passed, proceed ---
-
-	// Generate name if not provided
-	if name == "" {
-		name = GenerateName()
-	}
-
-	fmt.Printf("Creating sandbox %q (%s, %d nodes)\n\n", name, cfg.Domain, 5)
-
-	state := &SandboxState{
-		Name:      name,
-		CreatedAt: time.Now().UTC(),
-		Domain:    cfg.Domain,
-		Status:    StatusCreating,
-	}
-
-	// Phase 1: Provision servers
-	fmt.Println("Phase 1: Provisioning servers...")
-	if err := phase1ProvisionServers(client, cfg, state); err != nil {
-		cleanupFailedCreate(client, state)
-		return fmt.Errorf("provision servers: %w", err)
-	}
-	if err := SaveState(state); err != nil {
-		fmt.Fprintf(os.Stderr, "Warning: save state after provisioning: %v\n", err)
-	}
-
-	// Phase 2: Assign floating IPs
-	fmt.Println("\nPhase 2: Assigning floating IPs...")
-	if err := phase2AssignFloatingIPs(client, cfg, state, sshKeyPath); err != nil {
-		return fmt.Errorf("assign floating IPs: %w", err)
-	}
-	if err := SaveState(state); err != nil {
-		fmt.Fprintf(os.Stderr, "Warning: save state after floating IPs: %v\n", err)
-	}
-
-	// Phase 3: Upload binary archive
-	fmt.Println("\nPhase 3: Uploading binary archive...")
-	if err := phase3UploadArchive(state, sshKeyPath, archivePath); err != nil {
-		return fmt.Errorf("upload archive: %w", err)
-	}
-
-	// Phase 4: Install genesis node
-	fmt.Println("\nPhase 4: Installing genesis node...")
-	if err := phase4InstallGenesis(cfg, state, sshKeyPath); err != nil {
-		state.Status = StatusError
-		_ = SaveState(state)
-		return fmt.Errorf("install genesis: %w", err)
-	}
-
-	// Phase 5: Join remaining nodes
-	fmt.Println("\nPhase 5: Joining remaining nodes...")
-	if err := phase5JoinNodes(cfg, state, sshKeyPath); err != nil {
-		state.Status = StatusError
-		_ = SaveState(state)
-		return fmt.Errorf("join nodes: %w", err)
-	}
-
-	// Phase 6: Verify cluster
-	fmt.Println("\nPhase 6: Verifying cluster...")
-	phase6Verify(cfg, state, sshKeyPath)
-
-	state.Status = StatusRunning
-	if err := SaveState(state); err != nil {
-		return fmt.Errorf("save final state: %w", err)
-	}
-
-	printCreateSummary(cfg, state)
-	return nil
-}
-
-// checkAgentReady verifies the rootwallet agent is running, unlocked, and
-// that the desktop app is connected (required for first-time app approval).
-func checkAgentReady() error {
-	client := rwagent.New(os.Getenv("RW_AGENT_SOCK"))
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
-	defer cancel()
-
-	status, err := client.Status(ctx)
-	if err != nil {
-		if rwagent.IsNotRunning(err) {
-			return fmt.Errorf("rootwallet agent is not running\n\n  Start it with:\n    rw agent start && rw agent unlock")
-		}
-		return fmt.Errorf("rootwallet agent: %w", err)
-	}
-
-	return validateAgentStatus(status)
-}
-
-// validateAgentStatus checks that the agent status indicates readiness.
-// Separated from checkAgentReady for testability.
-func validateAgentStatus(status *rwagent.StatusResponse) error {
-	if status.Locked {
-		return fmt.Errorf("rootwallet agent is locked\n\n  Unlock it with:\n    rw agent unlock")
-	}
-
-	if status.ConnectedApps == 0 {
-		fmt.Println("  [!!] RootWallet desktop app is not open")
-		fmt.Println("       First-time use requires the desktop app to approve access.")
-		fmt.Println("       Open the RootWallet app, then re-run this command.")
-		return fmt.Errorf("RootWallet desktop app required for approval — open it and retry")
-	}
-
-	return nil
-}
-
-// resolveVaultKeyOnce resolves a wallet SSH key to a temp file.
-// Returns the key path, cleanup function, and any error.
-func resolveVaultKeyOnce(vaultTarget string) (string, func(), error) {
-	node := inspector.Node{User: "root", Host: "resolve-only", VaultTarget: vaultTarget}
-	nodes := []inspector.Node{node}
-	cleanup, err := remotessh.PrepareNodeKeys(nodes)
-	if err != nil {
-		return "", func() {}, err
-	}
-	return nodes[0].SSHKey, cleanup, nil
-}
-
-// phase1ProvisionServers creates 5 Hetzner servers in parallel.
-func phase1ProvisionServers(client *HetznerClient, cfg *Config, state *SandboxState) error {
-	type serverResult struct {
-		index  int
-		server *HetznerServer
-		err    error
-	}
-
-	results := make(chan serverResult, 5)
-
-	for i := 0; i < 5; i++ {
-		go func(idx int) {
-			role := "node"
-			if idx < 2 {
-				role = "nameserver"
-			}
-
-			serverName := fmt.Sprintf("sbx-%s-%d", state.Name, idx+1)
-			labels := map[string]string{
-				"orama-sandbox":      state.Name,
-				"orama-sandbox-role": role,
-			}
-
-			req := CreateServerRequest{
-				Name:       serverName,
-				ServerType: cfg.ServerType,
-				Image:      "ubuntu-24.04",
-				Location:   cfg.Location,
-				SSHKeys:    []int64{cfg.SSHKey.HetznerID},
-				Labels:     labels,
-			}
-			if cfg.FirewallID > 0 {
-				req.Firewalls = []struct {
-					Firewall int64 `json:"firewall"`
-				}{{Firewall: cfg.FirewallID}}
-			}
-
-			srv, err := client.CreateServer(req)
-			results <- serverResult{index: idx, server: srv, err: err}
-		}(i)
-	}
-
-	servers := make([]ServerState, 5)
-	var firstErr error
-	for i := 0; i < 5; i++ {
-		r := <-results
-		if r.err != nil {
-			if firstErr == nil {
-				firstErr = fmt.Errorf("server %d: %w", r.index+1, r.err)
-			}
-			continue
-		}
-		fmt.Printf("  Created %s (ID: %d, initializing...)\n", r.server.Name, r.server.ID)
-		role := "node"
-		if r.index < 2 {
-			role = "nameserver"
-		}
-		servers[r.index] = ServerState{
-			ID:   r.server.ID,
-			Name: r.server.Name,
-			Role: role,
-		}
-	}
-	state.Servers = servers // populate before returning so cleanup can delete created servers
-	if firstErr != nil {
-		return firstErr
-	}
-
-	// Wait for all servers to reach "running"
-	fmt.Print("  Waiting for servers to boot...")
-	for i := range servers {
-		srv, err := client.WaitForServer(servers[i].ID, 3*time.Minute)
-		if err != nil {
-			return fmt.Errorf("wait for %s: %w", servers[i].Name, err)
-		}
-		servers[i].IP = srv.PublicNet.IPv4.IP
-		fmt.Print(".")
-	}
-	fmt.Println(" OK")
-
-	// Assign floating IPs to nameserver entries
-	if len(cfg.FloatingIPs) >= 2 {
-		servers[0].FloatingIP = cfg.FloatingIPs[0].IP
-		servers[1].FloatingIP = cfg.FloatingIPs[1].IP
-	}
-
-	state.Servers = servers
-
-	for _, srv := range servers {
-		fmt.Printf("  %s: %s (%s)\n", srv.Name, srv.IP, srv.Role)
-	}
-
-	return nil
-}
-
-// phase2AssignFloatingIPs assigns floating IPs and configures loopback.
-func phase2AssignFloatingIPs(client *HetznerClient, cfg *Config, state *SandboxState, sshKeyPath string) error {
-	for i := 0; i < 2 && i < len(cfg.FloatingIPs) && i < len(state.Servers); i++ {
-		fip := cfg.FloatingIPs[i]
-		srv := state.Servers[i]
-
-		// Unassign if currently assigned elsewhere (ignore "not assigned" errors)
-		fmt.Printf("  Assigning %s to %s...\n", fip.IP, srv.Name)
-		if err := client.UnassignFloatingIP(fip.ID); err != nil {
-			// Log but continue — may fail if not currently assigned, which is fine
-			fmt.Printf("  Note: unassign %s: %v (continuing)\n", fip.IP, err)
-		}
-
-		if err := client.AssignFloatingIP(fip.ID, srv.ID); err != nil {
-			return fmt.Errorf("assign %s to %s: %w", fip.IP, srv.Name, err)
-		}
-
-		// Configure floating IP on the server's loopback interface
-		// Hetzner floating IPs require this: ip addr add <floating_ip>/32 dev lo
-		node := inspector.Node{
-			User:   "root",
-			Host:   srv.IP,
-			SSHKey: sshKeyPath,
-		}
-
-		// Wait for SSH to be ready on freshly booted servers
-		if err := waitForSSH(node, 5*time.Minute); err != nil {
-			return fmt.Errorf("SSH not ready on %s: %w", srv.Name, err)
-		}
-
-		cmd := fmt.Sprintf("ip addr add %s/32 dev lo 2>/dev/null || true", fip.IP)
-		if err := remotessh.RunSSHStreaming(node, cmd, remotessh.WithNoHostKeyCheck()); err != nil {
-			return fmt.Errorf("configure loopback on %s: %w", srv.Name, err)
-		}
-	}
-
-	return nil
-}
-
-// waitForSSH polls until SSH is responsive on the node.
-func waitForSSH(node inspector.Node, timeout time.Duration) error {
-	deadline := time.Now().Add(timeout)
-	for time.Now().Before(deadline) {
-		_, err := runSSHOutput(node, "echo ok")
-		if err == nil {
-			return nil
-		}
-		time.Sleep(3 * time.Second)
-	}
-	return fmt.Errorf("timeout after %s", timeout)
-}
-
-// autoBuildArchive runs `make build-archive` from the project root.
-func autoBuildArchive() error {
-	// Find project root by looking for go.mod
-	dir, err := findProjectRoot()
-	if err != nil {
-		return fmt.Errorf("find project root: %w", err)
-	}
-
-	cmd := exec.Command("make", "build-archive")
-	cmd.Dir = dir
-	cmd.Stdout = os.Stdout
-	cmd.Stderr = os.Stderr
-	if err := cmd.Run(); err != nil {
-		return fmt.Errorf("make build-archive failed: %w", err)
-	}
-	return nil
-}
-
-// findProjectRoot walks up from the current working directory to find go.mod.
-func findProjectRoot() (string, error) {
-	dir, err := os.Getwd()
-	if err != nil {
-		return "", err
-	}
-	for {
-		if _, err := os.Stat(filepath.Join(dir, "go.mod")); err == nil {
-			return dir, nil
-		}
-		parent := filepath.Dir(dir)
-		if parent == dir {
-			return "", fmt.Errorf("could not find go.mod in any parent directory")
-		}
-		dir = parent
-	}
-}
-
-// phase3UploadArchive uploads the binary archive to the genesis node, then fans out
-// to the remaining nodes server-to-server (much faster than uploading from local machine).
-func phase3UploadArchive(state *SandboxState, sshKeyPath, archivePath string) error {
-	fmt.Printf("  Archive: %s\n", filepath.Base(archivePath))
-
-	if err := fanoutArchive(state.Servers, sshKeyPath, archivePath); err != nil {
-		return err
-	}
-
-	fmt.Println("  All nodes ready")
-	return nil
-}
-
-// phase4InstallGenesis installs the genesis node.
-func phase4InstallGenesis(cfg *Config, state *SandboxState, sshKeyPath string) error {
-	genesis := state.GenesisServer()
-	node := inspector.Node{User: "root", Host: genesis.IP, SSHKey: sshKeyPath}
-
-	// Install genesis
-	installCmd := fmt.Sprintf("/opt/orama/bin/orama node install --vps-ip %s --domain %s --base-domain %s --nameserver --anyone-client --skip-checks",
-		genesis.IP, cfg.Domain, cfg.Domain)
-	fmt.Printf("  Installing on %s (%s)...\n", genesis.Name, genesis.IP)
-	if err := remotessh.RunSSHStreaming(node, installCmd, remotessh.WithNoHostKeyCheck()); err != nil {
-		return fmt.Errorf("install genesis: %w", err)
-	}
-
-	// Wait for RQLite leader
-	fmt.Print("  Waiting for RQLite leader...")
-	if err := waitForRQLiteHealth(node, 3*time.Minute); err != nil {
-		return fmt.Errorf("genesis health: %w", err)
-	}
-	fmt.Println(" OK")
-
-	return nil
-}
-
-// phase5JoinNodes joins the remaining 4 nodes to the cluster (serial).
-// Generates invite tokens just-in-time to avoid expiry during long installs.
-func phase5JoinNodes(cfg *Config, state *SandboxState, sshKeyPath string) error {
-	genesis := state.GenesisServer()
-	genesisNode := inspector.Node{User: "root", Host: genesis.IP, SSHKey: sshKeyPath}
-
-	for i := 1; i < len(state.Servers); i++ {
-		srv := state.Servers[i]
-		node := inspector.Node{User: "root", Host: srv.IP, SSHKey: sshKeyPath}
-
-		// Generate token just before use to avoid expiry
-		token, err := generateInviteToken(genesisNode)
-		if err != nil {
-			return fmt.Errorf("generate invite token for %s: %w", srv.Name, err)
-		}
-
-		var installCmd string
-		if srv.Role == "nameserver" {
-			installCmd = fmt.Sprintf("/opt/orama/bin/orama node install --join http://%s --token %s --vps-ip %s --domain %s --base-domain %s --nameserver --anyone-client --skip-checks",
-				genesis.IP, token, srv.IP, cfg.Domain, cfg.Domain)
-		} else {
-			installCmd = fmt.Sprintf("/opt/orama/bin/orama node install --join http://%s --token %s --vps-ip %s --base-domain %s --anyone-client --skip-checks",
-				genesis.IP, token, srv.IP, cfg.Domain)
-		}
-
-		fmt.Printf("  [%d/%d] Joining %s (%s, %s)...\n", i, len(state.Servers)-1, srv.Name, srv.IP, srv.Role)
-		if err := remotessh.RunSSHStreaming(node, installCmd, remotessh.WithNoHostKeyCheck()); err != nil {
-			return fmt.Errorf("join %s: %w", srv.Name, err)
-		}
-
-		// Wait for node health before proceeding
-		fmt.Printf("  Waiting for %s health...", srv.Name)
-		if err := waitForRQLiteHealth(node, 3*time.Minute); err != nil {
-			fmt.Printf(" WARN: %v\n", err)
-		} else {
-			fmt.Println(" OK")
-		}
-	}
-
-	return nil
-}
-
-// phase6Verify runs a basic cluster health check.
-func phase6Verify(cfg *Config, state *SandboxState, sshKeyPath string) {
-	genesis := state.GenesisServer()
-	node := inspector.Node{User: "root", Host: genesis.IP, SSHKey: sshKeyPath}
-
-	// Check RQLite cluster
-	out, err := runSSHOutput(node, "curl -s http://localhost:5001/status | grep -o '\"state\":\"[^\"]*\"' | head -1")
-	if err == nil {
-		fmt.Printf("  RQLite: %s\n", strings.TrimSpace(out))
-	}
-
-	// Check DNS (if floating IPs configured, only with safe domain names)
-	if len(cfg.FloatingIPs) > 0 && isSafeDNSName(cfg.Domain) {
-		out, err = runSSHOutput(node, fmt.Sprintf("dig +short @%s test.%s 2>/dev/null || echo 'DNS not responding'",
-			cfg.FloatingIPs[0].IP, cfg.Domain))
-		if err == nil {
-			fmt.Printf("  DNS: %s\n", strings.TrimSpace(out))
-		}
-	}
-}
-
-// waitForRQLiteHealth polls RQLite until it reports Leader or Follower state.
-func waitForRQLiteHealth(node inspector.Node, timeout time.Duration) error {
-	deadline := time.Now().Add(timeout)
-	for time.Now().Before(deadline) {
-		out, err := runSSHOutput(node, "curl -sf http://localhost:5001/status 2>/dev/null | grep -o '\"state\":\"[^\"]*\"'")
-		if err == nil {
-			result := strings.TrimSpace(out)
-			if strings.Contains(result, "Leader") || strings.Contains(result, "Follower") {
-				return nil
-			}
-		}
-		time.Sleep(5 * time.Second)
-	}
-	return fmt.Errorf("timeout waiting for RQLite health after %s", timeout)
-}
-
-// generateInviteToken runs `orama node invite` on the node and parses the token.
-func generateInviteToken(node inspector.Node) (string, error) {
-	out, err := runSSHOutput(node, "/opt/orama/bin/orama node invite --expiry 1h 2>&1")
-	if err != nil {
-		return "", fmt.Errorf("invite command failed: %w", err)
-	}
-
-	// Parse token from output — the invite command outputs:
-	//   "sudo orama install --join https://... --token <64-char-hex> --vps-ip ..."
-	// Look for the --token flag value first
-	fields := strings.Fields(out)
-	for i, field := range fields {
-		if field == "--token" && i+1 < len(fields) {
-			candidate := fields[i+1]
-			if len(candidate) == 64 && isHex(candidate) {
-				return candidate, nil
-			}
-		}
-	}
-
-	// Fallback: look for any standalone 64-char hex string
-	for _, word := range fields {
-		if len(word) == 64 && isHex(word) {
-			return word, nil
-		}
-	}
-
-	return "", fmt.Errorf("could not parse token from invite output:\n%s", out)
-}
-
-// isSafeDNSName returns true if the string is safe to use in shell commands.
-func isSafeDNSName(s string) bool {
-	for _, c := range s {
-		if !((c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z') || (c >= '0' && c <= '9') || c == '.' || c == '-') {
-			return false
-		}
-	}
-	return len(s) > 0
-}
-
-// isHex returns true if s contains only hex characters.
-func isHex(s string) bool {
-	for _, c := range s {
-		if !((c >= '0' && c <= '9') || (c >= 'a' && c <= 'f') || (c >= 'A' && c <= 'F')) {
-			return false
-		}
-	}
-	return true
-}
-
-// runSSHOutput runs a command via SSH and returns stdout as a string.
-// Uses StrictHostKeyChecking=no because sandbox IPs are frequently recycled.
-func runSSHOutput(node inspector.Node, command string) (string, error) {
-	args := []string{
-		"ssh", "-n",
-		"-o", "StrictHostKeyChecking=no",
-		"-o", "UserKnownHostsFile=/dev/null",
-		"-o", "ConnectTimeout=10",
-		"-o", "BatchMode=yes",
-		"-i", node.SSHKey,
-		fmt.Sprintf("%s@%s", node.User, node.Host),
-		command,
-	}
-
-	out, err := execCommand(args[0], args[1:]...)
-	return string(out), err
-}
-
-// execCommand runs a command and returns its output.
-func execCommand(name string, args ...string) ([]byte, error) {
-	return exec.Command(name, args...).Output()
-}
-
-// findNewestArchive finds the newest binary archive in /tmp/.
-func findNewestArchive() string {
-	entries, err := os.ReadDir("/tmp")
-	if err != nil {
-		return ""
-	}
-
-	var best string
-	var bestMod int64
-	for _, entry := range entries {
-		name := entry.Name()
-		if strings.HasPrefix(name, "orama-") && strings.Contains(name, "-linux-") && strings.HasSuffix(name, ".tar.gz") {
-			info, err := entry.Info()
-			if err != nil {
-				continue
-			}
-			if info.ModTime().Unix() > bestMod {
-				best = filepath.Join("/tmp", name)
-				bestMod = info.ModTime().Unix()
-			}
-		}
-	}
-
-	return best
-}
-
-// formatBytes formats a byte count as human-readable.
-func formatBytes(b int64) string {
-	const unit = 1024
-	if b < unit {
-		return fmt.Sprintf("%d B", b)
-	}
-	div, exp := int64(unit), 0
-	for n := b / unit; n >= unit; n /= unit {
-		div *= unit
-		exp++
-	}
-	return fmt.Sprintf("%.1f %cB", float64(b)/float64(div), "KMGTPE"[exp])
-}
-
-// printCreateSummary prints the cluster summary after creation.
-func printCreateSummary(cfg *Config, state *SandboxState) {
-	fmt.Printf("\nSandbox %q ready (%d nodes)\n", state.Name, len(state.Servers))
-	fmt.Println()
-
-	fmt.Println("Nameservers:")
-	for _, srv := range state.NameserverNodes() {
-		floating := ""
-		if srv.FloatingIP != "" {
-			floating = fmt.Sprintf(" (floating: %s)", srv.FloatingIP)
-		}
-		fmt.Printf("  %s: %s%s\n", srv.Name, srv.IP, floating)
-	}
-
-	fmt.Println("Nodes:")
-	for _, srv := range state.RegularNodes() {
-		fmt.Printf("  %s: %s\n", srv.Name, srv.IP)
-	}
-
-	fmt.Println()
-	fmt.Printf("Domain:  %s\n", cfg.Domain)
-	fmt.Printf("Gateway: https://%s\n", cfg.Domain)
-	fmt.Println()
-	fmt.Println("SSH:     orama sandbox ssh 1")
-	fmt.Println("Destroy: orama sandbox destroy")
-}
-
-// cleanupFailedCreate deletes any servers that were created during a failed provision.
-func cleanupFailedCreate(client *HetznerClient, state *SandboxState) {
-	if len(state.Servers) == 0 {
-		return
-	}
-	fmt.Println("\nCleaning up failed creation...")
-	for _, srv := range state.Servers {
-		if srv.ID > 0 {
-			client.DeleteServer(srv.ID)
-			fmt.Printf("  Deleted %s\n", srv.Name)
-		}
-	}
-	DeleteState(state.Name)
-}

core/pkg/cli/sandbox/create_test.go

@@ -1,158 +0,0 @@
-package sandbox
-
-import (
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"github.com/DeBrosOfficial/network/pkg/rwagent"
-)
-
-func TestFindProjectRoot_FromSubDir(t *testing.T) {
-	// Create a temp dir with go.mod (resolve symlinks for macOS /private/var)
-	root, _ := filepath.EvalSymlinks(t.TempDir())
-	if err := os.WriteFile(filepath.Join(root, "go.mod"), []byte("module test"), 0644); err != nil {
-		t.Fatal(err)
-	}
-
-	// Create a nested subdir
-	sub := filepath.Join(root, "pkg", "foo")
-	if err := os.MkdirAll(sub, 0755); err != nil {
-		t.Fatal(err)
-	}
-
-	// Change to subdir and find root
-	orig, _ := os.Getwd()
-	defer os.Chdir(orig)
-	os.Chdir(sub)
-
-	got, err := findProjectRoot()
-	if err != nil {
-		t.Fatalf("findProjectRoot() error: %v", err)
-	}
-	if got != root {
-		t.Errorf("findProjectRoot() = %q, want %q", got, root)
-	}
-}
-
-func TestFindProjectRoot_NoGoMod(t *testing.T) {
-	// Create a temp dir without go.mod
-	dir := t.TempDir()
-
-	orig, _ := os.Getwd()
-	defer os.Chdir(orig)
-	os.Chdir(dir)
-
-	_, err := findProjectRoot()
-	if err == nil {
-		t.Error("findProjectRoot() should error when no go.mod exists")
-	}
-}
-
-func TestFindNewestArchive_NoArchives(t *testing.T) {
-	// findNewestArchive scans /tmp — just verify it returns "" when
-	// no matching files exist (this is the normal case in CI).
-	// We can't fully control /tmp, but we can verify the function doesn't crash.
-	result := findNewestArchive()
-	// Result is either "" or a valid path — both are acceptable
-	if result != "" {
-		if _, err := os.Stat(result); err != nil {
-			t.Errorf("findNewestArchive() returned non-existent path: %s", result)
-		}
-	}
-}
-
-func TestIsSafeDNSName(t *testing.T) {
-	tests := []struct {
-		input string
-		want  bool
-	}{
-		{"example.com", true},
-		{"test-cluster.orama.network", true},
-		{"a", true},
-		{"", false},
-		{"test;rm -rf /", false},
-		{"test$(whoami)", false},
-		{"test space", false},
-		{"test_underscore", false},
-		{"UPPER.case.OK", true},
-		{"123.456", true},
-	}
-	for _, tt := range tests {
-		got := isSafeDNSName(tt.input)
-		if got != tt.want {
-			t.Errorf("isSafeDNSName(%q) = %v, want %v", tt.input, got, tt.want)
-		}
-	}
-}
-
-func TestIsHex(t *testing.T) {
-	tests := []struct {
-		input string
-		want  bool
-	}{
-		{"abcdef0123456789", true},
-		{"ABCDEF", true},
-		{"0", true},
-		{"", true}, // vacuous truth, but guarded by len check in caller
-		{"xyz", false},
-		{"abcg", false},
-		{"abc def", false},
-	}
-	for _, tt := range tests {
-		got := isHex(tt.input)
-		if got != tt.want {
-			t.Errorf("isHex(%q) = %v, want %v", tt.input, got, tt.want)
-		}
-	}
-}
-
-func TestValidateAgentStatus_Locked(t *testing.T) {
-	status := &rwagent.StatusResponse{Locked: true, ConnectedApps: 1}
-	err := validateAgentStatus(status)
-	if err == nil {
-		t.Fatal("expected error for locked agent")
-	}
-	if !strings.Contains(err.Error(), "locked") {
-		t.Errorf("error should mention locked, got: %v", err)
-	}
-}
-
-func TestValidateAgentStatus_NoDesktopApp(t *testing.T) {
-	status := &rwagent.StatusResponse{Locked: false, ConnectedApps: 0}
-	err := validateAgentStatus(status)
-	if err == nil {
-		t.Fatal("expected error when no desktop app connected")
-	}
-	if !strings.Contains(err.Error(), "desktop app") {
-		t.Errorf("error should mention desktop app, got: %v", err)
-	}
-}
-
-func TestValidateAgentStatus_Ready(t *testing.T) {
-	status := &rwagent.StatusResponse{Locked: false, ConnectedApps: 1}
-	if err := validateAgentStatus(status); err != nil {
-		t.Errorf("expected no error for ready agent, got: %v", err)
-	}
-}
-
-func TestFormatBytes(t *testing.T) {
-	tests := []struct {
-		input int64
-		want  string
-	}{
-		{0, "0 B"},
-		{500, "500 B"},
-		{1024, "1.0 KB"},
-		{1536, "1.5 KB"},
-		{1048576, "1.0 MB"},
-		{1073741824, "1.0 GB"},
-	}
-	for _, tt := range tests {
-		got := formatBytes(tt.input)
-		if got != tt.want {
-			t.Errorf("formatBytes(%d) = %q, want %q", tt.input, got, tt.want)
-		}
-	}
-}

core/pkg/cli/sandbox/destroy.go

@@ -1,122 +0,0 @@
-package sandbox
-
-import (
-	"bufio"
-	"fmt"
-	"os"
-	"strings"
-	"sync"
-)
-
-// Destroy tears down a sandbox cluster.
-func Destroy(name string, force bool) error {
-	cfg, err := LoadConfig()
-	if err != nil {
-		return err
-	}
-
-	// Resolve sandbox name
-	state, err := resolveSandbox(name)
-	if err != nil {
-		return err
-	}
-
-	// Confirm destruction
-	if !force {
-		reader := bufio.NewReader(os.Stdin)
-		fmt.Printf("Destroy sandbox %q? This deletes %d servers. [y/N]: ", state.Name, len(state.Servers))
-		choice, _ := reader.ReadString('\n')
-		choice = strings.TrimSpace(strings.ToLower(choice))
-		if choice != "y" && choice != "yes" {
-			fmt.Println("Aborted.")
-			return nil
-		}
-	}
-
-	state.Status = StatusDestroying
-	SaveState(state) // best-effort status update
-
-	client := NewHetznerClient(cfg.HetznerAPIToken)
-
-	// Step 1: Unassign floating IPs from nameserver nodes
-	fmt.Println("Unassigning floating IPs...")
-	for _, srv := range state.NameserverNodes() {
-		if srv.FloatingIP == "" {
-			continue
-		}
-		// Find the floating IP ID from config
-		for _, fip := range cfg.FloatingIPs {
-			if fip.IP == srv.FloatingIP {
-				if err := client.UnassignFloatingIP(fip.ID); err != nil {
-					fmt.Fprintf(os.Stderr, "  Warning: could not unassign floating IP %s: %v\n", fip.IP, err)
-				} else {
-					fmt.Printf("  Unassigned %s from %s\n", fip.IP, srv.Name)
-				}
-				break
-			}
-		}
-	}
-
-	// Step 2: Delete all servers in parallel
-	fmt.Printf("Deleting %d servers...\n", len(state.Servers))
-	var wg sync.WaitGroup
-	var mu sync.Mutex
-	var failed []string
-
-	for _, srv := range state.Servers {
-		wg.Add(1)
-		go func(srv ServerState) {
-			defer wg.Done()
-			if err := client.DeleteServer(srv.ID); err != nil {
-				// Treat 404 as already deleted (idempotent)
-				if strings.Contains(err.Error(), "404") || strings.Contains(err.Error(), "not found") {
-					fmt.Printf("  %s (ID %d): already deleted\n", srv.Name, srv.ID)
-				} else {
-					mu.Lock()
-					failed = append(failed, fmt.Sprintf("%s (ID %d): %v", srv.Name, srv.ID, err))
-					mu.Unlock()
-					fmt.Fprintf(os.Stderr, "  Warning: failed to delete %s: %v\n", srv.Name, err)
-				}
-			} else {
-				fmt.Printf("  Deleted %s (ID %d)\n", srv.Name, srv.ID)
-			}
-		}(srv)
-	}
-	wg.Wait()
-
-	if len(failed) > 0 {
-		fmt.Fprintf(os.Stderr, "\nFailed to delete %d server(s):\n", len(failed))
-		for _, f := range failed {
-			fmt.Fprintf(os.Stderr, "  %s\n", f)
-		}
-		fmt.Fprintf(os.Stderr, "\nManual cleanup: delete servers at https://console.hetzner.cloud\n")
-		state.Status = StatusError
-		SaveState(state)
-		return fmt.Errorf("failed to delete %d server(s)", len(failed))
-	}
-
-	// Step 3: Remove state file
-	if err := DeleteState(state.Name); err != nil {
-		return fmt.Errorf("delete state: %w", err)
-	}
-
-	fmt.Printf("\nSandbox %q destroyed (%d servers deleted)\n", state.Name, len(state.Servers))
-	return nil
-}
-
-// resolveSandbox finds a sandbox by name or returns the active one.
-func resolveSandbox(name string) (*SandboxState, error) {
-	if name != "" {
-		return LoadState(name)
-	}
-
-	// Find the active sandbox
-	active, err := FindActiveSandbox()
-	if err != nil {
-		return nil, err
-	}
-	if active == nil {
-		return nil, fmt.Errorf("no active sandbox found, specify --name")
-	}
-	return active, nil
-}

core/pkg/cli/sandbox/fanout.go

@@ -1,84 +0,0 @@
-package sandbox
-
-import (
-	"fmt"
-	"path/filepath"
-	"sync"
-
-	"github.com/DeBrosOfficial/network/pkg/cli/remotessh"
-	"github.com/DeBrosOfficial/network/pkg/inspector"
-)
-
-// fanoutArchive uploads a binary archive to the first server, then fans out
-// server-to-server in parallel to all remaining servers. This is much faster
-// than uploading from the local machine to each node individually.
-// After distribution, the archive is extracted on all nodes.
-func fanoutArchive(servers []ServerState, sshKeyPath, archivePath string) error {
-	remotePath := "/tmp/" + filepath.Base(archivePath)
-	extractCmd := fmt.Sprintf("mkdir -p /opt/orama && tar xzf %s -C /opt/orama && rm -f %s",
-		remotePath, remotePath)
-
-	// Step 1: Upload from local machine to first node
-	first := servers[0]
-	firstNode := inspector.Node{User: "root", Host: first.IP, SSHKey: sshKeyPath}
-
-	fmt.Printf("  Uploading to %s...\n", first.Name)
-	if err := remotessh.UploadFile(firstNode, archivePath, remotePath, remotessh.WithNoHostKeyCheck()); err != nil {
-		return fmt.Errorf("upload to %s: %w", first.Name, err)
-	}
-
-	// Step 2: Fan out from first node to remaining nodes in parallel (server-to-server)
-	if len(servers) > 1 {
-		fmt.Printf("  Fanning out from %s to %d nodes...\n", first.Name, len(servers)-1)
-
-		// Temporarily upload SSH key for server-to-server SCP
-		remoteKeyPath := "/tmp/.sandbox_key"
-		if err := remotessh.UploadFile(firstNode, sshKeyPath, remoteKeyPath, remotessh.WithNoHostKeyCheck()); err != nil {
-			return fmt.Errorf("upload SSH key to %s: %w", first.Name, err)
-		}
-		defer remotessh.RunSSHStreaming(firstNode, fmt.Sprintf("rm -f %s", remoteKeyPath), remotessh.WithNoHostKeyCheck())
-
-		if err := remotessh.RunSSHStreaming(firstNode, fmt.Sprintf("chmod 600 %s", remoteKeyPath), remotessh.WithNoHostKeyCheck()); err != nil {
-			return fmt.Errorf("chmod SSH key on %s: %w", first.Name, err)
-		}
-
-		var wg sync.WaitGroup
-		errs := make([]error, len(servers))
-
-		for i := 1; i < len(servers); i++ {
-			wg.Add(1)
-			go func(idx int, srv ServerState) {
-				defer wg.Done()
-				// SCP from first node to target
-				scpCmd := fmt.Sprintf("scp -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i %s %s root@%s:%s",
-					remoteKeyPath, remotePath, srv.IP, remotePath)
-				if err := remotessh.RunSSHStreaming(firstNode, scpCmd, remotessh.WithNoHostKeyCheck()); err != nil {
-					errs[idx] = fmt.Errorf("fanout to %s: %w", srv.Name, err)
-					return
-				}
-				// Extract on target
-				targetNode := inspector.Node{User: "root", Host: srv.IP, SSHKey: sshKeyPath}
-				if err := remotessh.RunSSHStreaming(targetNode, extractCmd, remotessh.WithNoHostKeyCheck()); err != nil {
-					errs[idx] = fmt.Errorf("extract on %s: %w", srv.Name, err)
-					return
-				}
-				fmt.Printf("  Distributed to %s\n", srv.Name)
-			}(i, servers[i])
-		}
-		wg.Wait()
-
-		for _, err := range errs {
-			if err != nil {
-				return err
-			}
-		}
-	}
-
-	// Step 3: Extract on first node
-	fmt.Printf("  Extracting on %s...\n", first.Name)
-	if err := remotessh.RunSSHStreaming(firstNode, extractCmd, remotessh.WithNoHostKeyCheck()); err != nil {
-		return fmt.Errorf("extract on %s: %w", first.Name, err)
-	}
-
-	return nil
-}

core/pkg/cli/sandbox/hetzner.go

@@ -1,538 +0,0 @@
-package sandbox
-
-import (
-	"bytes"
-	"encoding/json"
-	"fmt"
-	"io"
-	"net/http"
-	"strconv"
-	"time"
-)
-
-const hetznerBaseURL = "https://api.hetzner.cloud/v1"
-
-// HetznerClient is a minimal Hetzner Cloud API client.
-type HetznerClient struct {
-	token      string
-	httpClient *http.Client
-}
-
-// NewHetznerClient creates a new Hetzner API client.
-func NewHetznerClient(token string) *HetznerClient {
-	return &HetznerClient{
-		token: token,
-		httpClient: &http.Client{
-			Timeout: 30 * time.Second,
-		},
-	}
-}
-
-// --- Request helpers ---
-
-func (c *HetznerClient) doRequest(method, path string, body interface{}) ([]byte, int, error) {
-	var bodyReader io.Reader
-	if body != nil {
-		data, err := json.Marshal(body)
-		if err != nil {
-			return nil, 0, fmt.Errorf("marshal request body: %w", err)
-		}
-		bodyReader = bytes.NewReader(data)
-	}
-
-	req, err := http.NewRequest(method, hetznerBaseURL+path, bodyReader)
-	if err != nil {
-		return nil, 0, fmt.Errorf("create request: %w", err)
-	}
-
-	req.Header.Set("Authorization", "Bearer "+c.token)
-	if body != nil {
-		req.Header.Set("Content-Type", "application/json")
-	}
-
-	resp, err := c.httpClient.Do(req)
-	if err != nil {
-		return nil, 0, fmt.Errorf("request %s %s: %w", method, path, err)
-	}
-	defer resp.Body.Close()
-
-	respBody, err := io.ReadAll(resp.Body)
-	if err != nil {
-		return nil, resp.StatusCode, fmt.Errorf("read response: %w", err)
-	}
-
-	return respBody, resp.StatusCode, nil
-}
-
-func (c *HetznerClient) get(path string) ([]byte, error) {
-	body, status, err := c.doRequest("GET", path, nil)
-	if err != nil {
-		return nil, err
-	}
-	if status < 200 || status >= 300 {
-		return nil, parseHetznerError(body, status)
-	}
-	return body, nil
-}
-
-func (c *HetznerClient) post(path string, payload interface{}) ([]byte, error) {
-	body, status, err := c.doRequest("POST", path, payload)
-	if err != nil {
-		return nil, err
-	}
-	if status < 200 || status >= 300 {
-		return nil, parseHetznerError(body, status)
-	}
-	return body, nil
-}
-
-func (c *HetznerClient) delete(path string) error {
-	_, status, err := c.doRequest("DELETE", path, nil)
-	if err != nil {
-		return err
-	}
-	if status < 200 || status >= 300 {
-		return fmt.Errorf("delete %s: HTTP %d", path, status)
-	}
-	return nil
-}
-
-// --- API types ---
-
-// HetznerServer represents a Hetzner Cloud server.
-type HetznerServer struct {
-	ID         int64            `json:"id"`
-	Name       string           `json:"name"`
-	Status     string           `json:"status"` // initializing, running, off, ...
-	PublicNet  HetznerPublicNet `json:"public_net"`
-	Labels     map[string]string `json:"labels"`
-	ServerType struct {
-		Name string `json:"name"`
-	} `json:"server_type"`
-}
-
-// HetznerPublicNet holds public networking info for a server.
-type HetznerPublicNet struct {
-	IPv4 struct {
-		IP string `json:"ip"`
-	} `json:"ipv4"`
-}
-
-// HetznerFloatingIP represents a Hetzner floating IP.
-type HetznerFloatingIP struct {
-	ID          int64             `json:"id"`
-	IP          string            `json:"ip"`
-	Server      *int64            `json:"server"` // nil if unassigned
-	Labels      map[string]string `json:"labels"`
-	Description string            `json:"description"`
-	HomeLocation struct {
-		Name string `json:"name"`
-	} `json:"home_location"`
-}
-
-// HetznerSSHKey represents a Hetzner SSH key.
-type HetznerSSHKey struct {
-	ID          int64  `json:"id"`
-	Name        string `json:"name"`
-	Fingerprint string `json:"fingerprint"`
-	PublicKey   string `json:"public_key"`
-}
-
-// HetznerFirewall represents a Hetzner firewall.
-type HetznerFirewall struct {
-	ID    int64             `json:"id"`
-	Name  string            `json:"name"`
-	Rules []HetznerFWRule   `json:"rules"`
-	Labels map[string]string `json:"labels"`
-}
-
-// HetznerFWRule represents a firewall rule.
-type HetznerFWRule struct {
-	Direction   string   `json:"direction"`
-	Protocol    string   `json:"protocol"`
-	Port        string   `json:"port"`
-	SourceIPs   []string `json:"source_ips"`
-	Description string   `json:"description,omitempty"`
-}
-
-// HetznerError represents an API error response.
-type HetznerError struct {
-	Error struct {
-		Code    string `json:"code"`
-		Message string `json:"message"`
-	} `json:"error"`
-}
-
-func parseHetznerError(body []byte, status int) error {
-	var he HetznerError
-	if err := json.Unmarshal(body, &he); err == nil && he.Error.Message != "" {
-		return fmt.Errorf("hetzner API error (HTTP %d): %s — %s", status, he.Error.Code, he.Error.Message)
-	}
-	return fmt.Errorf("hetzner API error: HTTP %d", status)
-}
-
-// --- Server operations ---
-
-// CreateServerRequest holds parameters for server creation.
-type CreateServerRequest struct {
-	Name       string            `json:"name"`
-	ServerType string            `json:"server_type"`
-	Image      string            `json:"image"`
-	Location   string            `json:"location"`
-	SSHKeys    []int64           `json:"ssh_keys"`
-	Labels     map[string]string `json:"labels"`
-	Firewalls  []struct {
-		Firewall int64 `json:"firewall"`
-	} `json:"firewalls,omitempty"`
-}
-
-// CreateServer creates a new server and returns it.
-func (c *HetznerClient) CreateServer(req CreateServerRequest) (*HetznerServer, error) {
-	body, err := c.post("/servers", req)
-	if err != nil {
-		return nil, fmt.Errorf("create server %q: %w", req.Name, err)
-	}
-
-	var resp struct {
-		Server HetznerServer `json:"server"`
-	}
-	if err := json.Unmarshal(body, &resp); err != nil {
-		return nil, fmt.Errorf("parse create server response: %w", err)
-	}
-
-	return &resp.Server, nil
-}
-
-// GetServer retrieves a server by ID.
-func (c *HetznerClient) GetServer(id int64) (*HetznerServer, error) {
-	body, err := c.get("/servers/" + strconv.FormatInt(id, 10))
-	if err != nil {
-		return nil, fmt.Errorf("get server %d: %w", id, err)
-	}
-
-	var resp struct {
-		Server HetznerServer `json:"server"`
-	}
-	if err := json.Unmarshal(body, &resp); err != nil {
-		return nil, fmt.Errorf("parse server response: %w", err)
-	}
-
-	return &resp.Server, nil
-}
-
-// DeleteServer deletes a server by ID.
-func (c *HetznerClient) DeleteServer(id int64) error {
-	return c.delete("/servers/" + strconv.FormatInt(id, 10))
-}
-
-// ListServersByLabel lists servers filtered by a label selector.
-func (c *HetznerClient) ListServersByLabel(selector string) ([]HetznerServer, error) {
-	body, err := c.get("/servers?label_selector=" + selector)
-	if err != nil {
-		return nil, fmt.Errorf("list servers: %w", err)
-	}
-
-	var resp struct {
-		Servers []HetznerServer `json:"servers"`
-	}
-	if err := json.Unmarshal(body, &resp); err != nil {
-		return nil, fmt.Errorf("parse servers response: %w", err)
-	}
-
-	return resp.Servers, nil
-}
-
-// WaitForServer polls until the server reaches "running" status.
-func (c *HetznerClient) WaitForServer(id int64, timeout time.Duration) (*HetznerServer, error) {
-	deadline := time.Now().Add(timeout)
-	for time.Now().Before(deadline) {
-		srv, err := c.GetServer(id)
-		if err != nil {
-			return nil, err
-		}
-		if srv.Status == "running" {
-			return srv, nil
-		}
-		time.Sleep(3 * time.Second)
-	}
-	return nil, fmt.Errorf("server %d did not reach running state within %s", id, timeout)
-}
-
-// --- Floating IP operations ---
-
-// CreateFloatingIP creates a new floating IP.
-func (c *HetznerClient) CreateFloatingIP(location, description string, labels map[string]string) (*HetznerFloatingIP, error) {
-	payload := map[string]interface{}{
-		"type":         "ipv4",
-		"home_location": location,
-		"description":  description,
-		"labels":       labels,
-	}
-
-	body, err := c.post("/floating_ips", payload)
-	if err != nil {
-		return nil, fmt.Errorf("create floating IP: %w", err)
-	}
-
-	var resp struct {
-		FloatingIP HetznerFloatingIP `json:"floating_ip"`
-	}
-	if err := json.Unmarshal(body, &resp); err != nil {
-		return nil, fmt.Errorf("parse floating IP response: %w", err)
-	}
-
-	return &resp.FloatingIP, nil
-}
-
-// ListFloatingIPsByLabel lists floating IPs filtered by label.
-func (c *HetznerClient) ListFloatingIPsByLabel(selector string) ([]HetznerFloatingIP, error) {
-	body, err := c.get("/floating_ips?label_selector=" + selector)
-	if err != nil {
-		return nil, fmt.Errorf("list floating IPs: %w", err)
-	}
-
-	var resp struct {
-		FloatingIPs []HetznerFloatingIP `json:"floating_ips"`
-	}
-	if err := json.Unmarshal(body, &resp); err != nil {
-		return nil, fmt.Errorf("parse floating IPs response: %w", err)
-	}
-
-	return resp.FloatingIPs, nil
-}
-
-// AssignFloatingIP assigns a floating IP to a server.
-func (c *HetznerClient) AssignFloatingIP(floatingIPID, serverID int64) error {
-	payload := map[string]int64{"server": serverID}
-	_, err := c.post("/floating_ips/"+strconv.FormatInt(floatingIPID, 10)+"/actions/assign", payload)
-	if err != nil {
-		return fmt.Errorf("assign floating IP %d to server %d: %w", floatingIPID, serverID, err)
-	}
-	return nil
-}
-
-// UnassignFloatingIP removes a floating IP assignment.
-func (c *HetznerClient) UnassignFloatingIP(floatingIPID int64) error {
-	_, err := c.post("/floating_ips/"+strconv.FormatInt(floatingIPID, 10)+"/actions/unassign", struct{}{})
-	if err != nil {
-		return fmt.Errorf("unassign floating IP %d: %w", floatingIPID, err)
-	}
-	return nil
-}
-
-// --- SSH Key operations ---
-
-// UploadSSHKey uploads a public key to Hetzner.
-func (c *HetznerClient) UploadSSHKey(name, publicKey string) (*HetznerSSHKey, error) {
-	payload := map[string]string{
-		"name":       name,
-		"public_key": publicKey,
-	}
-
-	body, err := c.post("/ssh_keys", payload)
-	if err != nil {
-		return nil, fmt.Errorf("upload SSH key: %w", err)
-	}
-
-	var resp struct {
-		SSHKey HetznerSSHKey `json:"ssh_key"`
-	}
-	if err := json.Unmarshal(body, &resp); err != nil {
-		return nil, fmt.Errorf("parse SSH key response: %w", err)
-	}
-
-	return &resp.SSHKey, nil
-}
-
-// ListSSHKeysByFingerprint finds SSH keys matching a fingerprint.
-func (c *HetznerClient) ListSSHKeysByFingerprint(fingerprint string) ([]HetznerSSHKey, error) {
-	path := "/ssh_keys"
-	if fingerprint != "" {
-		path += "?fingerprint=" + fingerprint
-	}
-	body, err := c.get(path)
-	if err != nil {
-		return nil, fmt.Errorf("list SSH keys: %w", err)
-	}
-
-	var resp struct {
-		SSHKeys []HetznerSSHKey `json:"ssh_keys"`
-	}
-	if err := json.Unmarshal(body, &resp); err != nil {
-		return nil, fmt.Errorf("parse SSH keys response: %w", err)
-	}
-
-	return resp.SSHKeys, nil
-}
-
-// GetSSHKey retrieves an SSH key by ID.
-func (c *HetznerClient) GetSSHKey(id int64) (*HetznerSSHKey, error) {
-	body, err := c.get("/ssh_keys/" + strconv.FormatInt(id, 10))
-	if err != nil {
-		return nil, fmt.Errorf("get SSH key %d: %w", id, err)
-	}
-
-	var resp struct {
-		SSHKey HetznerSSHKey `json:"ssh_key"`
-	}
-	if err := json.Unmarshal(body, &resp); err != nil {
-		return nil, fmt.Errorf("parse SSH key response: %w", err)
-	}
-
-	return &resp.SSHKey, nil
-}
-
-// --- Firewall operations ---
-
-// CreateFirewall creates a firewall with the given rules.
-func (c *HetznerClient) CreateFirewall(name string, rules []HetznerFWRule, labels map[string]string) (*HetznerFirewall, error) {
-	payload := map[string]interface{}{
-		"name":   name,
-		"rules":  rules,
-		"labels": labels,
-	}
-
-	body, err := c.post("/firewalls", payload)
-	if err != nil {
-		return nil, fmt.Errorf("create firewall: %w", err)
-	}
-
-	var resp struct {
-		Firewall HetznerFirewall `json:"firewall"`
-	}
-	if err := json.Unmarshal(body, &resp); err != nil {
-		return nil, fmt.Errorf("parse firewall response: %w", err)
-	}
-
-	return &resp.Firewall, nil
-}
-
-// ListFirewallsByLabel lists firewalls filtered by label.
-func (c *HetznerClient) ListFirewallsByLabel(selector string) ([]HetznerFirewall, error) {
-	body, err := c.get("/firewalls?label_selector=" + selector)
-	if err != nil {
-		return nil, fmt.Errorf("list firewalls: %w", err)
-	}
-
-	var resp struct {
-		Firewalls []HetznerFirewall `json:"firewalls"`
-	}
-	if err := json.Unmarshal(body, &resp); err != nil {
-		return nil, fmt.Errorf("parse firewalls response: %w", err)
-	}
-
-	return resp.Firewalls, nil
-}
-
-// DeleteFirewall deletes a firewall by ID.
-func (c *HetznerClient) DeleteFirewall(id int64) error {
-	return c.delete("/firewalls/" + strconv.FormatInt(id, 10))
-}
-
-// DeleteFloatingIP deletes a floating IP by ID.
-func (c *HetznerClient) DeleteFloatingIP(id int64) error {
-	return c.delete("/floating_ips/" + strconv.FormatInt(id, 10))
-}
-
-// DeleteSSHKey deletes an SSH key by ID.
-func (c *HetznerClient) DeleteSSHKey(id int64) error {
-	return c.delete("/ssh_keys/" + strconv.FormatInt(id, 10))
-}
-
-// --- Location & Server Type operations ---
-
-// HetznerLocation represents a Hetzner datacenter location.
-type HetznerLocation struct {
-	ID          int64  `json:"id"`
-	Name        string `json:"name"`        // e.g., "fsn1", "nbg1", "hel1"
-	Description string `json:"description"` // e.g., "Falkenstein DC Park 1"
-	City        string `json:"city"`
-	Country     string `json:"country"` // ISO 3166-1 alpha-2
-}
-
-// HetznerServerType represents a Hetzner server type with pricing.
-type HetznerServerType struct {
-	ID          int64   `json:"id"`
-	Name        string  `json:"name"`        // e.g., "cx22", "cx23"
-	Description string  `json:"description"` // e.g., "CX23"
-	Cores       int     `json:"cores"`
-	Memory      float64 `json:"memory"` // GB
-	Disk        int     `json:"disk"`   // GB
-	Architecture string `json:"architecture"`
-	Deprecation *struct {
-		Announced    string `json:"announced"`
-		UnavailableAfter string `json:"unavailable_after"`
-	} `json:"deprecation"` // nil = not deprecated
-	Prices []struct {
-		Location string `json:"location"`
-		Hourly   struct {
-			Gross string `json:"gross"`
-		} `json:"price_hourly"`
-		Monthly struct {
-			Gross string `json:"gross"`
-		} `json:"price_monthly"`
-	} `json:"prices"`
-}
-
-// ListLocations returns all available Hetzner datacenter locations.
-func (c *HetznerClient) ListLocations() ([]HetznerLocation, error) {
-	body, err := c.get("/locations")
-	if err != nil {
-		return nil, fmt.Errorf("list locations: %w", err)
-	}
-
-	var resp struct {
-		Locations []HetznerLocation `json:"locations"`
-	}
-	if err := json.Unmarshal(body, &resp); err != nil {
-		return nil, fmt.Errorf("parse locations response: %w", err)
-	}
-
-	return resp.Locations, nil
-}
-
-// ListServerTypes returns all available server types.
-func (c *HetznerClient) ListServerTypes() ([]HetznerServerType, error) {
-	body, err := c.get("/server_types?per_page=50")
-	if err != nil {
-		return nil, fmt.Errorf("list server types: %w", err)
-	}
-
-	var resp struct {
-		ServerTypes []HetznerServerType `json:"server_types"`
-	}
-	if err := json.Unmarshal(body, &resp); err != nil {
-		return nil, fmt.Errorf("parse server types response: %w", err)
-	}
-
-	return resp.ServerTypes, nil
-}
-
-// --- Validation ---
-
-// ValidateToken checks if the API token is valid by making a simple request.
-func (c *HetznerClient) ValidateToken() error {
-	_, err := c.get("/servers?per_page=1")
-	if err != nil {
-		return fmt.Errorf("invalid Hetzner API token: %w", err)
-	}
-	return nil
-}
-
-// --- Sandbox firewall rules ---
-
-// SandboxFirewallRules returns the standard firewall rules for sandbox nodes.
-func SandboxFirewallRules() []HetznerFWRule {
-	allIPv4 := []string{"0.0.0.0/0"}
-	allIPv6 := []string{"::/0"}
-	allIPs := append(allIPv4, allIPv6...)
-
-	return []HetznerFWRule{
-		{Direction: "in", Protocol: "tcp", Port: "22", SourceIPs: allIPs, Description: "SSH"},
-		{Direction: "in", Protocol: "tcp", Port: "53", SourceIPs: allIPs, Description: "DNS TCP"},
-		{Direction: "in", Protocol: "udp", Port: "53", SourceIPs: allIPs, Description: "DNS UDP"},
-		{Direction: "in", Protocol: "tcp", Port: "80", SourceIPs: allIPs, Description: "HTTP"},
-		{Direction: "in", Protocol: "tcp", Port: "443", SourceIPs: allIPs, Description: "HTTPS"},
-		{Direction: "in", Protocol: "udp", Port: "51820", SourceIPs: allIPs, Description: "WireGuard"},
-	}
-}

core/pkg/cli/sandbox/hetzner_test.go

@@ -1,303 +0,0 @@
-package sandbox
-
-import (
-	"encoding/json"
-	"net/http"
-	"net/http/httptest"
-	"testing"
-	"time"
-)
-
-func TestValidateToken_Success(t *testing.T) {
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.Header.Get("Authorization") != "Bearer test-token" {
-			t.Errorf("unexpected auth header: %s", r.Header.Get("Authorization"))
-		}
-		w.WriteHeader(200)
-		json.NewEncoder(w).Encode(map[string]interface{}{"servers": []interface{}{}})
-	}))
-	defer srv.Close()
-
-	client := newTestClient(srv, "test-token")
-	if err := client.ValidateToken(); err != nil {
-		t.Errorf("ValidateToken() error = %v, want nil", err)
-	}
-}
-
-func TestValidateToken_InvalidToken(t *testing.T) {
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.WriteHeader(401)
-		json.NewEncoder(w).Encode(map[string]interface{}{
-			"error": map[string]string{
-				"code":    "unauthorized",
-				"message": "unable to authenticate",
-			},
-		})
-	}))
-	defer srv.Close()
-
-	client := newTestClient(srv, "bad-token")
-	if err := client.ValidateToken(); err == nil {
-		t.Error("ValidateToken() expected error for invalid token")
-	}
-}
-
-func TestCreateServer(t *testing.T) {
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.Method != "POST" || r.URL.Path != "/v1/servers" {
-			t.Errorf("unexpected request: %s %s", r.Method, r.URL.Path)
-		}
-
-		var req CreateServerRequest
-		json.NewDecoder(r.Body).Decode(&req)
-
-		if req.Name != "sbx-test-1" {
-			t.Errorf("unexpected server name: %s", req.Name)
-		}
-		if req.ServerType != "cx22" {
-			t.Errorf("unexpected server type: %s", req.ServerType)
-		}
-
-		w.WriteHeader(201)
-		json.NewEncoder(w).Encode(map[string]interface{}{
-			"server": map[string]interface{}{
-				"id":     12345,
-				"name":   req.Name,
-				"status": "initializing",
-				"public_net": map[string]interface{}{
-					"ipv4": map[string]string{"ip": "1.2.3.4"},
-				},
-				"labels":      req.Labels,
-				"server_type": map[string]string{"name": "cx22"},
-			},
-		})
-	}))
-	defer srv.Close()
-
-	client := newTestClient(srv, "test-token")
-	server, err := client.CreateServer(CreateServerRequest{
-		Name:       "sbx-test-1",
-		ServerType: "cx22",
-		Image:      "ubuntu-24.04",
-		Location:   "fsn1",
-		SSHKeys:    []int64{1},
-		Labels:     map[string]string{"orama-sandbox": "test"},
-	})
-
-	if err != nil {
-		t.Fatalf("CreateServer() error = %v", err)
-	}
-	if server.ID != 12345 {
-		t.Errorf("server ID = %d, want 12345", server.ID)
-	}
-	if server.Name != "sbx-test-1" {
-		t.Errorf("server name = %s, want sbx-test-1", server.Name)
-	}
-	if server.PublicNet.IPv4.IP != "1.2.3.4" {
-		t.Errorf("server IP = %s, want 1.2.3.4", server.PublicNet.IPv4.IP)
-	}
-}
-
-func TestDeleteServer(t *testing.T) {
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.Method != "DELETE" || r.URL.Path != "/v1/servers/12345" {
-			t.Errorf("unexpected request: %s %s", r.Method, r.URL.Path)
-		}
-		w.WriteHeader(200)
-	}))
-	defer srv.Close()
-
-	client := newTestClient(srv, "test-token")
-	if err := client.DeleteServer(12345); err != nil {
-		t.Errorf("DeleteServer() error = %v", err)
-	}
-}
-
-func TestListServersByLabel(t *testing.T) {
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.URL.Query().Get("label_selector") != "orama-sandbox=test" {
-			t.Errorf("unexpected label_selector: %s", r.URL.Query().Get("label_selector"))
-		}
-		w.WriteHeader(200)
-		json.NewEncoder(w).Encode(map[string]interface{}{
-			"servers": []map[string]interface{}{
-				{"id": 1, "name": "sbx-test-1", "status": "running", "public_net": map[string]interface{}{"ipv4": map[string]string{"ip": "1.1.1.1"}}, "server_type": map[string]string{"name": "cx22"}},
-				{"id": 2, "name": "sbx-test-2", "status": "running", "public_net": map[string]interface{}{"ipv4": map[string]string{"ip": "2.2.2.2"}}, "server_type": map[string]string{"name": "cx22"}},
-			},
-		})
-	}))
-	defer srv.Close()
-
-	client := newTestClient(srv, "test-token")
-	servers, err := client.ListServersByLabel("orama-sandbox=test")
-	if err != nil {
-		t.Fatalf("ListServersByLabel() error = %v", err)
-	}
-	if len(servers) != 2 {
-		t.Errorf("got %d servers, want 2", len(servers))
-	}
-}
-
-func TestWaitForServer_AlreadyRunning(t *testing.T) {
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.WriteHeader(200)
-		json.NewEncoder(w).Encode(map[string]interface{}{
-			"server": map[string]interface{}{
-				"id":     1,
-				"name":   "test",
-				"status": "running",
-				"public_net": map[string]interface{}{
-					"ipv4": map[string]string{"ip": "1.1.1.1"},
-				},
-				"server_type": map[string]string{"name": "cx22"},
-			},
-		})
-	}))
-	defer srv.Close()
-
-	client := newTestClient(srv, "test-token")
-	server, err := client.WaitForServer(1, 5*time.Second)
-	if err != nil {
-		t.Fatalf("WaitForServer() error = %v", err)
-	}
-	if server.Status != "running" {
-		t.Errorf("server status = %s, want running", server.Status)
-	}
-}
-
-func TestAssignFloatingIP(t *testing.T) {
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.Method != "POST" || r.URL.Path != "/v1/floating_ips/100/actions/assign" {
-			t.Errorf("unexpected request: %s %s", r.Method, r.URL.Path)
-		}
-
-		var body map[string]int64
-		json.NewDecoder(r.Body).Decode(&body)
-		if body["server"] != 200 {
-			t.Errorf("unexpected server ID: %d", body["server"])
-		}
-
-		w.WriteHeader(200)
-		json.NewEncoder(w).Encode(map[string]interface{}{"action": map[string]interface{}{"id": 1, "status": "running"}})
-	}))
-	defer srv.Close()
-
-	client := newTestClient(srv, "test-token")
-	if err := client.AssignFloatingIP(100, 200); err != nil {
-		t.Errorf("AssignFloatingIP() error = %v", err)
-	}
-}
-
-func TestUploadSSHKey(t *testing.T) {
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.Method != "POST" || r.URL.Path != "/v1/ssh_keys" {
-			t.Errorf("unexpected request: %s %s", r.Method, r.URL.Path)
-		}
-		w.WriteHeader(201)
-		json.NewEncoder(w).Encode(map[string]interface{}{
-			"ssh_key": map[string]interface{}{
-				"id":          42,
-				"name":        "orama-sandbox",
-				"fingerprint": "aa:bb:cc:dd",
-				"public_key":  "ssh-ed25519 AAAA...",
-			},
-		})
-	}))
-	defer srv.Close()
-
-	client := newTestClient(srv, "test-token")
-	key, err := client.UploadSSHKey("orama-sandbox", "ssh-ed25519 AAAA...")
-	if err != nil {
-		t.Fatalf("UploadSSHKey() error = %v", err)
-	}
-	if key.ID != 42 {
-		t.Errorf("key ID = %d, want 42", key.ID)
-	}
-}
-
-func TestCreateFirewall(t *testing.T) {
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.Method != "POST" || r.URL.Path != "/v1/firewalls" {
-			t.Errorf("unexpected request: %s %s", r.Method, r.URL.Path)
-		}
-		w.WriteHeader(201)
-		json.NewEncoder(w).Encode(map[string]interface{}{
-			"firewall": map[string]interface{}{
-				"id":   99,
-				"name": "orama-sandbox",
-			},
-		})
-	}))
-	defer srv.Close()
-
-	client := newTestClient(srv, "test-token")
-	fw, err := client.CreateFirewall("orama-sandbox", SandboxFirewallRules(), map[string]string{"orama-sandbox": "infra"})
-	if err != nil {
-		t.Fatalf("CreateFirewall() error = %v", err)
-	}
-	if fw.ID != 99 {
-		t.Errorf("firewall ID = %d, want 99", fw.ID)
-	}
-}
-
-func TestSandboxFirewallRules(t *testing.T) {
-	rules := SandboxFirewallRules()
-	if len(rules) != 6 {
-		t.Errorf("got %d rules, want 6", len(rules))
-	}
-
-	expectedPorts := map[string]bool{"22": false, "53": false, "80": false, "443": false, "51820": false}
-	for _, r := range rules {
-		expectedPorts[r.Port] = true
-		if r.Direction != "in" {
-			t.Errorf("rule %s direction = %s, want in", r.Port, r.Direction)
-		}
-	}
-	for port, seen := range expectedPorts {
-		if !seen {
-			t.Errorf("missing firewall rule for port %s", port)
-		}
-	}
-}
-
-func TestParseHetznerError(t *testing.T) {
-	body := `{"error":{"code":"uniqueness_error","message":"server name already used"}}`
-	err := parseHetznerError([]byte(body), 409)
-	if err == nil {
-		t.Fatal("expected error")
-	}
-	expected := "hetzner API error (HTTP 409): uniqueness_error — server name already used"
-	if err.Error() != expected {
-		t.Errorf("error = %q, want %q", err.Error(), expected)
-	}
-}
-
-// newTestClient creates a HetznerClient pointing at a test server.
-func newTestClient(ts *httptest.Server, token string) *HetznerClient {
-	client := NewHetznerClient(token)
-	// Override the base URL by using a custom transport
-	client.httpClient = ts.Client()
-	// We need to override the base URL — wrap the transport
-	origTransport := client.httpClient.Transport
-	client.httpClient.Transport = &testTransport{
-		base:    origTransport,
-		testURL: ts.URL,
-	}
-	return client
-}
-
-// testTransport rewrites requests to point at the test server.
-type testTransport struct {
-	base    http.RoundTripper
-	testURL string
-}
-
-func (t *testTransport) RoundTrip(req *http.Request) (*http.Response, error) {
-	// Rewrite the URL to point at the test server
-	req.URL.Scheme = "http"
-	req.URL.Host = t.testURL[len("http://"):]
-	if t.base != nil {
-		return t.base.RoundTrip(req)
-	}
-	return http.DefaultTransport.RoundTrip(req)
-}

core/pkg/cli/sandbox/names.go

@@ -1,26 +0,0 @@
-package sandbox
-
-import (
-	"math/rand"
-)
-
-var adjectives = []string{
-	"swift", "bright", "calm", "dark", "eager",
-	"fair", "gold", "hazy", "iron", "jade",
-	"keen", "lush", "mild", "neat", "opal",
-	"pure", "raw", "sage", "teal", "warm",
-}
-
-var nouns = []string{
-	"falcon", "beacon", "cedar", "delta", "ember",
-	"frost", "grove", "haven", "ivory", "jewel",
-	"knot", "latch", "maple", "nexus", "orbit",
-	"prism", "reef", "spark", "tide", "vault",
-}
-
-// GenerateName produces a random adjective-noun name like "swift-falcon".
-func GenerateName() string {
-	adj := adjectives[rand.Intn(len(adjectives))]
-	noun := nouns[rand.Intn(len(nouns))]
-	return adj + "-" + noun
-}

core/pkg/cli/sandbox/reset.go

@@ -1,119 +0,0 @@
-package sandbox
-
-import (
-	"bufio"
-	"fmt"
-	"os"
-	"strings"
-)
-
-// Reset tears down all sandbox infrastructure (floating IPs, firewall, SSH key)
-// and removes the config file so the user can rerun setup from scratch.
-// This is useful when switching datacenter locations (floating IPs are location-bound).
-func Reset() error {
-	fmt.Println("Sandbox Reset")
-	fmt.Println("=============")
-	fmt.Println()
-
-	cfg, err := LoadConfig()
-	if err != nil {
-		// Config doesn't exist — just clean up any local files
-		fmt.Println("No sandbox config found. Cleaning up local files...")
-		return resetLocalFiles()
-	}
-
-	// Check for active sandboxes — refuse to reset if clusters are still running
-	active, _ := FindActiveSandbox()
-	if active != nil {
-		return fmt.Errorf("active sandbox %q exists — run 'orama sandbox destroy' first", active.Name)
-	}
-
-	// Show what will be deleted
-	fmt.Println("This will delete the following Hetzner resources:")
-	for i, fip := range cfg.FloatingIPs {
-		fmt.Printf("  Floating IP %d: %s (ID: %d)\n", i+1, fip.IP, fip.ID)
-	}
-	if cfg.FirewallID != 0 {
-		fmt.Printf("  Firewall ID: %d\n", cfg.FirewallID)
-	}
-	if cfg.SSHKey.HetznerID != 0 {
-		fmt.Printf("  SSH Key ID: %d\n", cfg.SSHKey.HetznerID)
-	}
-	fmt.Println()
-	fmt.Println("Local files to remove:")
-	fmt.Println("  ~/.orama/sandbox.yaml")
-	fmt.Println()
-
-	reader := bufio.NewReader(os.Stdin)
-	fmt.Print("Delete all sandbox resources? [y/N]: ")
-	choice, _ := reader.ReadString('\n')
-	choice = strings.TrimSpace(strings.ToLower(choice))
-	if choice != "y" && choice != "yes" {
-		fmt.Println("Aborted.")
-		return nil
-	}
-
-	client := NewHetznerClient(cfg.HetznerAPIToken)
-
-	// Step 1: Delete floating IPs
-	fmt.Println()
-	fmt.Println("Deleting floating IPs...")
-	for _, fip := range cfg.FloatingIPs {
-		if err := client.DeleteFloatingIP(fip.ID); err != nil {
-			fmt.Fprintf(os.Stderr, "  Warning: could not delete floating IP %s (ID %d): %v\n", fip.IP, fip.ID, err)
-		} else {
-			fmt.Printf("  Deleted %s (ID %d)\n", fip.IP, fip.ID)
-		}
-	}
-
-	// Step 2: Delete firewall
-	if cfg.FirewallID != 0 {
-		fmt.Println("Deleting firewall...")
-		if err := client.DeleteFirewall(cfg.FirewallID); err != nil {
-			fmt.Fprintf(os.Stderr, "  Warning: could not delete firewall (ID %d): %v\n", cfg.FirewallID, err)
-		} else {
-			fmt.Printf("  Deleted firewall (ID %d)\n", cfg.FirewallID)
-		}
-	}
-
-	// Step 3: Delete SSH key from Hetzner
-	if cfg.SSHKey.HetznerID != 0 {
-		fmt.Println("Deleting SSH key from Hetzner...")
-		if err := client.DeleteSSHKey(cfg.SSHKey.HetznerID); err != nil {
-			fmt.Fprintf(os.Stderr, "  Warning: could not delete SSH key (ID %d): %v\n", cfg.SSHKey.HetznerID, err)
-		} else {
-			fmt.Printf("  Deleted SSH key (ID %d)\n", cfg.SSHKey.HetznerID)
-		}
-	}
-
-	// Step 4: Remove local files
-	if err := resetLocalFiles(); err != nil {
-		return err
-	}
-
-	fmt.Println()
-	fmt.Println("Reset complete. All sandbox resources deleted.")
-	fmt.Println()
-	fmt.Println("Next: orama sandbox setup")
-	return nil
-}
-
-// resetLocalFiles removes the sandbox config file.
-func resetLocalFiles() error {
-	dir, err := configDir()
-	if err != nil {
-		return err
-	}
-
-	configFile := dir + "/sandbox.yaml"
-	fmt.Println("Removing local files...")
-	if err := os.Remove(configFile); err != nil {
-		if !os.IsNotExist(err) {
-			fmt.Fprintf(os.Stderr, "  Warning: could not remove %s: %v\n", configFile, err)
-		}
-	} else {
-		fmt.Printf("  Removed %s\n", configFile)
-	}
-
-	return nil
-}

core/pkg/cli/sandbox/rollout.go

@@ -1,162 +0,0 @@
-package sandbox
-
-import (
-	"fmt"
-	"os"
-	"path/filepath"
-	"strings"
-	"time"
-
-	"github.com/DeBrosOfficial/network/pkg/cli/remotessh"
-	"github.com/DeBrosOfficial/network/pkg/inspector"
-)
-
-// RolloutFlags holds optional flags passed through to `orama node upgrade`.
-type RolloutFlags struct {
-	AnyoneClient bool
-}
-
-// Rollout builds, pushes, and performs a rolling upgrade on a sandbox cluster.
-func Rollout(name string, flags RolloutFlags) error {
-	cfg, err := LoadConfig()
-	if err != nil {
-		return err
-	}
-
-	state, err := resolveSandbox(name)
-	if err != nil {
-		return err
-	}
-
-	sshKeyPath, cleanup, err := resolveVaultKeyOnce(cfg.SSHKey.VaultTarget)
-	if err != nil {
-		return fmt.Errorf("prepare SSH key: %w", err)
-	}
-	defer cleanup()
-
-	fmt.Printf("Rolling out to sandbox %q (%d nodes)\n\n", state.Name, len(state.Servers))
-
-	// Step 1: Find or require binary archive
-	archivePath := findNewestArchive()
-	if archivePath == "" {
-		return fmt.Errorf("no binary archive found in /tmp/ (run `orama build` first)")
-	}
-
-	info, _ := os.Stat(archivePath)
-	fmt.Printf("Archive: %s (%s)\n\n", filepath.Base(archivePath), formatBytes(info.Size()))
-
-	// Build extra flags string for upgrade command
-	extraFlags := flags.upgradeFlags()
-
-	// Step 2: Push archive to all nodes (upload to first, fan out server-to-server)
-	fmt.Println("Pushing archive to all nodes...")
-	if err := fanoutArchive(state.Servers, sshKeyPath, archivePath); err != nil {
-		return err
-	}
-
-	// Step 3: Rolling upgrade — followers first, leader last
-	fmt.Println("\nRolling upgrade (followers first, leader last)...")
-
-	// Find the leader
-	leaderIdx := findLeaderIndex(state, sshKeyPath)
-	if leaderIdx < 0 {
-		fmt.Fprintf(os.Stderr, "  Warning: could not detect RQLite leader, upgrading in order\n")
-	}
-
-	// Upgrade non-leaders first
-	for i, srv := range state.Servers {
-		if i == leaderIdx {
-			continue // skip leader, do it last
-		}
-		if err := upgradeNode(srv, sshKeyPath, i+1, len(state.Servers), extraFlags); err != nil {
-			return err
-		}
-		// Wait between nodes
-		if i < len(state.Servers)-1 {
-			fmt.Printf("  Waiting 15s before next node...\n")
-			time.Sleep(15 * time.Second)
-		}
-	}
-
-	// Upgrade leader last
-	if leaderIdx >= 0 {
-		srv := state.Servers[leaderIdx]
-		if err := upgradeNode(srv, sshKeyPath, len(state.Servers), len(state.Servers), extraFlags); err != nil {
-			return err
-		}
-	}
-
-	fmt.Printf("\nRollout complete for sandbox %q\n", state.Name)
-	return nil
-}
-
-// upgradeFlags builds the extra CLI flags string for `orama node upgrade`.
-func (f RolloutFlags) upgradeFlags() string {
-	var parts []string
-	if f.AnyoneClient {
-		parts = append(parts, "--anyone-client")
-	}
-	return strings.Join(parts, " ")
-}
-
-// findLeaderIndex returns the index of the RQLite leader node, or -1 if unknown.
-func findLeaderIndex(state *SandboxState, sshKeyPath string) int {
-	for i, srv := range state.Servers {
-		node := inspector.Node{User: "root", Host: srv.IP, SSHKey: sshKeyPath}
-		out, err := runSSHOutput(node, "curl -sf http://localhost:5001/status 2>/dev/null | grep -o '\"state\":\"[^\"]*\"'")
-		if err == nil && contains(out, "Leader") {
-			return i
-		}
-	}
-	return -1
-}
-
-// upgradeNode performs `orama node upgrade --restart` on a single node.
-// It pre-replaces the orama CLI binary before running the upgrade command
-// to avoid ETXTBSY ("text file busy") errors when the old binary doesn't
-// have the os.Remove fix in copyBinary().
-func upgradeNode(srv ServerState, sshKeyPath string, current, total int, extraFlags string) error {
-	node := inspector.Node{User: "root", Host: srv.IP, SSHKey: sshKeyPath}
-
-	fmt.Printf("  [%d/%d] Upgrading %s (%s)...\n", current, total, srv.Name, srv.IP)
-
-	// Pre-replace the orama CLI so the upgrade runs the NEW binary (with ETXTBSY fix).
-	// rm unlinks the old inode (kernel keeps it alive for the running process),
-	// cp creates a fresh inode at the same path.
-	preReplace := "rm -f /usr/local/bin/orama && cp /opt/orama/bin/orama /usr/local/bin/orama"
-	if err := remotessh.RunSSHStreaming(node, preReplace, remotessh.WithNoHostKeyCheck()); err != nil {
-		return fmt.Errorf("pre-replace orama binary on %s: %w", srv.Name, err)
-	}
-
-	upgradeCmd := "orama node upgrade --restart"
-	if extraFlags != "" {
-		upgradeCmd += " " + extraFlags
-	}
-	if err := remotessh.RunSSHStreaming(node, upgradeCmd, remotessh.WithNoHostKeyCheck()); err != nil {
-		return fmt.Errorf("upgrade %s: %w", srv.Name, err)
-	}
-
-	// Wait for health
-	fmt.Printf("  Checking health...")
-	if err := waitForRQLiteHealth(node, 2*time.Minute); err != nil {
-		fmt.Printf(" WARN: %v\n", err)
-	} else {
-		fmt.Println(" OK")
-	}
-
-	return nil
-}
-
-// contains checks if s contains substr.
-func contains(s, substr string) bool {
-	return len(s) >= len(substr) && findSubstring(s, substr)
-}
-
-func findSubstring(s, substr string) bool {
-	for i := 0; i <= len(s)-len(substr); i++ {
-		if s[i:i+len(substr)] == substr {
-			return true
-		}
-	}
-	return false
-}

core/pkg/cli/sandbox/setup.go

@@ -1,582 +0,0 @@
-package sandbox
-
-import (
-	"bufio"
-	"fmt"
-	"os"
-	"os/exec"
-	"sort"
-	"strconv"
-	"strings"
-	"time"
-
-	"github.com/DeBrosOfficial/network/pkg/cli/remotessh"
-)
-
-// Setup runs the interactive sandbox setup wizard.
-func Setup() error {
-	fmt.Println("Orama Sandbox Setup")
-	fmt.Println("====================")
-	fmt.Println()
-
-	reader := bufio.NewReader(os.Stdin)
-
-	// Step 1: Hetzner API token
-	fmt.Print("Hetzner Cloud API token: ")
-	token, err := reader.ReadString('\n')
-	if err != nil {
-		return fmt.Errorf("read token: %w", err)
-	}
-	token = strings.TrimSpace(token)
-	if token == "" {
-		return fmt.Errorf("API token is required")
-	}
-
-	fmt.Print("  Validating token... ")
-	client := NewHetznerClient(token)
-	if err := client.ValidateToken(); err != nil {
-		fmt.Println("FAILED")
-		return fmt.Errorf("invalid token: %w", err)
-	}
-	fmt.Println("OK")
-	fmt.Println()
-
-	// Step 2: Domain
-	fmt.Print("Sandbox domain (e.g., sbx.dbrs.space): ")
-	domain, err := reader.ReadString('\n')
-	if err != nil {
-		return fmt.Errorf("read domain: %w", err)
-	}
-	domain = strings.TrimSpace(domain)
-	if domain == "" {
-		return fmt.Errorf("domain is required")
-	}
-
-	cfg := &Config{
-		HetznerAPIToken: token,
-		Domain:          domain,
-	}
-
-	// Step 3: Location selection
-	fmt.Println()
-	location, err := selectLocation(client, reader)
-	if err != nil {
-		return err
-	}
-	cfg.Location = location
-
-	// Step 4: Server type selection
-	fmt.Println()
-	serverType, err := selectServerType(client, reader, location)
-	if err != nil {
-		return err
-	}
-	cfg.ServerType = serverType
-
-	// Step 5: Floating IPs
-	fmt.Println()
-	fmt.Println("Checking floating IPs...")
-	floatingIPs, err := setupFloatingIPs(client, cfg.Location)
-	if err != nil {
-		return err
-	}
-	cfg.FloatingIPs = floatingIPs
-
-	// Step 6: Firewall
-	fmt.Println()
-	fmt.Println("Checking firewall...")
-	fwID, err := setupFirewall(client)
-	if err != nil {
-		return err
-	}
-	cfg.FirewallID = fwID
-
-	// Step 7: SSH key
-	fmt.Println()
-	fmt.Println("Setting up SSH key...")
-	sshKeyConfig, err := setupSSHKey(client)
-	if err != nil {
-		return err
-	}
-	cfg.SSHKey = sshKeyConfig
-
-	// Step 8: Display DNS instructions
-	fmt.Println()
-	fmt.Println("DNS Configuration")
-	fmt.Println("-----------------")
-	fmt.Println("Configure the following at your domain registrar:")
-	fmt.Println()
-	fmt.Printf("  1. Add glue records (Personal DNS Servers):\n")
-	fmt.Printf("     ns1.%s  ->  %s\n", domain, cfg.FloatingIPs[0].IP)
-	fmt.Printf("     ns2.%s  ->  %s\n", domain, cfg.FloatingIPs[1].IP)
-	fmt.Println()
-	fmt.Printf("  2. Set custom nameservers for %s:\n", domain)
-	fmt.Printf("     ns1.%s\n", domain)
-	fmt.Printf("     ns2.%s\n", domain)
-	fmt.Println()
-
-	// Step 9: Verify DNS (optional)
-	fmt.Print("Verify DNS now? [y/N]: ")
-	verifyChoice, _ := reader.ReadString('\n')
-	verifyChoice = strings.TrimSpace(strings.ToLower(verifyChoice))
-	if verifyChoice == "y" || verifyChoice == "yes" {
-		verifyDNS(domain, cfg.FloatingIPs, reader)
-	}
-
-	// Save config
-	if err := SaveConfig(cfg); err != nil {
-		return fmt.Errorf("save config: %w", err)
-	}
-
-	fmt.Println()
-	fmt.Println("Setup complete! Config saved to ~/.orama/sandbox.yaml")
-	fmt.Println()
-	fmt.Println("Next: orama sandbox create")
-	return nil
-}
-
-// selectLocation fetches available Hetzner locations and lets the user pick one.
-func selectLocation(client *HetznerClient, reader *bufio.Reader) (string, error) {
-	fmt.Println("Fetching available locations...")
-	locations, err := client.ListLocations()
-	if err != nil {
-		return "", fmt.Errorf("list locations: %w", err)
-	}
-
-	sort.Slice(locations, func(i, j int) bool {
-		return locations[i].Name < locations[j].Name
-	})
-
-	defaultLoc := "nbg1"
-	fmt.Println("  Available datacenter locations:")
-	for i, loc := range locations {
-		def := ""
-		if loc.Name == defaultLoc {
-			def = " (default)"
-		}
-		fmt.Printf("    %d) %s — %s, %s%s\n", i+1, loc.Name, loc.City, loc.Country, def)
-	}
-
-	fmt.Printf("\n  Select location [%s]: ", defaultLoc)
-	choice, _ := reader.ReadString('\n')
-	choice = strings.TrimSpace(choice)
-
-	if choice == "" {
-		fmt.Printf("  Using %s\n", defaultLoc)
-		return defaultLoc, nil
-	}
-
-	// Try as number first
-	if num, err := strconv.Atoi(choice); err == nil && num >= 1 && num <= len(locations) {
-		loc := locations[num-1].Name
-		fmt.Printf("  Using %s\n", loc)
-		return loc, nil
-	}
-
-	// Try as location name
-	for _, loc := range locations {
-		if strings.EqualFold(loc.Name, choice) {
-			fmt.Printf("  Using %s\n", loc.Name)
-			return loc.Name, nil
-		}
-	}
-
-	return "", fmt.Errorf("unknown location %q", choice)
-}
-
-// selectServerType fetches available server types for a location and lets the user pick one.
-func selectServerType(client *HetznerClient, reader *bufio.Reader, location string) (string, error) {
-	fmt.Println("Fetching available server types...")
-	serverTypes, err := client.ListServerTypes()
-	if err != nil {
-		return "", fmt.Errorf("list server types: %w", err)
-	}
-
-	// Filter to x86 shared-vCPU types available at the selected location, skip deprecated
-	type option struct {
-		name    string
-		cores   int
-		memory  float64
-		disk    int
-		hourly  string
-		monthly string
-	}
-
-	var options []option
-	for _, st := range serverTypes {
-		if st.Architecture != "x86" {
-			continue
-		}
-		if st.Deprecation != nil {
-			continue
-		}
-		// Only show shared-vCPU types (cx/cpx prefixes) — skip dedicated (ccx/cx5x)
-		if !strings.HasPrefix(st.Name, "cx") && !strings.HasPrefix(st.Name, "cpx") {
-			continue
-		}
-
-		// Find pricing for the selected location
-		hourly, monthly := "", ""
-		for _, p := range st.Prices {
-			if p.Location == location {
-				hourly = p.Hourly.Gross
-				monthly = p.Monthly.Gross
-				break
-			}
-		}
-		if hourly == "" {
-			continue // Not available in this location
-		}
-
-		options = append(options, option{
-			name:    st.Name,
-			cores:   st.Cores,
-			memory:  st.Memory,
-			disk:    st.Disk,
-			hourly:  hourly,
-			monthly: monthly,
-		})
-	}
-
-	if len(options) == 0 {
-		return "", fmt.Errorf("no server types available in %s", location)
-	}
-
-	// Sort by hourly price (cheapest first)
-	sort.Slice(options, func(i, j int) bool {
-		pi, _ := strconv.ParseFloat(options[i].hourly, 64)
-		pj, _ := strconv.ParseFloat(options[j].hourly, 64)
-		return pi < pj
-	})
-
-	defaultType := options[0].name // cheapest
-	fmt.Printf("  Available server types in %s:\n", location)
-	for i, opt := range options {
-		def := ""
-		if opt.name == defaultType {
-			def = " (default)"
-		}
-		fmt.Printf("    %d) %-8s %d vCPU / %4.0f GB RAM / %3d GB disk — €%s/hr (€%s/mo)%s\n",
-			i+1, opt.name, opt.cores, opt.memory, opt.disk, formatPrice(opt.hourly), formatPrice(opt.monthly), def)
-	}
-
-	fmt.Printf("\n  Select server type [%s]: ", defaultType)
-	choice, _ := reader.ReadString('\n')
-	choice = strings.TrimSpace(choice)
-
-	if choice == "" {
-		fmt.Printf("  Using %s (×5 nodes ≈ €%s/hr)\n", defaultType, multiplyPrice(options[0].hourly, 5))
-		return defaultType, nil
-	}
-
-	// Try as number
-	if num, err := strconv.Atoi(choice); err == nil && num >= 1 && num <= len(options) {
-		opt := options[num-1]
-		fmt.Printf("  Using %s (×5 nodes ≈ €%s/hr)\n", opt.name, multiplyPrice(opt.hourly, 5))
-		return opt.name, nil
-	}
-
-	// Try as name
-	for _, opt := range options {
-		if strings.EqualFold(opt.name, choice) {
-			fmt.Printf("  Using %s (×5 nodes ≈ €%s/hr)\n", opt.name, multiplyPrice(opt.hourly, 5))
-			return opt.name, nil
-		}
-	}
-
-	return "", fmt.Errorf("unknown server type %q", choice)
-}
-
-// formatPrice trims trailing zeros from a price string like "0.0063000000000000" → "0.0063".
-func formatPrice(price string) string {
-	f, err := strconv.ParseFloat(price, 64)
-	if err != nil {
-		return price
-	}
-	// Use enough precision then trim trailing zeros
-	s := fmt.Sprintf("%.4f", f)
-	s = strings.TrimRight(s, "0")
-	s = strings.TrimRight(s, ".")
-	return s
-}
-
-// multiplyPrice multiplies a price string by n and returns formatted.
-func multiplyPrice(price string, n int) string {
-	f, err := strconv.ParseFloat(price, 64)
-	if err != nil {
-		return "?"
-	}
-	return formatPrice(fmt.Sprintf("%.10f", f*float64(n)))
-}
-
-// setupFloatingIPs checks for existing floating IPs or creates new ones.
-func setupFloatingIPs(client *HetznerClient, location string) ([]FloatIP, error) {
-	existing, err := client.ListFloatingIPsByLabel("orama-sandbox-dns=true")
-	if err != nil {
-		return nil, fmt.Errorf("list floating IPs: %w", err)
-	}
-
-	if len(existing) >= 2 {
-		fmt.Printf("  Found %d existing floating IPs:\n", len(existing))
-		result := make([]FloatIP, 2)
-		for i := 0; i < 2; i++ {
-			fmt.Printf("    ns%d: %s (ID: %d)\n", i+1, existing[i].IP, existing[i].ID)
-			result[i] = FloatIP{ID: existing[i].ID, IP: existing[i].IP}
-		}
-		return result, nil
-	}
-
-	// Need to create missing floating IPs
-	needed := 2 - len(existing)
-	fmt.Printf("  Need to create %d floating IP(s)...\n", needed)
-
-	reader := bufio.NewReader(os.Stdin)
-	fmt.Printf("  Create %d floating IP(s) in %s? (~$0.005/hr each) [Y/n]: ", needed, location)
-	choice, _ := reader.ReadString('\n')
-	choice = strings.TrimSpace(strings.ToLower(choice))
-	if choice == "n" || choice == "no" {
-		return nil, fmt.Errorf("floating IPs required, aborting setup")
-	}
-
-	result := make([]FloatIP, 0, 2)
-	for _, fip := range existing {
-		result = append(result, FloatIP{ID: fip.ID, IP: fip.IP})
-	}
-
-	for i := len(existing); i < 2; i++ {
-		desc := fmt.Sprintf("orama-sandbox-ns%d", i+1)
-		labels := map[string]string{"orama-sandbox-dns": "true"}
-		fip, err := client.CreateFloatingIP(location, desc, labels)
-		if err != nil {
-			return nil, fmt.Errorf("create floating IP %d: %w", i+1, err)
-		}
-		fmt.Printf("    Created ns%d: %s (ID: %d)\n", i+1, fip.IP, fip.ID)
-		result = append(result, FloatIP{ID: fip.ID, IP: fip.IP})
-	}
-
-	return result, nil
-}
-
-// setupFirewall ensures a sandbox firewall exists.
-func setupFirewall(client *HetznerClient) (int64, error) {
-	existing, err := client.ListFirewallsByLabel("orama-sandbox=infra")
-	if err != nil {
-		return 0, fmt.Errorf("list firewalls: %w", err)
-	}
-
-	if len(existing) > 0 {
-		fmt.Printf("  Found existing firewall: %s (ID: %d)\n", existing[0].Name, existing[0].ID)
-		return existing[0].ID, nil
-	}
-
-	fmt.Print("  Creating sandbox firewall... ")
-	fw, err := client.CreateFirewall(
-		"orama-sandbox",
-		SandboxFirewallRules(),
-		map[string]string{"orama-sandbox": "infra"},
-	)
-	if err != nil {
-		fmt.Println("FAILED")
-		return 0, fmt.Errorf("create firewall: %w", err)
-	}
-	fmt.Printf("OK (ID: %d)\n", fw.ID)
-	return fw.ID, nil
-}
-
-// setupSSHKey ensures a wallet SSH entry exists and uploads its public key to Hetzner.
-func setupSSHKey(client *HetznerClient) (SSHKeyConfig, error) {
-	const vaultTarget = "sandbox/root"
-
-	// Ensure wallet entry exists (creates if missing)
-	fmt.Print("  Ensuring wallet SSH entry... ")
-	if err := remotessh.EnsureVaultEntry(vaultTarget); err != nil {
-		fmt.Println("FAILED")
-		return SSHKeyConfig{}, fmt.Errorf("ensure vault entry: %w", err)
-	}
-	fmt.Println("OK")
-
-	// Get public key from wallet
-	fmt.Print("  Resolving public key from wallet... ")
-	pubStr, err := remotessh.ResolveVaultPublicKey(vaultTarget)
-	if err != nil {
-		fmt.Println("FAILED")
-		return SSHKeyConfig{}, fmt.Errorf("resolve public key: %w", err)
-	}
-	fmt.Println("OK")
-
-	// Upload to Hetzner (will fail with uniqueness error if already exists)
-	fmt.Print("  Uploading to Hetzner... ")
-	key, err := client.UploadSSHKey("orama-sandbox", pubStr)
-	if err != nil {
-		// Key may already exist on Hetzner — check if it matches the current vault key
-		existing, listErr := client.ListSSHKeysByFingerprint("")
-		if listErr == nil {
-			for _, k := range existing {
-				if sshKeyDataEqual(k.PublicKey, pubStr) {
-					// Key data matches — safe to reuse regardless of name
-					fmt.Printf("already exists (ID: %d)\n", k.ID)
-					return SSHKeyConfig{
-						HetznerID:   k.ID,
-						VaultTarget: vaultTarget,
-					}, nil
-				}
-				if k.Name == "orama-sandbox" {
-					// Name matches but key data differs — vault key was rotated.
-					// Delete the stale Hetzner key so we can re-upload the current one.
-					fmt.Print("stale key detected, replacing... ")
-					if delErr := client.DeleteSSHKey(k.ID); delErr != nil {
-						fmt.Println("FAILED")
-						return SSHKeyConfig{}, fmt.Errorf("delete stale SSH key (ID %d): %w", k.ID, delErr)
-					}
-					// Re-upload with current vault key
-					newKey, uploadErr := client.UploadSSHKey("orama-sandbox", pubStr)
-					if uploadErr != nil {
-						fmt.Println("FAILED")
-						return SSHKeyConfig{}, fmt.Errorf("re-upload SSH key: %w", uploadErr)
-					}
-					fmt.Printf("OK (ID: %d)\n", newKey.ID)
-					return SSHKeyConfig{
-						HetznerID:   newKey.ID,
-						VaultTarget: vaultTarget,
-					}, nil
-				}
-			}
-		}
-
-		fmt.Println("FAILED")
-		return SSHKeyConfig{}, fmt.Errorf("upload SSH key: %w", err)
-	}
-	fmt.Printf("OK (ID: %d)\n", key.ID)
-
-	return SSHKeyConfig{
-		HetznerID:   key.ID,
-		VaultTarget: vaultTarget,
-	}, nil
-}
-
-// sshKeyDataEqual compares two SSH public key strings by their key type and
-// data, ignoring the optional comment field.
-func sshKeyDataEqual(a, b string) bool {
-	partsA := strings.Fields(strings.TrimSpace(a))
-	partsB := strings.Fields(strings.TrimSpace(b))
-	if len(partsA) < 2 || len(partsB) < 2 {
-		return false
-	}
-	return partsA[0] == partsB[0] && partsA[1] == partsB[1]
-}
-
-// verifyDNS checks if glue records for the sandbox domain are configured.
-//
-// There's a chicken-and-egg problem: NS records can't fully resolve until
-// CoreDNS is running on the floating IPs (which requires a sandbox cluster).
-// So instead of resolving NS → A records, we check for glue records at the
-// TLD level, which proves the registrar configuration is correct.
-func verifyDNS(domain string, floatingIPs []FloatIP, reader *bufio.Reader) {
-	expectedIPs := make(map[string]bool)
-	for _, fip := range floatingIPs {
-		expectedIPs[fip.IP] = true
-	}
-
-	// Find the TLD nameserver to query for glue records
-	findTLDServer := func() string {
-		// For "dbrs.space", the TLD is "space." — ask the root for its NS
-		parts := strings.Split(domain, ".")
-		if len(parts) < 2 {
-			return ""
-		}
-		tld := parts[len(parts)-1]
-		out, err := exec.Command("dig", "+short", "NS", tld+".", "@8.8.8.8").Output()
-		if err != nil {
-			return ""
-		}
-		lines := strings.Split(strings.TrimSpace(string(out)), "\n")
-		if len(lines) > 0 && lines[0] != "" {
-			return strings.TrimSpace(lines[0])
-		}
-		return ""
-	}
-
-	check := func() (glueFound bool, foundIPs []string) {
-		tldNS := findTLDServer()
-		if tldNS == "" {
-			return false, nil
-		}
-
-		// Query the TLD nameserver for NS + glue of our domain
-		// dig NS domain @tld-server will include glue in ADDITIONAL section
-		out, err := exec.Command("dig", "NS", domain, "@"+tldNS, "+norecurse", "+additional").Output()
-		if err != nil {
-			return false, nil
-		}
-
-		output := string(out)
-		remaining := make(map[string]bool)
-		for k, v := range expectedIPs {
-			remaining[k] = v
-		}
-
-		// Look for our floating IPs in the ADDITIONAL section (glue records)
-		// or anywhere in the response
-		for _, fip := range floatingIPs {
-			if strings.Contains(output, fip.IP) {
-				foundIPs = append(foundIPs, fip.IP)
-				delete(remaining, fip.IP)
-			}
-		}
-
-		return len(remaining) == 0, foundIPs
-	}
-
-	fmt.Printf("  Checking glue records for %s at TLD nameserver...\n", domain)
-	matched, foundIPs := check()
-
-	if matched {
-		fmt.Println("  ✓ Glue records configured correctly:")
-		for i, ip := range foundIPs {
-			fmt.Printf("    ns%d.%s → %s\n", i+1, domain, ip)
-		}
-		fmt.Println()
-		fmt.Println("  Note: Full DNS resolution will work once a sandbox is running")
-		fmt.Println("  (CoreDNS on the floating IPs needs to be up to answer queries).")
-		return
-	}
-
-	if len(foundIPs) > 0 {
-		fmt.Println("  ⚠ Partial glue records found:")
-		for _, ip := range foundIPs {
-			fmt.Printf("    %s\n", ip)
-		}
-		fmt.Println("  Missing floating IPs in glue:")
-		for _, fip := range floatingIPs {
-			if expectedIPs[fip.IP] {
-				fmt.Printf("    %s\n", fip.IP)
-			}
-		}
-	} else {
-		fmt.Println("  ✗ No glue records found yet.")
-		fmt.Println("  Make sure you configured at your registrar:")
-		fmt.Printf("    ns1.%s → %s\n", domain, floatingIPs[0].IP)
-		fmt.Printf("    ns2.%s → %s\n", domain, floatingIPs[1].IP)
-	}
-
-	fmt.Println()
-	fmt.Print("  Wait for glue propagation? (polls every 30s, Ctrl+C to stop) [y/N]: ")
-	choice, _ := reader.ReadString('\n')
-	choice = strings.TrimSpace(strings.ToLower(choice))
-	if choice != "y" && choice != "yes" {
-		fmt.Println("  Skipping. You can create the sandbox now — DNS will work once glue propagates.")
-		return
-	}
-
-	fmt.Println("  Waiting for glue record propagation...")
-	for i := 1; ; i++ {
-		time.Sleep(30 * time.Second)
-		matched, _ = check()
-		if matched {
-			fmt.Printf("\n  ✓ Glue records propagated after %d checks\n", i)
-			fmt.Println("  You can now create a sandbox: orama sandbox create")
-			return
-		}
-		fmt.Printf("  [%d] Not yet... checking again in 30s\n", i)
-	}
-}

core/pkg/cli/sandbox/setup_test.go

@@ -1,82 +0,0 @@
-package sandbox
-
-import "testing"
-
-func TestSSHKeyDataEqual(t *testing.T) {
-	tests := []struct {
-		name     string
-		a        string
-		b        string
-		expected bool
-	}{
-		{
-			name:     "identical keys",
-			a:        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBtest comment1",
-			b:        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBtest comment1",
-			expected: true,
-		},
-		{
-			name:     "same key different comments",
-			a:        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBtest vault",
-			b:        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBtest user@host",
-			expected: true,
-		},
-		{
-			name:     "same key one without comment",
-			a:        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBtest",
-			b:        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBtest vault",
-			expected: true,
-		},
-		{
-			name:     "different key data",
-			a:        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBoldkey vault",
-			b:        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBnewkey vault",
-			expected: false,
-		},
-		{
-			name:     "different key types",
-			a:        "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAB vault",
-			b:        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBtest vault",
-			expected: false,
-		},
-		{
-			name:     "empty string a",
-			a:        "",
-			b:        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBtest vault",
-			expected: false,
-		},
-		{
-			name:     "empty string b",
-			a:        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBtest vault",
-			b:        "",
-			expected: false,
-		},
-		{
-			name:     "both empty",
-			a:        "",
-			b:        "",
-			expected: false,
-		},
-		{
-			name:     "single field only",
-			a:        "ssh-ed25519",
-			b:        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBtest",
-			expected: false,
-		},
-		{
-			name:     "whitespace trimming",
-			a:        "  ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBtest vault  ",
-			b:        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBtest",
-			expected: true,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got := sshKeyDataEqual(tt.a, tt.b)
-			if got != tt.expected {
-				t.Errorf("sshKeyDataEqual(%q, %q) = %v, want %v", tt.a, tt.b, got, tt.expected)
-			}
-		})
-	}
-}

core/pkg/cli/sandbox/ssh_cmd.go

@@ -1,66 +0,0 @@
-package sandbox
-
-import (
-	"fmt"
-	"os"
-	"os/exec"
-)
-
-// SSHInto opens an interactive SSH session to a sandbox node.
-func SSHInto(name string, nodeNum int) error {
-	cfg, err := LoadConfig()
-	if err != nil {
-		return err
-	}
-
-	state, err := resolveSandbox(name)
-	if err != nil {
-		return err
-	}
-
-	if nodeNum < 1 || nodeNum > len(state.Servers) {
-		return fmt.Errorf("node number must be between 1 and %d", len(state.Servers))
-	}
-
-	srv := state.Servers[nodeNum-1]
-
-	sshKeyPath, cleanup, err := resolveVaultKeyOnce(cfg.SSHKey.VaultTarget)
-	if err != nil {
-		return fmt.Errorf("prepare SSH key: %w", err)
-	}
-
-	fmt.Printf("Connecting to %s (%s, %s)...\n", srv.Name, srv.IP, srv.Role)
-
-	// Find ssh binary
-	sshBin, err := findSSHBinary()
-	if err != nil {
-		cleanup()
-		return err
-	}
-
-	// Run SSH as a child process so cleanup runs after the session ends
-	cmd := exec.Command(sshBin,
-		"-o", "StrictHostKeyChecking=no",
-		"-o", "UserKnownHostsFile=/dev/null",
-		"-i", sshKeyPath,
-		fmt.Sprintf("root@%s", srv.IP),
-	)
-	cmd.Stdin = os.Stdin
-	cmd.Stdout = os.Stdout
-	cmd.Stderr = os.Stderr
-
-	err = cmd.Run()
-	cleanup()
-	return err
-}
-
-// findSSHBinary locates the ssh binary in PATH.
-func findSSHBinary() (string, error) {
-	paths := []string{"/usr/bin/ssh", "/usr/local/bin/ssh", "/opt/homebrew/bin/ssh"}
-	for _, p := range paths {
-		if _, err := os.Stat(p); err == nil {
-			return p, nil
-		}
-	}
-	return "", fmt.Errorf("ssh binary not found")
-}

core/pkg/cli/sandbox/state.go

@@ -1,211 +0,0 @@
-package sandbox
-
-import (
-	"fmt"
-	"os"
-	"path/filepath"
-	"strings"
-	"time"
-
-	"github.com/DeBrosOfficial/network/pkg/inspector"
-	"gopkg.in/yaml.v3"
-)
-
-// SandboxStatus represents the lifecycle state of a sandbox.
-type SandboxStatus string
-
-const (
-	StatusCreating   SandboxStatus = "creating"
-	StatusRunning    SandboxStatus = "running"
-	StatusDestroying SandboxStatus = "destroying"
-	StatusError      SandboxStatus = "error"
-)
-
-// SandboxState holds the full state of an active sandbox cluster.
-type SandboxState struct {
-	Name      string         `yaml:"name"`
-	CreatedAt time.Time      `yaml:"created_at"`
-	Domain    string         `yaml:"domain"`
-	Status    SandboxStatus  `yaml:"status"`
-	Servers   []ServerState  `yaml:"servers"`
-}
-
-// ServerState holds the state of a single server in the sandbox.
-type ServerState struct {
-	ID         int64  `yaml:"id"`                    // Hetzner server ID
-	Name       string `yaml:"name"`                  // e.g., sbx-feature-webrtc-1
-	IP         string `yaml:"ip"`                    // Public IPv4
-	Role       string `yaml:"role"`                  // "nameserver" or "node"
-	FloatingIP string `yaml:"floating_ip,omitempty"` // Only for nameserver nodes
-	WgIP       string `yaml:"wg_ip,omitempty"`       // WireGuard IP (populated after install)
-}
-
-// sandboxesDir returns ~/.orama/sandboxes/, creating it if needed.
-func sandboxesDir() (string, error) {
-	dir, err := configDir()
-	if err != nil {
-		return "", err
-	}
-	sbxDir := filepath.Join(dir, "sandboxes")
-	if err := os.MkdirAll(sbxDir, 0700); err != nil {
-		return "", fmt.Errorf("create sandboxes directory: %w", err)
-	}
-	return sbxDir, nil
-}
-
-// statePath returns the path for a sandbox's state file.
-func statePath(name string) (string, error) {
-	dir, err := sandboxesDir()
-	if err != nil {
-		return "", err
-	}
-	return filepath.Join(dir, name+".yaml"), nil
-}
-
-// SaveState persists the sandbox state to disk.
-func SaveState(state *SandboxState) error {
-	path, err := statePath(state.Name)
-	if err != nil {
-		return err
-	}
-
-	data, err := yaml.Marshal(state)
-	if err != nil {
-		return fmt.Errorf("marshal state: %w", err)
-	}
-
-	if err := os.WriteFile(path, data, 0600); err != nil {
-		return fmt.Errorf("write state: %w", err)
-	}
-
-	return nil
-}
-
-// LoadState reads a sandbox state from disk.
-func LoadState(name string) (*SandboxState, error) {
-	path, err := statePath(name)
-	if err != nil {
-		return nil, err
-	}
-
-	data, err := os.ReadFile(path)
-	if err != nil {
-		if os.IsNotExist(err) {
-			return nil, fmt.Errorf("sandbox %q not found", name)
-		}
-		return nil, fmt.Errorf("read state: %w", err)
-	}
-
-	var state SandboxState
-	if err := yaml.Unmarshal(data, &state); err != nil {
-		return nil, fmt.Errorf("parse state: %w", err)
-	}
-
-	return &state, nil
-}
-
-// DeleteState removes the sandbox state file.
-func DeleteState(name string) error {
-	path, err := statePath(name)
-	if err != nil {
-		return err
-	}
-
-	if err := os.Remove(path); err != nil && !os.IsNotExist(err) {
-		return fmt.Errorf("delete state: %w", err)
-	}
-
-	return nil
-}
-
-// ListStates returns all sandbox states from disk.
-func ListStates() ([]*SandboxState, error) {
-	dir, err := sandboxesDir()
-	if err != nil {
-		return nil, err
-	}
-
-	entries, err := os.ReadDir(dir)
-	if err != nil {
-		return nil, fmt.Errorf("read sandboxes directory: %w", err)
-	}
-
-	var states []*SandboxState
-	for _, entry := range entries {
-		if entry.IsDir() || !strings.HasSuffix(entry.Name(), ".yaml") {
-			continue
-		}
-		name := strings.TrimSuffix(entry.Name(), ".yaml")
-		state, err := LoadState(name)
-		if err != nil {
-			fmt.Fprintf(os.Stderr, "Warning: could not load sandbox %q: %v\n", name, err)
-			continue
-		}
-		states = append(states, state)
-	}
-
-	return states, nil
-}
-
-// FindActiveSandbox returns the first sandbox in running or creating state.
-// Returns nil if no active sandbox exists.
-func FindActiveSandbox() (*SandboxState, error) {
-	states, err := ListStates()
-	if err != nil {
-		return nil, err
-	}
-
-	for _, s := range states {
-		if s.Status == StatusRunning || s.Status == StatusCreating {
-			return s, nil
-		}
-	}
-
-	return nil, nil
-}
-
-// ToNodes converts sandbox servers to inspector.Node structs for SSH operations.
-// Sets VaultTarget on each node so PrepareNodeKeys resolves from the wallet.
-func (s *SandboxState) ToNodes(vaultTarget string) []inspector.Node {
-	nodes := make([]inspector.Node, len(s.Servers))
-	for i, srv := range s.Servers {
-		nodes[i] = inspector.Node{
-			Environment: "sandbox",
-			User:        "root",
-			Host:        srv.IP,
-			Role:        srv.Role,
-			VaultTarget: vaultTarget,
-		}
-	}
-	return nodes
-}
-
-// NameserverNodes returns only the nameserver nodes.
-func (s *SandboxState) NameserverNodes() []ServerState {
-	var ns []ServerState
-	for _, srv := range s.Servers {
-		if srv.Role == "nameserver" {
-			ns = append(ns, srv)
-		}
-	}
-	return ns
-}
-
-// RegularNodes returns only the non-nameserver nodes.
-func (s *SandboxState) RegularNodes() []ServerState {
-	var nodes []ServerState
-	for _, srv := range s.Servers {
-		if srv.Role == "node" {
-			nodes = append(nodes, srv)
-		}
-	}
-	return nodes
-}
-
-// GenesisServer returns the first server (genesis node).
-func (s *SandboxState) GenesisServer() ServerState {
-	if len(s.Servers) == 0 {
-		return ServerState{}
-	}
-	return s.Servers[0]
-}

core/pkg/cli/sandbox/state_test.go

@@ -1,217 +0,0 @@
-package sandbox
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-	"time"
-)
-
-func TestSaveAndLoadState(t *testing.T) {
-	// Use temp dir for test
-	tmpDir := t.TempDir()
-	origHome := os.Getenv("HOME")
-	os.Setenv("HOME", tmpDir)
-	defer os.Setenv("HOME", origHome)
-
-	state := &SandboxState{
-		Name:      "test-sandbox",
-		CreatedAt: time.Date(2026, 2, 25, 10, 0, 0, 0, time.UTC),
-		Domain:    "test.example.com",
-		Status:    StatusRunning,
-		Servers: []ServerState{
-			{ID: 1, Name: "sbx-test-1", IP: "1.1.1.1", Role: "nameserver", FloatingIP: "10.0.0.1", WgIP: "10.0.0.1"},
-			{ID: 2, Name: "sbx-test-2", IP: "2.2.2.2", Role: "nameserver", FloatingIP: "10.0.0.2", WgIP: "10.0.0.2"},
-			{ID: 3, Name: "sbx-test-3", IP: "3.3.3.3", Role: "node", WgIP: "10.0.0.3"},
-			{ID: 4, Name: "sbx-test-4", IP: "4.4.4.4", Role: "node", WgIP: "10.0.0.4"},
-			{ID: 5, Name: "sbx-test-5", IP: "5.5.5.5", Role: "node", WgIP: "10.0.0.5"},
-		},
-	}
-
-	if err := SaveState(state); err != nil {
-		t.Fatalf("SaveState() error = %v", err)
-	}
-
-	// Verify file exists
-	expected := filepath.Join(tmpDir, ".orama", "sandboxes", "test-sandbox.yaml")
-	if _, err := os.Stat(expected); err != nil {
-		t.Fatalf("state file not created at %s: %v", expected, err)
-	}
-
-	// Load back
-	loaded, err := LoadState("test-sandbox")
-	if err != nil {
-		t.Fatalf("LoadState() error = %v", err)
-	}
-
-	if loaded.Name != "test-sandbox" {
-		t.Errorf("name = %s, want test-sandbox", loaded.Name)
-	}
-	if loaded.Domain != "test.example.com" {
-		t.Errorf("domain = %s, want test.example.com", loaded.Domain)
-	}
-	if loaded.Status != StatusRunning {
-		t.Errorf("status = %s, want running", loaded.Status)
-	}
-	if len(loaded.Servers) != 5 {
-		t.Errorf("servers = %d, want 5", len(loaded.Servers))
-	}
-}
-
-func TestLoadState_NotFound(t *testing.T) {
-	tmpDir := t.TempDir()
-	origHome := os.Getenv("HOME")
-	os.Setenv("HOME", tmpDir)
-	defer os.Setenv("HOME", origHome)
-
-	_, err := LoadState("nonexistent")
-	if err == nil {
-		t.Error("LoadState() expected error for nonexistent sandbox")
-	}
-}
-
-func TestDeleteState(t *testing.T) {
-	tmpDir := t.TempDir()
-	origHome := os.Getenv("HOME")
-	os.Setenv("HOME", tmpDir)
-	defer os.Setenv("HOME", origHome)
-
-	state := &SandboxState{
-		Name:   "to-delete",
-		Status: StatusRunning,
-	}
-	if err := SaveState(state); err != nil {
-		t.Fatalf("SaveState() error = %v", err)
-	}
-
-	if err := DeleteState("to-delete"); err != nil {
-		t.Fatalf("DeleteState() error = %v", err)
-	}
-
-	_, err := LoadState("to-delete")
-	if err == nil {
-		t.Error("LoadState() should fail after DeleteState()")
-	}
-}
-
-func TestListStates(t *testing.T) {
-	tmpDir := t.TempDir()
-	origHome := os.Getenv("HOME")
-	os.Setenv("HOME", tmpDir)
-	defer os.Setenv("HOME", origHome)
-
-	// Create 2 sandboxes
-	for _, name := range []string{"sandbox-a", "sandbox-b"} {
-		if err := SaveState(&SandboxState{Name: name, Status: StatusRunning}); err != nil {
-			t.Fatalf("SaveState(%s) error = %v", name, err)
-		}
-	}
-
-	states, err := ListStates()
-	if err != nil {
-		t.Fatalf("ListStates() error = %v", err)
-	}
-	if len(states) != 2 {
-		t.Errorf("ListStates() returned %d, want 2", len(states))
-	}
-}
-
-func TestFindActiveSandbox(t *testing.T) {
-	tmpDir := t.TempDir()
-	origHome := os.Getenv("HOME")
-	os.Setenv("HOME", tmpDir)
-	defer os.Setenv("HOME", origHome)
-
-	// No sandboxes
-	active, err := FindActiveSandbox()
-	if err != nil {
-		t.Fatalf("FindActiveSandbox() error = %v", err)
-	}
-	if active != nil {
-		t.Error("expected nil when no sandboxes exist")
-	}
-
-	// Add one running sandbox
-	if err := SaveState(&SandboxState{Name: "active-one", Status: StatusRunning}); err != nil {
-		t.Fatal(err)
-	}
-	if err := SaveState(&SandboxState{Name: "errored-one", Status: StatusError}); err != nil {
-		t.Fatal(err)
-	}
-
-	active, err = FindActiveSandbox()
-	if err != nil {
-		t.Fatalf("FindActiveSandbox() error = %v", err)
-	}
-	if active == nil || active.Name != "active-one" {
-		t.Errorf("FindActiveSandbox() = %v, want active-one", active)
-	}
-}
-
-func TestToNodes(t *testing.T) {
-	state := &SandboxState{
-		Servers: []ServerState{
-			{IP: "1.1.1.1", Role: "nameserver"},
-			{IP: "2.2.2.2", Role: "node"},
-		},
-	}
-
-	nodes := state.ToNodes("sandbox/root")
-	if len(nodes) != 2 {
-		t.Fatalf("ToNodes() returned %d nodes, want 2", len(nodes))
-	}
-	if nodes[0].Host != "1.1.1.1" {
-		t.Errorf("node[0].Host = %s, want 1.1.1.1", nodes[0].Host)
-	}
-	if nodes[0].User != "root" {
-		t.Errorf("node[0].User = %s, want root", nodes[0].User)
-	}
-	if nodes[0].VaultTarget != "sandbox/root" {
-		t.Errorf("node[0].VaultTarget = %s, want sandbox/root", nodes[0].VaultTarget)
-	}
-	if nodes[0].SSHKey != "" {
-		t.Errorf("node[0].SSHKey = %s, want empty (set by PrepareNodeKeys)", nodes[0].SSHKey)
-	}
-	if nodes[0].Environment != "sandbox" {
-		t.Errorf("node[0].Environment = %s, want sandbox", nodes[0].Environment)
-	}
-}
-
-func TestNameserverAndRegularNodes(t *testing.T) {
-	state := &SandboxState{
-		Servers: []ServerState{
-			{Role: "nameserver"},
-			{Role: "nameserver"},
-			{Role: "node"},
-			{Role: "node"},
-			{Role: "node"},
-		},
-	}
-
-	ns := state.NameserverNodes()
-	if len(ns) != 2 {
-		t.Errorf("NameserverNodes() = %d, want 2", len(ns))
-	}
-
-	regular := state.RegularNodes()
-	if len(regular) != 3 {
-		t.Errorf("RegularNodes() = %d, want 3", len(regular))
-	}
-}
-
-func TestGenesisServer(t *testing.T) {
-	state := &SandboxState{
-		Servers: []ServerState{
-			{Name: "first"},
-			{Name: "second"},
-		},
-	}
-	if state.GenesisServer().Name != "first" {
-		t.Errorf("GenesisServer().Name = %s, want first", state.GenesisServer().Name)
-	}
-
-	empty := &SandboxState{}
-	if empty.GenesisServer().Name != "" {
-		t.Error("GenesisServer() on empty state should return zero value")
-	}
-}

core/pkg/cli/sandbox/status.go

@@ -1,165 +0,0 @@
-package sandbox
-
-import (
-	"encoding/json"
-	"fmt"
-	"strings"
-
-	"github.com/DeBrosOfficial/network/pkg/inspector"
-)
-
-// List prints all sandbox clusters.
-func List() error {
-	states, err := ListStates()
-	if err != nil {
-		return err
-	}
-
-	if len(states) == 0 {
-		fmt.Println("No sandboxes found.")
-		fmt.Println("Create one: orama sandbox create")
-		return nil
-	}
-
-	fmt.Printf("%-20s  %-10s  %-5s  %-25s  %s\n", "NAME", "STATUS", "NODES", "CREATED", "DOMAIN")
-	for _, s := range states {
-		fmt.Printf("%-20s  %-10s  %-5d  %-25s  %s\n",
-			s.Name, s.Status, len(s.Servers), s.CreatedAt.Format("2006-01-02 15:04"), s.Domain)
-	}
-
-	// Check for orphaned servers on Hetzner
-	cfg, err := LoadConfig()
-	if err != nil {
-		return nil // Config not set up, skip orphan check
-	}
-
-	client := NewHetznerClient(cfg.HetznerAPIToken)
-	hetznerServers, err := client.ListServersByLabel("orama-sandbox")
-	if err != nil {
-		return nil // API error, skip orphan check
-	}
-
-	// Build set of known server IDs
-	known := make(map[int64]bool)
-	for _, s := range states {
-		for _, srv := range s.Servers {
-			known[srv.ID] = true
-		}
-	}
-
-	var orphans []string
-	for _, srv := range hetznerServers {
-		if !known[srv.ID] {
-			orphans = append(orphans, fmt.Sprintf("%s (ID: %d, IP: %s)", srv.Name, srv.ID, srv.PublicNet.IPv4.IP))
-		}
-	}
-
-	if len(orphans) > 0 {
-		fmt.Printf("\nWarning: %d orphaned server(s) on Hetzner (no state file):\n", len(orphans))
-		for _, o := range orphans {
-			fmt.Printf("  %s\n", o)
-		}
-		fmt.Println("Delete manually at https://console.hetzner.cloud")
-	}
-
-	return nil
-}
-
-// Status prints the health report for a sandbox cluster.
-func Status(name string) error {
-	cfg, err := LoadConfig()
-	if err != nil {
-		return err
-	}
-
-	state, err := resolveSandbox(name)
-	if err != nil {
-		return err
-	}
-
-	sshKeyPath, cleanup, err := resolveVaultKeyOnce(cfg.SSHKey.VaultTarget)
-	if err != nil {
-		return fmt.Errorf("prepare SSH key: %w", err)
-	}
-	defer cleanup()
-
-	fmt.Printf("Sandbox: %s (status: %s)\n\n", state.Name, state.Status)
-
-	for _, srv := range state.Servers {
-		node := inspector.Node{User: "root", Host: srv.IP, SSHKey: sshKeyPath}
-
-		fmt.Printf("%s (%s) — %s\n", srv.Name, srv.IP, srv.Role)
-
-		// Get node report
-		out, err := runSSHOutput(node, "orama node report --json 2>/dev/null")
-		if err != nil {
-			fmt.Printf("  Status: UNREACHABLE (%v)\n", err)
-			fmt.Println()
-			continue
-		}
-
-		printNodeReport(out)
-		fmt.Println()
-	}
-
-	// Cluster summary
-	fmt.Println("Cluster Summary")
-	fmt.Println("---------------")
-	genesis := state.GenesisServer()
-	genesisNode := inspector.Node{User: "root", Host: genesis.IP, SSHKey: sshKeyPath}
-
-	out, err := runSSHOutput(genesisNode, "curl -sf http://localhost:5001/status 2>/dev/null")
-	if err != nil {
-		fmt.Println("  RQLite: UNREACHABLE")
-	} else {
-		var status map[string]interface{}
-		if err := json.Unmarshal([]byte(out), &status); err == nil {
-			if store, ok := status["store"].(map[string]interface{}); ok {
-				if raft, ok := store["raft"].(map[string]interface{}); ok {
-					fmt.Printf("  RQLite state: %v\n", raft["state"])
-					fmt.Printf("  Commit index: %v\n", raft["commit_index"])
-					if nodes, ok := raft["nodes"].([]interface{}); ok {
-						fmt.Printf("  Nodes: %d\n", len(nodes))
-					}
-				}
-			}
-		}
-	}
-
-	return nil
-}
-
-// printNodeReport parses and prints a node report JSON.
-func printNodeReport(jsonStr string) {
-	var report map[string]interface{}
-	if err := json.Unmarshal([]byte(jsonStr), &report); err != nil {
-		fmt.Printf("  Report: (parse error)\n")
-		return
-	}
-
-	// Print key fields
-	if services, ok := report["services"].(map[string]interface{}); ok {
-		var active, inactive []string
-		for name, info := range services {
-			if svc, ok := info.(map[string]interface{}); ok {
-				if state, ok := svc["active"].(bool); ok && state {
-					active = append(active, name)
-				} else {
-					inactive = append(inactive, name)
-				}
-			}
-		}
-		if len(active) > 0 {
-			fmt.Printf("  Active:   %s\n", strings.Join(active, ", "))
-		}
-		if len(inactive) > 0 {
-			fmt.Printf("  Inactive: %s\n", strings.Join(inactive, ", "))
-		}
-	}
-
-	if rqlite, ok := report["rqlite"].(map[string]interface{}); ok {
-		if state, ok := rqlite["state"].(string); ok {
-			fmt.Printf("  RQLite:   %s\n", state)
-		}
-	}
-}

core/pkg/client/database_client_test.go

@@ -1,82 +0,0 @@
-package client
-
-import (
-	"fmt"
-	"testing"
-
-	"github.com/rqlite/gorqlite"
-)
-
-// mockPanicConnection simulates what gorqlite does when WriteParameterized
-// returns an empty slice: accessing [0] panics.
-func simulateGorqlitePanic() (gorqlite.WriteResult, error) {
-	var empty []gorqlite.WriteResult
-	return empty[0], fmt.Errorf("leader not found") // panics
-}
-
-func TestSafeWriteOne_recoversPanic(t *testing.T) {
-	// We can't easily create a real gorqlite.Connection that panics,
-	// but we can verify our recovery wrapper works by testing the
-	// recovery pattern directly.
-	var recovered bool
-	func() {
-		defer func() {
-			if r := recover(); r != nil {
-				recovered = true
-			}
-		}()
-		simulateGorqlitePanic()
-	}()
-
-	if !recovered {
-		t.Fatal("expected simulateGorqlitePanic to panic, but it didn't")
-	}
-}
-
-func TestSafeWriteOne_nilConnection(t *testing.T) {
-	// safeWriteOne with nil connection should recover from panic, not crash.
-	_, err := safeWriteOne(nil, gorqlite.ParameterizedStatement{
-		Query: "INSERT INTO test (a) VALUES (?)",
-		Arguments: []interface{}{"x"},
-	})
-	if err == nil {
-		t.Fatal("expected error from nil connection, got nil")
-	}
-}
-
-func TestSafeWriteOneRaw_nilConnection(t *testing.T) {
-	// safeWriteOneRaw with nil connection should recover from panic, not crash.
-	_, err := safeWriteOneRaw(nil, "INSERT INTO test (a) VALUES ('x')")
-	if err == nil {
-		t.Fatal("expected error from nil connection, got nil")
-	}
-}
-
-func TestIsWriteOperation(t *testing.T) {
-	d := &DatabaseClientImpl{}
-
-	tests := []struct {
-		sql    string
-		isWrite bool
-	}{
-		{"INSERT INTO foo VALUES (1)", true},
-		{"  INSERT INTO foo VALUES (1)", true},
-		{"UPDATE foo SET a = 1", true},
-		{"DELETE FROM foo", true},
-		{"CREATE TABLE foo (a TEXT)", true},
-		{"DROP TABLE foo", true},
-		{"ALTER TABLE foo ADD COLUMN b TEXT", true},
-		{"SELECT * FROM foo", false},
-		{"  SELECT * FROM foo", false},
-		{"EXPLAIN SELECT * FROM foo", false},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.sql, func(t *testing.T) {
-			got := d.isWriteOperation(tt.sql)
-			if got != tt.isWrite {
-				t.Errorf("isWriteOperation(%q) = %v, want %v", tt.sql, got, tt.isWrite)
-			}
-		})
-	}
-}

core/pkg/constants/versions.go

@@ -1,13 +0,0 @@
-package constants
-
-// External dependency versions used across the network.
-// Single source of truth — all installer files and build scripts import from here.
-const (
-	GoVersion          = "1.24.6"
-	OlricVersion       = "v0.7.0"
-	IPFSKuboVersion    = "v0.38.2"
-	IPFSClusterVersion = "v1.1.2"
-	RQLiteVersion      = "8.43.0"
-	CoreDNSVersion     = "1.12.0"
-	CaddyVersion       = "2.10.2"
-)

core/pkg/environments/production/installers/coredns_test.go

@@ -1,151 +0,0 @@
-package installers
-
-import (
-	"io"
-	"strings"
-	"testing"
-)
-
-// newTestCoreDNSInstaller creates a CoreDNSInstaller suitable for unit tests.
-// It uses a non-existent oramaHome so generateCorefile won't find a password file
-// and will produce output without auth credentials.
-func newTestCoreDNSInstaller() *CoreDNSInstaller {
-	return &CoreDNSInstaller{
-		BaseInstaller: NewBaseInstaller("amd64", io.Discard),
-		version:       "1.11.1",
-		oramaHome:     "/nonexistent",
-	}
-}
-
-func TestGenerateCorefile_ContainsBindLocalhost(t *testing.T) {
-	ci := newTestCoreDNSInstaller()
-	corefile := ci.generateCorefile("dbrs.space", "http://localhost:5001")
-
-	if !strings.Contains(corefile, "bind 127.0.0.1") {
-		t.Fatal("Corefile forward block must contain 'bind 127.0.0.1' to prevent open resolver")
-	}
-}
-
-func TestGenerateCorefile_ForwardBlockIsLocalhostOnly(t *testing.T) {
-	ci := newTestCoreDNSInstaller()
-	corefile := ci.generateCorefile("dbrs.space", "http://localhost:5001")
-
-	// The bind directive must appear inside the catch-all (.) block,
-	// not inside the authoritative domain block.
-	// Find the ". {" block and verify bind is inside it.
-	dotBlockIdx := strings.Index(corefile, ". {")
-	if dotBlockIdx == -1 {
-		t.Fatal("Corefile must contain a catch-all '. {' server block")
-	}
-
-	dotBlock := corefile[dotBlockIdx:]
-	closingIdx := strings.Index(dotBlock, "}")
-	if closingIdx == -1 {
-		t.Fatal("Catch-all block has no closing brace")
-	}
-	dotBlock = dotBlock[:closingIdx]
-
-	if !strings.Contains(dotBlock, "bind 127.0.0.1") {
-		t.Error("bind 127.0.0.1 must be inside the catch-all (.) block, not the domain block")
-	}
-
-	if !strings.Contains(dotBlock, "forward .") {
-		t.Error("forward directive must be inside the catch-all (.) block")
-	}
-}
-
-func TestGenerateCorefile_AuthoritativeBlockNoBindRestriction(t *testing.T) {
-	ci := newTestCoreDNSInstaller()
-	corefile := ci.generateCorefile("dbrs.space", "http://localhost:5001")
-
-	// The authoritative domain block should NOT have a bind directive
-	// (it must listen on all interfaces to serve external DNS queries).
-	domainBlockStart := strings.Index(corefile, "dbrs.space {")
-	if domainBlockStart == -1 {
-		t.Fatal("Corefile must contain 'dbrs.space {' server block")
-	}
-
-	// Extract the domain block (up to the first closing brace)
-	domainBlock := corefile[domainBlockStart:]
-	closingIdx := strings.Index(domainBlock, "}")
-	if closingIdx == -1 {
-		t.Fatal("Domain block has no closing brace")
-	}
-	domainBlock = domainBlock[:closingIdx]
-
-	if strings.Contains(domainBlock, "bind ") {
-		t.Error("Authoritative domain block must not have a bind directive — it must listen on all interfaces")
-	}
-}
-
-func TestGenerateCorefile_ContainsDomainZone(t *testing.T) {
-	ci := newTestCoreDNSInstaller()
-
-	tests := []struct {
-		domain string
-	}{
-		{"dbrs.space"},
-		{"orama.network"},
-		{"example.com"},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.domain, func(t *testing.T) {
-			corefile := ci.generateCorefile(tt.domain, "http://localhost:5001")
-
-			if !strings.Contains(corefile, tt.domain+" {") {
-				t.Errorf("Corefile must contain server block for domain %q", tt.domain)
-			}
-
-			if !strings.Contains(corefile, "rqlite {") {
-				t.Error("Corefile must contain rqlite plugin block")
-			}
-		})
-	}
-}
-
-func TestGenerateCorefile_ContainsRQLiteDSN(t *testing.T) {
-	ci := newTestCoreDNSInstaller()
-	dsn := "http://10.0.0.1:5001"
-	corefile := ci.generateCorefile("dbrs.space", dsn)
-
-	if !strings.Contains(corefile, "dsn "+dsn) {
-		t.Errorf("Corefile must contain RQLite DSN %q", dsn)
-	}
-}
-
-func TestGenerateCorefile_NoAuthBlockWithoutCredentials(t *testing.T) {
-	ci := newTestCoreDNSInstaller()
-	corefile := ci.generateCorefile("dbrs.space", "http://localhost:5001")
-
-	if strings.Contains(corefile, "username") || strings.Contains(corefile, "password") {
-		t.Error("Corefile must not contain auth credentials when secrets file is absent")
-	}
-}
-
-func TestGeneratePluginConfig_ContainsBindPlugin(t *testing.T) {
-	ci := newTestCoreDNSInstaller()
-	cfg := ci.generatePluginConfig()
-
-	if !strings.Contains(cfg, "bind:bind") {
-		t.Error("Plugin config must include the bind plugin (required for localhost-only forwarding)")
-	}
-}
-
-func TestGeneratePluginConfig_ContainsACLPlugin(t *testing.T) {
-	ci := newTestCoreDNSInstaller()
-	cfg := ci.generatePluginConfig()
-
-	if !strings.Contains(cfg, "acl:acl") {
-		t.Error("Plugin config must include the acl plugin")
-	}
-}
-
-func TestGeneratePluginConfig_ContainsRQLitePlugin(t *testing.T) {
-	ci := newTestCoreDNSInstaller()
-	cfg := ci.generatePluginConfig()
-
-	if !strings.Contains(cfg, "rqlite:rqlite") {
-		t.Error("Plugin config must include the rqlite plugin")
-	}
-}

core/pkg/environments/production/prebuilt.go

@@ -1,325 +0,0 @@
-package production
-
-import (
-	"crypto/sha256"
-	"encoding/hex"
-	"encoding/json"
-	"fmt"
-	"io"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"strings"
-
-	ethcrypto "github.com/ethereum/go-ethereum/crypto"
-)
-
-// PreBuiltManifest describes the contents of a pre-built binary archive.
-type PreBuiltManifest struct {
-	Version   string            `json:"version"`
-	Commit    string            `json:"commit"`
-	Date      string            `json:"date"`
-	Arch      string            `json:"arch"`
-	Checksums map[string]string `json:"checksums"` // filename -> sha256
-}
-
-// HasPreBuiltArchive checks if a pre-built binary archive has been extracted
-// at /opt/orama/ by looking for the manifest.json file.
-func HasPreBuiltArchive() bool {
-	_, err := os.Stat(OramaManifest)
-	return err == nil
-}
-
-// LoadPreBuiltManifest loads and parses the pre-built manifest.
-func LoadPreBuiltManifest() (*PreBuiltManifest, error) {
-	data, err := os.ReadFile(OramaManifest)
-	if err != nil {
-		return nil, fmt.Errorf("failed to read manifest: %w", err)
-	}
-
-	var manifest PreBuiltManifest
-	if err := json.Unmarshal(data, &manifest); err != nil {
-		return nil, fmt.Errorf("failed to parse manifest: %w", err)
-	}
-
-	return &manifest, nil
-}
-
-// OramaSignerAddress is the Ethereum address authorized to sign build archives.
-// Archives signed by any other address are rejected during install.
-// This is the DeBros deploy wallet — update if the signing key rotates.
-const OramaSignerAddress = "0xb5d8a496c8b2412990d7D467E17727fdF5954afC"
-
-// VerifyArchiveSignature verifies that the pre-built archive was signed by the
-// authorized Orama signer. Returns nil if the signature is valid, or if no
-// signature file exists (unsigned archives are allowed but logged as a warning).
-func VerifyArchiveSignature(manifest *PreBuiltManifest) error {
-	sigData, err := os.ReadFile(OramaManifestSig)
-	if os.IsNotExist(err) {
-		return nil // unsigned archive — caller decides whether to proceed
-	}
-	if err != nil {
-		return fmt.Errorf("failed to read manifest.sig: %w", err)
-	}
-
-	// Reproduce the same hash used during signing: SHA256 of compact JSON
-	manifestJSON, err := json.Marshal(manifest)
-	if err != nil {
-		return fmt.Errorf("failed to marshal manifest: %w", err)
-	}
-	manifestHash := sha256.Sum256(manifestJSON)
-	hashHex := hex.EncodeToString(manifestHash[:])
-
-	// EVM personal_sign: keccak256("\x19Ethereum Signed Message:\n" + len + message)
-	msg := []byte(hashHex)
-	prefix := []byte("\x19Ethereum Signed Message:\n" + fmt.Sprintf("%d", len(msg)))
-	ethHash := ethcrypto.Keccak256(prefix, msg)
-
-	// Decode signature
-	sigHex := strings.TrimSpace(string(sigData))
-	if strings.HasPrefix(sigHex, "0x") || strings.HasPrefix(sigHex, "0X") {
-		sigHex = sigHex[2:]
-	}
-	sig, err := hex.DecodeString(sigHex)
-	if err != nil || len(sig) != 65 {
-		return fmt.Errorf("invalid signature format in manifest.sig")
-	}
-
-	// Normalize recovery ID
-	if sig[64] >= 27 {
-		sig[64] -= 27
-	}
-
-	// Recover public key from signature
-	pub, err := ethcrypto.SigToPub(ethHash, sig)
-	if err != nil {
-		return fmt.Errorf("signature recovery failed: %w", err)
-	}
-
-	recovered := ethcrypto.PubkeyToAddress(*pub).Hex()
-	expected := strings.ToLower(OramaSignerAddress)
-	got := strings.ToLower(recovered)
-
-	if got != expected {
-		return fmt.Errorf("archive signed by %s, expected %s — refusing to install", recovered, OramaSignerAddress)
-	}
-
-	return nil
-}
-
-// IsArchiveSigned returns true if a manifest.sig file exists alongside the manifest.
-func IsArchiveSigned() bool {
-	_, err := os.Stat(OramaManifestSig)
-	return err == nil
-}
-
-// installFromPreBuilt installs all binaries from a pre-built archive.
-// The archive must already be extracted at /opt/orama/ with:
-//   - /opt/orama/bin/ — all pre-compiled binaries
-//   - /opt/orama/systemd/ — namespace service templates
-//   - /opt/orama/packages/ — optional .deb packages
-//   - /opt/orama/manifest.json — archive metadata
-func (ps *ProductionSetup) installFromPreBuilt(manifest *PreBuiltManifest) error {
-	ps.logf("  Using pre-built binary archive v%s (%s) linux/%s", manifest.Version, manifest.Commit, manifest.Arch)
-
-	// Verify archive signature if present
-	if IsArchiveSigned() {
-		if err := VerifyArchiveSignature(manifest); err != nil {
-			return fmt.Errorf("archive signature verification failed: %w", err)
-		}
-		ps.logf("  ✓ Archive signature verified")
-	} else {
-		ps.logf("  ⚠️  Archive is unsigned — consider using 'orama build --sign'")
-	}
-
-	// Install minimal system dependencies (no build tools needed)
-	if err := ps.installMinimalSystemDeps(); err != nil {
-		ps.logf("  ⚠️  System dependencies warning: %v", err)
-	}
-
-	// Copy binaries to runtime locations
-	if err := ps.deployPreBuiltBinaries(manifest); err != nil {
-		return fmt.Errorf("failed to deploy pre-built binaries: %w", err)
-	}
-
-	// Set capabilities on binaries that need to bind privileged ports
-	if err := ps.setCapabilities(); err != nil {
-		return fmt.Errorf("failed to set capabilities: %w", err)
-	}
-
-	// Disable systemd-resolved stub listener for nameserver nodes
-	// (needed even in pre-built mode so CoreDNS can bind port 53)
-	if ps.isNameserver {
-		if err := ps.disableResolvedStub(); err != nil {
-			ps.logf("  ⚠️  Failed to disable systemd-resolved stub: %v", err)
-		}
-	}
-
-	// Install Anyone relay from .deb package if available
-	if ps.IsAnyoneRelay() || ps.IsAnyoneClient() {
-		if err := ps.installAnyonFromPreBuilt(); err != nil {
-			ps.logf("  ⚠️  Anyone install warning: %v", err)
-		}
-	}
-
-	ps.logf("  ✓ All pre-built binaries installed")
-	return nil
-}
-
-// installMinimalSystemDeps installs only runtime dependencies (no build tools).
-func (ps *ProductionSetup) installMinimalSystemDeps() error {
-	ps.logf("  Installing minimal system dependencies...")
-
-	cmd := exec.Command("apt-get", "update")
-	if err := cmd.Run(); err != nil {
-		ps.logf("    Warning: apt update failed")
-	}
-
-	// Only install runtime deps — no build-essential, make, nodejs, npm needed
-	cmd = exec.Command("apt-get", "install", "-y", "curl", "wget", "unzip")
-	if err := cmd.Run(); err != nil {
-		return fmt.Errorf("failed to install minimal dependencies: %w", err)
-	}
-
-	ps.logf("  ✓ Minimal system dependencies installed (no build tools needed)")
-	return nil
-}
-
-// deployPreBuiltBinaries copies pre-built binaries to their runtime locations.
-func (ps *ProductionSetup) deployPreBuiltBinaries(manifest *PreBuiltManifest) error {
-	ps.logf("  Deploying pre-built binaries...")
-
-	// Binary → destination mapping
-	// Most go to /usr/local/bin/, caddy goes to /usr/bin/
-	type binaryDest struct {
-		name string
-		dest string
-	}
-
-	binaries := []binaryDest{
-		{name: "orama", dest: "/usr/local/bin/orama"},
-		{name: "orama-node", dest: "/usr/local/bin/orama-node"},
-		{name: "gateway", dest: "/usr/local/bin/gateway"},
-		{name: "identity", dest: "/usr/local/bin/identity"},
-		{name: "sfu", dest: "/usr/local/bin/sfu"},
-		{name: "turn", dest: "/usr/local/bin/turn"},
-		{name: "olric-server", dest: "/usr/local/bin/olric-server"},
-		{name: "ipfs", dest: "/usr/local/bin/ipfs"},
-		{name: "ipfs-cluster-service", dest: "/usr/local/bin/ipfs-cluster-service"},
-		{name: "rqlited", dest: "/usr/local/bin/rqlited"},
-		{name: "coredns", dest: "/usr/local/bin/coredns"},
-		{name: "caddy", dest: "/usr/bin/caddy"},
-	}
-	// Note: vault-guardian stays at /opt/orama/bin/ (from archive extraction)
-	// and is referenced by absolute path in the systemd service — no copy needed.
-
-	for _, bin := range binaries {
-		srcPath := filepath.Join(OramaArchiveBin, bin.name)
-
-		// Skip optional binaries (e.g., coredns on non-nameserver nodes)
-		if _, ok := manifest.Checksums[bin.name]; !ok {
-			continue
-		}
-
-		if _, err := os.Stat(srcPath); os.IsNotExist(err) {
-			ps.logf("    ⚠️  Binary %s not found in archive, skipping", bin.name)
-			continue
-		}
-
-		if err := copyBinary(srcPath, bin.dest); err != nil {
-			return fmt.Errorf("failed to copy %s: %w", bin.name, err)
-		}
-		ps.logf("    ✓ %s → %s", bin.name, bin.dest)
-	}
-
-	return nil
-}
-
-// setCapabilities sets cap_net_bind_service on binaries that need to bind privileged ports.
-// Both the /opt/orama/bin/ originals (used by systemd) and /usr/local/bin/ copies need caps.
-func (ps *ProductionSetup) setCapabilities() error {
-	caps := []string{
-		filepath.Join(OramaArchiveBin, "orama-node"), // systemd uses this path
-		"/usr/local/bin/orama-node",                  // PATH copy
-		"/usr/bin/caddy",                             // caddy's standard location
-	}
-	for _, binary := range caps {
-		if _, err := os.Stat(binary); os.IsNotExist(err) {
-			continue
-		}
-		cmd := exec.Command("setcap", "cap_net_bind_service=+ep", binary)
-		if err := cmd.Run(); err != nil {
-			return fmt.Errorf("setcap failed on %s: %w (node won't be able to bind port 443)", binary, err)
-		}
-		ps.logf("    ✓ setcap on %s", binary)
-	}
-	return nil
-}
-
-// disableResolvedStub disables systemd-resolved's stub listener so CoreDNS can bind port 53.
-func (ps *ProductionSetup) disableResolvedStub() error {
-	// Delegate to the coredns installer's method
-	return ps.binaryInstaller.coredns.DisableResolvedStubListener()
-}
-
-// installAnyonFromPreBuilt installs the Anyone relay .deb from the packages dir,
-// falling back to apt install if the .deb is not bundled.
-func (ps *ProductionSetup) installAnyonFromPreBuilt() error {
-	debPath := filepath.Join(OramaPackagesDir, "anon.deb")
-	if _, err := os.Stat(debPath); err == nil {
-		ps.logf("  Installing Anyone from bundled .deb...")
-		cmd := exec.Command("dpkg", "-i", debPath)
-		if err := cmd.Run(); err != nil {
-			ps.logf("  ⚠️  dpkg -i failed, falling back to apt...")
-			cmd = exec.Command("apt-get", "install", "-y", "anon")
-			if err := cmd.Run(); err != nil {
-				return fmt.Errorf("failed to install anon: %w", err)
-			}
-		}
-		ps.logf("  ✓ Anyone installed from .deb")
-		return nil
-	}
-
-	// No .deb bundled — fall back to apt (the existing path in source mode)
-	ps.logf("  Installing Anyone via apt (not bundled in archive)...")
-	cmd := exec.Command("apt-get", "install", "-y", "anon")
-	if err := cmd.Run(); err != nil {
-		return fmt.Errorf("failed to install anon via apt: %w", err)
-	}
-	ps.logf("  ✓ Anyone installed via apt")
-	return nil
-}
-
-// copyBinary copies a file from src to dest, preserving executable permissions.
-// It removes the destination first to avoid ETXTBSY ("text file busy") errors
-// when overwriting a binary that is currently running.
-func copyBinary(src, dest string) error {
-	// Ensure parent directory exists
-	if err := os.MkdirAll(filepath.Dir(dest), 0755); err != nil {
-		return err
-	}
-
-	// Remove the old binary first. On Linux, if the binary is running,
-	// rm unlinks the filename while the kernel keeps the inode alive for
-	// the running process. Writing a new file at the same path creates a
-	// fresh inode — no ETXTBSY conflict.
-	_ = os.Remove(dest)
-
-	srcFile, err := os.Open(src)
-	if err != nil {
-		return err
-	}
-	defer srcFile.Close()
-
-	destFile, err := os.OpenFile(dest, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0755)
-	if err != nil {
-		return err
-	}
-	defer destFile.Close()
-
-	if _, err := io.Copy(destFile, srcFile); err != nil {
-		return err
-	}
-
-	return nil
-}

core/pkg/gateway/auth/crypto.go

@@ -1,24 +0,0 @@
-package auth
-
-import (
-	"crypto/hmac"
-	"crypto/sha256"
-	"encoding/hex"
-)
-
-// sha256Hex returns the lowercase hex-encoded SHA-256 hash of the input string.
-// Used to hash refresh tokens before storage — deterministic so we can hash on
-// insert and hash on lookup without storing the raw token.
-func sha256Hex(s string) string {
-	h := sha256.Sum256([]byte(s))
-	return hex.EncodeToString(h[:])
-}
-
-// HmacSHA256Hex computes HMAC-SHA256 of data with the given secret key and
-// returns the result as a lowercase hex string. Used for API key hashing —
-// fast and deterministic, allowing direct DB lookup by hash.
-func HmacSHA256Hex(data, secret string) string {
-	mac := hmac.New(sha256.New, []byte(secret))
-	mac.Write([]byte(data))
-	return hex.EncodeToString(mac.Sum(nil))
-}

core/pkg/gateway/handlers/enroll/handler.go

@@ -1,435 +0,0 @@
-// Package enroll implements the OramaOS node enrollment endpoint.
-//
-// Flow:
-//  1. Operator's CLI sends POST /v1/node/enroll with code + token + node_ip
-//  2. Gateway validates invite token (single-use)
-//  3. Gateway assigns WG IP, registers peer, reads secrets
-//  4. Gateway pushes cluster config to OramaOS node at node_ip:9999
-//  5. OramaOS node configures WG, encrypts data partition, starts services
-package enroll
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"fmt"
-	"net/http"
-	"os"
-	"os/exec"
-	"strings"
-	"time"
-
-	"github.com/DeBrosOfficial/network/pkg/rqlite"
-	"go.uber.org/zap"
-)
-
-// EnrollRequest is the request from the CLI.
-type EnrollRequest struct {
-	Code   string `json:"code"`
-	Token  string `json:"token"`
-	NodeIP string `json:"node_ip"`
-}
-
-// EnrollResponse is the configuration pushed to the OramaOS node.
-type EnrollResponse struct {
-	NodeID          string     `json:"node_id"`
-	WireGuardConfig string     `json:"wireguard_config"`
-	ClusterSecret   string     `json:"cluster_secret"`
-	Peers           []PeerInfo `json:"peers"`
-}
-
-// PeerInfo describes a cluster peer for LUKS key distribution.
-type PeerInfo struct {
-	WGIP   string `json:"wg_ip"`
-	NodeID string `json:"node_id"`
-}
-
-// Handler handles OramaOS node enrollment.
-type Handler struct {
-	logger       *zap.Logger
-	rqliteClient rqlite.Client
-	oramaDir     string
-}
-
-// NewHandler creates a new enrollment handler.
-func NewHandler(logger *zap.Logger, rqliteClient rqlite.Client, oramaDir string) *Handler {
-	return &Handler{
-		logger:       logger,
-		rqliteClient: rqliteClient,
-		oramaDir:     oramaDir,
-	}
-}
-
-// HandleEnroll handles POST /v1/node/enroll.
-func (h *Handler) HandleEnroll(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodPost {
-		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
-		return
-	}
-
-	r.Body = http.MaxBytesReader(w, r.Body, 1<<20)
-	var req EnrollRequest
-	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		http.Error(w, "invalid request body", http.StatusBadRequest)
-		return
-	}
-
-	if req.Code == "" || req.Token == "" || req.NodeIP == "" {
-		http.Error(w, "code, token, and node_ip are required", http.StatusBadRequest)
-		return
-	}
-
-	ctx := r.Context()
-
-	// 1. Validate invite token (single-use, same as join handler)
-	if err := h.consumeToken(ctx, req.Token, req.NodeIP); err != nil {
-		h.logger.Warn("enroll token validation failed", zap.Error(err))
-		http.Error(w, "unauthorized: invalid or expired token", http.StatusUnauthorized)
-		return
-	}
-
-	// 2. Verify registration code against the OramaOS node
-	if err := h.verifyCode(req.NodeIP, req.Code); err != nil {
-		h.logger.Warn("registration code verification failed", zap.Error(err))
-		http.Error(w, "code verification failed: "+err.Error(), http.StatusBadRequest)
-		return
-	}
-
-	// 3. Generate WG keypair for the OramaOS node
-	wgPrivKey, wgPubKey, err := generateWGKeypair()
-	if err != nil {
-		h.logger.Error("failed to generate WG keypair", zap.Error(err))
-		http.Error(w, "internal error", http.StatusInternalServerError)
-		return
-	}
-
-	// 4. Assign WG IP
-	wgIP, err := h.assignWGIP(ctx)
-	if err != nil {
-		h.logger.Error("failed to assign WG IP", zap.Error(err))
-		http.Error(w, "failed to assign WG IP", http.StatusInternalServerError)
-		return
-	}
-
-	nodeID := fmt.Sprintf("orama-node-%s", strings.ReplaceAll(wgIP, ".", "-"))
-
-	// 5. Register WG peer in database
-	if _, err := h.rqliteClient.Exec(ctx,
-		"INSERT OR REPLACE INTO wireguard_peers (node_id, wg_ip, public_key, public_ip, wg_port) VALUES (?, ?, ?, ?, ?)",
-		nodeID, wgIP, wgPubKey, req.NodeIP, 51820); err != nil {
-		h.logger.Error("failed to register WG peer", zap.Error(err))
-		http.Error(w, "failed to register peer", http.StatusInternalServerError)
-		return
-	}
-
-	// 6. Add peer to local WireGuard interface
-	if err := h.addWGPeerLocally(wgPubKey, req.NodeIP, wgIP); err != nil {
-		h.logger.Warn("failed to add WG peer to local interface", zap.Error(err))
-	}
-
-	// 7. Read secrets
-	clusterSecret, err := os.ReadFile(h.oramaDir + "/secrets/cluster-secret")
-	if err != nil {
-		h.logger.Error("failed to read cluster secret", zap.Error(err))
-		http.Error(w, "internal error", http.StatusInternalServerError)
-		return
-	}
-
-	// 8. Build WireGuard config for the OramaOS node
-	wgConfig, err := h.buildWGConfig(ctx, wgPrivKey, wgIP)
-	if err != nil {
-		h.logger.Error("failed to build WG config", zap.Error(err))
-		http.Error(w, "internal error", http.StatusInternalServerError)
-		return
-	}
-
-	// 9. Get all peer WG IPs for LUKS key distribution
-	peers, err := h.getPeerList(ctx, wgIP)
-	if err != nil {
-		h.logger.Error("failed to get peer list", zap.Error(err))
-		http.Error(w, "internal error", http.StatusInternalServerError)
-		return
-	}
-
-	// 10. Push config to OramaOS node
-	enrollResp := EnrollResponse{
-		NodeID:          nodeID,
-		WireGuardConfig: wgConfig,
-		ClusterSecret:   strings.TrimSpace(string(clusterSecret)),
-		Peers:           peers,
-	}
-
-	if err := h.pushConfigToNode(req.NodeIP, &enrollResp); err != nil {
-		h.logger.Error("failed to push config to node", zap.Error(err))
-		http.Error(w, "failed to configure node: "+err.Error(), http.StatusInternalServerError)
-		return
-	}
-
-	h.logger.Info("OramaOS node enrolled",
-		zap.String("node_id", nodeID),
-		zap.String("wg_ip", wgIP),
-		zap.String("public_ip", req.NodeIP))
-
-	w.Header().Set("Content-Type", "application/json")
-	json.NewEncoder(w).Encode(map[string]string{
-		"status":  "enrolled",
-		"node_id": nodeID,
-		"wg_ip":   wgIP,
-	})
-}
-
-// consumeToken validates and marks an invite token as used.
-func (h *Handler) consumeToken(ctx context.Context, token, usedByIP string) error {
-	result, err := h.rqliteClient.Exec(ctx,
-		"UPDATE invite_tokens SET used_at = datetime('now'), used_by_ip = ? WHERE token = ? AND used_at IS NULL AND expires_at > datetime('now')",
-		usedByIP, token)
-	if err != nil {
-		return fmt.Errorf("database error: %w", err)
-	}
-
-	rowsAffected, err := result.RowsAffected()
-	if err != nil {
-		return fmt.Errorf("failed to check result: %w", err)
-	}
-
-	if rowsAffected == 0 {
-		return fmt.Errorf("token invalid, expired, or already used")
-	}
-
-	return nil
-}
-
-// verifyCode checks that the OramaOS node has the expected registration code.
-func (h *Handler) verifyCode(nodeIP, expectedCode string) error {
-	client := &http.Client{Timeout: 10 * time.Second}
-	resp, err := client.Get(fmt.Sprintf("http://%s:9999/", nodeIP))
-	if err != nil {
-		return fmt.Errorf("cannot reach node at %s:9999: %w", nodeIP, err)
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode == http.StatusGone {
-		return fmt.Errorf("node already served its registration code")
-	}
-	if resp.StatusCode != http.StatusOK {
-		return fmt.Errorf("node returned status %d", resp.StatusCode)
-	}
-
-	var result struct {
-		Code string `json:"code"`
-	}
-	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
-		return fmt.Errorf("invalid response from node: %w", err)
-	}
-
-	if result.Code != expectedCode {
-		return fmt.Errorf("registration code mismatch")
-	}
-
-	return nil
-}
-
-// pushConfigToNode sends cluster configuration to the OramaOS node.
-func (h *Handler) pushConfigToNode(nodeIP string, config *EnrollResponse) error {
-	body, err := json.Marshal(config)
-	if err != nil {
-		return err
-	}
-
-	client := &http.Client{Timeout: 30 * time.Second}
-	resp, err := client.Post(
-		fmt.Sprintf("http://%s:9999/v1/agent/enroll/complete", nodeIP),
-		"application/json",
-		bytes.NewReader(body),
-	)
-	if err != nil {
-		return fmt.Errorf("failed to push config: %w", err)
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK {
-		return fmt.Errorf("node returned status %d", resp.StatusCode)
-	}
-
-	return nil
-}
-
-// generateWGKeypair generates a WireGuard private/public keypair.
-func generateWGKeypair() (privKey, pubKey string, err error) {
-	privOut, err := exec.Command("wg", "genkey").Output()
-	if err != nil {
-		return "", "", fmt.Errorf("wg genkey failed: %w", err)
-	}
-	privKey = strings.TrimSpace(string(privOut))
-
-	cmd := exec.Command("wg", "pubkey")
-	cmd.Stdin = strings.NewReader(privKey)
-	pubOut, err := cmd.Output()
-	if err != nil {
-		return "", "", fmt.Errorf("wg pubkey failed: %w", err)
-	}
-	pubKey = strings.TrimSpace(string(pubOut))
-
-	return privKey, pubKey, nil
-}
-
-// assignWGIP finds the next available WG IP.
-func (h *Handler) assignWGIP(ctx context.Context) (string, error) {
-	var rows []struct {
-		WGIP string `db:"wg_ip"`
-	}
-	if err := h.rqliteClient.Query(ctx, &rows, "SELECT wg_ip FROM wireguard_peers"); err != nil {
-		return "", fmt.Errorf("failed to query WG IPs: %w", err)
-	}
-
-	if len(rows) == 0 {
-		return "10.0.0.2", nil
-	}
-
-	maxD := 0
-	maxC := 0
-	for _, row := range rows {
-		var a, b, c, d int
-		if _, err := fmt.Sscanf(row.WGIP, "%d.%d.%d.%d", &a, &b, &c, &d); err != nil {
-			continue
-		}
-		if c > maxC || (c == maxC && d > maxD) {
-			maxC, maxD = c, d
-		}
-	}
-
-	maxD++
-	if maxD > 254 {
-		maxC++
-		maxD = 1
-	}
-
-	return fmt.Sprintf("10.0.%d.%d", maxC, maxD), nil
-}
-
-// addWGPeerLocally adds a peer to the local wg0 interface.
-func (h *Handler) addWGPeerLocally(pubKey, publicIP, wgIP string) error {
-	cmd := exec.Command("wg", "set", "wg0",
-		"peer", pubKey,
-		"endpoint", fmt.Sprintf("%s:51820", publicIP),
-		"allowed-ips", fmt.Sprintf("%s/32", wgIP),
-		"persistent-keepalive", "25")
-	if output, err := cmd.CombinedOutput(); err != nil {
-		return fmt.Errorf("wg set failed: %w\n%s", err, string(output))
-	}
-	return nil
-}
-
-// buildWGConfig generates a wg0.conf for the OramaOS node.
-func (h *Handler) buildWGConfig(ctx context.Context, privKey, nodeWGIP string) (string, error) {
-	// Get this node's public key and WG IP
-	myPubKey, err := exec.Command("wg", "show", "wg0", "public-key").Output()
-	if err != nil {
-		return "", fmt.Errorf("failed to get local WG public key: %w", err)
-	}
-
-	myWGIP, err := h.getMyWGIP()
-	if err != nil {
-		return "", fmt.Errorf("failed to get local WG IP: %w", err)
-	}
-
-	myPublicIP, err := h.getMyPublicIP(ctx)
-	if err != nil {
-		return "", fmt.Errorf("failed to get local public IP: %w", err)
-	}
-
-	var config strings.Builder
-	config.WriteString("[Interface]\n")
-	config.WriteString(fmt.Sprintf("PrivateKey = %s\n", privKey))
-	config.WriteString(fmt.Sprintf("Address = %s/24\n", nodeWGIP))
-	config.WriteString("ListenPort = 51820\n")
-	config.WriteString("\n")
-
-	// Add this gateway node as a peer
-	config.WriteString("[Peer]\n")
-	config.WriteString(fmt.Sprintf("PublicKey = %s\n", strings.TrimSpace(string(myPubKey))))
-	config.WriteString(fmt.Sprintf("Endpoint = %s:51820\n", myPublicIP))
-	config.WriteString(fmt.Sprintf("AllowedIPs = %s/32\n", myWGIP))
-	config.WriteString("PersistentKeepalive = 25\n")
-
-	// Add all existing peers
-	type peerRow struct {
-		WGIP      string `db:"wg_ip"`
-		PublicKey string `db:"public_key"`
-		PublicIP  string `db:"public_ip"`
-	}
-	var peers []peerRow
-	if err := h.rqliteClient.Query(ctx, &peers,
-		"SELECT wg_ip, public_key, public_ip FROM wireguard_peers WHERE wg_ip != ?", nodeWGIP); err != nil {
-		h.logger.Warn("failed to query peers for WG config", zap.Error(err))
-	}
-
-	for _, p := range peers {
-		if p.PublicKey == strings.TrimSpace(string(myPubKey)) {
-			continue // already added above
-		}
-		config.WriteString(fmt.Sprintf("\n[Peer]\nPublicKey = %s\nEndpoint = %s:51820\nAllowedIPs = %s/32\nPersistentKeepalive = 25\n",
-			p.PublicKey, p.PublicIP, p.WGIP))
-	}
-
-	return config.String(), nil
-}
-
-// getPeerList returns all cluster peers for LUKS key distribution.
-func (h *Handler) getPeerList(ctx context.Context, excludeWGIP string) ([]PeerInfo, error) {
-	type peerRow struct {
-		NodeID string `db:"node_id"`
-		WGIP   string `db:"wg_ip"`
-	}
-	var rows []peerRow
-	if err := h.rqliteClient.Query(ctx, &rows,
-		"SELECT node_id, wg_ip FROM wireguard_peers WHERE wg_ip != ?", excludeWGIP); err != nil {
-		return nil, err
-	}
-
-	peers := make([]PeerInfo, 0, len(rows))
-	for _, row := range rows {
-		peers = append(peers, PeerInfo{
-			WGIP:   row.WGIP,
-			NodeID: row.NodeID,
-		})
-	}
-	return peers, nil
-}
-
-// getMyWGIP gets this node's WireGuard IP.
-func (h *Handler) getMyWGIP() (string, error) {
-	out, err := exec.Command("ip", "-4", "addr", "show", "wg0").CombinedOutput()
-	if err != nil {
-		return "", fmt.Errorf("failed to get wg0 info: %w", err)
-	}
-	for _, line := range strings.Split(string(out), "\n") {
-		line = strings.TrimSpace(line)
-		if strings.HasPrefix(line, "inet ") {
-			parts := strings.Fields(line)
-			if len(parts) >= 2 {
-				return strings.Split(parts[1], "/")[0], nil
-			}
-		}
-	}
-	return "", fmt.Errorf("could not find wg0 IP")
-}
-
-// getMyPublicIP reads this node's public IP from the database.
-func (h *Handler) getMyPublicIP(ctx context.Context) (string, error) {
-	myWGIP, err := h.getMyWGIP()
-	if err != nil {
-		return "", err
-	}
-	var rows []struct {
-		PublicIP string `db:"public_ip"`
-	}
-	if err := h.rqliteClient.Query(ctx, &rows,
-		"SELECT public_ip FROM wireguard_peers WHERE wg_ip = ?", myWGIP); err != nil {
-		return "", err
-	}
-	if len(rows) == 0 {
-		return "", fmt.Errorf("no peer entry for WG IP %s", myWGIP)
-	}
-	return rows[0].PublicIP, nil
-}

core/pkg/gateway/handlers/enroll/node_proxy.go

@@ -1,272 +0,0 @@
-package enroll
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"io"
-	"log"
-	"net/http"
-	"os/exec"
-	"strings"
-	"time"
-
-	"go.uber.org/zap"
-)
-
-// HandleNodeStatus proxies GET /v1/node/status to the agent over WireGuard.
-// Query param: ?node_id=<node_id> or ?wg_ip=<wg_ip>
-func (h *Handler) HandleNodeStatus(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodGet {
-		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
-		return
-	}
-
-	wgIP, err := h.resolveNodeIP(r)
-	if err != nil {
-		http.Error(w, err.Error(), http.StatusBadRequest)
-		return
-	}
-
-	// Proxy to agent's status endpoint
-	body, statusCode, err := h.proxyToAgent(wgIP, "GET", "/v1/agent/status", nil)
-	if err != nil {
-		h.logger.Warn("failed to proxy status request", zap.String("wg_ip", wgIP), zap.Error(err))
-		http.Error(w, "node unreachable: "+err.Error(), http.StatusBadGateway)
-		return
-	}
-
-	w.Header().Set("Content-Type", "application/json")
-	w.WriteHeader(statusCode)
-	w.Write(body)
-}
-
-// HandleNodeCommand proxies POST /v1/node/command to the agent over WireGuard.
-func (h *Handler) HandleNodeCommand(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodPost {
-		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
-		return
-	}
-
-	wgIP, err := h.resolveNodeIP(r)
-	if err != nil {
-		http.Error(w, err.Error(), http.StatusBadRequest)
-		return
-	}
-
-	// Read command body
-	r.Body = http.MaxBytesReader(w, r.Body, 1<<20)
-	cmdBody, err := io.ReadAll(r.Body)
-	if err != nil {
-		http.Error(w, "invalid request body", http.StatusBadRequest)
-		return
-	}
-
-	// Proxy to agent's command endpoint
-	body, statusCode, err := h.proxyToAgent(wgIP, "POST", "/v1/agent/command", cmdBody)
-	if err != nil {
-		h.logger.Warn("failed to proxy command", zap.String("wg_ip", wgIP), zap.Error(err))
-		http.Error(w, "node unreachable: "+err.Error(), http.StatusBadGateway)
-		return
-	}
-
-	w.Header().Set("Content-Type", "application/json")
-	w.WriteHeader(statusCode)
-	w.Write(body)
-}
-
-// HandleNodeLogs proxies GET /v1/node/logs to the agent over WireGuard.
-// Query params: ?node_id=<id>&service=<name>&lines=<n>
-func (h *Handler) HandleNodeLogs(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodGet {
-		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
-		return
-	}
-
-	wgIP, err := h.resolveNodeIP(r)
-	if err != nil {
-		http.Error(w, err.Error(), http.StatusBadRequest)
-		return
-	}
-
-	// Build query string for agent
-	service := r.URL.Query().Get("service")
-	lines := r.URL.Query().Get("lines")
-	agentPath := "/v1/agent/logs"
-	params := []string{}
-	if service != "" {
-		params = append(params, "service="+service)
-	}
-	if lines != "" {
-		params = append(params, "lines="+lines)
-	}
-	if len(params) > 0 {
-		agentPath += "?" + strings.Join(params, "&")
-	}
-
-	body, statusCode, err := h.proxyToAgent(wgIP, "GET", agentPath, nil)
-	if err != nil {
-		h.logger.Warn("failed to proxy logs request", zap.String("wg_ip", wgIP), zap.Error(err))
-		http.Error(w, "node unreachable: "+err.Error(), http.StatusBadGateway)
-		return
-	}
-
-	w.Header().Set("Content-Type", "application/json")
-	w.WriteHeader(statusCode)
-	w.Write(body)
-}
-
-// HandleNodeLeave handles POST /v1/node/leave — graceful node departure.
-// Orchestrates: stop services → redistribute Shamir shares → remove WG peer.
-func (h *Handler) HandleNodeLeave(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodPost {
-		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
-		return
-	}
-
-	r.Body = http.MaxBytesReader(w, r.Body, 1<<20)
-	var req struct {
-		NodeID string `json:"node_id"`
-		WGIP   string `json:"wg_ip"`
-	}
-	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		http.Error(w, "invalid request body", http.StatusBadRequest)
-		return
-	}
-
-	wgIP := req.WGIP
-	if wgIP == "" && req.NodeID != "" {
-		resolved, err := h.nodeIDToWGIP(r.Context(), req.NodeID)
-		if err != nil {
-			http.Error(w, "node not found: "+err.Error(), http.StatusNotFound)
-			return
-		}
-		wgIP = resolved
-	}
-	if wgIP == "" {
-		http.Error(w, "node_id or wg_ip is required", http.StatusBadRequest)
-		return
-	}
-
-	h.logger.Info("node leave requested", zap.String("wg_ip", wgIP))
-
-	// Step 1: Tell the agent to stop services
-	_, _, err := h.proxyToAgent(wgIP, "POST", "/v1/agent/command",
-		[]byte(`{"action":"stop"}`))
-	if err != nil {
-		h.logger.Warn("failed to stop services on leaving node", zap.Error(err))
-		// Continue — node may already be down
-	}
-
-	// Step 2: Remove WG peer from database
-	ctx := r.Context()
-	if _, err := h.rqliteClient.Exec(ctx,
-		"DELETE FROM wireguard_peers WHERE wg_ip = ?", wgIP); err != nil {
-		h.logger.Error("failed to remove WG peer from database", zap.Error(err))
-		http.Error(w, "failed to remove peer", http.StatusInternalServerError)
-		return
-	}
-
-	// Step 3: Remove from local WireGuard interface
-	// Get the peer's public key first
-	var rows []struct {
-		PublicKey string `db:"public_key"`
-	}
-	_ = h.rqliteClient.Query(ctx, &rows,
-		"SELECT public_key FROM wireguard_peers WHERE wg_ip = ?", wgIP)
-	// Peer already deleted above, but try to remove from wg0 anyway
-	h.removeWGPeerLocally(wgIP)
-
-	h.logger.Info("node removed from cluster", zap.String("wg_ip", wgIP))
-
-	w.Header().Set("Content-Type", "application/json")
-	json.NewEncoder(w).Encode(map[string]string{
-		"status": "removed",
-		"wg_ip":  wgIP,
-	})
-}
-
-// proxyToAgent sends an HTTP request to the OramaOS agent over WireGuard.
-func (h *Handler) proxyToAgent(wgIP, method, path string, body []byte) ([]byte, int, error) {
-	url := fmt.Sprintf("http://%s:9998%s", wgIP, path)
-
-	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
-	defer cancel()
-
-	var reqBody io.Reader
-	if body != nil {
-		reqBody = strings.NewReader(string(body))
-	}
-
-	req, err := http.NewRequestWithContext(ctx, method, url, reqBody)
-	if err != nil {
-		return nil, 0, err
-	}
-	if body != nil {
-		req.Header.Set("Content-Type", "application/json")
-	}
-
-	client := &http.Client{Timeout: 15 * time.Second}
-	resp, err := client.Do(req)
-	if err != nil {
-		return nil, 0, fmt.Errorf("request to agent failed: %w", err)
-	}
-	defer resp.Body.Close()
-
-	respBody, err := io.ReadAll(resp.Body)
-	if err != nil {
-		return nil, resp.StatusCode, fmt.Errorf("failed to read agent response: %w", err)
-	}
-
-	return respBody, resp.StatusCode, nil
-}
-
-// resolveNodeIP extracts the WG IP from query parameters.
-func (h *Handler) resolveNodeIP(r *http.Request) (string, error) {
-	wgIP := r.URL.Query().Get("wg_ip")
-	if wgIP != "" {
-		return wgIP, nil
-	}
-
-	nodeID := r.URL.Query().Get("node_id")
-	if nodeID != "" {
-		return h.nodeIDToWGIP(r.Context(), nodeID)
-	}
-
-	return "", fmt.Errorf("wg_ip or node_id query parameter is required")
-}
-
-// nodeIDToWGIP resolves a node_id to its WireGuard IP.
-func (h *Handler) nodeIDToWGIP(ctx context.Context, nodeID string) (string, error) {
-	var rows []struct {
-		WGIP string `db:"wg_ip"`
-	}
-	if err := h.rqliteClient.Query(ctx, &rows,
-		"SELECT wg_ip FROM wireguard_peers WHERE node_id = ?", nodeID); err != nil {
-		return "", err
-	}
-	if len(rows) == 0 {
-		return "", fmt.Errorf("no node found with id %s", nodeID)
-	}
-	return rows[0].WGIP, nil
-}
-
-// removeWGPeerLocally removes a peer from the local wg0 interface by its allowed IP.
-func (h *Handler) removeWGPeerLocally(wgIP string) {
-	// Find peer public key by allowed IP
-	out, err := exec.Command("wg", "show", "wg0", "dump").Output()
-	if err != nil {
-		log.Printf("failed to get wg dump: %v", err)
-		return
-	}
-
-	for _, line := range strings.Split(string(out), "\n") {
-		fields := strings.Split(line, "\t")
-		if len(fields) >= 4 && strings.Contains(fields[3], wgIP) {
-			pubKey := fields[0]
-			exec.Command("wg", "set", "wg0", "peer", pubKey, "remove").Run()
-			log.Printf("removed WG peer %s (%s)", pubKey[:8]+"...", wgIP)
-			return
-		}
-	}
-}

core/pkg/gateway/handlers/join/handler_test.go

@@ -1,112 +0,0 @@
-package join
-
-import (
-	"encoding/base64"
-	"fmt"
-	"net"
-	"strings"
-	"testing"
-)
-
-func TestWgPeersContainsIP_found(t *testing.T) {
-	peers := []WGPeerInfo{
-		{PublicKey: "key1", Endpoint: "1.2.3.4:51820", AllowedIP: "10.0.0.1/32"},
-		{PublicKey: "key2", Endpoint: "5.6.7.8:51820", AllowedIP: "10.0.0.2/32"},
-	}
-
-	if !wgPeersContainsIP(peers, "10.0.0.1") {
-		t.Error("expected to find 10.0.0.1 in peer list")
-	}
-	if !wgPeersContainsIP(peers, "10.0.0.2") {
-		t.Error("expected to find 10.0.0.2 in peer list")
-	}
-}
-
-func TestWgPeersContainsIP_not_found(t *testing.T) {
-	peers := []WGPeerInfo{
-		{PublicKey: "key1", Endpoint: "1.2.3.4:51820", AllowedIP: "10.0.0.1/32"},
-	}
-
-	if wgPeersContainsIP(peers, "10.0.0.2") {
-		t.Error("did not expect to find 10.0.0.2 in peer list")
-	}
-}
-
-func TestWgPeersContainsIP_empty_list(t *testing.T) {
-	if wgPeersContainsIP(nil, "10.0.0.1") {
-		t.Error("did not expect to find any IP in nil peer list")
-	}
-	if wgPeersContainsIP([]WGPeerInfo{}, "10.0.0.1") {
-		t.Error("did not expect to find any IP in empty peer list")
-	}
-}
-
-func TestAssignWGIP_format(t *testing.T) {
-	// Verify the WG IP format used in the handler matches what wgPeersContainsIP expects
-	wgIP := "10.0.0.1"
-	allowedIP := fmt.Sprintf("%s/32", wgIP)
-	peers := []WGPeerInfo{{AllowedIP: allowedIP}}
-
-	if !wgPeersContainsIP(peers, wgIP) {
-		t.Errorf("format mismatch: wgPeersContainsIP(%q, %q) should match", allowedIP, wgIP)
-	}
-}
-
-func TestValidatePublicIP(t *testing.T) {
-	tests := []struct {
-		name  string
-		ip    string
-		valid bool
-	}{
-		{"valid IPv4", "46.225.234.112", true},
-		{"loopback", "127.0.0.1", true},
-		{"invalid string", "not-an-ip", false},
-		{"empty", "", false},
-		{"IPv6", "::1", false},
-		{"with newline", "1.2.3.4\n5.6.7.8", false},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			parsed := net.ParseIP(tt.ip)
-			isValid := parsed != nil && parsed.To4() != nil && !strings.ContainsAny(tt.ip, "\n\r")
-			if isValid != tt.valid {
-				t.Errorf("IP %q: expected valid=%v, got %v", tt.ip, tt.valid, isValid)
-			}
-		})
-	}
-}
-
-func TestValidateWGPublicKey(t *testing.T) {
-	// Valid WireGuard key: 32 bytes, base64 encoded = 44 chars
-	validKey := base64.StdEncoding.EncodeToString(make([]byte, 32))
-
-	tests := []struct {
-		name  string
-		key   string
-		valid bool
-	}{
-		{"valid 32-byte key", validKey, true},
-		{"too short", base64.StdEncoding.EncodeToString(make([]byte, 16)), false},
-		{"too long", base64.StdEncoding.EncodeToString(make([]byte, 64)), false},
-		{"not base64", "not-a-valid-base64-key!!!", false},
-		{"empty", "", false},
-		{"newline injection", validKey + "\n[Peer]", false},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			if strings.ContainsAny(tt.key, "\n\r") {
-				if tt.valid {
-					t.Errorf("key %q contains newlines but expected valid", tt.key)
-				}
-				return
-			}
-			decoded, err := base64.StdEncoding.DecodeString(tt.key)
-			isValid := err == nil && len(decoded) == 32
-			if isValid != tt.valid {
-				t.Errorf("key %q: expected valid=%v, got %v", tt.key, tt.valid, isValid)
-			}
-		})
-	}
-}

core/pkg/gateway/handlers/serverless/secrets_handler.go

@@ -1,146 +0,0 @@
-package serverless
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"net/http"
-	"time"
-
-	"github.com/DeBrosOfficial/network/pkg/serverless"
-	"go.uber.org/zap"
-)
-
-// setSecretRequest is the request body for setting a secret.
-type setSecretRequest struct {
-	Name  string `json:"name"`
-	Value string `json:"value"`
-}
-
-// HandleSetSecret handles PUT /v1/functions/secrets
-// Stores an encrypted secret scoped to the caller's namespace.
-func (h *ServerlessHandlers) HandleSetSecret(w http.ResponseWriter, r *http.Request) {
-	if h.secretsManager == nil {
-		writeError(w, http.StatusNotImplemented, "Secrets management not available")
-		return
-	}
-
-	namespace := h.getNamespaceFromRequest(r)
-	if namespace == "" {
-		writeError(w, http.StatusBadRequest, "namespace required")
-		return
-	}
-
-	var req setSecretRequest
-	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		writeError(w, http.StatusBadRequest, "Invalid JSON: "+err.Error())
-		return
-	}
-
-	if req.Name == "" {
-		writeError(w, http.StatusBadRequest, "secret name required")
-		return
-	}
-	if req.Value == "" {
-		writeError(w, http.StatusBadRequest, "secret value required")
-		return
-	}
-
-	ctx, cancel := context.WithTimeout(r.Context(), 10*time.Second)
-	defer cancel()
-
-	if err := h.secretsManager.Set(ctx, namespace, req.Name, req.Value); err != nil {
-		h.logger.Error("Failed to set secret",
-			zap.String("namespace", namespace),
-			zap.String("name", req.Name),
-			zap.Error(err),
-		)
-		writeError(w, http.StatusInternalServerError, "Failed to set secret: "+err.Error())
-		return
-	}
-
-	h.logger.Info("Secret set via API",
-		zap.String("namespace", namespace),
-		zap.String("name", req.Name),
-	)
-
-	writeJSON(w, http.StatusOK, map[string]any{
-		"message":   "Secret set",
-		"name":      req.Name,
-		"namespace": namespace,
-	})
-}
-
-// HandleListSecrets handles GET /v1/functions/secrets
-// Lists all secret names in the caller's namespace (values are never returned).
-func (h *ServerlessHandlers) HandleListSecrets(w http.ResponseWriter, r *http.Request) {
-	if h.secretsManager == nil {
-		writeError(w, http.StatusNotImplemented, "Secrets management not available")
-		return
-	}
-
-	namespace := h.getNamespaceFromRequest(r)
-	if namespace == "" {
-		writeError(w, http.StatusBadRequest, "namespace required")
-		return
-	}
-
-	ctx, cancel := context.WithTimeout(r.Context(), 10*time.Second)
-	defer cancel()
-
-	names, err := h.secretsManager.List(ctx, namespace)
-	if err != nil {
-		h.logger.Error("Failed to list secrets",
-			zap.String("namespace", namespace),
-			zap.Error(err),
-		)
-		writeError(w, http.StatusInternalServerError, "Failed to list secrets")
-		return
-	}
-
-	writeJSON(w, http.StatusOK, map[string]any{
-		"secrets": names,
-		"count":   len(names),
-	})
-}
-
-// HandleDeleteSecret handles DELETE /v1/functions/secrets/{name}
-// Deletes a secret from the caller's namespace.
-func (h *ServerlessHandlers) HandleDeleteSecret(w http.ResponseWriter, r *http.Request, secretName string) {
-	if h.secretsManager == nil {
-		writeError(w, http.StatusNotImplemented, "Secrets management not available")
-		return
-	}
-
-	namespace := h.getNamespaceFromRequest(r)
-	if namespace == "" {
-		writeError(w, http.StatusBadRequest, "namespace required")
-		return
-	}
-
-	ctx, cancel := context.WithTimeout(r.Context(), 10*time.Second)
-	defer cancel()
-
-	if err := h.secretsManager.Delete(ctx, namespace, secretName); err != nil {
-		if errors.Is(err, serverless.ErrSecretNotFound) {
-			writeError(w, http.StatusNotFound, "Secret not found")
-			return
-		}
-		h.logger.Error("Failed to delete secret",
-			zap.String("namespace", namespace),
-			zap.String("name", secretName),
-			zap.Error(err),
-		)
-		writeError(w, http.StatusInternalServerError, "Failed to delete secret: "+err.Error())
-		return
-	}
-
-	h.logger.Info("Secret deleted via API",
-		zap.String("namespace", namespace),
-		zap.String("name", secretName),
-	)
-
-	writeJSON(w, http.StatusOK, map[string]any{
-		"message": "Secret deleted",
-	})
-}

core/pkg/gateway/handlers/serverless/secrets_handler_test.go

@@ -1,339 +0,0 @@
-package serverless
-
-import (
-	"context"
-	"encoding/json"
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"testing"
-
-	"github.com/DeBrosOfficial/network/pkg/serverless"
-	"go.uber.org/zap"
-)
-
-// ---------------------------------------------------------------------------
-// Mock SecretsManager
-// ---------------------------------------------------------------------------
-
-type mockSecretsManager struct {
-	secrets map[string]map[string]string // namespace -> name -> value
-	setErr  error
-	getErr  error
-	listErr error
-	delErr  error
-}
-
-func newMockSecretsManager() *mockSecretsManager {
-	return &mockSecretsManager{
-		secrets: make(map[string]map[string]string),
-	}
-}
-
-func (m *mockSecretsManager) Set(_ context.Context, namespace, name, value string) error {
-	if m.setErr != nil {
-		return m.setErr
-	}
-	if m.secrets[namespace] == nil {
-		m.secrets[namespace] = make(map[string]string)
-	}
-	m.secrets[namespace][name] = value
-	return nil
-}
-
-func (m *mockSecretsManager) Get(_ context.Context, namespace, name string) (string, error) {
-	if m.getErr != nil {
-		return "", m.getErr
-	}
-	ns, ok := m.secrets[namespace]
-	if !ok {
-		return "", serverless.ErrSecretNotFound
-	}
-	v, ok := ns[name]
-	if !ok {
-		return "", serverless.ErrSecretNotFound
-	}
-	return v, nil
-}
-
-func (m *mockSecretsManager) List(_ context.Context, namespace string) ([]string, error) {
-	if m.listErr != nil {
-		return nil, m.listErr
-	}
-	ns := m.secrets[namespace]
-	names := make([]string, 0, len(ns))
-	for k := range ns {
-		names = append(names, k)
-	}
-	return names, nil
-}
-
-func (m *mockSecretsManager) Delete(_ context.Context, namespace, name string) error {
-	if m.delErr != nil {
-		return m.delErr
-	}
-	ns, ok := m.secrets[namespace]
-	if !ok {
-		return serverless.ErrSecretNotFound
-	}
-	if _, ok := ns[name]; !ok {
-		return serverless.ErrSecretNotFound
-	}
-	delete(ns, name)
-	return nil
-}
-
-// ---------------------------------------------------------------------------
-// Helpers
-// ---------------------------------------------------------------------------
-
-func newSecretsTestHandlers(sm serverless.SecretsManager) *ServerlessHandlers {
-	logger := zap.NewNop()
-	wsManager := serverless.NewWSManager(logger)
-	return NewServerlessHandlers(
-		nil,
-		newMockRegistry(),
-		wsManager,
-		nil,
-		nil,
-		sm,
-		logger,
-	)
-}
-
-func decodeJSON(t *testing.T, rec *httptest.ResponseRecorder) map[string]interface{} {
-	t.Helper()
-	var result map[string]interface{}
-	if err := json.Unmarshal(rec.Body.Bytes(), &result); err != nil {
-		t.Fatalf("failed to decode response: %v", err)
-	}
-	return result
-}
-
-// ---------------------------------------------------------------------------
-// Tests
-// ---------------------------------------------------------------------------
-
-func TestHandleSetSecret_Success(t *testing.T) {
-	sm := newMockSecretsManager()
-	h := newSecretsTestHandlers(sm)
-
-	body := `{"name":"API_KEY","value":"secret123"}`
-	req := httptest.NewRequest(http.MethodPut, "/v1/functions/secrets?namespace=myns", strings.NewReader(body))
-	req.Header.Set("Content-Type", "application/json")
-	rec := httptest.NewRecorder()
-
-	h.HandleSetSecret(rec, req)
-
-	if rec.Code != http.StatusOK {
-		t.Errorf("expected 200, got %d: %s", rec.Code, rec.Body.String())
-	}
-
-	resp := decodeJSON(t, rec)
-	if resp["name"] != "API_KEY" {
-		t.Errorf("expected name API_KEY, got %v", resp["name"])
-	}
-
-	// Verify stored
-	if sm.secrets["myns"]["API_KEY"] != "secret123" {
-		t.Errorf("secret not stored correctly")
-	}
-}
-
-func TestHandleSetSecret_MissingName(t *testing.T) {
-	h := newSecretsTestHandlers(newMockSecretsManager())
-
-	body := `{"value":"secret123"}`
-	req := httptest.NewRequest(http.MethodPut, "/v1/functions/secrets?namespace=myns", strings.NewReader(body))
-	req.Header.Set("Content-Type", "application/json")
-	rec := httptest.NewRecorder()
-
-	h.HandleSetSecret(rec, req)
-
-	if rec.Code != http.StatusBadRequest {
-		t.Errorf("expected 400, got %d", rec.Code)
-	}
-}
-
-func TestHandleSetSecret_MissingValue(t *testing.T) {
-	h := newSecretsTestHandlers(newMockSecretsManager())
-
-	body := `{"name":"API_KEY"}`
-	req := httptest.NewRequest(http.MethodPut, "/v1/functions/secrets?namespace=myns", strings.NewReader(body))
-	req.Header.Set("Content-Type", "application/json")
-	rec := httptest.NewRecorder()
-
-	h.HandleSetSecret(rec, req)
-
-	if rec.Code != http.StatusBadRequest {
-		t.Errorf("expected 400, got %d", rec.Code)
-	}
-}
-
-func TestHandleSetSecret_NilManager(t *testing.T) {
-	h := newSecretsTestHandlers(nil)
-
-	body := `{"name":"API_KEY","value":"secret123"}`
-	req := httptest.NewRequest(http.MethodPut, "/v1/functions/secrets?namespace=myns", strings.NewReader(body))
-	req.Header.Set("Content-Type", "application/json")
-	rec := httptest.NewRecorder()
-
-	h.HandleSetSecret(rec, req)
-
-	if rec.Code != http.StatusNotImplemented {
-		t.Errorf("expected 501, got %d", rec.Code)
-	}
-}
-
-func TestHandleListSecrets_Empty(t *testing.T) {
-	h := newSecretsTestHandlers(newMockSecretsManager())
-
-	req := httptest.NewRequest(http.MethodGet, "/v1/functions/secrets?namespace=myns", nil)
-	rec := httptest.NewRecorder()
-
-	h.HandleListSecrets(rec, req)
-
-	if rec.Code != http.StatusOK {
-		t.Errorf("expected 200, got %d", rec.Code)
-	}
-
-	resp := decodeJSON(t, rec)
-	if resp["count"].(float64) != 0 {
-		t.Errorf("expected count 0, got %v", resp["count"])
-	}
-}
-
-func TestHandleListSecrets_Populated(t *testing.T) {
-	sm := newMockSecretsManager()
-	sm.secrets["myns"] = map[string]string{
-		"KEY_A": "val_a",
-		"KEY_B": "val_b",
-	}
-	h := newSecretsTestHandlers(sm)
-
-	req := httptest.NewRequest(http.MethodGet, "/v1/functions/secrets?namespace=myns", nil)
-	rec := httptest.NewRecorder()
-
-	h.HandleListSecrets(rec, req)
-
-	if rec.Code != http.StatusOK {
-		t.Errorf("expected 200, got %d", rec.Code)
-	}
-
-	resp := decodeJSON(t, rec)
-	if resp["count"].(float64) != 2 {
-		t.Errorf("expected count 2, got %v", resp["count"])
-	}
-}
-
-func TestHandleListSecrets_NilManager(t *testing.T) {
-	h := newSecretsTestHandlers(nil)
-
-	req := httptest.NewRequest(http.MethodGet, "/v1/functions/secrets?namespace=myns", nil)
-	rec := httptest.NewRecorder()
-
-	h.HandleListSecrets(rec, req)
-
-	if rec.Code != http.StatusNotImplemented {
-		t.Errorf("expected 501, got %d", rec.Code)
-	}
-}
-
-func TestHandleDeleteSecret_Success(t *testing.T) {
-	sm := newMockSecretsManager()
-	sm.secrets["myns"] = map[string]string{"API_KEY": "val"}
-	h := newSecretsTestHandlers(sm)
-
-	req := httptest.NewRequest(http.MethodDelete, "/v1/functions/secrets/API_KEY?namespace=myns", nil)
-	rec := httptest.NewRecorder()
-
-	h.HandleDeleteSecret(rec, req, "API_KEY")
-
-	if rec.Code != http.StatusOK {
-		t.Errorf("expected 200, got %d", rec.Code)
-	}
-
-	if _, exists := sm.secrets["myns"]["API_KEY"]; exists {
-		t.Error("secret should have been deleted")
-	}
-}
-
-func TestHandleDeleteSecret_NotFound(t *testing.T) {
-	h := newSecretsTestHandlers(newMockSecretsManager())
-
-	req := httptest.NewRequest(http.MethodDelete, "/v1/functions/secrets/MISSING?namespace=myns", nil)
-	rec := httptest.NewRecorder()
-
-	h.HandleDeleteSecret(rec, req, "MISSING")
-
-	if rec.Code != http.StatusNotFound {
-		t.Errorf("expected 404, got %d", rec.Code)
-	}
-}
-
-func TestHandleDeleteSecret_NilManager(t *testing.T) {
-	h := newSecretsTestHandlers(nil)
-
-	req := httptest.NewRequest(http.MethodDelete, "/v1/functions/secrets/KEY?namespace=myns", nil)
-	rec := httptest.NewRecorder()
-
-	h.HandleDeleteSecret(rec, req, "KEY")
-
-	if rec.Code != http.StatusNotImplemented {
-		t.Errorf("expected 501, got %d", rec.Code)
-	}
-}
-
-// Test routing through handleFunctionByName
-func TestRouting_SecretsSet(t *testing.T) {
-	sm := newMockSecretsManager()
-	h := newSecretsTestHandlers(sm)
-
-	mux := http.NewServeMux()
-	h.RegisterRoutes(mux)
-
-	body := `{"name":"MY_SECRET","value":"myval"}`
-	req := httptest.NewRequest(http.MethodPut, "/v1/functions/secrets?namespace=test", strings.NewReader(body))
-	req.Header.Set("Content-Type", "application/json")
-	rec := httptest.NewRecorder()
-
-	mux.ServeHTTP(rec, req)
-
-	if rec.Code != http.StatusOK {
-		t.Errorf("expected 200, got %d: %s", rec.Code, rec.Body.String())
-	}
-}
-
-func TestRouting_SecretsList(t *testing.T) {
-	h := newSecretsTestHandlers(newMockSecretsManager())
-
-	mux := http.NewServeMux()
-	h.RegisterRoutes(mux)
-
-	req := httptest.NewRequest(http.MethodGet, "/v1/functions/secrets?namespace=test", nil)
-	rec := httptest.NewRecorder()
-
-	mux.ServeHTTP(rec, req)
-
-	if rec.Code != http.StatusOK {
-		t.Errorf("expected 200, got %d: %s", rec.Code, rec.Body.String())
-	}
-}
-
-func TestRouting_SecretsDelete(t *testing.T) {
-	sm := newMockSecretsManager()
-	sm.secrets["test"] = map[string]string{"KEY": "val"}
-	h := newSecretsTestHandlers(sm)
-
-	mux := http.NewServeMux()
-	h.RegisterRoutes(mux)
-
-	req := httptest.NewRequest(http.MethodDelete, "/v1/functions/secrets/KEY?namespace=test", nil)
-	rec := httptest.NewRecorder()
-
-	mux.ServeHTTP(rec, req)
-
-	if rec.Code != http.StatusOK {
-		t.Errorf("expected 200, got %d: %s", rec.Code, rec.Body.String())
-	}
-}

core/pkg/gateway/handlers/serverless/trigger_handler.go

@@ -1,188 +0,0 @@
-package serverless
-
-import (
-	"context"
-	"encoding/json"
-	"net/http"
-	"time"
-
-	"github.com/DeBrosOfficial/network/pkg/serverless"
-	"go.uber.org/zap"
-)
-
-// addTriggerRequest is the request body for adding a PubSub trigger.
-type addTriggerRequest struct {
-	Topic string `json:"topic"`
-}
-
-// HandleAddTrigger handles POST /v1/functions/{name}/triggers
-// Adds a PubSub trigger that invokes this function when a message is published to the topic.
-func (h *ServerlessHandlers) HandleAddTrigger(w http.ResponseWriter, r *http.Request, functionName string) {
-	if h.triggerStore == nil {
-		writeError(w, http.StatusNotImplemented, "PubSub triggers not available")
-		return
-	}
-
-	namespace := h.getNamespaceFromRequest(r)
-	if namespace == "" {
-		writeError(w, http.StatusBadRequest, "namespace required")
-		return
-	}
-
-	var req addTriggerRequest
-	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		writeError(w, http.StatusBadRequest, "Invalid JSON: "+err.Error())
-		return
-	}
-
-	if req.Topic == "" {
-		writeError(w, http.StatusBadRequest, "topic required")
-		return
-	}
-
-	ctx, cancel := context.WithTimeout(r.Context(), 10*time.Second)
-	defer cancel()
-
-	// Look up function to get its ID
-	fn, err := h.registry.Get(ctx, namespace, functionName, 0)
-	if err != nil {
-		if serverless.IsNotFound(err) {
-			writeError(w, http.StatusNotFound, "Function not found")
-		} else {
-			writeError(w, http.StatusInternalServerError, "Failed to look up function")
-		}
-		return
-	}
-
-	triggerID, err := h.triggerStore.Add(ctx, fn.ID, req.Topic)
-	if err != nil {
-		h.logger.Error("Failed to add PubSub trigger",
-			zap.String("function", functionName),
-			zap.String("topic", req.Topic),
-			zap.Error(err),
-		)
-		writeError(w, http.StatusInternalServerError, "Failed to add trigger: "+err.Error())
-		return
-	}
-
-	// Invalidate cache for this topic
-	if h.dispatcher != nil {
-		h.dispatcher.InvalidateCache(ctx, namespace, req.Topic)
-	}
-
-	h.logger.Info("PubSub trigger added via API",
-		zap.String("function", functionName),
-		zap.String("topic", req.Topic),
-		zap.String("trigger_id", triggerID),
-	)
-
-	writeJSON(w, http.StatusCreated, map[string]interface{}{
-		"trigger_id": triggerID,
-		"function":   functionName,
-		"topic":      req.Topic,
-	})
-}
-
-// HandleListTriggers handles GET /v1/functions/{name}/triggers
-// Lists all PubSub triggers for a function.
-func (h *ServerlessHandlers) HandleListTriggers(w http.ResponseWriter, r *http.Request, functionName string) {
-	if h.triggerStore == nil {
-		writeError(w, http.StatusNotImplemented, "PubSub triggers not available")
-		return
-	}
-
-	namespace := h.getNamespaceFromRequest(r)
-	if namespace == "" {
-		writeError(w, http.StatusBadRequest, "namespace required")
-		return
-	}
-
-	ctx, cancel := context.WithTimeout(r.Context(), 10*time.Second)
-	defer cancel()
-
-	// Look up function to get its ID
-	fn, err := h.registry.Get(ctx, namespace, functionName, 0)
-	if err != nil {
-		if serverless.IsNotFound(err) {
-			writeError(w, http.StatusNotFound, "Function not found")
-		} else {
-			writeError(w, http.StatusInternalServerError, "Failed to look up function")
-		}
-		return
-	}
-
-	triggers, err := h.triggerStore.ListByFunction(ctx, fn.ID)
-	if err != nil {
-		writeError(w, http.StatusInternalServerError, "Failed to list triggers")
-		return
-	}
-
-	writeJSON(w, http.StatusOK, map[string]interface{}{
-		"triggers": triggers,
-		"count":    len(triggers),
-	})
-}
-
-// HandleDeleteTrigger handles DELETE /v1/functions/{name}/triggers/{triggerID}
-// Removes a PubSub trigger.
-func (h *ServerlessHandlers) HandleDeleteTrigger(w http.ResponseWriter, r *http.Request, functionName, triggerID string) {
-	if h.triggerStore == nil {
-		writeError(w, http.StatusNotImplemented, "PubSub triggers not available")
-		return
-	}
-
-	namespace := h.getNamespaceFromRequest(r)
-	if namespace == "" {
-		writeError(w, http.StatusBadRequest, "namespace required")
-		return
-	}
-
-	ctx, cancel := context.WithTimeout(r.Context(), 10*time.Second)
-	defer cancel()
-
-	// Look up the trigger's topic before deleting (for cache invalidation)
-	fn, err := h.registry.Get(ctx, namespace, functionName, 0)
-	if err != nil {
-		if serverless.IsNotFound(err) {
-			writeError(w, http.StatusNotFound, "Function not found")
-		} else {
-			writeError(w, http.StatusInternalServerError, "Failed to look up function")
-		}
-		return
-	}
-
-	// Get current triggers to find the topic for cache invalidation
-	triggers, err := h.triggerStore.ListByFunction(ctx, fn.ID)
-	if err != nil {
-		writeError(w, http.StatusInternalServerError, "Failed to look up triggers")
-		return
-	}
-
-	// Find the topic for the trigger being deleted
-	var triggerTopic string
-	for _, t := range triggers {
-		if t.ID == triggerID {
-			triggerTopic = t.Topic
-			break
-		}
-	}
-
-	if err := h.triggerStore.Remove(ctx, triggerID); err != nil {
-		writeError(w, http.StatusInternalServerError, "Failed to remove trigger: "+err.Error())
-		return
-	}
-
-	// Invalidate cache for the topic
-	if h.dispatcher != nil && triggerTopic != "" {
-		h.dispatcher.InvalidateCache(ctx, namespace, triggerTopic)
-	}
-
-	h.logger.Info("PubSub trigger removed via API",
-		zap.String("function", functionName),
-		zap.String("trigger_id", triggerID),
-	)
-
-	writeJSON(w, http.StatusOK, map[string]interface{}{
-		"message": "Trigger removed",
-	})
-}

core/pkg/gateway/handlers/vault/handlers.go

@@ -1,132 +0,0 @@
-// Package vault provides HTTP handlers for vault proxy operations.
-//
-// The gateway acts as a smart proxy between RootWallet clients and
-// vault guardian nodes on the WireGuard overlay network. It handles
-// Shamir split/combine so clients make a single HTTPS call.
-package vault
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"net/http"
-	"time"
-
-	"github.com/DeBrosOfficial/network/pkg/client"
-	"github.com/DeBrosOfficial/network/pkg/logging"
-)
-
-const (
-	// VaultGuardianPort is the port vault guardians listen on (client API).
-	VaultGuardianPort = 7500
-
-	// guardianTimeout is the per-guardian HTTP request timeout.
-	guardianTimeout = 5 * time.Second
-
-	// overallTimeout is the maximum time for the full fan-out operation.
-	overallTimeout = 15 * time.Second
-
-	// maxPushBodySize limits push request bodies (1 MiB).
-	maxPushBodySize = 1 << 20
-
-	// maxPullBodySize limits pull request bodies (4 KiB).
-	maxPullBodySize = 4 << 10
-)
-
-// Handlers provides HTTP handlers for vault proxy operations.
-type Handlers struct {
-	logger      *logging.ColoredLogger
-	dbClient    client.NetworkClient
-	rateLimiter *IdentityRateLimiter
-	httpClient  *http.Client
-}
-
-// NewHandlers creates vault proxy handlers.
-func NewHandlers(logger *logging.ColoredLogger, dbClient client.NetworkClient) *Handlers {
-	h := &Handlers{
-		logger:   logger,
-		dbClient: dbClient,
-		rateLimiter: NewIdentityRateLimiter(
-			30,  // 30 pushes per hour per identity
-			120, // 120 pulls per hour per identity
-		),
-		httpClient: &http.Client{
-			Timeout: guardianTimeout,
-			Transport: &http.Transport{
-				MaxIdleConns:        100,
-				MaxIdleConnsPerHost: 10,
-				IdleConnTimeout:     90 * time.Second,
-			},
-		},
-	}
-	h.rateLimiter.StartCleanup(10*time.Minute, 1*time.Hour)
-	return h
-}
-
-// guardian represents a reachable vault guardian node.
-type guardian struct {
-	IP   string
-	Port int
-}
-
-// discoverGuardians queries dns_nodes for all active nodes.
-// Every Orama node runs a vault guardian, so every active node is a guardian.
-func (h *Handlers) discoverGuardians(ctx context.Context) ([]guardian, error) {
-	db := h.dbClient.Database()
-	internalCtx := client.WithInternalAuth(ctx)
-
-	query := "SELECT COALESCE(internal_ip, ip_address) FROM dns_nodes WHERE status = 'active'"
-	result, err := db.Query(internalCtx, query)
-	if err != nil {
-		return nil, fmt.Errorf("vault: failed to query guardian nodes: %w", err)
-	}
-	if result == nil || len(result.Rows) == 0 {
-		return nil, fmt.Errorf("vault: no active guardian nodes found")
-	}
-
-	guardians := make([]guardian, 0, len(result.Rows))
-	for _, row := range result.Rows {
-		if len(row) == 0 {
-			continue
-		}
-		ip := getString(row[0])
-		if ip == "" {
-			continue
-		}
-		guardians = append(guardians, guardian{IP: ip, Port: VaultGuardianPort})
-	}
-	if len(guardians) == 0 {
-		return nil, fmt.Errorf("vault: no guardian nodes with valid IPs found")
-	}
-	return guardians, nil
-}
-
-func writeJSON(w http.ResponseWriter, status int, v interface{}) {
-	w.Header().Set("Content-Type", "application/json")
-	w.WriteHeader(status)
-	json.NewEncoder(w).Encode(v)
-}
-
-func writeError(w http.ResponseWriter, status int, msg string) {
-	writeJSON(w, status, map[string]string{"error": msg})
-}
-
-func getString(v interface{}) string {
-	if s, ok := v.(string); ok {
-		return s
-	}
-	return ""
-}
-
-// isValidIdentity checks that identity is exactly 64 hex characters.
-func isValidIdentity(identity string) bool {
-	if len(identity) != 64 {
-		return false
-	}
-	for _, c := range identity {
-		if !((c >= '0' && c <= '9') || (c >= 'a' && c <= 'f') || (c >= 'A' && c <= 'F')) {
-			return false
-		}
-	}
-	return true
-}

core/pkg/gateway/handlers/vault/health_handler.go

@@ -1,116 +0,0 @@
-package vault
-
-import (
-	"context"
-	"fmt"
-	"io"
-	"net/http"
-	"sync"
-	"sync/atomic"
-
-	"github.com/DeBrosOfficial/network/pkg/shamir"
-)
-
-// HealthResponse is returned for GET /v1/vault/health.
-type HealthResponse struct {
-	Status string `json:"status"` // "healthy", "degraded", "unavailable"
-}
-
-// StatusResponse is returned for GET /v1/vault/status.
-type StatusResponse struct {
-	Guardians  int `json:"guardians"`   // Total guardian nodes
-	Healthy    int `json:"healthy"`     // Reachable guardians
-	Threshold  int `json:"threshold"`   // Read quorum (K)
-	WriteQuorum int `json:"write_quorum"` // Write quorum (W)
-}
-
-// HandleHealth processes GET /v1/vault/health.
-func (h *Handlers) HandleHealth(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodGet {
-		writeError(w, http.StatusMethodNotAllowed, "method not allowed")
-		return
-	}
-
-	guardians, err := h.discoverGuardians(r.Context())
-	if err != nil {
-		writeJSON(w, http.StatusOK, HealthResponse{Status: "unavailable"})
-		return
-	}
-
-	n := len(guardians)
-	healthy := h.probeGuardians(r.Context(), guardians)
-
-	k := shamir.AdaptiveThreshold(n)
-	wq := shamir.WriteQuorum(n)
-
-	status := "healthy"
-	if healthy < wq {
-		if healthy >= k {
-			status = "degraded"
-		} else {
-			status = "unavailable"
-		}
-	}
-
-	writeJSON(w, http.StatusOK, HealthResponse{Status: status})
-}
-
-// HandleStatus processes GET /v1/vault/status.
-func (h *Handlers) HandleStatus(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodGet {
-		writeError(w, http.StatusMethodNotAllowed, "method not allowed")
-		return
-	}
-
-	guardians, err := h.discoverGuardians(r.Context())
-	if err != nil {
-		writeJSON(w, http.StatusOK, StatusResponse{})
-		return
-	}
-
-	n := len(guardians)
-	healthy := h.probeGuardians(r.Context(), guardians)
-
-	writeJSON(w, http.StatusOK, StatusResponse{
-		Guardians:   n,
-		Healthy:     healthy,
-		Threshold:   shamir.AdaptiveThreshold(n),
-		WriteQuorum: shamir.WriteQuorum(n),
-	})
-}
-
-// probeGuardians checks health of all guardians in parallel and returns the healthy count.
-func (h *Handlers) probeGuardians(ctx context.Context, guardians []guardian) int {
-	ctx, cancel := context.WithTimeout(ctx, guardianTimeout)
-	defer cancel()
-
-	var healthyCount atomic.Int32
-	var wg sync.WaitGroup
-	wg.Add(len(guardians))
-
-	for _, g := range guardians {
-		go func(gd guardian) {
-			defer wg.Done()
-
-			url := fmt.Sprintf("http://%s:%d/v1/vault/health", gd.IP, gd.Port)
-			req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
-			if err != nil {
-				return
-			}
-
-			resp, err := h.httpClient.Do(req)
-			if err != nil {
-				return
-			}
-			defer resp.Body.Close()
-			io.Copy(io.Discard, resp.Body)
-
-			if resp.StatusCode >= 200 && resp.StatusCode < 300 {
-				healthyCount.Add(1)
-			}
-		}(g)
-	}
-
-	wg.Wait()
-	return int(healthyCount.Load())
-}

core/pkg/gateway/handlers/vault/pull_handler.go

@@ -1,183 +0,0 @@
-package vault
-
-import (
-	"bytes"
-	"context"
-	"encoding/base64"
-	"encoding/json"
-	"fmt"
-	"io"
-	"net/http"
-	"sync"
-
-	"github.com/DeBrosOfficial/network/pkg/logging"
-	"github.com/DeBrosOfficial/network/pkg/shamir"
-	"go.uber.org/zap"
-)
-
-// PullRequest is the client-facing request body.
-type PullRequest struct {
-	Identity string `json:"identity"` // 64 hex chars
-}
-
-// PullResponse is returned to the client.
-type PullResponse struct {
-	Envelope  string `json:"envelope"`  // base64-encoded reconstructed envelope
-	Collected int    `json:"collected"` // Number of shares collected
-	Threshold int    `json:"threshold"` // K threshold used
-}
-
-// guardianPullRequest is sent to each vault guardian.
-type guardianPullRequest struct {
-	Identity string `json:"identity"`
-}
-
-// guardianPullResponse is the response from a guardian.
-type guardianPullResponse struct {
-	Share string `json:"share"` // base64([x:1byte][y:rest])
-}
-
-// HandlePull processes POST /v1/vault/pull.
-func (h *Handlers) HandlePull(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodPost {
-		writeError(w, http.StatusMethodNotAllowed, "method not allowed")
-		return
-	}
-
-	body, err := io.ReadAll(io.LimitReader(r.Body, maxPullBodySize))
-	if err != nil {
-		writeError(w, http.StatusBadRequest, "failed to read request body")
-		return
-	}
-
-	var req PullRequest
-	if err := json.Unmarshal(body, &req); err != nil {
-		writeError(w, http.StatusBadRequest, "invalid JSON")
-		return
-	}
-
-	if !isValidIdentity(req.Identity) {
-		writeError(w, http.StatusBadRequest, "identity must be 64 hex characters")
-		return
-	}
-
-	if !h.rateLimiter.AllowPull(req.Identity) {
-		w.Header().Set("Retry-After", "30")
-		writeError(w, http.StatusTooManyRequests, "pull rate limit exceeded for this identity")
-		return
-	}
-
-	guardians, err := h.discoverGuardians(r.Context())
-	if err != nil {
-		h.logger.ComponentError(logging.ComponentGeneral, "Vault pull: guardian discovery failed", zap.Error(err))
-		writeError(w, http.StatusServiceUnavailable, "no guardian nodes available")
-		return
-	}
-
-	n := len(guardians)
-	k := shamir.AdaptiveThreshold(n)
-
-	// Fan out pull requests to all guardians.
-	ctx, cancel := context.WithTimeout(r.Context(), overallTimeout)
-	defer cancel()
-
-	type shareResult struct {
-		share shamir.Share
-		ok    bool
-	}
-
-	results := make([]shareResult, n)
-	var wg sync.WaitGroup
-	wg.Add(n)
-
-	for i, g := range guardians {
-		go func(idx int, gd guardian) {
-			defer wg.Done()
-
-			guardianReq := guardianPullRequest{Identity: req.Identity}
-			reqBody, _ := json.Marshal(guardianReq)
-
-			url := fmt.Sprintf("http://%s:%d/v1/vault/pull", gd.IP, gd.Port)
-			httpReq, err := http.NewRequestWithContext(ctx, http.MethodPost, url, bytes.NewReader(reqBody))
-			if err != nil {
-				return
-			}
-			httpReq.Header.Set("Content-Type", "application/json")
-
-			resp, err := h.httpClient.Do(httpReq)
-			if err != nil {
-				return
-			}
-			defer resp.Body.Close()
-
-			if resp.StatusCode < 200 || resp.StatusCode >= 300 {
-				io.Copy(io.Discard, resp.Body)
-				return
-			}
-
-			var pullResp guardianPullResponse
-			if err := json.NewDecoder(resp.Body).Decode(&pullResp); err != nil {
-				return
-			}
-
-			shareBytes, err := base64.StdEncoding.DecodeString(pullResp.Share)
-			if err != nil || len(shareBytes) < 2 {
-				return
-			}
-
-			results[idx] = shareResult{
-				share: shamir.Share{
-					X: shareBytes[0],
-					Y: shareBytes[1:],
-				},
-				ok: true,
-			}
-		}(i, g)
-	}
-
-	wg.Wait()
-
-	// Collect successful shares.
-	shares := make([]shamir.Share, 0, n)
-	for _, r := range results {
-		if r.ok {
-			shares = append(shares, r.share)
-		}
-	}
-
-	if len(shares) < k {
-		h.logger.ComponentError(logging.ComponentGeneral, "Vault pull: not enough shares",
-			zap.Int("collected", len(shares)), zap.Int("total", n), zap.Int("threshold", k))
-		writeError(w, http.StatusServiceUnavailable,
-			fmt.Sprintf("not enough shares: collected %d of %d required (contacted %d guardians)", len(shares), k, n))
-		return
-	}
-
-	// Shamir combine to reconstruct envelope.
-	envelope, err := shamir.Combine(shares[:k])
-	if err != nil {
-		h.logger.ComponentError(logging.ComponentGeneral, "Vault pull: Shamir combine failed", zap.Error(err))
-		writeError(w, http.StatusInternalServerError, "failed to reconstruct envelope")
-		return
-	}
-
-	// Wipe collected shares.
-	for i := range shares {
-		for j := range shares[i].Y {
-			shares[i].Y[j] = 0
-		}
-	}
-
-	envelopeB64 := base64.StdEncoding.EncodeToString(envelope)
-
-	// Wipe envelope.
-	for i := range envelope {
-		envelope[i] = 0
-	}
-
-	writeJSON(w, http.StatusOK, PullResponse{
-		Envelope:  envelopeB64,
-		Collected: len(shares),
-		Threshold: k,
-	})
-}

core/pkg/gateway/handlers/vault/push_handler.go

@@ -1,168 +0,0 @@
-package vault
-
-import (
-	"bytes"
-	"context"
-	"encoding/base64"
-	"encoding/json"
-	"fmt"
-	"io"
-	"net/http"
-	"sync"
-	"sync/atomic"
-
-	"github.com/DeBrosOfficial/network/pkg/logging"
-	"github.com/DeBrosOfficial/network/pkg/shamir"
-	"go.uber.org/zap"
-)
-
-// PushRequest is the client-facing request body.
-type PushRequest struct {
-	Identity string `json:"identity"` // 64 hex chars (SHA-256)
-	Envelope string `json:"envelope"` // base64-encoded encrypted envelope
-	Version  uint64 `json:"version"`  // Anti-rollback version counter
-}
-
-// PushResponse is returned to the client.
-type PushResponse struct {
-	Status    string `json:"status"`    // "ok" or "partial"
-	AckCount  int    `json:"ack_count"`
-	Total     int    `json:"total"`
-	Quorum    int    `json:"quorum"`
-	Threshold int    `json:"threshold"`
-}
-
-// guardianPushRequest is sent to each vault guardian.
-type guardianPushRequest struct {
-	Identity string `json:"identity"`
-	Share    string `json:"share"`   // base64([x:1byte][y:rest])
-	Version  uint64 `json:"version"`
-}
-
-// HandlePush processes POST /v1/vault/push.
-func (h *Handlers) HandlePush(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodPost {
-		writeError(w, http.StatusMethodNotAllowed, "method not allowed")
-		return
-	}
-
-	body, err := io.ReadAll(io.LimitReader(r.Body, maxPushBodySize))
-	if err != nil {
-		writeError(w, http.StatusBadRequest, "failed to read request body")
-		return
-	}
-
-	var req PushRequest
-	if err := json.Unmarshal(body, &req); err != nil {
-		writeError(w, http.StatusBadRequest, "invalid JSON")
-		return
-	}
-
-	if !isValidIdentity(req.Identity) {
-		writeError(w, http.StatusBadRequest, "identity must be 64 hex characters")
-		return
-	}
-
-	envelopeBytes, err := base64.StdEncoding.DecodeString(req.Envelope)
-	if err != nil {
-		writeError(w, http.StatusBadRequest, "invalid base64 envelope")
-		return
-	}
-	if len(envelopeBytes) == 0 {
-		writeError(w, http.StatusBadRequest, "envelope must not be empty")
-		return
-	}
-
-	if !h.rateLimiter.AllowPush(req.Identity) {
-		w.Header().Set("Retry-After", "120")
-		writeError(w, http.StatusTooManyRequests, "push rate limit exceeded for this identity")
-		return
-	}
-
-	guardians, err := h.discoverGuardians(r.Context())
-	if err != nil {
-		h.logger.ComponentError(logging.ComponentGeneral, "Vault push: guardian discovery failed", zap.Error(err))
-		writeError(w, http.StatusServiceUnavailable, "no guardian nodes available")
-		return
-	}
-
-	n := len(guardians)
-	k := shamir.AdaptiveThreshold(n)
-	quorum := shamir.WriteQuorum(n)
-
-	shares, err := shamir.Split(envelopeBytes, n, k)
-	if err != nil {
-		h.logger.ComponentError(logging.ComponentGeneral, "Vault push: Shamir split failed", zap.Error(err))
-		writeError(w, http.StatusInternalServerError, "failed to split envelope")
-		return
-	}
-
-	// Fan out to guardians in parallel.
-	ctx, cancel := context.WithTimeout(r.Context(), overallTimeout)
-	defer cancel()
-
-	var ackCount atomic.Int32
-	var wg sync.WaitGroup
-	wg.Add(n)
-
-	for i, g := range guardians {
-		go func(idx int, gd guardian) {
-			defer wg.Done()
-
-			share := shares[idx]
-			// Serialize: [x:1byte][y:rest]
-			shareBytes := make([]byte, 1+len(share.Y))
-			shareBytes[0] = share.X
-			copy(shareBytes[1:], share.Y)
-			shareB64 := base64.StdEncoding.EncodeToString(shareBytes)
-
-			guardianReq := guardianPushRequest{
-				Identity: req.Identity,
-				Share:    shareB64,
-				Version:  req.Version,
-			}
-			reqBody, _ := json.Marshal(guardianReq)
-
-			url := fmt.Sprintf("http://%s:%d/v1/vault/push", gd.IP, gd.Port)
-			httpReq, err := http.NewRequestWithContext(ctx, http.MethodPost, url, bytes.NewReader(reqBody))
-			if err != nil {
-				return
-			}
-			httpReq.Header.Set("Content-Type", "application/json")
-
-			resp, err := h.httpClient.Do(httpReq)
-			if err != nil {
-				return
-			}
-			defer resp.Body.Close()
-			io.Copy(io.Discard, resp.Body)
-
-			if resp.StatusCode >= 200 && resp.StatusCode < 300 {
-				ackCount.Add(1)
-			}
-		}(i, g)
-	}
-
-	wg.Wait()
-
-	// Wipe share data.
-	for i := range shares {
-		for j := range shares[i].Y {
-			shares[i].Y[j] = 0
-		}
-	}
-
-	ack := int(ackCount.Load())
-	status := "ok"
-	if ack < quorum {
-		status = "partial"
-	}
-
-	writeJSON(w, http.StatusOK, PushResponse{
-		Status:    status,
-		AckCount:  ack,
-		Total:     n,
-		Quorum:    quorum,
-		Threshold: k,
-	})
-}

core/pkg/gateway/handlers/vault/rate_limiter.go

@@ -1,120 +0,0 @@
-package vault
-
-import (
-	"sync"
-	"time"
-)
-
-// IdentityRateLimiter provides per-identity-hash rate limiting for vault operations.
-// Push and pull have separate rate limits since push is more expensive.
-type IdentityRateLimiter struct {
-	pushBuckets sync.Map // identity -> *tokenBucket
-	pullBuckets sync.Map // identity -> *tokenBucket
-	pushRate    float64  // tokens per second
-	pushBurst   int
-	pullRate    float64  // tokens per second
-	pullBurst   int
-	stopCh      chan struct{}
-}
-
-type tokenBucket struct {
-	mu        sync.Mutex
-	tokens    float64
-	lastCheck time.Time
-}
-
-// NewIdentityRateLimiter creates a per-identity rate limiter.
-// pushPerHour and pullPerHour are sustained rates; burst is 1/6th of the hourly rate.
-func NewIdentityRateLimiter(pushPerHour, pullPerHour int) *IdentityRateLimiter {
-	pushBurst := pushPerHour / 6
-	if pushBurst < 1 {
-		pushBurst = 1
-	}
-	pullBurst := pullPerHour / 6
-	if pullBurst < 1 {
-		pullBurst = 1
-	}
-	return &IdentityRateLimiter{
-		pushRate:  float64(pushPerHour) / 3600.0,
-		pushBurst: pushBurst,
-		pullRate:  float64(pullPerHour) / 3600.0,
-		pullBurst: pullBurst,
-	}
-}
-
-// AllowPush checks if a push for this identity is allowed.
-func (rl *IdentityRateLimiter) AllowPush(identity string) bool {
-	return rl.allow(&rl.pushBuckets, identity, rl.pushRate, rl.pushBurst)
-}
-
-// AllowPull checks if a pull for this identity is allowed.
-func (rl *IdentityRateLimiter) AllowPull(identity string) bool {
-	return rl.allow(&rl.pullBuckets, identity, rl.pullRate, rl.pullBurst)
-}
-
-func (rl *IdentityRateLimiter) allow(buckets *sync.Map, identity string, rate float64, burst int) bool {
-	val, _ := buckets.LoadOrStore(identity, &tokenBucket{
-		tokens:    float64(burst),
-		lastCheck: time.Now(),
-	})
-	b := val.(*tokenBucket)
-
-	b.mu.Lock()
-	defer b.mu.Unlock()
-
-	now := time.Now()
-	elapsed := now.Sub(b.lastCheck).Seconds()
-	b.tokens += elapsed * rate
-	if b.tokens > float64(burst) {
-		b.tokens = float64(burst)
-	}
-	b.lastCheck = now
-
-	if b.tokens >= 1 {
-		b.tokens--
-		return true
-	}
-	return false
-}
-
-// StartCleanup runs periodic cleanup of stale identity entries.
-func (rl *IdentityRateLimiter) StartCleanup(interval, maxAge time.Duration) {
-	rl.stopCh = make(chan struct{})
-	go func() {
-		ticker := time.NewTicker(interval)
-		defer ticker.Stop()
-		for {
-			select {
-			case <-ticker.C:
-				rl.cleanup(maxAge)
-			case <-rl.stopCh:
-				return
-			}
-		}
-	}()
-}
-
-// Stop terminates the background cleanup goroutine.
-func (rl *IdentityRateLimiter) Stop() {
-	if rl.stopCh != nil {
-		close(rl.stopCh)
-	}
-}
-
-func (rl *IdentityRateLimiter) cleanup(maxAge time.Duration) {
-	cutoff := time.Now().Add(-maxAge)
-	cleanMap := func(m *sync.Map) {
-		m.Range(func(key, value interface{}) bool {
-			b := value.(*tokenBucket)
-			b.mu.Lock()
-			stale := b.lastCheck.Before(cutoff)
-			b.mu.Unlock()
-			if stale {
-				m.Delete(key)
-			}
-			return true
-		})
-	}
-	cleanMap(&rl.pushBuckets)
-	cleanMap(&rl.pullBuckets)
-}

core/pkg/gateway/handlers/webrtc/credentials.go

@@ -1,57 +0,0 @@
-package webrtc
-
-import (
-	"fmt"
-	"net/http"
-	"time"
-
-	"github.com/DeBrosOfficial/network/pkg/logging"
-	"github.com/DeBrosOfficial/network/pkg/turn"
-	"go.uber.org/zap"
-)
-
-const turnCredentialTTL = 10 * time.Minute
-
-// CredentialsHandler handles POST /v1/webrtc/turn/credentials
-// Returns fresh TURN credentials scoped to the authenticated namespace.
-func (h *WebRTCHandlers) CredentialsHandler(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodPost {
-		writeError(w, http.StatusMethodNotAllowed, "method not allowed")
-		return
-	}
-
-	ns := resolveNamespaceFromRequest(r)
-	if ns == "" {
-		writeError(w, http.StatusForbidden, "namespace not resolved")
-		return
-	}
-
-	if h.turnSecret == "" {
-		writeError(w, http.StatusServiceUnavailable, "TURN not configured")
-		return
-	}
-
-	username, password := turn.GenerateCredentials(h.turnSecret, ns, turnCredentialTTL)
-
-	// Build TURN URIs — use IPs to bypass DNS propagation delays
-	var uris []string
-	if h.turnDomain != "" {
-		uris = append(uris,
-			fmt.Sprintf("turn:%s:3478?transport=udp", h.turnDomain),
-			fmt.Sprintf("turn:%s:3478?transport=tcp", h.turnDomain),
-			fmt.Sprintf("turns:%s:5349", h.turnDomain),
-		)
-	}
-
-	h.logger.ComponentInfo(logging.ComponentGeneral, "Issued TURN credentials",
-		zap.String("namespace", ns),
-		zap.String("username", username),
-	)
-
-	writeJSON(w, http.StatusOK, map[string]interface{}{
-		"username": username,
-		"password": password,
-		"ttl":      int(turnCredentialTTL.Seconds()),
-		"uris":     uris,
-	})
-}

core/pkg/gateway/handlers/webrtc/handlers_test.go

@@ -1,271 +0,0 @@
-package webrtc
-
-import (
-	"context"
-	"encoding/json"
-	"net/http"
-	"net/http/httptest"
-	"testing"
-
-	"github.com/DeBrosOfficial/network/pkg/gateway/ctxkeys"
-	"github.com/DeBrosOfficial/network/pkg/logging"
-)
-
-func testHandlers() *WebRTCHandlers {
-	logger, _ := logging.NewColoredLogger(logging.ComponentGeneral, false)
-	return NewWebRTCHandlers(
-		logger,
-		"", // defaults to 127.0.0.1 in tests
-		8443,
-		"turn.ns-test.dbrs.space",
-		"test-secret-key-32bytes-long!!!!",
-		nil, // No actual proxy in tests
-	)
-}
-
-func requestWithNamespace(method, path, namespace string) *http.Request {
-	req := httptest.NewRequest(method, path, nil)
-	ctx := context.WithValue(req.Context(), ctxkeys.NamespaceOverride, namespace)
-	return req.WithContext(ctx)
-}
-
-// --- Credentials handler tests ---
-
-func TestCredentialsHandler_Success(t *testing.T) {
-	h := testHandlers()
-	req := requestWithNamespace("POST", "/v1/webrtc/turn/credentials", "test-ns")
-	w := httptest.NewRecorder()
-
-	h.CredentialsHandler(w, req)
-
-	if w.Code != http.StatusOK {
-		t.Errorf("status = %d, want %d", w.Code, http.StatusOK)
-	}
-
-	var result map[string]interface{}
-	if err := json.NewDecoder(w.Body).Decode(&result); err != nil {
-		t.Fatalf("failed to decode response: %v", err)
-	}
-
-	if result["username"] == nil || result["username"] == "" {
-		t.Error("expected non-empty username")
-	}
-	if result["password"] == nil || result["password"] == "" {
-		t.Error("expected non-empty password")
-	}
-	if result["ttl"] == nil {
-		t.Error("expected ttl field")
-	}
-	ttl, ok := result["ttl"].(float64)
-	if !ok || ttl != 600 {
-		t.Errorf("ttl = %v, want 600", result["ttl"])
-	}
-	uris, ok := result["uris"].([]interface{})
-	if !ok || len(uris) != 3 {
-		t.Errorf("uris count = %v, want 3", result["uris"])
-	}
-}
-
-func TestCredentialsHandler_MethodNotAllowed(t *testing.T) {
-	h := testHandlers()
-	req := requestWithNamespace("GET", "/v1/webrtc/turn/credentials", "test-ns")
-	w := httptest.NewRecorder()
-
-	h.CredentialsHandler(w, req)
-
-	if w.Code != http.StatusMethodNotAllowed {
-		t.Errorf("status = %d, want %d", w.Code, http.StatusMethodNotAllowed)
-	}
-}
-
-func TestCredentialsHandler_NoNamespace(t *testing.T) {
-	h := testHandlers()
-	req := httptest.NewRequest("POST", "/v1/webrtc/turn/credentials", nil)
-	w := httptest.NewRecorder()
-
-	h.CredentialsHandler(w, req)
-
-	if w.Code != http.StatusForbidden {
-		t.Errorf("status = %d, want %d", w.Code, http.StatusForbidden)
-	}
-}
-
-func TestCredentialsHandler_NoTURNSecret(t *testing.T) {
-	logger, _ := logging.NewColoredLogger(logging.ComponentGeneral, false)
-	h := NewWebRTCHandlers(logger, "", 8443, "turn.test.dbrs.space", "", nil)
-
-	req := requestWithNamespace("POST", "/v1/webrtc/turn/credentials", "test-ns")
-	w := httptest.NewRecorder()
-
-	h.CredentialsHandler(w, req)
-
-	if w.Code != http.StatusServiceUnavailable {
-		t.Errorf("status = %d, want %d", w.Code, http.StatusServiceUnavailable)
-	}
-}
-
-// --- Signal handler tests ---
-
-func TestSignalHandler_NoNamespace(t *testing.T) {
-	h := testHandlers()
-	req := httptest.NewRequest("GET", "/v1/webrtc/signal", nil)
-	w := httptest.NewRecorder()
-
-	h.SignalHandler(w, req)
-
-	if w.Code != http.StatusForbidden {
-		t.Errorf("status = %d, want %d", w.Code, http.StatusForbidden)
-	}
-}
-
-func TestSignalHandler_NoSFUPort(t *testing.T) {
-	logger, _ := logging.NewColoredLogger(logging.ComponentGeneral, false)
-	h := NewWebRTCHandlers(logger, "", 0, "", "secret", nil)
-
-	req := requestWithNamespace("GET", "/v1/webrtc/signal", "test-ns")
-	w := httptest.NewRecorder()
-
-	h.SignalHandler(w, req)
-
-	if w.Code != http.StatusServiceUnavailable {
-		t.Errorf("status = %d, want %d", w.Code, http.StatusServiceUnavailable)
-	}
-}
-
-func TestSignalHandler_NoProxyFunc(t *testing.T) {
-	h := testHandlers() // proxyWebSocket is nil
-	req := requestWithNamespace("GET", "/v1/webrtc/signal", "test-ns")
-	w := httptest.NewRecorder()
-
-	h.SignalHandler(w, req)
-
-	if w.Code != http.StatusInternalServerError {
-		t.Errorf("status = %d, want %d", w.Code, http.StatusInternalServerError)
-	}
-}
-
-// --- Rooms handler tests ---
-
-func TestRoomsHandler_MethodNotAllowed(t *testing.T) {
-	h := testHandlers()
-	req := requestWithNamespace("POST", "/v1/webrtc/rooms", "test-ns")
-	w := httptest.NewRecorder()
-
-	h.RoomsHandler(w, req)
-
-	if w.Code != http.StatusMethodNotAllowed {
-		t.Errorf("status = %d, want %d", w.Code, http.StatusMethodNotAllowed)
-	}
-}
-
-func TestRoomsHandler_NoNamespace(t *testing.T) {
-	h := testHandlers()
-	req := httptest.NewRequest("GET", "/v1/webrtc/rooms", nil)
-	w := httptest.NewRecorder()
-
-	h.RoomsHandler(w, req)
-
-	if w.Code != http.StatusForbidden {
-		t.Errorf("status = %d, want %d", w.Code, http.StatusForbidden)
-	}
-}
-
-func TestRoomsHandler_NoSFUPort(t *testing.T) {
-	logger, _ := logging.NewColoredLogger(logging.ComponentGeneral, false)
-	h := NewWebRTCHandlers(logger, "", 0, "", "secret", nil)
-
-	req := requestWithNamespace("GET", "/v1/webrtc/rooms", "test-ns")
-	w := httptest.NewRecorder()
-
-	h.RoomsHandler(w, req)
-
-	if w.Code != http.StatusServiceUnavailable {
-		t.Errorf("status = %d, want %d", w.Code, http.StatusServiceUnavailable)
-	}
-}
-
-func TestRoomsHandler_SFUProxySuccess(t *testing.T) {
-	// Start a mock SFU health endpoint
-	mockSFU := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Content-Type", "application/json")
-		w.WriteHeader(http.StatusOK)
-		w.Write([]byte(`{"status":"ok","rooms":3}`))
-	}))
-	defer mockSFU.Close()
-
-	// Extract port from mock server
-	logger, _ := logging.NewColoredLogger(logging.ComponentGeneral, false)
-	// Parse port from mockSFU.URL (format: http://127.0.0.1:PORT)
-	var port int
-	for i := len(mockSFU.URL) - 1; i >= 0; i-- {
-		if mockSFU.URL[i] == ':' {
-			p := mockSFU.URL[i+1:]
-			for _, c := range p {
-				port = port*10 + int(c-'0')
-			}
-			break
-		}
-	}
-
-	h := NewWebRTCHandlers(logger, "", port, "", "secret", nil)
-	req := requestWithNamespace("GET", "/v1/webrtc/rooms", "test-ns")
-	w := httptest.NewRecorder()
-
-	h.RoomsHandler(w, req)
-
-	if w.Code != http.StatusOK {
-		t.Errorf("status = %d, want %d", w.Code, http.StatusOK)
-	}
-
-	body := w.Body.String()
-	if body != `{"status":"ok","rooms":3}` {
-		t.Errorf("body = %q, want %q", body, `{"status":"ok","rooms":3}`)
-	}
-}
-
-// --- Helper tests ---
-
-func TestResolveNamespaceFromRequest(t *testing.T) {
-	// With namespace
-	req := requestWithNamespace("GET", "/test", "my-namespace")
-	ns := resolveNamespaceFromRequest(req)
-	if ns != "my-namespace" {
-		t.Errorf("namespace = %q, want %q", ns, "my-namespace")
-	}
-
-	// Without namespace
-	req = httptest.NewRequest("GET", "/test", nil)
-	ns = resolveNamespaceFromRequest(req)
-	if ns != "" {
-		t.Errorf("namespace = %q, want empty", ns)
-	}
-}
-
-func TestWriteError(t *testing.T) {
-	w := httptest.NewRecorder()
-	writeError(w, http.StatusBadRequest, "bad request")
-
-	if w.Code != http.StatusBadRequest {
-		t.Errorf("status = %d, want %d", w.Code, http.StatusBadRequest)
-	}
-
-	var result map[string]string
-	if err := json.NewDecoder(w.Body).Decode(&result); err != nil {
-		t.Fatalf("failed to decode: %v", err)
-	}
-	if result["error"] != "bad request" {
-		t.Errorf("error = %q, want %q", result["error"], "bad request")
-	}
-}
-
-func TestWriteJSON(t *testing.T) {
-	w := httptest.NewRecorder()
-	writeJSON(w, http.StatusOK, map[string]string{"status": "ok"})
-
-	if w.Code != http.StatusOK {
-		t.Errorf("status = %d, want %d", w.Code, http.StatusOK)
-	}
-	if ct := w.Header().Get("Content-Type"); ct != "application/json" {
-		t.Errorf("Content-Type = %q, want %q", ct, "application/json")
-	}
-}

core/pkg/gateway/handlers/webrtc/rooms.go

@@ -1,51 +0,0 @@
-package webrtc
-
-import (
-	"fmt"
-	"io"
-	"net/http"
-	"time"
-
-	"github.com/DeBrosOfficial/network/pkg/logging"
-	"go.uber.org/zap"
-)
-
-// RoomsHandler handles GET /v1/webrtc/rooms (list rooms)
-// and GET /v1/webrtc/rooms?room_id=X (get specific room)
-// Proxies to the local SFU's health endpoint for room data.
-func (h *WebRTCHandlers) RoomsHandler(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodGet {
-		writeError(w, http.StatusMethodNotAllowed, "method not allowed")
-		return
-	}
-
-	ns := resolveNamespaceFromRequest(r)
-	if ns == "" {
-		writeError(w, http.StatusForbidden, "namespace not resolved")
-		return
-	}
-
-	if h.sfuPort <= 0 {
-		writeError(w, http.StatusServiceUnavailable, "SFU not configured")
-		return
-	}
-
-	// Proxy to SFU health endpoint which returns room count
-	targetURL := fmt.Sprintf("http://%s:%d/health", h.sfuHost, h.sfuPort)
-
-	client := &http.Client{Timeout: 5 * time.Second}
-	resp, err := client.Get(targetURL)
-	if err != nil {
-		h.logger.ComponentWarn(logging.ComponentGeneral, "SFU health check failed",
-			zap.String("namespace", ns),
-			zap.Error(err),
-		)
-		writeError(w, http.StatusServiceUnavailable, "SFU unavailable")
-		return
-	}
-	defer resp.Body.Close()
-
-	w.Header().Set("Content-Type", "application/json")
-	w.WriteHeader(resp.StatusCode)
-	io.Copy(w, resp.Body)
-}

core/pkg/gateway/handlers/webrtc/signal.go

@@ -1,51 +0,0 @@
-package webrtc
-
-import (
-	"fmt"
-	"net/http"
-
-	"github.com/DeBrosOfficial/network/pkg/logging"
-	"go.uber.org/zap"
-)
-
-// SignalHandler handles WebSocket /v1/webrtc/signal
-// Proxies the WebSocket connection to the local SFU's signaling endpoint.
-func (h *WebRTCHandlers) SignalHandler(w http.ResponseWriter, r *http.Request) {
-	ns := resolveNamespaceFromRequest(r)
-	if ns == "" {
-		writeError(w, http.StatusForbidden, "namespace not resolved")
-		return
-	}
-
-	if h.sfuPort <= 0 {
-		writeError(w, http.StatusServiceUnavailable, "SFU not configured")
-		return
-	}
-
-	// Proxy WebSocket to local SFU on WireGuard IP
-	targetHost := fmt.Sprintf("%s:%d", h.sfuHost, h.sfuPort)
-
-	h.logger.ComponentDebug(logging.ComponentGeneral, "Proxying WebRTC signal to SFU",
-		zap.String("namespace", ns),
-		zap.String("target", targetHost),
-	)
-
-	// Rewrite the URL path to match the SFU's expected endpoint
-	r.URL.Path = "/ws/signal"
-	r.URL.Scheme = "http"
-	r.URL.Host = targetHost
-	r.Host = targetHost
-
-	if h.proxyWebSocket == nil {
-		writeError(w, http.StatusInternalServerError, "WebSocket proxy not available")
-		return
-	}
-
-	if !h.proxyWebSocket(w, r, targetHost) {
-		// proxyWebSocket already wrote the error response
-		h.logger.ComponentWarn(logging.ComponentGeneral, "SFU WebSocket proxy failed",
-			zap.String("namespace", ns),
-			zap.String("target", targetHost),
-		)
-	}
-}

core/pkg/gateway/handlers/webrtc/types.go

@@ -1,64 +0,0 @@
-package webrtc
-
-import (
-	"encoding/json"
-	"net/http"
-
-	"github.com/DeBrosOfficial/network/pkg/gateway/ctxkeys"
-	"github.com/DeBrosOfficial/network/pkg/logging"
-)
-
-// WebRTCHandlers handles all WebRTC-related HTTP and WebSocket endpoints.
-// These run on the namespace gateway and proxy signaling to the local SFU.
-type WebRTCHandlers struct {
-	logger     *logging.ColoredLogger
-	sfuHost    string // SFU host IP (WireGuard IP) to proxy connections to
-	sfuPort    int    // Local SFU signaling port to proxy WebSocket connections to
-	turnDomain string // TURN server domain for building URIs
-	turnSecret string // HMAC-SHA1 shared secret for TURN credential generation
-
-	// proxyWebSocket is injected from the gateway to reuse its WebSocket proxy logic
-	proxyWebSocket func(w http.ResponseWriter, r *http.Request, targetHost string) bool
-}
-
-// NewWebRTCHandlers creates a new WebRTCHandlers instance.
-func NewWebRTCHandlers(
-	logger *logging.ColoredLogger,
-	sfuHost string,
-	sfuPort int,
-	turnDomain string,
-	turnSecret string,
-	proxyWS func(w http.ResponseWriter, r *http.Request, targetHost string) bool,
-) *WebRTCHandlers {
-	if sfuHost == "" {
-		sfuHost = "127.0.0.1"
-	}
-	return &WebRTCHandlers{
-		logger:         logger,
-		sfuHost:        sfuHost,
-		sfuPort:        sfuPort,
-		turnDomain:     turnDomain,
-		turnSecret:     turnSecret,
-		proxyWebSocket: proxyWS,
-	}
-}
-
-// resolveNamespaceFromRequest gets namespace from context set by auth middleware
-func resolveNamespaceFromRequest(r *http.Request) string {
-	if v := r.Context().Value(ctxkeys.NamespaceOverride); v != nil {
-		if s, ok := v.(string); ok {
-			return s
-		}
-	}
-	return ""
-}
-
-func writeJSON(w http.ResponseWriter, code int, v any) {
-	w.Header().Set("Content-Type", "application/json")
-	w.WriteHeader(code)
-	json.NewEncoder(w).Encode(v)
-}
-
-func writeError(w http.ResponseWriter, code int, msg string) {
-	writeJSON(w, code, map[string]string{"error": msg})
-}

core/pkg/gateway/status_handlers_test.go

@@ -1,111 +0,0 @@
-package gateway
-
-import "testing"
-
-func TestAggregateHealthStatus_allHealthy(t *testing.T) {
-	checks := map[string]checkResult{
-		"rqlite":    {Status: "ok"},
-		"olric":     {Status: "ok"},
-		"ipfs":      {Status: "ok"},
-		"libp2p":    {Status: "ok"},
-		"anyone":    {Status: "ok"},
-		"vault":     {Status: "ok"},
-		"wireguard": {Status: "ok"},
-	}
-	if got := aggregateHealthStatus(checks); got != "healthy" {
-		t.Errorf("expected healthy, got %s", got)
-	}
-}
-
-func TestAggregateHealthStatus_rqliteError(t *testing.T) {
-	checks := map[string]checkResult{
-		"rqlite": {Status: "error", Error: "connection refused"},
-		"olric":  {Status: "ok"},
-		"ipfs":   {Status: "ok"},
-	}
-	if got := aggregateHealthStatus(checks); got != "unhealthy" {
-		t.Errorf("expected unhealthy, got %s", got)
-	}
-}
-
-func TestAggregateHealthStatus_nonCriticalError(t *testing.T) {
-	checks := map[string]checkResult{
-		"rqlite": {Status: "ok"},
-		"olric":  {Status: "error", Error: "timeout"},
-		"ipfs":   {Status: "ok"},
-	}
-	if got := aggregateHealthStatus(checks); got != "degraded" {
-		t.Errorf("expected degraded, got %s", got)
-	}
-}
-
-func TestAggregateHealthStatus_unavailableIsNotError(t *testing.T) {
-	// Key test: "unavailable" services (like Anyone in sandbox) should NOT
-	// cause degraded status.
-	checks := map[string]checkResult{
-		"rqlite":    {Status: "ok"},
-		"olric":     {Status: "ok"},
-		"vault":     {Status: "ok"},
-		"ipfs":      {Status: "unavailable"},
-		"libp2p":    {Status: "unavailable"},
-		"anyone":    {Status: "unavailable"},
-		"wireguard": {Status: "unavailable"},
-	}
-	if got := aggregateHealthStatus(checks); got != "healthy" {
-		t.Errorf("expected healthy when services are unavailable, got %s", got)
-	}
-}
-
-func TestAggregateHealthStatus_emptyChecks(t *testing.T) {
-	checks := map[string]checkResult{}
-	if got := aggregateHealthStatus(checks); got != "healthy" {
-		t.Errorf("expected healthy for empty checks, got %s", got)
-	}
-}
-
-func TestAggregateHealthStatus_rqliteErrorOverridesDegraded(t *testing.T) {
-	// rqlite error should take priority over other errors
-	checks := map[string]checkResult{
-		"rqlite": {Status: "error", Error: "leader not found"},
-		"olric":  {Status: "error", Error: "timeout"},
-		"anyone": {Status: "error", Error: "not reachable"},
-	}
-	if got := aggregateHealthStatus(checks); got != "unhealthy" {
-		t.Errorf("expected unhealthy (rqlite takes priority), got %s", got)
-	}
-}
-
-func TestAggregateHealthStatus_vaultErrorIsUnhealthy(t *testing.T) {
-	// vault is critical — error should mean unhealthy, not degraded
-	checks := map[string]checkResult{
-		"rqlite": {Status: "ok"},
-		"vault":  {Status: "error", Error: "vault-guardian unreachable on port 7500"},
-		"olric":  {Status: "ok"},
-	}
-	if got := aggregateHealthStatus(checks); got != "unhealthy" {
-		t.Errorf("expected unhealthy (vault is critical), got %s", got)
-	}
-}
-
-func TestAggregateHealthStatus_wireguardErrorIsDegraded(t *testing.T) {
-	// wireguard is non-critical — error should mean degraded, not unhealthy
-	checks := map[string]checkResult{
-		"rqlite":    {Status: "ok"},
-		"vault":     {Status: "ok"},
-		"wireguard": {Status: "error", Error: "wg0 interface not found"},
-	}
-	if got := aggregateHealthStatus(checks); got != "degraded" {
-		t.Errorf("expected degraded (wireguard is non-critical), got %s", got)
-	}
-}
-
-func TestAggregateHealthStatus_bothCriticalDown(t *testing.T) {
-	checks := map[string]checkResult{
-		"rqlite":    {Status: "error", Error: "connection refused"},
-		"vault":     {Status: "error", Error: "unreachable"},
-		"wireguard": {Status: "ok"},
-	}
-	if got := aggregateHealthStatus(checks); got != "unhealthy" {
-		t.Errorf("expected unhealthy, got %s", got)
-	}
-}