build: prepare 4.5.0 release candidate 1

Co-authored-by: Copilot <223556219+Copilot@users.nply.github.com>
ci: install MessagePack C++ headers on Ubuntu
2026-11-08 12:28:42 +00:00 · 2026-11-03 22:48:09 -05:00 · 2026-11-03 22:44:50 -05:00 · 2026-11-03 22:41:04 -05:00 · 2026-11-03 22:40:02 -05:00 · 2026-10-29 22:46:57 -04:00
226 changed files with 29510 additions and 12860 deletions
@@ -0,0 +1,12 @@
+.git
+.vscode
+.DS_Store
+build
+build-*
+build_*
+install
+vcpkg_installed
+rust/target
+**/__pycache__
+python/dist
+python/*.egg-info
@@ -0,0 +1 @@
+custom: ['https://jami.net/donate/']
@@ -2,80 +2,21 @@ name: C/C++ CI

 env:
  LLHTTP_VERSION: "v9.2.1"
-  RESTINIO_VERSION: "0.7.6"
+  RESTINIO_VERSION: "0.7.10"
  EXPECTED_LITE_URL: "https://raw.githubusercontent.com/martinmoene/expected-lite/master/include/nonstd/expected.hpp"
-  UBUNTU_FULL_DEPS: "libncurses5-dev libreadline-dev nettle-dev libasio-dev libgnutls28-dev libuv1-dev python3-pip python3-dev python3-setuptools libcppunit-dev libjsoncpp-dev autotools-dev autoconf libfmt-dev libmsgpack-dev libargon2-dev"
-  UBUNTU_MESON_DEPS: "ninja-build libncurses5-dev libreadline-dev nettle-dev libasio-dev libgnutls28-dev libuv1-dev python3-dev python3-setuptools python3-pip libcppunit-dev libjsoncpp-dev libfmt-dev libmsgpack-dev libargon2-dev"
-  UBUNTU_MINIMAL_DEPS: "libncurses5-dev libreadline-dev nettle-dev libfmt-dev libgnutls28-dev libcppunit-dev libmsgpack-dev libargon2-dev"
-  DEBIAN12_DEPS: "git autotools-dev autoconf libtool m4 automake pkg-config wget cmake libncurses5-dev libreadline-dev nettle-dev libasio-dev libgnutls28-dev libuv1-dev python3-pip python3-dev python3-setuptools libcppunit-dev libjsoncpp-dev libfmt-dev libmsgpack-dev libargon2-dev"
+  UBUNTU_FULL_DEPS: "libncurses5-dev libreadline-dev nettle-dev libasio-dev libgnutls28-dev libuv1-dev python3-pip python3-dev python3-setuptools libcppunit-dev libjsoncpp-dev libfmt-dev libmsgpack-cxx-dev libargon2-dev"
+  UBUNTU_MESON_DEPS: "ninja-build libncurses5-dev libreadline-dev nettle-dev libasio-dev libgnutls28-dev libuv1-dev python3-dev python3-setuptools python3-pip libcppunit-dev libjsoncpp-dev libfmt-dev libmsgpack-cxx-dev libargon2-dev"
+  UBUNTU_MINIMAL_DEPS: "libncurses5-dev libreadline-dev nettle-dev libfmt-dev libgnutls28-dev libcppunit-dev libmsgpack-cxx-dev libargon2-dev"
+  DEBIAN13_DEPS: "git libtool pkg-config wget cmake libncurses5-dev libreadline-dev nettle-dev libasio-dev libgnutls28-dev libuv1-dev python3-pip python3-dev python3-setuptools libcppunit-dev libjsoncpp-dev libfmt-dev libmsgpack-cxx-dev libargon2-dev"

 on: [push, pull_request]

 jobs:
-  build-ubuntu:
-    name: Ubuntu/GCC Autotools build
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-
-      - name: Install Dependencies
-        run: |
-          echo "Installing Ubuntu full dependencies:"
-          sudo apt-get update
-          sudo apt-get install -y $UBUNTU_FULL_DEPS
-
-      - name: Install Cython
-        run: sudo pip3 install Cython
-
-      - name: Build llhttp dependency
-        run: |
-          mkdir llhttp
-          wget "https://github.com/nodejs/llhttp/archive/refs/tags/release/${LLHTTP_VERSION}.tar.gz" -O llhttp.tar.gz
-          tar -xzf llhttp.tar.gz -C llhttp --strip-components=1
-          cd llhttp && cmake -DCMAKE_INSTALL_PREFIX=/usr . && make -j2 && sudo make install
-          cd ../ && rm -rf llhttp*
-
-      - name: Install expected-lite header
-        run: |
-          sudo mkdir -p /usr/local/include/nonstd
-          sudo wget "${EXPECTED_LITE_URL}" -O /usr/local/include/nonstd/expected.hpp
-        
-      - name: Install simdutf
-        run: |
-          wget https://github.com/simdutf/simdutf/archive/refs/tags/v7.7.0.tar.gz -O simdutf.tar.gz
-          tar -xzf simdutf.tar.gz
-          mv simdutf-7.7.0 simdutf
-          mkdir simdutf/build && cd simdutf/build
-          cmake -DCMAKE_INSTALL_PREFIX=/usr/local -DSIMDUTF_CXX_STANDARD=17 -DSIMDUTF_TOOLS=Off -DSIMDUTF_TESTS=Off .. && make -j2 && sudo make install
-          cd ../../ && rm -rf simdutf
-
-      - name: Build restinio dependency
-        run: |
-          mkdir restinio && cd restinio
-          wget "https://github.com/Stiffstream/restinio/releases/download/v${RESTINIO_VERSION}/restinio-${RESTINIO_VERSION}.tar.bz2"
-          tar -xjf restinio-${RESTINIO_VERSION}.tar.bz2
-          cd restinio-${RESTINIO_VERSION}/dev
-          cmake -DCMAKE_INSTALL_PREFIX=/usr/local \
-                -DRESTINIO_TEST=Off -DRESTINIO_SAMPLE=Off -DRESTINIO_BENCHMARK=Off \
-                -DRESTINIO_WITH_SOBJECTIZER=Off \
-                -DRESTINIO_DEP_STANDALONE_ASIO=system -DRESTINIO_DEP_LLHTTP=system \
-                -DRESTINIO_DEP_FMT=system -DRESTINIO_DEP_EXPECTED_LITE=system .
-          sudo make install
-          cd ../../ && rm -rf restinio*
-
-      - name: Configure project
-        run: |
-          ./autogen.sh
-          ./configure --enable-proxy-client
-
-      - name: Build
-        run: make
-
  build-ubuntu-meson:
    name: Ubuntu/GCC Meson build
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7

      - name: Install Dependencies
        run: |
@@ -92,11 +33,26 @@ jobs:
      - name: Build with Ninja
        run: cd build && ninja

+      - uses: dtolnay/rust-toolchain@stable
+
+      - name: Test Rust bindings
+        env:
+          LIBRARY_PATH: ${{ github.workspace }}/build
+          LD_LIBRARY_PATH: ${{ github.workspace }}/build
+          RUSTFLAGS: -L native=${{ github.workspace }}/build
+        run: |
+          cargo test --manifest-path rust/Cargo.toml --all-targets
+          cargo test --manifest-path rust/Cargo.toml --all-features --all-targets
+          cargo test --manifest-path rust/Cargo.toml --all-features --doc
+
  build-ubuntu-minimal:
    name: Ubuntu/GCC minimal build
    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        cxx_standard: [17, 20, 23]
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7

      - name: Install Minimal Dependencies
        run: |
@@ -109,6 +65,8 @@ jobs:
          mkdir build && cd build
          cmake .. -DCMAKE_INSTALL_PREFIX=/usr/local \
                   -DCMAKE_BUILD_TYPE=Debug \
+                   -DCMAKE_CXX_STANDARD=${{ matrix.cxx_standard }} \
+                   -DCMAKE_CXX_STANDARD_REQUIRED=ON \
                   -DOPENDHT_C=Off -DBUILD_TESTING=On \
                   -DOPENDHT_PEER_DISCOVERY=Off -DOPENDHT_PYTHON=Off \
                   -DOPENDHT_TOOLS=On -DOPENDHT_PROXY_SERVER=Off -DOPENDHT_PROXY_CLIENT=Off
@@ -119,12 +77,12 @@ jobs:
      - name: Run Unit tests
        run: ctest --output-on-failure --test-dir build

-  build-debian12:
-    name: Debian 12/GCC build
+  build-debian13:
+    name: Debian 13/GCC build
    runs-on: ubuntu-latest

    container:
-      image: debian:12
+      image: debian:13
      volumes:
        - .:/workspace
      options: --workdir /workspace
@@ -132,12 +90,12 @@ jobs:
        DEBIAN_FRONTEND: noninteractive

    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7

      - name: Install Dependencies
        run: |
          apt-get update
-          apt-get install -y $DEBIAN12_DEPS
+          apt-get install -y $DEBIAN13_DEPS

      - name: Build llhttp dependency
        run: |
@@ -181,8 +139,11 @@ jobs:
  build-macos:
    name: macOS/Clang build
    runs-on: macos-15
+    strategy:
+      matrix:
+        cxx_standard: [17, 20, 23]
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7

      - name: Install Homebrew Dependencies
        run: brew install msgpack-cxx asio gnutls nettle readline fmt jsoncpp argon2 openssl cppunit
@@ -217,6 +178,8 @@ jobs:
          cmake .. -DCMAKE_INSTALL_PREFIX=/usr/local \
                   -DOPENDHT_DOWNLOAD_DEPS=ON \
                   -DCMAKE_BUILD_TYPE=Debug \
+                   -DCMAKE_CXX_STANDARD=${{ matrix.cxx_standard }} \
+                   -DCMAKE_CXX_STANDARD_REQUIRED=ON \
                   -DOPENDHT_C=On -DBUILD_TESTING=On \
                   -DOPENDHT_PEER_DISCOVERY=On -DOPENDHT_PYTHON=Off \
                   -DOPENDHT_TOOLS=On -DOPENDHT_PROXY_SERVER=On \
@@ -6,31 +6,33 @@ jobs:
    name: Clang Static Analysis
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
      - name: deps
        run: |
          sudo apt update && \
          sudo apt install libncurses5-dev libreadline-dev nettle-dev \
          libgnutls28-dev libuv1-dev python3-dev python3-setuptools libcppunit-dev libjsoncpp-dev \
-          autotools-dev autoconf libfmt-dev libmsgpack-dev libargon2-dev libasio-dev \
+          libfmt-dev libmsgpack-cxx-dev libargon2-dev libasio-dev \
          llvm llvm-dev clang clang-tools && \
          sudo apt remove gcc g++

      - name: expected-lite
        run: |
-          sudo mkdir /usr/include/nonstd && \
+          sudo mkdir /usr/include/nonstd
          sudo wget https://raw.githubusercontent.com/martinmoene/expected-lite/master/include/nonstd/expected.hpp \
            -O /usr/include/nonstd/expected.hpp

      - name: restinio
+        env:
+          RESTINIO_VERSION: "0.7.10"
        run: |
          mkdir restinio && cd restinio
-          wget https://github.com/Stiffstream/restinio/releases/download/v.0.7.3/restinio-0.7.3.tar.bz2
-          ls -l && tar -xjf restinio-0.7.3.tar.bz2
-          cd restinio-0.7.3/dev
+          wget "https://github.com/Stiffstream/restinio/releases/download/v${RESTINIO_VERSION}/restinio-${RESTINIO_VERSION}.tar.bz2"
+          ls -l && tar -xjf "restinio-${RESTINIO_VERSION}.tar.bz2"
+          cd "restinio-${RESTINIO_VERSION}/dev"
          cmake -DCMAKE_INSTALL_PREFIX=/usr -DRESTINIO_TEST=Off -DRESTINIO_SAMPLE=Off -DRESTINIO_BENCHMARK=Off \
-                  -DRESTINIO_WITH_SOBJECTIZER=Off -DRESTINIO_DEP_STANDALONE_ASIO=system -DRESTINIO_DEP_LLHTTP=system \
-                  -DRESTINIO_DEP_FMT=system -DRESTINIO_DEP_EXPECTED_LITE=system .
+             -DRESTINIO_WITH_SOBJECTIZER=Off -DRESTINIO_DEP_STANDALONE_ASIO=system -DRESTINIO_DEP_LLHTTP=system \
+             -DRESTINIO_DEP_FMT=system -DRESTINIO_DEP_EXPECTED_LITE=system .
          make -j2 && sudo make install
          cd ../../ && rm -rf restinio*

@@ -27,7 +27,7 @@ jobs:

    steps:
    - name: Checkout repository
-      uses: actions/checkout@v6
+      uses: actions/checkout@v7

    - name: Initialize CodeQL
      uses: github/codeql-action/init@v4
@@ -0,0 +1,206 @@
+name: Node.js Package
+
+on:
+  push:
+    branches: ['**']
+    paths:
+      - 'nodejs/**'
+      - '.github/workflows/nodejs-package.yml'
+      - 'src/**'
+      - 'include/**'
+      - 'cmake/**'
+      - 'CMakeLists.txt'
+      - 'vcpkg*.json'
+      - 'ports/**'
+      - 'LICENSE'
+  pull_request:
+    paths:
+      - 'nodejs/**'
+      - '.github/workflows/nodejs-package.yml'
+      - 'src/**'
+      - 'include/**'
+      - 'cmake/**'
+      - 'CMakeLists.txt'
+      - 'vcpkg*.json'
+      - 'ports/**'
+      - 'LICENSE'
+  workflow_call:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  packages: read
+
+jobs:
+  build:
+    name: Build ${{ matrix.target }}
+    runs-on: ${{ matrix.os }}
+    container:
+      image: ${{ matrix.container }}
+      credentials:
+        username: ${{ github.actor }}
+        password: ${{ secrets.GITHUB_TOKEN }}
+    timeout-minutes: 45
+    defaults:
+      run:
+        working-directory: nodejs
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-26.04
+            target: linux-x64
+            container: ghcr.io/${{ github.repository }}/opendht-deps-noble:latest
+          - os: macos-15
+            target: darwin-arm64
+          - os: macos-15-intel
+            target: darwin-x64
+          - os: windows-2022
+            target: win32-x64
+    env:
+      VCPKG_DISABLE_METRICS: '1'
+      VCPKG_DEFAULT_TRIPLET: x64-windows-release
+      VCPKG_INSTALLED_DIR: ${{ github.workspace }}/vcpkg_installed
+      VCPKG_BINARY_SOURCES: clear;files,${{ github.workspace }}/vcpkg-binary-cache,readwrite
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
+        with:
+          node-version: '22'
+          cache: npm
+          cache-dependency-path: nodejs/package-lock.json
+      - name: Install macOS dependencies
+        if: runner.os == 'macOS'
+        run: brew install cmake ninja pkg-config dylibbundler gnutls nettle argon2 msgpack-cxx fmt jsoncpp simdutf asio llhttp openssl
+      - name: Install restinio
+        if: runner.os == 'macOS'
+        env:
+          RESTINIO_VERSION: '0.7.10'
+        run: |
+          include="$RUNNER_TEMP/opendht-proxy/include"
+          mkdir -p "$include/nonstd"
+          curl -fsSL --retry 3 https://raw.githubusercontent.com/martinmoene/expected-lite/v0.10.0/include/nonstd/expected.hpp -o "$include/nonstd/expected.hpp"
+          curl -fsSL --retry 3 "https://github.com/Stiffstream/restinio/releases/download/v${RESTINIO_VERSION}/restinio-${RESTINIO_VERSION}.tar.bz2" -o "$RUNNER_TEMP/restinio.tar.bz2"
+          tar -xjf "$RUNNER_TEMP/restinio.tar.bz2" -C "$RUNNER_TEMP"
+          cp -R "$RUNNER_TEMP/restinio-${RESTINIO_VERSION}/dev/restinio" "$include/"
+          echo "CMAKE_PREFIX_PATH=$RUNNER_TEMP/opendht-proxy" >> "$GITHUB_ENV"
+      - name: Set up MSVC
+        if: runner.os == 'Windows'
+        uses: ilammy/msvc-dev-cmd@v1
+        with:
+          arch: x64
+      - name: Set up vcpkg
+        if: runner.os == 'Windows'
+        uses: lukka/run-vcpkg@v11
+        with:
+          vcpkgJsonGlob: vcpkg.json
+          vcpkgConfigurationJsonGlob: vcpkg-configuration.json
+      - name: Cache Windows native dependencies
+        if: runner.os == 'Windows'
+        uses: actions/cache@v6
+        with:
+          path: ${{ github.workspace }}/vcpkg-binary-cache
+          key: node-vcpkg-${{ env.VCPKG_DEFAULT_TRIPLET }}-${{ hashFiles('vcpkg.json', 'vcpkg-configuration.json', 'ports/**') }}-${{ github.run_id }}-${{ github.run_attempt }}
+          restore-keys: |
+            node-vcpkg-${{ env.VCPKG_DEFAULT_TRIPLET }}-${{ hashFiles('vcpkg.json', 'vcpkg-configuration.json', 'ports/**') }}-
+      - run: npm ci --no-audit --no-fund
+      - name: Build Unix addon
+        if: runner.os != 'Windows'
+        shell: bash
+        run: |
+          if [[ "$RUNNER_OS" == 'macOS' ]]; then
+            export MACOSX_DEPLOYMENT_TARGET=15.0
+            openssl_prefix=$(brew --prefix openssl)
+            export PKG_CONFIG_PATH="$openssl_prefix/lib/pkgconfig${PKG_CONFIG_PATH:+:$PKG_CONFIG_PATH}"
+          fi
+          npm run build -- --CDOPENDHT_DOWNLOAD_DEPS=OFF
+      - name: Build Windows addon
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          npm run build -- `
+            "--CDCMAKE_TOOLCHAIN_FILE=$env:VCPKG_ROOT/scripts/buildsystems/vcpkg.cmake" `
+            "--CDVCPKG_MANIFEST_DIR=$env:GITHUB_WORKSPACE" `
+            "--CDVCPKG_INSTALLED_DIR=$env:VCPKG_INSTALLED_DIR" `
+            "--CDVCPKG_TARGET_TRIPLET=$env:VCPKG_DEFAULT_TRIPLET" `
+            --CDVCPKG_MANIFEST_NO_DEFAULT_FEATURES=ON `
+            --CDVCPKG_MANIFEST_FEATURES=proxy `
+            --CDCMAKE_MSVC_RUNTIME_LIBRARY=MultiThreadedDLL `
+            --CDOPENDHT_DOWNLOAD_DEPS=OFF
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+          "$env:VCPKG_INSTALLED_DIR/$env:VCPKG_DEFAULT_TRIPLET/bin" >> $env:GITHUB_PATH
+          "OPENDHT_LIBRARY_PATH=$env:VCPKG_INSTALLED_DIR/$env:VCPKG_DEFAULT_TRIPLET/bin" >> $env:GITHUB_ENV
+      - run: npm test
+      - run: npm run typecheck
+      - run: npm run bundle
+      - name: Include static simdutf licenses
+        if: runner.os == 'Linux'
+        run: |
+          mkdir -p prebuilds/linux-x64/licenses/simdutf
+          cp /usr/share/doc/simdutf/LICENSE-* prebuilds/linux-x64/licenses/simdutf/
+      - run: npm run test:package
+      - uses: actions/upload-artifact@v7
+        with:
+          name: opendht-node-prebuild-${{ matrix.target }}
+          path: nodejs/prebuilds/
+          if-no-files-found: error
+
+  package:
+    name: Assemble npm archive
+    needs: build
+    runs-on: ubuntu-26.04
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
+        with:
+          node-version: '22'
+      - uses: actions/download-artifact@v8
+        with:
+          pattern: opendht-node-prebuild-*
+          path: nodejs/prebuilds
+          merge-multiple: true
+      - name: Set release version
+        if: github.event_name == 'push' && github.ref_type == 'tag'
+        working-directory: nodejs
+        env:
+          RELEASE_TAG: ${{ github.ref_name }}
+        run: |
+          release_version=$(npm version "${RELEASE_TAG#v}" --no-git-tag-version --ignore-scripts --allow-same-version)
+          if [[ "$release_version" != "$RELEASE_TAG" ]]; then
+            printf '::error::Release tag %s is not an exact npm semantic version (normalized to %s).\n' "$RELEASE_TAG" "$release_version" >&2
+            exit 1
+          fi
+      - name: Pack all platforms
+        working-directory: nodejs
+        run: |
+          npm ci --ignore-scripts
+          mkdir -p dist
+          npm pack --pack-destination dist
+      - uses: actions/upload-artifact@v7
+        with:
+          name: opendht-node-npm
+          path: nodejs/dist/*.tgz
+          if-no-files-found: error
+
+  smoke:
+    name: Install on ${{ matrix.os }} / Node ${{ matrix.node }}
+    needs: package
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 10
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-24.04, ubuntu-26.04, macos-15, macos-15-intel, windows-2022]
+        node: ['22', '24', '26']
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
+        with:
+          node-version: ${{ matrix.node }}
+      - uses: actions/download-artifact@v8
+        with:
+          name: opendht-node-npm
+          path: nodejs/dist
+      - name: Test installed archive without a native build toolchain
+        working-directory: nodejs
+        run: npm run test:package -- dist
@@ -4,10 +4,10 @@ permissions:
  contents: read

 on:
-  release:
-    types: [published]
  push:
+    branches: ['**']
  pull_request:
+  workflow_call:
  workflow_dispatch:

 jobs:
@@ -16,18 +16,18 @@ jobs:
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
-        os: [ubuntu-latest, ubuntu-24.04-arm, macos-latest]
+        os: [ubuntu-latest, ubuntu-24.04-arm, macos-15]

    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7

      # Run locally with: pipx run cibuildwheel --platform linux python
      - name: Build wheels
-        uses: pypa/cibuildwheel@v3.3.0
+        uses: pypa/cibuildwheel@v4.3.5
        with:
          package-dir: python

-      - uses: actions/upload-artifact@v5
+      - uses: actions/upload-artifact@v7
        with:
          name: opendht-wheels-${{ matrix.os }}
          path: ./wheelhouse/*.whl
@@ -36,36 +36,28 @@ jobs:
    name: Build wheels on Windows
    runs-on: windows-latest
    env:
-      VCPKG_VERSION: "2025.07.25"
-      VCPKG_INSTALLATION_ROOT: "C:\\vcpkg"
      VCPKG_DISABLE_METRICS: "1"
      VCPKG_DEFAULT_TRIPLET: x64-windows-release
      VCPKG_INSTALLED_DIR: ${{ github.workspace }}\vcpkg_installed
-      VCPKG_DEFAULT_BINARY_CACHE: ${{ github.workspace }}\vcpkg_binary_cache
+      VCPKG_BINARY_SOURCES: clear;files,${{ github.workspace }}/vcpkg-binary-cache,readwrite

    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7

-      - name: Cache vcpkg installed packages
-        id: cache-vcpkg
-        uses: actions/cache@v4
+      - name: Set up vcpkg
+        uses: lukka/run-vcpkg@v11
        with:
-          path: |
-            ${{ env.VCPKG_INSTALLED_DIR }}
-            ${{ env.VCPKG_DEFAULT_BINARY_CACHE }}
-          key: ${{ runner.os }}-vcpkg-${{ env.VCPKG_VERSION }}-${{ env.VCPKG_DEFAULT_TRIPLET }}-${{ hashFiles('**/vcpkg.json', '**/vcpkg-configuration.json') }}-${{ hashFiles('.github/workflows/windows-build.yml') }}
+          vcpkgJsonGlob: vcpkg.json
+          vcpkgConfigurationJsonGlob: vcpkg-configuration.json

-      - name: Setup vcpkg and install dependencies
-        if: steps.cache-vcpkg.outputs.cache-hit != 'true'
-        run: |
-          New-Item -Path "${{ env.VCPKG_INSTALLED_DIR }}" -ItemType Directory -Force
-          New-Item -Path "${{ env.VCPKG_DEFAULT_BINARY_CACHE }}" -ItemType Directory -Force
-          vcpkg install `
-            --recurse `
-            --clean-after-build `
-            --triplet=${{ env.VCPKG_DEFAULT_TRIPLET }} `
-            --x-install-root=${{ env.VCPKG_INSTALLED_DIR }}
-        shell: pwsh
+      - name: Cache vcpkg binary packages
+        uses: actions/cache@v6
+        with:
+          path: ${{ github.workspace }}/vcpkg-binary-cache
+          key: ${{ runner.os }}-vcpkg-binary-${{ env.VCPKG_DEFAULT_TRIPLET }}-${{ hashFiles('vcpkg.json', 'vcpkg-configuration.json', 'ports/**') }}-${{ github.run_id }}-${{ github.run_attempt }}
+          restore-keys: |
+            ${{ runner.os }}-vcpkg-binary-${{ env.VCPKG_DEFAULT_TRIPLET }}-${{ hashFiles('vcpkg.json', 'vcpkg-configuration.json', 'ports/**') }}-
+            ${{ runner.os }}-vcpkg-binary-${{ env.VCPKG_DEFAULT_TRIPLET }}-

      - name: Build wheels
        run: |
@@ -73,7 +65,7 @@ jobs:
          cmake -S . -B build `
            -DCMAKE_BUILD_TYPE=Release `
            -DVCPKG_TARGET_TRIPLET=${{ env.VCPKG_DEFAULT_TRIPLET }} `
-            -DCMAKE_TOOLCHAIN_FILE=${{ env.VCPKG_INSTALLATION_ROOT }}\scripts\buildsystems\vcpkg.cmake `
+            "-DCMAKE_TOOLCHAIN_FILE=$env:VCPKG_ROOT/scripts/buildsystems/vcpkg.cmake" `
            -DVCPKG_INSTALLED_DIR=${{ env.VCPKG_INSTALLED_DIR }} `
            -DBUILD_TESTING=OFF `
            -DOPENDHT_C=OFF `
@@ -86,23 +78,7 @@ jobs:
          pipx run cibuildwheel python
        shell: pwsh

-      - uses: actions/upload-artifact@v5
+      - uses: actions/upload-artifact@v7
        with:
          name: opendht-wheels-win_amd64
          path: ./build/wheelhouse/*.whl
-
-  publish:
-    runs-on: ubuntu-latest
-    needs: [build_wheels, build_wheels_windows]
-    steps:
-    - uses: actions/download-artifact@v6
-      with:
-        pattern: opendht-wheels-*
-        path: dist
-        merge-multiple: true
-
-    - name: Publish package
-      if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags')
-      uses: pypa/gh-action-pypi-publish@release/v1
-      with:
-        password: ${{ secrets.PYPI_API_TOKEN }}
@@ -8,7 +8,9 @@ on:
 env:
  REGISTRY: ghcr.io
  IMAGE_NAME_DEPS: ${{ github.repository }}/opendht-deps
+  IMAGE_NAME_DEPS_NOBLE: ${{ github.repository }}/opendht-deps-noble
  IMAGE_NAME: ${{ github.repository }}/opendht
+  IMAGE_NAME_NOBLE: ${{ github.repository }}/opendht-noble
  IMAGE_NAME_DEPS_LLVM: ${{ github.repository }}/opendht-deps-llvm
  IMAGE_NAME_LLVM: ${{ github.repository }}/opendht-llvm
  IMAGE_NAME_DHTNODE: ${{ github.repository }}/dhtnode
@@ -16,6 +18,19 @@ env:
  IMAGE_NAME_ALPINE_DEPS: ${{ github.repository }}/opendht-deps-alpine

 jobs:
+  nodejs-package:
+    name: Build and verify Node.js package
+    uses: ./.github/workflows/nodejs-package.yml
+    permissions:
+      contents: read
+      packages: read
+
+  python-wheels:
+    name: Build Python wheels
+    uses: ./.github/workflows/python-wheels.yml
+    permissions:
+      contents: read
+
  build-and-push-deps-image:
    name: Dependency Docker image
    runs-on: ubuntu-latest
@@ -25,10 +40,16 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4

      - name: Log in to the Container registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
@@ -36,21 +57,22 @@ jobs:

      - name: Extract metadata (tags, labels) for Docker
        id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME_DEPS }}

      - name: Build and push Docker image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
        with:
          context: .
          file: docker/DockerfileDeps
+          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}

-  build-and-push-image:
-    name: OpenDHT Docker image
+  build-and-push-deps-image-noble:
+    name: Dependency Docker image (Ubuntu 24.04)
    runs-on: ubuntu-latest
    permissions:
      contents: read
@@ -58,10 +80,16 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4

      - name: Log in to the Container registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
@@ -69,16 +97,99 @@ jobs:

      - name: Extract metadata (tags, labels) for Docker
        id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME_DEPS_NOBLE }}
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          file: docker/DockerfileDepsNoble
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+
+  build-and-push-image:
+    name: OpenDHT Docker image
+    runs-on: ubuntu-latest
+    needs: build-and-push-deps-image
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Log in to the Container registry
+        uses: docker/login-action@v4
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@v6
        with:
          images: |
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}

      - name: Build and push Docker image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
        with:
          context: .
          file: docker/Dockerfile
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+
+  build-and-push-image-noble:
+    name: OpenDHT Docker image (Ubuntu 24.04)
+    runs-on: ubuntu-latest
+    needs: build-and-push-deps-image-noble
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Log in to the Container registry
+        uses: docker/login-action@v4
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@v6
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME_NOBLE }}
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          file: docker/DockerfileNoble
+          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
@@ -92,10 +203,16 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4

      - name: Log in to the Container registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
@@ -103,15 +220,16 @@ jobs:

      - name: Extract metadata (tags, labels) for Docker
        id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME_DEPS_LLVM }}

      - name: Build and push Docker image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
        with:
          context: .
          file: docker/DockerfileDepsLlvm
+          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
@@ -119,16 +237,23 @@ jobs:
  build-and-push-image-llvm:
    name: OpenDHT Docker image (LLVM)
    runs-on: ubuntu-latest
+    needs: build-and-push-deps-image-llvm
    permissions:
      contents: read
      packages: write

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4

      - name: Log in to the Container registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
@@ -136,16 +261,17 @@ jobs:

      - name: Extract metadata (tags, labels) for Docker
        id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
        with:
          images: |
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME_LLVM }}

      - name: Build and push Docker image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
        with:
          context: .
          file: docker/DockerfileLlvm
+          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
@@ -153,16 +279,23 @@ jobs:
  build-and-push-image-dhtnode:
    name: dhtnode Docker image
    runs-on: ubuntu-latest
+    needs: build-and-push-image
    permissions:
      contents: read
      packages: write

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4

      - name: Log in to the Container registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
@@ -170,16 +303,17 @@ jobs:

      - name: Extract metadata (tags, labels) for Docker
        id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
        with:
          images: |
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME_DHTNODE }}

      - name: Build and push Docker image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
        with:
          context: .
          file: docker/DockerfileDhtnode
+          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
@@ -193,10 +327,16 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4

      - name: Log in to the Container registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
@@ -204,16 +344,17 @@ jobs:

      - name: Extract metadata (tags, labels) for Docker
        id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
        with:
          images: |
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME_ALPINE_DEPS }}

      - name: Build and push Docker image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
        with:
          context: .
          file: docker/DockerfileDepsAlpine
+          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
@@ -221,16 +362,23 @@ jobs:
  build-and-push-image-alpine:
    name: Alpine Docker image
    runs-on: ubuntu-latest
+    needs: build-and-push-image-alpine-deps
    permissions:
      contents: read
      packages: write

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4

      - name: Log in to the Container registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
@@ -238,16 +386,17 @@ jobs:

      - name: Extract metadata (tags, labels) for Docker
        id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
        with:
          images: |
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME_ALPINE }}

      - name: Build and push Docker image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
        with:
          context: .
          file: docker/DockerfileAlpine
+          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
@@ -256,22 +405,26 @@ jobs:
    name: Build Windows MSI Installer
    runs-on: windows-latest
    env:
-      VCPKG_VERSION: "2025.07.25"
-      VCPKG_INSTALLATION_ROOT: "C:\\vcpkg"
      VCPKG_DISABLE_METRICS: "1"
      VCPKG_DEFAULT_TRIPLET: x64-windows
      VCPKG_INSTALLED_DIR: ${{ github.workspace }}\vcpkg_installed
-      VCPKG_DEFAULT_BINARY_CACHE: ${{ github.workspace }}\vcpkg_binary_cache
+      VCPKG_BINARY_SOURCES: clear;files,${{ github.workspace }}/vcpkg-binary-cache,readwrite
    permissions:
      contents: read
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
        with:
          submodules: recursive

+      - name: Set up vcpkg
+        uses: lukka/run-vcpkg@v11
+        with:
+          vcpkgJsonGlob: vcpkg.json
+          vcpkgConfigurationJsonGlob: vcpkg-configuration.json
+
      - name: Set up MSVC developer environment
-        uses: microsoft/setup-msbuild@v2
+        uses: microsoft/setup-msbuild@v3
      
      - name: Install WIX using .net tools
        run: |
@@ -279,27 +432,14 @@ jobs:
          wix extension add --global WixToolset.UI.wixext/6.0.1
        shell: pwsh

-      - name: Cache vcpkg installed packages
-        id: cache-vcpkg
-        uses: actions/cache@v4
+      - name: Cache vcpkg binary packages
+        uses: actions/cache@v6
        with:
-          path: |
-            ${{ env.VCPKG_INSTALLED_DIR }}
-            ${{ env.VCPKG_DEFAULT_BINARY_CACHE }}
-          key: ${{ runner.os }}-vcpkg-${{ env.VCPKG_VERSION }}-x64-shared-${{ hashFiles('**/vcpkg.json', '**/vcpkg-configuration.json') }}-${{ hashFiles('.github/workflows/windows-build.yml') }}
-
-      - name: Setup vcpkg and install dependencies
-        if: steps.cache-vcpkg.outputs.cache-hit != 'true'
-        run: |
-          New-Item -Path "${{ env.VCPKG_INSTALLED_DIR }}" -ItemType Directory -Force
-          New-Item -Path "${{ env.VCPKG_DEFAULT_BINARY_CACHE }}" -ItemType Directory -Force
-          vcpkg install `
-            --recurse `
-            --clean-after-build `
-            --triplet=x64-windows `
-            --x-install-root=${{ env.VCPKG_INSTALLED_DIR }} `
-            --x-feature=test
-        shell: pwsh
+          path: ${{ github.workspace }}/vcpkg-binary-cache
+          key: ${{ runner.os }}-vcpkg-binary-${{ env.VCPKG_DEFAULT_TRIPLET }}-${{ hashFiles('vcpkg.json', 'vcpkg-configuration.json', 'ports/**') }}-${{ github.run_id }}-${{ github.run_attempt }}
+          restore-keys: |
+            ${{ runner.os }}-vcpkg-binary-${{ env.VCPKG_DEFAULT_TRIPLET }}-${{ hashFiles('vcpkg.json', 'vcpkg-configuration.json', 'ports/**') }}-
+            ${{ runner.os }}-vcpkg-binary-${{ env.VCPKG_DEFAULT_TRIPLET }}-

      - name: Configure CMake for MSI
        shell: pwsh
@@ -307,7 +447,7 @@ jobs:
          mkdir build -ErrorAction SilentlyContinue
          cmake -B build `
            -S . `
-            -DCMAKE_TOOLCHAIN_FILE=${{ env.VCPKG_INSTALLATION_ROOT }}/scripts/buildsystems/vcpkg.cmake `
+            "-DCMAKE_TOOLCHAIN_FILE=$env:VCPKG_ROOT/scripts/buildsystems/vcpkg.cmake" `
            -DVCPKG_TARGET_TRIPLET=x64-windows `
            -DVCPKG_INSTALLED_DIR=${{ env.VCPKG_INSTALLED_DIR }} `
            -DVCPKG_MANIFEST_FEATURES=test `
@@ -350,7 +490,7 @@ jobs:
          }

      - name: Upload MSI Artifact
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v7
        with:
          name: opendht-windows-msi
          path: build/${{ steps.cpack_msi.outputs.msi_path }} # Path to the MSI in the build directory
@@ -360,47 +500,35 @@ jobs:
    name: Build Windows dhtnode
    runs-on: windows-latest
    env:
-      VCPKG_VERSION: "2025.07.25"
-      VCPKG_INSTALLATION_ROOT: "C:\\vcpkg"
      VCPKG_DISABLE_METRICS: "1"
      VCPKG_DEFAULT_TRIPLET: x64-windows-static-release
      VCPKG_INSTALLED_DIR: ${{ github.workspace }}\vcpkg_installed
-      VCPKG_DEFAULT_BINARY_CACHE: ${{ github.workspace }}\vcpkg_binary_cache
+      VCPKG_BINARY_SOURCES: clear;files,${{ github.workspace }}/vcpkg-binary-cache,readwrite
    permissions:
      contents: read
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
        with:
          submodules: recursive

-      - name: Set up MSVC developer environment
-        uses: microsoft/setup-msbuild@v2
-
-      - name: Cache vcpkg static installed packages
-        id: cache-vcpkg-static
-        uses: actions/cache@v4
+      - name: Set up vcpkg
+        uses: lukka/run-vcpkg@v11
        with:
-          path: |
-            ${{ env.VCPKG_INSTALLED_DIR }}
-            ${{ env.VCPKG_DEFAULT_BINARY_CACHE }}
-          key: ${{ runner.os }}-vcpkg-${{ env.VCPKG_VERSION }}-x64-static-${{ hashFiles('**/vcpkg.json', '**/vcpkg-configuration.json') }}-${{ hashFiles('.github/workflows/windows-build.yml') }}
-          restore-keys: |
-            ${{ runner.os }}-vcpkg-${{ env.VCPKG_VERSION }}-x64-static-${{ hashFiles('**/vcpkg.json', '**/vcpkg-configuration.json') }}
-            ${{ runner.os }}-vcpkg-${{ env.VCPKG_VERSION }}-x64-static-
+          vcpkgJsonGlob: vcpkg.json
+          vcpkgConfigurationJsonGlob: vcpkg-configuration.json

-      - name: Setup vcpkg and install static dependencies
-        if: steps.cache-vcpkg-static.outputs.cache-hit != 'true'
-        shell: pwsh
-        run: |
-          New-Item -Path "${{ env.VCPKG_INSTALLED_DIR }}" -ItemType Directory -Force
-          New-Item -Path "${{ env.VCPKG_DEFAULT_BINARY_CACHE }}" -ItemType Directory -Force
-          vcpkg install `
-            --recurse `
-            --clean-after-build `
-            --triplet=x64-windows-static-release `
-            --x-install-root=${{ env.VCPKG_INSTALLED_DIR }} `
-            --x-feature=test
+      - name: Set up MSVC developer environment
+        uses: microsoft/setup-msbuild@v3
+
+      - name: Cache vcpkg binary packages
+        uses: actions/cache@v6
+        with:
+          path: ${{ github.workspace }}/vcpkg-binary-cache
+          key: ${{ runner.os }}-vcpkg-binary-${{ env.VCPKG_DEFAULT_TRIPLET }}-${{ hashFiles('vcpkg.json', 'vcpkg-configuration.json', 'ports/**') }}-${{ github.run_id }}-${{ github.run_attempt }}
+          restore-keys: |
+            ${{ runner.os }}-vcpkg-binary-${{ env.VCPKG_DEFAULT_TRIPLET }}-${{ hashFiles('vcpkg.json', 'vcpkg-configuration.json', 'ports/**') }}-
+            ${{ runner.os }}-vcpkg-binary-${{ env.VCPKG_DEFAULT_TRIPLET }}-

      - name: Configure CMake for Static Build
        shell: pwsh
@@ -408,7 +536,7 @@ jobs:
          mkdir build_static -ErrorAction SilentlyContinue
          cmake -B build_static `
            -S . `
-            -DCMAKE_TOOLCHAIN_FILE=${{ env.VCPKG_INSTALLATION_ROOT }}/scripts/buildsystems/vcpkg.cmake `
+            "-DCMAKE_TOOLCHAIN_FILE=$env:VCPKG_ROOT/scripts/buildsystems/vcpkg.cmake" `
            -DVCPKG_TARGET_TRIPLET=x64-windows-static-release `
            -DVCPKG_INSTALLED_DIR=${{ env.VCPKG_INSTALLED_DIR }} `
            -DVCPKG_MANIFEST_FEATURES=test `
@@ -430,7 +558,7 @@ jobs:
          cmake --build build_static --config Release --parallel $([System.Environment]::ProcessorCount)

      - name: Upload Static dhtnode Artifact
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v7
        with:
          name: opendht-windows-dhtnode
          path: |
@@ -440,31 +568,119 @@ jobs:
  create-github-release:
    name: Create GitHub Release
    runs-on: ubuntu-latest
-    needs: [build-windows-msi, build-windows-dhtnode]
+    needs: [build-windows-msi, build-windows-dhtnode, nodejs-package]
    permissions:
      contents: write

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7

      - name: Download Windows MSI artifact
-        uses: actions/download-artifact@v6
+        uses: actions/download-artifact@v8
        with:
          name: opendht-windows-msi
          path: downloaded_artifacts/windows_msi

      - name: Download Static dhtnode artifact
-        uses: actions/download-artifact@v6
+        uses: actions/download-artifact@v8
        with:
          name: opendht-windows-dhtnode
          path: downloaded_artifacts/static_dhtnode

+      - name: Download npm archive
+        uses: actions/download-artifact@v8
+        with:
+          name: opendht-node-npm
+          path: downloaded_artifacts/nodejs
+
      - name: Create Release
        id: create_release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3
        with:
          draft: true
+          prerelease: ${{ contains(github.ref_name, '-') }}
          files: |
            downloaded_artifacts/windows_msi/*.msi
            downloaded_artifacts/static_dhtnode/**/*dhtnode.exe
+            downloaded_artifacts/nodejs/*.tgz
+
+  publish-npm:
+    name: Publish opendht to npm
+    needs: create-github-release
+    runs-on: ubuntu-26.04
+    environment:
+      name: npm
+      url: https://www.npmjs.com/package/opendht
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
+        with:
+          node-version: '24'
+          registry-url: https://registry.npmjs.org/
+          package-manager-cache: false
+      - uses: actions/download-artifact@v8
+        with:
+          name: opendht-node-npm
+          path: nodejs/dist
+      - name: Publish verified archive
+        working-directory: nodejs
+        env:
+          RELEASE_TAG: ${{ github.ref_name }}
+        run: |
+          dist_tag=latest
+          if [[ "${RELEASE_TAG#v}" == *-* ]]; then
+            dist_tag=next
+          fi
+          npm publish ./dist/*.tgz --access public --provenance --tag "$dist_tag"
+
+  publish-pypi:
+    name: Publish opendht to PyPI
+    needs: [create-github-release, python-wheels]
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/opendht
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v8
+        with:
+          pattern: opendht-wheels-*
+          path: dist
+          merge-multiple: true
+      - name: Publish wheels
+        uses: pypa/gh-action-pypi-publish@release/v1
+
+  publish-crate:
+    name: Publish opendht to crates.io
+    needs: create-github-release
+    runs-on: ubuntu-latest
+    environment:
+      name: crates-io
+      url: https://crates.io/crates/opendht
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@v7
+      - uses: taiki-e/install-action@v2
+        with:
+          tool: cargo-edit
+      - name: Set crate version from release tag
+        working-directory: rust
+        env:
+          RELEASE_TAG: ${{ github.ref_name }}
+        run: cargo set-version "${RELEASE_TAG#v}"
+      - name: Authenticate with crates.io
+        id: auth
+        uses: rust-lang/crates-io-auth-action@v1
+      - name: Publish crate
+        working-directory: rust
+        env:
+          CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}
+        run: cargo publish --allow-dirty
@@ -9,137 +9,117 @@ on:
    branches: [ main, master ]

 env:
-  VCPKG_VERSION: "2025.07.25"
-  VCPKG_INSTALLATION_ROOT: "C:\\vcpkg"
  VCPKG_DISABLE_METRICS: "1"
  VCPKG_INSTALLED_DIR: ${{ github.workspace }}\vcpkg_installed
-  VCPKG_DEFAULT_BINARY_CACHE: ${{ github.workspace }}\vcpkg_binary_cache
+  VCPKG_BINARY_SOURCES: clear;files,${{ github.workspace }}/vcpkg-binary-cache,readwrite

 jobs:
  prepare-dependencies:
    name: Prepare Windows Dependencies
    runs-on: windows-latest
-    outputs:
-      vcpkg_cache_key: ${{ steps.generate_cache_key.outputs.key }}
+    env:
+      VCPKG_DEFAULT_TRIPLET: ${{ matrix.arch }}-windows
    strategy:
      matrix:
        arch: [x64]

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7

      - name: Set up MSVC
-        uses: microsoft/setup-msbuild@v2
+        uses: microsoft/setup-msbuild@v3

-      - name: Generate Cache Key
-        id: generate_cache_key
-        shell: pwsh
-        run: |
-          $key_value = "${{ runner.os }}-vcpkg-${{ env.VCPKG_VERSION }}-${{ matrix.arch }}-shared-${{ hashFiles('**/vcpkg.json', '**/vcpkg-configuration.json') }}-${{ hashFiles('.github/workflows/windows-build.yml') }}"
-          echo "key=$key_value" >> $env:GITHUB_OUTPUT
-
-      - name: Cache vcpkg installed packages
-        id: cache-vcpkg
-        uses: actions/cache@v4
+      - name: Cache vcpkg binary packages
+        uses: actions/cache@v6
        with:
-          path: |
-            ${{ env.VCPKG_INSTALLED_DIR }}
-            ${{ env.VCPKG_DEFAULT_BINARY_CACHE }}
-          key: ${{ steps.generate_cache_key.outputs.key }}
+          path: ${{ github.workspace }}/vcpkg-binary-cache
+          key: ${{ runner.os }}-vcpkg-binary-${{ env.VCPKG_DEFAULT_TRIPLET }}-${{ hashFiles('vcpkg.json', 'vcpkg-configuration.json', 'ports/**') }}-${{ github.run_id }}-${{ github.run_attempt }}
          restore-keys: |
-            ${{ runner.os }}-vcpkg-${{ env.VCPKG_VERSION }}-${{ matrix.arch }}-shared-${{ hashFiles('**/vcpkg.json', '**/vcpkg-configuration.json') }}
-            ${{ runner.os }}-vcpkg-${{ env.VCPKG_VERSION }}-${{ matrix.arch }}-shared-
+            ${{ runner.os }}-vcpkg-binary-${{ env.VCPKG_DEFAULT_TRIPLET }}-${{ hashFiles('vcpkg.json', 'vcpkg-configuration.json', 'ports/**') }}-
+            ${{ runner.os }}-vcpkg-binary-${{ env.VCPKG_DEFAULT_TRIPLET }}-

-      - name: Setup vcpkg and install dependencies
-        if: steps.cache-vcpkg.outputs.cache-hit != 'true'
-        run: |
-          New-Item -Path "${{ env.VCPKG_INSTALLED_DIR }}" -ItemType Directory -Force
-          New-Item -Path "${{ env.VCPKG_DEFAULT_BINARY_CACHE }}" -ItemType Directory -Force
-          vcpkg install `
-            --recurse `
-            --clean-after-build `
-            --triplet=${{ matrix.arch }}-windows `
-            --x-install-root=${{ env.VCPKG_INSTALLED_DIR }} `
-            --x-feature=test
-        shell: pwsh
+      - name: Set up vcpkg and install dependencies
+        uses: lukka/run-vcpkg@v11
+        with:
+          vcpkgJsonGlob: vcpkg.json
+          vcpkgConfigurationJsonGlob: vcpkg-configuration.json
+          runVcpkgInstall: true
+          runVcpkgFormatString: >-
+            [`install`, `--clean-after-build`, `--x-feature=test`,
+             `--triplet`, `$[env.VCPKG_DEFAULT_TRIPLET]`,
+             `--x-install-root`, `$[env.VCPKG_INSTALLED_DIR]`]

  prepare-static-dependencies:
    name: Prepare Windows Static Dependencies
    runs-on: windows-latest
-    outputs:
-      vcpkg_static_cache_key: ${{ steps.generate_static_cache_key.outputs.key }}
+    env:
+      VCPKG_DEFAULT_TRIPLET: ${{ matrix.arch }}-windows-static-release
    strategy:
      matrix:
        arch: [x64]

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7

      - name: Set up MSVC
-        uses: microsoft/setup-msbuild@v2
+        uses: microsoft/setup-msbuild@v3

-      - name: Generate Cache Key for Static Libs
-        id: generate_static_cache_key
-        shell: pwsh
-        run: |
-          $key_value = "${{ runner.os }}-vcpkg-${{ env.VCPKG_VERSION }}-${{ matrix.arch }}-static-${{ hashFiles('**/vcpkg.json', '**/vcpkg-configuration.json') }}-${{ hashFiles('.github/workflows/windows-build.yml') }}"
-          echo "key=$key_value" >> $env:GITHUB_OUTPUT
-
-      - name: Cache vcpkg static installed packages
-        id: cache-vcpkg-static
-        uses: actions/cache@v4
+      - name: Cache vcpkg binary packages
+        uses: actions/cache@v6
        with:
-          path: |
-            ${{ env.VCPKG_INSTALLED_DIR }}
-            ${{ env.VCPKG_DEFAULT_BINARY_CACHE }}
-          key: ${{ steps.generate_static_cache_key.outputs.key }}
+          path: ${{ github.workspace }}/vcpkg-binary-cache
+          key: ${{ runner.os }}-vcpkg-binary-${{ env.VCPKG_DEFAULT_TRIPLET }}-${{ hashFiles('vcpkg.json', 'vcpkg-configuration.json', 'ports/**') }}-${{ github.run_id }}-${{ github.run_attempt }}
          restore-keys: |
-            ${{ runner.os }}-vcpkg-${{ env.VCPKG_VERSION }}-${{ matrix.arch }}-static-${{ hashFiles('**/vcpkg.json', '**/vcpkg-configuration.json') }}
-            ${{ runner.os }}-vcpkg-${{ env.VCPKG_VERSION }}-${{ matrix.arch }}-static-
+            ${{ runner.os }}-vcpkg-binary-${{ env.VCPKG_DEFAULT_TRIPLET }}-${{ hashFiles('vcpkg.json', 'vcpkg-configuration.json', 'ports/**') }}-
+            ${{ runner.os }}-vcpkg-binary-${{ env.VCPKG_DEFAULT_TRIPLET }}-

-      - name: Setup vcpkg and install static dependencies
-        if: steps.cache-vcpkg-static.outputs.cache-hit != 'true'
-        shell: pwsh
-        run: |
-          New-Item -Path "${{ env.VCPKG_INSTALLED_DIR }}" -ItemType Directory -Force
-          New-Item -Path "${{ env.VCPKG_DEFAULT_BINARY_CACHE }}" -ItemType Directory -Force
-          vcpkg install `
-            --recurse `
-            --clean-after-build `
-            --triplet=${{ matrix.arch }}-windows-static-release `
-            --x-install-root=${{ env.VCPKG_INSTALLED_DIR }} `
-            --x-feature=test
+      - name: Set up vcpkg and install dependencies
+        uses: lukka/run-vcpkg@v11
+        with:
+          vcpkgJsonGlob: vcpkg.json
+          vcpkgConfigurationJsonGlob: vcpkg-configuration.json
+          runVcpkgInstall: true
+          runVcpkgFormatString: >-
+            [`install`, `--clean-after-build`, `--x-feature=test`,
+             `--triplet`, `$[env.VCPKG_DEFAULT_TRIPLET]`,
+             `--x-install-root`, `$[env.VCPKG_INSTALLED_DIR]`]

  build-windows:
    name: Windows MSVC Build
    runs-on: windows-latest
    needs: prepare-dependencies
+    env:
+      VCPKG_DEFAULT_TRIPLET: ${{ matrix.arch }}-windows
    
    strategy:
      matrix:
        build_type: [Debug, Release]
        arch: [x64]
+        cxx_standard: [17, 20, 23]

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
+
+      - name: Set up vcpkg
+        uses: lukka/run-vcpkg@v11
+        with:
+          vcpkgJsonGlob: vcpkg.json
+          vcpkgConfigurationJsonGlob: vcpkg-configuration.json

      - name: Set up MSVC
-        uses: microsoft/setup-msbuild@v2
+        uses: microsoft/setup-msbuild@v3

-      - name: Restore vcpkg installed packages
-        id: cache-vcpkg-restore
-        uses: actions/cache/restore@v4
+      - name: Restore vcpkg binary packages
+        uses: actions/cache/restore@v6
        with:
-          path: |
-            ${{ env.VCPKG_INSTALLED_DIR }}
-            ${{ env.VCPKG_DEFAULT_BINARY_CACHE }}
-          key: ${{ needs.prepare-dependencies.outputs.vcpkg_cache_key }}
+          path: ${{ github.workspace }}/vcpkg-binary-cache
+          key: ${{ runner.os }}-vcpkg-binary-${{ env.VCPKG_DEFAULT_TRIPLET }}-${{ hashFiles('vcpkg.json', 'vcpkg-configuration.json', 'ports/**') }}-${{ github.run_id }}-${{ github.run_attempt }}
          restore-keys: |
-            ${{ runner.os }}-vcpkg-${{ env.VCPKG_VERSION }}-${{ matrix.arch }}-shared-${{ hashFiles('**/vcpkg.json', '**/vcpkg-configuration.json') }}
-            ${{ runner.os }}-vcpkg-${{ env.VCPKG_VERSION }}-${{ matrix.arch }}-shared-
+            ${{ runner.os }}-vcpkg-binary-${{ env.VCPKG_DEFAULT_TRIPLET }}-${{ hashFiles('vcpkg.json', 'vcpkg-configuration.json', 'ports/**') }}-
+            ${{ runner.os }}-vcpkg-binary-${{ env.VCPKG_DEFAULT_TRIPLET }}-

      - name: Configure CMake
        shell: pwsh
@@ -147,11 +127,13 @@ jobs:
          mkdir build -ErrorAction SilentlyContinue
          cmake -B build `
            -S . `
-            -DCMAKE_TOOLCHAIN_FILE=${{ env.VCPKG_INSTALLATION_ROOT }}/scripts/buildsystems/vcpkg.cmake `
+            "-DCMAKE_TOOLCHAIN_FILE=$env:VCPKG_ROOT/scripts/buildsystems/vcpkg.cmake" `
            -DVCPKG_TARGET_TRIPLET=${{ matrix.arch }}-windows `
            -DVCPKG_INSTALLED_DIR=${{ env.VCPKG_INSTALLED_DIR }} `
            -DVCPKG_MANIFEST_FEATURES=test `
            -DCMAKE_BUILD_TYPE=${{ matrix.build_type }} `
+            -DCMAKE_CXX_STANDARD=${{ matrix.cxx_standard }} `
+            -DCMAKE_CXX_STANDARD_REQUIRED=ON `
            -DBUILD_TESTING=ON `
            -DOPENDHT_PROXY_CLIENT=ON `
            -DOPENDHT_PROXY_SERVER=ON `
@@ -178,9 +160,9 @@ jobs:

      - name: Upload build artifacts
        if: matrix.build_type == 'Release'
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v7
        with:
-          name: opendht-windows-${{ matrix.arch }}-${{ matrix.build_type }}
+          name: opendht-windows-${{ matrix.arch }}-cxx${{ matrix.cxx_standard }}-${{ matrix.build_type }}
          path: |
            build/**/*.exe
            build/**/*.dll
@@ -191,29 +173,35 @@ jobs:
    name: Windows Static MSVC Build
    runs-on: windows-latest
    needs: prepare-static-dependencies
+    env:
+      VCPKG_DEFAULT_TRIPLET: ${{ matrix.arch }}-windows-static-release
    strategy:
      matrix:
        build_type: [Release]
        arch: [x64]
+        cxx_standard: [17, 20, 23]

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
+
+      - name: Set up vcpkg
+        uses: lukka/run-vcpkg@v11
+        with:
+          vcpkgJsonGlob: vcpkg.json
+          vcpkgConfigurationJsonGlob: vcpkg-configuration.json

      - name: Set up MSVC
-        uses: microsoft/setup-msbuild@v2
+        uses: microsoft/setup-msbuild@v3

-      - name: Restore vcpkg static installed packages
-        id: cache-vcpkg-static-restore
-        uses: actions/cache/restore@v4
+      - name: Restore vcpkg binary packages
+        uses: actions/cache/restore@v6
        with:
-          path: |
-            ${{ env.VCPKG_INSTALLED_DIR }}
-            ${{ env.VCPKG_DEFAULT_BINARY_CACHE }}
-          key: ${{ needs.prepare-static-dependencies.outputs.vcpkg_static_cache_key }}
+          path: ${{ github.workspace }}/vcpkg-binary-cache
+          key: ${{ runner.os }}-vcpkg-binary-${{ env.VCPKG_DEFAULT_TRIPLET }}-${{ hashFiles('vcpkg.json', 'vcpkg-configuration.json', 'ports/**') }}-${{ github.run_id }}-${{ github.run_attempt }}
          restore-keys: |
-            ${{ runner.os }}-vcpkg-${{ env.VCPKG_VERSION }}-${{ matrix.arch }}-static-${{ hashFiles('**/vcpkg.json', '**/vcpkg-configuration.json') }}
-            ${{ runner.os }}-vcpkg-${{ env.VCPKG_VERSION }}-${{ matrix.arch }}-static-
+            ${{ runner.os }}-vcpkg-binary-${{ env.VCPKG_DEFAULT_TRIPLET }}-${{ hashFiles('vcpkg.json', 'vcpkg-configuration.json', 'ports/**') }}-
+            ${{ runner.os }}-vcpkg-binary-${{ env.VCPKG_DEFAULT_TRIPLET }}-
      
      - name: Configure CMake for Static Build
        shell: pwsh
@@ -221,11 +209,13 @@ jobs:
          mkdir build -ErrorAction SilentlyContinue
          cmake -B build `
            -S . `
-            -DCMAKE_TOOLCHAIN_FILE=${{ env.VCPKG_INSTALLATION_ROOT }}/scripts/buildsystems/vcpkg.cmake `
+            "-DCMAKE_TOOLCHAIN_FILE=$env:VCPKG_ROOT/scripts/buildsystems/vcpkg.cmake" `
            -DVCPKG_TARGET_TRIPLET=${{ matrix.arch }}-windows-static-release `
            -DVCPKG_INSTALLED_DIR=${{ env.VCPKG_INSTALLED_DIR }} `
            -DVCPKG_MANIFEST_FEATURES=test `
            -DCMAKE_BUILD_TYPE=${{ matrix.build_type }} `
+            -DCMAKE_CXX_STANDARD=${{ matrix.cxx_standard }} `
+            -DCMAKE_CXX_STANDARD_REQUIRED=ON `
            -DBUILD_SHARED_LIBS=OFF `
            -DBUILD_TESTING=ON `
            -DOPENDHT_PROXY_CLIENT=ON `
@@ -250,9 +240,9 @@ jobs:
          ctest --build-config ${{ matrix.build_type }} --output-on-failure --parallel 4

      - name: Upload static build artifacts
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v7
        with:
-          name: opendht-windows-static-${{ matrix.arch }}-${{ matrix.build_type }}
+          name: opendht-windows-static-${{ matrix.arch }}-cxx${{ matrix.cxx_standard }}-${{ matrix.build_type }}
          path: |
            build/**/*.exe
            build/**/*.lib
@@ -269,7 +259,7 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7

      - name: Setup MinGW
        uses: msys2/setup-msys2@v2
@@ -298,7 +288,7 @@ jobs:
        shell: msys2 {0}
        env:
          LLHTTP_VERSION: "v9.2.1"
-          RESTINIO_VERSION: "0.7.6"
+          RESTINIO_VERSION: "0.7.10"
          EXPECTED_LITE_URL: "https://raw.githubusercontent.com/martinmoene/expected-lite/master/include/nonstd/expected.hpp"
        run: |
          MSYS2_SYSROOT=$(cygpath -u "$MSYSTEM_PREFIX")
@@ -369,7 +359,7 @@ jobs:

      - name: Upload MinGW artifacts
        if: matrix.build_type == 'Release'
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v7
        with:
          name: opendht-windows-mingw-${{ matrix.build_type }}
          path: |
@@ -23,33 +23,12 @@
 **/dhtchat
 **/dhtscanner

-# Autotools
-/ac
-Makefile
-Makefile.in
-/aclocal.m4
-/autom4te.cache/
-/config.*
-/configure
-/depcomp
-/install-sh
-/libtool
-/ltmain.sh
-/m4/
-/missing
-/stamp-h?
-.deps/
-.dirstamp
-.libs/
-*.l[ao]
-*~
-*.pc
-
 # CMake
 CMakeCache.txt
 CMakeFiles/
 cmake_install.cmake
 *ConfigVersion.cmake
+*.pc

 # VSCode
 .vscode/*
@@ -61,7 +40,6 @@ CMakeSettings.json
 # Eclipse CDT
 .cproject
 .project
-.autotools
 language.settings.xml

 # Python
@@ -0,0 +1,74 @@
+# OpenDHT – Agent Instructions
+
+## Build
+
+### Primary: CMake (C++17)
+```sh
+mkdir build && cd build
+cmake .. -DCMAKE_BUILD_TYPE=Debug -DBUILD_TESTING=ON -GNinja
+ninja
+```
+
+### Common CMake options
+| Option | Default | Purpose |
+|--------|---------|---------|
+| `OPENDHT_TOOLS` | ON | CLI tools (dhtnode, dhtchat, …) |
+| `OPENDHT_C` | OFF | C language bindings |
+| `OPENDHT_PYTHON` | OFF | Python 3 Cython bindings |
+| `OPENDHT_PROXY_SERVER` | OFF | REST API proxy server (requires RESTinio + llhttp) |
+| `OPENDHT_PROXY_CLIENT` | OFF | REST API proxy client |
+| `OPENDHT_PEER_DISCOVERY` | OFF | Multicast local peer discovery |
+| `OPENDHT_PUSH_NOTIFICATIONS` | OFF | Push notification support |
+| `OPENDHT_SANITIZE` | OFF | AddressSanitizer + stack protector |
+
+### Alternative: Meson (C++20)
+```sh
+meson setup build . && cd build && ninja
+```
+
+### Run tests
+```sh
+# Full suite
+ctest --output-on-failure --test-dir build
+
+# Single test executable
+./build/test_testName
+```
+
+## dhtnode
+
+The `dhtnode` CLI tool is a simple DHT node implementation using `DhtRunner`.
+
+---
+
+## Commit
+
+After implementing a feature or fixing a bug, commit your changes in clean, atomic commits with descriptive messages with format:
+`topic: short description`
+
+If any test are added or modified, commit them separately before the fix (if any).
+
+---
+
+## Architecture
+
+OpenDHT is a Kademlia-based DHT library. The implementation is layered:
+
+```
+DhtRunner          (public API — thread-safe, manages lifecycle & I/O threads)
+  └── SecureDht    (GnuTLS crypto: signing, encryption, identity)
+        └── Dht    (core DHT logic: routing, storage, find/get/put operations)
+              └── NetworkEngine   (raw UDP sockets, message parsing, IPv4/IPv6)
+```
+
+- **`DhtRunner`** (`include/opendht/dhtrunner.h`, `src/dhtrunner.cpp`) — entry point for all users of the library. Wraps everything in a thread-pool and exposes async callbacks as well as blocking calls.
+- **`Dht`** (`include/opendht/dht.h`, `src/dht.cpp`) — Kademlia protocol: routing table, k-buckets, value replication, expiry.
+- **`SecureDht`** (`include/opendht/securedht.h`, `src/securedht.cpp`) — transparent encryption/signing layer on top of `Dht`. Identity is a GnuTLS certificate.
+- **`NetworkEngine`** (`include/opendht/network_engine.h`, `src/network_engine.cpp`) — UDP socket layer, serializes/deserializes msgpack messages.
+- **`RoutingTable`** (`include/opendht/routing_table.h`, `src/routing_table.cpp`) — Kademlia routing table with bucket splitting.
+- **`Value`** (`include/opendht/value.h`) — the storable unit: binary blob, optional signature, optional encryption; typed via `ValueType`.
+- **`InfoHash`** (`include/opendht/infohash.h`) — 20-byte SHA-1 identifier; alias `Hash<HASH_LEN>`.
+
+Optional components (`DhtProxyServer`, `DhtProxyClient`, `PeerDiscovery`) are compiled in only when the corresponding CMake options are enabled.
+
+---
@@ -21,11 +21,11 @@ Optionally, install RESTinio to enable the OpenDHT proxy client and server:
 mkdir /usr/include/nonstd
 wget https://raw.githubusercontent.com/martinmoene/expected-lite/master/include/nonstd/expected.hpp -O /usr/include/nonstd/expected.hpp

-wget https://github.com/Stiffstream/restinio/releases/download/v.0.7.3/restinio-0.7.3.tar.bz2
-tar -xjf restinio-0.7.3.tar.bz2
-cd restinio-0.7.3/dev
+wget https://github.com/Stiffstream/restinio/releases/download/v.0.7.9/restinio-0.7.9.tar.bz2
+tar -xjf restinio-0.7.9.tar.bz2
+cd restinio-0.7.9/dev
 cmake -DCMAKE_INSTALL_PREFIX=/usr -DRESTINIO_TEST=Off -DRESTINIO_SAMPLE=Off -DRESTINIO_BENCHMARK=Off -DRESTINIO_WITH_SOBJECTIZER=Off -DRESTINIO_DEP_STANDALONE_ASIO=system -DRESTINIO_DEP_LLHTTP=system -DRESTINIO_DEP_FMT=system -DRESTINIO_DEP_EXPECTED_LITE=system .
-make -j2 && make install
+make && make install
 ```

 To run openDHT on a different computer from the build computer, the following runtime dependencies are required:
@@ -48,11 +48,11 @@ Optionally, install RESTinio to enable the OpenDHT proxy client and server:
 mkdir /usr/include/nonstd
 wget https://raw.githubusercontent.com/martinmoene/expected-lite/master/include/nonstd/expected.hpp -O /usr/include/nonstd/expected.hpp

-wget https://github.com/Stiffstream/restinio/releases/download/v.0.7.3/restinio-0.7.3.tar.bz2
-tar -xjf restinio-0.7.3.tar.bz2
-cd restinio-0.7.3/dev
+wget https://github.com/Stiffstream/restinio/releases/download/v.0.7.9/restinio-0.7.9.tar.bz2
+tar -xjf restinio-0.7.9.tar.bz2
+cd restinio-0.7.9/dev
 cmake -DCMAKE_INSTALL_PREFIX=/usr -DRESTINIO_TEST=Off -DRESTINIO_SAMPLE=Off -DRESTINIO_BENCHMARK=Off -DRESTINIO_WITH_SOBJECTIZER=Off -DRESTINIO_DEP_STANDALONE_ASIO=system -DRESTINIO_DEP_LLHTTP=system -DRESTINIO_DEP_FMT=system -DRESTINIO_DEP_EXPECTED_LITE=system .
-make -j2 && make install
+make && make install
 ```

 ### Fedora
@@ -67,7 +67,7 @@ sudo dnf install python3-Cython python3-devel redhat-rpm-config
 ### macOS

 ```sh
-brew install gnutls msgpack-cxx argon2 asio readline jsoncpp fmt
+brew install gnutls msgpack-cxx argon2 asio readline jsoncpp fmt llhttp
 ```

 ## Build
@@ -81,7 +81,7 @@ git clone https://github.com/savoirfairelinux/opendht.git
 # Build and install
 cd opendht
 mkdir build && cd build
-cmake -DCMAKE_INSTALL_PREFIX=/usr ..
+cmake ..
 make -j$(nproc)
 sudo make install
 ```
@@ -100,20 +100,79 @@ cmake -DOPENDHT_PYTHON=ON \
      -DOPENDHT_PROXY_SERVER=ON \
      -DOPENDHT_PROXY_SERVER_IDENTITY=ON \
      -DOPENDHT_PROXY_CLIENT=ON \
-      -DOPENDHT_PUSH_NOTIFICATIONS=ON \
-      -DCMAKE_INSTALL_PREFIX=/usr ..
+      -DOPENDHT_PUSH_NOTIFICATIONS=ON ..
 ```

+#### Common CMake options
+| Option | Default | Purpose |
+|--------|---------|---------|
+| `OPENDHT_TOOLS` | ON | CLI tools (dhtnode, dhtchat, …) |
+| `OPENDHT_C` | OFF | C language bindings |
+| `OPENDHT_PYTHON` | OFF | Python 3 Cython bindings |
+| `OPENDHT_PROXY_SERVER` | OFF | REST API proxy server (requires RESTinio + llhttp) |
+| `OPENDHT_PROXY_CLIENT` | OFF | REST API proxy client |
+| `OPENDHT_PEER_DISCOVERY` | OFF | Multicast local peer discovery |
+| `OPENDHT_PUSH_NOTIFICATIONS` | OFF | Push notification support |
+| `OPENDHT_SANITIZE` | OFF | AddressSanitizer + stack protector |
+
+## Node.js Bindings
+
+Node-API bindings wrap the C++ API directly with `node-addon-api`, including
+RSA/EC keys, certificates, identities, and signed/encrypted DHT operations.
+With the native dependencies above, Node.js 22.9+, and CMake installed, run
+`npm ci`, `npm run build`, `npm test`, and `npm run typecheck` from `nodejs/`.
+This creates a separate native build without changing the existing build tree.
+See [the Node.js binding guide](nodejs/README.md) for the API and current limits.
+`npm run package` creates a platform prebuild with bundled native dependencies;
+`npm run test:package` verifies installation outside the source tree. The Node.js
+package CI builds Linux x64, macOS ARM64/x64, and Windows x64 prebuilds and checks
+the assembled npm archive on Node 22, 24, and 26 before release attachment.
+
+## C and Rust Bindings
+
+Enable `OPENDHT_C=ON` to build the C ABI. With `BUILD_TESTING=ON`, CTest runs
+`test_c`; Meson registers the same test as `CBindings` when `c` and `tests` are
+enabled. Rust regression and callback-lifetime tests run with Cargo; see
+[the Rust build guide](rust/BUILD.md) for build and library-path settings.
+
+`dht_infohash` and `dht_pkid` have `uint32_t` alignment, matching the native hash
+types, while retaining their 20-byte and 32-byte sizes. Rebuild consumers against
+the updated header; foreign-language declarations must match this alignment.
+
+C handles returned by constructors, imports, and reference functions are owned
+and require their matching delete/unref function. Data views, string getters,
+query fields, and callback arguments are borrowed: copy them or take a reference
+before returning from the callback. `dht_sockaddr_array_delete` releases both the
+public-address array and its elements.
+
+Operation completion callbacks run once, including failure when pending work is
+discarded on runner teardown. Listener release callbacks run after the native
+registration is destroyed; deleting an operation token alone does not cancel its
+listener. Cancel first, then delete the consumed token. Startup-context release
+callbacks run after all native status/store callback captures are released, also
+on startup failure. Certificate-store callbacks must invoke the supplied emitter
+synchronously with borrowed certificates. Query-result views are callback-scoped.
+
+`dht_runner_loop` drives non-threaded nodes. `dht_runner_join` waits for callbacks
+and allows restart; never call it from a DHT callback. For persisted shutdown,
+wait for the shutdown callback before joining. Push tokens can be polled without
+blocking and must be deleted separately. `dht_push_token_poll` returns `EAGAIN`
+while pending, 0 with the native outcome when ready, and an error code otherwise;
+consume a successful result only once. Native push outcomes are 0 through 3 for
+refresh/value events, 128 through 131 for ignored events, and 132 for errors.
+
 ## Windows/MSVC

 Building on Windows with MSVC is supported with VCPKG and CMake.

 ### Build with VCPKG in manifest mode

-1. Install [VCPKG](https://github.com/microsoft/vcpkg) and required dependencies:
+1. Install [VCPKG](https://github.com/microsoft/vcpkg) 2026.10.16 and required dependencies:
 ```ps1
 git clone https://github.com/microsoft/vcpkg.git
-cd vcpkg; .\bootstrap-vcpkg.bat
+cd vcpkg
+git checkout 9eec002df1cd109f8f104cd966a763daf9751489
+.\bootstrap-vcpkg.bat
 ```

 2. Use CMake preset for vcpkg:
@@ -122,3 +181,19 @@ cd opendht
 cmake --preset=vcpkg_manifest .
 cmake --build .
 ```
+
+### CI
+
+Windows CI uses [lukka/run-vcpkg](https://github.com/lukka/run-vcpkg) to acquire
+and bootstrap the revision pinned by `default-registry.baseline` in
+`vcpkg-configuration.json`. CMake uses the action's `VCPKG_ROOT` and installs
+manifest dependencies on every run. Dependency-preparation jobs warm the binary
+cache before the Windows build matrix starts.
+
+Only ABI-keyed binary package archives are cached, not installed trees. The
+supported [files provider](https://learn.microsoft.com/en-us/vcpkg/reference/binarycaching#files-provider)
+is persisted with `actions/cache`; it does not use the removed `x-gha` provider
+or require package-feed credentials. Cache keys include the target triplet,
+manifests, overlay ports, run ID, and attempt, with restore prefixes for reuse.
+Each run can save newly built archives without overwriting an immutable cache;
+vcpkg validates package ABIs before reuse.
@@ -1,4 +1,4 @@
-cmake_minimum_required (VERSION 3.21..3.31)
+cmake_minimum_required (VERSION 3.21...4.4)
 if(POLICY CMP0091)
    cmake_policy(SET CMP0091 NEW)
 endif()
@@ -9,11 +9,11 @@ if(POLICY CMP0167)
    cmake_policy(SET CMP0167 NEW)
 endif()

-set (opendht_VERSION_MAJOR 3)
-set (opendht_VERSION_MINOR 6.2)
+set (opendht_VERSION_MAJOR 4)
+set (opendht_VERSION_MINOR 5.0)
 set (opendht_VERSION ${opendht_VERSION_MAJOR}.${opendht_VERSION_MINOR})
-set (PACKAGE_VERSION ${opendht_VERSION})
-set (VERSION "${opendht_VERSION}")
+set (PACKAGE_VERSION "${opendht_VERSION}-rc.1")
+set (VERSION "${PACKAGE_VERSION}")
 project (opendht
    VERSION ${opendht_VERSION}
    DESCRIPTION "OpenDHT: A lightweight C++17 Distributed Hash Table library."
@@ -115,14 +115,10 @@ if (NOT MSVC)
    find_package (Threads)
    if (OPENDHT_USE_PKGCONFIG)
        find_package (PkgConfig REQUIRED)
-        # GNUTLS
        pkg_search_module (GnuTLS REQUIRED IMPORTED_TARGET gnutls)
-        # libnettle
        pkg_search_module (Nettle REQUIRED IMPORTED_TARGET nettle)
-        # libargon2
        pkg_search_module (argon2 REQUIRED IMPORTED_TARGET libargon2)
        set(argon2_lib ", libargon2")
-        # jsoncpp
        pkg_search_module (Jsoncpp IMPORTED_TARGET jsoncpp)
        if(Jsoncpp_FOUND)
            set(JSONCPP_LIBRARIES PkgConfig::Jsoncpp)
@@ -134,15 +130,16 @@ if (NOT MSVC)
                message(STATUS "simdutf not found with pkgconfig")
                if (OPENDHT_DOWNLOAD_DEPS)
                    message(STATUS "Fallback mode specified, downloading simdutf")
+                    set(SIMDUTF_CXX_STANDARD ${CMAKE_CXX_STANDARD} CACHE INTERNAL "C++ standard for simdutf downloader")
                    set(SIMDUTF_TESTS OFF CACHE INTERNAL "Disable tests for simdutf downloader")
                    set(SIMDUTF_TOOLS OFF CACHE INTERNAL "Disable tools for simdutf downloader")
-                    set(SIMDUTF_CXX_STANDARD 17 CACHE INTERNAL "Set C++ standard for simdutf downloader")
                    FetchContent_Declare(simdutf
                        GIT_REPOSITORY "https://github.com/simdutf/simdutf.git"
-                        GIT_TAG "v7.5.0"
+                        GIT_TAG "v8.0.0"
                    )
                    FetchContent_MakeAvailable(simdutf)
                    set(SIMDUTF_LIBRARIES simdutf::simdutf)
+                    set(simdutf_lib ", simdutf")
                else()
                    message(SEND_ERROR "simdutf not found and the fallback downloader is not set! Install simdutf or use OPENDHT_DOWNLOAD_DEPS option")
                endif()
@@ -207,15 +204,11 @@ if (NOT MSVC)
    else ()
        find_package(GnuTLS REQUIRED)
        include_directories(${GNUTLS_INCLUDE_DIR})
-        # jsoncpp
        find_package(jsoncpp CONFIG REQUIRED)
        set(JSONCPP_FOUND TRUE)
-        # libfmt
        find_package(fmt CONFIG REQUIRED)
-        # libargon2
        find_path(ARGON2_INCLUDE_DIR argon2.h REQUIRED)
        set(argon2_lib ", libargon2")
-        # libreadline
        if (OPENDHT_TOOLS)
            find_package (Readline 6 REQUIRED)
        endif ()
@@ -424,11 +417,11 @@ else ()
                    -DSTATIC_GETOPT)
    set(DISABLE_MSC_WARNINGS "/wd4101 /wd4244 /wd4267 /wd4273 /wd4804 /wd4834 /wd4996")
    set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} ${DISABLE_MSC_WARNINGS}")
-    set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} /MP /bigobj /utf-8 /EHsc")
+    set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} /MP /bigobj /utf-8 /EHsc /Zc:__cplusplus")
 endif ()
 set (CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -DMSGPACK_NO_BOOST -DMSGPACK_DISABLE_LEGACY_NIL -DMSGPACK_DISABLE_LEGACY_CONVERT")

-add_definitions(-DPACKAGE_VERSION="${opendht_VERSION}")
+add_definitions(-DPACKAGE_VERSION="${PACKAGE_VERSION}")

 if (ASIO_INCLUDE_DIR)
    include_directories (SYSTEM "${ASIO_INCLUDE_DIR}")
@@ -852,6 +845,15 @@ endif()

 # Unit tests
 if (BUILD_TESTING)
+    if (OPENDHT_C)
+        add_executable(test_c tests/test_c.c)
+        target_include_directories(test_c PRIVATE c include)
+        target_link_libraries(test_c PRIVATE opendht-c)
+        if (MSVC)
+            target_link_libraries(test_c PRIVATE ${GNUTLS_LIBRARIES})
+        endif()
+        add_test(NAME test_c COMMAND test_c)
+    endif()
    if (NOT MSVC)
        pkg_search_module(Cppunit REQUIRED IMPORTED_TARGET cppunit)
        set(cppunit_LIBRARIES PkgConfig::Cppunit)
@@ -861,30 +863,52 @@ if (BUILD_TESTING)
    endif()
    # unit testing
    list (APPEND test_FILES
-        tests/infohashtester.h
-        tests/infohashtester.cpp
-        tests/valuetester.h
-        tests/valuetester.cpp
-        tests/cryptotester.h
-        tests/cryptotester.cpp
-        tests/dhtrunnertester.h
-        tests/dhtrunnertester.cpp
-        tests/threadpooltester.h
-        tests/threadpooltester.cpp
+        tests/test_infohash.h
+        tests/test_infohash.cpp
+        tests/test_value.h
+        tests/test_value.cpp
+        tests/test_crypto.h
+        tests/test_crypto.cpp
+        tests/test_dhtrunner.h
+        tests/test_dhtrunner.cpp
+        tests/test_storage.h
+        tests/test_storage.cpp
+        tests/test_threadpool.h
+        tests/test_threadpool.cpp
+        tests/test_parsedmessage.h
+        tests/test_parsedmessage.cpp
+        tests/test_networkengine.h
+        tests/test_networkengine.cpp
+        tests/test_opcache.h
+        tests/test_opcache.cpp
+        tests/test_valuecache.h
+        tests/test_valuecache.cpp
    )
+    if (OPENDHT_INDEX)
+        list (APPEND test_FILES
+            tests/test_pht.h
+            tests/test_pht.cpp
+        )
+    endif()
+    if (OPENDHT_PROXY_CLIENT)
+        list (APPEND test_FILES
+            tests/test_dhtproxy_client.h
+            tests/test_dhtproxy_client.cpp
+        )
+    endif()
    if (OPENDHT_TESTS_NETWORK)
        if (OPENDHT_PROXY_SERVER AND OPENDHT_PROXY_CLIENT)
            list (APPEND test_FILES
-                tests/httptester.h
-                tests/httptester.cpp
-                tests/dhtproxytester.h
-                tests/dhtproxytester.cpp
+                tests/test_http.h
+                tests/test_http.cpp
+                tests/test_dhtproxy.h
+                tests/test_dhtproxy.cpp
            )
        endif()
        if (OPENDHT_PEER_DISCOVERY)
            list (APPEND test_FILES
-                tests/peerdiscoverytester.h
-                tests/peerdiscoverytester.cpp
+                tests/test_peerdiscovery.h
+                tests/test_peerdiscovery.cpp
            )
        endif()
    endif()
@@ -892,7 +916,7 @@ if (BUILD_TESTING)
    # We keep using the common tests_runner.cpp (CppUnit registry based) and compile it with each test file.
    foreach(test_src ${test_FILES})
        if (test_src MATCHES ".*\\.cpp$")
-            get_filename_component(test_name ${test_src} NAME_WE) # e.g. infohashtester
+            get_filename_component(test_name ${test_src} NAME_WE) # e.g. test_infohash
            set(target_name ${test_name})
            add_executable(${target_name}
                tests/tests_runner.cpp
@@ -921,8 +945,8 @@ if (OPENDHT_CPACK)
    set(CPACK_PACKAGE_VENDOR "Savoir-faire Linux, Inc.")
    set(CPACK_PACKAGE_DESCRIPTION_SUMMARY "OpenDHT: A lightweight C++17 Distributed Hash Table library.")
    set(CPACK_PACKAGE_HOMEPAGE_URL "https://opendht.net/")
-    set(CPACK_PACKAGE_CONTACT "support@savoirfairelinux.com") # Or a relevant contact/mailing list
-    set(CPACK_RESOURCE_FILE_LICENSE "${CMAKE_CURRENT_SOURCE_DIR}/COPYING.txt")
+    set(CPACK_PACKAGE_CONTACT "support@savoirfairelinux.com")
+    set(CPACK_RESOURCE_FILE_LICENSE "${CMAKE_CURRENT_SOURCE_DIR}/resources/LICENSE.txt")
    set(CPACK_PACKAGE_INSTALL_DIRECTORY "OpenDHT")

    if(WIN32)
@@ -1,674 +0,0 @@
-                    GNU GENERAL PUBLIC LICENSE
-                       Version 3, 29 June 2007
-
- Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
- Everyone is permitted to copy and distribute verbatim copies
- of this license document, but changing it is not allowed.
-
-                            Preamble
-
-  The GNU General Public License is a free, copyleft license for
-software and other kinds of works.
-
-  The licenses for most software and other practical works are designed
-to take away your freedom to share and change the works.  By contrast,
-the GNU General Public License is intended to guarantee your freedom to
-share and change all versions of a program--to make sure it remains free
-software for all its users.  We, the Free Software Foundation, use the
-GNU General Public License for most of our software; it applies also to
-any other work released this way by its authors.  You can apply it to
-your programs, too.
-
-  When we speak of free software, we are referring to freedom, not
-price.  Our General Public Licenses are designed to make sure that you
-have the freedom to distribute copies of free software (and charge for
-them if you wish), that you receive source code or can get it if you
-want it, that you can change the software or use pieces of it in new
-free programs, and that you know you can do these things.
-
-  To protect your rights, we need to prevent others from denying you
-these rights or asking you to surrender the rights.  Therefore, you have
-certain responsibilities if you distribute copies of the software, or if
-you modify it: responsibilities to respect the freedom of others.
-
-  For example, if you distribute copies of such a program, whether
-gratis or for a fee, you must pass on to the recipients the same
-freedoms that you received.  You must make sure that they, too, receive
-or can get the source code.  And you must show them these terms so they
-know their rights.
-
-  Developers that use the GNU GPL protect your rights with two steps:
-(1) assert copyright on the software, and (2) offer you this License
-giving you legal permission to copy, distribute and/or modify it.
-
-  For the developers' and authors' protection, the GPL clearly explains
-that there is no warranty for this free software.  For both users' and
-authors' sake, the GPL requires that modified versions be marked as
-changed, so that their problems will not be attributed erroneously to
-authors of previous versions.
-
-  Some devices are designed to deny users access to install or run
-modified versions of the software inside them, although the manufacturer
-can do so.  This is fundamentally incompatible with the aim of
-protecting users' freedom to change the software.  The systematic
-pattern of such abuse occurs in the area of products for individuals to
-use, which is precisely where it is most unacceptable.  Therefore, we
-have designed this version of the GPL to prohibit the practice for those
-products.  If such problems arise substantially in other domains, we
-stand ready to extend this provision to those domains in future versions
-of the GPL, as needed to protect the freedom of users.
-
-  Finally, every program is threatened constantly by software patents.
-States should not allow patents to restrict development and use of
-software on general-purpose computers, but in those that do, we wish to
-avoid the special danger that patents applied to a free program could
-make it effectively proprietary.  To prevent this, the GPL assures that
-patents cannot be used to render the program non-free.
-
-  The precise terms and conditions for copying, distribution and
-modification follow.
-
-                       TERMS AND CONDITIONS
-
-  0. Definitions.
-
-  "This License" refers to version 3 of the GNU General Public License.
-
-  "Copyright" also means copyright-like laws that apply to other kinds of
-works, such as semiconductor masks.
-
-  "The Program" refers to any copyrightable work licensed under this
-License.  Each licensee is addressed as "you".  "Licensees" and
-"recipients" may be individuals or organizations.
-
-  To "modify" a work means to copy from or adapt all or part of the work
-in a fashion requiring copyright permission, other than the making of an
-exact copy.  The resulting work is called a "modified version" of the
-earlier work or a work "based on" the earlier work.
-
-  A "covered work" means either the unmodified Program or a work based
-on the Program.
-
-  To "propagate" a work means to do anything with it that, without
-permission, would make you directly or secondarily liable for
-infringement under applicable copyright law, except executing it on a
-computer or modifying a private copy.  Propagation includes copying,
-distribution (with or without modification), making available to the
-public, and in some countries other activities as well.
-
-  To "convey" a work means any kind of propagation that enables other
-parties to make or receive copies.  Mere interaction with a user through
-a computer network, with no transfer of a copy, is not conveying.
-
-  An interactive user interface displays "Appropriate Legal Notices"
-to the extent that it includes a convenient and prominently visible
-feature that (1) displays an appropriate copyright notice, and (2)
-tells the user that there is no warranty for the work (except to the
-extent that warranties are provided), that licensees may convey the
-work under this License, and how to view a copy of this License.  If
-the interface presents a list of user commands or options, such as a
-menu, a prominent item in the list meets this criterion.
-
-  1. Source Code.
-
-  The "source code" for a work means the preferred form of the work
-for making modifications to it.  "Object code" means any non-source
-form of a work.
-
-  A "Standard Interface" means an interface that either is an official
-standard defined by a recognized standards body, or, in the case of
-interfaces specified for a particular programming language, one that
-is widely used among developers working in that language.
-
-  The "System Libraries" of an executable work include anything, other
-than the work as a whole, that (a) is included in the normal form of
-packaging a Major Component, but which is not part of that Major
-Component, and (b) serves only to enable use of the work with that
-Major Component, or to implement a Standard Interface for which an
-implementation is available to the public in source code form.  A
-"Major Component", in this context, means a major essential component
-(kernel, window system, and so on) of the specific operating system
-(if any) on which the executable work runs, or a compiler used to
-produce the work, or an object code interpreter used to run it.
-
-  The "Corresponding Source" for a work in object code form means all
-the source code needed to generate, install, and (for an executable
-work) run the object code and to modify the work, including scripts to
-control those activities.  However, it does not include the work's
-System Libraries, or general-purpose tools or generally available free
-programs which are used unmodified in performing those activities but
-which are not part of the work.  For example, Corresponding Source
-includes interface definition files associated with source files for
-the work, and the source code for shared libraries and dynamically
-linked subprograms that the work is specifically designed to require,
-such as by intimate data communication or control flow between those
-subprograms and other parts of the work.
-
-  The Corresponding Source need not include anything that users
-can regenerate automatically from other parts of the Corresponding
-Source.
-
-  The Corresponding Source for a work in source code form is that
-same work.
-
-  2. Basic Permissions.
-
-  All rights granted under this License are granted for the term of
-copyright on the Program, and are irrevocable provided the stated
-conditions are met.  This License explicitly affirms your unlimited
-permission to run the unmodified Program.  The output from running a
-covered work is covered by this License only if the output, given its
-content, constitutes a covered work.  This License acknowledges your
-rights of fair use or other equivalent, as provided by copyright law.
-
-  You may make, run and propagate covered works that you do not
-convey, without conditions so long as your license otherwise remains
-in force.  You may convey covered works to others for the sole purpose
-of having them make modifications exclusively for you, or provide you
-with facilities for running those works, provided that you comply with
-the terms of this License in conveying all material for which you do
-not control copyright.  Those thus making or running the covered works
-for you must do so exclusively on your behalf, under your direction
-and control, on terms that prohibit them from making any copies of
-your copyrighted material outside their relationship with you.
-
-  Conveying under any other circumstances is permitted solely under
-the conditions stated below.  Sublicensing is not allowed; section 10
-makes it unnecessary.
-
-  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
-
-  No covered work shall be deemed part of an effective technological
-measure under any applicable law fulfilling obligations under article
-11 of the WIPO copyright treaty adopted on 20 December 1996, or
-similar laws prohibiting or restricting circumvention of such
-measures.
-
-  When you convey a covered work, you waive any legal power to forbid
-circumvention of technological measures to the extent such circumvention
-is effected by exercising rights under this License with respect to
-the covered work, and you disclaim any intention to limit operation or
-modification of the work as a means of enforcing, against the work's
-users, your or third parties' legal rights to forbid circumvention of
-technological measures.
-
-  4. Conveying Verbatim Copies.
-
-  You may convey verbatim copies of the Program's source code as you
-receive it, in any medium, provided that you conspicuously and
-appropriately publish on each copy an appropriate copyright notice;
-keep intact all notices stating that this License and any
-non-permissive terms added in accord with section 7 apply to the code;
-keep intact all notices of the absence of any warranty; and give all
-recipients a copy of this License along with the Program.
-
-  You may charge any price or no price for each copy that you convey,
-and you may offer support or warranty protection for a fee.
-
-  5. Conveying Modified Source Versions.
-
-  You may convey a work based on the Program, or the modifications to
-produce it from the Program, in the form of source code under the
-terms of section 4, provided that you also meet all of these conditions:
-
-    a) The work must carry prominent notices stating that you modified
-    it, and giving a relevant date.
-
-    b) The work must carry prominent notices stating that it is
-    released under this License and any conditions added under section
-    7.  This requirement modifies the requirement in section 4 to
-    "keep intact all notices".
-
-    c) You must license the entire work, as a whole, under this
-    License to anyone who comes into possession of a copy.  This
-    License will therefore apply, along with any applicable section 7
-    additional terms, to the whole of the work, and all its parts,
-    regardless of how they are packaged.  This License gives no
-    permission to license the work in any other way, but it does not
-    invalidate such permission if you have separately received it.
-
-    d) If the work has interactive user interfaces, each must display
-    Appropriate Legal Notices; however, if the Program has interactive
-    interfaces that do not display Appropriate Legal Notices, your
-    work need not make them do so.
-
-  A compilation of a covered work with other separate and independent
-works, which are not by their nature extensions of the covered work,
-and which are not combined with it such as to form a larger program,
-in or on a volume of a storage or distribution medium, is called an
-"aggregate" if the compilation and its resulting copyright are not
-used to limit the access or legal rights of the compilation's users
-beyond what the individual works permit.  Inclusion of a covered work
-in an aggregate does not cause this License to apply to the other
-parts of the aggregate.
-
-  6. Conveying Non-Source Forms.
-
-  You may convey a covered work in object code form under the terms
-of sections 4 and 5, provided that you also convey the
-machine-readable Corresponding Source under the terms of this License,
-in one of these ways:
-
-    a) Convey the object code in, or embodied in, a physical product
-    (including a physical distribution medium), accompanied by the
-    Corresponding Source fixed on a durable physical medium
-    customarily used for software interchange.
-
-    b) Convey the object code in, or embodied in, a physical product
-    (including a physical distribution medium), accompanied by a
-    written offer, valid for at least three years and valid for as
-    long as you offer spare parts or customer support for that product
-    model, to give anyone who possesses the object code either (1) a
-    copy of the Corresponding Source for all the software in the
-    product that is covered by this License, on a durable physical
-    medium customarily used for software interchange, for a price no
-    more than your reasonable cost of physically performing this
-    conveying of source, or (2) access to copy the
-    Corresponding Source from a network server at no charge.
-
-    c) Convey individual copies of the object code with a copy of the
-    written offer to provide the Corresponding Source.  This
-    alternative is allowed only occasionally and noncommercially, and
-    only if you received the object code with such an offer, in accord
-    with subsection 6b.
-
-    d) Convey the object code by offering access from a designated
-    place (gratis or for a charge), and offer equivalent access to the
-    Corresponding Source in the same way through the same place at no
-    further charge.  You need not require recipients to copy the
-    Corresponding Source along with the object code.  If the place to
-    copy the object code is a network server, the Corresponding Source
-    may be on a different server (operated by you or a third party)
-    that supports equivalent copying facilities, provided you maintain
-    clear directions next to the object code saying where to find the
-    Corresponding Source.  Regardless of what server hosts the
-    Corresponding Source, you remain obligated to ensure that it is
-    available for as long as needed to satisfy these requirements.
-
-    e) Convey the object code using peer-to-peer transmission, provided
-    you inform other peers where the object code and Corresponding
-    Source of the work are being offered to the general public at no
-    charge under subsection 6d.
-
-  A separable portion of the object code, whose source code is excluded
-from the Corresponding Source as a System Library, need not be
-included in conveying the object code work.
-
-  A "User Product" is either (1) a "consumer product", which means any
-tangible personal property which is normally used for personal, family,
-or household purposes, or (2) anything designed or sold for incorporation
-into a dwelling.  In determining whether a product is a consumer product,
-doubtful cases shall be resolved in favor of coverage.  For a particular
-product received by a particular user, "normally used" refers to a
-typical or common use of that class of product, regardless of the status
-of the particular user or of the way in which the particular user
-actually uses, or expects or is expected to use, the product.  A product
-is a consumer product regardless of whether the product has substantial
-commercial, industrial or non-consumer uses, unless such uses represent
-the only significant mode of use of the product.
-
-  "Installation Information" for a User Product means any methods,
-procedures, authorization keys, or other information required to install
-and execute modified versions of a covered work in that User Product from
-a modified version of its Corresponding Source.  The information must
-suffice to ensure that the continued functioning of the modified object
-code is in no case prevented or interfered with solely because
-modification has been made.
-
-  If you convey an object code work under this section in, or with, or
-specifically for use in, a User Product, and the conveying occurs as
-part of a transaction in which the right of possession and use of the
-User Product is transferred to the recipient in perpetuity or for a
-fixed term (regardless of how the transaction is characterized), the
-Corresponding Source conveyed under this section must be accompanied
-by the Installation Information.  But this requirement does not apply
-if neither you nor any third party retains the ability to install
-modified object code on the User Product (for example, the work has
-been installed in ROM).
-
-  The requirement to provide Installation Information does not include a
-requirement to continue to provide support service, warranty, or updates
-for a work that has been modified or installed by the recipient, or for
-the User Product in which it has been modified or installed.  Access to a
-network may be denied when the modification itself materially and
-adversely affects the operation of the network or violates the rules and
-protocols for communication across the network.
-
-  Corresponding Source conveyed, and Installation Information provided,
-in accord with this section must be in a format that is publicly
-documented (and with an implementation available to the public in
-source code form), and must require no special password or key for
-unpacking, reading or copying.
-
-  7. Additional Terms.
-
-  "Additional permissions" are terms that supplement the terms of this
-License by making exceptions from one or more of its conditions.
-Additional permissions that are applicable to the entire Program shall
-be treated as though they were included in this License, to the extent
-that they are valid under applicable law.  If additional permissions
-apply only to part of the Program, that part may be used separately
-under those permissions, but the entire Program remains governed by
-this License without regard to the additional permissions.
-
-  When you convey a copy of a covered work, you may at your option
-remove any additional permissions from that copy, or from any part of
-it.  (Additional permissions may be written to require their own
-removal in certain cases when you modify the work.)  You may place
-additional permissions on material, added by you to a covered work,
-for which you have or can give appropriate copyright permission.
-
-  Notwithstanding any other provision of this License, for material you
-add to a covered work, you may (if authorized by the copyright holders of
-that material) supplement the terms of this License with terms:
-
-    a) Disclaiming warranty or limiting liability differently from the
-    terms of sections 15 and 16 of this License; or
-
-    b) Requiring preservation of specified reasonable legal notices or
-    author attributions in that material or in the Appropriate Legal
-    Notices displayed by works containing it; or
-
-    c) Prohibiting misrepresentation of the origin of that material, or
-    requiring that modified versions of such material be marked in
-    reasonable ways as different from the original version; or
-
-    d) Limiting the use for publicity purposes of names of licensors or
-    authors of the material; or
-
-    e) Declining to grant rights under trademark law for use of some
-    trade names, trademarks, or service marks; or
-
-    f) Requiring indemnification of licensors and authors of that
-    material by anyone who conveys the material (or modified versions of
-    it) with contractual assumptions of liability to the recipient, for
-    any liability that these contractual assumptions directly impose on
-    those licensors and authors.
-
-  All other non-permissive additional terms are considered "further
-restrictions" within the meaning of section 10.  If the Program as you
-received it, or any part of it, contains a notice stating that it is
-governed by this License along with a term that is a further
-restriction, you may remove that term.  If a license document contains
-a further restriction but permits relicensing or conveying under this
-License, you may add to a covered work material governed by the terms
-of that license document, provided that the further restriction does
-not survive such relicensing or conveying.
-
-  If you add terms to a covered work in accord with this section, you
-must place, in the relevant source files, a statement of the
-additional terms that apply to those files, or a notice indicating
-where to find the applicable terms.
-
-  Additional terms, permissive or non-permissive, may be stated in the
-form of a separately written license, or stated as exceptions;
-the above requirements apply either way.
-
-  8. Termination.
-
-  You may not propagate or modify a covered work except as expressly
-provided under this License.  Any attempt otherwise to propagate or
-modify it is void, and will automatically terminate your rights under
-this License (including any patent licenses granted under the third
-paragraph of section 11).
-
-  However, if you cease all violation of this License, then your
-license from a particular copyright holder is reinstated (a)
-provisionally, unless and until the copyright holder explicitly and
-finally terminates your license, and (b) permanently, if the copyright
-holder fails to notify you of the violation by some reasonable means
-prior to 60 days after the cessation.
-
-  Moreover, your license from a particular copyright holder is
-reinstated permanently if the copyright holder notifies you of the
-violation by some reasonable means, this is the first time you have
-received notice of violation of this License (for any work) from that
-copyright holder, and you cure the violation prior to 30 days after
-your receipt of the notice.
-
-  Termination of your rights under this section does not terminate the
-licenses of parties who have received copies or rights from you under
-this License.  If your rights have been terminated and not permanently
-reinstated, you do not qualify to receive new licenses for the same
-material under section 10.
-
-  9. Acceptance Not Required for Having Copies.
-
-  You are not required to accept this License in order to receive or
-run a copy of the Program.  Ancillary propagation of a covered work
-occurring solely as a consequence of using peer-to-peer transmission
-to receive a copy likewise does not require acceptance.  However,
-nothing other than this License grants you permission to propagate or
-modify any covered work.  These actions infringe copyright if you do
-not accept this License.  Therefore, by modifying or propagating a
-covered work, you indicate your acceptance of this License to do so.
-
-  10. Automatic Licensing of Downstream Recipients.
-
-  Each time you convey a covered work, the recipient automatically
-receives a license from the original licensors, to run, modify and
-propagate that work, subject to this License.  You are not responsible
-for enforcing compliance by third parties with this License.
-
-  An "entity transaction" is a transaction transferring control of an
-organization, or substantially all assets of one, or subdividing an
-organization, or merging organizations.  If propagation of a covered
-work results from an entity transaction, each party to that
-transaction who receives a copy of the work also receives whatever
-licenses to the work the party's predecessor in interest had or could
-give under the previous paragraph, plus a right to possession of the
-Corresponding Source of the work from the predecessor in interest, if
-the predecessor has it or can get it with reasonable efforts.
-
-  You may not impose any further restrictions on the exercise of the
-rights granted or affirmed under this License.  For example, you may
-not impose a license fee, royalty, or other charge for exercise of
-rights granted under this License, and you may not initiate litigation
-(including a cross-claim or counterclaim in a lawsuit) alleging that
-any patent claim is infringed by making, using, selling, offering for
-sale, or importing the Program or any portion of it.
-
-  11. Patents.
-
-  A "contributor" is a copyright holder who authorizes use under this
-License of the Program or a work on which the Program is based.  The
-work thus licensed is called the contributor's "contributor version".
-
-  A contributor's "essential patent claims" are all patent claims
-owned or controlled by the contributor, whether already acquired or
-hereafter acquired, that would be infringed by some manner, permitted
-by this License, of making, using, or selling its contributor version,
-but do not include claims that would be infringed only as a
-consequence of further modification of the contributor version.  For
-purposes of this definition, "control" includes the right to grant
-patent sublicenses in a manner consistent with the requirements of
-this License.
-
-  Each contributor grants you a non-exclusive, worldwide, royalty-free
-patent license under the contributor's essential patent claims, to
-make, use, sell, offer for sale, import and otherwise run, modify and
-propagate the contents of its contributor version.
-
-  In the following three paragraphs, a "patent license" is any express
-agreement or commitment, however denominated, not to enforce a patent
-(such as an express permission to practice a patent or covenant not to
-sue for patent infringement).  To "grant" such a patent license to a
-party means to make such an agreement or commitment not to enforce a
-patent against the party.
-
-  If you convey a covered work, knowingly relying on a patent license,
-and the Corresponding Source of the work is not available for anyone
-to copy, free of charge and under the terms of this License, through a
-publicly available network server or other readily accessible means,
-then you must either (1) cause the Corresponding Source to be so
-available, or (2) arrange to deprive yourself of the benefit of the
-patent license for this particular work, or (3) arrange, in a manner
-consistent with the requirements of this License, to extend the patent
-license to downstream recipients.  "Knowingly relying" means you have
-actual knowledge that, but for the patent license, your conveying the
-covered work in a country, or your recipient's use of the covered work
-in a country, would infringe one or more identifiable patents in that
-country that you have reason to believe are valid.
-
-  If, pursuant to or in connection with a single transaction or
-arrangement, you convey, or propagate by procuring conveyance of, a
-covered work, and grant a patent license to some of the parties
-receiving the covered work authorizing them to use, propagate, modify
-or convey a specific copy of the covered work, then the patent license
-you grant is automatically extended to all recipients of the covered
-work and works based on it.
-
-  A patent license is "discriminatory" if it does not include within
-the scope of its coverage, prohibits the exercise of, or is
-conditioned on the non-exercise of one or more of the rights that are
-specifically granted under this License.  You may not convey a covered
-work if you are a party to an arrangement with a third party that is
-in the business of distributing software, under which you make payment
-to the third party based on the extent of your activity of conveying
-the work, and under which the third party grants, to any of the
-parties who would receive the covered work from you, a discriminatory
-patent license (a) in connection with copies of the covered work
-conveyed by you (or copies made from those copies), or (b) primarily
-for and in connection with specific products or compilations that
-contain the covered work, unless you entered into that arrangement,
-or that patent license was granted, prior to 28 March 2007.
-
-  Nothing in this License shall be construed as excluding or limiting
-any implied license or other defenses to infringement that may
-otherwise be available to you under applicable patent law.
-
-  12. No Surrender of Others' Freedom.
-
-  If conditions are imposed on you (whether by court order, agreement or
-otherwise) that contradict the conditions of this License, they do not
-excuse you from the conditions of this License.  If you cannot convey a
-covered work so as to satisfy simultaneously your obligations under this
-License and any other pertinent obligations, then as a consequence you may
-not convey it at all.  For example, if you agree to terms that obligate you
-to collect a royalty for further conveying from those to whom you convey
-the Program, the only way you could satisfy both those terms and this
-License would be to refrain entirely from conveying the Program.
-
-  13. Use with the GNU Affero General Public License.
-
-  Notwithstanding any other provision of this License, you have
-permission to link or combine any covered work with a work licensed
-under version 3 of the GNU Affero General Public License into a single
-combined work, and to convey the resulting work.  The terms of this
-License will continue to apply to the part which is the covered work,
-but the special requirements of the GNU Affero General Public License,
-section 13, concerning interaction through a network will apply to the
-combination as such.
-
-  14. Revised Versions of this License.
-
-  The Free Software Foundation may publish revised and/or new versions of
-the GNU General Public License from time to time.  Such new versions will
-be similar in spirit to the present version, but may differ in detail to
-address new problems or concerns.
-
-  Each version is given a distinguishing version number.  If the
-Program specifies that a certain numbered version of the GNU General
-Public License "or any later version" applies to it, you have the
-option of following the terms and conditions either of that numbered
-version or of any later version published by the Free Software
-Foundation.  If the Program does not specify a version number of the
-GNU General Public License, you may choose any version ever published
-by the Free Software Foundation.
-
-  If the Program specifies that a proxy can decide which future
-versions of the GNU General Public License can be used, that proxy's
-public statement of acceptance of a version permanently authorizes you
-to choose that version for the Program.
-
-  Later license versions may give you additional or different
-permissions.  However, no additional obligations are imposed on any
-author or copyright holder as a result of your choosing to follow a
-later version.
-
-  15. Disclaimer of Warranty.
-
-  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
-APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
-HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
-OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
-THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
-PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
-IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
-ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
-
-  16. Limitation of Liability.
-
-  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
-WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
-THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
-GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
-USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
-DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
-PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
-EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
-SUCH DAMAGES.
-
-  17. Interpretation of Sections 15 and 16.
-
-  If the disclaimer of warranty and limitation of liability provided
-above cannot be given local legal effect according to their terms,
-reviewing courts shall apply local law that most closely approximates
-an absolute waiver of all civil liability in connection with the
-Program, unless a warranty or assumption of liability accompanies a
-copy of the Program in return for a fee.
-
-                     END OF TERMS AND CONDITIONS
-
-            How to Apply These Terms to Your New Programs
-
-  If you develop a new program, and you want it to be of the greatest
-possible use to the public, the best way to achieve this is to make it
-free software which everyone can redistribute and change under these terms.
-
-  To do so, attach the following notices to the program.  It is safest
-to attach them to the start of each source file to most effectively
-state the exclusion of warranty; and each file should have at least
-the "copyright" line and a pointer to where the full notice is found.
-
-    <one line to give the program's name and a brief idea of what it does.>
-    Copyright (C) <year>  <name of author>
-
-    This program is free software: you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-    the Free Software Foundation, either version 3 of the License, or
-    (at your option) any later version.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-Also add information on how to contact you by electronic and paper mail.
-
-  If the program does terminal interaction, make it output a short
-notice like this when it starts in an interactive mode:
-
-    <program>  Copyright (C) <year>  <name of author>
-    This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
-    This is free software, and you are welcome to redistribute it
-    under certain conditions; type `show c' for details.
-
-The hypothetical commands `show w' and `show c' should show the appropriate
-parts of the General Public License.  Of course, your program's commands
-might be different; for a GUI interface, you would use an "about box".
-
-  You should also get your employer (if you work as a programmer) or school,
-if any, to sign a "copyright disclaimer" for the program, if necessary.
-For more information on this, and how to apply and follow the GNU GPL, see
-<http://www.gnu.org/licenses/>.
-
-  The GNU General Public License does not permit incorporating your program
-into proprietary programs.  If your program is a subroutine library, you
-may consider it more useful to permit linking proprietary applications with
-the library.  If this is what you want to do, use the GNU Lesser General
-Public License instead of this License.  But first, please read
-<http://www.gnu.org/philosophy/why-not-lgpl.html>.
@@ -1,674 +0,0 @@
-                    GNU GENERAL PUBLIC LICENSE
-                       Version 3, 29 June 2007
-
- Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
- Everyone is permitted to copy and distribute verbatim copies
- of this license document, but changing it is not allowed.
-
-                            Preamble
-
-  The GNU General Public License is a free, copyleft license for
-software and other kinds of works.
-
-  The licenses for most software and other practical works are designed
-to take away your freedom to share and change the works.  By contrast,
-the GNU General Public License is intended to guarantee your freedom to
-share and change all versions of a program--to make sure it remains free
-software for all its users.  We, the Free Software Foundation, use the
-GNU General Public License for most of our software; it applies also to
-any other work released this way by its authors.  You can apply it to
-your programs, too.
-
-  When we speak of free software, we are referring to freedom, not
-price.  Our General Public Licenses are designed to make sure that you
-have the freedom to distribute copies of free software (and charge for
-them if you wish), that you receive source code or can get it if you
-want it, that you can change the software or use pieces of it in new
-free programs, and that you know you can do these things.
-
-  To protect your rights, we need to prevent others from denying you
-these rights or asking you to surrender the rights.  Therefore, you have
-certain responsibilities if you distribute copies of the software, or if
-you modify it: responsibilities to respect the freedom of others.
-
-  For example, if you distribute copies of such a program, whether
-gratis or for a fee, you must pass on to the recipients the same
-freedoms that you received.  You must make sure that they, too, receive
-or can get the source code.  And you must show them these terms so they
-know their rights.
-
-  Developers that use the GNU GPL protect your rights with two steps:
-(1) assert copyright on the software, and (2) offer you this License
-giving you legal permission to copy, distribute and/or modify it.
-
-  For the developers' and authors' protection, the GPL clearly explains
-that there is no warranty for this free software.  For both users' and
-authors' sake, the GPL requires that modified versions be marked as
-changed, so that their problems will not be attributed erroneously to
-authors of previous versions.
-
-  Some devices are designed to deny users access to install or run
-modified versions of the software inside them, although the manufacturer
-can do so.  This is fundamentally incompatible with the aim of
-protecting users' freedom to change the software.  The systematic
-pattern of such abuse occurs in the area of products for individuals to
-use, which is precisely where it is most unacceptable.  Therefore, we
-have designed this version of the GPL to prohibit the practice for those
-products.  If such problems arise substantially in other domains, we
-stand ready to extend this provision to those domains in future versions
-of the GPL, as needed to protect the freedom of users.
-
-  Finally, every program is threatened constantly by software patents.
-States should not allow patents to restrict development and use of
-software on general-purpose computers, but in those that do, we wish to
-avoid the special danger that patents applied to a free program could
-make it effectively proprietary.  To prevent this, the GPL assures that
-patents cannot be used to render the program non-free.
-
-  The precise terms and conditions for copying, distribution and
-modification follow.
-
-                       TERMS AND CONDITIONS
-
-  0. Definitions.
-
-  "This License" refers to version 3 of the GNU General Public License.
-
-  "Copyright" also means copyright-like laws that apply to other kinds of
-works, such as semiconductor masks.
-
-  "The Program" refers to any copyrightable work licensed under this
-License.  Each licensee is addressed as "you".  "Licensees" and
-"recipients" may be individuals or organizations.
-
-  To "modify" a work means to copy from or adapt all or part of the work
-in a fashion requiring copyright permission, other than the making of an
-exact copy.  The resulting work is called a "modified version" of the
-earlier work or a work "based on" the earlier work.
-
-  A "covered work" means either the unmodified Program or a work based
-on the Program.
-
-  To "propagate" a work means to do anything with it that, without
-permission, would make you directly or secondarily liable for
-infringement under applicable copyright law, except executing it on a
-computer or modifying a private copy.  Propagation includes copying,
-distribution (with or without modification), making available to the
-public, and in some countries other activities as well.
-
-  To "convey" a work means any kind of propagation that enables other
-parties to make or receive copies.  Mere interaction with a user through
-a computer network, with no transfer of a copy, is not conveying.
-
-  An interactive user interface displays "Appropriate Legal Notices"
-to the extent that it includes a convenient and prominently visible
-feature that (1) displays an appropriate copyright notice, and (2)
-tells the user that there is no warranty for the work (except to the
-extent that warranties are provided), that licensees may convey the
-work under this License, and how to view a copy of this License.  If
-the interface presents a list of user commands or options, such as a
-menu, a prominent item in the list meets this criterion.
-
-  1. Source Code.
-
-  The "source code" for a work means the preferred form of the work
-for making modifications to it.  "Object code" means any non-source
-form of a work.
-
-  A "Standard Interface" means an interface that either is an official
-standard defined by a recognized standards body, or, in the case of
-interfaces specified for a particular programming language, one that
-is widely used among developers working in that language.
-
-  The "System Libraries" of an executable work include anything, other
-than the work as a whole, that (a) is included in the normal form of
-packaging a Major Component, but which is not part of that Major
-Component, and (b) serves only to enable use of the work with that
-Major Component, or to implement a Standard Interface for which an
-implementation is available to the public in source code form.  A
-"Major Component", in this context, means a major essential component
-(kernel, window system, and so on) of the specific operating system
-(if any) on which the executable work runs, or a compiler used to
-produce the work, or an object code interpreter used to run it.
-
-  The "Corresponding Source" for a work in object code form means all
-the source code needed to generate, install, and (for an executable
-work) run the object code and to modify the work, including scripts to
-control those activities.  However, it does not include the work's
-System Libraries, or general-purpose tools or generally available free
-programs which are used unmodified in performing those activities but
-which are not part of the work.  For example, Corresponding Source
-includes interface definition files associated with source files for
-the work, and the source code for shared libraries and dynamically
-linked subprograms that the work is specifically designed to require,
-such as by intimate data communication or control flow between those
-subprograms and other parts of the work.
-
-  The Corresponding Source need not include anything that users
-can regenerate automatically from other parts of the Corresponding
-Source.
-
-  The Corresponding Source for a work in source code form is that
-same work.
-
-  2. Basic Permissions.
-
-  All rights granted under this License are granted for the term of
-copyright on the Program, and are irrevocable provided the stated
-conditions are met.  This License explicitly affirms your unlimited
-permission to run the unmodified Program.  The output from running a
-covered work is covered by this License only if the output, given its
-content, constitutes a covered work.  This License acknowledges your
-rights of fair use or other equivalent, as provided by copyright law.
-
-  You may make, run and propagate covered works that you do not
-convey, without conditions so long as your license otherwise remains
-in force.  You may convey covered works to others for the sole purpose
-of having them make modifications exclusively for you, or provide you
-with facilities for running those works, provided that you comply with
-the terms of this License in conveying all material for which you do
-not control copyright.  Those thus making or running the covered works
-for you must do so exclusively on your behalf, under your direction
-and control, on terms that prohibit them from making any copies of
-your copyrighted material outside their relationship with you.
-
-  Conveying under any other circumstances is permitted solely under
-the conditions stated below.  Sublicensing is not allowed; section 10
-makes it unnecessary.
-
-  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
-
-  No covered work shall be deemed part of an effective technological
-measure under any applicable law fulfilling obligations under article
-11 of the WIPO copyright treaty adopted on 20 December 1996, or
-similar laws prohibiting or restricting circumvention of such
-measures.
-
-  When you convey a covered work, you waive any legal power to forbid
-circumvention of technological measures to the extent such circumvention
-is effected by exercising rights under this License with respect to
-the covered work, and you disclaim any intention to limit operation or
-modification of the work as a means of enforcing, against the work's
-users, your or third parties' legal rights to forbid circumvention of
-technological measures.
-
-  4. Conveying Verbatim Copies.
-
-  You may convey verbatim copies of the Program's source code as you
-receive it, in any medium, provided that you conspicuously and
-appropriately publish on each copy an appropriate copyright notice;
-keep intact all notices stating that this License and any
-non-permissive terms added in accord with section 7 apply to the code;
-keep intact all notices of the absence of any warranty; and give all
-recipients a copy of this License along with the Program.
-
-  You may charge any price or no price for each copy that you convey,
-and you may offer support or warranty protection for a fee.
-
-  5. Conveying Modified Source Versions.
-
-  You may convey a work based on the Program, or the modifications to
-produce it from the Program, in the form of source code under the
-terms of section 4, provided that you also meet all of these conditions:
-
-    a) The work must carry prominent notices stating that you modified
-    it, and giving a relevant date.
-
-    b) The work must carry prominent notices stating that it is
-    released under this License and any conditions added under section
-    7.  This requirement modifies the requirement in section 4 to
-    "keep intact all notices".
-
-    c) You must license the entire work, as a whole, under this
-    License to anyone who comes into possession of a copy.  This
-    License will therefore apply, along with any applicable section 7
-    additional terms, to the whole of the work, and all its parts,
-    regardless of how they are packaged.  This License gives no
-    permission to license the work in any other way, but it does not
-    invalidate such permission if you have separately received it.
-
-    d) If the work has interactive user interfaces, each must display
-    Appropriate Legal Notices; however, if the Program has interactive
-    interfaces that do not display Appropriate Legal Notices, your
-    work need not make them do so.
-
-  A compilation of a covered work with other separate and independent
-works, which are not by their nature extensions of the covered work,
-and which are not combined with it such as to form a larger program,
-in or on a volume of a storage or distribution medium, is called an
-"aggregate" if the compilation and its resulting copyright are not
-used to limit the access or legal rights of the compilation's users
-beyond what the individual works permit.  Inclusion of a covered work
-in an aggregate does not cause this License to apply to the other
-parts of the aggregate.
-
-  6. Conveying Non-Source Forms.
-
-  You may convey a covered work in object code form under the terms
-of sections 4 and 5, provided that you also convey the
-machine-readable Corresponding Source under the terms of this License,
-in one of these ways:
-
-    a) Convey the object code in, or embodied in, a physical product
-    (including a physical distribution medium), accompanied by the
-    Corresponding Source fixed on a durable physical medium
-    customarily used for software interchange.
-
-    b) Convey the object code in, or embodied in, a physical product
-    (including a physical distribution medium), accompanied by a
-    written offer, valid for at least three years and valid for as
-    long as you offer spare parts or customer support for that product
-    model, to give anyone who possesses the object code either (1) a
-    copy of the Corresponding Source for all the software in the
-    product that is covered by this License, on a durable physical
-    medium customarily used for software interchange, for a price no
-    more than your reasonable cost of physically performing this
-    conveying of source, or (2) access to copy the
-    Corresponding Source from a network server at no charge.
-
-    c) Convey individual copies of the object code with a copy of the
-    written offer to provide the Corresponding Source.  This
-    alternative is allowed only occasionally and noncommercially, and
-    only if you received the object code with such an offer, in accord
-    with subsection 6b.
-
-    d) Convey the object code by offering access from a designated
-    place (gratis or for a charge), and offer equivalent access to the
-    Corresponding Source in the same way through the same place at no
-    further charge.  You need not require recipients to copy the
-    Corresponding Source along with the object code.  If the place to
-    copy the object code is a network server, the Corresponding Source
-    may be on a different server (operated by you or a third party)
-    that supports equivalent copying facilities, provided you maintain
-    clear directions next to the object code saying where to find the
-    Corresponding Source.  Regardless of what server hosts the
-    Corresponding Source, you remain obligated to ensure that it is
-    available for as long as needed to satisfy these requirements.
-
-    e) Convey the object code using peer-to-peer transmission, provided
-    you inform other peers where the object code and Corresponding
-    Source of the work are being offered to the general public at no
-    charge under subsection 6d.
-
-  A separable portion of the object code, whose source code is excluded
-from the Corresponding Source as a System Library, need not be
-included in conveying the object code work.
-
-  A "User Product" is either (1) a "consumer product", which means any
-tangible personal property which is normally used for personal, family,
-or household purposes, or (2) anything designed or sold for incorporation
-into a dwelling.  In determining whether a product is a consumer product,
-doubtful cases shall be resolved in favor of coverage.  For a particular
-product received by a particular user, "normally used" refers to a
-typical or common use of that class of product, regardless of the status
-of the particular user or of the way in which the particular user
-actually uses, or expects or is expected to use, the product.  A product
-is a consumer product regardless of whether the product has substantial
-commercial, industrial or non-consumer uses, unless such uses represent
-the only significant mode of use of the product.
-
-  "Installation Information" for a User Product means any methods,
-procedures, authorization keys, or other information required to install
-and execute modified versions of a covered work in that User Product from
-a modified version of its Corresponding Source.  The information must
-suffice to ensure that the continued functioning of the modified object
-code is in no case prevented or interfered with solely because
-modification has been made.
-
-  If you convey an object code work under this section in, or with, or
-specifically for use in, a User Product, and the conveying occurs as
-part of a transaction in which the right of possession and use of the
-User Product is transferred to the recipient in perpetuity or for a
-fixed term (regardless of how the transaction is characterized), the
-Corresponding Source conveyed under this section must be accompanied
-by the Installation Information.  But this requirement does not apply
-if neither you nor any third party retains the ability to install
-modified object code on the User Product (for example, the work has
-been installed in ROM).
-
-  The requirement to provide Installation Information does not include a
-requirement to continue to provide support service, warranty, or updates
-for a work that has been modified or installed by the recipient, or for
-the User Product in which it has been modified or installed.  Access to a
-network may be denied when the modification itself materially and
-adversely affects the operation of the network or violates the rules and
-protocols for communication across the network.
-
-  Corresponding Source conveyed, and Installation Information provided,
-in accord with this section must be in a format that is publicly
-documented (and with an implementation available to the public in
-source code form), and must require no special password or key for
-unpacking, reading or copying.
-
-  7. Additional Terms.
-
-  "Additional permissions" are terms that supplement the terms of this
-License by making exceptions from one or more of its conditions.
-Additional permissions that are applicable to the entire Program shall
-be treated as though they were included in this License, to the extent
-that they are valid under applicable law.  If additional permissions
-apply only to part of the Program, that part may be used separately
-under those permissions, but the entire Program remains governed by
-this License without regard to the additional permissions.
-
-  When you convey a copy of a covered work, you may at your option
-remove any additional permissions from that copy, or from any part of
-it.  (Additional permissions may be written to require their own
-removal in certain cases when you modify the work.)  You may place
-additional permissions on material, added by you to a covered work,
-for which you have or can give appropriate copyright permission.
-
-  Notwithstanding any other provision of this License, for material you
-add to a covered work, you may (if authorized by the copyright holders of
-that material) supplement the terms of this License with terms:
-
-    a) Disclaiming warranty or limiting liability differently from the
-    terms of sections 15 and 16 of this License; or
-
-    b) Requiring preservation of specified reasonable legal notices or
-    author attributions in that material or in the Appropriate Legal
-    Notices displayed by works containing it; or
-
-    c) Prohibiting misrepresentation of the origin of that material, or
-    requiring that modified versions of such material be marked in
-    reasonable ways as different from the original version; or
-
-    d) Limiting the use for publicity purposes of names of licensors or
-    authors of the material; or
-
-    e) Declining to grant rights under trademark law for use of some
-    trade names, trademarks, or service marks; or
-
-    f) Requiring indemnification of licensors and authors of that
-    material by anyone who conveys the material (or modified versions of
-    it) with contractual assumptions of liability to the recipient, for
-    any liability that these contractual assumptions directly impose on
-    those licensors and authors.
-
-  All other non-permissive additional terms are considered "further
-restrictions" within the meaning of section 10.  If the Program as you
-received it, or any part of it, contains a notice stating that it is
-governed by this License along with a term that is a further
-restriction, you may remove that term.  If a license document contains
-a further restriction but permits relicensing or conveying under this
-License, you may add to a covered work material governed by the terms
-of that license document, provided that the further restriction does
-not survive such relicensing or conveying.
-
-  If you add terms to a covered work in accord with this section, you
-must place, in the relevant source files, a statement of the
-additional terms that apply to those files, or a notice indicating
-where to find the applicable terms.
-
-  Additional terms, permissive or non-permissive, may be stated in the
-form of a separately written license, or stated as exceptions;
-the above requirements apply either way.
-
-  8. Termination.
-
-  You may not propagate or modify a covered work except as expressly
-provided under this License.  Any attempt otherwise to propagate or
-modify it is void, and will automatically terminate your rights under
-this License (including any patent licenses granted under the third
-paragraph of section 11).
-
-  However, if you cease all violation of this License, then your
-license from a particular copyright holder is reinstated (a)
-provisionally, unless and until the copyright holder explicitly and
-finally terminates your license, and (b) permanently, if the copyright
-holder fails to notify you of the violation by some reasonable means
-prior to 60 days after the cessation.
-
-  Moreover, your license from a particular copyright holder is
-reinstated permanently if the copyright holder notifies you of the
-violation by some reasonable means, this is the first time you have
-received notice of violation of this License (for any work) from that
-copyright holder, and you cure the violation prior to 30 days after
-your receipt of the notice.
-
-  Termination of your rights under this section does not terminate the
-licenses of parties who have received copies or rights from you under
-this License.  If your rights have been terminated and not permanently
-reinstated, you do not qualify to receive new licenses for the same
-material under section 10.
-
-  9. Acceptance Not Required for Having Copies.
-
-  You are not required to accept this License in order to receive or
-run a copy of the Program.  Ancillary propagation of a covered work
-occurring solely as a consequence of using peer-to-peer transmission
-to receive a copy likewise does not require acceptance.  However,
-nothing other than this License grants you permission to propagate or
-modify any covered work.  These actions infringe copyright if you do
-not accept this License.  Therefore, by modifying or propagating a
-covered work, you indicate your acceptance of this License to do so.
-
-  10. Automatic Licensing of Downstream Recipients.
-
-  Each time you convey a covered work, the recipient automatically
-receives a license from the original licensors, to run, modify and
-propagate that work, subject to this License.  You are not responsible
-for enforcing compliance by third parties with this License.
-
-  An "entity transaction" is a transaction transferring control of an
-organization, or substantially all assets of one, or subdividing an
-organization, or merging organizations.  If propagation of a covered
-work results from an entity transaction, each party to that
-transaction who receives a copy of the work also receives whatever
-licenses to the work the party's predecessor in interest had or could
-give under the previous paragraph, plus a right to possession of the
-Corresponding Source of the work from the predecessor in interest, if
-the predecessor has it or can get it with reasonable efforts.
-
-  You may not impose any further restrictions on the exercise of the
-rights granted or affirmed under this License.  For example, you may
-not impose a license fee, royalty, or other charge for exercise of
-rights granted under this License, and you may not initiate litigation
-(including a cross-claim or counterclaim in a lawsuit) alleging that
-any patent claim is infringed by making, using, selling, offering for
-sale, or importing the Program or any portion of it.
-
-  11. Patents.
-
-  A "contributor" is a copyright holder who authorizes use under this
-License of the Program or a work on which the Program is based.  The
-work thus licensed is called the contributor's "contributor version".
-
-  A contributor's "essential patent claims" are all patent claims
-owned or controlled by the contributor, whether already acquired or
-hereafter acquired, that would be infringed by some manner, permitted
-by this License, of making, using, or selling its contributor version,
-but do not include claims that would be infringed only as a
-consequence of further modification of the contributor version.  For
-purposes of this definition, "control" includes the right to grant
-patent sublicenses in a manner consistent with the requirements of
-this License.
-
-  Each contributor grants you a non-exclusive, worldwide, royalty-free
-patent license under the contributor's essential patent claims, to
-make, use, sell, offer for sale, import and otherwise run, modify and
-propagate the contents of its contributor version.
-
-  In the following three paragraphs, a "patent license" is any express
-agreement or commitment, however denominated, not to enforce a patent
-(such as an express permission to practice a patent or covenant not to
-sue for patent infringement).  To "grant" such a patent license to a
-party means to make such an agreement or commitment not to enforce a
-patent against the party.
-
-  If you convey a covered work, knowingly relying on a patent license,
-and the Corresponding Source of the work is not available for anyone
-to copy, free of charge and under the terms of this License, through a
-publicly available network server or other readily accessible means,
-then you must either (1) cause the Corresponding Source to be so
-available, or (2) arrange to deprive yourself of the benefit of the
-patent license for this particular work, or (3) arrange, in a manner
-consistent with the requirements of this License, to extend the patent
-license to downstream recipients.  "Knowingly relying" means you have
-actual knowledge that, but for the patent license, your conveying the
-covered work in a country, or your recipient's use of the covered work
-in a country, would infringe one or more identifiable patents in that
-country that you have reason to believe are valid.
-
-  If, pursuant to or in connection with a single transaction or
-arrangement, you convey, or propagate by procuring conveyance of, a
-covered work, and grant a patent license to some of the parties
-receiving the covered work authorizing them to use, propagate, modify
-or convey a specific copy of the covered work, then the patent license
-you grant is automatically extended to all recipients of the covered
-work and works based on it.
-
-  A patent license is "discriminatory" if it does not include within
-the scope of its coverage, prohibits the exercise of, or is
-conditioned on the non-exercise of one or more of the rights that are
-specifically granted under this License.  You may not convey a covered
-work if you are a party to an arrangement with a third party that is
-in the business of distributing software, under which you make payment
-to the third party based on the extent of your activity of conveying
-the work, and under which the third party grants, to any of the
-parties who would receive the covered work from you, a discriminatory
-patent license (a) in connection with copies of the covered work
-conveyed by you (or copies made from those copies), or (b) primarily
-for and in connection with specific products or compilations that
-contain the covered work, unless you entered into that arrangement,
-or that patent license was granted, prior to 28 March 2007.
-
-  Nothing in this License shall be construed as excluding or limiting
-any implied license or other defenses to infringement that may
-otherwise be available to you under applicable patent law.
-
-  12. No Surrender of Others' Freedom.
-
-  If conditions are imposed on you (whether by court order, agreement or
-otherwise) that contradict the conditions of this License, they do not
-excuse you from the conditions of this License.  If you cannot convey a
-covered work so as to satisfy simultaneously your obligations under this
-License and any other pertinent obligations, then as a consequence you may
-not convey it at all.  For example, if you agree to terms that obligate you
-to collect a royalty for further conveying from those to whom you convey
-the Program, the only way you could satisfy both those terms and this
-License would be to refrain entirely from conveying the Program.
-
-  13. Use with the GNU Affero General Public License.
-
-  Notwithstanding any other provision of this License, you have
-permission to link or combine any covered work with a work licensed
-under version 3 of the GNU Affero General Public License into a single
-combined work, and to convey the resulting work.  The terms of this
-License will continue to apply to the part which is the covered work,
-but the special requirements of the GNU Affero General Public License,
-section 13, concerning interaction through a network will apply to the
-combination as such.
-
-  14. Revised Versions of this License.
-
-  The Free Software Foundation may publish revised and/or new versions of
-the GNU General Public License from time to time.  Such new versions will
-be similar in spirit to the present version, but may differ in detail to
-address new problems or concerns.
-
-  Each version is given a distinguishing version number.  If the
-Program specifies that a certain numbered version of the GNU General
-Public License "or any later version" applies to it, you have the
-option of following the terms and conditions either of that numbered
-version or of any later version published by the Free Software
-Foundation.  If the Program does not specify a version number of the
-GNU General Public License, you may choose any version ever published
-by the Free Software Foundation.
-
-  If the Program specifies that a proxy can decide which future
-versions of the GNU General Public License can be used, that proxy's
-public statement of acceptance of a version permanently authorizes you
-to choose that version for the Program.
-
-  Later license versions may give you additional or different
-permissions.  However, no additional obligations are imposed on any
-author or copyright holder as a result of your choosing to follow a
-later version.
-
-  15. Disclaimer of Warranty.
-
-  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
-APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
-HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
-OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
-THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
-PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
-IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
-ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
-
-  16. Limitation of Liability.
-
-  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
-WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
-THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
-GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
-USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
-DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
-PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
-EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
-SUCH DAMAGES.
-
-  17. Interpretation of Sections 15 and 16.
-
-  If the disclaimer of warranty and limitation of liability provided
-above cannot be given local legal effect according to their terms,
-reviewing courts shall apply local law that most closely approximates
-an absolute waiver of all civil liability in connection with the
-Program, unless a warranty or assumption of liability accompanies a
-copy of the Program in return for a fee.
-
-                     END OF TERMS AND CONDITIONS
-
-            How to Apply These Terms to Your New Programs
-
-  If you develop a new program, and you want it to be of the greatest
-possible use to the public, the best way to achieve this is to make it
-free software which everyone can redistribute and change under these terms.
-
-  To do so, attach the following notices to the program.  It is safest
-to attach them to the start of each source file to most effectively
-state the exclusion of warranty; and each file should have at least
-the "copyright" line and a pointer to where the full notice is found.
-
-    <one line to give the program's name and a brief idea of what it does.>
-    Copyright (C) <year>  <name of author>
-
-    This program is free software: you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-    the Free Software Foundation, either version 3 of the License, or
-    (at your option) any later version.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-Also add information on how to contact you by electronic and paper mail.
-
-  If the program does terminal interaction, make it output a short
-notice like this when it starts in an interactive mode:
-
-    <program>  Copyright (C) <year>  <name of author>
-    This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
-    This is free software, and you are welcome to redistribute it
-    under certain conditions; type `show c' for details.
-
-The hypothetical commands `show w' and `show c' should show the appropriate
-parts of the General Public License.  Of course, your program's commands
-might be different; for a GUI interface, you would use an "about box".
-
-  You should also get your employer (if you work as a programmer) or school,
-if any, to sign a "copyright disclaimer" for the program, if necessary.
-For more information on this, and how to apply and follow the GNU GPL, see
-<http://www.gnu.org/licenses/>.
-
-  The GNU General Public License does not permit incorporating your program
-into proprietary programs.  If your program is a subroutine library, you
-may consider it more useful to permit linking proprietary applications with
-the library.  If this is what you want to do, use the GNU Lesser General
-Public License instead of this License.  But first, please read
-<http://www.gnu.org/philosophy/why-not-lgpl.html>.
@@ -0,0 +1,7 @@
+Copyright (c) 2014-2026 Savoir-faire Linux Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
@@ -1,35 +0,0 @@
-AM_CXXFLAGS = -pthread
-
-SUBDIRS =
-
-SUBDIRS += src
-
-if ENABLE_C
-SUBDIRS += c
-endif
-
-if ENABLE_TOOLS
-SUBDIRS += tools
-endif
-
-if USE_CYTHON
-SUBDIRS += python
-endif
-
-if ENABLE_TESTS
-SUBDIRS += tests
-endif
-
-SUBDIRS += doc
-
-ACLOCAL_AMFLAGS = -I m4
-
-DOC_FILES = \
-			README.md \
-			COPYING
-
-EXTRA_DIST = \
-			$(DOC_FILES)
-
-pkgconfigdir = $(libdir)/pkgconfig
-pkgconfig_DATA = opendht.pc
@@ -4,7 +4,10 @@
    <a id="user-content-opendht-" class="anchor" href="/savoirfairelinux/opendht/blob/master/README.md#opendht-" aria-hidden="true"></a>OpenDHT
 </h1>

-![PyPI - Version](https://img.shields.io/pypi/v/opendht?style=flat)
+[![PyPI - Version](https://img.shields.io/pypi/v/opendht?style=flat)](https://pypi.org/project/opendht/)
+[![crates.io - Version](https://img.shields.io/crates/v/opendht?style=flat)](https://crates.io/crates/opendht)
+[![npm - Version](https://img.shields.io/npm/v/opendht?style=flat)](https://www.npmjs.com/package/opendht)
+[![Docker Image](https://img.shields.io/badge/Docker-ghcr.io-2496ED?style=flat&logo=docker&logoColor=white)](https://github.com/savoirfairelinux/opendht/pkgs/container/opendht%2Fopendht)

 A lightweight C++17 Distributed Hash Table implementation.

@@ -17,7 +20,7 @@ Values are distributed over the network, with redundancy.
 * Public key cryptography layer providing optional data signature and encryption (using GnuTLS)
 * IPv4 and IPv6 support
 * Clean and powerful **C++17** map API
- * Bindings for **C, Rust & Python 3**
+ * Bindings for **C, Rust, Node.js & Python 3**
 * REST API with optional HTTP client+server with push notification support

 ## Documentation
@@ -140,28 +143,26 @@ asyncio.run(dht_async_demo("unique_key"))
 ```

 ## Dependencies
+Core dependencies:
 - msgpack-c 1.2+, used for data serialization.
 - GnuTLS 3.3+, used for cryptographic operations.
 - Nettle 2.4+, a GnuTLS dependency for crypto.
 - {fmt} 9.0+, for log formatting.
- (optional) restinio used for the REST API.
- (optional) llhttp used for the REST API.
- (optional) jsoncpp 1.7.4-3+, used for the REST API.
+
+Optional dependencies for the REST API (DHT proxy client/server):
+- (optional) restinio
+- (optional) llhttp
+- (optional) jsoncpp 1.7.4-3+
+- (optional) simdutf
+
+Build environment:
 - Build tested with GCC 9+ (GNU/Linux, Windows with MinGW), Clang/LLVM (GNU/Linux, Android, macOS, iOS).
 - Build tested with Microsoft Visual Studio 2019, 2022

-## Contact
-
-IRC: join us on Libera.chat at [`#opendht`](https://web.libera.chat/#opendht).
-
 ## License
-Copyright (C) 2014-2025 Savoir-faire Linux Inc.
+Copyright (c) 2014-2026 Savoir-faire Linux Inc.

-OpenDHT is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 3 of the License, or (at your option) any later version.
-
-This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
-
-See COPYING or https://www.gnu.org/licenses/gpl-3.0.en.html for the full GPLv3 license.
+OpenDHT is released under the MIT License. See [LICENSE](LICENSE) for details.

 ## Acknowledgements
 This project was originally based on https://github.com/jech/dht by Juliusz Chroboczek.
@@ -1 +0,0 @@
-autoreconf --install --verbose -Wall
@@ -1,15 +0,0 @@
-lib_LTLIBRARIES = libopendht-c.la
-noinst_HEADERS = opendht_c.h
-
-AM_CPPFLAGS = -DOPENDHT_C_BUILD -isystem @top_srcdir@/include @JsonCpp_CFLAGS@ @MsgPack_CFLAGS@
-if OPENDHT_SHARED
-AM_CPPFLAGS += -Dopendht_c_EXPORTS
-endif
-
-libopendht_c_la_LIBADD = $(LIBOBJS) ../src/.libs/libopendht.la
-
-libopendht_c_la_SOURCES  = \
-        opendht.cpp
-
-nobase_include_HEADERS = \
-        opendht_c.h
@@ -1,21 +1,5 @@
-/*
- *  Copyright (C) 2014-2025 Savoir-faire Linux Inc.
- *  Author : Adrien Béraud <adrien.beraud@savoirfairelinux.com>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 3 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program. If not, see <https://www.gnu.org/licenses/>.
- */
-
+// Copyright (c) 2014-2026 Savoir-faire Linux Inc.
+// SPDX-License-Identifier: MIT
 #pragma once

 #ifdef __cplusplus
@@ -39,7 +23,8 @@ typedef uint16_t in_port_t;
 #endif

 // Non-owning data view
-struct OPENDHT_C_PUBLIC dht_data_view {
+struct OPENDHT_C_PUBLIC dht_data_view
+{
    const uint8_t* data;
    size_t size;
 };
@@ -54,7 +39,18 @@ OPENDHT_C_PUBLIC dht_data_view dht_blob_get_data(const dht_blob* data);
 OPENDHT_C_PUBLIC void dht_blob_delete(dht_blob* data);

 // dht::InfoHash
-struct OPENDHT_C_PUBLIC dht_infohash { uint8_t d[HASH_LEN]; };
+#ifdef __cplusplus
+#define OPENDHT_C_ALIGN_UINT32 alignas(uint32_t)
+#elif defined(_MSC_VER)
+#define OPENDHT_C_ALIGN_UINT32 __declspec(align(4))
+#else
+#define OPENDHT_C_ALIGN_UINT32 _Alignas(uint32_t)
+#endif
+
+struct OPENDHT_C_PUBLIC dht_infohash
+{
+    OPENDHT_C_ALIGN_UINT32 uint8_t d[HASH_LEN];
+};
 typedef struct dht_infohash dht_infohash;
 OPENDHT_C_PUBLIC void dht_infohash_zero(dht_infohash* h);
 OPENDHT_C_PUBLIC void dht_infohash_random(dht_infohash* h);
@@ -66,8 +62,12 @@ OPENDHT_C_PUBLIC const char* dht_infohash_print(const dht_infohash* h);
 OPENDHT_C_PUBLIC bool dht_infohash_is_zero(const dht_infohash* h);

 // dht::PkId
-struct OPENDHT_C_PUBLIC dht_pkid { uint8_t d[32]; };
+struct OPENDHT_C_PUBLIC dht_pkid
+{
+    OPENDHT_C_ALIGN_UINT32 uint8_t d[32];
+};
 typedef struct dht_pkid dht_pkid;
+#undef OPENDHT_C_ALIGN_UINT32
 OPENDHT_C_PUBLIC const char* dht_pkid_print(const dht_pkid* h);

 // dht::crypto::PublicKey
@@ -76,17 +76,23 @@ typedef struct dht_publickey dht_publickey;
 OPENDHT_C_PUBLIC dht_publickey* dht_publickey_import(const uint8_t* dat, size_t dat_size);
 OPENDHT_C_PUBLIC void dht_publickey_delete(dht_publickey* pk);
 OPENDHT_C_PUBLIC int dht_publickey_export(const dht_publickey* pk, char* out, size_t* out_size);
+OPENDHT_C_PUBLIC dht_blob* dht_publickey_export_blob(const dht_publickey* pk);
+OPENDHT_C_PUBLIC int dht_publickey_unpack(dht_publickey* pk, const uint8_t* data, size_t size);
 OPENDHT_C_PUBLIC dht_infohash dht_publickey_get_id(const dht_publickey* pk);
 OPENDHT_C_PUBLIC dht_pkid dht_publickey_get_long_id(const dht_publickey* pk);
-OPENDHT_C_PUBLIC bool dht_publickey_check_signature(const dht_publickey* pk, const char* data, size_t data_size, const char* signature, size_t signature_size);
+OPENDHT_C_PUBLIC bool dht_publickey_check_signature(
+    const dht_publickey* pk, const char* data, size_t data_size, const char* signature, size_t signature_size);
 OPENDHT_C_PUBLIC dht_blob* dht_publickey_encrypt(const dht_publickey* pk, const char* data, size_t data_size);

 // dht::crypto::PrivateKey
 struct OPENDHT_C_PUBLIC dht_privatekey;
 typedef struct dht_privatekey dht_privatekey;
 OPENDHT_C_PUBLIC dht_privatekey* dht_privatekey_generate(unsigned key_length_bits);
+OPENDHT_C_PUBLIC dht_privatekey* dht_privatekey_generate_ec(void);
 OPENDHT_C_PUBLIC dht_privatekey* dht_privatekey_import(const uint8_t* dat, size_t dat_size, const char* password);
 OPENDHT_C_PUBLIC int dht_privatekey_export(const dht_privatekey*, char* out, size_t* out_size, const char* password);
+OPENDHT_C_PUBLIC dht_blob* dht_privatekey_export_blob(const dht_privatekey*, const char* password);
+OPENDHT_C_PUBLIC dht_blob* dht_privatekey_sign(const dht_privatekey*, const uint8_t* data, size_t size);
 OPENDHT_C_PUBLIC dht_publickey* dht_privatekey_get_publickey(const dht_privatekey*);
 OPENDHT_C_PUBLIC dht_blob* dht_privatekey_decrypt(const dht_privatekey*, const char* data, size_t data_size);
 OPENDHT_C_PUBLIC void dht_privatekey_delete(dht_privatekey*);
@@ -95,17 +101,21 @@ OPENDHT_C_PUBLIC void dht_privatekey_delete(dht_privatekey*);
 struct OPENDHT_C_PUBLIC dht_certificate;
 typedef struct dht_certificate dht_certificate;
 OPENDHT_C_PUBLIC dht_certificate* dht_certificate_import(const uint8_t* dat, size_t dat_size);
+OPENDHT_C_PUBLIC dht_blob* dht_certificate_export(const dht_certificate* certificate);
+OPENDHT_C_PUBLIC dht_certificate* dht_certificate_ref(const dht_certificate* certificate);
 OPENDHT_C_PUBLIC dht_infohash dht_certificate_get_id(const dht_certificate*);
 OPENDHT_C_PUBLIC dht_pkid dht_certificate_get_long_id(const dht_certificate*);
 OPENDHT_C_PUBLIC dht_publickey* dht_certificate_get_publickey(const dht_certificate*);
 OPENDHT_C_PUBLIC void dht_certificate_delete(dht_certificate*);

-struct OPENDHT_C_PUBLIC dht_identity {
+struct OPENDHT_C_PUBLIC dht_identity
+{
    dht_privatekey* privatekey;
    dht_certificate* certificate;
 };
 typedef struct dht_identity dht_identity;
 OPENDHT_C_PUBLIC dht_identity dht_identity_generate(const char* common_name, const dht_identity* ca);
+OPENDHT_C_PUBLIC dht_identity dht_identity_generate_ec(const char* common_name, const dht_identity* ca);
 OPENDHT_C_PUBLIC void dht_identity_delete(dht_identity*);

 // dht::Value
@@ -116,6 +126,7 @@ OPENDHT_C_PUBLIC dht_value* dht_value_new(const uint8_t* data, size_t size);
 OPENDHT_C_PUBLIC dht_value* dht_value_with_id_new(const uint8_t* data, size_t size, uint64_t value_id);
 OPENDHT_C_PUBLIC dht_value* dht_value_new_from_string(const char* str);
 OPENDHT_C_PUBLIC dht_value* dht_value_ref(const dht_value*);
+OPENDHT_C_PUBLIC dht_value* dht_value_copy(const dht_value*);
 OPENDHT_C_PUBLIC void dht_value_unref(dht_value*);
 OPENDHT_C_PUBLIC dht_data_view dht_value_get_data(const dht_value* data);
 OPENDHT_C_PUBLIC dht_value_id dht_value_get_id(const dht_value* data);
@@ -123,19 +134,61 @@ OPENDHT_C_PUBLIC dht_publickey* dht_value_get_owner(const dht_value* data);
 OPENDHT_C_PUBLIC dht_infohash dht_value_get_recipient(const dht_value* data);
 OPENDHT_C_PUBLIC const char* dht_value_get_user_type(const dht_value* data);
 OPENDHT_C_PUBLIC void dht_value_set_user_type(dht_value* data, const char* user_type);
+OPENDHT_C_PUBLIC uint16_t dht_value_get_type(const dht_value* value);
+OPENDHT_C_PUBLIC void dht_value_set_type(dht_value* value, uint16_t type);
+OPENDHT_C_PUBLIC uint16_t dht_value_get_seq(const dht_value* value);
+OPENDHT_C_PUBLIC void dht_value_set_seq(dht_value* value, uint16_t seq);
+OPENDHT_C_PUBLIC unsigned dht_value_get_priority(const dht_value* value);
+OPENDHT_C_PUBLIC void dht_value_set_priority(dht_value* value, unsigned priority);
+OPENDHT_C_PUBLIC const char* dht_value_get_push_type(const dht_value* value);
+OPENDHT_C_PUBLIC void dht_value_set_push_type(dht_value* value, const char* push_type);

 // callbacks
 typedef bool (*dht_get_cb)(const dht_value* value, void* user_data);
 typedef bool (*dht_value_cb)(const dht_value* value, bool expired, void* user_data);
 typedef void (*dht_done_cb)(bool ok, void* user_data);
 typedef void (*dht_shutdown_cb)(void* user_data);
+typedef void (*dht_status_cb)(int ipv4_status, int ipv6_status, void* user_data);
+typedef void (*dht_certificate_cb)(const dht_certificate* certificate, void* user_data);
+typedef void (*dht_certificate_store_cb)(const dht_pkid* id, dht_certificate_cb emit, void* emit_data, void* user_data);
+
+typedef struct dht_runner_context
+{
+    dht_status_cb status_cb;
+    dht_certificate_store_cb certificate_store_cb;
+    dht_shutdown_cb released_cb;
+    void* user_data;
+} dht_runner_context;
+
+enum dht_query_field {
+    DHT_FIELD_ID = 1,
+    DHT_FIELD_TYPE = 2,
+    DHT_FIELD_SEQ = 4,
+    DHT_FIELD_OWNER = 8,
+    DHT_FIELD_USER_TYPE = 16
+};
+
+typedef struct dht_query_result
+{
+    uint32_t fields;
+    uint64_t id;
+    uint16_t value_type;
+    uint16_t seq;
+    dht_infohash owner;
+    dht_data_view user_type;
+} dht_query_result;
+typedef bool (*dht_query_cb)(const dht_query_result* result, void* user_data);
+
+struct dht_push_token;
+typedef struct dht_push_token dht_push_token;

 struct OPENDHT_C_PUBLIC dht_op_token;
 typedef struct dht_op_token dht_op_token;
 OPENDHT_C_PUBLIC void dht_op_token_delete(dht_op_token* token);

 // config
-struct OPENDHT_C_PUBLIC dht_node_config {
+struct OPENDHT_C_PUBLIC dht_node_config
+{
    dht_infohash node_id;
    uint32_t network;
    bool is_bootstrap;
@@ -144,13 +197,15 @@ struct OPENDHT_C_PUBLIC dht_node_config {
 };
 typedef struct dht_node_config dht_node_config;

-struct OPENDHT_C_PUBLIC dht_secure_config {
+struct OPENDHT_C_PUBLIC dht_secure_config
+{
    dht_node_config node_config;
    dht_identity id;
 };
 typedef struct dht_secure_config dht_secure_config;

-struct OPENDHT_C_PUBLIC dht_runner_config {
+struct OPENDHT_C_PUBLIC dht_runner_config
+{
    dht_secure_config dht_config;
    bool threaded;
    const char* proxy_server;
@@ -173,18 +228,70 @@ struct OPENDHT_C_PUBLIC dht_runner;
 typedef struct dht_runner dht_runner;
 OPENDHT_C_PUBLIC dht_runner* dht_runner_new(void);
 OPENDHT_C_PUBLIC void dht_runner_delete(dht_runner* runner);
+OPENDHT_C_PUBLIC int dht_runner_loop(dht_runner* runner);
+OPENDHT_C_PUBLIC int dht_runner_join(dht_runner* runner);
 /* Returns 0 on success, standard error code on failure */
 OPENDHT_C_PUBLIC int dht_runner_run(dht_runner* runner, in_port_t port);
 /* Returns 0 on success, standard error code on failure */
 OPENDHT_C_PUBLIC int dht_runner_run_config(dht_runner* runner, in_port_t port, const dht_runner_config* config);
-OPENDHT_C_PUBLIC void dht_runner_ping(dht_runner* runner, struct sockaddr* addr, socklen_t addr_len, dht_done_cb done_cb, void* cb_user_data);
+OPENDHT_C_PUBLIC int dht_runner_run_bind(dht_runner* runner,
+                                         const char* ipv4,
+                                         const char* ipv6,
+                                         in_port_t port,
+                                         const dht_runner_config* config,
+                                         const dht_runner_context* context);
+OPENDHT_C_PUBLIC int dht_runner_connectivity_changed(dht_runner* runner);
+OPENDHT_C_PUBLIC int dht_runner_register_type(
+    dht_runner* runner, uint16_t id, const char* name, uint64_t expiration_seconds, bool insecure);
+OPENDHT_C_PUBLIC dht_publickey* dht_runner_get_publickey(const dht_runner* runner);
+OPENDHT_C_PUBLIC void dht_runner_find_certificate(
+    dht_runner* runner, const dht_pkid* id, dht_certificate_cb callback, dht_shutdown_cb released_cb, void* user_data);
+OPENDHT_C_PUBLIC int dht_runner_register_certificate(dht_runner* runner, const dht_certificate* certificate);
+OPENDHT_C_PUBLIC void dht_runner_ping(
+    dht_runner* runner, struct sockaddr* addr, socklen_t addr_len, dht_done_cb done_cb, void* cb_user_data);
 OPENDHT_C_PUBLIC void dht_runner_bootstrap(dht_runner* runner, const char* host, const char* service);
-OPENDHT_C_PUBLIC void dht_runner_get(dht_runner* runner, const dht_infohash* hash, dht_get_cb cb, dht_done_cb done_cb, void* cb_user_data);
-OPENDHT_C_PUBLIC dht_op_token* dht_runner_listen(dht_runner* runner, const dht_infohash* hash, dht_value_cb cb, dht_shutdown_cb done_cb, void* cb_user_data);
+OPENDHT_C_PUBLIC void dht_runner_get(
+    dht_runner* runner, const dht_infohash* hash, dht_get_cb cb, dht_done_cb done_cb, void* cb_user_data);
+OPENDHT_C_PUBLIC void dht_runner_get_filtered(dht_runner* runner,
+                                              const dht_infohash* hash,
+                                              const char* where,
+                                              dht_get_cb cb,
+                                              dht_done_cb done_cb,
+                                              void* user_data);
+OPENDHT_C_PUBLIC void dht_runner_query(dht_runner* runner,
+                                       const dht_infohash* hash,
+                                       const char* query,
+                                       dht_query_cb cb,
+                                       dht_done_cb done_cb,
+                                       void* user_data);
+OPENDHT_C_PUBLIC dht_op_token* dht_runner_listen(
+    dht_runner* runner, const dht_infohash* hash, dht_value_cb cb, dht_shutdown_cb done_cb, void* cb_user_data);
+OPENDHT_C_PUBLIC dht_op_token* dht_runner_listen_filtered(dht_runner* runner,
+                                                          const dht_infohash* hash,
+                                                          const char* where,
+                                                          dht_value_cb cb,
+                                                          dht_shutdown_cb released_cb,
+                                                          void* user_data);
 OPENDHT_C_PUBLIC void dht_runner_cancel_listen(dht_runner* runner, const dht_infohash* hash, dht_op_token* token);
-OPENDHT_C_PUBLIC void dht_runner_put(dht_runner* runner, const dht_infohash* hash, const dht_value* value, dht_done_cb done_cb, void* cb_user_data, bool permanent);
-OPENDHT_C_PUBLIC void dht_runner_put_signed(dht_runner* runner, const dht_infohash* hash, const dht_value* value, dht_done_cb done_cb, void* cb_user_data, bool permanent);
-OPENDHT_C_PUBLIC void dht_runner_put_encrypted(dht_runner* runner, const dht_infohash* hash, const dht_infohash* to, const dht_value* value, dht_done_cb done_cb, void* cb_user_data, bool permanent);
+OPENDHT_C_PUBLIC void dht_runner_put(dht_runner* runner,
+                                     const dht_infohash* hash,
+                                     const dht_value* value,
+                                     dht_done_cb done_cb,
+                                     void* cb_user_data,
+                                     bool permanent);
+OPENDHT_C_PUBLIC void dht_runner_put_signed(dht_runner* runner,
+                                            const dht_infohash* hash,
+                                            const dht_value* value,
+                                            dht_done_cb done_cb,
+                                            void* cb_user_data,
+                                            bool permanent);
+OPENDHT_C_PUBLIC void dht_runner_put_encrypted(dht_runner* runner,
+                                               const dht_infohash* hash,
+                                               const dht_pkid* to,
+                                               const dht_value* value,
+                                               dht_done_cb done_cb,
+                                               void* cb_user_data,
+                                               bool permanent);
 OPENDHT_C_PUBLIC void dht_runner_cancel_put(dht_runner* runner, const dht_infohash* hash, dht_value_id value_id);
 OPENDHT_C_PUBLIC void dht_runner_shutdown(dht_runner* runner, dht_shutdown_cb done_cb, void* cb_user_data);
 OPENDHT_C_PUBLIC dht_infohash dht_runner_get_node_id(const dht_runner* runner);
@@ -193,6 +300,16 @@ OPENDHT_C_PUBLIC bool dht_runner_is_running(const dht_runner* runner);
 OPENDHT_C_PUBLIC in_port_t dht_runner_get_bound_port(const dht_runner* runner, sa_family_t af);
 /** Returns null-terminated array that must be freed after use as well as each element */
 OPENDHT_C_PUBLIC struct sockaddr** dht_runner_get_public_address(const dht_runner* runner);
+OPENDHT_C_PUBLIC void dht_sockaddr_array_delete(struct sockaddr** addresses);
+OPENDHT_C_PUBLIC int dht_runner_set_push_notification_token(dht_runner* runner, const char* value);
+OPENDHT_C_PUBLIC int dht_runner_set_push_notification_topic(dht_runner* runner, const char* value);
+OPENDHT_C_PUBLIC int dht_runner_set_push_notification_platform(dht_runner* runner, const char* value);
+OPENDHT_C_PUBLIC dht_push_token* dht_runner_push_notification_received(dht_runner* runner,
+                                                                       const char* const* keys,
+                                                                       const char* const* values,
+                                                                       size_t count);
+OPENDHT_C_PUBLIC int dht_push_token_poll(dht_push_token* token, int* result);
+OPENDHT_C_PUBLIC void dht_push_token_delete(dht_push_token* token);

 #ifdef __cplusplus
 }
@@ -10,7 +10,7 @@
 #  READLINE_LIBRARIES    - the Readline library plus the libraries it 
 #                          depends on

-# Copyright (C) 2009
+# Copyright (c) 2009
 # ASTRON (Netherlands Institute for Radio Astronomy)
 # P.O.Box 2, 7990 AA Dwingeloo, The Netherlands
 #
@@ -1,231 +0,0 @@
-dnl define macros
-m4_define([opendht_major_version], 3)
-m4_define([opendht_minor_version], 6)
-m4_define([opendht_patch_version], 2)
-m4_define([opendht_version],
-		  [opendht_major_version.opendht_minor_version.opendht_patch_version])
-
-AC_INIT(opendht, [opendht_version])
-AC_MSG_WARN([The Autotools build system for OpenDHT is deprecated and will be removed in a future release. Please use CMake or Meson instead.])
-AC_CONFIG_AUX_DIR(ac)
-AM_INIT_AUTOMAKE([foreign subdir-objects])
-AC_CONFIG_HEADERS([config.h])
-AC_CONFIG_MACRO_DIR([m4])
-AC_CANONICAL_HOST
-
-AC_SUBST(OPENDHT_MAJOR_VERSION, opendht_major_version)
-AC_SUBST(OPENDHT_MINOR_VERSION, opendht_minor_version)
-AC_SUBST(OPENDHT_PATCH_VERSION, opendht_patch_version)
-
-AC_ARG_ENABLE([debug], AS_HELP_STRING([--enable-debug], [Build in debug mode, adds stricter warnings, disables optimization]))
-AS_IF([test "x$enable_debug" = "xyes"],
-      [CXXFLAGS="${CXXFLAGS} -g -Og -Wno-return-type -Wall -Wextra -Wnon-virtual-dtor -Wno-deprecated -pedantic-errors"],
-      [CXXFLAGS="${CXXFLAGS} -O3 -Wno-deprecated -pedantic-errors -fvisibility=hidden"])
-
-CPPFLAGS="${CPPFLAGS} -DOPENDHT_BUILD"
-AM_CONDITIONAL([OPENDHT_SHARED], [test "x$enable_shared" != xno])
-AM_COND_IF(OPENDHT_SHARED, [
-  CPPFLAGS="${CPPFLAGS} -Dopendht_EXPORTS"
-])
-
-AM_PROG_AR
-LT_INIT()
-LT_LANG(C++)
-AC_LANG(C++)
-AC_PROG_CXX
-AX_CXX_COMPILE_STDCXX(17,[noext],[mandatory])
-
-dnl Check for C binding
-AC_ARG_ENABLE([c], [AS_HELP_STRING([--disable-c], [Disable DHT C binding])])
-AM_CONDITIONAL(ENABLE_C, test x$enable_c != "xno")
-AM_COND_IF(ENABLE_C, [
-	AC_DEFINE([OPENDHT_C], [], [Define if DHT C biding is enabled])
-])
-
-dnl Check for indexation
-AC_ARG_ENABLE([indexation], [AS_HELP_STRING([--disable-indexation], [Disable DHT indexation])])
-AM_CONDITIONAL(ENABLE_INDEXATION, test x$enable_indexation != "xno")
-AM_COND_IF(ENABLE_INDEXATION, [
-	AC_DEFINE([OPENDHT_INDEXATION], [], [Define if DHT indexation is enabled])
-])
-
-AC_ARG_ENABLE([peer-discovery], [AS_HELP_STRING([--disable-peer-discovery], [Disable peer-discovery])])
-AM_CONDITIONAL(ENABLE_PEER_DISCOVERY, test x$enable_peer_discovery != "xno")
-AM_COND_IF(ENABLE_PEER_DISCOVERY, [AC_DEFINE([OPENDHT_PEER_DISCOVERY], [], [Define if peer discovery is enabled])])
-
-dnl Check for Doxygen
-AC_ARG_ENABLE([doc], AS_HELP_STRING([--enable-doc], [Enable documentation generation (doxygen)]))
-AS_IF([test "x$enable_doc" = "xyes"], [
-       AC_CHECK_PROGS([DOXYGEN], [doxygen])
-       AS_IF([test -z "$DOXYGEN"],
-          [AC_MSG_ERROR([Doxygen is required to generate the documentation.])])
-])
-AM_CONDITIONAL([HAVE_DOXYGEN], [test -n "$DOXYGEN"])
-
-dnl Check for Python
-AC_ARG_ENABLE([python], [AS_HELP_STRING([--disable-python], [Disable python binding])])
-AS_IF([test "x$enable_python" = "xyes"], [
-  AM_COND_IF([ENABLE_INDEXATION], [
-    AM_PATH_PYTHON([3.3],, [:])
-    AS_IF([test -n "$PYTHON"],[
-      echo 'import Cython' | $PYTHON
-      AS_IF([test $? == 0],
-        [CYTHON=yes],
-        [AC_MSG_ERROR([Cython not found, but required for Python support.])])
-      AC_CHECK_PROGS([PIP], [pip3])
-        AS_IF([test -z "$PIP"],
-        [AC_MSG_WARN([pip not found - continuing without python uninstall support])])])
-     ], [AC_MSG_ERROR([Python support requires DHT indexation to be turned on.])])])
-AM_CONDITIONAL([USE_CYTHON], [test -n "$CYTHON"])
-AM_CONDITIONAL([HAVE_PIP], [test -n "$PIP"])
-
-case "${host_os}" in
-  "")
-    SYS=unknown
-    ;;
-  *android*)
-    SYS=android
-    ;;
-  linux*)
-    SYS=linux
-    CPPFLAGS="$CPPFLAGS -D_POSIX_C_SOURCE=200809L"
-    ;;
-  darwin*)
-    SYS=darwin
-    ;;
-  mingw32*)
-    SYS=mingw32
-    WIN32=1
-    AC_DEFINE([_POSIX_SOURCE], [1], [IEEE Std 1003.1.])
-    AC_DEFINE([_POSIX_C_SOURCE], [200809L], [IEEE Std 1003.1.])
-    AC_DEFINE([_XOPEN_SOURCE], [700], [POSIX and XPG 7th edition])
-    AC_DEFINE([_XOPEN_SOURCE_EXTENDED], [1], [XPG things and X/Open Unix extensions.])
-    AC_DEFINE([_BSD_SOURCE], [1], [ISO C, POSIX, and 4.3BSD things.])
-    LDFLAGS="${LDFLAGS} -lws2_32"
-    AC_SUBST(WINDOWS_ARCH)
-    AC_SUBST(PROGRAMFILES)
-    ;;
-  *)
-    SYS="${host_os}"
-    ;;
-esac
-
-AM_CONDITIONAL(WIN32, [test "x$SYS" = "xmingw32"])
-AS_IF([test "x$SYS" = "xandroid"],
-      [], [LDFLAGS="${LDFLAGS} -lpthread"])
-
-PKG_PROG_PKG_CONFIG()
-
-AC_ARG_ENABLE([proxy_server], AS_HELP_STRING([--enable-proxy-server], [Enable proxy server ability]), proxy_server=yes, proxy_server=no)
-AM_CONDITIONAL(ENABLE_PROXY_SERVER, test x$proxy_server == xyes)
-
-AC_ARG_ENABLE([push_notifications], AS_HELP_STRING([--enable-push-notifications], [Enable push notifications support]), push_notifications=yes, push_notifications=no)
-AM_CONDITIONAL(ENABLE_PUSH_NOTIFICATIONS, test x$push_notifications == xyes)
-
-AC_ARG_ENABLE([proxy_server_identity], AS_HELP_STRING([--enable-proxy-server-identity],
-	[Enable proxy server ability]), proxy_server_identity=yes, proxy_server_identity=no)
-AM_CONDITIONAL(ENABLE_PROXY_SERVER_IDENTITY, test x$proxy_server_identity == xyes -a x$proxy_server == xyes)
-AC_ARG_ENABLE([proxy_server_identity], AS_HELP_STRING([--enable-proxy-server-identity],
-	[Enable proxy server ability]), proxy_server_identity=yes, proxy_server_identity=no)
-
-AC_ARG_ENABLE([proxy_client], AS_HELP_STRING([--enable-proxy-client], [Enable proxy client ability]), proxy_client=yes, proxy_client=no)
-AM_CONDITIONAL(ENABLE_PROXY_CLIENT, test x$proxy_client == xyes)
-
-AC_ARG_ENABLE([tests], AS_HELP_STRING([--enable-tests], [Enable tests]), build_tests=yes, build_tests=no)
-AM_CONDITIONAL(ENABLE_TESTS, test "x$build_tests" == xyes)
-AS_IF([test "x$build_tests" == xyes], [
-	PKG_CHECK_MODULES([CppUnit], [cppunit >= 1.12])
-])
-
-AM_CONDITIONAL(PROXY_CLIENT_OR_SERVER, test x$proxy_client == xyes || test x$proxy_server == xyes)
-
-PKG_CHECK_MODULES([Nettle], [nettle >= 2.4])
-PKG_CHECK_MODULES([GnuTLS], [gnutls >= 3.3])
-AC_CHECK_HEADERS([msgpack.hpp], [], [
-  PKG_CHECK_MODULES([MsgPack], [msgpack-cxx >= 1.2])
-])
-PKG_CHECK_MODULES([Argon2], [libargon2])
-AC_SUBST(argon2_lib, [", libargon2"])
-
-AC_ARG_WITH([jsoncpp], AS_HELP_STRING([--without-jsoncpp], [Build without JsonCpp support]))
-AS_IF([test "x$with_jsoncpp" != "xno"],
-      [PKG_CHECK_MODULES([JsonCpp], [jsoncpp >= 1.7.2], [have_jsoncpp=yes], [have_jsoncpp=no])
-       PKG_CHECK_MODULES([simdutf], [simdutf >= 6], [have_simdutf=yes], [have_simdutf=no])],
-      [have_jsoncpp=no])
-AS_IF([test "x$have_jsoncpp" = "xyes"], [
-    AC_MSG_NOTICE([Using JsonCpp])
-    CPPFLAGS="${CPPFLAGS} -DOPENDHT_JSONCPP"
-    AC_SUBST(jsoncpp_lib, [", jsoncpp"])
-    AC_SUBST(simdutf_lib, [", simdutf"])
-], [
-    AC_MSG_NOTICE([Not using JsonCpp])
-    AM_COND_IF(PROXY_CLIENT_OR_SERVER, AC_MSG_ERROR(["JsonCpp is required for proxy/push notification support"]))
-])
-
-AC_ARG_WITH([openssl], AS_HELP_STRING([--without-openssl], [Build without OpenSSL support]))
-AS_IF([test "x$with_openssl" != "xno"],
-      [PKG_CHECK_MODULES([OpenSSL], [openssl >= 1.1], [have_openssl=yes], [have_openssl=no])],
-      [have_openssl=no])
-AS_IF([test "x$have_openssl" = "xyes"], [
-    AC_MSG_NOTICE([Using OpenSSL])
-    AC_SUBST(openssl_lib, [", openssl"])
-], [
-    AC_MSG_NOTICE([Not using OpenSSL])
-])
-
-PKG_CHECK_MODULES([Fmt], [fmt >= 5.3.0], [have_fmt=yes], [have_fmt=no])
-AS_IF([test "x$have_fmt" = "xyes"], [
-    AC_MSG_NOTICE([Using libfmt])
-], [
-    AC_MSG_NOTICE([Missing libfmt files])
-])
-
-AM_COND_IF([PROXY_CLIENT_OR_SERVER], [
-    AC_CHECK_HEADERS([asio.hpp],, AC_MSG_ERROR([Missing Asio headers files]))
-    CXXFLAGS="${CXXFLAGS} -DASIO_STANDALONE"
-    PKG_CHECK_MODULES([Llhttp], [libllhttp])
-    llhttp_lib=", libllhttp"
-])
-AC_SUBST(llhttp_lib)
-
-AC_ARG_WITH([liburing], AS_HELP_STRING([--with-liburing], [Build with io_uring support(Linux only)]),[], [with_liburing=no])
-AS_IF([test "x$with_liburing" != "xno"], [
-    CXX_FLAGS="${CXXFLAGS} -DASIO_HAS_IO_URING -DASIO_DISABLE_EPOLL"
-    PKG_CHECK_MODULES([Liburing], [liburing])
-    iouring_lib=", liburing"
-])
-AC_SUBST(iouring_lib)
-
-CXXFLAGS="${CXXFLAGS} -DMSGPACK_NO_BOOST -DMSGPACK_DISABLE_LEGACY_NIL -DMSGPACK_DISABLE_LEGACY_CONVERT"
-
-AC_ARG_ENABLE([tools], AS_HELP_STRING([--disable-tools],[Disable tools (CLI DHT node)]),,build_tools=yes)
-AM_CONDITIONAL(ENABLE_TOOLS, test x$build_tools == xyes)
-AM_COND_IF([ENABLE_TOOLS], [
-  AC_CHECK_HEADERS([readline/readline.h readline/history.h], [],
-    [AC_MSG_ERROR([Unable to find readline.h. Readline is required for the tools.])
-  ])
-])
-
-AM_COND_IF(ENABLE_PROXY_SERVER, AC_DEFINE([OPENDHT_PROXY_SERVER], [], [Building with proxy server]))
-AM_COND_IF(ENABLE_PROXY_CLIENT, AC_DEFINE([OPENDHT_PROXY_CLIENT], [], [Building with proxy client]))
-AM_COND_IF(ENABLE_PUSH_NOTIFICATIONS, [CPPFLAGS="${CPPFLAGS} -DOPENDHT_PUSH_NOTIFICATIONS"], [])
-AM_COND_IF(ENABLE_PROXY_SERVER_IDENTITY, [CPPFLAGS="${CPPFLAGS} -DOPENDHT_PROXY_SERVER_IDENTITY"], [])
-
-dnl Configure setup.py if we build the python module
-AC_SUBST(CURRENT_SOURCE_DIR, ".")
-AC_SUBST(CURRENT_BINARY_DIR, ".")
-AC_SUBST(PROJECT_SOURCE_DIR, "..")
-AC_SUBST(PROJECT_BINARY_DIR, "../src/.libs")
-
-AC_CONFIG_FILES([Makefile
-                 src/Makefile
-                 c/Makefile
-                 tools/Makefile
-                 python/Makefile
-                 python/setup.py
-                 tests/Makefile
-                 doc/Makefile
-                 doc/Doxyfile
-                 opendht.pc])
-AC_MSG_WARN([The Autotools build system for OpenDHT is deprecated and will be removed in a future release. Please use CMake or Meson instead.])
-AC_OUTPUT
@@ -1,16 +0,0 @@
-dist_man1_MANS = dhtnode.1
-
-noinst_HEADERS = \
-	Doxyfile
-
-if HAVE_DOXYGEN
-doxyfile.stamp: Doxyfile
-	$(DOXYGEN) Doxyfile
-	echo stamp > doxyfile.stamp
-
-CLEANFILES = doxyfile.stamp
-
-all-local: doxyfile.stamp
-clean-local:
-	rm -rf $(top_srcdir)/doc/man $(top_srcdir)/doc/html
-endif
@@ -1,102 +1,193 @@
-.TH DHTNODE 1 2019-06-08
+.TH DHTNODE 1 2026-04-18
 .SH NAME
 .B dhtnode
 - a simple OpenDHT command line node runner.
 .SH SYNOPSIS
 .B dhtnode
 [\fB\-h\fR]
+[\fB\-V\fR]
 [\fB\-v\fR [\fB\-l\fR \fIlogfile\fR] [\fB\-L\fR]]
-[\fB\-i\fR [\fB\-\-save\-identity\fR \fIfile\fR]]
+[\fB\-i\fR [\fB\-I\fR \fIfile\fR]]
+[\fB\-c\fR \fIfile\fR]
+[\fB\-k\fR \fIfile\fR]
+[\fB\-m\fR \fIpassword\fR]
 [\fB\-d\fR] [\fB\-s\fR]
+[\fB\-D\fR] [\fB\-U\fR] [\fB\-P\fR]
 [\fB\-n\fR \fInetwork_id\fR]
 [\fB\-p\fR \fIlocal_port\fR]
 [\fB\-b\fR \fIbootstrap_host\fR[:\fIport\fR]]
-[\fB\-\-certificate\fR \fIfile\fR]
-[\fB\-\-privkey\fR \fIfile\fR]
-[\fB\-\-privkey\-password\fR \fIpassword\fR]
-[\fB\-\-proxyserver\fR \fIport\fR]
-[\fB\-\-proxyclient\fR \fIserver\fR]
+[\fB\-f\fR \fIpath\fR]
+[\fB\-S\fR \fIport\fR]
+[\fB\-e\fR \fIport\fR]
+[\fB\-a\fR \fIaddress\fR]
+[\fB\-w\fR \fIfile\fR]
+[\fB\-K\fR \fIfile\fR]
+[\fB\-M\fR \fIpassword\fR]
+[\fB\-C\fR \fIserver\fR]
+[\fB\-y\fR \fIendpoint\fR]
+[\fB\-z\fR \fIkey\fR]
+[\fB\-u\fR \fIbundleid\fR]
 .SH DESCRIPTION
-Runs an OpenDHT node, with a CLI (default) or as a daemon (with \fB'-d'\fP or \fB'-s'\fP).
+Runs an OpenDHT node, with an interactive CLI (default) or as a daemon (with \fB'-d'\fP or \fB'-s'\fP).
 Commands available in the interactive shell are:
 .EX
    h, help    Print this help message.
-    q, quit    Quit the program.
+    x, quit    Quit the program.
    log        Start/stop printing DHT logs.

    Node information:
    ll         Print basic information and stats about the current node.
-    ls         Print basic information about current searches.
-    ld         Print basic information about currenty stored values on this node.
-    lr         Print the full current routing table of this node
+    ls [key]   Print basic information about current search(es).
+    ld [key]   Print basic information about currenty stored values on this
+               node (or for a specific key).
+    lr         Print the full current routing table of this node.

    Operations on the DHT:
-    b ip:port             Ping potential node at given IP address/port.
-    g [key]               Get values at [key].
-    l [key]               Listen for value changes at [key].
-    p [key] [str]         Put string value at [key].
-    s [key] [str]         Put string value at [key], signed with our generated
-                          private key.
-    e [key] [dest] [str]  Put string value at [key], encrypted for [dest] with
-                          its public key (if found).
+    b <ip:port>            Ping potential node at given IP address/port.
+    g <key>                Get values at <key>.
+    l <key>                Listen for value changes at <key>.
+    cl <key> <token>       Cancel listen for <token> and <key>.
+    p <key> <str>          Put string value at <key>.
+    pp <key> <str>         Put string value at <key> (persistent version).
+    cpp <key> <id>         Cancel persistent put operation for <key> and
+                           value <id>.
+    s <key> <str>          Put string value at <key>, signed with our
+                           generated private key.
+    e <key> <dest> <str>   Put string value at <key>, encrypted for <dest>
+                           with its public key (if found).
+    cc                     Trigger connectivity changed signal.
+
+    Operations with the proxy (if compiled with proxy server support):
+    pst [port] <pushServer>  Start the proxy interface on port.
+    psx [port]               Start the proxy SSL interface on port.
+    psp [port]               Stop the proxy interface on port.
+
+    Operations with the proxy (if compiled with proxy client support):
+    stt [server_address] <device_key>  Start the proxy client.
+    stp                                Stop the proxy client.
+    rs  [token]                        Resubscribe to opendht.
+    rp  [token]                        Inject a push notification.
 .EE
 .SH OPTIONS
 .TP
-\fB\-h\fP
-Prints some help.
+\fB\-h\fP, \fB\-\-help\fP
+Prints help and exits.
 .TP
-\fB\-v\fP
-Enable the verbose mode (log to stdout/stderr by default)
+\fB\-V\fP, \fB\-\-version\fP
+Prints version information and exits.
 .TP
-\fB\-l\fP \fIlog_file\fP
-Write log to file instead of stdout/stderr
+\fB\-v\fP, \fB\-\-verbose\fP
+Enable verbose mode (log to stdout/stderr by default).
 .TP
-\fB\-L\fP
-Write log to syslog instead of stdout/stderr
+\fB\-l\fP \fIlogfile\fP, \fB\-\-logfile\fP \fIlogfile\fP
+Write log to file instead of stdout/stderr.
 .TP
-\fB\-i\fP
-Generate cryptographic identity for the node.
+\fB\-L\fP, \fB\-\-syslog\fP
+Write log to syslog instead of stdout/stderr (enables verbose mode).
 .TP
-\fB\-\-save\-identity\fP \fIfile\fP
+\fB\-i\fP, \fB\-\-identity\fP
+Generate a cryptographic identity (RSA key pair and self-signed certificate)
+for the node. Required to perform cryptographic operations (encrypt/sign values)
+if no private key file is provided.
+.TP
+\fB\-I\fP \fIfile\fP, \fB\-\-save\-identity\fP \fIfile\fP
 Save generated identity (certificate and private key) to given file prefix.
+Files are saved as \fIfile\fP and \fIfile\fP_ca.
 .TP
-\fB\-\-certificate\fP \fIfile\fP
-Load identity certificate from given file.
+\fB\-c\fP \fIfile\fP, \fB\-\-certificate\fP \fIfile\fP
+Load identity certificate from given file. If specified, the certificate is
+published on the DHT.
 .TP
-\fB\-\-privkey\fP \fIfile\fP
-Load identity private key from given file.
+\fB\-k\fP \fIfile\fP, \fB\-\-privkey\fP \fIfile\fP
+Load identity private key from given file. Required to perform cryptographic
+operations if no identity is generated.
 .TP
-\fB\-\-privkey\-password\fP \fIpassword\fP
+\fB\-m\fP \fIpassword\fP, \fB\-\-privkey\-password\fP \fIpassword\fP
 Password to use for private key encryption or decryption (optional).
 .TP
-\fB\-d\fP
-Run the program in daemon mode (will fork in the background).
+\fB\-d\fP, \fB\-\-daemonize\fP
+Run the program in daemon mode (will fork in the background). When verbose mode
+is enabled, logs to syslog by default.
 .TP
-\fB\-s\fP
+\fB\-s\fP, \fB\-\-service\fP
 Run the program in service mode (non\-forking daemon).
 .TP
-\fB\-D\fP
+\fB\-D\fP, \fB\-\-peer\-discovery\fP
 Enables multicast automatic local peer discovery.
 .TP
-\fB\-f\fP \fIfile\fP
-Specify a file path to persist/load the node state.
+\fB\-U\fP, \fB\-\-no\-rate\-limit\fP
+Disable rate limiting (allows unlimited requests and storage).
 .TP
-\fB\-n\fP \fInetwork_id\fP
-Specify the network id. This let you connect to distinct networks and prevents
-the merge of two different networks (available since OpenDHT v0.6.1).
+\fB\-P\fP, \fB\-\-public\-stable\fP
+Enable public stable mode.
 .TP
-\fB\-p\fP \fIlocal_port\fP
-Use UDP port \fIlocal_port\fP for the program to bind to.
+\fB\-f\fP \fIpath\fP, \fB\-\-persist\fP \fIpath\fP
+Specify a file path to persist/load the node state (routing table and values).
 .TP
-\fB\-b\fP \fIbootstrap_host\fP[:\fIport\fP]
-The program needs to be given a node to connect to the network. You use this
-option to provide the ip address of that node.
+\fB\-n\fP \fInetwork_id\fP, \fB\-\-net\fP \fInetwork_id\fP
+Specify the network id. This lets you connect to distinct networks and prevents
+the merge of two different networks. Defaults to 0 (the main public network).
 .TP
-\fB\-\-proxyserver\fP \fIlocal_port\fP
-Run a proxy server bound to this DHT node on HTTP port \fIlocal_port\fP
+\fB\-p\fP \fIlocal_port\fP, \fB\-\-port\fP \fIlocal_port\fP
+Use UDP port \fIlocal_port\fP for the program to bind to. If not set, will use
+any available port. The default OpenDHT port for public nodes is 4222.
 .TP
-\fB\-\-proxyclient\fP \fIserver\fP
-Run this DHT node in proxy client mode, and connect to \fIserver\fP
+\fB\-b\fP \fIbootstrap_host\fP[:\fIport\fP], \fB\-\-bootstrap\fP \fIbootstrap_host\fP[:\fIport\fP]
+Specify a bootstrap node address to connect to the network.
+.TP
+\fB\-S\fP \fIlocal_port\fP, \fB\-\-proxyserver\fP \fIlocal_port\fP
+Run a REST API proxy server bound to this DHT node on HTTP port \fIlocal_port\fP.
+.TP
+\fB\-e\fP \fIlocal_port\fP, \fB\-\-proxyserverssl\fP \fIlocal_port\fP
+Run a REST API proxy server with SSL bound to this DHT node on HTTPS port \fIlocal_port\fP.
+.TP
+\fB\-a\fP \fIaddress\fP, \fB\-\-proxy\-addr\fP \fIaddress\fP
+Proxy server bind address.
+.TP
+\fB\-w\fP \fIfile\fP, \fB\-\-proxy\-certificate\fP \fIfile\fP
+Load proxy SSL certificate from given file.
+.TP
+\fB\-K\fP \fIfile\fP, \fB\-\-proxy\-privkey\fP \fIfile\fP
+Load proxy SSL private key from given file.
+.TP
+\fB\-M\fP \fIpassword\fP, \fB\-\-proxy\-privkey\-password\fP \fIpassword\fP
+Password for the proxy private key encryption or decryption (optional).
+.TP
+\fB\-C\fP \fIserver\fP, \fB\-\-proxyclient\fP \fIserver\fP
+Run this DHT node in proxy client mode, and connect to \fIserver\fP.
+.TP
+\fB\-y\fP \fIendpoint\fP, \fB\-\-pushserver\fP \fIendpoint\fP
+Push notification server endpoint.
+.TP
+\fB\-z\fP \fIkey\fP, \fB\-\-devicekey\fP \fIkey\fP
+Device key for push notifications.
+.TP
+\fB\-u\fP \fIbundleid\fP, \fB\-\-bundleid\fP \fIbundleid\fP
+Bundle ID for push notifications.
+.SH EXAMPLES
+Run a node using bootstrap.jami.net as a bootstrap:
+.PP
+.EX
+dhtnode -b bootstrap.jami.net:4222
+.EE
+.PP
+Run a node as a non-forking daemon on port 4222:
+.PP
+.EX
+dhtnode -b bootstrap.jami.net -p 4222 -s
+.EE
+.PP
+Run a proxy server on port 8000:
+.PP
+.EX
+dhtnode -b bootstrap.jami.net:4222 --proxyserver 8000
+.EE
+.PP
+Use a proxy client to connect to a proxy server:
+.PP
+.EX
+dhtnode --proxyclient dhtproxy.jami.net:80
+.EE
 .SH AUTHORS
 .TP
 Program written by
@@ -5,14 +5,16 @@ LABEL org.opencontainers.image.source=https://github.com/savoirfairelinux/opendh
 COPY . opendht

 RUN cd opendht && mkdir build && cd build \
-	&& cmake .. -DCMAKE_INSTALL_PREFIX=/usr \
-				-DCMAKE_INTERPROCEDURAL_OPTIMIZATION=On \
-				-DOPENDHT_C=On \
-				-DOPENDHT_PEER_DISCOVERY=On \
-				-DOPENDHT_PYTHON=On \
-				-DOPENDHT_TOOLS=On \
-				-DOPENDHT_PROXY_SERVER=On \
-				-DOPENDHT_PROXY_CLIENT=On \
-				-DOPENDHT_SYSTEMD=On \
-	&& make -j8 && make install \
+	&& cmake -GNinja .. -DCMAKE_INSTALL_PREFIX=/usr \
+	-DBUILD_TESTING=Off \
+	-DCMAKE_INTERPROCEDURAL_OPTIMIZATION=On \
+	-DCMAKE_BUILD_TYPE=RelWithDebInfo \
+	-DOPENDHT_C=On \
+	-DOPENDHT_PEER_DISCOVERY=On \
+	-DOPENDHT_PYTHON=On \
+	-DOPENDHT_TOOLS=On \
+	-DOPENDHT_PROXY_SERVER=On \
+	-DOPENDHT_PROXY_CLIENT=On \
+	-DOPENDHT_SYSTEMD=On \
+	&& ninja && ninja install \
 	&& cd ../.. && rm -rf opendht
@@ -9,17 +9,19 @@ ENV DESTDIR=/install

 RUN cd opendht && mkdir build && cd build \
 	&& cmake .. -DCMAKE_INSTALL_PREFIX=/usr \
-				-DCMAKE_INTERPROCEDURAL_OPTIMIZATION=On \
-				-DOPENDHT_C=On \
-				-DOPENDHT_PEER_DISCOVERY=On \
-				-DOPENDHT_PYTHON=On \
-				-DOPENDHT_TOOLS=On \
-				-DOPENDHT_PROXY_SERVER=On \
-				-DOPENDHT_PROXY_CLIENT=On \
-				-DOPENDHT_SYSTEMD=On \
+                -DCMAKE_INTERPROCEDURAL_OPTIMIZATION=On \
+                -DCMAKE_BUILD_TYPE=RelWithDebInfo \
+                -DBUILD_TESTING=Off \
+                -DOPENDHT_C=On \
+                -DOPENDHT_PEER_DISCOVERY=On \
+                -DOPENDHT_PYTHON=On \
+                -DOPENDHT_TOOLS=On \
+                -DOPENDHT_PROXY_SERVER=On \
+                -DOPENDHT_PROXY_CLIENT=On \
+                -DOPENDHT_SYSTEMD=On \
 	&& make -j8 && make install

-FROM alpine:3.23 AS install
+FROM alpine:3.24 AS install
 COPY --from=build /install /
 RUN apk add --no-cache \
        libstdc++ \
@@ -8,7 +8,7 @@ RUN mkdir /install
 ENV DESTDIR=/install

 RUN cd opendht && mkdir build && cd build \
-	&& cmake .. -DCMAKE_INSTALL_PREFIX=/usr \
+	&& cmake .. -GNinja -DCMAKE_INSTALL_PREFIX=/usr \
                -DOPENDHT_DOWNLOAD_DEPS=Off \
                -DCMAKE_BUILD_TYPE=RelWithDebInfo \
                -DCMAKE_INTERPROCEDURAL_OPTIMIZATION=On \
@@ -19,7 +19,7 @@ RUN cd opendht && mkdir build && cd build \
                -DOPENDHT_PROXY_SERVER=On \
                -DOPENDHT_PROXY_CLIENT=On \
                -DOPENDHT_SYSTEMD=On \
-	&& make -j8 && make install
+	&& ninja && ninja install

 FROM alpine:edge AS install
 COPY --from=build /install /
@@ -32,10 +32,9 @@ RUN apk add --no-cache \
        jsoncpp \
        llhttp \
        fmt \
+        simdutf \
        readline \
-        ncurses \
-        gdb
-#CMD ["dhtnode", "-b", "bootstrap.jami.net", "-p", "4222", "--proxyserver", "8080"]
+        ncurses
+CMD ["dhtnode", "-b", "bootstrap.jami.net", "-p", "4222", "--proxyserver", "8080"]
 EXPOSE 4222/udp
 EXPOSE 8080/tcp
-CMD ["/bin/sh"]
@@ -1,32 +1,34 @@
-FROM ubuntu:24.04
+FROM ubuntu:26.04
 LABEL maintainer="Adrien Béraud <adrien.beraud@savoirfairelinux.com>"
 LABEL org.opencontainers.image.source=https://github.com/savoirfairelinux/opendht

 RUN apt-get update && apt-get install -y \
-        dialog apt-utils \
+    dialog apt-utils \
    && apt-get clean \
    && echo 'debconf debconf/frontend select Noninteractive' | debconf-set-selections

 RUN apt-get update && apt-get install -y \
-        build-essential pkg-config cmake git wget meson \
-        libtool autotools-dev autoconf \
-        python3-dev python3-setuptools python3-build python3-virtualenv cython3 \
-        libncurses5-dev libreadline-dev nettle-dev libcppunit-dev \
-        libgnutls28-dev libuv1-dev libjsoncpp-dev libargon2-dev \
-        libssl-dev libfmt-dev libasio-dev libmsgpack-dev \
+    build-essential pkg-config cmake git wget meson ninja-build \
+    libtool \
+    python3-dev python3-setuptools python3-build python3-virtualenv cython3 \
+    libncurses5-dev libreadline-dev nettle-dev libcppunit-dev \
+    libgnutls28-dev libuv1-dev libjsoncpp-dev libargon2-dev \
+    libssl-dev libfmt-dev libasio-dev libmsgpack-cxx-dev \
+    libllhttp-dev libsimdutf-dev \
    && apt-get clean && rm -rf /var/lib/apt/lists/* /var/cache/apt/*

 RUN mkdir /usr/include/nonstd \
    && wget https://raw.githubusercontent.com/martinmoene/expected-lite/master/include/nonstd/expected.hpp \
-            -O /usr/include/nonstd/expected.hpp
+    -O /usr/include/nonstd/expected.hpp

+ARG RESTINIO_VERSION=0.7.10
 RUN echo "*** Downloading RESTinio ***" \
    && mkdir restinio && cd restinio \
-    && wget https://github.com/Stiffstream/restinio/releases/download/v.0.7.3/restinio-0.7.3.tar.bz2 \
-    && ls -l && tar -xjf restinio-0.7.3.tar.bz2 \
-    && cd restinio-0.7.3/dev \
+    && wget "https://github.com/Stiffstream/restinio/releases/download/v${RESTINIO_VERSION}/restinio-${RESTINIO_VERSION}.tar.bz2" \
+    && ls -l && tar -xjf "restinio-${RESTINIO_VERSION}.tar.bz2" \
+    && cd "restinio-${RESTINIO_VERSION}/dev" \
    && cmake -DCMAKE_INSTALL_PREFIX=/usr -DRESTINIO_TEST=Off -DRESTINIO_SAMPLE=Off -DRESTINIO_BENCHMARK=Off \
-             -DRESTINIO_WITH_SOBJECTIZER=Off -DRESTINIO_DEP_STANDALONE_ASIO=system -DRESTINIO_DEP_LLHTTP=system \
-             -DRESTINIO_DEP_FMT=system -DRESTINIO_DEP_EXPECTED_LITE=system . \
+    -DRESTINIO_WITH_SOBJECTIZER=Off -DRESTINIO_DEP_STANDALONE_ASIO=system -DRESTINIO_DEP_LLHTTP=system \
+    -DRESTINIO_DEP_FMT=system -DRESTINIO_DEP_EXPECTED_LITE=system . \
    && make -j2 && make install \
    && cd ../../ && rm -rf restinio*
@@ -1,4 +1,4 @@
-FROM alpine:3.23
+FROM alpine:3.24
 LABEL maintainer="Adrien Béraud <adrien.beraud@savoirfairelinux.com>"
 LABEL org.opencontainers.image.source=https://github.com/savoirfairelinux/opendht

@@ -7,7 +7,7 @@ RUN apk add --no-cache \
        cython python3-dev py3-setuptools \
        ncurses-dev readline-dev nettle-dev \
        cppunit-dev gnutls-dev jsoncpp-dev \
-        argon2-dev openssl-dev fmt-dev \
+        argon2-dev openssl-dev fmt-dev simdutf-dev \
        llhttp-dev asio-dev msgpack-cxx-dev \
    && rm -rf /var/cache/apk/*

@@ -15,11 +15,12 @@ RUN mkdir /usr/include/nonstd \
    && wget https://raw.githubusercontent.com/martinmoene/expected-lite/master/include/nonstd/expected.hpp \
            -O /usr/include/nonstd/expected.hpp

+ARG RESTINIO_VERSION=0.7.10
 RUN echo "*** Downloading RESTinio ***" \
    && mkdir restinio && cd restinio \
-    && wget https://github.com/Stiffstream/restinio/releases/download/v.0.7.3/restinio-0.7.3.tar.bz2 \
-    && ls -l && tar -xjf restinio-0.7.3.tar.bz2 \
-    && cd restinio-0.7.3/dev \
+    && wget "https://github.com/Stiffstream/restinio/releases/download/v${RESTINIO_VERSION}/restinio-${RESTINIO_VERSION}.tar.bz2" \
+    && ls -l && tar -xjf "restinio-${RESTINIO_VERSION}.tar.bz2" \
+    && cd "restinio-${RESTINIO_VERSION}/dev" \
    && cmake -DCMAKE_INSTALL_PREFIX=/usr -DRESTINIO_TEST=Off -DRESTINIO_SAMPLE=Off -DRESTINIO_BENCHMARK=Off \
             -DRESTINIO_WITH_SOBJECTIZER=Off -DRESTINIO_DEP_STANDALONE_ASIO=system -DRESTINIO_DEP_LLHTTP=system \
             -DRESTINIO_DEP_FMT=system -DRESTINIO_DEP_EXPECTED_LITE=system . \
@@ -7,7 +7,7 @@ RUN apk add --no-cache \
        cython python3-dev py3-setuptools \
        ncurses-dev readline-dev nettle-dev \
        cppunit-dev gnutls-dev jsoncpp-dev \
-        argon2-dev openssl-dev fmt-dev \
+        argon2-dev openssl-dev fmt-dev simdutf-dev \
        llhttp-dev asio-dev msgpack-cxx-dev \
    && rm -rf /var/cache/apk/*

@@ -15,13 +15,14 @@ RUN mkdir /usr/include/nonstd \
    && wget https://raw.githubusercontent.com/martinmoene/expected-lite/master/include/nonstd/expected.hpp \
            -O /usr/include/nonstd/expected.hpp

+ARG RESTINIO_VERSION=0.7.10
 RUN echo "*** Downloading RESTinio ***" \
    && mkdir restinio && cd restinio \
-    && wget https://github.com/Stiffstream/restinio/releases/download/v.0.7.3/restinio-0.7.3.tar.bz2 \
-    && ls -l && tar -xjf restinio-0.7.3.tar.bz2 \
-    && cd restinio-0.7.3/dev \
-    && cmake -DCMAKE_INSTALL_PREFIX=/usr -DRESTINIO_TEST=Off -DRESTINIO_SAMPLE=Off -DRESTINIO_BENCHMARK=Off \
+    && wget "https://github.com/Stiffstream/restinio/releases/download/v${RESTINIO_VERSION}/restinio-${RESTINIO_VERSION}.tar.bz2" \
+    && ls -l && tar -xjf "restinio-${RESTINIO_VERSION}.tar.bz2" \
+    && cd "restinio-${RESTINIO_VERSION}/dev" \
+    && cmake -GNinja -DCMAKE_INSTALL_PREFIX=/usr -DRESTINIO_TEST=Off -DRESTINIO_SAMPLE=Off -DRESTINIO_BENCHMARK=Off \
             -DRESTINIO_WITH_SOBJECTIZER=Off -DRESTINIO_DEP_STANDALONE_ASIO=system -DRESTINIO_DEP_LLHTTP=system \
             -DRESTINIO_DEP_FMT=system -DRESTINIO_DEP_EXPECTED_LITE=system . \
-    && make -j2 && make install \
+    && ninja && ninja install \
    && cd ../../ && rm -rf restinio*
@@ -3,32 +3,46 @@ LABEL maintainer="Adrien Béraud <adrien.beraud@savoirfairelinux.com>"
 LABEL org.opencontainers.image.source=https://github.com/savoirfairelinux/opendht

 RUN apt-get update && apt-get install -y \
-        dialog apt-utils \
+    dialog apt-utils \
    && apt-get clean \
    && echo 'debconf debconf/frontend select Noninteractive' | debconf-set-selections

 RUN apt-get update && apt-get install -y \
-        build-essential pkg-config cmake git wget \
-        libtool autotools-dev autoconf \
-        python3-dev python3-setuptools python3-pip \
-        libncurses5-dev libreadline-dev nettle-dev libcppunit-dev \
-        libgnutls28-dev libuv1-dev libjsoncpp-dev libargon2-dev \
-        libssl-dev libfmt-dev libasio-dev libmsgpack-dev \
+    build-essential pkg-config cmake git wget \
+    libtool \
+    python3-dev python3-setuptools python3-pip \
+    libncurses5-dev libreadline-dev nettle-dev libcppunit-dev \
+    libgnutls28-dev libuv1-dev libjsoncpp-dev libargon2-dev \
+    libssl-dev libfmt-dev libasio-dev libmsgpack-dev \
    && apt-get clean && rm -rf /var/lib/apt/lists/* /var/cache/apt/*

 RUN pip3 install meson Cython

+ARG SIMDUTF_VERSION=8.0.0
+RUN mkdir simdutf \
+    && wget -q "https://github.com/simdutf/simdutf/archive/refs/tags/v${SIMDUTF_VERSION}.tar.gz" -O simdutf.tar.gz \
+    && tar -xzf simdutf.tar.gz -C simdutf --strip-components=1 \
+    && cmake -S simdutf -B simdutf/build -DCMAKE_BUILD_TYPE=Release \
+        -DCMAKE_INSTALL_PREFIX=/usr/local -DCMAKE_POSITION_INDEPENDENT_CODE=ON \
+        -DBUILD_SHARED_LIBS=OFF -DSIMDUTF_TESTS=OFF -DSIMDUTF_TOOLS=OFF \
+    && cmake --build simdutf/build --parallel 2 \
+    && cmake --install simdutf/build \
+    && install -D simdutf/LICENSE-MIT /usr/share/doc/simdutf/LICENSE-MIT \
+    && install -D simdutf/LICENSE-APACHE /usr/share/doc/simdutf/LICENSE-APACHE \
+    && rm -rf simdutf simdutf.tar.gz
+
 RUN mkdir /usr/include/nonstd \
    && wget https://raw.githubusercontent.com/martinmoene/expected-lite/master/include/nonstd/expected.hpp \
-            -O /usr/include/nonstd/expected.hpp
+    -O /usr/include/nonstd/expected.hpp

+ARG RESTINIO_VERSION=0.7.10
 RUN echo "*** Downloading RESTinio ***" \
    && mkdir restinio && cd restinio \
-    && wget https://github.com/Stiffstream/restinio/releases/download/v.0.7.3/restinio-0.7.3.tar.bz2 \
-    && ls -l && tar -xjf restinio-0.7.3.tar.bz2 \
-    && cd restinio-0.7.3/dev \
+    && wget "https://github.com/Stiffstream/restinio/releases/download/v${RESTINIO_VERSION}/restinio-${RESTINIO_VERSION}.tar.bz2" \
+    && ls -l && tar -xjf "restinio-${RESTINIO_VERSION}.tar.bz2" \
+    && cd "restinio-${RESTINIO_VERSION}/dev" \
    && cmake -DCMAKE_INSTALL_PREFIX=/usr -DRESTINIO_TEST=Off -DRESTINIO_SAMPLE=Off -DRESTINIO_BENCHMARK=Off \
-             -DRESTINIO_WITH_SOBJECTIZER=Off -DRESTINIO_DEP_STANDALONE_ASIO=system -DRESTINIO_DEP_LLHTTP=system \
-             -DRESTINIO_DEP_FMT=system -DRESTINIO_DEP_EXPECTED_LITE=system . \
+    -DRESTINIO_WITH_SOBJECTIZER=Off -DRESTINIO_DEP_STANDALONE_ASIO=system -DRESTINIO_DEP_LLHTTP=system \
+    -DRESTINIO_DEP_FMT=system -DRESTINIO_DEP_EXPECTED_LITE=system . \
    && make -j2 && make install \
    && cd ../../ && rm -rf restinio*
@@ -1,19 +1,19 @@
-FROM ubuntu:24.04
+FROM ubuntu:26.04
 LABEL maintainer="Adrien Béraud <adrien.beraud@savoirfairelinux.com>"
 LABEL org.opencontainers.image.source=https://github.com/savoirfairelinux/opendht

 RUN apt-get update && apt-get install -y \
-        dialog apt-utils \
+    dialog apt-utils \
    && apt-get clean \
    && echo 'debconf debconf/frontend select Noninteractive' | debconf-set-selections

 RUN apt-get update \
    && apt-get install -y llvm llvm-dev lldb clang gdb make cmake meson pkg-config \
-       libtool git wget libncurses5-dev libreadline-dev \
-       nettle-dev libgnutls28-dev libuv1-dev libmsgpack-dev libjsoncpp-dev python3-dev \
-       python3-setuptools libcppunit-dev python3-pip python3-build python3-virtualenv \
-       autotools-dev autoconf libssl-dev libargon2-dev \
-       libfmt-dev libasio-dev \
+    libtool git wget libncurses5-dev libreadline-dev \
+    nettle-dev libgnutls28-dev libuv1-dev libmsgpack-cxx-dev libjsoncpp-dev python3-dev \
+    python3-setuptools libcppunit-dev python3-pip python3-build python3-virtualenv \
+    libssl-dev libargon2-dev libllhttp-dev libsimdutf-dev \
+    libfmt-dev libasio-dev \
    && apt-get remove -y gcc g++ && apt-get autoremove -y \
    && apt-get clean && rm -rf /var/lib/apt/lists/* /var/cache/apt/*

@@ -24,15 +24,16 @@ ENV CXX=c++

 RUN mkdir /usr/include/nonstd \
    && wget https://raw.githubusercontent.com/martinmoene/expected-lite/master/include/nonstd/expected.hpp \
-            -O /usr/include/nonstd/expected.hpp
+    -O /usr/include/nonstd/expected.hpp

+ARG RESTINIO_VERSION=0.7.10
 RUN echo "*** Downloading RESTinio ***" \
    && mkdir restinio && cd restinio \
-    && wget https://github.com/Stiffstream/restinio/releases/download/v.0.7.3/restinio-0.7.3.tar.bz2 \
-    && ls -l && tar -xjf restinio-0.7.3.tar.bz2 \
-    && cd restinio-0.7.3/dev \
+    && wget "https://github.com/Stiffstream/restinio/releases/download/v${RESTINIO_VERSION}/restinio-${RESTINIO_VERSION}.tar.bz2" \
+    && ls -l && tar -xjf "restinio-${RESTINIO_VERSION}.tar.bz2" \
+    && cd "restinio-${RESTINIO_VERSION}/dev" \
    && cmake -DCMAKE_INSTALL_PREFIX=/usr -DRESTINIO_TEST=Off -DRESTINIO_SAMPLE=Off -DRESTINIO_BENCHMARK=Off \
-             -DRESTINIO_WITH_SOBJECTIZER=Off -DRESTINIO_DEP_STANDALONE_ASIO=system -DRESTINIO_DEP_LLHTTP=system \
-             -DRESTINIO_DEP_FMT=system -DRESTINIO_DEP_EXPECTED_LITE=system . \
+    -DRESTINIO_WITH_SOBJECTIZER=Off -DRESTINIO_DEP_STANDALONE_ASIO=system -DRESTINIO_DEP_LLHTTP=system \
+    -DRESTINIO_DEP_FMT=system -DRESTINIO_DEP_EXPECTED_LITE=system . \
    && make -j2 && make install \
    && cd ../../ && rm -rf restinio*
@@ -0,0 +1,56 @@
+FROM ubuntu:24.04
+LABEL maintainer="Adrien Béraud <adrien.beraud@savoirfairelinux.com>"
+LABEL org.opencontainers.image.source=https://github.com/savoirfairelinux/opendht
+
+RUN apt-get update && apt-get install -y \
+    dialog apt-utils \
+    && apt-get clean \
+    && echo 'debconf debconf/frontend select Noninteractive' | debconf-set-selections
+
+RUN apt-get update && apt-get install -y \
+    build-essential pkg-config cmake git wget meson ninja-build patchelf \
+    libtool \
+    python3-dev python3-setuptools python3-build python3-virtualenv cython3 \
+    libncurses5-dev libreadline-dev nettle-dev libcppunit-dev \
+    libgnutls28-dev libuv1-dev libjsoncpp-dev libargon2-dev \
+    libssl-dev libfmt-dev libasio-dev libmsgpack-cxx-dev \
+    && apt-get clean && rm -rf /var/lib/apt/lists/* /var/cache/apt/*
+
+ARG LLHTTP_VERSION=9.2.1
+RUN mkdir llhttp \
+    && wget -q "https://github.com/nodejs/llhttp/archive/refs/tags/release/v${LLHTTP_VERSION}.tar.gz" -O llhttp.tar.gz \
+    && tar -xzf llhttp.tar.gz -C llhttp --strip-components=1 \
+    && cmake -S llhttp -B llhttp/build -DCMAKE_BUILD_TYPE=Release -DCMAKE_INSTALL_PREFIX=/usr \
+    && cmake --build llhttp/build --parallel 2 \
+    && cmake --install llhttp/build \
+    && rm -rf llhttp llhttp.tar.gz
+
+ARG SIMDUTF_VERSION=8.0.0
+RUN mkdir simdutf \
+    && wget -q "https://github.com/simdutf/simdutf/archive/refs/tags/v${SIMDUTF_VERSION}.tar.gz" -O simdutf.tar.gz \
+    && tar -xzf simdutf.tar.gz -C simdutf --strip-components=1 \
+    && cmake -S simdutf -B simdutf/build -DCMAKE_BUILD_TYPE=Release \
+        -DCMAKE_INSTALL_PREFIX=/usr/local -DCMAKE_POSITION_INDEPENDENT_CODE=ON \
+        -DBUILD_SHARED_LIBS=OFF -DSIMDUTF_TESTS=OFF -DSIMDUTF_TOOLS=OFF \
+    && cmake --build simdutf/build --parallel 2 \
+    && cmake --install simdutf/build \
+    && install -D simdutf/LICENSE-MIT /usr/share/doc/simdutf/LICENSE-MIT \
+    && install -D simdutf/LICENSE-APACHE /usr/share/doc/simdutf/LICENSE-APACHE \
+    && rm -rf simdutf simdutf.tar.gz
+
+RUN mkdir /usr/include/nonstd \
+    && wget https://raw.githubusercontent.com/martinmoene/expected-lite/master/include/nonstd/expected.hpp \
+    -O /usr/include/nonstd/expected.hpp
+
+ARG RESTINIO_VERSION=0.7.10
+RUN echo "*** Downloading RESTinio ***" \
+    && mkdir restinio && cd restinio \
+    && wget "https://github.com/Stiffstream/restinio/releases/download/v${RESTINIO_VERSION}/restinio-${RESTINIO_VERSION}.tar.bz2" \
+    && ls -l && tar -xjf "restinio-${RESTINIO_VERSION}.tar.bz2" \
+    && cd "restinio-${RESTINIO_VERSION}/dev" \
+    && cmake -DCMAKE_INSTALL_PREFIX=/usr -DRESTINIO_TEST=Off -DRESTINIO_SAMPLE=Off -DRESTINIO_BENCHMARK=Off \
+    -DRESTINIO_WITH_SOBJECTIZER=Off -DRESTINIO_DEP_STANDALONE_ASIO=system -DRESTINIO_DEP_LLHTTP=system \
+    -DRESTINIO_DEP_FMT=system -DRESTINIO_DEP_EXPECTED_LITE=system . \
+    && make -j2 && make install \
+    && cd ../../ && rm -rf restinio* \
+    && ldconfig
@@ -6,7 +6,9 @@ COPY . opendht

 RUN cd opendht && mkdir build && cd build \
 	&& cmake .. -DCMAKE_INSTALL_PREFIX=/usr \
+				-DBUILD_TESTING=Off \
 				-DCMAKE_INTERPROCEDURAL_OPTIMIZATION=On \
+				-DCMAKE_BUILD_TYPE=RelWithDebInfo \
 				-DOPENDHT_C=On \
 				-DOPENDHT_PEER_DISCOVERY=On \
 				-DOPENDHT_PYTHON=On \
@@ -7,6 +7,7 @@ COPY . opendht
 RUN cd opendht && mkdir build && cd build \
 	&& cmake .. -DCMAKE_INSTALL_PREFIX=/usr \
 				-DCMAKE_INTERPROCEDURAL_OPTIMIZATION=On \
+				-DCMAKE_BUILD_TYPE=RelWithDebInfo \
 				-DOPENDHT_C=On \
 				-DOPENDHT_PEER_DISCOVERY=On \
 				-DOPENDHT_PYTHON=On \
@@ -0,0 +1,20 @@
+FROM ghcr.io/savoirfairelinux/opendht/opendht-deps-noble:latest
+LABEL maintainer="Adrien Béraud <adrien.beraud@savoirfairelinux.com>"
+LABEL org.opencontainers.image.source=https://github.com/savoirfairelinux/opendht
+
+COPY . opendht
+
+RUN cd opendht && mkdir build && cd build \
+	&& cmake .. -DCMAKE_INSTALL_PREFIX=/usr \
+	-DBUILD_TESTING=Off \
+	-DCMAKE_INTERPROCEDURAL_OPTIMIZATION=On \
+	-DCMAKE_BUILD_TYPE=RelWithDebInfo \
+	-DOPENDHT_C=On \
+	-DOPENDHT_PEER_DISCOVERY=On \
+	-DOPENDHT_PYTHON=On \
+	-DOPENDHT_TOOLS=On \
+	-DOPENDHT_PROXY_SERVER=On \
+	-DOPENDHT_PROXY_CLIENT=On \
+	-DOPENDHT_SYSTEMD=On \
+	&& make -j8 && make install \
+	&& cd ../.. && rm -rf opendht
@@ -1,21 +1,5 @@
-/*
- *  Copyright (C) 2014-2025 Savoir-faire Linux Inc.
- *  Author : Adrien Béraud <adrien.beraud@savoirfairelinux.com>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 3 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program. If not, see <https://www.gnu.org/licenses/>.
- */
-
+// Copyright (c) 2014-2026 Savoir-faire Linux Inc.
+// SPDX-License-Identifier: MIT
 #pragma once

 #include "opendht/dhtrunner.h"
@@ -1,23 +1,5 @@
-/*
- *  Copyright (C) 2014-2025 Savoir-faire Linux Inc.
- *  Authors: Adrien Béraud <adrien.beraud@savoirfairelinux.com>
- *           Simon Désaulniers <simon.desaulniers@savoirfairelinux.com>
- *           Sébastien Blin <sebastien.blin@savoirfairelinux.com>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 3 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program. If not, see <https://www.gnu.org/licenses/>.
- */
-
+// Copyright (c) 2014-2026 Savoir-faire Linux Inc.
+// SPDX-License-Identifier: MIT
 #pragma once

 #include "infohash.h"
@@ -41,22 +23,20 @@ struct Node;
 */
 enum class NodeStatus {
    Disconnected, // 0 nodes
-    Connecting,   // 1+ nodes
+    Connecting,   // bootstrap pending or 1+ nodes
    Connected     // 1+ good nodes
 };

-inline constexpr const char*
-statusToStr(NodeStatus status) {
-    return status == NodeStatus::Connected  ? "connected"  : (
-           status == NodeStatus::Connecting ? "connecting" :
-                                              "disconnected");
+inline constexpr std::string_view
+statusToStr(NodeStatus status)
+{
+    return status == NodeStatus::Connected ? "connected"sv
+                                           : (status == NodeStatus::Connecting ? "connecting"sv : "disconnected"sv);
 }

-struct OPENDHT_PUBLIC NodeStats {
-    unsigned good_nodes {0},
-             dubious_nodes {0},
-             cached_nodes {0},
-             incoming_nodes {0};
+struct OPENDHT_PUBLIC NodeStats
+{
+    unsigned good_nodes {0}, dubious_nodes {0}, cached_nodes {0}, incoming_nodes {0};
    unsigned table_depth {0};
    unsigned searches {0};
    unsigned node_cache_size {0};
@@ -76,7 +56,8 @@ struct OPENDHT_PUBLIC NodeStats {
    MSGPACK_DEFINE_MAP(good_nodes, dubious_nodes, cached_nodes, incoming_nodes, table_depth, searches, node_cache_size)
 };

-struct OPENDHT_PUBLIC NodeInfo {
+struct OPENDHT_PUBLIC NodeInfo
+{
    InfoHash id;
    InfoHash node_id;
    NodeStats ipv4 {};
@@ -84,6 +65,8 @@ struct OPENDHT_PUBLIC NodeInfo {
    size_t ongoing_ops {0};
    size_t storage_values {0};
    size_t storage_size {0};
+    size_t local_storage_values {0};
+    size_t local_storage_size {0};
    in_port_t bound4 {0};
    in_port_t bound6 {0};

@@ -96,13 +79,24 @@ struct OPENDHT_PUBLIC NodeInfo {
    explicit NodeInfo(const Json::Value& v);
 #endif

-    MSGPACK_DEFINE_MAP(id, node_id, ipv4, ipv6)
+    MSGPACK_DEFINE_MAP(id,
+                       node_id,
+                       ipv4,
+                       ipv6,
+                       ongoing_ops,
+                       storage_values,
+                       storage_size,
+                       local_storage_values,
+                       local_storage_size,
+                       bound4,
+                       bound6)
 };

 /**
 * Dht configuration.
 */
-struct OPENDHT_PUBLIC Config {
+struct OPENDHT_PUBLIC Config
+{
    /** DHT node ID */
    InfoHash node_id {};

@@ -131,9 +125,12 @@ struct OPENDHT_PUBLIC Config {
    /* If non-0, overrides the default maximum number of searches. -1 means no limit.  */
    ssize_t max_searches {0};

-    /* If non-0, overrides the default maximum store size. -1 means no limit.  */
+    /* If non-0, overrides the default maximum store size for remote values. -1 means no limit.  */
    ssize_t max_store_size {0};

+    /* If non-0, overrides the default maximum store size for locally stored values. -1 means no limit.  */
+    ssize_t max_local_store_size {0};
+
    /* If non-0, overrides the default maximum store key count. -1 means no limit.  */
    ssize_t max_store_keys {0};

@@ -163,7 +160,7 @@ struct OPENDHT_PUBLIC SecureDhtConfig
    bool cert_cache_all {false};
 };

-enum class OPENDHT_PUBLIC PushNotificationResult: uint8_t {
+enum class OPENDHT_PUBLIC PushNotificationResult : uint8_t {
    /* success codes */
    PutRefresh,
    ListenRefresh,
@@ -177,7 +174,8 @@ enum class OPENDHT_PUBLIC PushNotificationResult: uint8_t {
    Error
 };

-static constexpr size_t DEFAULT_STORAGE_LIMIT {1024 * 1024 * 64};
+static constexpr size_t STORAGE_LIMIT_DEFAULT {1024 * 1024 * 64};
+static constexpr size_t STORAGE_LIMIT_UNLIMITED {(size_t) -1};

 using ValuesExport = std::pair<InfoHash, Blob>;

@@ -189,19 +187,17 @@ using ShutdownCallback = std::function<void()>;
 using IdentityAnnouncedCb = std::function<void(bool)>;
 using PublicAddressChangedCb = std::function<void(std::vector<SockAddr>)>;

-using CertificateStoreQueryLegacy = std::function<std::vector<std::shared_ptr<crypto::Certificate>>(const InfoHash& pk_id)>;
 using CertificateStoreQuery = std::function<std::vector<std::shared_ptr<crypto::Certificate>>(const PkId& pk_id)>;

 using DoneCallback = std::function<void(bool success, const std::vector<std::shared_ptr<Node>>& nodes)>;
 using DoneCallbackSimple = std::function<void(bool success)>;

-typedef bool (*GetCallbackRaw)(std::shared_ptr<Value>, void *user_data);
-typedef bool (*ValueCallbackRaw)(std::shared_ptr<Value>, bool expired, void *user_data);
-typedef void (*DoneCallbackRaw)(bool, std::vector<std::shared_ptr<Node>>*, void *user_data);
-typedef void (*ShutdownCallbackRaw)(void *user_data);
-typedef void (*DoneCallbackSimpleRaw)(bool, void *user_data);
-typedef bool (*FilterRaw)(const Value&, void *user_data);
-
+typedef bool (*GetCallbackRaw)(std::shared_ptr<Value>, void* user_data);
+typedef bool (*ValueCallbackRaw)(std::shared_ptr<Value>, bool expired, void* user_data);
+typedef void (*DoneCallbackRaw)(bool, std::vector<std::shared_ptr<Node>>*, void* user_data);
+typedef void (*ShutdownCallbackRaw)(void* user_data);
+typedef void (*DoneCallbackSimpleRaw)(bool, void* user_data);
+typedef bool (*FilterRaw)(const Value&, void* user_data);

 OPENDHT_PUBLIC GetCallbackSimple bindGetCb(GetCallbackRaw raw_cb, void* user_data);
 OPENDHT_PUBLIC GetCallback bindGetCb(GetCallbackSimple cb);
@@ -212,4 +208,4 @@ OPENDHT_PUBLIC DoneCallback bindDoneCb(DoneCallbackRaw raw_cb, void* user_data);
 OPENDHT_PUBLIC DoneCallbackSimple bindDoneCbSimple(DoneCallbackSimpleRaw raw_cb, void* user_data);
 OPENDHT_PUBLIC Value::Filter bindFilterRaw(FilterRaw raw_filter, void* user_data);

-}
+} // namespace dht
@@ -1,20 +1,5 @@
-/*
- *  Copyright (C) 2014-2025 Savoir-faire Linux Inc.
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 3 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program. If not, see <https://www.gnu.org/licenses/>.
- */
-
+// Copyright (c) 2014-2026 Savoir-faire Linux Inc.
+// SPDX-License-Identifier: MIT
 #pragma once

 #include "infohash.h"
@@ -219,7 +204,13 @@ struct OPENDHT_PUBLIC PrivateKey
     * @param algo : the public key algorithm to use, GNUTLS_PK_RSA or GNUTLS_PK_RSA_OAEP
     */
    static PrivateKey generate(unsigned key_length = 4096, gnutls_pk_algorithm_t algo = GNUTLS_PK_RSA);
-    static PrivateKey generateEC();
+
+    /**
+     * Generate a new EC key pair
+     * @param curve : the elliptic curve to use. If GNUTLS_ECC_CURVE_INVALID is provided, the default curve will be used
+     * (currently GNUTLS_ECC_CURVE_SECP384R1).
+     */
+    static PrivateKey generateEC(gnutls_ecc_curve_t curve = GNUTLS_ECC_CURVE_INVALID);

    gnutls_privkey_t key {};
    gnutls_x509_privkey_t x509_key {};
@@ -229,7 +220,7 @@ private:
    PrivateKey& operator=(const PrivateKey&) = delete;
    Blob decryptBloc(const uint8_t* src, size_t src_size) const;

-    mutable std::mutex publicKeyMutex_ {};
+    mutable std::mutex publicKeyMutex_;
    mutable std::shared_ptr<PublicKey> publicKey_ {};
 };

@@ -282,9 +273,15 @@ public:
    /**
     * Sign this revocation list using provided key and certificate.
     * Validity_period sets the duration until next update (default to no next update).
+     * If `number` is non-zero, it is stored verbatim (big-endian) as the CRL Number
+     * extension. Otherwise the number is initialized randomly on the first signature
+     * and incremented on subsequent ones.
     */
-    void sign(const PrivateKey&, const Certificate&, duration validity_period = {});
-    void sign(const Identity& id) { sign(*id.first, *id.second); }
+    void sign(const PrivateKey&, const Certificate&, duration validity_period = {}, uint64_t number = 0);
+    void sign(const Identity& id, duration validity_period = {}, uint64_t number = 0)
+    {
+        sign(*id.first, *id.second, validity_period, number);
+    }

    bool isSignedBy(const Certificate& issuer) const;

@@ -700,7 +697,7 @@ private:

    std::set<std::shared_ptr<RevocationList>, crlNumberCmp> revocation_lists;

-    mutable std::mutex publicKeyMutex_ {};
+    mutable std::mutex publicKeyMutex_;
    mutable std::shared_ptr<PublicKey> publicKey_ {};
 };

@@ -1,19 +1,5 @@
-/*
- *  Copyright (C) 2014-2025 Savoir-faire Linux Inc.
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 3 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program. If not, see <https://www.gnu.org/licenses/>.
- */
+// Copyright (c) 2014-2026 Savoir-faire Linux Inc.
+// SPDX-License-Identifier: MIT
 #pragma once

 #include <vector>
@@ -22,71 +8,91 @@
 namespace dht {
 namespace crypto {

-template <class T>
+template<class T>
 class secure_vector
 {
 public:
    secure_vector() {}
    secure_vector(secure_vector<T> const&) = default;
-    secure_vector(secure_vector<T> &&) = default;
-    explicit secure_vector(unsigned size): data_(size) {}
-    explicit secure_vector(unsigned size, T _item): data_(size, _item) {}
-    explicit secure_vector(const std::vector<T>& c): data_(c) {}
-    secure_vector(std::vector<T>&& c): data_(std::move(c)) {}
+    secure_vector(secure_vector<T>&&) = default;
+    explicit secure_vector(unsigned size)
+        : data_(size)
+    {}
+    explicit secure_vector(unsigned size, T _item)
+        : data_(size, _item)
+    {}
+    explicit secure_vector(const std::vector<T>& c)
+        : data_(c)
+    {}
+    secure_vector(std::vector<T>&& c)
+        : data_(std::move(c))
+    {}
    ~secure_vector() { clean(); }

-    static secure_vector<T> getRandom(size_t size) {
+    static secure_vector<T> getRandom(size_t size)
+    {
        secure_vector<T> ret(size);
        std::random_device rdev;
 #ifdef _WIN32
-        std::uniform_int_distribution<int> rand_byte{ 0, std::numeric_limits<uint8_t>::max() };
+        std::uniform_int_distribution<int> rand_byte {0, std::numeric_limits<uint8_t>::max()};
 #else
        std::uniform_int_distribution<uint8_t> rand_byte;
 #endif
-        std::generate_n((uint8_t*)ret.data_.data(), ret.size()*sizeof(T), std::bind(rand_byte, std::ref(rdev)));
+        std::generate_n((uint8_t*) ret.data_.data(), ret.size() * sizeof(T), std::bind(rand_byte, std::ref(rdev)));
        return ret;
    }
-    secure_vector<T>& operator=(const secure_vector<T>& c) {
+    secure_vector<T>& operator=(const secure_vector<T>& c)
+    {
        if (&c == this)
            return *this;
        clean();
        data_ = c.data_;
        return *this;
    }
-    secure_vector<T>& operator=(secure_vector<T>&& c) {
+    secure_vector<T>& operator=(secure_vector<T>&& c)
+    {
        if (&c == this)
            return *this;
        clean();
        data_ = std::move(c.data_);
        return *this;
    }
-    secure_vector<T>& operator=(std::vector<T>&& c) {
+    secure_vector<T>& operator=(std::vector<T>&& c)
+    {
        clean();
        data_ = std::move(c);
        return *this;
    }
-    std::vector<T>& writable() { clean(); return data_; }
+    std::vector<T>& writable()
+    {
+        clean();
+        return data_;
+    }
    const std::vector<T>& makeInsecure() const { return data_; }
    const uint8_t* data() const { return data_.data(); }

-    void clean() {
-        clean(data_.begin(), data_.end());
-    }
+    void clean() { clean(data_.begin(), data_.end()); }

-    void clear() { clean(); data_.clear(); }
+    void clear()
+    {
+        clean();
+        data_.clear();
+    }

    size_t size() const { return data_.size(); }
    bool empty() const { return data_.empty(); }

    void swap(secure_vector<T>& other) { data_.swap(other.data_); }
-    void resize(size_t s) {
-        if (s == data_.size()) return;
+    void resize(size_t s)
+    {
+        if (s == data_.size())
+            return;
        if (s < data_.size()) {
-            //shrink
-            clean(data_.begin()+s, data_.end());
+            // shrink
+            clean(data_.begin() + s, data_.end());
            data_.resize(s);
        } else {
-            //grow
+            // grow
            auto data = std::move(data_); // move protected data
            clear();
            data_.resize(s);
@@ -99,7 +105,8 @@ private:
    /**
     * Securely wipe memory
     */
-    static void clean(const typename std::vector<T>::iterator& i, const typename std::vector<T>::iterator& j) {
+    static void clean(const typename std::vector<T>::iterator& i, const typename std::vector<T>::iterator& j)
+    {
        volatile uint8_t* b = reinterpret_cast<uint8_t*>(&*i);
        volatile uint8_t* e = reinterpret_cast<uint8_t*>(&*j);
        std::fill(b, e, 0);
@@ -110,5 +117,5 @@ private:

 using SecureBlob = secure_vector<uint8_t>;

-}
-}
+} // namespace crypto
+} // namespace dht
@@ -1,33 +1,12 @@
-/*
- *  Copyright (C) 2014-2025 Savoir-faire Linux Inc.
- *  Author : Adrien Béraud <adrien.beraud@savoirfairelinux.com>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 3 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program. If not, see <https://www.gnu.org/licenses/>.
- */
-
+// Copyright (c) 2014-2026 Savoir-faire Linux Inc.
+// SPDX-License-Identifier: MIT
 #pragma once

 #include "value.h"
 #include "sockaddr.h"

 namespace dht {
-enum class ImStatus : uint8_t {
-    NONE = 0,
-    TYPING,
-    RECEIVED,
-    READ
-};
+enum class ImStatus : uint8_t { NONE = 0, TYPING, RECEIVED, READ };
 }
 MSGPACK_ADD_ENUM(dht::ImStatus)

@@ -38,11 +17,12 @@ class OPENDHT_PUBLIC DhtMessage : public Value::Serializable<DhtMessage>
 public:
    static const ValueType TYPE;

-    DhtMessage(const std::string& s = {}, const Blob& msg = {}) : service(s), data(msg) {}
+    DhtMessage(const std::string& s = {}, const Blob& msg = {})
+        : service(s)
+        , data(msg)
+    {}

-    std::string getService() const {
-        return service;
-    }
+    std::string getService() const { return service; }

    static Value::Filter getFilter() { return {}; }

@@ -51,21 +31,22 @@ public:
    static Value::Filter ServiceFilter(const std::string& s);

    /** print value for debugging */
-    friend std::ostream& operator<< (std::ostream&, const DhtMessage&);
+    friend std::ostream& operator<<(std::ostream&, const DhtMessage&);

    std::string service;
    Blob data;
    MSGPACK_DEFINE(service, data)
 };

-template <typename T>
+template<typename T>
 class SignedValue : public Value::Serializable<T>
 {
 private:
    using BaseClass = Value::Serializable<T>;

 public:
-    virtual void unpackValue(const Value& v) override {
+    virtual void unpackValue(const Value& v) override
+    {
        if (v.owner) {
            owner = v.owner;
            from = v.owner->getId();
@@ -75,22 +56,26 @@ public:
        BaseClass::unpackValue(v);
    }

-    static Value::Filter getFilter() {
-        return [](const Value& v){ return v.isSigned(); };
+    static Value::Filter getFilter()
+    {
+        return [](const Value& v) {
+            return v.isSigned();
+        };
    }

    Sp<crypto::PublicKey> owner;
    dht::InfoHash from;
 };

-template <typename T>
+template<typename T>
 class EncryptedValue : public SignedValue<T>
 {
 public:
    using BaseClass = SignedValue<T>;

 public:
-    virtual void unpackValue(const Value& v) override {
+    virtual void unpackValue(const Value& v) override
+    {
        if (!v.recipient) {
            throw std::runtime_error("Value has no recipient");
        }
@@ -98,11 +83,10 @@ public:
        BaseClass::unpackValue(v);
    }

-    static Value::Filter getFilter() {
-        return Value::Filter::chain(
-            BaseClass::getFilter(),
-            [](const Value& v) { return static_cast<bool>(v.recipient); }
-        );
+    static Value::Filter getFilter()
+    {
+        return Value::Filter::chain(BaseClass::getFilter(),
+                                    [](const Value& v) { return static_cast<bool>(v.recipient); });
    }

    dht::InfoHash to;
@@ -118,20 +102,31 @@ public:

    ImMessage() {}
    ImMessage(dht::Value::Id id, std::string&& m, long d = 0)
-        : id(id), msg(std::move(m)), date(d) {}
-    ImMessage(dht::Value::Id id, std::string &&dt, std::string &&m, long d = 0)
-        : id(id), msg(std::move(m)), datatype(std::move(dt)), date(d) {}
-    ImMessage(dht::Value::Id id, std::string &&dt, std::string &&m, std::map<std::string, std::string> &&md, long d = 0)
-        : id(id), msg(std::move(m)), datatype(std::move(dt)), metadatas(std::move(md)), date(d) {}
+        : id(id)
+        , msg(std::move(m))
+        , date(d)
+    {}
+    ImMessage(dht::Value::Id id, std::string&& dt, std::string&& m, long d = 0)
+        : id(id)
+        , msg(std::move(m))
+        , datatype(std::move(dt))
+        , date(d)
+    {}
+    ImMessage(dht::Value::Id id, std::string&& dt, std::string&& m, std::map<std::string, std::string>&& md, long d = 0)
+        : id(id)
+        , msg(std::move(m))
+        , datatype(std::move(dt))
+        , metadatas(std::move(md))
+        , date(d)
+    {}

-    virtual void unpackValue(const Value& v) override {
+    virtual void unpackValue(const Value& v) override
+    {
        to = v.recipient;
        SignedValue::unpackValue(v);
    }

-    static Value::Filter getFilter() {
-        return SignedValue::getFilter();
-    }
+    static Value::Filter getFilter() { return SignedValue::getFilter(); }

    dht::InfoHash to;
    dht::Value::Id id {0};
@@ -153,13 +148,24 @@ public:
    static const ValueType TYPE;

    TrustRequest() {}
-    TrustRequest(std::string s, std::string ci = {}) : service(s), conversationId(ci) {}
-    TrustRequest(std::string s, std::string ci, const Blob& d) : service(s), conversationId(ci), payload(d) {}
+    TrustRequest(std::string s, std::string ci = {})
+        : service(s)
+        , conversationId(ci)
+    {}
+    TrustRequest(std::string s, std::string ci, const Blob& d)
+        : service(s)
+        , conversationId(ci)
+        , payload(d)
+    {}

-    static Value::Filter getFilter() {
-        return EncryptedValue::getFilter();
+    static Value::Filter getFilter() { return EncryptedValue::getFilter(); }
+    virtual void unpackValue(const dht::Value& v) override
+    {
+        BaseClass::unpackValue(v);
+        id = v.id;
    }

+    dht::Value::Id id {0}; /// Value ID of the trust request, used for deserialization only.
    std::string service;
    std::string conversationId;
    Blob payload;
@@ -176,20 +182,21 @@ public:
    static const ValueType TYPE;

    IceCandidates() {}
-    IceCandidates(Value::Id msg_id, Blob ice) : id(msg_id), ice_data(ice) {}
+    IceCandidates(Value::Id msg_id, Blob ice)
+        : id(msg_id)
+        , ice_data(ice)
+    {}

-    static Value::Filter getFilter() {
-        return EncryptedValue::getFilter();
-    }
+    static Value::Filter getFilter() { return EncryptedValue::getFilter(); }

-    template <typename Packer>
+    template<typename Packer>
    void msgpack_pack(Packer& pk) const
    {
        pk.pack_array(2);
        pk.pack(id);
 #if 1
        pk.pack_bin(ice_data.size());
-        pk.pack_bin_body((const char*)ice_data.data(), ice_data.size());
+        pk.pack_bin_body((const char*) ice_data.data(), ice_data.size());
 #else
        // hack for backward compatibility with old opendht compiled with msgpack 1.0
        // remove when enough people have moved to new versions
@@ -201,8 +208,10 @@ public:

    virtual void msgpack_unpack(const msgpack::object& o)
    {
-        if (o.type != msgpack::type::ARRAY) throw msgpack::type_error();
-        if (o.via.array.size < 2) throw msgpack::type_error();
+        if (o.type != msgpack::type::ARRAY)
+            throw msgpack::type_error();
+        if (o.via.array.size < 2)
+            throw msgpack::type_error();
        id = o.via.array.ptr[0].as<Value::Id>();
        ice_data = unpackBlob(o.via.array.ptr[1]);
    }
@@ -221,59 +230,51 @@ private:
 public:
    static const ValueType TYPE;

-    IpServiceAnnouncement(sa_family_t family = AF_UNSPEC, in_port_t p = 0) {
+    IpServiceAnnouncement(sa_family_t family = AF_UNSPEC, in_port_t p = 0)
+    {
        addr.setFamily(family);
        addr.setPort(p);
    }

-    IpServiceAnnouncement(const SockAddr& sa) : addr(sa) {}
+    IpServiceAnnouncement(const SockAddr& sa)
+        : addr(sa)
+    {}

-    IpServiceAnnouncement(const Blob& b) {
-        msgpack_unpack(unpackMsg(b).get());
-    }
+    IpServiceAnnouncement(const Blob& b) { msgpack_unpack(unpackMsg(b).get()); }

-    template <typename Packer>
+    template<typename Packer>
    void msgpack_pack(Packer& pk) const
    {
        pk.pack_bin(addr.getLength());
-        pk.pack_bin_body((const char*)addr.get(), addr.getLength());
+        pk.pack_bin_body((const char*) addr.get(), addr.getLength());
    }

    virtual void msgpack_unpack(const msgpack::object& o)
    {
        if (o.type == msgpack::type::BIN)
-            addr = {(sockaddr*)o.via.bin.ptr, (socklen_t)o.via.bin.size};
+            addr = {(sockaddr*) o.via.bin.ptr, (socklen_t) o.via.bin.size};
        else
            throw msgpack::type_error();
    }

-    in_port_t getPort() const {
-        return addr.getPort();
-    }
-    void setPort(in_port_t p) {
-        addr.setPort(p);
-    }
+    in_port_t getPort() const { return addr.getPort(); }
+    void setPort(in_port_t p) { addr.setPort(p); }

-    const SockAddr& getPeerAddr() const {
-        return addr;
-    }
+    const SockAddr& getPeerAddr() const { return addr; }

-    virtual const ValueType& getType() const {
-        return TYPE;
-    }
+    virtual const ValueType& getType() const { return TYPE; }

    static bool storePolicy(InfoHash, std::shared_ptr<Value>&, const InfoHash&, const SockAddr&);

    /** print value for debugging */
-    friend std::ostream& operator<< (std::ostream&, const IpServiceAnnouncement&);
+    friend std::ostream& operator<<(std::ostream&, const IpServiceAnnouncement&);

 private:
    SockAddr addr;
 };

-
 OPENDHT_PUBLIC extern const std::array<std::reference_wrapper<const ValueType>, 5> DEFAULT_TYPES;

 OPENDHT_PUBLIC extern const std::array<std::reference_wrapper<const ValueType>, 1> DEFAULT_INSECURE_TYPES;

-}
+} // namespace dht
@@ -1,23 +1,5 @@
-/*
- *  Copyright (C) 2014-2025 Savoir-faire Linux Inc.
- *  Authors: Adrien Béraud <adrien.beraud@savoirfairelinux.com>
- *           Simon Désaulniers <simon.desaulniers@savoirfairelinux.com>
- *           Sébastien Blin <sebastien.blin@savoirfairelinux.com>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 3 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program. If not, see <https://www.gnu.org/licenses/>.
- */
-
+// Copyright (c) 2014-2026 Savoir-faire Linux Inc.
+// SPDX-License-Identifier: MIT
 #pragma once

 #include "infohash.h"
@@ -59,13 +41,17 @@ struct LocalListener;
 * Must be given open UDP sockets and ::periodic must be
 * called regularly.
 */
-class OPENDHT_PUBLIC Dht final : public DhtInterface {
+class OPENDHT_PUBLIC Dht final : public DhtInterface
+{
 public:
    /**
     * Initialise the Dht with two open sockets (for IPv4 and IP6)
     * and an ID for the node.
     */
-    Dht(std::unique_ptr<net::DatagramSocket>&& sock, const Config& config, const Sp<Logger>& l = {}, std::unique_ptr<std::mt19937_64>&& rd = {});
+    Dht(std::unique_ptr<net::DatagramSocket>&& sock,
+        const Config& config,
+        const Sp<Logger>& l = {},
+        std::unique_ptr<std::mt19937_64>&& rd = {});

    virtual ~Dht();

@@ -73,22 +59,16 @@ public:
     * Get the ID of the node.
     */
    inline const InfoHash& getNodeId() const override { return myid; }
-    void setOnPublicAddressChanged(PublicAddressChangedCb cb) override {
-        publicAddressChangedCb_ = std::move(cb);
-    }
+    void setOnPublicAddressChanged(PublicAddressChangedCb cb) override { publicAddressChangedCb_ = std::move(cb); }

    NodeStatus updateStatus(sa_family_t af) override;

    /**
     * Get the current status of the node for the given family.
     */
-    NodeStatus getStatus(sa_family_t af) const override {
-        return dht(af).status;
-    }
+    NodeStatus getStatus(sa_family_t af) const override { return dht(af).status; }

-    NodeStatus getStatus() const override {
-        return std::max(getStatus(AF_INET), getStatus(AF_INET6));
-    }
+    NodeStatus getStatus() const override { return std::max(getStatus(AF_INET), getStatus(AF_INET6)); }

    net::DatagramSocket* getSocket() const override { return network_engine.getSocket(); };

@@ -105,21 +85,16 @@ public:
     */
    bool isRunning(sa_family_t af = 0) const override;

-    virtual void registerType(const ValueType& type) override {
-        types.registerType(type);
-    }
-    const ValueType& getType(ValueType::Id type_id) const override {
-        return types.getType(type_id);
-    }
+    virtual void registerType(const ValueType& type) override { types.registerType(type); }
+    const ValueType& getType(ValueType::Id type_id) const override { return types.getType(type_id); }

-    void addBootstrap(const std::string& host, const std::string& service) override {
+    void addBootstrap(const std::string& host, const std::string& service) override
+    {
        bootstrap_nodes.emplace_back(host, service);
        startBootstrap();
    }

-    void clearBootstrap() override {
-        bootstrap_nodes.clear();
-    }
+    void clearBootstrap() override { bootstrap_nodes.clear(); }

    /**
     * Insert a node in the main routing table.
@@ -127,14 +102,14 @@ public:
     * used to bootstrap efficiently from previously known nodes.
     */
    void insertNode(const InfoHash& id, const SockAddr&) override;
-    void insertNode(const NodeExport& n) override {
-        insertNode(n.id, n.addr);
-    }
+    void insertNode(const NodeExport& n) override { insertNode(n.id, n.addr); }

-    void pingNode(SockAddr, DoneCallbackSimple&& cb={}) override;
+    void pingNode(SockAddr, DoneCallbackSimple&& cb = {}) override;

-    time_point periodic(const uint8_t *buf, size_t buflen, SockAddr, const time_point& now) override;
-    time_point periodic(const uint8_t *buf, size_t buflen, const sockaddr* from, socklen_t fromlen, const time_point& now) override {
+    time_point periodic(const uint8_t* buf, size_t buflen, SockAddr, const time_point& now) override;
+    time_point periodic(
+        const uint8_t* buf, size_t buflen, const sockaddr* from, socklen_t fromlen, const time_point& now) override
+    {
        return periodic(buf, buflen, SockAddr(from, fromlen), now);
    }

@@ -148,14 +123,30 @@ public:
                     cb and donecb won't be called again afterward.
     * @param f a filter function used to prefilter values.
     */
-    virtual void get(const InfoHash& key, GetCallback cb, DoneCallback donecb={}, Value::Filter&& f={}, Where&& w = {}) override;
-    virtual void get(const InfoHash& key, GetCallback cb, DoneCallbackSimple donecb={}, Value::Filter&& f={}, Where&& w = {}) override {
+    virtual void get(
+        const InfoHash& key, GetCallback cb, DoneCallback donecb = {}, Value::Filter&& f = {}, Where&& w = {}) override;
+    virtual void get(const InfoHash& key,
+                     GetCallback cb,
+                     DoneCallbackSimple donecb = {},
+                     Value::Filter&& f = {},
+                     Where&& w = {}) override
+    {
        get(key, cb, bindDoneCb(donecb), std::forward<Value::Filter>(f), std::forward<Where>(w));
    }
-    virtual void get(const InfoHash& key, GetCallbackSimple cb, DoneCallback donecb={}, Value::Filter&& f={}, Where&& w = {}) override {
+    virtual void get(const InfoHash& key,
+                     GetCallbackSimple cb,
+                     DoneCallback donecb = {},
+                     Value::Filter&& f = {},
+                     Where&& w = {}) override
+    {
        get(key, bindGetCb(cb), donecb, std::forward<Value::Filter>(f), std::forward<Where>(w));
    }
-    virtual void get(const InfoHash& key, GetCallbackSimple cb, DoneCallbackSimple donecb, Value::Filter&& f={}, Where&& w = {}) override {
+    virtual void get(const InfoHash& key,
+                     GetCallbackSimple cb,
+                     DoneCallbackSimple donecb,
+                     Value::Filter&& f = {},
+                     Where&& w = {}) override
+    {
        get(key, bindGetCb(cb), bindDoneCb(donecb), std::forward<Value::Filter>(f), std::forward<Where>(w));
    }
    /**
@@ -169,7 +160,8 @@ public:
     *          response.
     */
    virtual void query(const InfoHash& key, QueryCallback cb, DoneCallback done_cb = {}, Query&& q = {}) override;
-    virtual void query(const InfoHash& key, QueryCallback cb, DoneCallbackSimple done_cb = {}, Query&& q = {}) override {
+    virtual void query(const InfoHash& key, QueryCallback cb, DoneCallbackSimple done_cb = {}, Query&& q = {}) override
+    {
        query(key, cb, bindDoneCb(done_cb), std::forward<Query>(q));
    }

@@ -190,32 +182,32 @@ public:
     * The done callback will be called once, when the first announce succeeds, or fails.
     */
    void put(const InfoHash& key,
-            Sp<Value>,
-            DoneCallback cb=nullptr,
-            time_point created=time_point::max(),
-            bool permanent = false) override;
+             Sp<Value>,
+             DoneCallback cb = nullptr,
+             time_point created = time_point::max(),
+             bool permanent = false) override;
    void put(const InfoHash& key,
-            const Sp<Value>& v,
-            DoneCallbackSimple cb,
-            time_point created=time_point::max(),
-            bool permanent = false) override
+             const Sp<Value>& v,
+             DoneCallbackSimple cb,
+             time_point created = time_point::max(),
+             bool permanent = false) override
    {
        put(key, v, bindDoneCb(cb), created, permanent);
    }

    void put(const InfoHash& key,
-            Value&& v,
-            DoneCallback cb=nullptr,
-            time_point created=time_point::max(),
-            bool permanent = false) override
+             Value&& v,
+             DoneCallback cb = nullptr,
+             time_point created = time_point::max(),
+             bool permanent = false) override
    {
        put(key, std::make_shared<Value>(std::move(v)), cb, created, permanent);
    }
    void put(const InfoHash& key,
-            Value&& v,
-            DoneCallbackSimple cb,
-            time_point created=time_point::max(),
-            bool permanent = false) override
+             Value&& v,
+             DoneCallbackSimple cb,
+             time_point created = time_point::max(),
+             bool permanent = false) override
    {
        put(key, std::forward<Value>(v), bindDoneCb(cb), created, permanent);
    }
@@ -243,16 +235,22 @@ public:
     *
     * @return a token to cancel the listener later.
     */
-    size_t listen(const InfoHash&, ValueCallback, Value::Filter={}, Where={}) override;
+    size_t listen(const InfoHash&, ValueCallback, Value::Filter = {}, Where = {}) override;

-    size_t listen(const InfoHash& key, GetCallback cb, Value::Filter f={}, Where w={}) override {
-        return listen(key, [cb](const std::vector<Sp<Value>>& vals, bool expired){
-            if (not expired)
-                return cb(vals);
-            return true;
-        }, std::forward<Value::Filter>(f), std::forward<Where>(w));
+    size_t listen(const InfoHash& key, GetCallback cb, Value::Filter f = {}, Where w = {}) override
+    {
+        return listen(
+            key,
+            [cb](const std::vector<Sp<Value>>& vals, bool expired) {
+                if (not expired)
+                    return cb(vals);
+                return true;
+            },
+            std::forward<Value::Filter>(f),
+            std::forward<Where>(w));
    }
-    size_t listen(const InfoHash& key, GetCallbackSimple cb, Value::Filter f={}, Where w={}) override {
+    size_t listen(const InfoHash& key, GetCallbackSimple cb, Value::Filter f = {}, Where w = {}) override
+    {
        return listen(key, bindGetCb(cb), std::forward<Value::Filter>(f), std::forward<Where>(w));
    }

@@ -264,7 +262,8 @@ public:
     * The DHT will recontact neighbor nodes, re-register for listen ops etc.
     */
    void connectivityChanged(sa_family_t) override;
-    void connectivityChanged() override {
+    void connectivityChanged() override
+    {
        connectivityChanged(AF_INET);
        connectivityChanged(AF_INET6);
    }
@@ -291,37 +290,43 @@ public:
    std::string getSearchLog(const InfoHash&, sa_family_t af = AF_UNSPEC) const override;

    void dumpTables() const override;
-    std::vector<unsigned> getNodeMessageStats(bool in = false) override {
+    std::vector<unsigned> getNodeMessageStats(bool in = false) override
+    {
        return network_engine.getNodeMessageStats(in);
    }

    /**
-     * Set the in-memory storage limit in bytes
+     * Set the in-memory storage limit in bytes for remote values
     */
-    void setStorageLimit(size_t limit = DEFAULT_STORAGE_LIMIT) override {
-        max_store_size = limit;
-    }
-    size_t getStorageLimit() const override {
-        return max_store_size;
+    void setStorageLimit(size_t limit = 0) override { max_store_size = limit == 0 ? STORAGE_LIMIT_DEFAULT : limit; }
+    size_t getStorageLimit() const override { return max_store_size; }
+
+    /**
+     * Set the in-memory storage limit in bytes for locally stored values
+     */
+    void setLocalStorageLimit(size_t limit = 0) override
+    {
+        max_local_store_size = limit == 0 ? STORAGE_LIMIT_UNLIMITED : limit;
    }
+    size_t getLocalStorageLimit() const override { return max_local_store_size; }

    /**
     * Returns the total memory usage of stored values and the number
     * of stored values.
     */
-    std::pair<size_t, size_t> getStoreSize() const override {
-        return {total_store_size, total_values};
-    }
+    std::pair<size_t, size_t> getStoreSize() const override { return {total_store_size, total_values}; }
+
+    std::pair<size_t, size_t> getLocalStoreSize() const override;

    std::vector<SockAddr> getPublicAddress(sa_family_t family = 0) override;

-    PushNotificationResult pushNotificationReceived(const std::map<std::string, std::string>&) override {
+    PushNotificationResult pushNotificationReceived(const std::map<std::string, std::string>&) override
+    {
        return PushNotificationResult::IgnoredDisabled;
    }
    void resubscribe(unsigned) {}

 private:
-
    /* When performing a search, we search for up to SEARCH_NODES closest nodes
       to the destination, and use the additional ones to backtrack if any of
       the target 8 turn out to be dead. */
@@ -387,7 +392,8 @@ private:
    using SearchMap = std::map<InfoHash, Sp<Search>>;
    using ReportedAddr = std::pair<unsigned, SockAddr>;

-    struct Kad {
+    struct Kad
+    {
        RoutingTable buckets {};
        SearchMap searches {};
        unsigned pending_pings {0};
@@ -402,16 +408,19 @@ private:
    Kad dht6 {};
    PublicAddressChangedCb publicAddressChangedCb_ {};

-    std::vector<std::pair<std::string,std::string>> bootstrap_nodes {};
+    std::vector<std::pair<std::string, std::string>> bootstrap_nodes {};
    std::chrono::steady_clock::duration bootstrap_period {BOOTSTRAP_PERIOD};
    Sp<Scheduler::Job> bootstrapJob {};
+    bool bootstrap_pending {false};

    std::map<InfoHash, Storage> store;
    std::map<SockAddr, StorageBucket, SockAddr::ipCmp> store_quota;
+    std::unique_ptr<StorageBucket> local_store_quota;
    size_t total_values {0};
    size_t total_store_size {0};
    size_t max_store_keys {MAX_HASHES};
-    size_t max_store_size {DEFAULT_STORAGE_LIMIT};
+    size_t max_store_size {STORAGE_LIMIT_DEFAULT};
+    size_t max_local_store_size {STORAGE_LIMIT_UNLIMITED};

    size_t max_searches {MAX_SEARCHES};
    size_t search_id {0};
@@ -421,7 +430,6 @@ private:
    std::map<size_t, std::tuple<size_t, size_t, size_t>> listeners {};
    size_t listener_token {1};

-
    // timing
    Scheduler scheduler;
    Sp<Scheduler::Job> nextNodesConfirmation {};
@@ -439,7 +447,8 @@ private:
    const bool maintain_storage {false};
    const bool public_stable {false};

-    inline const duration& getListenExpiration() const {
+    inline const duration& getListenExpiration() const
+    {
        return public_stable ? LISTEN_EXPIRE_TIME_PUBLIC : LISTEN_EXPIRE_TIME;
    }

@@ -452,7 +461,12 @@ private:

    // Storage
    void storageAddListener(const InfoHash& id, const Sp<Node>& node, size_t tid, Query&& = {}, int version = 0);
-    bool storageStore(const InfoHash& id, const Sp<Value>& value, time_point created, const SockAddr& sa = {}, bool permanent = false);
+    bool storageStore(const InfoHash& id,
+                      const Sp<Value>& value,
+                      time_point created,
+                      const SockAddr& sa = {},
+                      bool permanent = false,
+                      time_point expiration = time_point::min());
    bool storageRefresh(const InfoHash& id, Value::Id vid);
    void expireStore();
    void expireStorage(InfoHash h);
@@ -468,19 +482,21 @@ private:
     * nodes.
     */
    void dataPersistence(InfoHash id);
-    size_t maintainStorage(decltype(store)::value_type&, bool force=false, const DoneCallback& donecb={});
+    size_t maintainStorage(decltype(store)::value_type&, bool force = false, const DoneCallback& donecb = {});

    // Buckets
    Kad& dht(sa_family_t af) { return af == AF_INET ? dht4 : dht6; }
    const Kad& dht(sa_family_t af) const { return af == AF_INET ? dht4 : dht6; }
    RoutingTable& buckets(sa_family_t af) { return dht(af).buckets; }
    const RoutingTable& buckets(sa_family_t af) const { return dht(af).buckets; }
-    Bucket* findBucket(const InfoHash& id, sa_family_t af) {
+    Bucket* findBucket(const InfoHash& id, sa_family_t af)
+    {
        auto& b = buckets(af);
        auto it = b.findBucket(id);
        return it == b.end() ? nullptr : &(*it);
    }
-    const Bucket* findBucket(const InfoHash& id, sa_family_t af) const {
+    const Bucket* findBucket(const InfoHash& id, sa_family_t af) const
+    {
        return const_cast<Dht*>(this)->findBucket(id, af);
    }

@@ -505,9 +521,20 @@ private:
     * Low-level method that will perform a search on the DHT for the specified
     * infohash (id), using the specified IP version (IPv4 or IPv6).
     */
-    Sp<Search> search(const InfoHash& id, sa_family_t af, GetCallback = {}, QueryCallback = {}, DoneCallback = {}, Value::Filter = {}, const Sp<Query>& q = {});
+    Sp<Search> search(const InfoHash& id,
+                      sa_family_t af,
+                      GetCallback = {},
+                      QueryCallback = {},
+                      DoneCallback = {},
+                      Value::Filter = {},
+                      const Sp<Query>& q = {});

-    void announce(const InfoHash& id, sa_family_t af, Sp<Value> value, DoneCallback callback, time_point created=time_point::max(), bool permanent = false);
+    void announce(const InfoHash& id,
+                  sa_family_t af,
+                  Sp<Value> value,
+                  DoneCallback callback,
+                  time_point created = time_point::max(),
+                  bool permanent = false);
    size_t listenTo(const InfoHash& id, sa_family_t af, ValueCallback cb, Value::Filter f = {}, const Sp<Query>& q = {});

    /**
@@ -535,9 +562,9 @@ private:
     * @param query   The query sent to the node.
     */
    void searchNodeGetDone(const net::Request& status,
-            net::RequestAnswer&& answer,
-            std::weak_ptr<Search> ws,
-            Sp<Query> query);
+                           net::RequestAnswer&& answer,
+                           std::weak_ptr<Search> ws,
+                           Sp<Query> query);

    /**
     * Generic function to execute when a 'get' request expires.
@@ -562,7 +589,7 @@ private:
    /**
     * If update is true, this method will also send message to synced but non-updated search nodes.
     */
-    SearchNode* searchSendGetValues(Sp<Search> sr, SearchNode *n = nullptr, bool update = true);
+    SearchNode* searchSendGetValues(Sp<Search> sr, SearchNode* n = nullptr, bool update = true);

    /**
     * Forwards an 'announce' request for a list of nodes to the network engine.
@@ -594,41 +621,22 @@ private:
    net::RequestAnswer onPing(Sp<Node> node);
    /* when we receive a "find node" request */
    net::RequestAnswer onFindNode(Sp<Node> node, const InfoHash& hash, want_t want);
-    void onFindNodeDone(const Sp<Node>& status,
-            net::RequestAnswer& a,
-            Sp<Search> sr);
+    void onFindNodeDone(const Sp<Node>& status, net::RequestAnswer& a, Sp<Search> sr);
    /* when we receive a "get values" request */
-    net::RequestAnswer onGetValues(Sp<Node> node,
-            const InfoHash& hash,
-            want_t want,
-            const Query& q);
-    void onGetValuesDone(const Sp<Node>& status,
-            net::RequestAnswer& a,
-            Sp<Search>& sr,
-            const Sp<Query>& orig_query);
+    net::RequestAnswer onGetValues(Sp<Node> node, const InfoHash& hash, want_t want, const Query& q);
+    void onGetValuesDone(const Sp<Node>& status, net::RequestAnswer& a, Sp<Search>& sr, const Sp<Query>& orig_query);
    /* when we receive a listen request */
-    net::RequestAnswer onListen(Sp<Node> node,
-            const InfoHash& hash,
-            const Blob& token,
-            size_t socket_id,
-            const Query& query,
-            int version = 0);
-    void onListenDone(const Sp<Node>& status,
-            net::RequestAnswer& a,
-            Sp<Search>& sr);
+    net::RequestAnswer onListen(
+        Sp<Node> node, const InfoHash& hash, const Blob& token, size_t socket_id, const Query& query, int version = 0);
+    void onListenDone(const Sp<Node>& node, net::RequestAnswer& a, Sp<Search>& sr);
    /* when we receive an announce request */
    net::RequestAnswer onAnnounce(Sp<Node> node,
-            const InfoHash& hash,
-            const Blob& token,
-            const std::vector<Sp<Value>>& v,
-            const time_point& created);
-    net::RequestAnswer onRefresh(Sp<Node> node,
-            const InfoHash& hash,
-            const Blob& token,
-            const Value::Id& vid);
-    void onAnnounceDone(const Sp<Node>& status,
-            net::RequestAnswer& a,
-            Sp<Search>& sr);
+                                  const InfoHash& hash,
+                                  const Blob& token,
+                                  const std::vector<Sp<Value>>& v,
+                                  const time_point& created);
+    net::RequestAnswer onRefresh(Sp<Node> node, const InfoHash& hash, const Blob& token, const Value::Id& vid);
+    void onAnnounceDone(const Sp<Node>& status, net::RequestAnswer& a, Sp<Search>& sr);
 };

-}
+} // namespace dht
@@ -1,21 +1,5 @@
-/*
- *  Copyright (C) 2014-2025 Savoir-faire Linux Inc.
- *  Author: Sébastien Blin <sebastien.blin@savoirfairelinux.com>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 3 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program. If not, see <https://www.gnu.org/licenses/>.
- */
-
+// Copyright (c) 2014-2026 Savoir-faire Linux Inc.
+// SPDX-License-Identifier: MIT
 #pragma once

 #include "infohash.h"
@@ -27,14 +11,16 @@
 namespace dht {

 namespace net {
-    class DatagramSocket;
+class DatagramSocket;
 }

-class OPENDHT_PUBLIC DhtInterface {
+class OPENDHT_PUBLIC DhtInterface
+{
 public:
    DhtInterface() = default;
-    DhtInterface(const Logger& l) : logger_(std::make_shared<Logger>(l)) {}
-    DhtInterface(const std::shared_ptr<Logger>& l) : logger_(l) {}
+    DhtInterface(const std::shared_ptr<Logger>& l)
+        : logger_(l)
+    {}
    virtual ~DhtInterface() = default;

    // [[deprecated]]
@@ -49,9 +35,7 @@ public:
    virtual NodeStatus getStatus(sa_family_t af) const = 0;
    virtual NodeStatus getStatus() const = 0;

-    void addOnConnectedCallback(std::function<void()> cb) {
-        onConnectCallbacks_.emplace(std::move(cb));
-    }
+    void addOnConnectedCallback(std::function<void()> cb) { onConnectCallbacks_.emplace(std::move(cb)); }
    virtual void setOnPublicAddressChanged(PublicAddressChangedCb) {}

    virtual net::DatagramSocket* getSocket() const { return {}; }
@@ -91,10 +75,12 @@ public:
    virtual void insertNode(const InfoHash& id, const SockAddr&) = 0;
    virtual void insertNode(const NodeExport& n) = 0;

-    virtual void pingNode(SockAddr, DoneCallbackSimple&& cb={}) = 0;
+    virtual void pingNode(SockAddr, DoneCallbackSimple&& cb = {}) = 0;

-    virtual time_point periodic(const uint8_t *buf, size_t buflen, SockAddr, const time_point& now) = 0;
-    virtual time_point periodic(const uint8_t *buf, size_t buflen, const sockaddr* from, socklen_t fromlen, const time_point& now) = 0;
+    virtual time_point periodic(const uint8_t* buf, size_t buflen, SockAddr, const time_point& now) = 0;
+    virtual time_point periodic(
+        const uint8_t* buf, size_t buflen, const sockaddr* from, socklen_t fromlen, const time_point& now)
+        = 0;

    /**
     * Get a value by searching on all available protocols (IPv4, IPv6),
@@ -106,10 +92,18 @@ public:
                  cb and donecb won't be called again afterward.
     * @param f a filter function used to prefilter values.
     */
-    virtual void get(const InfoHash& key, GetCallback cb, DoneCallback donecb={}, Value::Filter&& f={}, Where&& w = {}) = 0;
-    virtual void get(const InfoHash& key, GetCallback cb, DoneCallbackSimple donecb={}, Value::Filter&& f={}, Where&& w = {}) = 0;
-    virtual void get(const InfoHash& key, GetCallbackSimple cb, DoneCallback donecb={}, Value::Filter&& f={}, Where&& w = {}) = 0;
-    virtual void get(const InfoHash& key, GetCallbackSimple cb, DoneCallbackSimple donecb, Value::Filter&& f={}, Where&& w = {}) = 0;
+    virtual void get(
+        const InfoHash& key, GetCallback cb, DoneCallback donecb = {}, Value::Filter&& f = {}, Where&& w = {})
+        = 0;
+    virtual void get(
+        const InfoHash& key, GetCallback cb, DoneCallbackSimple donecb = {}, Value::Filter&& f = {}, Where&& w = {})
+        = 0;
+    virtual void get(
+        const InfoHash& key, GetCallbackSimple cb, DoneCallback donecb = {}, Value::Filter&& f = {}, Where&& w = {})
+        = 0;
+    virtual void get(
+        const InfoHash& key, GetCallbackSimple cb, DoneCallbackSimple donecb, Value::Filter&& f = {}, Where&& w = {})
+        = 0;

    /**
      * Similar to Dht::get, but sends a Query to filter data remotely.
@@ -141,25 +135,29 @@ public:
     * The done callback will be called once, when the first announce succeeds, or fails.
     */
    virtual void put(const InfoHash& key,
-           Sp<Value>,
-           DoneCallback cb=nullptr,
-           time_point created=time_point::max(),
-           bool permanent = false) = 0;
+                     Sp<Value>,
+                     DoneCallback cb = nullptr,
+                     time_point created = time_point::max(),
+                     bool permanent = false)
+        = 0;
    virtual void put(const InfoHash& key,
-           const Sp<Value>& v,
-           DoneCallbackSimple cb,
-           time_point created=time_point::max(),
-           bool permanent = false) = 0;
+                     const Sp<Value>& v,
+                     DoneCallbackSimple cb,
+                     time_point created = time_point::max(),
+                     bool permanent = false)
+        = 0;
    virtual void put(const InfoHash& key,
-           Value&& v,
-           DoneCallback cb=nullptr,
-           time_point created=time_point::max(),
-           bool permanent = false) = 0;
+                     Value&& v,
+                     DoneCallback cb = nullptr,
+                     time_point created = time_point::max(),
+                     bool permanent = false)
+        = 0;
    virtual void put(const InfoHash& key,
-           Value&& v,
-           DoneCallbackSimple cb,
-           time_point created=time_point::max(),
-           bool permanent = false) = 0;
+                     Value&& v,
+                     DoneCallbackSimple cb,
+                     time_point created = time_point::max(),
+                     bool permanent = false)
+        = 0;

    /**
     * Get data currently being put at the given hash.
@@ -184,9 +182,9 @@ public:
     *
     * @return a token to cancel the listener later.
     */
-    virtual size_t listen(const InfoHash&, GetCallback, Value::Filter={}, Where w = {}) = 0;
-    virtual size_t listen(const InfoHash& key, GetCallbackSimple cb, Value::Filter f={}, Where w = {}) = 0;
-    virtual size_t listen(const InfoHash&, ValueCallback, Value::Filter={}, Where w = {}) = 0;
+    virtual size_t listen(const InfoHash&, GetCallback, Value::Filter = {}, Where w = {}) = 0;
+    virtual size_t listen(const InfoHash& key, GetCallbackSimple cb, Value::Filter f = {}, Where w = {}) = 0;
+    virtual size_t listen(const InfoHash&, ValueCallback, Value::Filter = {}, Where w = {}) = 0;

    virtual bool cancelListen(const InfoHash&, size_t token) = 0;

@@ -220,29 +218,28 @@ public:
    virtual std::vector<unsigned> getNodeMessageStats(bool in = false) = 0;

    /**
-     * Set the in-memory storage limit in bytes
+     * Set the in-memory storage limit in bytes for remote values
     */
-    virtual void setStorageLimit(size_t limit = DEFAULT_STORAGE_LIMIT) = 0;
+    virtual void setStorageLimit(size_t limit = 0) = 0;
    virtual size_t getStorageLimit() const = 0;

+    /**
+     * Set the in-memory storage limit in bytes for locally stored values
+     */
+    virtual void setLocalStorageLimit(size_t limit = 0) = 0;
+    virtual size_t getLocalStorageLimit() const = 0;
+
    /**
     * Returns the total memory usage of stored values and the number
     * of stored values.
     */
    virtual std::pair<size_t, size_t> getStoreSize() const = 0;

+    virtual std::pair<size_t, size_t> getLocalStoreSize() const = 0;
+
    virtual std::vector<SockAddr> getPublicAddress(sa_family_t family = 0) = 0;

-    virtual void setLogger(const Logger& l) {
-        if (logger_)
-            *logger_ = l;
-        else
-            logger_= std::make_shared<Logger>(l);
-    }
-
-    virtual void setLogger(const std::shared_ptr<Logger>& l) {
-        logger_ = l;
-    }
+    virtual void setLogger(const std::shared_ptr<Logger>& l) { logger_ = l; }

    /**
     * Only print logs related to the given InfoHash (if given), or disable filter (if zeroes).
@@ -1,23 +1,5 @@
-/*
- *  Copyright (C) 2014-2025 Savoir-faire Linux Inc.
- *  Author: Sébastien Blin <sebastien.blin@savoirfairelinux.com>
- *          Adrien Béraud <adrien.beraud@savoirfairelinux.com>
- *          Vsevolod Ivanov <vsevolod.ivanov@savoirfairelinux.com>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 3 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program. If not, see <https://www.gnu.org/licenses/>.
- */
-
+// Copyright (c) 2014-2026 Savoir-faire Linux Inc.
+// SPDX-License-Identifier: MIT
 #pragma once

 #include <functional>
@@ -43,33 +25,32 @@ class Value;
 namespace http {
 class Resolver;
 class Request;
-}
+} // namespace http

 namespace dht {

-class OPENDHT_PUBLIC DhtProxyClient final : public DhtInterface {
+class OPENDHT_PUBLIC DhtProxyClient final : public DhtInterface
+{
 public:
-
    DhtProxyClient();

-    explicit DhtProxyClient(
-        std::shared_ptr<crypto::Certificate> serverCA,
-        crypto::Identity clientIdentity,
-        std::function<void()> loopSignal,
-        const std::string& serverHost,
-        const std::string& userAgent = "",
-        const std::string& pushClientId = "",
-        const std::string& pushToken = "",
-        const std::string& pushTopic = "",
-        const std::string& pushPlatform = "",
-        std::shared_ptr<Logger> logger = {}
-    );
+    explicit DhtProxyClient(std::shared_ptr<crypto::Certificate> serverCA,
+                            crypto::Identity clientIdentity,
+                            std::function<void()> loopSignal,
+                            const std::string& serverHost,
+                            const std::string& userAgent = "",
+                            const std::string& pushClientId = "",
+                            const std::string& pushToken = "",
+                            const std::string& pushTopic = "",
+                            const std::string& pushPlatform = "",
+                            std::shared_ptr<Logger> logger = {});

    void setHeaderFields(http::Request& request);

    virtual void setPushNotificationToken(const std::string& token) override;

-    virtual void setPushNotificationTopic(const std::string& topic) override {
+    virtual void setPushNotificationTopic(const std::string& topic) override
+    {
 #ifdef OPENDHT_PUSH_NOTIFICATIONS
        notificationTopic_ = topic;
 #else
@@ -77,7 +58,8 @@ public:
 #endif
    }

-    virtual void setPushNotificationPlatform(const std::string& platform) override {
+    virtual void setPushNotificationPlatform(const std::string& platform) override
+    {
 #ifdef OPENDHT_PUSH_NOTIFICATIONS
        platform_ = platform;
 #else
@@ -91,17 +73,13 @@ public:
     * Get the ID of the node.
     */
    inline const InfoHash& getNodeId() const override { return myid; }
-    void setOnPublicAddressChanged(PublicAddressChangedCb cb) override {
-        publicAddressChangedCb_ = std::move(cb);
-    }
+    void setOnPublicAddressChanged(PublicAddressChangedCb cb) override { publicAddressChangedCb_ = std::move(cb); }

    /**
     * Get the current status of the node for the given family.
     */
    NodeStatus getStatus(sa_family_t af) const override;
-    NodeStatus getStatus() const override {
-        return std::max(getStatus(AF_INET), getStatus(AF_INET6));
-    }
+    NodeStatus getStatus() const override { return std::max(getStatus(AF_INET), getStatus(AF_INET6)); }

    /**
     * Performs final operations before quitting.
@@ -126,14 +104,30 @@ public:
                     cb and donecb won't be called again afterward.
     * @param f a filter function used to prefilter values.
     */
-    virtual void get(const InfoHash& key, GetCallback cb, DoneCallback donecb={}, Value::Filter&& f={}, Where&& w = {}) override;
-    virtual void get(const InfoHash& key, GetCallback cb, DoneCallbackSimple donecb={}, Value::Filter&& f={}, Where&& w = {}) override {
+    virtual void get(
+        const InfoHash& key, GetCallback cb, DoneCallback donecb = {}, Value::Filter&& f = {}, Where&& w = {}) override;
+    virtual void get(const InfoHash& key,
+                     GetCallback cb,
+                     DoneCallbackSimple donecb = {},
+                     Value::Filter&& f = {},
+                     Where&& w = {}) override
+    {
        get(key, cb, bindDoneCb(std::move(donecb)), std::forward<Value::Filter>(f), std::forward<Where>(w));
    }
-    virtual void get(const InfoHash& key, GetCallbackSimple cb, DoneCallback donecb={}, Value::Filter&& f={}, Where&& w = {}) override {
+    virtual void get(const InfoHash& key,
+                     GetCallbackSimple cb,
+                     DoneCallback donecb = {},
+                     Value::Filter&& f = {},
+                     Where&& w = {}) override
+    {
        get(key, bindGetCb(cb), std::move(donecb), std::forward<Value::Filter>(f), std::forward<Where>(w));
    }
-    virtual void get(const InfoHash& key, GetCallbackSimple cb, DoneCallbackSimple donecb, Value::Filter&& f={}, Where&& w = {}) override {
+    virtual void get(const InfoHash& key,
+                     GetCallbackSimple cb,
+                     DoneCallbackSimple donecb,
+                     Value::Filter&& f = {},
+                     Where&& w = {}) override
+    {
        get(key, bindGetCb(cb), bindDoneCb(std::move(donecb)), std::forward<Value::Filter>(f), std::forward<Where>(w));
    }

@@ -145,32 +139,32 @@ public:
     * NOTE: For now, created parameter is ignored.
     */
    void put(const InfoHash& key,
-            Sp<Value>,
-            DoneCallback cb=nullptr,
-            time_point created=time_point::max(),
-            bool permanent = false) override;
+             Sp<Value>,
+             DoneCallback cb = nullptr,
+             time_point created = time_point::max(),
+             bool permanent = false) override;
    void put(const InfoHash& key,
-            const Sp<Value>& v,
-            DoneCallbackSimple cb,
-            time_point created=time_point::max(),
-            bool permanent = false) override
+             const Sp<Value>& v,
+             DoneCallbackSimple cb,
+             time_point created = time_point::max(),
+             bool permanent = false) override
    {
        put(key, v, bindDoneCb(std::move(cb)), created, permanent);
    }

    void put(const InfoHash& key,
-            Value&& v,
-            DoneCallback cb=nullptr,
-            time_point created=time_point::max(),
-            bool permanent = false) override
+             Value&& v,
+             DoneCallback cb = nullptr,
+             time_point created = time_point::max(),
+             bool permanent = false) override
    {
        put(key, std::make_shared<Value>(std::move(v)), std::move(cb), created, permanent);
    }
    void put(const InfoHash& key,
-            Value&& v,
-            DoneCallbackSimple cb,
-            time_point created=time_point::max(),
-            bool permanent = false) override
+             Value&& v,
+             DoneCallbackSimple cb,
+             time_point created = time_point::max(),
+             bool permanent = false) override
    {
        put(key, std::forward<Value>(v), bindDoneCb(std::move(cb)), created, permanent);
    }
@@ -194,16 +188,22 @@ public:
     *
     * @return a token to cancel the listener later.
     */
-    virtual size_t listen(const InfoHash&, ValueCallback, Value::Filter={}, Where={}) override;
+    virtual size_t listen(const InfoHash&, ValueCallback, Value::Filter = {}, Where = {}) override;

-    virtual size_t listen(const InfoHash& key, GetCallback cb, Value::Filter f={}, Where w={}) override {
-        return listen(key, [cb=std::move(cb)](const std::vector<Sp<Value>>& vals, bool expired){
-            if (not expired)
-                return cb(vals);
-            return true;
-        }, std::forward<Value::Filter>(f), std::forward<Where>(w));
+    virtual size_t listen(const InfoHash& key, GetCallback cb, Value::Filter f = {}, Where w = {}) override
+    {
+        return listen(
+            key,
+            [cb = std::move(cb)](const std::vector<Sp<Value>>& vals, bool expired) {
+                if (not expired)
+                    return cb(vals);
+                return true;
+            },
+            std::forward<Value::Filter>(f),
+            std::forward<Where>(w));
    }
-    virtual size_t listen(const InfoHash& key, GetCallbackSimple cb, Value::Filter f={}, Where w={}) override {
+    virtual size_t listen(const InfoHash& key, GetCallbackSimple cb, Value::Filter f = {}, Where w = {}) override
+    {
        return listen(key, bindGetCb(std::move(cb)), std::forward<Value::Filter>(f), std::forward<Where>(w));
    }
    /*
@@ -219,7 +219,9 @@ public:
    PushNotificationResult pushNotificationReceived(const std::map<std::string, std::string>& notification) override;

    time_point periodic(const uint8_t*, size_t, SockAddr, const time_point& now) override;
-    time_point periodic(const uint8_t* buf, size_t buflen, const sockaddr* from, socklen_t fromlen, const time_point& now) override {
+    time_point periodic(
+        const uint8_t* buf, size_t buflen, const sockaddr* from, socklen_t fromlen, const time_point& now) override
+    {
        return periodic(buf, buflen, SockAddr(from, fromlen), now);
    }

@@ -233,8 +235,13 @@ public:
     * @param q a query used to filter values on the remotes before they send a
     *          response.
     */
-    virtual void query(const InfoHash& /*key*/, QueryCallback /*cb*/, DoneCallback /*done_cb*/ = {}, Query&& /*q*/ = {}) override { }
-    virtual void query(const InfoHash& key, QueryCallback cb, DoneCallbackSimple done_cb = {}, Query&& q = {}) override {
+    virtual void query(const InfoHash& /*key*/,
+                       QueryCallback /*cb*/,
+                       DoneCallback /*done_cb*/ = {},
+                       Query&& /*q*/ = {}) override
+    {}
+    virtual void query(const InfoHash& key, QueryCallback cb, DoneCallbackSimple done_cb = {}, Query&& q = {}) override
+    {
        query(key, cb, bindDoneCb(std::move(done_cb)), std::forward<Query>(q));
    }

@@ -254,14 +261,10 @@ public:
     */
    bool cancelPut(const InfoHash&, const Value::Id&) override;

-    void pingNode(SockAddr, DoneCallbackSimple&& /*cb*/={}) override { }
+    void pingNode(SockAddr, DoneCallbackSimple&& /*cb*/ = {}) override {}

-    virtual void registerType(const ValueType& type) override {
-        types.registerType(type);
-    }
-    const ValueType& getType(ValueType::Id type_id) const override {
-        return types.getType(type_id);
-    }
+    virtual void registerType(const ValueType& type) override { types.registerType(type); }
+    const ValueType& getType(ValueType::Id type_id) const override { return types.getType(type_id); }

    std::vector<Sp<Value>> getLocal(const InfoHash& k, const Value::Filter& filter) const override;
    Sp<Value> getLocalById(const InfoHash& k, Value::Id id) const override;
@@ -270,9 +273,10 @@ public:
     * NOTE: The following methods will not be implemented because the
     * DhtProxyClient doesn't have any storage nor synchronization process
     */
-    void insertNode(const InfoHash&, const SockAddr&) override { }
-    void insertNode(const NodeExport&) override { }
+    void insertNode(const InfoHash&, const SockAddr&) override {}
+    void insertNode(const NodeExport&) override {}
    std::pair<size_t, size_t> getStoreSize() const override { return {}; }
+    std::pair<size_t, size_t> getLocalStoreSize() const override { return {}; }
    std::vector<NodeExport> exportNodes() const override { return {}; }
    std::vector<ValuesExport> exportValues() const override { return {}; }
    void importValues(const std::vector<ValuesExport>&) override {}
@@ -285,17 +289,16 @@ public:
    std::vector<unsigned> getNodeMessageStats(bool) override { return {}; }
    void setStorageLimit(size_t) override {}
    virtual size_t getStorageLimit() const override { return 0; }
-    void connectivityChanged(sa_family_t) override {
-        getProxyInfos();
-    }
-    void connectivityChanged() override {
+    void setLocalStorageLimit(size_t) override {}
+    virtual size_t getLocalStorageLimit() const override { return STORAGE_LIMIT_UNLIMITED; }
+    void connectivityChanged(sa_family_t) override { getProxyInfos(); }
+    void connectivityChanged() override
+    {
        getProxyInfos();
        loopSignal_();
    }

-    void listenKeepIdle(uint32_t seconds) {
-        listenKeepIdle_ = seconds;
-    }
+    void listenKeepIdle(uint32_t seconds) { listenKeepIdle_ = seconds; }
    inline uint32_t listenKeepIdle() { return listenKeepIdle_; }

 private:
@@ -311,13 +314,15 @@ private:
     */
    struct InfoState;
    void getProxyInfos();
-    void queryProxyInfo(const std::shared_ptr<InfoState>& infoState, const std::shared_ptr<http::Resolver>& resolver, sa_family_t family);
+    void queryProxyInfo(const std::shared_ptr<InfoState>& infoState,
+                        const std::shared_ptr<http::Resolver>& resolver,
+                        sa_family_t family);
    void onProxyInfos(const Json::Value& val, const sa_family_t family);
    SockAddr parsePublicAddress(const Json::Value& val);

    void opFailed();

-    void handleExpireListener(const asio::error_code &ec, const InfoHash& key);
+    void handleExpireListener(const asio::error_code& ec, const InfoHash& key);

    struct Listener;
    struct OperationState;
@@ -326,15 +331,21 @@ private:
        SUBSCRIBE,
        RESUBSCRIBE,
    };
-    using CacheValueCallback = std::function<bool(const std::vector<std::shared_ptr<Value>>& values, bool expired, system_clock::time_point)>;
+    using CacheValueCallback
+        = std::function<bool(const std::vector<std::shared_ptr<Value>>& values, bool expired, system_clock::time_point)>;

    /**
     * Send Listen with httpClient_
     */
-    void sendListen(const restinio::http_request_header_t& header, const CacheValueCallback& cb,
-                    const Sp<OperationState>& opstate, Listener& listener, ListenMethod method = ListenMethod::LISTEN);
-    void handleResubscribe(const asio::error_code& ec, const InfoHash& key,
-                           const size_t token, std::shared_ptr<OperationState> opstate);
+    void sendListen(const restinio::http_request_header_t& header,
+                    const CacheValueCallback& cb,
+                    const Sp<OperationState>& opstate,
+                    Listener& listener,
+                    ListenMethod method = ListenMethod::LISTEN);
+    void handleResubscribe(const asio::error_code& ec,
+                           const InfoHash& key,
+                           const size_t token,
+                           std::shared_ptr<OperationState> opstate);

    void doPut(const InfoHash&, Sp<Value>, DoneCallbackSimple, time_point created, bool permanent);
    void handleRefreshPut(const asio::error_code& ec, InfoHash key, Value::Id id);
@@ -414,14 +425,14 @@ private:
    /**
     * Retrieve if we can connect to the proxy (update statusIpvX_)
     */
-    void handleProxyConfirm(const asio::error_code &ec);
+    void handleProxyConfirm(const asio::error_code& ec);
    std::unique_ptr<asio::steady_timer> nextProxyConfirmationTimer_;
    std::unique_ptr<asio::steady_timer> listenerRestartTimer_;

    /**
     * Relaunch LISTEN requests if the client disconnect/reconnect.
     */
-    void restartListeners(const asio::error_code &ec);
+    void restartListeners(const asio::error_code& ec);

    /**
     * Refresh a listen via a token
@@ -445,12 +456,12 @@ private:
     */
    std::string platform_
 #ifdef __ANDROID__
-    {"android"};
+        {"android"};
 #else
 #ifdef __APPLE__
-    {"ios"};
+        {"ios"};
 #else
-    {};
+        {};
 #endif
 #endif

@@ -467,4 +478,4 @@ private:
    std::shared_ptr<http::Request> buildRequest(const std::string& target = {});
 };

-}
+} // namespace dht
@@ -1,23 +1,5 @@
-/*
- *  Copyright (C) 2014-2025 Savoir-faire Linux Inc.
- *  Author: Sébastien Blin <sebastien.blin@savoirfairelinux.com>
- *          Adrien Béraud <adrien.beraud@savoirfairelinux.com>
- *          Vsevolod Ivanov <vsevolod.ivanov@savoirfairelinux.com>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 3 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program. If not, see <https://www.gnu.org/licenses/>.
- */
-
+// Copyright (c) 2014-2026 Savoir-faire Linux Inc.
+// SPDX-License-Identifier: MIT
 #pragma once

 #include "callbacks.h"
@@ -37,12 +19,9 @@
 #include <mutex>

 namespace dht {
-enum class PushType {
-    None = 0,
-    Android,
-    iOS,
-    UnifiedPush
-};
+// Appended only: the values are serialized as integers by MSGPACK_ADD_ENUM,
+// so reordering would break compatibility with deployed proxies.
+enum class PushType { None = 0, Android, iOS, UnifiedPush, Huawei };
 }
 MSGPACK_ADD_ENUM(dht::PushType)

@@ -55,14 +34,15 @@ namespace dht {
 namespace http {
 class Request;
 struct ListenerSession;
-}
+} // namespace http

 class DhtRunner;

 using RestRouter = restinio::router::express_router_t<>;
 using RequestStatus = restinio::request_handling_status_t;

-struct OPENDHT_PUBLIC ProxyServerConfig {
+struct OPENDHT_PUBLIC ProxyServerConfig
+{
    std::string address {};
    in_port_t port {8000};
    std::string pushServer {};
@@ -86,8 +66,8 @@ public:
     * it will fails silently
     */
    DhtProxyServer(const std::shared_ptr<DhtRunner>& dht,
-        const ProxyServerConfig& config = {},
-        const std::shared_ptr<log::Logger>& logger = {});
+                   const ProxyServerConfig& config = {},
+                   const std::shared_ptr<log::Logger>& logger = {});

    virtual ~DhtProxyServer();

@@ -98,33 +78,44 @@ public:

    asio::io_context& io_context() const;

+    // Monotonic clock for elapsed-time statistics (request rate, uptime).
+    // Must stay on steady_clock so NTP/wall-clock corrections don't skew durations.
    using clock = std::chrono::steady_clock;
    using time_point = clock::time_point;
+    // Wall clock for persisted subscribe/permanent-put lease expirations,
+    // so they map directly to epoch time and survive restarts.
+    using sys_clock = std::chrono::system_clock;
+    using sys_time_point = sys_clock::time_point;

-    struct PushStats {
+    struct PushStats
+    {
        uint64_t highPriorityCount {0};
        uint64_t normalPriorityCount {0};

-        void increment(bool highPriority) {
+        void increment(bool highPriority)
+        {
            if (highPriority)
                highPriorityCount++;
            else
                normalPriorityCount++;
        }

-        Json::Value toJson() const {
+        Json::Value toJson() const
+        {
            Json::Value val;
            val["highPriorityCount"] = static_cast<Json::UInt64>(highPriorityCount);
            val["normalPriorityCount"] = static_cast<Json::UInt64>(normalPriorityCount);
            return val;
        }

-        std::string toString() const {
+        std::string toString() const
+        {
            return fmt::format("{} high priority, {} normal priority", highPriorityCount, normalPriorityCount);
        }
    };

-    struct OPENDHT_PUBLIC ServerStats {
+    struct OPENDHT_PUBLIC ServerStats
+    {
        /** Current number of listen operations */
        size_t listenCount {0};
        /** Current number of permanent put operations (hash used) */
@@ -139,10 +130,11 @@ public:
        /** Last time at which the stats were updated */
        time_point lastUpdated;
        /** Total number of push notification requests that the server attempted to
-          * send since being started, broken down by type and priority level */
+         * send since being started, broken down by type and priority level */
        PushStats androidPush;
        PushStats iosPush;
        PushStats unifiedPush;
+        PushStats huaweiPush;

        /** Average requests per second */
        double requestRate {0};
@@ -168,13 +160,12 @@ private:
    struct RestRouterTraitsTls;
    struct RestRouterTraits;

-    template <typename HttpResponse>
+    template<typename HttpResponse>
    static HttpResponse initHttpResponse(HttpResponse response);
    static restinio::request_handling_status_t serverError(restinio::request_t& request);

-    template< typename ServerSettings >
-    void addServerSettings(ServerSettings& serverSettings,
-                           const unsigned int max_pipelined_requests = 16);
+    template<typename ServerSettings>
+    void addServerSettings(ServerSettings& serverSettings, const unsigned int max_pipelined_requests = 16);

    std::unique_ptr<RestRouter> createRestRouter();

@@ -187,8 +178,7 @@ private:
     * On error: HTTP 503, body: {"err":"xxxx"}
     * @param session
     */
-    RequestStatus getNodeInfo(restinio::request_handle_t request,
-                               restinio::router::route_params_t params) const;
+    RequestStatus getNodeInfo(restinio::request_handle_t request, restinio::router::route_params_t params) const;

    /**
     * Return ServerStats in JSON format
@@ -196,8 +186,7 @@ private:
     * Result: HTTP 200, body: Node infos in JSON format
     * @param session
     */
-    RequestStatus getStats(restinio::request_handle_t request,
-                           restinio::router::route_params_t params);
+    RequestStatus getStats(restinio::request_handle_t request, restinio::router::route_params_t params);

    /**
     * Return Values of an infoHash
@@ -209,8 +198,7 @@ private:
     * On error: HTTP 503, body: {"err":"xxxx"}
     * @param session
     */
-    RequestStatus get(restinio::request_handle_t request,
-                       restinio::router::route_params_t params);
+    RequestStatus get(restinio::request_handle_t request, restinio::router::route_params_t params);

    /**
     * Listen incoming Values of an infoHash.
@@ -222,8 +210,7 @@ private:
     * On error: HTTP 503, body: {"err":"xxxx"}
     * @param session
     */
-    RequestStatus listen(restinio::request_handle_t request,
-                         restinio::router::route_params_t params);
+    RequestStatus listen(restinio::request_handle_t request, restinio::router::route_params_t params);

    /**
     * Put a value on the DHT
@@ -234,10 +221,9 @@ private:
     * HTTP 400, body: {"err":"xxxx"} if bad json or HTTP 502 if put fails
     * @param session
     */
-    RequestStatus put(restinio::request_handle_t request,
-                      restinio::router::route_params_t params);
+    RequestStatus put(restinio::request_handle_t request, restinio::router::route_params_t params);

-    void handleCancelPermamentPut(const asio::error_code &ec, const InfoHash& key, Value::Id vid);
+    void handleCancelPermamentPut(const asio::error_code& ec, const InfoHash& key, Value::Id vid);

 #ifdef OPENDHT_PROXY_SERVER_IDENTITY
    /**
@@ -249,8 +235,7 @@ private:
     * HTTP 400, body: {"err":"xxxx"} if bad json
     * @param session
     */
-    RequestStatus putSigned(restinio::request_handle_t request,
-                            restinio::router::route_params_t params) const;
+    RequestStatus putSigned(restinio::request_handle_t request, restinio::router::route_params_t params) const;

    /**
     * Put a value to encrypt by the proxy on the DHT
@@ -261,8 +246,7 @@ private:
     * HTTP 400, body: {"err":"xxxx"} if bad json
     * @param session
     */
-    RequestStatus putEncrypted(restinio::request_handle_t request,
-                               restinio::router::route_params_t params);
+    RequestStatus putEncrypted(restinio::request_handle_t request, restinio::router::route_params_t params);

 #endif // OPENDHT_PROXY_SERVER_IDENTITY

@@ -276,8 +260,7 @@ private:
     * On error: HTTP 503, body: {"err":"xxxx"}
     * @param session
     */
-    RequestStatus getFiltered(restinio::request_handle_t request,
-                              restinio::router::route_params_t params);
+    RequestStatus getFiltered(restinio::request_handle_t request, restinio::router::route_params_t params);

    /**
     * Respond allowed Methods
@@ -286,21 +269,25 @@ private:
     * See https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods/OPTIONS
     * @param session
     */
-    RequestStatus options(restinio::request_handle_t request,
-                           restinio::router::route_params_t params);
+    RequestStatus options(restinio::request_handle_t request, restinio::router::route_params_t params);

-    struct PushSessionContext {
+    struct PushSessionContext
+    {
        std::mutex lock;
        std::string sessionId;
-        PushSessionContext(const std::string& id) : sessionId(id) {}
+        /** Where to push: follows the latest subscription refresh of the device. */
+        PushType type {PushType::None};
+        std::string topic;
+        PushSessionContext(const std::string& id)
+            : sessionId(id)
+        {}
    };

 #ifdef OPENDHT_PUSH_NOTIFICATIONS
    PushType getTypeFromString(const std::string& type);
    std::string getDefaultTopic(PushType type);

-    RequestStatus pingPush(restinio::request_handle_t request,
-                         restinio::router::route_params_t /*params*/);
+    RequestStatus pingPush(restinio::request_handle_t request, restinio::router::route_params_t /*params*/);
    /**
     * Subscribe to push notifications for an iOS or Android device.
     * Method: SUBSCRIBE "/{InfoHash: .*}"
@@ -310,8 +297,7 @@ private:
     * so you need to refresh the operation each six hours.
     * @param session
     */
-    RequestStatus subscribe(restinio::request_handle_t request,
-                            restinio::router::route_params_t params);
+    RequestStatus subscribe(restinio::request_handle_t request, restinio::router::route_params_t params);

    /**
     * Unsubscribe to push notifications for an iOS or Android device.
@@ -320,15 +306,15 @@ private:
     * Return: nothing
     * @param session
     */
-    RequestStatus unsubscribe(restinio::request_handle_t request,
-                              restinio::router::route_params_t params);
+    RequestStatus unsubscribe(restinio::request_handle_t request, restinio::router::route_params_t params);

    /**
     * Send a push notification via a gorush push gateway
     * @param key of the device
     * @param json, the content to send
     */
-    void sendPushNotification(const std::string& key, Json::Value&& json, PushType type, bool highPriority, const std::string& topic);
+    void sendPushNotification(
+        const std::string& key, Json::Value&& json, PushType type, bool highPriority, const std::string& topic);

    /**
     * Send push notification with an expire timeout.
@@ -338,8 +324,11 @@ private:
     * @param type
     * @param topic
     */
-    void handleNotifyPushListenExpire(const asio::error_code &ec, const std::string pushToken,
-                                      std::function<Json::Value()> json, PushType type, const std::string& topic);
+    void handleNotifyPushListenExpire(const asio::error_code& ec,
+                                      const std::string pushToken,
+                                      std::function<Json::Value()> json,
+                                      PushType type,
+                                      const std::string& topic);

    /**
     * Remove a push listener between a client and a hash
@@ -348,36 +337,38 @@ private:
     * @param key
     * @param clientId
     */
-    void handleCancelPushListen(const asio::error_code &ec, const std::string pushToken,
-                                const InfoHash key, const std::string clientId);
+    void handleCancelPushListen(const asio::error_code& ec,
+                                const std::string pushToken,
+                                const InfoHash key,
+                                const std::string clientId);

    /**
     * Handles a push listen request.
     *
     * @param infoHash The information hash associated with the push listen request.
     * @param pushToken The push token associated with the push listen request.
-     * @param type The type of the push listen request.
     * @param clientId The client ID associated with the push listen request.
-     * @param sessionCtx The shared pointer to the push session context associated with the push listen request.
-     * @param topic The topic associated with the push listen request.
+     * @param sessionCtx The push session context of the listener, giving the session, push type and topic to use.
     * @param values The vector of shared pointers to values associated with the push listen request.
     * @param expired A boolean indicating whether the push listen request has expired.
     * @return true.
     */
-    bool handlePushListen(const InfoHash& infoHash, const std::string& pushToken,
-                          PushType type, const std::string& clientId,
-                          const std::shared_ptr<DhtProxyServer::PushSessionContext>& sessionCtx, const std::string& topic,
-                          const std::vector<std::shared_ptr<Value>>& values, bool expired);
+    bool handlePushListen(const InfoHash& infoHash,
+                          const std::string& pushToken,
+                          const std::string& clientId,
+                          const std::shared_ptr<DhtProxyServer::PushSessionContext>& sessionCtx,
+                          const std::vector<std::shared_ptr<Value>>& values,
+                          bool expired);

-#endif //OPENDHT_PUSH_NOTIFICATIONS
+#endif // OPENDHT_PUSH_NOTIFICATIONS

-    void handlePrintStats(const asio::error_code &ec);
+    void handlePrintStats(const asio::error_code& ec);
    void updateStats();

-    template <typename Os>
+    template<typename Os>
    void saveState(Os& stream);

-    template <typename Is>
+    template<typename Is>
    void loadState(Is& is, size_t size);

    std::shared_ptr<asio::io_context> ioContext_;
@@ -409,6 +400,7 @@ private:
    PushStats androidPush_;
    PushStats iosPush_;
    PushStats unifiedPush_;
+    PushStats huaweiPush_;

    // Thread-safe access to listeners map.
    std::mutex lockListener_;
@@ -416,42 +408,52 @@ private:
    std::map<restinio::connection_id_t, http::ListenerSession> listeners_;
    // Connection Listener observing conn state changes.
    std::shared_ptr<ConnectionListener> connListener_;
-    struct PermanentPut {
-        time_point expiration;
+    struct PermanentPut
+    {
+        sys_time_point expiration;
        std::string pushToken;
        std::string clientId;
        std::shared_ptr<PushSessionContext> sessionCtx;
-        std::unique_ptr<asio::steady_timer> expireTimer;
-        std::unique_ptr<asio::steady_timer> expireNotifyTimer;
+        std::unique_ptr<asio::system_timer> expireTimer;
+        std::unique_ptr<asio::system_timer> expireNotifyTimer;
        Sp<Value> value;
        PushType type;
        std::string topic;

-        template <typename Packer>
+        template<typename Packer>
        void msgpack_pack(Packer& p) const
        {
-            p.pack_map(2 + (sessionCtx ? 1 : 0) + (clientId.empty() ? 0 : 1) + (type == PushType::None ? 0 : 2) + (topic.empty() ? 0 : 1));
-            p.pack("value"); p.pack(value);
-            p.pack("exp"); p.pack(to_time_t(expiration));
+            p.pack_map(2 + (sessionCtx ? 1 : 0) + (clientId.empty() ? 0 : 1) + (type == PushType::None ? 0 : 2)
+                       + (topic.empty() ? 0 : 1));
+            p.pack("value");
+            p.pack(value);
+            p.pack("exp");
+            p.pack(sys_clock::to_time_t(expiration));
            if (not clientId.empty()) {
-                p.pack("cid"); p.pack(clientId);
+                p.pack("cid");
+                p.pack(clientId);
            }
            if (sessionCtx) {
-                std::lock_guard<std::mutex> l(sessionCtx->lock);
-                p.pack("sid"); p.pack(sessionCtx->sessionId);
+                std::lock_guard l(sessionCtx->lock);
+                p.pack("sid");
+                p.pack(sessionCtx->sessionId);
            }
            if (type != PushType::None) {
-                p.pack("t"); p.pack(type);
-                p.pack("token"); p.pack(pushToken);
+                p.pack("t");
+                p.pack(type);
+                p.pack("token");
+                p.pack(pushToken);
            }
            if (not topic.empty()) {
-                p.pack("top"); p.pack(topic);
+                p.pack("top");
+                p.pack(topic);
            }
        }

        void msgpack_unpack(const msgpack::object& o);
    };
-    struct SearchPuts {
+    struct SearchPuts
+    {
        std::map<dht::Value::Id, PermanentPut> puts;
        MSGPACK_DEFINE_ARRAY(puts)
    };
@@ -465,40 +467,47 @@ private:
    std::string bundleId_;

 #ifdef OPENDHT_PUSH_NOTIFICATIONS
-    struct Listener {
-        time_point expiration;
+    struct Listener
+    {
+        sys_time_point expiration;
        std::string clientId;
        std::shared_ptr<PushSessionContext> sessionCtx;
        std::future<size_t> internalToken;
-        std::unique_ptr<asio::steady_timer> expireTimer;
-        std::unique_ptr<asio::steady_timer> expireNotifyTimer;
+        std::unique_ptr<asio::system_timer> expireTimer;
+        std::unique_ptr<asio::system_timer> expireNotifyTimer;
        PushType type;
        std::string topic;

-        template <typename Packer>
+        template<typename Packer>
        void msgpack_pack(Packer& p) const
        {
            p.pack_map(3 + (sessionCtx ? 1 : 0) + (topic.empty() ? 0 : 1));
-            p.pack("cid"); p.pack(clientId);
-            p.pack("exp"); p.pack(to_time_t(expiration));
+            p.pack("cid");
+            p.pack(clientId);
+            p.pack("exp");
+            p.pack(sys_clock::to_time_t(expiration));
            if (sessionCtx) {
-                std::lock_guard<std::mutex> l(sessionCtx->lock);
-                p.pack("sid"); p.pack(sessionCtx->sessionId);
+                std::lock_guard l(sessionCtx->lock);
+                p.pack("sid");
+                p.pack(sessionCtx->sessionId);
            }
-            p.pack("t"); p.pack(type);
+            p.pack("t");
+            p.pack(type);
            if (!topic.empty()) {
-                p.pack("top"); p.pack(topic);
+                p.pack("top");
+                p.pack(topic);
            }
        }

        void msgpack_unpack(const msgpack::object& o);
    };
-    struct PushListener {
+    struct PushListener
+    {
        std::map<InfoHash, std::vector<Listener>> listeners;
        MSGPACK_DEFINE_ARRAY(listeners)
    };
    std::map<std::string, PushListener> pushListeners_;
-#endif //OPENDHT_PUSH_NOTIFICATIONS
+#endif // OPENDHT_PUSH_NOTIFICATIONS
 };

-}
+} // namespace dht
@@ -1,23 +1,5 @@
-/*
- *  Copyright (C) 2014-2025 Savoir-faire Linux Inc.
- *  Authors: Adrien Béraud <adrien.beraud@savoirfairelinux.com>
- *           Simon Désaulniers <simon.desaulniers@savoirfairelinux.com>
- *           Sébastien Blin <sebastien.blin@savoirfairelinux.com>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 3 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program. If not, see <https://www.gnu.org/licenses/>.
- */
-
+// Copyright (c) 2014-2026 Savoir-faire Linux Inc.
+// SPDX-License-Identifier: MIT
 #pragma once

 #include "def.h"
@@ -51,12 +33,13 @@ struct SecureDhtConfig;
 * either wait for (expectedly frequent) calls to ::loop() or start an internal
 * thread that will update the DHT when appropriate.
 */
-class OPENDHT_PUBLIC DhtRunner {
-
+class OPENDHT_PUBLIC DhtRunner
+{
 public:
    using StatusCallback = std::function<void(NodeStatus, NodeStatus)>;

-    struct Config {
+    struct Config
+    {
        SecureDhtConfig dht_config {};
        bool threaded {true};
        std::string proxy_server {};
@@ -72,13 +55,13 @@ public:
        SockAddr bind4 {}, bind6 {};
    };

-    struct Context {
+    struct Context
+    {
        std::shared_ptr<Logger> logger {};
        std::unique_ptr<net::DatagramSocket> sock;
        std::shared_ptr<PeerDiscovery> peerDiscovery {};
        StatusCallback statusChangedCallback {};
-        CertificateStoreQueryLegacy certificateStore {};
-        CertificateStoreQuery certificateStorePkId {};
+        CertificateStoreQuery certificateStore {};
        IdentityAnnouncedCb identityAnnouncedCb {};
        PublicAddressChangedCb publicAddressChangedCb {};
        std::unique_ptr<std::mt19937_64> rng {};
@@ -88,205 +71,270 @@ public:
    DhtRunner();
    virtual ~DhtRunner();

-    void get(InfoHash id, GetCallbackSimple cb, DoneCallback donecb={}, Value::Filter f = {}, Where w = {}) {
+    void get(InfoHash id, GetCallbackSimple cb, DoneCallback donecb = {}, Value::Filter f = {}, Where w = {})
+    {
        get(id, bindGetCb(cb), donecb, f, w);
    }

-    void get(InfoHash id, GetCallbackSimple cb, DoneCallbackSimple donecb={}, Value::Filter f = {}, Where w = {}) {
+    void get(InfoHash id, GetCallbackSimple cb, DoneCallbackSimple donecb = {}, Value::Filter f = {}, Where w = {})
+    {
        get(id, bindGetCb(cb), donecb, f, w);
    }

-    void get(InfoHash hash, GetCallback vcb, DoneCallback dcb, Value::Filter f={}, Where w = {});
+    void get(InfoHash hash, GetCallback vcb, DoneCallback dcb, Value::Filter f = {}, Where w = {});

-    void get(InfoHash id, GetCallback cb, DoneCallbackSimple donecb={}, Value::Filter f = {}, Where w = {}) {
+    void get(InfoHash id, GetCallback cb, DoneCallbackSimple donecb = {}, Value::Filter f = {}, Where w = {})
+    {
        get(id, cb, bindDoneCb(donecb), f, w);
    }
-    void get(const std::string& key, GetCallback vcb, DoneCallbackSimple dcb={}, Value::Filter f = {}, Where w = {});
+    void get(const std::string& key, GetCallback vcb, DoneCallbackSimple dcb = {}, Value::Filter f = {}, Where w = {});

-    template <class T>
-    void get(InfoHash hash, std::function<bool(std::vector<T>&&)> cb, DoneCallbackSimple dcb={})
+    template<class T>
+    void get(InfoHash hash, std::function<bool(std::vector<T>&&)> cb, DoneCallbackSimple dcb = {})
    {
-        get(hash, [cb=std::move(cb)](const std::vector<std::shared_ptr<Value>>& vals) {
-            return cb(unpackVector<T>(vals));
-        },
-        dcb,
-        getFilterSet<T>());
+        get(
+            hash,
+            [cb = std::move(cb)](const std::vector<std::shared_ptr<Value>>& vals) { return cb(unpackVector<T>(vals)); },
+            dcb,
+            getFilterSet<T>());
    }
-    template <class T>
-    void get(InfoHash hash, std::function<bool(T&&)> cb, DoneCallbackSimple dcb={})
+    template<class T>
+    void get(InfoHash hash, std::function<bool(T&&)> cb, DoneCallbackSimple dcb = {})
    {
-        get(hash, [cb=std::move(cb)](const std::vector<std::shared_ptr<Value>>& vals) {
-            for (const auto& v : vals) {
-                try {
-                    if (not cb(Value::unpack<T>(*v)))
-                        return false;
-                } catch (const std::exception&) {
-                    continue;
+        get(
+            hash,
+            [cb = std::move(cb)](const std::vector<std::shared_ptr<Value>>& vals) {
+                for (const auto& v : vals) {
+                    try {
+                        if (not cb(Value::unpack<T>(*v)))
+                            return false;
+                    } catch (const std::exception&) {
+                        continue;
+                    }
                }
-            }
-            return true;
-        },
-        dcb,
-        getFilterSet<T>());
+                return true;
+            },
+            dcb,
+            getFilterSet<T>());
    }

-    std::future<std::vector<std::shared_ptr<dht::Value>>> get(InfoHash key, Value::Filter f = {}, Where w = {}) {
-        auto p = std::make_shared<std::promise<std::vector<std::shared_ptr< dht::Value >>>>();
-        auto values = std::make_shared<std::vector<std::shared_ptr< dht::Value >>>();
-        get(key, [=](const std::vector<std::shared_ptr<dht::Value>>& vlist) {
-            values->insert(values->end(), vlist.begin(), vlist.end());
-            return true;
-        }, [=](bool) {
-            p->set_value(std::move(*values));
-        },
-        f, w);
+    std::future<std::vector<std::shared_ptr<dht::Value>>> get(InfoHash key, Value::Filter f = {}, Where w = {})
+    {
+        auto p = std::make_shared<std::promise<std::vector<std::shared_ptr<dht::Value>>>>();
+        auto values = std::make_shared<std::vector<std::shared_ptr<dht::Value>>>();
+        get(
+            key,
+            [=](const std::vector<std::shared_ptr<dht::Value>>& vlist) {
+                values->insert(values->end(), vlist.begin(), vlist.end());
+                return true;
+            },
+            [=](bool) { p->set_value(std::move(*values)); },
+            f,
+            w);
        return p->get_future();
    }

-    template <class T>
-    std::future<std::vector<T>> get(InfoHash key) {
+    template<class T>
+    std::future<std::vector<T>> get(InfoHash key)
+    {
        auto p = std::make_shared<std::promise<std::vector<T>>>();
        auto values = std::make_shared<std::vector<T>>();
-        get<T>(key, [=](T&& v) {
-            values->emplace_back(std::move(v));
-            return true;
-        }, [=](bool) {
-            p->set_value(std::move(*values));
-        });
+        get<T>(
+            key,
+            [=](T&& v) {
+                values->emplace_back(std::move(v));
+                return true;
+            },
+            [=](bool) { p->set_value(std::move(*values)); });
        return p->get_future();
    }

    void query(const InfoHash& hash, QueryCallback cb, DoneCallback done_cb = {}, Query q = {});
-    void query(const InfoHash& hash, QueryCallback cb, DoneCallbackSimple done_cb = {}, Query q = {}) {
+    void query(const InfoHash& hash, QueryCallback cb, DoneCallbackSimple done_cb = {}, Query q = {})
+    {
        query(hash, cb, bindDoneCb(done_cb), q);
    }

    std::future<size_t> listen(InfoHash key, ValueCallback vcb, Value::Filter f = {}, Where w = {});

-    std::future<size_t> listen(InfoHash key, GetCallback cb, Value::Filter f={}, Where w={}) {
-        return listen(key, [cb=std::move(cb)](const std::vector<Sp<Value>>& vals, bool expired){
-            if (not expired)
-                return cb(vals);
-            return true;
-        }, std::forward<Value::Filter>(f), std::forward<Where>(w));
+    std::future<size_t> listen(InfoHash key, GetCallback cb, Value::Filter f = {}, Where w = {})
+    {
+        return listen(
+            key,
+            [cb = std::move(cb)](const std::vector<Sp<Value>>& vals, bool expired) {
+                if (not expired)
+                    return cb(vals);
+                return true;
+            },
+            std::forward<Value::Filter>(f),
+            std::forward<Where>(w));
    }
    std::future<size_t> listen(const std::string& key, GetCallback vcb, Value::Filter f = {}, Where w = {});
-    std::future<size_t> listen(InfoHash key, GetCallbackSimple cb, Value::Filter f = {}, Where w = {}) {
+    std::future<size_t> listen(InfoHash key, GetCallbackSimple cb, Value::Filter f = {}, Where w = {})
+    {
        return listen(key, bindGetCb(cb), f, w);
    }

-    template <class T>
+    template<class T>
    std::future<size_t> listen(InfoHash hash, std::function<bool(std::vector<T>&&)> cb)
    {
-        return listen(hash, [cb=std::move(cb)](const std::vector<std::shared_ptr<Value>>& vals) {
-            return cb(unpackVector<T>(vals));
-        },
-        getFilterSet<T>());
+        return listen(
+            hash,
+            [cb = std::move(cb)](const std::vector<std::shared_ptr<Value>>& vals) { return cb(unpackVector<T>(vals)); },
+            getFilterSet<T>());
    }
-    template <class T>
+    template<class T>
    std::future<size_t> listen(InfoHash hash, std::function<bool(std::vector<T>&&, bool)> cb)
    {
-        return listen(hash, [cb=std::move(cb)](const std::vector<std::shared_ptr<Value>>& vals, bool expired) {
-            return cb(unpackVector<T>(vals), expired);
-        },
-        getFilterSet<T>());
+        return listen(
+            hash,
+            [cb = std::move(cb)](const std::vector<std::shared_ptr<Value>>& vals, bool expired) {
+                return cb(unpackVector<T>(vals), expired);
+            },
+            getFilterSet<T>());
    }

-    template <typename T>
+    template<typename T>
    std::future<size_t> listen(InfoHash hash, std::function<bool(T&&)> cb, Value::Filter f = {}, Where w = {})
    {
-        return listen(hash, [cb=std::move(cb)](const std::vector<std::shared_ptr<Value>>& vals) {
-            for (const auto& v : vals) {
-                try {
-                    if (not cb(Value::unpack<T>(*v)))
-                        return false;
-                } catch (const std::exception&) {
-                    continue;
+        return listen(
+            hash,
+            [cb = std::move(cb)](const std::vector<std::shared_ptr<Value>>& vals) {
+                for (const auto& v : vals) {
+                    try {
+                        if (not cb(Value::unpack<T>(*v)))
+                            return false;
+                    } catch (const std::exception&) {
+                        continue;
+                    }
                }
-            }
-            return true;
-        },
-        getFilterSet<T>(f), w);
+                return true;
+            },
+            getFilterSet<T>(f),
+            w);
    }
-    template <typename T>
+    template<typename T>
    std::future<size_t> listen(InfoHash hash, std::function<bool(T&&, bool)> cb, Value::Filter f = {}, Where w = {})
    {
-        return listen(hash, [cb=std::move(cb)](const std::vector<std::shared_ptr<Value>>& vals, bool expired) {
-            for (const auto& v : vals) {
-                try {
-                    if (not cb(Value::unpack<T>(*v), expired))
-                        return false;
-                } catch (const std::exception&) {
-                    continue;
+        return listen(
+            hash,
+            [cb = std::move(cb)](const std::vector<std::shared_ptr<Value>>& vals, bool expired) {
+                for (const auto& v : vals) {
+                    try {
+                        if (not cb(Value::unpack<T>(*v), expired))
+                            return false;
+                    } catch (const std::exception&) {
+                        continue;
+                    }
                }
-            }
-            return true;
-        },
-        getFilterSet<T>(f), w);
+                return true;
+            },
+            getFilterSet<T>(f),
+            w);
    }

    void cancelListen(InfoHash h, size_t token);
    void cancelListen(InfoHash h, std::shared_future<size_t> token);

-    void put(InfoHash hash, std::shared_ptr<Value> value, DoneCallback cb={}, time_point created=time_point::max(), bool permanent = false);
-    void put(InfoHash hash, std::shared_ptr<Value> value, DoneCallbackSimple cb, time_point created=time_point::max(), bool permanent = false) {
+    void put(InfoHash hash,
+             std::shared_ptr<Value> value,
+             DoneCallback cb = {},
+             time_point created = time_point::max(),
+             bool permanent = false);
+    void put(InfoHash hash,
+             std::shared_ptr<Value> value,
+             DoneCallbackSimple cb,
+             time_point created = time_point::max(),
+             bool permanent = false)
+    {
        put(hash, value, bindDoneCb(cb), created, permanent);
    }

-    void put(InfoHash hash, Value&& value, DoneCallback cb={}, time_point created=time_point::max(), bool permanent = false);
-    void put(InfoHash hash, Value&& value, DoneCallbackSimple cb, time_point created=time_point::max(), bool permanent = false) {
+    void put(InfoHash hash,
+             Value&& value,
+             DoneCallback cb = {},
+             time_point created = time_point::max(),
+             bool permanent = false);
+    void put(InfoHash hash,
+             Value&& value,
+             DoneCallbackSimple cb,
+             time_point created = time_point::max(),
+             bool permanent = false)
+    {
        put(hash, std::forward<Value>(value), bindDoneCb(cb), created, permanent);
    }
-    void put(const std::string& key, Value&& value, DoneCallbackSimple cb={}, time_point created=time_point::max(), bool permanent = false);
+    void put(const std::string& key,
+             Value&& value,
+             DoneCallbackSimple cb = {},
+             time_point created = time_point::max(),
+             bool permanent = false);

    void cancelPut(const InfoHash& h, Value::Id id);
    void cancelPut(const InfoHash& h, const std::shared_ptr<Value>& value);

-    void putSigned(InfoHash hash, std::shared_ptr<Value> value, DoneCallback cb={}, bool permanent = false);
-    void putSigned(InfoHash hash, std::shared_ptr<Value> value, DoneCallbackSimple cb, bool permanent = false) {
+    void putSigned(InfoHash hash, std::shared_ptr<Value> value, DoneCallback cb = {}, bool permanent = false);
+    void putSigned(InfoHash hash, std::shared_ptr<Value> value, DoneCallbackSimple cb, bool permanent = false)
+    {
        putSigned(hash, value, bindDoneCb(cb), permanent);
    }

-    void putSigned(InfoHash hash, Value&& value, DoneCallback cb={}, bool permanent = false);
-    void putSigned(InfoHash hash, Value&& value, DoneCallbackSimple cb, bool permanent = false) {
+    void putSigned(InfoHash hash, Value&& value, DoneCallback cb = {}, bool permanent = false);
+    void putSigned(InfoHash hash, Value&& value, DoneCallbackSimple cb, bool permanent = false)
+    {
        putSigned(hash, std::forward<Value>(value), bindDoneCb(cb), permanent);
    }
-    void putSigned(const std::string& key, Value&& value, DoneCallbackSimple cb={}, bool permanent = false);
+    void putSigned(const std::string& key, Value&& value, DoneCallbackSimple cb = {}, bool permanent = false);

-    void putEncrypted(InfoHash hash, InfoHash to, std::shared_ptr<Value> value, DoneCallback cb={}, bool permanent = false);
-    void putEncrypted(InfoHash hash, InfoHash to, std::shared_ptr<Value> value, DoneCallbackSimple cb, bool permanent = false) {
+    void putEncrypted(InfoHash hash,
+                      const std::shared_ptr<crypto::PublicKey>& to,
+                      std::shared_ptr<Value> value,
+                      DoneCallback cb = {},
+                      bool permanent = false);
+    void putEncrypted(InfoHash hash,
+                      const std::shared_ptr<crypto::PublicKey>& to,
+                      std::shared_ptr<Value> value,
+                      DoneCallbackSimple cb,
+                      bool permanent = false)
+    {
        putEncrypted(hash, to, value, bindDoneCb(cb), permanent);
    }

-    void putEncrypted(InfoHash hash, InfoHash to, Value&& value, DoneCallback cb={}, bool permanent = false);
-    void putEncrypted(InfoHash hash, InfoHash to, Value&& value, DoneCallbackSimple cb, bool permanent = false) {
-        putEncrypted(hash, to, std::forward<Value>(value), bindDoneCb(cb), permanent);
-    }
-    void putEncrypted(const std::string& key, InfoHash to, Value&& value, DoneCallback cb={}, bool permanent = false);
-
-    void putEncrypted(InfoHash hash, const std::shared_ptr<crypto::PublicKey>& to, std::shared_ptr<Value> value, DoneCallback cb={}, bool permanent = false);
-    void putEncrypted(InfoHash hash, const std::shared_ptr<crypto::PublicKey>& to, std::shared_ptr<Value> value, DoneCallbackSimple cb, bool permanent = false) {
-        putEncrypted(hash, to, value, bindDoneCb(cb), permanent);
-    }
-
-    [[deprecated("Use the shared_ptr version instead")]]
-    void putEncrypted(InfoHash hash, const std::shared_ptr<crypto::PublicKey>& to, Value&& value, DoneCallback cb={}, bool permanent = false);
-    [[deprecated("Use the shared_ptr version instead")]]
-    void putEncrypted(InfoHash hash, const std::shared_ptr<crypto::PublicKey>& to, Value&& value, DoneCallbackSimple cb, bool permanent = false) {
+    void putEncrypted(InfoHash hash,
+                      const std::shared_ptr<crypto::PublicKey>& to,
+                      Value&& value,
+                      DoneCallback cb = {},
+                      bool permanent = false);
+    void putEncrypted(InfoHash hash,
+                      const std::shared_ptr<crypto::PublicKey>& to,
+                      Value&& value,
+                      DoneCallbackSimple cb,
+                      bool permanent = false)
+    {
        putEncrypted(hash, to, std::forward<Value>(value), bindDoneCb(cb), permanent);
    }

-    void putEncrypted(InfoHash hash, const PkId& to, std::shared_ptr<Value> value, DoneCallback cb={}, bool permanent = false);
-    void putEncrypted(InfoHash hash, const PkId& to, std::shared_ptr<Value> value, DoneCallbackSimple cb, bool permanent = false) {
+    void putEncrypted(
+        InfoHash hash, const PkId& to, std::shared_ptr<Value> value, DoneCallback cb = {}, bool permanent = false);
+    void putEncrypted(
+        InfoHash hash, const PkId& to, std::shared_ptr<Value> value, DoneCallbackSimple cb, bool permanent = false)
+    {
        putEncrypted(hash, to, value, bindDoneCb(cb), permanent);
    }
+    void putEncrypted(InfoHash hash, const PkId& to, Value&& value, DoneCallback cb = {}, bool permanent = false)
+    {
+        putEncrypted(hash, to, std::make_shared<Value>(std::move(value)), std::move(cb), permanent);
+    }
+    void putEncrypted(InfoHash hash, const PkId& to, Value&& value, DoneCallbackSimple cb, bool permanent = false)
+    {
+        putEncrypted(hash, to, std::make_shared<Value>(std::move(value)), bindDoneCb(cb), permanent);
+    }

    /**
     * Insert known nodes to the routing table, without necessarly ping them.
     * Usefull to restart a node and get things running fast without putting load on the network.
     */
-    void bootstrap(std::vector<SockAddr> nodes, DoneCallbackSimple cb={});
-    void bootstrap(SockAddr addr, DoneCallbackSimple cb={});
+    void bootstrap(std::vector<SockAddr> nodes, DoneCallbackSimple cb = {});
+    void bootstrap(SockAddr addr, DoneCallbackSimple cb = {});

    /**
     * Insert known nodes to the routing table, without necessarly ping them.
@@ -348,17 +396,17 @@ public:

    std::pair<size_t, size_t> getStoreSize() const;

-    void getStorageLimit() const;
-    void setStorageLimit(size_t limit = DEFAULT_STORAGE_LIMIT);
+    size_t getStorageLimit() const;
+    void setStorageLimit(size_t limit = 0);
+
+    size_t getLocalStorageLimit() const;
+    void setLocalStorageLimit(size_t limit = 0);

    std::vector<NodeExport> exportNodes() const;

    std::vector<ValuesExport> exportValues() const;

    void setLogger(const Sp<Logger>& logger = {});
-    void setLogger(const Logger& logger) {
-        setLogger(std::make_shared<Logger>(logger));
-    }

    /**
     * Only print logs related to the given InfoHash (if given), or disable filter (if zeroes).
@@ -370,12 +418,14 @@ public:

    void importValues(const std::vector<ValuesExport>& values);

-    bool isRunning() const {
-        return running != State::Idle;
-    }
+    bool isRunning() const { return running != State::Idle; }

    NodeStats getNodesStats(sa_family_t af) const;
-    unsigned getNodesStats(sa_family_t af, unsigned *good_return, unsigned *dubious_return, unsigned *cached_return, unsigned *incoming_return) const;
+    unsigned getNodesStats(sa_family_t af,
+                           unsigned* good_return,
+                           unsigned* dubious_return,
+                           unsigned* cached_return,
+                           unsigned* incoming_return) const;
    NodeInfo getNodeInfo() const;
    void getNodeInfo(std::function<void(std::shared_ptr<NodeInfo>)>);

@@ -390,12 +440,9 @@ public:
    void getPublicAddress(std::function<void(std::vector<SockAddr>&&)>, sa_family_t af = AF_UNSPEC);

    // securedht methods
-
-    void findCertificate(InfoHash hash, std::function<void(const std::shared_ptr<crypto::Certificate>&)>);
    void findCertificate(PkId hash, std::function<void(const std::shared_ptr<crypto::Certificate>&)>);

    void registerCertificate(const std::shared_ptr<crypto::Certificate>& cert);
-    void setLocalCertificateStore(CertificateStoreQueryLegacy&& query_method);
    void setLocalCertificateStore(CertificateStoreQuery&& query_method);

    /**
@@ -404,7 +451,11 @@ public:
     * @param threaded: If false, ::loop() must be called periodically. Otherwise a thread is launched.
     * @param cb: Optional callback to receive general state information.
     */
-    void run(in_port_t port = dht::net::DHT_DEFAULT_PORT, const crypto::Identity& identity = {}, bool threaded = true, NetId network = 0) {
+    void run(in_port_t port = dht::net::DHT_DEFAULT_PORT,
+             const crypto::Identity& identity = {},
+             bool threaded = true,
+             NetId network = 0)
+    {
        Config config;
        config.dht_config.node_config.network = network;
        config.dht_config.id = identity;
@@ -414,13 +465,15 @@ public:
    void run(in_port_t port, Config& config, Context&& context = {});

    /**
-     * Same as @run(sockaddr_in, sockaddr_in6, Identity, bool, StatusCallback), but with string IP addresses and service (port).
+     * Same as @run(sockaddr_in, sockaddr_in6, Identity, bool, StatusCallback), but with string IP addresses and service
+     * (port).
     */
    void run(const char* ip4, const char* ip6, const char* service, Config& config, Context&& context = {});

    void run(const Config& config, Context&& context);

-    void setOnStatusChanged(StatusCallback&& cb) {
+    void setOnStatusChanged(StatusCallback&& cb)
+    {
        if (cb)
            statusCbs.emplace_back(std::move(cb));
    }
@@ -430,8 +483,9 @@ public:
     * regularly and everytime a new packet is received.
     * @return the next op
     */
-    time_point loop() {
-        std::lock_guard<std::mutex> lck(dht_mtx);
+    time_point loop()
+    {
+        std::lock_guard lck(dht_mtx);
        return loop_();
    }

@@ -466,18 +520,20 @@ public:
     */
    void setPushNotificationToken(const std::string& token);

-     /**
+    /**
     * Sets the push notification topic
     */
    void setPushNotificationTopic(const std::string& topic);

-     /**
+    /**
     * Sets the push notification platform
     */
    void setPushNotificationPlatform(const std::string& platform);

    /**
     * Insert a push notification to process for OpenDHT
+     * Returns an immediately ready future with IgnoredStopped if the runner is idle,
+     * or IgnoredDisabled if push notification support is disabled at build time.
     */
    std::future<PushNotificationResult> pushNotificationReceived(const std::map<std::string, std::string>& data);

@@ -485,17 +541,11 @@ public:
    void forwardAllMessages(bool forward);

 private:
-    enum class State {
-        Idle,
-        Running,
-        Stopping
-    };
+    enum class State { Idle, Running, Stopping };

    time_point loop_();

-    NodeStatus getStatus() const {
-        return std::max(status4, status6);
-    }
+    NodeStatus getStatus() const { return std::max(status4, status6); }

    bool checkShutdown();
    void opEnded();
@@ -517,23 +567,22 @@ private:
     */
    void resetDht();

-    mutable std::mutex dht_mtx {};
+    mutable std::mutex dht_mtx;
    std::thread dht_thread {};
    std::condition_variable cv {};
-    std::mutex sock_mtx {};
+    std::mutex sock_mtx;
    net::PacketList rcv {};
    decltype(rcv) rcv_free {};

    std::queue<std::function<void(SecureDht&)>> pending_ops_prio {};
    std::queue<std::function<void(SecureDht&)>> pending_ops {};
-    std::mutex storage_mtx {};
+    std::mutex storage_mtx;

    std::atomic<State> running {State::Idle};
    std::atomic_size_t ongoing_ops {0};
    std::vector<ShutdownCallback> shutdownCallbacks_;

-    NodeStatus status4 {NodeStatus::Disconnected},
-               status6 {NodeStatus::Disconnected};
+    NodeStatus status4 {NodeStatus::Disconnected}, status6 {NodeStatus::Disconnected};

    std::vector<StatusCallback> statusCbs {};

@@ -547,4 +596,4 @@ private:
    std::shared_ptr<dht::Logger> logger_;
 };

-}
+} // namespace dht
@@ -1,21 +1,5 @@
-/*
- *  Copyright (C) 2014-2025 Savoir-faire Linux Inc.
- *  Author: Vsevolod Ivanov <vsevolod.ivanov@savoirfairelinux.com>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 3 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program. If not, see <https://www.gnu.org/licenses/>.
- */
-
+// Copyright (c) 2014-2026 Savoir-faire Linux Inc.
+// SPDX-License-Identifier: MIT
 #pragma once

 #include "def.h"
@@ -67,11 +51,11 @@ using ConnectHandlerCb = std::function<void(const asio::error_code& ec, const as
 using ssl_socket_t = restinio::impl::tls_socket_t;
 using socket_t = asio::ip::tcp::socket;

-class OPENDHT_PUBLIC Url
+struct OPENDHT_PUBLIC Url
 {
-public:
    Url() = default;
-    Url(std::string_view url);
+    Url(std::string url);
+
    std::string url;
    std::string protocol {"http"};
    std::string_view user;
@@ -122,9 +106,16 @@ public:

    void timeout(const std::chrono::seconds& timeout, HandlerCb cb = {});

+    /**
+     * Close the underlying socket.
+     * Safe to call from any thread: the actual close is dispatched to
+     * the thread running the io_context.
+     */
    void close();

 private:
+    void doClose();
+
    template<typename T>
    T wrapCallback(T cb) const
    {
@@ -165,7 +156,7 @@ public:
    using ResolverCb
        = std::function<void(const asio::error_code& ec, const std::vector<asio::ip::tcp::endpoint>& endpoints)>;

-    Resolver(asio::io_context& ctx, const std::string& url, std::shared_ptr<log::Logger> logger = {});
+    Resolver(asio::io_context& ctx, std::string url, std::shared_ptr<log::Logger> logger = {});
    Resolver(asio::io_context& ctx,
             std::string_view host,
             std::string_view service,
@@ -177,10 +168,6 @@ public:
             std::vector<asio::ip::tcp::endpoint> endpoints,
             const bool ssl = false,
             std::shared_ptr<log::Logger> logger = {});
-    Resolver(asio::io_context& ctx,
-             const std::string& url,
-             std::vector<asio::ip::tcp::endpoint> endpoints,
-             std::shared_ptr<log::Logger> logger = {});

    ~Resolver();

@@ -232,19 +219,19 @@ public:

    // resolves implicitly
    Request(asio::io_context& ctx,
-            const std::string& url,
+            std::string url,
            const Json::Value& json,
            OnJsonCb jsoncb,
            std::shared_ptr<log::Logger> logger = {});
-    Request(asio::io_context& ctx, const std::string& url, OnJsonCb jsoncb, std::shared_ptr<log::Logger> logger = {});
+    Request(asio::io_context& ctx, std::string url, OnJsonCb jsoncb, std::shared_ptr<log::Logger> logger = {});

-    Request(asio::io_context& ctx, const std::string& url, std::shared_ptr<log::Logger> logger = {});
+    Request(asio::io_context& ctx, std::string url, std::shared_ptr<log::Logger> logger = {});
    Request(asio::io_context& ctx,
            std::string_view host,
            std::string_view service,
            const bool ssl = false,
            std::shared_ptr<log::Logger> logger = {});
-    Request(asio::io_context& ctx, const std::string& url, OnDoneCb onDone, std::shared_ptr<log::Logger> logger = {});
+    Request(asio::io_context& ctx, std::string url, OnDoneCb onDone, std::shared_ptr<log::Logger> logger = {});

    // user defined resolver
    Request(asio::io_context& ctx, std::shared_ptr<Resolver> resolver, sa_family_t family = AF_UNSPEC);
@@ -360,8 +347,6 @@ private:

    dht::crypto::Identity client_identity_;
    std::shared_ptr<dht::crypto::Certificate> server_ca_;
-    std::string service_;
-    std::string host_;

    unsigned int id_;
    static std::atomic_uint ids_;
@@ -1,23 +1,5 @@
-/*
- *  Copyright (C) 2014-2025 Savoir-faire Linux Inc.
- *  Author(s) : Adrien Béraud <adrien.beraud@savoirfairelinux.com>
- *              Simon Désaulniers <simon.desaulniers@savoirfairelinux.com>
- *              Nicolas Reynaud <nicolas.reynaud@savoirfairelinux.com>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 3 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program. If not, see <https://www.gnu.org/licenses/>.
- */
-
+// Copyright (c) 2014-2026 Savoir-faire Linux Inc.
+// SPDX-License-Identifier: MIT
 #pragma once

 #include <string>
@@ -46,25 +28,32 @@ namespace indexation {
 * the node in question is a leaf, *the label is a prefix of all the keys
 * contained in the leaf*.
 */
-struct OPENDHT_PUBLIC Prefix {
+struct OPENDHT_PUBLIC Prefix
+{
    Prefix() {}
-    Prefix(InfoHash h) : size_(h.size() * 8), content_(h.begin(), h.end()) { }
-    Prefix(const Blob& d, const Blob& f={}) : size_(d.size()*8), flags_(f), content_(d) { }
+    Prefix(InfoHash h)
+        : size_(h.size() * 8)
+        , content_(h.begin(), h.end())
+    {}
+    Prefix(const Blob& d, const Blob& f = {})
+        : size_(d.size() * 8)
+        , flags_(f)
+        , content_(d)
+    {}

-    Prefix(const Prefix& p, size_t first) :
-        size_(std::min(first, p.content_.size()*8)),
-        content_(Blob(p.content_.begin(), p.content_.begin()+size_/8))
+    Prefix(const Prefix& p, size_t first)
+        : size_(std::min(first, p.content_.size() * 8))
+        , content_(Blob(p.content_.begin(), p.content_.begin() + size_ / 8))
    {
-
        auto rem = size_ % 8;
-        if ( not p.flags_.empty() ) {
-            flags_ = Blob(p.flags_.begin(), p.flags_.begin()+size_/8);
+        if (not p.flags_.empty()) {
+            flags_ = Blob(p.flags_.begin(), p.flags_.begin() + size_ / 8);
            if (rem)
-                flags_.push_back(p.flags_[size_/8] & (0xFF << (8 - rem)));
+                flags_.push_back(p.flags_[size_ / 8] & (0xFF << (8 - rem)));
        }

        if (rem)
-            content_.push_back(p.content_[size_/8] & (0xFF << (8 - rem)));
+            content_.push_back(p.content_[size_ / 8] & (0xFF << (8 - rem)));
    }

    /**
@@ -79,8 +68,9 @@ struct OPENDHT_PUBLIC Prefix {
     *
     * @throw out_of_range if len is larger than size of the content
     */
-    Prefix getPrefix(ssize_t len) const {
-        if ((size_t)std::abs(len) >= content_.size() * 8)
+    Prefix getPrefix(ssize_t len) const
+    {
+        if ((size_t) std::abs(len) >= content_.size() * 8)
            throw std::out_of_range("len larger than prefix size.");
        if (len < 0)
            len += size_;
@@ -94,33 +84,31 @@ struct OPENDHT_PUBLIC Prefix {
 ee     *
     * @see isActiveBit in private function
     */
-    bool isFlagActive(size_t pos) const {
-        return flags_.empty() or isActiveBit(flags_, pos);
-    }
+    bool isFlagActive(size_t pos) const { return flags_.empty() or isActiveBit(flags_, pos); }

    /**
     * @see isActiveBit in private function
     */
-    bool isContentBitActive(size_t pos) const {
-        return isActiveBit(content_, pos);
-    }
+    bool isContentBitActive(size_t pos) const { return isActiveBit(content_, pos); }

-    Prefix getFullSize() { return Prefix(*this, content_.size()*8); }
+    Prefix getFullSize() { return Prefix(*this, content_.size() * 8); }

    /**
     * This methods gets the prefix of its sibling in the PHT structure.
     *
     * @return The prefix of this sibling.
     */
-    Prefix getSibling() const {
+    Prefix getSibling() const
+    {
        Prefix copy = *this;
-        if ( size_ )
+        if (size_)
            copy.swapContentBit(size_ - 1);

        return copy;
    }

-    InfoHash hash() const {
+    InfoHash hash() const
+    {
        Blob copy(content_);
        copy.push_back(size_);
        return InfoHash::get(copy);
@@ -133,69 +121,53 @@ ee     *
     * @param p2 second prefix to compared
     * @return Lenght of the larger common prefix between both
     */
-    static inline unsigned commonBits(const Prefix& p1, const Prefix& p2) {
-        unsigned i, j;
-        uint8_t x;
+    static inline unsigned commonBits(const Prefix& p1, const Prefix& p2)
+    {
+        /* size_ counts bits, so the comparison walks bits: reading it as a
+           byte count would run past the end of the shorter content. */
        auto longest_prefix_size = std::min(p1.size_, p2.size_);

-        for (i = 0; i < longest_prefix_size; i++) {
-            if (p1.content_.data()[i] != p2.content_.data()[i]
-                or not p1.isFlagActive(i)
-                or not p2.isFlagActive(i) ) {
-
-                    break;
-            }
+        unsigned common = 0;
+        while (common < longest_prefix_size) {
+            if (not p1.isFlagActive(common) or not p2.isFlagActive(common)
+                or p1.isContentBitActive(common) != p2.isContentBitActive(common))
+                break;
+            common++;
        }

-        if (i == longest_prefix_size)
-            return 8*longest_prefix_size;
-
-        x = p1.content_.data()[i] ^ p2.content_.data()[i];
-
-        j = 0;
-        while ((x & 0x80) == 0) {
-            x <<= 1;
-            j++;
-        }
-
-        return 8 * i + j;
+        return common;
    }

    /**
     * @see doc of swap private function
     */
-    void swapContentBit(size_t bit) {
-        swapBit(content_, bit);
-    }
+    void swapContentBit(size_t bit) { swapBit(content_, bit); }

    /**
     * @see doc of swap private function
     */
-    void swapFlagBit(size_t bit) {
-        swapBit(flags_, bit);
-    }
+    void swapFlagBit(size_t bit) { swapBit(flags_, bit); }

    /**
     * @see doc of addPadding private function
     */
-    void addPaddingContent(size_t size) {
-        content_ = addPadding(content_, size);
-    }
+    void addPaddingContent(size_t size) { content_ = addPadding(content_, size); }

-    void updateFlags() {
+    void updateFlags()
+    {
        /* Fill first known bit */
        auto csize = size_ - flags_.size() * 8;
-        while(csize >= 8) {
+        while (csize >= 8) {
            flags_.push_back(0xFF);
            csize -= 8;
        }

        /* if needed fill remaining bit */
-        if ( csize )
+        if (csize)
            flags_.push_back(0xFF << (8 - csize));

        /* Complet vector space missing */
-        for ( auto i = flags_.size(); i < content_.size(); i++ )
+        for (auto i = flags_.size(); i < content_.size(); i++)
            flags_.push_back(0xFF);
    }

@@ -210,7 +182,6 @@ ee     *
    Blob content_ {};

 private:
-
    /**
     * Add a padding to the input blob
     *
@@ -219,12 +190,13 @@ private:
     *
     * @return Copy of the input Blob but with a padding
     */
-    Blob addPadding(Blob toP, size_t size) {
+    Blob addPadding(Blob toP, size_t size)
+    {
        Blob copy = toP;
-        for ( auto i = copy.size(); i < size; i++ )
+        for (auto i = copy.size(); i < size; i++)
            copy.push_back(0);

-        swapBit(copy, size_ + 1);
+        swapBit(copy, size_);
        return copy;
    }

@@ -238,11 +210,12 @@ private:
     *
     * @throw out_of_range if bit is superior to blob size * 8
     */
-    bool isActiveBit(const Blob &b, size_t pos) const {
-        if ( pos >= content_.size() * 8 )
+    bool isActiveBit(const Blob& b, size_t pos) const
+    {
+        if (pos >= content_.size() * 8)
            throw std::out_of_range("Can't detect active bit at pos, pos larger than prefix size or empty prefix");

-        return ((b[pos / 8] >> (7 - (pos % 8)) ) & 1) == 1;
+        return ((b[pos / 8] >> (7 - (pos % 8))) & 1) == 1;
    }

    /**
@@ -255,25 +228,30 @@ private:
     *
     * @throw out_of_range if bit is superior to blob size * 8
     */
-    void swapBit(Blob &b, size_t bit) {
-        if ( bit >= b.size() * 8 )
+    void swapBit(Blob& b, size_t bit)
+    {
+        if (bit >= b.size() * 8)
            throw std::out_of_range("bit larger than prefix size.");

-        size_t offset_bit = (8 - bit) % 8;
-        b[bit / 8] ^= (1 << offset_bit);
+        /* Bit 0 is the most significant one of the first byte, as
+           isActiveBit reads it. */
+        b[bit / 8] ^= (1 << (7 - (bit % 8)));
    }
 };

 using Value = std::pair<InfoHash, dht::Value::Id>;
-struct OPENDHT_PUBLIC IndexEntry : public dht::Value::Serializable<IndexEntry> {
+struct OPENDHT_PUBLIC IndexEntry : public dht::Value::Serializable<IndexEntry>
+{
    static const ValueType& TYPE;

-    virtual void unpackValue(const dht::Value& v) {
+    virtual void unpackValue(const dht::Value& v)
+    {
        Serializable<IndexEntry>::unpackValue(v);
        name = v.user_type;
    }

-    virtual dht::Value packValue() const {
+    virtual dht::Value packValue() const
+    {
        auto pack = Serializable<IndexEntry>::packValue();
        pack.user_type = name;
        return pack;
@@ -285,14 +263,14 @@ struct OPENDHT_PUBLIC IndexEntry : public dht::Value::Serializable<IndexEntry> {
    MSGPACK_DEFINE_MAP(prefix, value)
 };

-class OPENDHT_PUBLIC Pht {
+class OPENDHT_PUBLIC Pht
+{
    static constexpr const char* INVALID_KEY = "Key does not match the PHT key spec.";

    /* Prefixes the user_type for all dht values put on the DHT */
    static constexpr const char* INDEX_PREFIX = "index.pht.";

 public:
-
    /* This is the maximum number of entries per node. This parameter is
     * critical and influences the traffic a lot during a lookup operation.
     */
@@ -306,28 +284,34 @@ public:
    using KeySpec = std::map<std::string, size_t>;
    using LookupCallback = std::function<void(std::vector<std::shared_ptr<Value>>& values, const Prefix& p)>;

-    typedef void (*LookupCallbackRaw)(std::vector<std::shared_ptr<Value>>* values, Prefix* p, void *user_data);
-    static LookupCallback
-    bindLookupCb(LookupCallbackRaw raw_cb, void* user_data) {
-        if (not raw_cb) return {};
+    typedef void (*LookupCallbackRaw)(std::vector<std::shared_ptr<Value>>* values, Prefix* p, void* user_data);
+    static LookupCallback bindLookupCb(LookupCallbackRaw raw_cb, void* user_data)
+    {
+        if (not raw_cb)
+            return {};
        return [=](std::vector<std::shared_ptr<Value>>& values, const Prefix& p) {
            raw_cb((std::vector<std::shared_ptr<Value>>*) &values, (Prefix*) &p, user_data);
        };
    }
    using LookupCallbackSimple = std::function<void(std::vector<std::shared_ptr<Value>>& values)>;
-    typedef void (*LookupCallbackSimpleRaw)(std::vector<std::shared_ptr<Value>>* values, void *user_data);
-    static LookupCallbackSimple
-    bindLookupCbSimple(LookupCallbackSimpleRaw raw_cb, void* user_data) {
-        if (not raw_cb) return {};
+    typedef void (*LookupCallbackSimpleRaw)(std::vector<std::shared_ptr<Value>>* values, void* user_data);
+    static LookupCallbackSimple bindLookupCbSimple(LookupCallbackSimpleRaw raw_cb, void* user_data)
+    {
+        if (not raw_cb)
+            return {};
        return [=](std::vector<std::shared_ptr<Value>>& values) {
            raw_cb((std::vector<std::shared_ptr<Value>>*) &values, user_data);
        };
    }

    Pht(std::string name, KeySpec k_spec, std::shared_ptr<DhtRunner> dht)
-        : name_(INDEX_PREFIX + name), canary_(name_ + ".canary"), keySpec_(k_spec), dht_(dht) {}
+        : name_(INDEX_PREFIX + name)
+        , canary_(name_ + ".canary")
+        , keySpec_(k_spec)
+        , dht_(dht)
+    {}

-    virtual ~Pht () { }
+    virtual ~Pht() {}

    /**
     * Lookup a key for a value.
@@ -335,7 +319,11 @@ public:
    void lookup(Key k, LookupCallback cb = {}, DoneCallbackSimple done_cb = {}, bool exact_match = true);
    void lookup(Key k, LookupCallbackSimple cb = {}, DoneCallbackSimple done_cb = {}, bool exact_match = true)
    {
-        lookup(k, [cb=std::move(cb)](std::vector<std::shared_ptr<Value>>& values, Prefix) { cb(values); }, done_cb, exact_match);
+        lookup(
+            k,
+            [cb = std::move(cb)](std::vector<std::shared_ptr<Value>>& values, Prefix) { cb(values); },
+            done_cb,
+            exact_match);
    }

    /**
@@ -345,7 +333,8 @@ public:
     * @param v : Value to insert
     * @param done_cb : Callbakc which going to be call when all the insert is done
     */
-    void insert(Key k, Value v, DoneCallbackSimple done_cb = {}) {
+    void insert(Key k, Value v, DoneCallbackSimple done_cb = {})
+    {
        Prefix p = linearize(k);

        auto lo = std::make_shared<int>(0);
@@ -360,7 +349,6 @@ public:
    }

 private:
-
    /**
     * Insert function which really insert onto the pht
     *
@@ -373,10 +361,16 @@ private:
     * @param done_cb     : Callback to call when the insert is done
     */

-    void insert(const Prefix& kp, IndexEntry entry, std::shared_ptr<int> lo, std::shared_ptr<int> hi, time_point time_p,
-                bool check_split, DoneCallbackSimple done_cb = {});
+    void insert(const Prefix& kp,
+                IndexEntry entry,
+                std::shared_ptr<int> lo,
+                std::shared_ptr<int> hi,
+                time_point time_p,
+                bool check_split,
+                DoneCallbackSimple done_cb = {});

-    class Cache {
+    class Cache
+    {
    public:
        /**
         * Insert all needed node into the tree according to a prefix
@@ -398,14 +392,15 @@ private:
        static constexpr const size_t MAX_ELEMENT {1024};
        static constexpr const std::chrono::minutes NODE_EXPIRE_TIME {5};

-        struct Node {
+        struct Node
+        {
            time_point last_reply;           /* Made the assocation between leaves and leaves multimap */
            std::shared_ptr<Node> parent;    /* Share_ptr to the parent, it allow the self destruction of tree */
            std::weak_ptr<Node> left_child;  /* Left child, for bit equal to 1 */
            std::weak_ptr<Node> right_child; /* Right child, for bit equal to 0 */
        };

-        std::weak_ptr<Node> root_;                         /* Root of the tree */
+        std::weak_ptr<Node> root_; /* Root of the tree */

        /**
         * This mutlimap contains all prefix insert in the tree in time order
@@ -430,14 +425,19 @@ private:
     * @param cb         : Callback to use at the end of the lookupStep (call on the value of vals)
     * @param done_cb    : Callback at the end of the lookupStep
     * @param max_common_prefix_len: used in the inexacte lookup match case, indicate the longest common prefix found
-     * @param start      : If start is set then lo and hi will be ignore for the first step, if the step fail lo and hi will be used
+     * @param start      : If start is set then lo and hi will be ignore for the first step, if the step fail lo and hi
+     * will be used
     * @param all_values : If all value is true then all value met during the lookupstep will be in the vector vals
     */
-    void lookupStep(Prefix k, std::shared_ptr<int> lo, std::shared_ptr<int> hi,
-            std::shared_ptr<std::vector<std::shared_ptr<IndexEntry>>> vals,
-            LookupCallbackWrapper cb, DoneCallbackSimple done_cb,
-            std::shared_ptr<unsigned> max_common_prefix_len,
-            int start = -1, bool all_values = false);
+    void lookupStep(Prefix k,
+                    std::shared_ptr<int> lo,
+                    std::shared_ptr<int> hi,
+                    std::shared_ptr<std::vector<std::shared_ptr<IndexEntry>>> vals,
+                    LookupCallbackWrapper cb,
+                    DoneCallbackSimple done_cb,
+                    std::shared_ptr<unsigned> max_common_prefix_len,
+                    int start = -1,
+                    bool all_values = false);

    /**
     * Apply the zcurve algorithm on the list of input prefix
@@ -466,7 +466,7 @@ private:
     * @param entry   The entry to put at the prefix p
     * @param end_cb  Callback to use at the end of counting
     */
-    void getRealPrefix(const std::shared_ptr<Prefix>& p, IndexEntry entry, RealInsertCallback end_cb );
+    void getRealPrefix(const std::shared_ptr<Prefix>& p, IndexEntry entry, RealInsertCallback end_cb);

    /**
     * Looking where to put the data cause if there is free space on the node
@@ -485,10 +485,11 @@ private:
     * @param vals     : The vector of values to compare with comapred
     * @return position compared diverge from all others
     */
-    static size_t findSplitLocation(const Prefix& compared, const std::vector<std::shared_ptr<IndexEntry>>& vals) {
-        for ( size_t i = 0; i < compared.content_.size() * 8 - 1; i++ )
-            for ( auto const& v : vals)
-                if ( Prefix(v->prefix).isContentBitActive(i) != compared.isContentBitActive(i) )
+    static size_t findSplitLocation(const Prefix& compared, const std::vector<std::shared_ptr<IndexEntry>>& vals)
+    {
+        for (size_t i = 0; i < compared.content_.size() * 8 - 1; i++)
+            for (auto const& v : vals)
+                if (Prefix(v->prefix).isContentBitActive(i) != compared.isContentBitActive(i))
                    return i + 1;
        return compared.content_.size() * 8 - 1;
    }
@@ -501,18 +502,23 @@ private:
     * @param entry  : Entry to put on the pht
     * @param end_cb : Callback to apply to the insert prefi (here does the insert)
     */
-    void split(const Prefix& insert, const std::vector<std::shared_ptr<IndexEntry>>& vals, IndexEntry entry, RealInsertCallback end_cb);
+    void split(const Prefix& insert,
+               const std::vector<std::shared_ptr<IndexEntry>>& vals,
+               IndexEntry entry,
+               RealInsertCallback end_cb);

    /**
     * Tells if the key is valid according to the key spec.
     */
-    bool validKey(const Key& k) const {
-        return k.size() == keySpec_.size() and
-            std::equal(k.begin(), k.end(), keySpec_.begin(),
-                [&](const Key::value_type& key, const KeySpec::value_type& key_spec) {
-                    return key.first == key_spec.first and key.second.size() <= key_spec.second;
-                }
-            );
+    bool validKey(const Key& k) const
+    {
+        return k.size() == keySpec_.size()
+               and std::equal(k.begin(),
+                              k.end(),
+                              keySpec_.begin(),
+                              [&](const Key::value_type& key, const KeySpec::value_type& key_spec) {
+                                  return key.first == key_spec.first and key.second.size() <= key_spec.second;
+                              });
    }

    /**
@@ -528,6 +534,5 @@ private:
    std::shared_ptr<DhtRunner> dht_;
 };

-} /* indexation  */
-} /* dht */
-
+} // namespace indexation
+} // namespace dht
@@ -1,21 +1,5 @@
-/*
- *  Copyright (C) 2014-2025 Savoir-faire Linux Inc.
- *  Author : Adrien Béraud <adrien.beraud@savoirfairelinux.com>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 3 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program. If not, see <https://www.gnu.org/licenses/>.
- */
-
+// Copyright (c) 2014-2026 Savoir-faire Linux Inc.
+// SPDX-License-Identifier: MIT
 #pragma once

 #include "def.h"
@@ -54,70 +38,73 @@ namespace dht {
 using byte = uint8_t;

 namespace crypto {
-    OPENDHT_PUBLIC void hash(const uint8_t* data, size_t data_length, uint8_t* hash, size_t hash_length);
+OPENDHT_PUBLIC void hash(const uint8_t* data, size_t data_length, uint8_t* hash, size_t hash_length);
 }

 /**
- * Represents an Hash,
- * a byte array of N bytes.
+ * Represents an Hash, a byte array of N bytes.
 * Hashes identify nodes and values in the Dht.
 */
-template <size_t N>
-class Hash {
+template<size_t N>
+class Hash
+{
 public:
    using T = std::array<uint8_t, N>;
    typedef typename T::iterator iterator;
    typedef typename T::const_iterator const_iterator;

-    Hash() noexcept {
-        data_.fill(0);
-    }
-    Hash(const uint8_t* h, size_t data_len) {
-        if (data_len < N)
-            data_.fill(0);
-        else
-            std::copy_n(h, N, data_.begin());
-    }
+    constexpr Hash() noexcept
+        : data_ {}
+    {}
+    constexpr Hash(const uint8_t* h, size_t data_len)
+        : data_(fromBytes(h, data_len))
+    {}
    /**
     * Constructor from an hexadecimal string (without "0x").
-     * hex must be at least 2.HASH_LEN characters long.
-     * If too long, only the first 2.HASH_LEN characters are read.
+     * hex must be at least 2.N characters long.
+     * If too long, only the first 2.N characters are read.
     */
-    explicit Hash(std::string_view hex) {
-        if (hex.size() < 2*N)
-            data_.fill(0);
-        else
-            fromString(hex.data());
-    }
+    explicit constexpr Hash(std::string_view hex)
+        : data_(fromString(hex))
+    {}

-    Hash(const msgpack::object& o) {
-        msgpack_unpack(o);
-    }
+    Hash(const msgpack::object& o) { msgpack_unpack(o); }

    static constexpr size_t size() noexcept { return N; }
-    const uint8_t* data() const { return data_.data(); }
+    constexpr const uint8_t* data() const { return data_.data(); }
    uint8_t* data() { return data_.data(); }
    iterator begin() { return data_.begin(); }
    const_iterator cbegin() const { return data_.cbegin(); }
    iterator end() { return data_.end(); }
    const_iterator cend() const { return data_.cend(); }

-    static constexpr inline Hash zero() noexcept { return Hash{}; }
+    static constexpr inline Hash zero() noexcept { return Hash {}; }

-    bool operator==(const Hash& h) const {
+    constexpr bool operator==(const Hash& h) const
+    {
+#if __cplusplus >= 202002L
        return data_ == h.data_;
+#else
+        for (size_t i = 0; i < N; ++i) {
+            if (data_[i] != h.data_[i])
+                return false;
+        }
+        return true;
+#endif
    }
-    bool operator!=(const Hash& h) const { return !(*this == h); }
+    constexpr bool operator!=(const Hash& h) const { return !(*this == h); }

-    bool operator<(const Hash& o) const {
+    constexpr bool operator<(const Hash& o) const
+    {
        for (unsigned i = 0; i < N; i++) {
-            if(data_[i] != o.data_[i])
+            if (data_[i] != o.data_[i])
                return data_[i] < o.data_[i];
        }
        return false;
    }

-    Hash operator^(const Hash& o) const {
+    constexpr Hash operator^(const Hash& o) const
+    {
        Hash result;
        for (auto i = 0u; i < N; i++) {
            result[i] = data_[i] ^ o.data_[i];
@@ -125,7 +112,9 @@ public:
        return result;
    }

-    explicit operator bool() const {
+    explicit constexpr operator bool() const
+    {
+#if __cplusplus >= 202002L
        auto a = reinterpret_cast<const uint32_t*>(data_.data());
        auto b = reinterpret_cast<const uint32_t*>(data_.data() + N);
        for (; a != b; a++) {
@@ -133,50 +122,58 @@ public:
                return true;
        }
        return false;
+#else
+        for (size_t i = 0; i < N; ++i) {
+            if (data_[i] != 0)
+                return true;
+        }
+        return false;
+#endif
    }

    uint8_t& operator[](size_t index) { return data_[index]; }
-    const uint8_t& operator[](size_t index) const { return data_[index]; }
+    constexpr const uint8_t& operator[](size_t index) const { return data_[index]; }

    /**
     * Find the lowest 1 bit in an id.
     * Result will allways be lower than 8*N
     */
-    inline int lowbit() const {
-        int i, j;
-        for(i = N-1; i >= 0; i--)
-            if(data_[i] != 0)
+    constexpr int lowbit() const
+    {
+        int i = N - 1;
+        for (; i >= 0; i--)
+            if (data_[i] != 0)
                break;
-        if(i < 0)
+        if (i < 0)
            return -1;
-        for(j = 7; j >= 0; j--)
-            if((data_[i] & (0x80 >> j)) != 0)
+        int j = 7;
+        for (; j >= 0; j--)
+            if ((data_[i] & (0x80 >> j)) != 0)
                break;
        return 8 * i + j;
    }

-    static inline int cmp(const Hash& id1, const Hash& id2) {
+    static inline int cmp(const Hash& id1, const Hash& id2)
+    {
        return std::memcmp(id1.data_.data(), id2.data_.data(), N);
    }

    /** Find how many bits two ids have in common. */
-    static inline unsigned
-    commonBits(const Hash& id1, const Hash& id2)
+    static constexpr inline unsigned commonBits(const Hash& id1, const Hash& id2)
    {
-        unsigned i, j;
-        uint8_t x;
-        for(i = 0; i < N; i++) {
-            if(id1.data_[i] != id2.data_[i])
+        unsigned i = 0;
+        for (; i < N; i++) {
+            if (id1.data_[i] != id2.data_[i])
                break;
        }

-        if(i == N)
-            return 8*N;
+        if (i == N)
+            return 8 * N;

-        x = id1.data_[i] ^ id2.data_[i];
+        uint8_t x = id1.data_[i] ^ id2.data_[i];

-        j = 0;
-        while((x & 0x80) == 0) {
+        unsigned j = 0;
+        while ((x & 0x80) == 0) {
            x <<= 1;
            j++;
        }
@@ -185,11 +182,10 @@ public:
    }

    /** Determine whether id1 or id2 is closer to this */
-    int
-    xorCmp(const Hash& id1, const Hash& id2) const
+    constexpr int xorCmp(const Hash& id1, const Hash& id2) const
    {
        for (unsigned i = 0; i < N; i++) {
-            if(id1.data_[i] == id2.data_[i])
+            if (id1.data_[i] == id2.data_[i])
                continue;
            uint8_t xor1 = id1.data_[i] ^ data_[i];
            uint8_t xor2 = id2.data_[i] ^ data_[i];
@@ -198,40 +194,36 @@ public:
        return 0;
    }

-    bool
-    getBit(unsigned nbit) const
+    constexpr bool getBit(unsigned nbit) const
    {
-        auto& num = *(data_.cbegin()+(nbit/8));
+        auto& num = *(data_.cbegin() + (nbit / 8));
        unsigned bit = 7 - (nbit % 8);
        return (num >> bit) & 1;
    }

-    void
-    setBit(unsigned nbit, bool b)
+    void setBit(unsigned nbit, bool b)
    {
-        auto& num = data_[nbit/8];
+        auto& num = data_[nbit / 8];
        unsigned bit = 7 - (nbit % 8);
        num ^= (-b ^ num) & (1 << bit);
    }

-    double toFloat() const {
+    double toFloat() const
+    {
        using D = size_t;
        double v = 0.;
-        for (size_t i = 0; i < std::min<size_t>(N, sizeof(D)-1); i++)
-            v += *(data_.cbegin()+i) / (double)((D)1 << 8*(i+1));
+        for (size_t i = 0; i < std::min<size_t>(N, sizeof(D) - 1); i++)
+            v += *(data_.cbegin() + i) / (double) ((D) 1 << 8 * (i + 1));
        return v;
    }

-    static inline Hash get(std::string_view data) {
-        return get((const uint8_t*)data.data(), data.size());
-    }
+    static inline Hash get(std::string_view data) { return get((const uint8_t*) data.data(), data.size()); }

-    static inline Hash get(const std::vector<uint8_t>& data) {
-        return get(data.data(), data.size());
-    }
+    static inline Hash get(const std::vector<uint8_t>& data) { return get(data.data(), data.size()); }

-    template <size_t H>
-    static Hash get(const Hash<H>& o) {
+    template<size_t H>
+    static Hash get(const Hash<H>& o)
+    {
        return get(o.data(), o.size());
    }

@@ -247,36 +239,39 @@ public:

    static Hash getRandom();

-    template <typename Rd>
+    template<typename Rd>
    static Hash getRandom(Rd&);

-    template <size_t M>
-    friend std::ostream& operator<< (std::ostream& s, const Hash<M>& h);
+    template<size_t M>
+    friend std::ostream& operator<<(std::ostream& s, const Hash<M>& h);

-    template <size_t M>
-    friend std::istream& operator>> (std::istream& s, Hash<M>& h);
+    template<size_t M>
+    friend std::istream& operator>>(std::istream& s, Hash<M>& h);

    /** Returns view to thread-allocated memory, only valid until the next call to this function. */
-    std::string_view to_view() const { return std::string_view(to_c_str(), N*2); }
+    std::string_view to_view() const { return std::string_view(to_c_str(), N * 2); }
    const char* to_c_str() const;

    std::string toString() const;

-    template <typename Packer>
+    template<typename Packer>
    void msgpack_pack(Packer& pk) const
    {
        pk.pack_bin(N);
-        pk.pack_bin_body((char*)data_.data(), N);
+        pk.pack_bin_body((char*) data_.data(), N);
    }

-    void msgpack_unpack(msgpack::object o) {
+    void msgpack_unpack(msgpack::object o)
+    {
        if (o.type != msgpack::type::BIN or o.via.bin.size != N)
            throw msgpack::type_error();
        std::copy_n(o.via.bin.ptr, N, data_.data());
    }
+
 private:
-    T data_;
-    void fromString(const char*);
+    alignas(alignof(uint32_t)) T data_;
+    static constexpr T fromBytes(const uint8_t*, size_t);
+    static constexpr T fromString(std::string_view);
 };

 #define HASH_LEN 20u
@@ -284,41 +279,69 @@ using InfoHash = Hash<HASH_LEN>;
 using h256 = Hash<32>;
 using PkId = h256;

-template <size_t N>
-std::ostream& operator<< (std::ostream& s, const Hash<N>& h)
+template<size_t N>
+std::ostream&
+operator<<(std::ostream& s, const Hash<N>& h)
 {
-    s.write(h.to_c_str(), N*2);
+    s.write(h.to_c_str(), N * 2);
    return s;
 }

-template <size_t N>
-std::istream& operator>> (std::istream& s, Hash<N>& h)
+template<size_t N>
+std::istream&
+operator>>(std::istream& s, Hash<N>& h)
 {
-    std::array<char, h.size()*2> dat;
+    std::array<char, h.size() * 2> dat;
    s.exceptions(std::istream::eofbit | std::istream::failbit);
    s.read(&(*dat.begin()), dat.size());
-    fromString(dat.data());
+    h = Hash<N>(std::string_view(dat.data(), dat.size()));
    return s;
 }

-template <size_t N>
-void
-Hash<N>::fromString(const char* in) {
-    auto hex2bin = [](char c) -> uint8_t {
-        if      (c >= 'a' and c <= 'f') return 10 + c - 'a';
-        else if (c >= 'A' and c <= 'F') return 10 + c - 'A';
-        else if (c >= '0' and c <= '9') return c - '0';
-        else throw std::domain_error("not an hex character");
-    };
-    try {
-        for (size_t i=0; i<N; i++)
-            data_[i] = (hex2bin(in[2*i]) << 4) | hex2bin(in[2*i+1]);
-    } catch (const std::domain_error&) {
-        data_.fill(0);
-    }
+template<size_t N>
+constexpr typename Hash<N>::T
+Hash<N>::fromBytes(const uint8_t* in, size_t size)
+{
+    T data {};
+    if (size < N)
+        return data;
+    for (size_t i = 0; i < N; ++i)
+        data[i] = in[i];
+    return data;
 }

-template <size_t N>
+template<size_t N>
+constexpr typename Hash<N>::T
+Hash<N>::fromString(std::string_view in)
+{
+    T data {};
+    if (in.size() < 2 * N)
+        return data;
+
+    constexpr auto hex2bin = [](char c, bool& valid) -> uint8_t {
+        if (c >= 'a' and c <= 'f')
+            return 10 + c - 'a';
+        else if (c >= 'A' and c <= 'F')
+            return 10 + c - 'A';
+        else if (c >= '0' and c <= '9')
+            return c - '0';
+        else {
+            valid = false;
+            return 0;
+        }
+    };
+    bool valid = true;
+    for (size_t i = 0; i < N && valid; i++) {
+        uint8_t high = hex2bin(in[2 * i], valid);
+        uint8_t low = hex2bin(in[2 * i + 1], valid);
+        data[i] = (high << 4) | low;
+    }
+    if (!valid)
+        return {};
+    return data;
+}
+
+template<size_t N>
 Hash<N>
 Hash<N>::getRandom()
 {
@@ -331,8 +354,8 @@ Hash<N>::getRandom()
    return h;
 }

-template <size_t N>
-template <typename Rd>
+template<size_t N>
+template<typename Rd>
 Hash<N>
 Hash<N>::getRandom(Rd& rdev)
 {
@@ -344,14 +367,18 @@ Hash<N>::getRandom(Rd& rdev)
    return h;
 }

-struct alignas(std::max_align_t) HexMap : public std::array<std::array<char, 2>, 256> {
-    constexpr HexMap(): std::array<std::array<char, 2>, 256>() {
+struct alignas(std::max_align_t) HexMap : public std::array<std::array<char, 2>, 256>
+{
+    constexpr HexMap()
+        : std::array<std::array<char, 2>, 256>()
+    {
        for (size_t i = 0; i < size(); i++) {
            auto& e = (*this)[i];
            e[0] = hex_digits[(i >> 4) & 0x0F];
            e[1] = hex_digits[i & 0x0F];
        }
    }
+
 private:
    static constexpr const char* hex_digits = "0123456789abcdef";
 };
@@ -359,47 +386,64 @@ private:
 inline constexpr HexMap hex_map {};

 inline std::string
-toHex(const uint8_t* data, size_t size) {
+toHex(const uint8_t* data, size_t size)
+{
    std::string ret(size * 2, '\0');
-    for (size_t i=0; i<size; i++) {
-        auto b = ret.data()+i*2;
+    for (size_t i = 0; i < size; i++) {
+        auto b = ret.data() + i * 2;
        const auto& m = hex_map[data[i]];
-        *((uint16_t*)b) = *((uint16_t*)&m);
+        *((uint16_t*) b) = *((uint16_t*) &m);
    }
    return ret;
 }

 inline std::string
-toHex(const std::vector<uint8_t>& data) {
+toHex(const std::vector<uint8_t>& data)
+{
    return toHex(data.data(), data.size());
 }

-template <size_t N>
+template<size_t N>
+constexpr std::array<char, N * 2>
+toHexArray(const Hash<N>& h)
+{
+    std::array<char, N * 2> ret {};
+    for (size_t i = 0; i < N; i++) {
+        const auto& m = hex_map[h[i]];
+        ret[i * 2] = m[0];
+        ret[i * 2 + 1] = m[1];
+    }
+    return ret;
+}
+
+template<size_t N>
 const char*
 Hash<N>::to_c_str() const
 {
-    alignas(std::max_align_t) thread_local std::array<char, N*2+1> buf;
-    for (size_t i=0; i<N; i++) {
-        auto b = buf.data() + i*2;
+    alignas(std::max_align_t) thread_local std::array<char, N * 2 + 1> buf;
+    for (size_t i = 0; i < N; i++) {
+        auto b = buf.data() + i * 2;
        const auto& m = hex_map[data_[i]];
-        *((uint16_t*)b) = *((uint16_t*)&m);
+        *((uint16_t*) b) = *((uint16_t*) &m);
    }
-    buf[N*2] = '\0';
+    buf[N * 2] = '\0';
    return buf.data();
 }

-template <size_t N>
+template<size_t N>
 std::string
 Hash<N>::toString() const
 {
-    return std::string(to_c_str(), N*2);
+    return std::string(to_c_str(), N * 2);
 }

-}
+} // namespace dht

-template <size_t N>
-struct fmt::formatter<dht::Hash<N>>: formatter<string_view> {
-  constexpr auto format(const dht::Hash<N>& c, format_context& ctx) const {
-    return formatter<string_view>::format(c.to_view(), ctx);
-  }
+template<size_t N>
+struct fmt::formatter<dht::Hash<N>> : formatter<string_view>
+{
+    constexpr auto format(const dht::Hash<N>& c, format_context& ctx) const
+    {
+        return formatter<string_view>::format(c.to_view(), ctx);
+    }
 };
@@ -1,22 +1,5 @@
-/*
- *  Copyright (C) 2014-2025 Savoir-faire Linux Inc.
- *
- *  Author: Adrien Béraud <adrien.beraud@savoirfairelinux.com>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 3 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program. If not, see <https://www.gnu.org/licenses/>.
- */
-
+// Copyright (c) 2014-2026 Savoir-faire Linux Inc.
+// SPDX-License-Identifier: MIT
 #pragma once

 #include "def.h"
@@ -38,22 +21,18 @@ OPENDHT_PUBLIC
 std::shared_ptr<Logger> getStdLogger();

 OPENDHT_PUBLIC
-std::shared_ptr<Logger> getFileLogger(const std::string &path);
+std::shared_ptr<Logger> getFileLogger(const std::string& path);

 OPENDHT_PUBLIC
 std::shared_ptr<Logger> getSyslogLogger(const char* name);

-OPENDHT_PUBLIC void
-enableLogging(dht::DhtRunner &dht);
+OPENDHT_PUBLIC void enableLogging(dht::DhtRunner& dht);

-OPENDHT_PUBLIC void
-enableFileLogging(dht::DhtRunner &dht, const std::string &path);
+OPENDHT_PUBLIC void enableFileLogging(dht::DhtRunner& dht, const std::string& path);

-OPENDHT_PUBLIC void
-disableLogging(dht::DhtRunner &dht);
+OPENDHT_PUBLIC void disableLogging(dht::DhtRunner& dht);

-OPENDHT_PUBLIC void
-enableSyslog(dht::DhtRunner &dht, const char* name);
+OPENDHT_PUBLIC void enableSyslog(dht::DhtRunner& dht, const char* name);

-} /* log */
-} /* dht  */
+} // namespace log
+} // namespace dht
@@ -1,21 +1,5 @@
-/*
- *  Copyright (C) 2014-2025 Savoir-faire Linux Inc.
- *  Author : Adrien Béraud <adrien.beraud@savoirfairelinux.com>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 3 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program. If not, see <https://www.gnu.org/licenses/>.
- */
-
+// Copyright (c) 2014-2026 Savoir-faire Linux Inc.
+// SPDX-License-Identifier: MIT
 #pragma once

 #include "infohash.h"
@@ -24,111 +8,197 @@
 #include <fmt/printf.h>

 #include <functional>
+#include <mutex>
 #include <string_view>
+#include <type_traits>
 #include <cstdarg>

+#if __cplusplus >= 202002L
+#include <source_location>
+#endif
+
 namespace dht {
 namespace log {

+#if __cplusplus >= 202002L
+/**
+ * Extracts the filename from a full file path at compile time.
+ */
+consteval std::string_view
+getfilename(std::string_view path)
+{
+    size_t pos = path.size();
+    for (size_t i = path.size(); i-- > 0;) {
+        if (path[i] == '/' || path[i] == '\\') {
+            pos = i + 1;
+            break;
+        }
+    }
+    return path.substr(pos);
+}
+
+consteval std::string_view
+getfunctionname(std::string_view path)
+{
+    size_t pos = 0;
+    size_t end = path.size();
+    for (size_t i = 0; i < path.size(); i++) {
+        if (path[i] == ' ' || path[i] == '\t' || path[i] == ':') {
+            pos = i + 1;
+        } else if (path[i] == '(') {
+            end = i;
+            break;
+        }
+    }
+    return path.substr(pos, end - pos);
+}
+#endif
+
+struct source_loc
+{
+    std::string_view file;
+    std::uint_least32_t line;
+    std::string_view function;
+
+#if __cplusplus >= 202002L
+    consteval source_loc(const std::source_location& loc)
+        : file(getfilename(loc.file_name()))
+        , line(loc.line())
+        , function(getfunctionname(loc.function_name()))
+    {}
+#else
+    constexpr source_loc()
+        : file()
+        , line(0)
+        , function()
+    {}
+#endif
+};
+
 enum class LogLevel { debug, warning, error };

-using LogMethod = std::function<void(LogLevel, std::string&&)>;
+using LogMethod = std::function<void(source_loc, LogLevel, std::string_view, std::string&&)>;
+
+template<typename... Args>
+struct LogFormat
+{
+    fmt::format_string<Args...> fmt;
+    source_loc loc;
+
+#if __cplusplus >= 202002L
+    template<typename S>
+    consteval LogFormat(const S& s, const std::source_location& l = std::source_location::current())
+        : fmt(s)
+        , loc(l)
+    {}
+#else
+    template<typename S>
+    constexpr LogFormat(const S& s)
+        : fmt(s)
+        , loc()
+    {}
+#endif
+};
+
+#if __cplusplus < 202002L
+template<class _Tp>
+struct type_identity
+{
+    typedef _Tp type;
+};
+template<class _Tp>
+using type_identity_t = typename type_identity<_Tp>::type;
+#else
+using std::type_identity_t;
+#endif

 struct OPENDHT_PUBLIC Logger
 {
    Logger() = delete;
-    Logger(LogMethod&& l)
-        : logger(std::move(l))
+    Logger(LogMethod&& l, std::string tag = "")
+        : logger_(std::move(l))
+        , tag_(std::move(tag))
+        , prefix_(tag_.empty() ? "" : fmt::format("[{}] ", tag_))
    {
-        if (!logger)
-            throw std::invalid_argument {"logger and loggerf must be set"};
+        if (!logger_)
+            throw std::invalid_argument {"logger must be set"};
    }
-    void setFilter(const InfoHash& f)
+    Logger(const Logger& parent, std::string tag)
+        : logger_(parent.logger_)
+        , tag_(std::move(tag))
+        , prefix_(fmt::format("{}[{}] ", parent.prefix_, tag_))
+    {}
+
+    std::shared_ptr<Logger> createChild(std::string tag)
    {
-        filter_ = f;
-        filterEnable_ = static_cast<bool>(filter_);
+        std::lock_guard lock {children_mutex_};
+        auto child = std::make_shared<Logger>(*this, std::move(tag));
+        children_.push_back(child);
+        return child;
    }
-    inline void log0(LogLevel level, fmt::string_view format, fmt::printf_args args) const
+
+    void setFilter(std::string_view filter)
    {
-        if (not filterEnable_)
-            logger(level, fmt::vsprintf(format, args));
+        std::lock_guard lock {children_mutex_};
+        enable_ = filter.empty() or tag_.find(filter) != std::string_view::npos;
+        for (auto it = children_.begin(); it != children_.end();) {
+            if (auto c = it->lock()) {
+                c->setFilter(enable_ ? std::string_view {} : filter);
+                ++it;
+            } else {
+                it = children_.erase(it);
+            }
+        }
    }
-    inline void log1(LogLevel level, const InfoHash& f, fmt::string_view format, fmt::printf_args args) const
+
+    void setFilter(const InfoHash& f) { setFilter(f.to_view()); }
+
+    inline void log0(source_loc loc, LogLevel level, fmt::string_view format, fmt::printf_args args) const
    {
-        if (not filterEnable_ or f == filter_)
-            logger(level, fmt::vsprintf(format, args));
-    }
-    inline void log2(
-        LogLevel level, const InfoHash& f1, const InfoHash& f2, fmt::string_view format, fmt::printf_args args) const
-    {
-        if (not filterEnable_ or f1 == filter_ or f2 == filter_)
-            logger(level, fmt::vsprintf(format, args));
+        if (enable_)
+            logger_(loc, level, prefix_, fmt::vsprintf(format, args));
    }
    template<typename... Args>
-    inline void debug(fmt::format_string<Args...> format, Args&&... args) const
+    inline void debug(LogFormat<type_identity_t<Args>...> format, Args&&... args) const
    {
-        logger(LogLevel::debug, fmt::format(format, std::forward<Args>(args)...));
+        if (enable_)
+            logger_(format.loc, LogLevel::debug, prefix_, fmt::format(format.fmt, std::forward<Args>(args)...));
    }
    template<typename... Args>
-    inline void warn(fmt::format_string<Args...> format, Args&&... args) const
+    inline void warn(LogFormat<type_identity_t<Args>...> format, Args&&... args) const
    {
-        logger(LogLevel::warning, fmt::format(format, std::forward<Args>(args)...));
+        if (enable_)
+            logger_(format.loc, LogLevel::warning, prefix_, fmt::format(format.fmt, std::forward<Args>(args)...));
    }
    template<typename... Args>
-    inline void error(fmt::format_string<Args...> format, Args&&... args) const
+    inline void error(LogFormat<type_identity_t<Args>...> format, Args&&... args) const
    {
-        logger(LogLevel::error, fmt::format(format, std::forward<Args>(args)...));
+        if (enable_)
+            logger_(format.loc, LogLevel::error, prefix_, fmt::format(format.fmt, std::forward<Args>(args)...));
    }
    template<typename... T>
-    inline void d(fmt::format_string<T...> format, T&&... args) const
+    inline void d(LogFormat<type_identity_t<T>...> format, T&&... args) const
    {
-        log0(LogLevel::debug, format, fmt::make_printf_args(args...));
+        log0(format.loc, LogLevel::debug, format.fmt, fmt::make_printf_args(args...));
    }
    template<typename... T>
-    inline void d(const InfoHash& f, fmt::format_string<T...> format, T&&... args) const
+    inline void w(LogFormat<type_identity_t<T>...> format, T&&... args) const
    {
-        log1(LogLevel::debug, f, format, fmt::make_printf_args(args...));
+        log0(format.loc, LogLevel::warning, format.fmt, fmt::make_printf_args(args...));
    }
    template<typename... T>
-    inline void d(const InfoHash& f1, const InfoHash& f2, fmt::format_string<T...> format, T&&... args) const
+    inline void e(LogFormat<type_identity_t<T>...> format, T&&... args) const
    {
-        log2(LogLevel::debug, f1, f2, format, fmt::make_printf_args(args...));
-    }
-    template<typename... T>
-    inline void w(fmt::format_string<T...> format, T&&... args) const
-    {
-        log0(LogLevel::warning, format, fmt::make_printf_args(args...));
-    }
-    template<typename... T>
-    inline void w(const InfoHash& f, fmt::format_string<T...> format, T&&... args) const
-    {
-        log1(LogLevel::warning, f, format, fmt::make_printf_args(args...));
-    }
-    template<typename... T>
-    inline void w(const InfoHash& f1, const InfoHash& f2, fmt::format_string<T...> format, T&&... args) const
-    {
-        log2(LogLevel::warning, f1, f2, format, fmt::make_printf_args(args...));
-    }
-    template<typename... T>
-    inline void e(fmt::format_string<T...> format, T&&... args) const
-    {
-        log0(LogLevel::error, format, fmt::make_printf_args(args...));
-    }
-    template<typename... T>
-    inline void e(const InfoHash& f, fmt::format_string<T...> format, T&&... args) const
-    {
-        log1(LogLevel::error, f, format, fmt::make_printf_args(args...));
-    }
-    template<typename... T>
-    inline void e(const InfoHash& f1, const InfoHash& f2, fmt::format_string<T...> format, T&&... args) const
-    {
-        log2(LogLevel::error, f1, f2, format, fmt::make_printf_args(args...));
+        log0(format.loc, LogLevel::error, format.fmt, fmt::make_printf_args(args...));
    }

 private:
-    LogMethod logger = {};
-    bool filterEnable_ {false};
-    InfoHash filter_ {};
+    const LogMethod logger_ = {};
+    const std::string tag_ {};
+    const std::string prefix_ {};
+    std::mutex children_mutex_;
+    std::vector<std::weak_ptr<Logger>> children_ {};
+    bool enable_ {true};
 };

 } // namespace log
@@ -1,22 +1,5 @@
-/*
- *  Copyright (C) 2014-2025 Savoir-faire Linux Inc.
- *  Author(s) : Adrien Béraud <adrien.beraud@savoirfairelinux.com>
- *              Simon Désaulniers <simon.desaulniers@savoirfairelinux.com>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 3 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program. If not, see <https://www.gnu.org/licenses/>.
- */
-
+// Copyright (c) 2014-2026 Savoir-faire Linux Inc.
+// SPDX-License-Identifier: MIT
 #pragma once

 #include "node_cache.h"
@@ -48,23 +31,25 @@ struct TransId;
 #define MSG_CONFIRM 0
 #endif

-struct NetworkConfig {
+struct NetworkConfig
+{
    NetId network {0};
    ssize_t max_req_per_sec {0};
    ssize_t max_peer_req_per_sec {0};
    bool is_client {false};
 };

-class DhtProtocolException : public DhtException {
+class DhtProtocolException : public DhtException
+{
 public:
    // sent to another peer (http-like).
    static const constexpr uint16_t NON_AUTHORITATIVE_INFORMATION {203}; /* incomplete request packet. */
    static const constexpr uint16_t UNAUTHORIZED {401};                  /* incorrect tokens. */
    static const constexpr uint16_t NOT_FOUND {404};                     /* storage not found */
    // for internal use (custom).
-    static const constexpr uint16_t INVALID_TID_SIZE {421};              /* id was truncated. */
-    static const constexpr uint16_t UNKNOWN_TID {422};                   /* unknown tid */
-    static const constexpr uint16_t WRONG_NODE_INFO_BUF_LEN {423};       /* node info length is incorrect */
+    static const constexpr uint16_t INVALID_TID_SIZE {421};        /* id was truncated. */
+    static const constexpr uint16_t UNKNOWN_TID {422};             /* unknown tid */
+    static const constexpr uint16_t WRONG_NODE_INFO_BUF_LEN {423}; /* node info length is incorrect */

    static const std::string GET_NO_INFOHASH;    /* received "get" request with no infohash */
    static const std::string LISTEN_NO_INFOHASH; /* got "listen" request without infohash */
@@ -74,8 +59,12 @@ public:
    static const std::string STORAGE_NOT_FOUND;  /* got access request for an unknown storage */
    static const std::string PUT_INVALID_ID;     /* invalid id in "put" request */

-    DhtProtocolException(uint16_t code, const std::string& msg="", InfoHash failing_node_id={})
-        : DhtException(msg), msg(msg), code(code), failing_node_id(failing_node_id) {}
+    DhtProtocolException(uint16_t code, const std::string& msg = "", InfoHash failing_node_id = {})
+        : DhtException(msg)
+        , msg(msg)
+        , code(code)
+        , failing_node_id(failing_node_id)
+    {}

    const std::string& getMsg() const { return msg; }
    uint16_t getCode() const { return code; }
@@ -92,7 +81,8 @@ struct ParsedMessage;
 /**
 * Answer for a request.
 */
-struct RequestAnswer {
+struct RequestAnswer
+{
    Blob ntoken {};
    Value::Id vid {};
    std::vector<Sp<Value>> values {};
@@ -177,12 +167,7 @@ private:
     * @param token (type: Blob) security token.
     * @param rid (type: uint16_t) request id.
     */
-    std::function<RequestAnswer(Sp<Node>,
-            const InfoHash&,
-            const Blob&,
-            Tid,
-            const Query&,
-            int)> onListen {};
+    std::function<RequestAnswer(Sp<Node>, const InfoHash&, const Blob&, Tid, const Query&, int)> onListen {};
    /**
     * Called on announce request.
     *
@@ -192,11 +177,8 @@ private:
     * @param values (type: std::vector<Sp<Value>>) values to store.
     * @param created (type: time_point) time when the value was created.
     */
-    std::function<RequestAnswer(Sp<Node>,
-            const InfoHash&,
-            const Blob&,
-            const std::vector<Sp<Value>>&,
-            const time_point&)> onAnnounce {};
+    std::function<RequestAnswer(Sp<Node>, const InfoHash&, const Blob&, const std::vector<Sp<Value>>&, const time_point&)>
+        onAnnounce {};
    /**
     * Called on refresh request.
     *
@@ -205,32 +187,28 @@ private:
     * @param token (type: Blob) security token.
     * @param vid (type: Value::id) the value id.
     */
-    std::function<RequestAnswer(Sp<Node>,
-            const InfoHash&,
-            const Blob&,
-            const Value::Id&)> onRefresh {};
+    std::function<RequestAnswer(Sp<Node>, const InfoHash&, const Blob&, const Value::Id&)> onRefresh {};

 public:
    using RequestCb = std::function<void(const Request&, RequestAnswer&&)>;
    using RequestErrorCb = std::function<bool(const Request&, DhtProtocolException&&)>;
    using RequestExpiredCb = std::function<void(const Request&, bool)>;

-    NetworkEngine(
-            InfoHash& myid,
-            NetworkConfig config,
-            std::unique_ptr<DatagramSocket>&& sock,
-            const Sp<Logger>& log,
-            std::mt19937_64& rd,
-            Scheduler& scheduler,
-            decltype(NetworkEngine::onError)&& onError,
-            decltype(NetworkEngine::onNewNode)&& onNewNode,
-            decltype(NetworkEngine::onReportedAddr)&& onReportedAddr,
-            decltype(NetworkEngine::onPing)&& onPing,
-            decltype(NetworkEngine::onFindNode)&& onFindNode,
-            decltype(NetworkEngine::onGetValues)&& onGetValues,
-            decltype(NetworkEngine::onListen)&& onListen,
-            decltype(NetworkEngine::onAnnounce)&& onAnnounce,
-            decltype(NetworkEngine::onRefresh)&& onRefresh);
+    NetworkEngine(InfoHash& myid,
+                  NetworkConfig config,
+                  std::unique_ptr<DatagramSocket>&& sock,
+                  const Sp<Logger>& log,
+                  std::mt19937_64& rd,
+                  Scheduler& scheduler,
+                  decltype(NetworkEngine::onError)&& onError,
+                  decltype(NetworkEngine::onNewNode)&& onNewNode,
+                  decltype(NetworkEngine::onReportedAddr)&& onReportedAddr,
+                  decltype(NetworkEngine::onPing)&& onPing,
+                  decltype(NetworkEngine::onFindNode)&& onFindNode,
+                  decltype(NetworkEngine::onGetValues)&& onGetValues,
+                  decltype(NetworkEngine::onListen)&& onListen,
+                  decltype(NetworkEngine::onAnnounce)&& onAnnounce,
+                  decltype(NetworkEngine::onRefresh)&& onRefresh);

    ~NetworkEngine();

@@ -253,15 +231,32 @@ public:
     * @param values      The values to send.
     * @param version     If version = 1, a request will be used to answer to the listener
     */
-    void tellListener(const Sp<Node>& n, Tid socket_id, const InfoHash& hash, want_t want, const Blob& ntoken,
-            std::vector<Sp<Node>>&& nodes, std::vector<Sp<Node>>&& nodes6,
-            std::vector<Sp<Value>>&& values, const Query& q, int version);
+    void tellListener(const Sp<Node>& n,
+                      Tid socket_id,
+                      const InfoHash& hash,
+                      want_t want,
+                      const Blob& ntoken,
+                      std::vector<Sp<Node>>&& nodes,
+                      std::vector<Sp<Node>>&& nodes6,
+                      std::vector<Sp<Value>>&& values,
+                      const Query& q,
+                      int version);

-    void tellListenerRefreshed(const Sp<Node>& n, Tid socket_id, const InfoHash& hash, const Blob& ntoken, const std::vector<Value::Id>& values, int version);
-    void tellListenerExpired(const Sp<Node>& n, Tid socket_id, const InfoHash& hash, const Blob& ntoken, const std::vector<Value::Id>& values, int version);
+    void tellListenerRefreshed(const Sp<Node>& n,
+                               Tid socket_id,
+                               const InfoHash& hash,
+                               const Blob& ntoken,
+                               const std::vector<Value::Id>& values,
+                               int version);
+    void tellListenerExpired(const Sp<Node>& n,
+                             Tid socket_id,
+                             const InfoHash& hash,
+                             const Blob& ntoken,
+                             const std::vector<Value::Id>& values,
+                             int version);

    bool isRunning(sa_family_t af) const;
-    inline want_t want () const { return dht_socket->hasIPv4() and dht_socket->hasIPv6() ? (WANT4 | WANT6) : -1; }
+    inline want_t want() const { return dht_socket->hasIPv4() and dht_socket->hasIPv6() ? (WANT4 | WANT6) : -1; }

    void connectivityChanged(sa_family_t);

@@ -278,8 +273,7 @@ public:
     *
     * @return the request with information concerning its success.
     */
-    Sp<Request>
-    sendPing(const Sp<Node>& n, RequestCb&& on_done, RequestExpiredCb&& on_expired);
+    Sp<Request> sendPing(const Sp<Node>& n, RequestCb&& on_done, RequestExpiredCb&& on_expired);

    /**
     * Send a "ping" request to a given node.
@@ -291,11 +285,11 @@ public:
     *
     * @return the request with information concerning its success.
     */
-    Sp<Request>
-    sendPing(SockAddr&& sa, RequestCb&& on_done, RequestExpiredCb&& on_expired) {
+    Sp<Request> sendPing(SockAddr&& sa, RequestCb&& on_done, RequestExpiredCb&& on_expired)
+    {
        return sendPing(std::make_shared<Node>(InfoHash::zero(), std::move(sa), rd),
-                std::forward<RequestCb>(on_done),
-                std::forward<RequestExpiredCb>(on_expired));
+                        std::forward<RequestCb>(on_done),
+                        std::forward<RequestExpiredCb>(on_expired));
    }

    /**
@@ -418,11 +412,11 @@ public:
     * @return the request with information concerning its success.
     */
    void sendUpdateValues(const Sp<Node>& n,
-                                 const InfoHash& infohash,
-                                 std::vector<Sp<Value>>&& values,
-                                 time_point created,
-                                 const Blob& token,
-                                 size_t sid);
+                          const InfoHash& infohash,
+                          std::vector<Sp<Value>>&& values,
+                          time_point created,
+                          const Blob& token,
+                          size_t sid);
    Sp<Request> sendUpdateValues(const Sp<Node>& n,
                                 const InfoHash& infohash,
                                 std::vector<Sp<Value>>::iterator begin,
@@ -440,44 +434,38 @@ public:
     * @param fromlen  The length of the corresponding sockaddr structure.
     * @param now  The time to adjust the clock in the network engine.
     */
-    void processMessage(const uint8_t *buf, size_t buflen, SockAddr addr);
+    void processMessage(const uint8_t* buf, size_t buflen, SockAddr addr);

-    Sp<Node> insertNode(const InfoHash& id, const SockAddr& addr) {
+    Sp<Node> insertNode(const InfoHash& id, const SockAddr& addr)
+    {
        auto n = cache.getNode(id, addr, scheduler.time(), 0);
        onNewNode(n, 0);
        return n;
    }

-    std::vector<unsigned> getNodeMessageStats(bool in) {
+    std::vector<unsigned> getNodeMessageStats(bool in)
+    {
        auto& st = in ? in_stats : out_stats;
-        std::vector<unsigned> stats {st.ping,  st.find,  st.get,  st.listen,  st.put};
+        std::vector<unsigned> stats {st.ping, st.find, st.get, st.listen, st.put};
        st = {};
        return stats;
    }

    void blacklistNode(const Sp<Node>& n);

-    std::vector<Sp<Node>> getCachedNodes(const InfoHash& id, sa_family_t sa_f, size_t count) {
+    std::vector<Sp<Node>> getCachedNodes(const InfoHash& id, sa_family_t sa_f, size_t count)
+    {
        return cache.getCachedNodes(id, sa_f, count);
    }

-    size_t getNodeCacheSize() const {
-        return cache.size();
-    }
-    size_t getNodeCacheSize(sa_family_t af) const {
-        return cache.size(af);
-    }
+    size_t getNodeCacheSize() const { return cache.size(); }
+    size_t getNodeCacheSize(sa_family_t af) const { return cache.size(af); }

-    size_t getRateLimiterSize() const {
-        return address_rate_limiter.size();
-    }
+    size_t getRateLimiterSize() const { return address_rate_limiter.size(); }

-    size_t getPartialCount() const {
-        return partial_messages.size();
-    }
+    size_t getPartialCount() const { return partial_messages.size(); }

 private:
-
    struct PartialMessage;

    /***************
@@ -501,8 +489,12 @@ private:
    static constexpr size_t MTU {1280};
    static constexpr size_t MAX_PACKET_VALUE_SIZE {600};
    static constexpr size_t MAX_MESSAGE_VALUE_SIZE {56 * 1024};
+    static constexpr size_t RX_MAX_EARLY_BYTES {MAX_MESSAGE_VALUE_SIZE + MAX_VALUE_SIZE + 32};
+    static constexpr size_t RX_MAX_EARLY_PARTS {RX_MAX_EARLY_BYTES / MTU + 2};

    void process(std::unique_ptr<ParsedMessage>&&, const SockAddr& from);
+    bool isExpectedReply(const ParsedMessage&, const SockAddr& from);
+    bool tryCompleteMessage(PartialMessage&, const SockAddr& from);

    bool rateLimit(const SockAddr& addr);

@@ -517,26 +509,30 @@ private:
     */
    void sendRequest(const Sp<Request>& request);

-    struct MessageStats {
-        unsigned ping         {0};
-        unsigned find         {0};
-        unsigned get          {0};
-        unsigned put          {0};
-        unsigned listen       {0};
-        unsigned refresh      {0};
-        unsigned updateValue  {0};
+    struct MessageStats
+    {
+        unsigned ping {0};
+        unsigned find {0};
+        unsigned get {0};
+        unsigned put {0};
+        unsigned listen {0};
+        unsigned refresh {0};
+        unsigned updateValue {0};
    };

-
    // basic wrapper for socket sendto function
-    int send(const SockAddr& addr, const char *buf, size_t len, bool confirmed = false);
+    int send(const SockAddr& addr, const char* buf, size_t len, bool confirmed = false);

    void sendValueParts(Tid tid, const std::vector<Blob>& svals, const SockAddr& addr);
-    std::vector<Blob> packValueHeader(msgpack::sbuffer&, std::vector<Sp<Value>>::const_iterator, std::vector<Sp<Value>>::const_iterator) const;
-    std::vector<Blob> packValueHeader(msgpack::sbuffer& buf, const std::vector<Sp<Value>>& values) const {
+    std::vector<Blob> packValueHeader(msgpack::sbuffer&,
+                                      std::vector<Sp<Value>>::const_iterator,
+                                      std::vector<Sp<Value>>::const_iterator) const;
+    std::vector<Blob> packValueHeader(msgpack::sbuffer& buf, const std::vector<Sp<Value>>& values) const
+    {
        return packValueHeader(buf, values.begin(), values.end());
    }
-    void maintainRxBuffer(Tid tid);
+    using PartialMessageKey = std::pair<SockAddr, Tid>;
+    void maintainRxBuffer(const PartialMessageKey& key);

    /*************
     *  Answers  *
@@ -545,29 +541,22 @@ private:
    void sendPong(const SockAddr& addr, Tid tid);
    /* answer to findnodes/getvalues request */
    void sendNodesValues(const SockAddr& addr,
-            Tid tid,
-            const Blob& nodes,
-            const Blob& nodes6,
-            const std::vector<Sp<Value>>& st,
-            const Query& query,
-            const Blob& token);
+                         Tid tid,
+                         const Blob& nodes,
+                         const Blob& nodes6,
+                         const std::vector<Sp<Value>>& st,
+                         const Query& query,
+                         const Blob& token);
    Blob bufferNodes(sa_family_t af, const InfoHash& id, std::vector<Sp<Node>>& nodes);

-    std::pair<Blob, Blob> bufferNodes(sa_family_t af,
-            const InfoHash& id,
-            want_t want,
-            std::vector<Sp<Node>>& nodes,
-            std::vector<Sp<Node>>& nodes6);
+    std::pair<Blob, Blob> bufferNodes(
+        sa_family_t af, const InfoHash& id, want_t want, std::vector<Sp<Node>>& nodes, std::vector<Sp<Node>>& nodes6);
    /* answer to a listen request */
-    void sendListenConfirmation(const SockAddr& addr, Tid tid);
+    void sendListenConfirmation(const SockAddr& addr, Tid tid, const Blob& token = {});
    /* answer to put request */
    void sendValueAnnounced(const SockAddr& addr, Tid, Value::Id);
    /* answer in case of error */
-    void sendError(const SockAddr& addr,
-            Tid tid,
-            uint16_t code,
-            const std::string& message,
-            bool include_id=false);
+    void sendError(const SockAddr& addr, Tid tid, uint16_t code, const std::string& message, bool include_id = false);

    void deserializeNodes(ParsedMessage& msg, const SockAddr& from);

@@ -589,7 +578,7 @@ private:

    // requests handling
    std::map<Tid, Sp<Request>> requests {};
-    std::map<Tid, PartialMessage> partial_messages;
+    std::map<PartialMessageKey, PartialMessage> partial_messages;

    MessageStats in_stats {}, out_stats {};
    std::set<SockAddr> blacklist {};
@@ -1,20 +1,5 @@
-/*
- *  Copyright (C) 2014-2025 Savoir-faire Linux Inc.
- *  Author(s) : Adrien Béraud <adrien.beraud@savoirfairelinux.com>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 3 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program. If not, see <https://www.gnu.org/licenses/>.
- */
+// Copyright (c) 2014-2026 Savoir-faire Linux Inc.
+// SPDX-License-Identifier: MIT
 #pragma once

 #include "def.h"
@@ -73,7 +58,7 @@ public:

    inline void setOnReceive(OnReceive&& cb)
    {
-        std::lock_guard<std::mutex> lk(lock);
+        std::lock_guard lk(lock);
        rx_callback = std::move(cb);
    }

@@ -82,12 +67,12 @@ public:

    SockAddr getBound(sa_family_t family = AF_UNSPEC) const
    {
-        std::lock_guard<std::mutex> lk(lock);
+        std::lock_guard lk(lock);
        return getBoundRef(family);
    }
    in_port_t getPort(sa_family_t family = AF_UNSPEC) const
    {
-        std::lock_guard<std::mutex> lk(lock);
+        std::lock_guard lk(lock);
        return getBoundRef(family).getPort();
    }

@@ -117,7 +102,7 @@ protected:

    inline void onReceived(PacketList&& packets)
    {
-        std::lock_guard<std::mutex> lk(lock);
+        std::lock_guard lk(lock);
        if (rx_callback) {
            auto r = rx_callback(std::move(packets));
            if (not r.empty() and toRecycle_.size() < RX_QUEUE_MAX_SIZE)
@@ -149,12 +134,12 @@ public:

    bool hasIPv4() const override
    {
-        std::lock_guard<std::mutex> lk(lock);
+        std::lock_guard lk(lock);
        return s4 != -1;
    }
    bool hasIPv6() const override
    {
-        std::lock_guard<std::mutex> lk(lock);
+        std::lock_guard lk(lock);
        return s6 != -1;
    }

@@ -1,22 +1,5 @@
-/*
- *  Copyright (C) 2014-2025 Savoir-faire Linux Inc.
- *  Author(s) : Adrien Béraud <adrien.beraud@savoirfairelinux.com>
- *              Simon Désaulniers <simon.desaulniers@savoirfairelinux.com>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 3 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program. If not, see <https://www.gnu.org/licenses/>.
- */
-
+// Copyright (c) 2014-2026 Savoir-faire Linux Inc.
+// SPDX-License-Identifier: MIT
 #pragma once

 #include "infohash.h" // includes socket structures
@@ -38,28 +21,28 @@ struct RequestAnswer;

 using Tid = uint32_t;
 using SocketCb = std::function<void(const Sp<Node>&, net::RequestAnswer&&)>;
-struct Socket {
+struct Socket
+{
    Socket() {}
-    Socket(SocketCb&& on_receive) :
-        on_receive(std::move(on_receive)) {}
+    Socket(SocketCb&& on_receive)
+        : on_receive(std::move(on_receive))
+    {}
    SocketCb on_receive {};
 };

-struct Node {
+struct Node
+{
    const InfoHash id;

-    Node(const InfoHash& id, const SockAddr& addr, std::mt19937_64& rd, bool client=false);
-    Node(const InfoHash& id, SockAddr&& addr, std::mt19937_64& rd, bool client=false);
+    Node(const InfoHash& id, const SockAddr& addr, std::mt19937_64& rd, bool client = false);
+    Node(const InfoHash& id, SockAddr&& addr, std::mt19937_64& rd, bool client = false);
    Node(const InfoHash& id, const sockaddr* sa, socklen_t salen, std::mt19937_64& rd)
-        : Node(id, SockAddr(sa, salen), rd) {}
+        : Node(id, SockAddr(sa, salen), rd)
+    {}

-    const InfoHash& getId() const {
-        return id;
-    }
+    const InfoHash& getId() const { return id; }
    const SockAddr& getAddr() const { return addr; }
-    std::string getAddrStr() const {
-        return addr.toString();
-    }
+    std::string getAddrStr() const { return addr.toString(); }
    bool isClient() const { return is_client; }
    bool isIncoming() { return time > reply_time; }

@@ -72,7 +55,8 @@ struct Node {
     * to MAX_AUTH_ERRORS errors are accepted in order to let the node recover.
     * Upon this limit, the node expires.
     */
-    void authError() {
+    void authError()
+    {
        if (++auth_errors > MAX_AUTH_ERRORS)
            setExpired();
    }
@@ -83,14 +67,11 @@ struct Node {
    bool isPendingMessage() const;
    size_t getPendingMessageCount() const;

-    bool isOld(const time_point& now) const {
-        return time + NODE_EXPIRE_TIME < now;
-    }
-    bool isRemovable(const time_point& now) const {
-        return isExpired() and isOld(now);
-    }
+    bool isOld(const time_point& now) const { return time + NODE_EXPIRE_TIME < now; }
+    bool isRemovable(const time_point& now) const { return isExpired() and isOld(now); }

-    NodeExport exportNode() const {
+    NodeExport exportNode() const
+    {
        NodeExport ne;
        ne.id = id;
        ne.addr = addr;
@@ -130,21 +111,26 @@ struct Node {
    /**
     * Resets the state of the node so it's not expired anymore.
     */
-    void reset() { expired_ = false; reply_time = time_point::min(); }
+    void reset()
+    {
+        expired_ = false;
+        reply_time = time_point::min();
+    }

    /**
     * Generates a new request id, skipping the invalid id.
     *
     * @return the new id.
     */
-    Tid getNewTid() {
+    Tid getNewTid()
+    {
        ++transaction_id;
        return transaction_id ? transaction_id : ++transaction_id;
    }

    std::string toString() const;

-    OPENDHT_PUBLIC friend std::ostream& operator<< (std::ostream& s, const Node& h);
+    OPENDHT_PUBLIC friend std::ostream& operator<<(std::ostream& s, const Node& h);

    static constexpr const std::chrono::minutes NODE_GOOD_TIME {120};

@@ -160,8 +146,8 @@ private:

    SockAddr addr;
    bool is_client {false};
-    time_point time {time_point::min()};            /* last time eared about */
-    time_point reply_time {time_point::min()};      /* time of last correct reply received */
+    time_point time {time_point::min()};       /* last time eared about */
+    time_point reply_time {time_point::min()}; /* time of last correct reply received */
    unsigned auth_errors {0};
    bool expired_ {false};
    Tid transaction_id;
@@ -171,4 +157,4 @@ private:
    std::map<Tid, Sp<Socket>> sockets_;
 };

-}
+} // namespace dht
@@ -1,21 +1,5 @@
-/*
- *  Copyright (C) 2014-2025 Savoir-faire Linux Inc.
- *  Author(s) : Adrien Béraud <adrien.beraud@savoirfairelinux.com>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 3 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program. If not, see <https://www.gnu.org/licenses/>.
- */
-
+// Copyright (c) 2014-2026 Savoir-faire Linux Inc.
+// SPDX-License-Identifier: MIT
 #pragma once

 #include "node.h"
@@ -25,16 +9,13 @@

 namespace dht {

-struct NodeCache {
-    size_t size(sa_family_t family) const {
-        return cache(family).count();
-    }
-    size_t size() const {
-        return size(AF_INET) + size(AF_INET6);
-    }
+struct NodeCache
+{
+    size_t size(sa_family_t family) const { return cache(family).count(); }
+    size_t size() const { return size(AF_INET) + size(AF_INET6); }

    Sp<Node> getNode(const InfoHash& id, sa_family_t family);
-    Sp<Node> getNode(const InfoHash& id, const SockAddr&, time_point now, bool confirmed, bool client=false);
+    Sp<Node> getNode(const InfoHash& id, const SockAddr&, time_point now, bool confirmed, bool client = false);
    std::vector<Sp<Node>> getCachedNodes(const InfoHash& id, sa_family_t sa_f, size_t count) const;

    /**
@@ -44,19 +25,23 @@ struct NodeCache {
     */
    void clearBadNodes(sa_family_t family = 0);

-    NodeCache(std::mt19937_64& r) : rd(r) {};
+    NodeCache(std::mt19937_64& r)
+        : rd(r) {};
    ~NodeCache();

 private:
-    class NodeMap : private std::map<InfoHash, std::weak_ptr<Node>> {
+    class NodeMap : private std::map<InfoHash, std::weak_ptr<Node>>
+    {
    public:
        Sp<Node> getNode(const InfoHash& id);
-        Sp<Node> getNode(const InfoHash& id, const SockAddr&, time_point now, bool confirmed, bool client, std::mt19937_64& rd);
+        Sp<Node> getNode(
+            const InfoHash& id, const SockAddr&, time_point now, bool confirmed, bool client, std::mt19937_64& rd);
        std::vector<Sp<Node>> getCachedNodes(const InfoHash& id, size_t count) const;
        void clearBadNodes();
        void setExpired();
        void cleanup();
        size_t count() const { return size(); }
+
    private:
        size_t cleanup_counter {0};
    };
@@ -68,4 +53,4 @@ private:
    std::mt19937_64& rd;
 };

-}
+} // namespace dht
@@ -1,19 +1,5 @@
-/*
- *  Copyright (C) 2014-2025 Savoir-faire Linux Inc.
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 3 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program. If not, see <https://www.gnu.org/licenses/>.
- */
+// Copyright (c) 2014-2026 Savoir-faire Linux Inc.
+// SPDX-License-Identifier: MIT
 #pragma once

 #include "def.h"
@@ -25,11 +11,12 @@
 namespace dht {
 using namespace std::literals;

-struct OPENDHT_PUBLIC NodeExport {
+struct OPENDHT_PUBLIC NodeExport
+{
    InfoHash id;
    SockAddr addr;

-    template <typename Packer>
+    template<typename Packer>
    void msgpack_pack(Packer& pk) const
    {
        pk.pack_map(2);
@@ -37,12 +24,12 @@ struct OPENDHT_PUBLIC NodeExport {
        pk.pack(id);
        pk.pack("addr"sv);
        pk.pack_bin(addr.getLength());
-        pk.pack_bin_body((const char*)addr.get(), (size_t)addr.getLength());
+        pk.pack_bin_body((const char*) addr.get(), (size_t) addr.getLength());
    }

    void msgpack_unpack(msgpack::object o);

-    OPENDHT_PUBLIC friend std::ostream& operator<< (std::ostream& s, const NodeExport& h);
+    OPENDHT_PUBLIC friend std::ostream& operator<<(std::ostream& s, const NodeExport& h);
 };

-}
+} // namespace dht
@@ -1,22 +1,5 @@
-/*
- *  Copyright (C) 2014-2025 Savoir-faire Linux Inc.
- *  Author(s) : Mingrui Zhang <mingrui.zhang@savoirfairelinux.com>
- *              Vsevolod Ivanov <vsevolod.ivanov@savoirfairelinux.com>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 3 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program. If not, see <https://www.gnu.org/licenses/>.
- */
-
+// Copyright (c) 2014-2026 Savoir-faire Linux Inc.
+// SPDX-License-Identifier: MIT
 #pragma once

 #include "def.h"
@@ -38,11 +21,11 @@ class OPENDHT_PUBLIC PeerDiscovery
 {
 public:
    static constexpr in_port_t DEFAULT_PORT = 8888;
-    using ServiceDiscoveredCallback = std::function<void(msgpack::object &&, SockAddr &&)>;
+    using ServiceDiscoveredCallback = std::function<void(msgpack::object&&, SockAddr&&)>;

    PeerDiscovery(in_port_t port = DEFAULT_PORT,
-                std::shared_ptr<asio::io_context> ioContext = {},
-                std::shared_ptr<Logger> logger = {});
+                  std::shared_ptr<asio::io_context> ioContext = {},
+                  std::shared_ptr<Logger> logger = {});
    ~PeerDiscovery();

    /**
@@ -51,21 +34,21 @@ public:
     */
    void startDiscovery(std::string_view type, ServiceDiscoveredCallback callback);

-    template <typename T>
-    void startDiscovery(std::string_view type, std::function<void(T &&, SockAddr &&)> cb) {
-        startDiscovery(type, [cb](msgpack::object &&ob, SockAddr &&addr) {
-            cb(ob.as<T>(), std::move(addr));
-        });
+    template<typename T>
+    void startDiscovery(std::string_view type, std::function<void(T&&, SockAddr&&)> cb)
+    {
+        startDiscovery(type, [cb](msgpack::object&& ob, SockAddr&& addr) { cb(ob.as<T>(), std::move(addr)); });
    }

    /**
     * startPublish - Keeping sending data until node is joinned or stop is called
     */
-    void startPublish(std::string_view type, const msgpack::sbuffer &pack_buf);
-    void startPublish(sa_family_t domain, std::string_view type, const msgpack::sbuffer &pack_buf);
+    void startPublish(std::string_view type, const msgpack::sbuffer& pack_buf);
+    void startPublish(sa_family_t domain, std::string_view type, const msgpack::sbuffer& pack_buf);

-    template <typename T>
-    void startPublish(std::string_view type, const T &object) {
+    template<typename T>
+    void startPublish(std::string_view type, const T& object)
+    {
        msgpack::sbuffer buf;
        msgpack::pack(buf, object);
        startPublish(type, buf);
@@ -1,20 +1,5 @@
-/*
- *  Copyright (C) 2014-2025 Savoir-faire Linux Inc.
- *  Author: Adrien Béraud <adrien.beraud@savoirfairelinux.com>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 3 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program. If not, see <https://www.gnu.org/licenses/>.
- */
+// Copyright (c) 2014-2026 Savoir-faire Linux Inc.
+// SPDX-License-Identifier: MIT
 #pragma once

 #include <chrono>
@@ -23,9 +8,9 @@ namespace dht {
 namespace proxy {

 constexpr const std::chrono::hours OP_TIMEOUT {24}; // one day
-constexpr const std::chrono::hours OP_MARGIN {2}; // two hours
+constexpr const std::chrono::hours OP_MARGIN {8};   // eight hours

 using ListenToken = uint64_t;

-}
-}
+} // namespace proxy
+} // namespace dht
@@ -1,21 +1,5 @@
-/*
- *  Copyright (C) 2014-2025 Savoir-faire Linux Inc.
- *  Author : Adrien Béraud <adrien.beraud@savoirfairelinux.com>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 3 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program. If not, see <https://www.gnu.org/licenses/>.
- */
-
+// Copyright (c) 2014-2026 Savoir-faire Linux Inc.
+// SPDX-License-Identifier: MIT
 #pragma once

 #include "utils.h"
@@ -23,20 +7,25 @@

 namespace dht {

-class RateLimiter {
+class RateLimiter
+{
 public:
    RateLimiter(size_t quota, const duration& period = std::chrono::seconds(1))
-     : quota_(quota), period_(period) {}
+        : quota_(quota)
+        , period_(period)
+    {}

    /** Clear outdated records and return current quota usage */
-    size_t maintain(const time_point& now) {
+    size_t maintain(const time_point& now)
+    {
        auto limit = now - period_;
        while (not records.empty() and records.front() < limit)
            records.pop();
        return records.size();
    }
    /** Return false if quota is reached, insert record and return true otherwise. */
-    bool limit(const time_point& now) {
+    bool limit(const time_point& now)
+    {
        if (quota_ == std::numeric_limits<size_t>::max())
            return true;
        if (maintain(now) >= quota_)
@@ -44,13 +33,12 @@ public:
        records.emplace(now);
        return true;
    }
-    bool empty() const {
-        return records.empty();
-    }
+    bool empty() const { return records.empty(); }
+
 private:
    const size_t quota_;
    const duration period_;
    std::queue<time_point> records {};
 };

-}
+} // namespace dht
@@ -1,21 +1,5 @@
-/*
- *  Copyright (C) 2014-2025 Savoir-faire Linux Inc.
- *  Author : Adrien Béraud <adrien.beraud@savoirfairelinux.com>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 3 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program. If not, see <https://www.gnu.org/licenses/>.
- */
-
+// Copyright (c) 2014-2026 Savoir-faire Linux Inc.
+// SPDX-License-Identifier: MIT
 #pragma once

 #include <random>
@@ -27,14 +11,16 @@
 namespace dht {
 namespace crypto {

-/** 
+/**
 * Generate a seeded random engine.
 */
-template<class T = std::mt19937, std::size_t N = T::state_size+1>
-auto getSeededRandomEngine() -> typename std::enable_if<!!N, T>::type {
+template<class T = std::mt19937, std::size_t N = T::state_size + 1>
+auto
+getSeededRandomEngine() -> typename std::enable_if<!!N, T>::type
+{
    std::array<typename T::result_type, N> random_data;
    constexpr auto gen = [](std::random_device& source) -> typename T::result_type {
-        for (unsigned j=0; j<64; j++) {
+        for (unsigned j = 0; j < 64; j++) {
            try {
                return source();
            } catch (...) {
@@ -43,14 +29,13 @@ auto getSeededRandomEngine() -> typename std::enable_if<!!N, T>::type {
        }
        throw std::runtime_error("Can't generate random number");
    };
-    for (unsigned i=0; i<8; i++) {
+    for (unsigned i = 0; i < 8; i++) {
        try {
            std::random_device source;
            for (auto& r : random_data)
                r = gen(source);
-            std::seed_seq seed(
-                (std::seed_seq::result_type*)random_data.data(),
-                (std::seed_seq::result_type*)(random_data.data() + random_data.size()));
+            std::seed_seq seed((std::seed_seq::result_type*) random_data.data(),
+                               (std::seed_seq::result_type*) (random_data.data() + random_data.size()));
            return T(seed);
        } catch (...) {
            std::this_thread::sleep_for(std::chrono::microseconds(500));
@@ -62,14 +47,16 @@ auto getSeededRandomEngine() -> typename std::enable_if<!!N, T>::type {
 /**
 * Generate a random engine from another source.
 */
-template<class T = std::mt19937, std::size_t N = T::state_size+1>
-auto getDerivedRandomEngine(T& source) -> typename std::enable_if<!!N, T>::type {
+template<class T = std::mt19937, std::size_t N = T::state_size + 1>
+auto
+getDerivedRandomEngine(T& source) -> typename std::enable_if<!!N, T>::type
+{
    std::array<typename T::result_type, N> random_data;
    std::generate(random_data.begin(), random_data.end(), std::ref(source));
-    std::seed_seq seed(
-        (std::seed_seq::result_type*)random_data.data(),
-        (std::seed_seq::result_type*)(random_data.data() + random_data.size()));
+    std::seed_seq seed((std::seed_seq::result_type*) random_data.data(),
+                       (std::seed_seq::result_type*) (random_data.data() + random_data.size()));
    return T(seed);
 }

-}} // dht::crypto
+} // namespace crypto
+} // namespace dht
@@ -1,22 +1,5 @@
-/*
- *  Copyright (C) 2014-2025 Savoir-faire Linux Inc.
- *  Author(s) : Adrien Béraud <adrien.beraud@savoirfairelinux.com>
- *              Simon Désaulniers <simon.desaulniers@savoirfairelinux.com>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 3 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program. If not, see <https://www.gnu.org/licenses/>.
- */
-
+// Copyright (c) 2014-2026 Savoir-faire Linux Inc.
+// SPDX-License-Identifier: MIT
 #pragma once

 #include "node.h"
@@ -28,28 +11,37 @@ namespace net {
 class NetworkEngine;
 }

-struct Bucket {
-    Bucket() : cached() {}
+struct Bucket
+{
+    Bucket()
+        : cached()
+    {}
    Bucket(sa_family_t af, const InfoHash& f = {}, time_point t = time_point::min())
-        : af(af), first(f), time(t), cached() {}
+        : af(af)
+        , first(f)
+        , time(t)
+        , cached()
+    {}
    sa_family_t af {0};
    InfoHash first {};
    time_point time {time_point::min()}; /* time of last reply in this bucket */
    std::list<Sp<Node>> nodes {};
-    Sp<Node> cached;                    /* the address of a likely candidate */
+    Sp<Node> cached; /* the address of a likely candidate */

    /** Return a random node in a bucket. */
    Sp<Node> randomNode(std::mt19937_64& rd);

    void sendCachedPing(net::NetworkEngine& ne);
-    void connectivityChanged() {
+    void connectivityChanged()
+    {
        time = time_point::min();
        for (auto& node : nodes)
            node->setTime(time_point::min());
    }
 };

-class RoutingTable : public std::list<Bucket> {
+class RoutingTable : public std::list<Bucket>
+{
 public:
    using std::list<Bucket>::list;

@@ -66,25 +58,26 @@ public:
    /**
     * Return true if the id is in the bucket's range.
     */
-    inline bool contains(const RoutingTable::const_iterator& bucket, const InfoHash& id) const {
+    inline bool contains(const RoutingTable::const_iterator& bucket, const InfoHash& id) const
+    {
        return InfoHash::cmp(bucket->first, id) <= 0
-            && (std::next(bucket) == end() || InfoHash::cmp(id, std::next(bucket)->first) < 0);
+               && (std::next(bucket) == end() || InfoHash::cmp(id, std::next(bucket)->first) < 0);
    }

    /**
     * Return true if the table has no bucket ore one empty buket.
     */
-    inline bool isEmpty() const {
-        return empty() || (size() == 1 && front().nodes.empty());
-    }
+    inline bool isEmpty() const { return empty() || (size() == 1 && front().nodes.empty()); }

-    void connectivityChanged(const time_point& now) {
+    void connectivityChanged(const time_point& now)
+    {
        grow_time = now;
        for (auto& b : *this)
            b.connectivityChanged();
    }

-    bool onNewNode(const Sp<Node>& node, int comfirm, const time_point& now, const InfoHash& myid, net::NetworkEngine& ne);
+    bool onNewNode(
+        const Sp<Node>& node, int comfirm, const time_point& now, const InfoHash& myid, net::NetworkEngine& ne);

    /**
     * Return a random id in the bucket's range.
@@ -99,4 +92,4 @@ public:
    bool split(const RoutingTable::iterator& b);
 };

-}
+} // namespace dht
@@ -1,23 +1,5 @@
-/*
- *  Copyright (C) 2014-2025 Savoir-faire Linux Inc.
- *  Author(s) : Adrien Béraud <adrien.beraud@savoirfairelinux.com>
- *              Simon Désaulniers <simon.desaulniers@savoirfairelinux.com>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 3 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program. If not, see <https://www.gnu.org/licenses/>.
- */
-
-
+// Copyright (c) 2014-2026 Savoir-faire Linux Inc.
+// SPDX-License-Identifier: MIT
 #pragma once

 #include "utils.h"
@@ -33,10 +15,15 @@ namespace dht {
 * @details
 * Maintains the timings upon which to execute a job.
 */
-class Scheduler {
+class Scheduler
+{
 public:
-    struct Job {
-        Job(std::function<void()>&& f, time_point t) : do_(std::move(f)), t_(t) {}
+    struct Job
+    {
+        Job(std::function<void()>&& f, time_point t)
+            : do_(std::move(f))
+            , t_(t)
+        {}
        std::function<void()> do_;
        const time_point t_;
        void cancel() { do_ = {}; }
@@ -50,7 +37,8 @@ public:
     *
     * @return pointer to the newly scheduled job.
     */
-    Sp<Scheduler::Job> add(time_point t, std::function<void()>&& job_func) {
+    Sp<Scheduler::Job> add(time_point t, std::function<void()>&& job_func)
+    {
        auto job = std::make_shared<Job>(std::move(job_func), t);
        if (t != time_point::max())
            timers.emplace(std::move(t), job);
@@ -63,7 +51,8 @@ public:
     * @param job  The job to edit.
     * @param t  The time at which the job shall be rescheduled.
     */
-    void edit(Sp<Scheduler::Job>& job, time_point t) {
+    void edit(Sp<Scheduler::Job>& job, time_point t)
+    {
        if (not job)
            return;
        // std::function move doesn't garantee to leave the object empty.
@@ -73,7 +62,8 @@ public:
        job = add(t, std::move(task));
    }

-    bool cancel(Sp<Scheduler::Job>& job) {
+    bool cancel(Sp<Scheduler::Job>& job)
+    {
        if (job) {
            job->cancel();
            for (auto r = timers.equal_range(job->t_); r.first != r.second; ++r.first) {
@@ -92,7 +82,8 @@ public:
     *
     * @return The time for the next job to run.
     */
-    time_point run() {
+    time_point run()
+    {
        while (not timers.empty()) {
            auto timer = timers.begin();
            /*
@@ -112,9 +103,7 @@ public:
        return getNextJobTime();
    }

-    inline time_point getNextJobTime() const {
-        return timers.empty() ? time_point::max() : timers.begin()->first;
-    }
+    inline time_point getNextJobTime() const { return timers.empty() ? time_point::max() : timers.begin()->first; }

    /**
     * Accessors for the common time reference used for synchronizing
@@ -129,4 +118,4 @@ private:
    std::multimap<time_point, Sp<Job>> timers {}; /* the jobs ordered by time */
 };

-}
+} // namespace dht
@@ -1,23 +1,5 @@
-/*
- *  Copyright (C) 2014-2025 Savoir-faire Linux Inc.
- *  Authors: Adrien Béraud <adrien.beraud@savoirfairelinux.com>
- *           Simon Désaulniers <simon.desaulniers@savoirfairelinux.com>
- *           Sébastien Blin <sebastien.blin@savoirfairelinux.com>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 3 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program. If not, see <https://www.gnu.org/licenses/>.
- */
-
+// Copyright (c) 2014-2026 Savoir-faire Linux Inc.
+// SPDX-License-Identifier: MIT
 #pragma once

 #include "dht.h"
@@ -30,9 +12,9 @@

 namespace dht {

-class OPENDHT_PUBLIC SecureDht final : public DhtInterface {
+class OPENDHT_PUBLIC SecureDht final : public DhtInterface
+{
 public:
-
    typedef std::function<void(bool)> SignatureCheckCallback;

    using Config = SecureDhtConfig;
@@ -41,7 +23,7 @@ public:
    {
        auto c = conf.node_config;
        if (not c.node_id and conf.id.second)
-            c.node_id = InfoHash::get("node:"+conf.id.second->getId().toString());
+            c.node_id = InfoHash::get("node:" + conf.id.second->getId().toString());
        return c;
    }

@@ -51,36 +33,37 @@ public:
     * id:    the identity to use for the crypto layer and to compute
     *        our own hash on the Dht.
     */
-    SecureDht(std::unique_ptr<DhtInterface> dht, Config config, IdentityAnnouncedCb iacb = {}, const std::shared_ptr<Logger>& l = {});
+    SecureDht(std::unique_ptr<DhtInterface> dht,
+              Config config,
+              IdentityAnnouncedCb iacb = {},
+              const std::shared_ptr<Logger>& l = {});

    virtual ~SecureDht();

-    InfoHash getId() const {
-        return key_ ? key_->getPublicKey().getId() : InfoHash();
-    }
-    PkId getLongId() const {
-        return key_ ? key_->getPublicKey().getLongId() : PkId();
-    }
-    Sp<crypto::PublicKey> getPublicKey() const {
-        return key_ ? key_->getSharedPublicKey() : Sp<crypto::PublicKey>{};
-    }
+    InfoHash getId() const { return key_ ? key_->getPublicKey().getId() : InfoHash(); }
+    PkId getLongId() const { return key_ ? key_->getPublicKey().getLongId() : PkId(); }
+    Sp<crypto::PublicKey> getPublicKey() const { return key_ ? key_->getSharedPublicKey() : Sp<crypto::PublicKey> {}; }

    ValueType secureType(ValueType&& type);

-    ValueType secureType(const ValueType& type) {
+    ValueType secureType(const ValueType& type)
+    {
        ValueType tmp_type = type;
        return secureType(std::move(tmp_type));
    }

-    void registerType(const ValueType& type) override {
+    void registerType(const ValueType& type) override
+    {
        if (dht_)
            dht_->registerType(secureType(type));
    }
-    void registerType(ValueType&& type) {
+    void registerType(ValueType&& type)
+    {
        if (dht_)
            dht_->registerType(secureType(std::forward<ValueType>(type)));
    }
-    void registerInsecureType(const ValueType& type) {
+    void registerInsecureType(const ValueType& type)
+    {
        if (dht_)
            dht_->registerType(type);
    }
@@ -90,14 +73,29 @@ public:
     * If the signature is unable to be checked, or if the data is unable to be decrypted, it is not returned.
     * Public, non-signed & non-encrypted data is retransmitted as-is.
     */
-    void get(const InfoHash& id, GetCallback cb, DoneCallback donecb={}, Value::Filter&& = {}, Where&& w = {}) override;
-    void get(const InfoHash& id, GetCallback cb, DoneCallbackSimple donecb={}, Value::Filter&& f = {}, Where&& w = {}) override {
+    void get(const InfoHash& id, GetCallback cb, DoneCallback donecb = {}, Value::Filter&& = {}, Where&& w = {}) override;
+    void get(const InfoHash& id,
+             GetCallback cb,
+             DoneCallbackSimple donecb = {},
+             Value::Filter&& f = {},
+             Where&& w = {}) override
+    {
        get(id, cb, bindDoneCb(donecb), std::forward<Value::Filter>(f), std::forward<Where>(w));
    }
-    void get(const InfoHash& key, GetCallbackSimple cb, DoneCallback donecb={}, Value::Filter&& f={}, Where&& w = {}) override {
+    void get(const InfoHash& key,
+             GetCallbackSimple cb,
+             DoneCallback donecb = {},
+             Value::Filter&& f = {},
+             Where&& w = {}) override
+    {
        get(key, bindGetCb(cb), donecb, std::forward<Value::Filter>(f), std::forward<Where>(w));
    }
-    void get(const InfoHash& key, GetCallbackSimple cb, DoneCallbackSimple donecb, Value::Filter&& f={}, Where&& w = {}) override {
+    void get(const InfoHash& key,
+             GetCallbackSimple cb,
+             DoneCallbackSimple donecb,
+             Value::Filter&& f = {},
+             Where&& w = {}) override
+    {
        get(key, bindGetCb(cb), bindDoneCb(donecb), std::forward<Value::Filter>(f), std::forward<Where>(w));
    }

@@ -105,7 +103,8 @@ public:
     * Will take ownership of the value, sign it using our private key and put it in the DHT.
     */
    void putSigned(const InfoHash& hash, Sp<Value> val, DoneCallback callback, bool permanent = false);
-    void putSigned(const InfoHash& hash, Value&& v, DoneCallback callback, bool permanent = false) {
+    void putSigned(const InfoHash& hash, Value&& v, DoneCallback callback, bool permanent = false)
+    {
        putSigned(hash, std::make_shared<Value>(std::move(v)), callback, permanent);
    }

@@ -114,16 +113,16 @@ public:
     * and put it in the DHT.
     * The operation will be immediate if the recipient' public key is known (otherwise it will be retrived first).
     */
-    void putEncrypted(const InfoHash& hash, const InfoHash& to, Sp<Value> val, DoneCallback callback, bool permanent = false);
+    void putEncrypted(const InfoHash& hash,
+                      const crypto::PublicKey& to,
+                      Sp<Value> val,
+                      DoneCallback callback,
+                      bool permanent = false);

    [[deprecated("Use the shared_ptr version instead")]]
-    void putEncrypted(const InfoHash& hash, const InfoHash& to, Value&& v, DoneCallback callback, bool permanent = false) {
-        putEncrypted(hash, to, std::make_shared<Value>(std::move(v)), callback, permanent);
-    }
-    void putEncrypted(const InfoHash& hash, const crypto::PublicKey& to, Sp<Value> val, DoneCallback callback, bool permanent = false);
-
-    [[deprecated("Use the shared_ptr version instead")]]
-    void putEncrypted(const InfoHash& hash, const crypto::PublicKey& to, Value&& v, DoneCallback callback, bool permanent = false) {
+    void putEncrypted(
+        const InfoHash& hash, const crypto::PublicKey& to, Value&& v, DoneCallback callback, bool permanent = false)
+    {
        putEncrypted(hash, to, std::make_shared<Value>(std::move(v)), callback, permanent);
    }

@@ -138,17 +137,11 @@ public:

    Value decrypt(const Value& v);

-    void findCertificate(const InfoHash& node, const std::function<void(const Sp<crypto::Certificate>)>& cb);
-    void findPublicKey(const InfoHash& node, const std::function<void(const Sp<crypto::PublicKey>)>& cb);
-
    void findCertificate(const PkId& id, const std::function<void(const Sp<crypto::Certificate>)>& cb);
    void findPublicKey(const PkId& id, const std::function<void(const Sp<crypto::PublicKey>)>& cb);

    void registerCertificate(const Sp<crypto::Certificate>& cert);

-    Sp<crypto::Certificate> getCertificate(const InfoHash& node) const;
-    Sp<crypto::PublicKey> getPublicKey(const InfoHash& node) const;
-
    Sp<crypto::Certificate> getCertificate(const PkId& node) const;
    Sp<crypto::PublicKey> getPublicKey(const PkId& node) const;

@@ -157,201 +150,157 @@ public:
     * The search key used is the public key ID, so there may be multiple certificates retured, signed with
     * the same private key.
     */
-    void setLocalCertificateStore(CertificateStoreQueryLegacy&& query_method) {
-        localQueryMethodLegacy_ = std::move(query_method);
-    }
-    void setLocalCertificateStore(CertificateStoreQuery&& query_method) {
-        localQueryMethod_ = std::move(query_method);
-    }
-    void setOnPublicAddressChanged(PublicAddressChangedCb cb) override {
-        dht_->setOnPublicAddressChanged(cb);
-    }
+    void setLocalCertificateStore(CertificateStoreQuery&& query_method) { localQueryMethod_ = std::move(query_method); }
+    void setOnPublicAddressChanged(PublicAddressChangedCb cb) override { dht_->setOnPublicAddressChanged(cb); }

    /**
     * SecureDht to Dht proxy
     */
-    void shutdown(ShutdownCallback cb, bool stop = false) override {
-        dht_->shutdown(cb, stop);
-    }
-    void dumpTables() const override {
-        dht_->dumpTables();
-    }
+    void shutdown(ShutdownCallback cb, bool stop = false) override { dht_->shutdown(cb, stop); }
+    void dumpTables() const override { dht_->dumpTables(); }
    inline const InfoHash& getNodeId() const override { return dht_->getNodeId(); }

-    std::pair<size_t, size_t> getStoreSize() const override {
-        return dht_->getStoreSize();
-    }
-    std::string getStorageLog() const override {
-        return dht_->getStorageLog();
-    }
-    std::string getStorageLog(const InfoHash& h) const override {
-        return dht_->getStorageLog(h);
-    }
-    void setStorageLimit(size_t limit = DEFAULT_STORAGE_LIMIT) override {
-        dht_->setStorageLimit(limit);
-    }
-    size_t getStorageLimit() const override {
-        return dht_->getStorageLimit();
+    std::pair<size_t, size_t> getStoreSize() const override { return dht_->getStoreSize(); }
+    std::pair<size_t, size_t> getLocalStoreSize() const override { return dht_->getLocalStoreSize(); }
+    std::string getStorageLog() const override { return dht_->getStorageLog(); }
+    std::string getStorageLog(const InfoHash& h) const override { return dht_->getStorageLog(h); }
+    void setStorageLimit(size_t limit = 0) override { dht_->setStorageLimit(limit); }
+    size_t getStorageLimit() const override { return dht_->getStorageLimit(); }
+    void setLocalStorageLimit(size_t limit = 0) override { dht_->setLocalStorageLimit(limit); }
+    size_t getLocalStorageLimit() const override { return dht_->getLocalStorageLimit(); }
+
+    std::vector<NodeExport> exportNodes() const override { return dht_->exportNodes(); }
+    std::vector<ValuesExport> exportValues() const override { return dht_->exportValues(); }
+    void importValues(const std::vector<ValuesExport>& v) override { dht_->importValues(v); }
+    NodeStats getNodesStats(sa_family_t af) const override { return dht_->getNodesStats(af); }
+
+    NodeInfo getNodeInfo()
+    {
+        NodeInfo info;
+        info.id = getId();
+        info.node_id = getNodeId();
+        info.ipv4 = getNodesStats(AF_INET);
+        info.ipv6 = getNodesStats(AF_INET6);
+        std::tie(info.storage_size, info.storage_values) = getStoreSize();
+        std::tie(info.local_storage_size, info.local_storage_values) = getLocalStoreSize();
+        if (auto sock = getSocket()) {
+            info.bound4 = sock->getBoundRef(AF_INET).getPort();
+            info.bound6 = sock->getBoundRef(AF_INET6).getPort();
+        }
+        return info;
    }

-    std::vector<NodeExport> exportNodes() const override {
-        return dht_->exportNodes();
-    }
-    std::vector<ValuesExport> exportValues() const override {
-        return dht_->exportValues();
-    }
-    void importValues(const std::vector<ValuesExport>& v) override {
-        dht_->importValues(v);
-    }
-    NodeStats getNodesStats(sa_family_t af) const override {
-        return dht_->getNodesStats(af);
-    }
-    std::vector<unsigned> getNodeMessageStats(bool in = false) override {
-        return dht_->getNodeMessageStats(in);
-    }
-    std::string getRoutingTablesLog(sa_family_t af) const override {
-        return dht_->getRoutingTablesLog(af);
-    }
-    std::string getSearchesLog(sa_family_t af) const override {
-        return dht_->getSearchesLog(af);
-    }
-    std::string getSearchLog(const InfoHash& h, sa_family_t af = AF_UNSPEC) const override {
+    std::vector<unsigned> getNodeMessageStats(bool in = false) override { return dht_->getNodeMessageStats(in); }
+    std::string getRoutingTablesLog(sa_family_t af) const override { return dht_->getRoutingTablesLog(af); }
+    std::string getSearchesLog(sa_family_t af) const override { return dht_->getSearchesLog(af); }
+    std::string getSearchLog(const InfoHash& h, sa_family_t af = AF_UNSPEC) const override
+    {
        return dht_->getSearchLog(h, af);
    }
-    std::vector<SockAddr> getPublicAddress(sa_family_t family = 0) override {
-        return dht_->getPublicAddress(family);
-    }
-    time_point periodic(const uint8_t *buf, size_t buflen, SockAddr sa, const time_point& now) override {
+    std::vector<SockAddr> getPublicAddress(sa_family_t family = 0) override { return dht_->getPublicAddress(family); }
+    time_point periodic(const uint8_t* buf, size_t buflen, SockAddr sa, const time_point& now) override
+    {
        return dht_->periodic(buf, buflen, std::move(sa), now);
    }
-    time_point periodic(const uint8_t *buf, size_t buflen, const sockaddr* from, socklen_t fromlen, const time_point& now) override {
+    time_point periodic(
+        const uint8_t* buf, size_t buflen, const sockaddr* from, socklen_t fromlen, const time_point& now) override
+    {
        return dht_->periodic(buf, buflen, from, fromlen, now);
    }
-    NodeStatus updateStatus(sa_family_t af) override  {
-        return dht_->updateStatus(af);
-    }
-    NodeStatus getStatus(sa_family_t af) const override {
-        return dht_->getStatus(af);
-    }
-    NodeStatus getStatus() const override {
-        return dht_->getStatus();
-    }
-    net::DatagramSocket* getSocket() const override {
-        return dht_->getSocket();
-    };
-    bool isRunning(sa_family_t af = 0) const override {
-        return dht_->isRunning(af);
-    }
-    const ValueType& getType(ValueType::Id type_id) const override {
-        return dht_->getType(type_id);
-    }
-    void addBootstrap(const std::string& host, const std::string& service) override {
+    NodeStatus updateStatus(sa_family_t af) override { return dht_->updateStatus(af); }
+    NodeStatus getStatus(sa_family_t af) const override { return dht_->getStatus(af); }
+    NodeStatus getStatus() const override { return dht_->getStatus(); }
+    net::DatagramSocket* getSocket() const override { return dht_->getSocket(); };
+    bool isRunning(sa_family_t af = 0) const override { return dht_->isRunning(af); }
+    const ValueType& getType(ValueType::Id type_id) const override { return dht_->getType(type_id); }
+    void addBootstrap(const std::string& host, const std::string& service) override
+    {
        dht_->addBootstrap(host, service);
    }
-    void clearBootstrap() override {
-        dht_->clearBootstrap();
-    }
-    void insertNode(const InfoHash& id, const SockAddr& sa) override {
-        dht_->insertNode(id, sa);
-    }
-    void insertNode(const NodeExport& n) override {
-        dht_->insertNode(n);
-    }
-    void pingNode(SockAddr sa, DoneCallbackSimple&& cb={}) override {
-        dht_->pingNode(std::move(sa), std::move(cb));
-    }
-    void query(const InfoHash& key, QueryCallback cb, DoneCallback done_cb = {}, Query&& q = {}) override {
+    void clearBootstrap() override { dht_->clearBootstrap(); }
+    void insertNode(const InfoHash& id, const SockAddr& sa) override { dht_->insertNode(id, sa); }
+    void insertNode(const NodeExport& n) override { dht_->insertNode(n); }
+    void pingNode(SockAddr sa, DoneCallbackSimple&& cb = {}) override { dht_->pingNode(std::move(sa), std::move(cb)); }
+    void query(const InfoHash& key, QueryCallback cb, DoneCallback done_cb = {}, Query&& q = {}) override
+    {
        dht_->query(key, cb, done_cb, std::move(q));
    }
-    void query(const InfoHash& key, QueryCallback cb, DoneCallbackSimple done_cb = {}, Query&& q = {}) override {
+    void query(const InfoHash& key, QueryCallback cb, DoneCallbackSimple done_cb = {}, Query&& q = {}) override
+    {
        dht_->query(key, cb, done_cb, std::move(q));
    }
-    std::vector<Sp<Value>> getLocal(const InfoHash& key, const Value::Filter& f = {}) const override {
+    std::vector<Sp<Value>> getLocal(const InfoHash& key, const Value::Filter& f = {}) const override
+    {
        return dht_->getLocal(key, f);
    }
-    Sp<Value> getLocalById(const InfoHash& key, Value::Id vid) const override {
-        return dht_->getLocalById(key, vid);
-    }
+    Sp<Value> getLocalById(const InfoHash& key, Value::Id vid) const override { return dht_->getLocalById(key, vid); }
    void put(const InfoHash& key,
-            Sp<Value> v,
-            DoneCallback cb=nullptr,
-            time_point created=time_point::max(),
-            bool permanent = false) override
+             Sp<Value> v,
+             DoneCallback cb = nullptr,
+             time_point created = time_point::max(),
+             bool permanent = false) override
    {
        dht_->put(key, v, cb, created, permanent);
    }
    void put(const InfoHash& key,
-            const Sp<Value>& v,
-            DoneCallbackSimple cb,
-            time_point created=time_point::max(),
-            bool permanent = false) override
+             const Sp<Value>& v,
+             DoneCallbackSimple cb,
+             time_point created = time_point::max(),
+             bool permanent = false) override
    {
        dht_->put(key, v, cb, created, permanent);
    }

    void put(const InfoHash& key,
-            Value&& v,
-            DoneCallback cb=nullptr,
-            time_point created=time_point::max(),
-            bool permanent = false) override
+             Value&& v,
+             DoneCallback cb = nullptr,
+             time_point created = time_point::max(),
+             bool permanent = false) override
    {
        dht_->put(key, std::move(v), cb, created, permanent);
    }
    void put(const InfoHash& key,
-            Value&& v,
-            DoneCallbackSimple cb,
-            time_point created=time_point::max(),
-            bool permanent = false) override
+             Value&& v,
+             DoneCallbackSimple cb,
+             time_point created = time_point::max(),
+             bool permanent = false) override
    {
        dht_->put(key, std::move(v), cb, created, permanent);
    }
-    std::vector<Sp<Value>> getPut(const InfoHash& h) const override {
-        return dht_->getPut(h);
-    }
-    Sp<Value> getPut(const InfoHash& h, const Value::Id& vid) const override {
-        return dht_->getPut(h, vid);
-    }
-    bool cancelPut(const InfoHash& h, const Value::Id& vid) override {
-        return dht_->cancelPut(h, vid);
-    }
+    std::vector<Sp<Value>> getPut(const InfoHash& h) const override { return dht_->getPut(h); }
+    Sp<Value> getPut(const InfoHash& h, const Value::Id& vid) const override { return dht_->getPut(h, vid); }
+    bool cancelPut(const InfoHash& h, const Value::Id& vid) override { return dht_->cancelPut(h, vid); }

-    size_t listen(const InfoHash& key, ValueCallback, Value::Filter={}, Where={}) override;
+    size_t listen(const InfoHash& key, ValueCallback, Value::Filter = {}, Where = {}) override;
    size_t listen(const InfoHash& key, GetCallback cb, Value::Filter = {}, Where w = {}) override;
-    size_t listen(const InfoHash& key, GetCallbackSimple cb, Value::Filter f={}, Where w = {}) override {
+    size_t listen(const InfoHash& key, GetCallbackSimple cb, Value::Filter f = {}, Where w = {}) override
+    {
        return listen(key, bindGetCb(cb), f, w);
    }
-    bool cancelListen(const InfoHash& h, size_t token) override {
-        return dht_->cancelListen(h, token);
-    }
-    void connectivityChanged(sa_family_t af) override {
-        dht_->connectivityChanged(af);
-    }
-    void connectivityChanged() override {
-        dht_->connectivityChanged();
-    }
+    bool cancelListen(const InfoHash& h, size_t token) override { return dht_->cancelListen(h, token); }
+    void connectivityChanged(sa_family_t af) override { dht_->connectivityChanged(af); }
+    void connectivityChanged() override { dht_->connectivityChanged(); }

-    void forwardAllMessages(bool forward) {
-        forward_all_ = forward;
-    }
+    void forwardAllMessages(bool forward) { forward_all_ = forward; }

-    void setPushNotificationToken(const std::string& token = "") override {
-        dht_->setPushNotificationToken(token);
+    void setPushNotificationToken(const std::string& token = "") override { dht_->setPushNotificationToken(token); }
+    void setPushNotificationTopic(const std::string& topic) override { dht_->setPushNotificationTopic(topic); }
+    void setPushNotificationPlatform(const std::string& platform) override
+    {
+        dht_->setPushNotificationPlatform(platform);
    }

    /**
     * Call linked callback with push_notification
     * @param notification to process
     */
-    PushNotificationResult pushNotificationReceived(const std::map<std::string, std::string>& notification) override {
+    PushNotificationResult pushNotificationReceived(const std::map<std::string, std::string>& notification) override
+    {
        return dht_->pushNotificationReceived(notification);
    }

-    void setLogger(const Logger& logger) override {
-        DhtInterface::setLogger(logger);
-        dht_->setLogger(logger);
-    }
-
-    void setLogger(const std::shared_ptr<Logger>& logger) override {
+    void setLogger(const std::shared_ptr<Logger>& logger) override
+    {
        DhtInterface::setLogger(logger);
        dht_->setLogger(logger);
    }
@@ -359,7 +308,8 @@ public:
    /**
     * Only print logs related to the given InfoHash (if given), or disable filter (if zeroes).
     */
-    void setLogFilter(const InfoHash& f) override {
+    void setLogFilter(const InfoHash& f) override
+    {
        DhtInterface::setLogFilter(f);
        dht_->setLogFilter(f);
    }
@@ -382,35 +332,36 @@ private:

    // method to query the local certificate store
    CertificateStoreQuery localQueryMethod_ {};
-    CertificateStoreQueryLegacy localQueryMethodLegacy_ {};

    // our certificate cache
-    std::map<InfoHash, Sp<crypto::Certificate>> nodesCertificates_ {};
-    std::map<InfoHash, Sp<crypto::PublicKey>> nodesPubKeys_ {};
-    std::map<PkId, Sp<crypto::Certificate>> nodesCertificatesLong_ {};
-    std::map<PkId, Sp<crypto::PublicKey>> nodesPubKeysLong_ {};
+    std::map<PkId, Sp<crypto::Certificate>> nodesCertificates_ {};
+    std::map<PkId, Sp<crypto::PublicKey>> nodesPubKeys_ {};

    std::atomic_bool forward_all_ {false};
    bool enableCache_ {false};
 };

-const ValueType CERTIFICATE_TYPE = {
-    8, "Certificate", std::chrono::hours(24 * 7),
-    // A certificate can only be stored at its public key ID.
-    [](InfoHash id, Sp<Value>& v, const InfoHash&, const SockAddr&) {
-        try {
-            crypto::Certificate crt(v->data);
-            // TODO check certificate signature
-            return crt.getPublicKey().getId() == id || InfoHash::get(crt.getPublicKey().getLongId()) == id;
-        } catch (const std::exception& e) {}
-        return false;
-    },
-    [](InfoHash, const Sp<Value>& o, Sp<Value>& n, const InfoHash&, const SockAddr&) {
-        try {
-            return crypto::Certificate(o->data).getPublicKey().getLongId() == crypto::Certificate(n->data).getPublicKey().getLongId();
-        } catch (const std::exception& e) {}
-        return false;
-    }
-};
+const ValueType CERTIFICATE_TYPE = {8,
+                                    "Certificate",
+                                    std::chrono::hours(24 * 7),
+                                    // A certificate can only be stored at its public key ID.
+                                    [](InfoHash id, Sp<Value>& v, const InfoHash&, const SockAddr&) {
+                                        try {
+                                            crypto::Certificate crt(v->data);
+                                            // TODO check certificate signature
+                                            return crt.getPublicKey().getId() == id
+                                                   || InfoHash::get(crt.getPublicKey().getLongId()) == id;
+                                        } catch (const std::exception& e) {
+                                        }
+                                        return false;
+                                    },
+                                    [](InfoHash, const Sp<Value>& o, Sp<Value>& n, const InfoHash&, const SockAddr&) {
+                                        try {
+                                            return crypto::Certificate(o->data).getPublicKey().getLongId()
+                                                   == crypto::Certificate(n->data).getPublicKey().getLongId();
+                                        } catch (const std::exception& e) {
+                                        }
+                                        return false;
+                                    }};

-}
+} // namespace dht
@@ -1,21 +1,5 @@
-/*
- *  Copyright (C) 2014-2025 Savoir-faire Linux Inc.
- *  Author : Adrien Béraud <adrien.beraud@savoirfairelinux.com>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 3 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program. If not, see <https://www.gnu.org/licenses/>.
- */
-
+// Copyright (c) 2014-2026 Savoir-faire Linux Inc.
+// SPDX-License-Identifier: MIT
 #pragma once

 #include "def.h"
@@ -59,30 +43,34 @@ OPENDHT_PUBLIC std::string print_addr(const sockaddr_storage& ss, socklen_t ssle
 /**
 * A Socket Address (sockaddr*), with abstraction for IPv4, IPv6 address families.
 */
-class OPENDHT_PUBLIC SockAddr {
+class OPENDHT_PUBLIC SockAddr
+{
 public:
    SockAddr() {}
-    SockAddr(const SockAddr& o) {
-        set(o.get(), o.getLength());
-    }
-    SockAddr(SockAddr&& o) noexcept : addr(std::move(o.addr)), len(o.len) {
+    SockAddr(const SockAddr& o) { set(o.get(), o.getLength()); }
+    SockAddr(SockAddr&& o) noexcept
+        : addr(std::move(o.addr))
+        , len(o.len)
+    {
        o.len = 0;
    }

    /**
     * Build from existing address.
     */
-    SockAddr(const sockaddr* sa, socklen_t length) {
+    SockAddr(const sockaddr* sa, socklen_t length)
+    {
        if (length > static_cast<socklen_t>(sizeof(sockaddr_storage)))
            throw std::runtime_error("Socket address length is too large");
        set(sa, length);
    }
-    SockAddr(const sockaddr* sa) {
+    SockAddr(const sockaddr* sa)
+    {
        socklen_t len = 0;
        if (sa) {
            if (sa->sa_family == AF_INET)
                len = sizeof(sockaddr_in);
-            else if(sa->sa_family == AF_INET6)
+            else if (sa->sa_family == AF_INET6)
                len = sizeof(sockaddr_in6);
            else
                throw std::runtime_error("Unknown address family");
@@ -93,34 +81,40 @@ public:
    /**
     * Build from an existing sockaddr_storage structure.
     */
-    SockAddr(const sockaddr_storage& ss, socklen_t len) : SockAddr((const sockaddr*)&ss, len) {}
+    SockAddr(const sockaddr_storage& ss, socklen_t len)
+        : SockAddr((const sockaddr*) &ss, len)
+    {}

    static std::vector<SockAddr> resolve(const std::string& host, const std::string& service = {});

-    bool operator<(const SockAddr& o) const {
+    bool operator<(const SockAddr& o) const
+    {
        if (len != o.len)
            return len < o.len;
-        return std::memcmp((const uint8_t*)get(), (const uint8_t*)o.get(), len) < 0;
+        return std::memcmp((const uint8_t*) get(), (const uint8_t*) o.get(), len) < 0;
    }

-    bool equals(const SockAddr& o) const {
-        return len == o.len
-            && std::memcmp((const uint8_t*)get(), (const uint8_t*)o.get(), len) == 0;
+    bool equals(const SockAddr& o) const
+    {
+        return len == o.len && std::memcmp((const uint8_t*) get(), (const uint8_t*) o.get(), len) == 0;
    }
-    SockAddr& operator=(const SockAddr& o) {
+    bool operator==(const SockAddr& o) const { return equals(o); }
+    bool operator!=(const SockAddr& o) const { return !equals(o); }
+
+    SockAddr& operator=(const SockAddr& o)
+    {
        set(o.get(), o.getLength());
        return *this;
    }
-    SockAddr& operator=(SockAddr&& o) {
+    SockAddr& operator=(SockAddr&& o)
+    {
        len = o.len;
        o.len = 0;
        addr = std::move(o.addr);
        return *this;
    }

-    std::string toString() const {
-        return print_addr(get(), getLength());
-    }
+    std::string toString() const { return print_addr(get(), getLength()); }

    /**
     * Returns the address family or AF_UNSPEC if the address is not set.
@@ -132,9 +126,10 @@ public:
     * in which case the sockaddr structure is cleared to zero,
     * and set the address family field (sa_family).
     */
-    void setFamily(sa_family_t af) {
+    void setFamily(sa_family_t af)
+    {
        socklen_t new_length;
-        switch(af) {
+        switch (af) {
        case AF_INET:
            new_length = sizeof(sockaddr_in);
            break;
@@ -146,8 +141,10 @@ public:
        }
        if (new_length != len) {
            len = new_length;
-            if (len) addr.reset((sockaddr*)::calloc(len, 1));
-            else     addr.reset();
+            if (len)
+                addr.reset((sockaddr*) ::calloc(len, 1));
+            else
+                addr.reset();
        }
        if (len)
            addr->sa_family = af;
@@ -156,9 +153,10 @@ public:
    /**
     * Set address to any
     */
-    void setAny() {
+    void setAny()
+    {
        auto family = getFamily();
-        switch(family) {
+        switch (family) {
        case AF_INET:
            getIPv4().sin_addr.s_addr = htonl(INADDR_ANY);
            break;
@@ -171,9 +169,10 @@ public:
    /**
     * Set address to loopback.
     */
-    void setLoopback() {
+    void setLoopback()
+    {
        auto family = getFamily();
-        switch(family) {
+        switch (family) {
        case AF_INET:
            getIPv4().sin_addr.s_addr = htonl(INADDR_LOOPBACK);
            break;
@@ -187,8 +186,9 @@ public:
     * Retreive the port (in host byte order) or 0 if the address is not
     * of a supported family.
     */
-    in_port_t getPort() const {
-        switch(getFamily()) {
+    in_port_t getPort() const
+    {
+        switch (getFamily()) {
        case AF_INET:
            return ntohs(getIPv4().sin_port);
        case AF_INET6:
@@ -201,8 +201,9 @@ public:
     * Set the port. The address must be of a supported family.
     * @param p The port in host byte order.
     */
-    void setPort(in_port_t p) {
-        switch(getFamily()) {
+    void setPort(in_port_t p)
+    {
+        switch (getFamily()) {
        case AF_INET:
            getIPv4().sin_port = htons(p);
            break;
@@ -227,9 +228,7 @@ public:
    /**
     * An address is defined to be true if its length is not zero.
     */
-    explicit operator bool() const noexcept {
-        return len;
-    }
+    explicit operator bool() const noexcept { return len; }

    /**
     * Returns the address to the managed sockaddr structure.
@@ -243,24 +242,17 @@ public:
     */
    sockaddr* get() { return addr.get(); }

-    inline const sockaddr_in& getIPv4() const {
-        return *reinterpret_cast<const sockaddr_in*>(get());
-    }
-    inline const sockaddr_in6& getIPv6() const {
-        return *reinterpret_cast<const sockaddr_in6*>(get());
-    }
-    inline sockaddr_in& getIPv4() {
-        return *reinterpret_cast<sockaddr_in*>(get());
-    }
-    inline sockaddr_in6& getIPv6() {
-        return *reinterpret_cast<sockaddr_in6*>(get());
-    }
+    inline const sockaddr_in& getIPv4() const { return *reinterpret_cast<const sockaddr_in*>(get()); }
+    inline const sockaddr_in6& getIPv6() const { return *reinterpret_cast<const sockaddr_in6*>(get()); }
+    inline sockaddr_in& getIPv4() { return *reinterpret_cast<sockaddr_in*>(get()); }
+    inline sockaddr_in6& getIPv6() { return *reinterpret_cast<sockaddr_in6*>(get()); }

-    /** 
+    /**
     * Releases the ownership of the managed object, if any.
     * The caller is responsible for deleting the object with free().
     */
-    inline sockaddr* release() {
+    inline sockaddr* release()
+    {
        len = 0;
        return addr.release();
    }
@@ -285,56 +277,63 @@ public:
     * A comparator to classify IP addresses, only considering the
     * first 64 bits in IPv6.
     */
-    struct ipCmp {
-        bool operator()(const SockAddr& a, const SockAddr& b) const {
+    struct ipCmp
+    {
+        bool operator()(const SockAddr& a, const SockAddr& b) const
+        {
            if (a.len != b.len)
                return a.len < b.len;
            socklen_t start, len;
-            switch(a.getFamily()) {
-                case AF_INET:
-                    start = offsetof(sockaddr_in, sin_addr);
-                    len = sizeof(in_addr);
-                    break;
-                case AF_INET6:
-                    start = offsetof(sockaddr_in6, sin6_addr);
-                    // don't consider more than 64 bits (IPv6)
-                    len = 8;
-                    break;
-                default:
-                    start = 0;
-                    len = a.len;
-                    break;
+            switch (a.getFamily()) {
+            case AF_INET:
+                start = offsetof(sockaddr_in, sin_addr);
+                len = sizeof(in_addr);
+                break;
+            case AF_INET6:
+                start = offsetof(sockaddr_in6, sin6_addr);
+                // don't consider more than 64 bits (IPv6)
+                len = 8;
+                break;
+            default:
+                start = 0;
+                len = a.len;
+                break;
            }
-            return std::memcmp((uint8_t*)a.get()+start,
-                               (uint8_t*)b.get()+start, len) < 0;
+            return std::memcmp((uint8_t*) a.get() + start, (uint8_t*) b.get() + start, len) < 0;
        }
    };
-    friend std::ostream& operator<< (std::ostream& s, const SockAddr& h) {
+    friend std::ostream& operator<<(std::ostream& s, const SockAddr& h)
+    {
        print_addr(s, h.get(), h.getLength());
        return s;
    }

 private:
-    struct free_delete { void operator()(void* p) { ::free(p); } };
+    struct free_delete
+    {
+        void operator()(void* p) { ::free(p); }
+    };
    std::unique_ptr<sockaddr, free_delete> addr {};
    socklen_t len {0};

-    void set(const sockaddr* sa, socklen_t length) {
+    void set(const sockaddr* sa, socklen_t length)
+    {
        if (len != length) {
            len = length;
-            if (len) addr.reset((sockaddr*)::malloc(len));
-            else     addr.reset();
+            if (len)
+                addr.reset((sockaddr*) ::malloc(len));
+            else
+                addr.reset();
        }
        if (len)
-            std::memcpy((uint8_t*)get(), (const uint8_t*)sa, len);
+            std::memcpy((uint8_t*) get(), (const uint8_t*) sa, len);
    }
-
 };

-OPENDHT_PUBLIC bool operator==(const SockAddr& a, const SockAddr& b);
-
-}
+} // namespace dht

 #if FMT_VERSION >= 90000
-template <> struct fmt::formatter<dht::SockAddr> : ostream_formatter {};
+template<>
+struct fmt::formatter<dht::SockAddr> : ostream_formatter
+{};
 #endif
@@ -1,22 +1,5 @@
-/*
- *  Copyright (C) 2014-2025 Savoir-faire Linux Inc.
- *
- *  Author: Adrien Béraud <adrien.beraud@savoirfairelinux.com>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 3 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program. If not, see <http://www.gnu.org/licenses/>.
- */
-
+// Copyright (c) 2014-2026 Savoir-faire Linux Inc.
+// SPDX-License-Identifier: MIT
 #pragma once

 #include "def.h"
@@ -27,11 +10,14 @@
 #include <future>
 #include <functional>

-#include <ciso646> // fix windows compiler bug
+#if __cplusplus < 202002L
+#include <ciso646>
+#endif

 namespace dht {

-class OPENDHT_PUBLIC ThreadPool {
+class OPENDHT_PUBLIC ThreadPool
+{
 public:
    static ThreadPool& computation();
    static ThreadPool& io();
@@ -43,7 +29,8 @@ public:
    void run(std::function<void()>&& cb);

    template<class T>
-    std::future<T> get(std::function<T()>&& cb) {
+    std::future<T> get(std::function<T()>&& cb)
+    {
        auto ret = std::make_shared<std::promise<T>>();
        run([cb = std::move(cb), ret]() mutable {
            try {
@@ -51,13 +38,15 @@ public:
            } catch (...) {
                try {
                    ret->set_exception(std::current_exception());
-                } catch(...) {}
+                } catch (...) {
+                }
            }
        });
        return ret->get_future();
    }
    template<class T>
-    std::shared_future<T> getShared(std::function<T()>&& cb) {
+    std::shared_future<T> getShared(std::function<T()>&& cb)
+    {
        return get(std::move(cb));
    }

@@ -66,12 +55,14 @@ public:
    void detach();

 private:
-    std::mutex lock_ {};
+    std::mutex lock_;
    std::condition_variable cv_ {};
+    std::condition_variable stopCv_ {};
    std::queue<std::function<void()>> tasks_ {};
    std::vector<std::unique_ptr<std::thread>> threads_;
    unsigned readyThreads_ {0};
    bool running_ {true};
+    bool stopping_ {false};

    unsigned minThreads_;
    const unsigned maxThreads_;
@@ -81,10 +72,12 @@ private:
    void threadEnded(std::thread&);
 };

-class OPENDHT_PUBLIC Executor : public std::enable_shared_from_this<Executor> {
+class OPENDHT_PUBLIC Executor : public std::enable_shared_from_this<Executor>
+{
 public:
    Executor(ThreadPool& pool, unsigned maxConcurrent = 1)
-     : threadPool_(pool), maxConcurrent_(maxConcurrent)
+        : threadPool_(pool)
+        , maxConcurrent_(maxConcurrent)
    {}

    void run(std::function<void()>&& task);
@@ -92,7 +85,7 @@ public:
 private:
    std::reference_wrapper<ThreadPool> threadPool_;
    const unsigned maxConcurrent_ {1};
-    std::mutex lock_ {};
+    std::mutex lock_;
    unsigned current_ {0};
    std::queue<std::function<void()>> tasks_ {};

@@ -100,33 +93,32 @@ private:
    void schedule();
 };

-class OPENDHT_PUBLIC ExecutionContext {
+class OPENDHT_PUBLIC ExecutionContext
+{
 public:
    ExecutionContext(ThreadPool& pool)
-     : threadPool_(pool), state_(std::make_shared<SharedState>())
+        : threadPool_(pool)
+        , state_(std::make_shared<SharedState>())
    {}

-    ~ExecutionContext() {
-        state_->destroy();
-    }
+    ~ExecutionContext() { state_->destroy(); }

    /** Wait for ongoing tasks to complete execution and drop other pending tasks */
-    void stop() {
-        state_->destroy(false);
-    }
+    void stop() { state_->destroy(false); }

-    void run(std::function<void()>&& task) {
-        std::lock_guard<std::mutex> lock(state_->mtx);
-        if (state_->shutdown_) return;
+    void run(std::function<void()>&& task)
+    {
+        std::lock_guard lock(state_->mtx);
+        if (state_->shutdown_)
+            return;
        state_->pendingTasks++;
-        threadPool_.get().run([task = std::move(task), state = state_] {
-            state->run(task);
-        });
+        threadPool_.get().run([task = std::move(task), state = state_] { state->run(task); });
    }

 private:
-    struct SharedState {
-        std::mutex mtx {};
+    struct SharedState
+    {
+        std::mutex mtx;
        std::condition_variable cv {};
        unsigned pendingTasks {0};
        unsigned ongoingTasks {0};
@@ -135,9 +127,11 @@ private:
        /** When true, prevents scheduled tasks to be executed */
        std::atomic_bool destroyed {false};

-        void destroy(bool wait = true) {
-            std::unique_lock<std::mutex> lock(mtx);
-            if (destroyed) return;
+        void destroy(bool wait = true)
+        {
+            std::unique_lock lock(mtx);
+            if (destroyed)
+                return;
            if (wait) {
                cv.wait(lock, [this] { return pendingTasks == 0 && ongoingTasks == 0; });
            }
@@ -148,16 +142,18 @@ private:
            destroyed = true;
        }

-        void run(const std::function<void()>& task) {
+        void run(const std::function<void()>& task)
+        {
            {
-                std::lock_guard<std::mutex> lock(mtx);
+                std::lock_guard lock(mtx);
                pendingTasks--;
                ongoingTasks++;
            }
-                if (destroyed) return;
-                task();
+            if (destroyed)
+                return;
+            task();
            {
-                std::lock_guard<std::mutex> lock(mtx);
+                std::lock_guard lock(mtx);
                ongoingTasks--;
                cv.notify_all();
            }
@@ -167,4 +163,4 @@ private:
    std::shared_ptr<SharedState> state_;
 };

-}
+} // namespace dht
@@ -1,21 +1,5 @@
-/*
- *  Copyright (C) 2014-2025 Savoir-faire Linux Inc.
- *  Author : Adrien Béraud <adrien.beraud@savoirfairelinux.com>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 3 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program. If not, see <https://www.gnu.org/licenses/>.
- */
-
+// Copyright (c) 2014-2026 Savoir-faire Linux Inc.
+// SPDX-License-Identifier: MIT
 #pragma once

 #include "def.h"
@@ -101,8 +85,16 @@ using system_clock = std::chrono::system_clock;
 using time_point = clock::time_point;
 using duration = clock::duration;

-time_point from_time_t(std::time_t t);
-std::time_t to_time_t(time_point t);
+OPENDHT_PUBLIC time_point from_system_time(system_clock::time_point t,
+                                           time_point steady_now,
+                                           system_clock::time_point system_now);
+OPENDHT_PUBLIC time_point from_system_time(system_clock::time_point t);
+OPENDHT_PUBLIC system_clock::time_point to_system_time(time_point t,
+                                                       time_point steady_now,
+                                                       system_clock::time_point system_now);
+OPENDHT_PUBLIC system_clock::time_point to_system_time(time_point t);
+OPENDHT_PUBLIC time_point from_time_t(std::time_t t);
+OPENDHT_PUBLIC std::time_t to_time_t(time_point t);

 template<class DT>
 static std::string
@@ -134,13 +126,16 @@ template<class TimePoint>
 static std::string
 print_time_relative(TimePoint now, TimePoint d)
 {
+    using namespace std::literals;
    if (d == TimePoint::min())
-        return "never";
+        return "never"s;
    if (d == now)
-        return "now";
-    return (d > now) ? std::string("in ") + print_duration(d - now) : print_duration(now - d) + std::string(" ago");
+        return "now"s;
+    return (d > now) ? concat("in "sv, print_duration(d - now)) : concat(print_duration(now - d), " ago"sv);
 }

+OPENDHT_PUBLIC std::string printByteCount(size_t bytes);
+
 template<typename Duration = duration>
 class uniform_duration_distribution : public std::uniform_int_distribution<typename Duration::rep>
 {
@@ -187,15 +182,19 @@ packMsg(const Type& t)

 template<typename Type>
 Type
-unpackMsg(Blob b)
+unpackMsg(const Blob& b)
 {
    msgpack::unpacked msg_res = msgpack::unpack((const char*) b.data(), b.size());
    return msg_res.get().as<Type>();
 }

-msgpack::unpacked unpackMsg(Blob b);
+inline msgpack::unpacked
+unpackMsg(const Blob& b)
+{
+    return msgpack::unpack((const char*) b.data(), b.size());
+}

-msgpack::object* findMapValue(const msgpack::object& map, const char* key, size_t length);
+OPENDHT_PUBLIC msgpack::object* findMapValue(const msgpack::object& map, const char* key, size_t length);

 inline msgpack::object*
 findMapValue(const msgpack::object& map, const char* key)
@@ -3,9 +3,11 @@ project(
    'c',
    'cpp',
    'cython',
-    version: '3.6.2',
+    license: 'MIT',
+    license_files: 'LICENSE',
+    version: '4.5.0-rc.1',
    meson_version: '>=1.1.0',
-    default_options: ['cpp_std=c++17', 'warning_level=3'],
+    default_options: ['cpp_std=c++20', 'warning_level=3'],
 )

 gnutls = dependency('gnutls')
@@ -13,10 +15,23 @@ nettle = dependency('nettle')
 msgpack = dependency('msgpack-cxx', required: false)
 argon2 = dependency('libargon2')
 fmt = dependency('fmt')
-openssl = dependency('openssl', required: get_option('proxy_client'))
-jsoncpp = dependency('jsoncpp', required: get_option('proxy_client'))
-llhttp = dependency('llhttp', 'libllhttp', required: get_option('proxy_client'))
-simdutf = dependency('simdutf', required: get_option('proxy_client'))
+
+proxy_enabled = get_option('proxy_client').enabled() or get_option('proxy_server').enabled()
+
+openssl = dependency('openssl', required: proxy_enabled)
+jsoncpp = dependency('jsoncpp', required: proxy_enabled)
+llhttp = dependency('llhttp', 'libllhttp', required: proxy_enabled)
+simdutf = dependency('simdutf', required: proxy_enabled)
+
+# restinio is a header-only library that may not ship a pkg-config file
+restinio_dep = dependency('restinio', required: false)
+if not restinio_dep.found()
+    cpp = meson.get_compiler('cpp')
+    if cpp.has_header('restinio/all.hpp', required: proxy_enabled)
+        restinio_dep = declare_dependency()
+    endif
+endif
+
 io_uring = host_machine.system() == 'linux' ? dependency('liburing', required: false) : disabler()

 deps = [
@@ -31,12 +46,21 @@ deps = [
    llhttp,
 ]

+if restinio_dep.found()
+    deps += restinio_dep
+endif
+
 if host_machine.system() == 'linux' and io_uring.found()
    deps += io_uring
 endif
 conf_data = configuration_data()

-add_project_arguments('-DMSGPACK_NO_BOOST', '-DASIO_STANDALONE', language: 'cpp')
+add_project_arguments(
+    '-DMSGPACK_NO_BOOST',
+    '-DASIO_STANDALONE',
+    '-DPACKAGE_VERSION="' + meson.project_version() + '"',
+    language: 'cpp',
+)
 if io_uring.found()
    add_project_arguments('-DASIO_HAS_IO_URING', '-DASIO_DISABLE_EPOLL', language: 'cpp')
    conf_data.set('iouring_lib', ', liburing')
@@ -77,7 +101,7 @@ if get_option('indexation').enabled()
    opendht_src += 'src/indexation/pht.cpp'
    add_project_arguments('-DOPENDHT_INDEXATION', language: 'cpp')
 endif
-if jsoncpp.found()
+if jsoncpp.found() and simdutf.found()
    opendht_src += ['src/base64.cpp']
    add_project_arguments('-DOPENDHT_JSONCPP', language: 'cpp')
    conf_data.set('jsoncpp_lib', ', jsoncpp')
@@ -116,6 +140,20 @@ opendht = library(
    install: true,
 )

+opendht_dep_args = []
+if get_option('default_library') != 'static'
+    opendht_dep_args += '-Dopendht_EXPORTS'
+endif
+
+opendht_dep = declare_dependency(
+    link_with: opendht,
+    include_directories: opendht_interface_inc,
+    compile_args: opendht_dep_args,
+)
+
+# Install library headers.
+install_subdir('include', install_dir: get_option('includedir'), strip_directory: true)
+
 conf_data.set('VERSION', meson.project_version())
 conf_data.set('prefix', get_option('prefix'))
 conf_data.set('exec_prefix', get_option('prefix'))
@@ -123,6 +161,13 @@ conf_data.set('libdir', join_paths(get_option('prefix'), get_option('libdir')))
 conf_data.set('includedir', join_paths(get_option('prefix'), get_option('includedir')))
 conf_data.set('argon2_lib', ', libargon2')
 conf_data.set('simdutf_lib', ', simdutf')
+conf_data.set('opendht_public_cflags', '')
+conf_data.set('opendht_c_public_cflags', '')
+
+if get_option('default_library') != 'static'
+    conf_data.set('opendht_public_cflags', ' -Dopendht_EXPORTS')
+    conf_data.set('opendht_c_public_cflags', ' -Dopendht_c_EXPORTS')
+endif

 configure_file(
    input: 'opendht.pc.in',
@@ -138,13 +183,13 @@ if get_option('c').enabled()
    opendht_c = library(
        'opendht-c',
        ['c/opendht.cpp', 'c/opendht_c.h'],
-        include_directories: opendht_interface_inc,
-        link_with: opendht,
-        dependencies: [msgpack, jsoncpp, fmt],
+        dependencies: [opendht_dep, msgpack, jsoncpp, fmt],
        cpp_args: ['-DOPENDHT_C_BUILD', '-Dopendht_c_EXPORTS'],
        install: true,
    )

+    install_headers('c/opendht_c.h', subdir: 'opendht')
+
    configure_file(
        input: 'opendht-c.pc.in',
        output: 'opendht-c.pc',
@@ -169,117 +214,154 @@ if get_option('python').require(
    get_option('indexation').enabled(),
    error_message: 'python requires indexation',
 ).allowed()
-    py = import('python').find_installation()
+    py = import('python').find_installation(pure: false)
    dep_py = py.dependency()
    py.extension_module(
-        'opendht',
+        '_core',
        'python/opendht.pyx',
-        include_directories: opendht_interface_inc,
+        subdir: 'opendht',
+        cython_args: ['--module-name', 'opendht._core'],
        override_options: ['cython_language=cpp'],
-        link_with: [opendht],
-        dependencies: [msgpack, jsoncpp, fmt, dep_py],
+        dependencies: [opendht_dep, msgpack, jsoncpp, fmt, dep_py],
        install: true,
    )
+    py.install_sources(
+        'python/opendht/__init__.py',
+        'python/opendht/aio.py',
+        subdir: 'opendht',
+    )
 endif

 if get_option('tools').enabled()
    dhtnode = executable(
        'dhtnode',
        'tools/dhtnode.cpp',
-        include_directories: opendht_interface_inc,
-        link_with: opendht,
-        dependencies: [readline, jsoncpp, msgpack, fmt, openssl],
+        dependencies: [opendht_dep, readline, jsoncpp, msgpack, fmt, openssl],
        install: true,
    )
    dhtchat = executable(
        'dhtchat',
        'tools/dhtchat.cpp',
-        include_directories: opendht_interface_inc,
-        link_with: opendht,
-        dependencies: [readline, jsoncpp, msgpack, fmt, openssl],
+        dependencies: [opendht_dep, readline, jsoncpp, msgpack, fmt, openssl],
        install: true,
    )
    dhtscanner = executable(
        'dhtscanner',
        'tools/dhtscanner.cpp',
-        include_directories: opendht_interface_inc,
-        link_with: opendht,
-        dependencies: [readline, jsoncpp, msgpack, fmt, openssl],
+        dependencies: [opendht_dep, readline, jsoncpp, msgpack, fmt, openssl],
        install: true,
    )
    if llhttp.found()
+        durl_deps = [msgpack, openssl]
+
+        if io_uring.found()
+            durl_deps += io_uring
+        endif
+
        durl = executable(
            'durl',
            'tools/durl.cpp',
-            include_directories: opendht_interface_inc,
-            link_with: opendht,
-            dependencies: [msgpack, openssl],
+            dependencies: [opendht_dep] + durl_deps,
        )
    endif
 endif

 # Unit tests
 if get_option('tests').enabled()
+    if get_option('c').enabled()
+        test_c = executable(
+            'test_c',
+            'tests/test_c.c',
+            include_directories: ['c', opendht_interface_inc],
+            dependencies: [gnutls],
+            link_with: opendht_c,
+        )
+        test('CBindings', test_c)
+    endif
    cppunit = dependency('cppunit')

    test_infohash = executable(
        'test_infohash',
-        'tests/infohashtester.cpp',
+        'tests/test_infohash.cpp',
        'tests/tests_runner.cpp',
-        include_directories: opendht_interface_inc,
-        link_with: opendht,
-        dependencies: [cppunit, jsoncpp, fmt, openssl, msgpack],
+        dependencies: [opendht_dep, cppunit, jsoncpp, fmt, openssl, msgpack],
    )
    test('Infohash', test_infohash)

    test_value = executable(
        'test_value',
-        'tests/valuetester.cpp',
+        'tests/test_value.cpp',
        'tests/tests_runner.cpp',
-        include_directories: opendht_interface_inc,
-        link_with: opendht,
-        dependencies: [cppunit, jsoncpp, fmt, openssl, msgpack],
+        dependencies: [opendht_dep, cppunit, jsoncpp, fmt, openssl, msgpack],
    )
    test('Value', test_value)

+    test_parsedmessage = executable(
+        'test_parsedmessage',
+        'tests/test_parsedmessage.cpp',
+        'tests/tests_runner.cpp',
+        include_directories: opendht_inc,
+        dependencies: [opendht_dep, cppunit, jsoncpp, fmt, openssl, msgpack],
+    )
+    test('ParsedMessage', test_parsedmessage)
+
+    test_networkengine = executable(
+        'test_networkengine',
+        'tests/test_networkengine.cpp',
+        'tests/tests_runner.cpp',
+        include_directories: opendht_inc,
+        dependencies: [opendht_dep, cppunit, jsoncpp, fmt, openssl, msgpack],
+    )
+    test('NetworkEngine', test_networkengine)
+
+    test_opcache = executable(
+        'test_opcache',
+        'tests/test_opcache.cpp',
+        'tests/tests_runner.cpp',
+        include_directories: opendht_inc,
+        dependencies: [opendht_dep, cppunit, jsoncpp, fmt, openssl, msgpack],
+    )
+    test('OpCache', test_opcache)
+
+    test_valuecache = executable(
+        'test_valuecache',
+        'tests/test_valuecache.cpp',
+        'tests/tests_runner.cpp',
+        include_directories: opendht_inc,
+        dependencies: [opendht_dep, cppunit, jsoncpp, fmt, openssl, msgpack],
+    )
+    test('ValueCache', test_valuecache)
+
    test_crypto = executable(
        'test_crypto',
-        'tests/cryptotester.cpp',
+        'tests/test_crypto.cpp',
        'tests/tests_runner.cpp',
-        include_directories: opendht_interface_inc,
-        link_with: opendht,
-        dependencies: [cppunit, jsoncpp, fmt, openssl, msgpack, gnutls],
+        dependencies: [opendht_dep, cppunit, jsoncpp, fmt, openssl, msgpack, gnutls],
    )
-    test('Crypto', test_crypto)
+    test('Crypto', test_crypto, timeout: 60)

    test_dhtrunner = executable(
        'test_dhtrunner',
-        'tests/dhtrunnertester.cpp',
+        'tests/test_dhtrunner.cpp',
        'tests/tests_runner.cpp',
-        include_directories: opendht_interface_inc,
-        link_with: opendht,
-        dependencies: [cppunit, jsoncpp, fmt, openssl, msgpack],
+        dependencies: [opendht_dep, cppunit, jsoncpp, fmt, openssl, msgpack],
    )
-    test('DhtRunner', test_dhtrunner)
+    test('DhtRunner', test_dhtrunner, timeout: 60)

    test_threadpool = executable(
        'test_threadpool',
-        'tests/threadpooltester.cpp',
+        'tests/test_threadpool.cpp',
        'tests/tests_runner.cpp',
-        include_directories: opendht_interface_inc,
-        link_with: opendht,
-        dependencies: [cppunit, jsoncpp, fmt, openssl, msgpack],
+        dependencies: [opendht_dep, cppunit, jsoncpp, fmt, openssl, msgpack],
    )
    test('ThreadPool', test_threadpool)

    if get_option('proxy_client').enabled() or get_option('proxy_server').enabled()
        test_http = executable(
            'test_http',
-            'tests/httptester.cpp',
+            'tests/test_http.cpp',
            'tests/tests_runner.cpp',
-            include_directories: opendht_interface_inc,
-            link_with: opendht,
-            dependencies: [cppunit, jsoncpp, fmt, openssl, msgpack],
+            dependencies: [opendht_dep, cppunit, jsoncpp, fmt, openssl, msgpack],
        )
        test('Http', test_http)
    endif
@@ -287,11 +369,9 @@ if get_option('tests').enabled()
    if get_option('peer_discovery').enabled()
        test_peerdiscovery = executable(
            'test_peerdiscovery',
-            'tests/peerdiscoverytester.cpp',
+            'tests/test_peerdiscovery.cpp',
            'tests/tests_runner.cpp',
-            include_directories: opendht_interface_inc,
-            link_with: opendht,
-            dependencies: [cppunit, jsoncpp, fmt, openssl, msgpack],
+            dependencies: [opendht_dep, cppunit, jsoncpp, fmt, openssl, msgpack],
        )
        test('PeerDiscovery', test_peerdiscovery)
    endif
@@ -299,11 +379,9 @@ if get_option('tests').enabled()
    if get_option('proxy_server').enabled()
        test_proxy = executable(
            'test_dhtproxy',
-            'tests/dhtproxytester.cpp',
+            'tests/test_dhtproxy.cpp',
            'tests/tests_runner.cpp',
-            include_directories: opendht_interface_inc,
-            link_with: opendht,
-            dependencies: [cppunit, jsoncpp, fmt, openssl, msgpack],
+            dependencies: [opendht_dep, cppunit, jsoncpp, fmt, openssl, msgpack],
        )
        test('DhtProxy', test_proxy)

@@ -312,9 +390,7 @@ if get_option('tests').enabled()
                'test_dhtproxystress',
                'tests/dhtproxy_stress_tester.cpp',
                'tests/tests_runner.cpp',
-                include_directories: opendht_interface_inc,
-                link_with: opendht,
-                dependencies: [cppunit, jsoncpp, fmt, openssl, msgpack],
+                dependencies: [opendht_dep, cppunit, jsoncpp, fmt, openssl, msgpack],
            )
            test('DhtProxy Stress', test_proxystress)
        endif
@@ -0,0 +1,5 @@
+node_modules/
+build*/
+prebuilds/
+dist/
+examples/dhtnode.js
@@ -0,0 +1,64 @@
+cmake_minimum_required(VERSION 3.21)
+project(opendht_node LANGUAGES C CXX)
+
+set(CMAKE_CXX_STANDARD 17)
+set(CMAKE_CXX_STANDARD_REQUIRED ON)
+set(CMAKE_POSITION_INDEPENDENT_CODE ON)
+set(OPENDHT_TOOLS OFF CACHE BOOL "Build DHT tools")
+set(OPENDHT_PYTHON OFF CACHE BOOL "Build Python bindings")
+set(OPENDHT_PROXY_CLIENT ON CACHE BOOL "Enable DHT proxy client")
+set(OPENDHT_PEER_DISCOVERY OFF CACHE BOOL "Enable multicast peer discovery")
+set(OPENDHT_DOCUMENTATION OFF CACHE BOOL "Build documentation")
+set(BUILD_TESTING OFF CACHE BOOL "Build native tests")
+add_subdirectory(.. native EXCLUDE_FROM_ALL)
+
+find_program(NODE_EXECUTABLE node REQUIRED)
+execute_process(
+    COMMAND "${NODE_EXECUTABLE}" --input-type=module -e "import addon from 'node-addon-api'; process.stdout.write(addon.include_dir)"
+    WORKING_DIRECTORY "${CMAKE_CURRENT_SOURCE_DIR}"
+    OUTPUT_VARIABLE NODE_ADDON_API_DIR
+    OUTPUT_STRIP_TRAILING_WHITESPACE
+    COMMAND_ERROR_IS_FATAL ANY
+)
+
+add_library(opendht_node MODULE addon.cpp crypto.cpp ${CMAKE_JS_SRC})
+target_compile_definitions(opendht_node PRIVATE NAPI_VERSION=8 NAPI_CPP_EXCEPTIONS)
+target_include_directories(opendht_node PRIVATE
+    ${CMAKE_JS_INC}
+    "${CMAKE_CURRENT_SOURCE_DIR}/${NODE_ADDON_API_DIR}"
+    "${CMAKE_CURRENT_SOURCE_DIR}/../include"
+    "${CMAKE_CURRENT_BINARY_DIR}/native/include"
+)
+target_link_libraries(opendht_node PRIVATE opendht ${CMAKE_JS_LIB})
+if(OPENDHT_SANITIZE AND CMAKE_CXX_COMPILER_ID MATCHES "GNU|Clang")
+    target_compile_options(opendht_node PRIVATE -fsanitize=address -fstack-protector-strong)
+    target_link_options(opendht_node PRIVATE -fsanitize=address)
+endif()
+set_target_properties(opendht_node PROPERTIES
+    PREFIX ""
+    SUFFIX ".node"
+    OUTPUT_NAME "opendht"
+    LIBRARY_OUTPUT_DIRECTORY "${CMAKE_BINARY_DIR}/$<CONFIG>"
+    RUNTIME_OUTPUT_DIRECTORY "${CMAKE_BINARY_DIR}/$<CONFIG>"
+)
+if(APPLE)
+    target_link_options(opendht_node PRIVATE "-undefined" "dynamic_lookup")
+endif()
+if(WIN32)
+    add_custom_command(TARGET opendht_node POST_BUILD
+        COMMAND ${CMAKE_COMMAND} -E copy_if_different
+            $<TARGET_RUNTIME_DLLS:opendht_node> $<TARGET_FILE_DIR:opendht_node>
+        COMMAND_EXPAND_LISTS
+    )
+endif()
+if(MSVC)
+    target_compile_options(opendht_node PRIVATE /EHsc)
+    target_include_directories(opendht_node PRIVATE
+        "${CMAKE_CURRENT_SOURCE_DIR}/../src/compat/msvc"
+        "${CMAKE_CURRENT_SOURCE_DIR}/../src/compat/win32"
+    )
+    if(CMAKE_JS_NODELIB_DEF AND CMAKE_JS_NODELIB_TARGET)
+        execute_process(COMMAND ${CMAKE_AR} /def:${CMAKE_JS_NODELIB_DEF}
+            /out:${CMAKE_JS_NODELIB_TARGET} ${CMAKE_STATIC_LINKER_FLAGS})
+    endif()
+endif()
@@ -0,0 +1,243 @@
+# OpenDHT Node.js Bindings
+
+Initial Node-API bindings using `node-addon-api` directly over the C++ library.
+Node.js 22.9 or later is required; the addon targets Node-API version 8.
+
+## Install
+
+```sh
+npm install opendht
+```
+
+## Build
+
+Install the native dependencies described in [BUILD.md](../BUILD.md), plus Node.js,
+a C++17 compiler, and CMake 3.21 or later. Ninja is optional. Proxy-client support
+defaults to enabled and requires ASIO, llhttp, RESTinio, and expected-lite headers.
+
+```sh
+cd nodejs
+npm ci
+npm run build
+npm test
+npm run typecheck
+```
+
+CMake.js builds OpenDHT from the parent source directory in `nodejs/build/native`.
+It does not change the repository's existing build directory. Tools, Python,
+peer discovery, documentation, and native tests default to disabled in this build.
+Native CMake options can be passed through, for example:
+
+```sh
+npm run build -- --CDOPENDHT_PEER_DISCOVERY=ON
+```
+
+For an existing build, change cached options directly with CMake, for example
+`cmake -S . -B build -DOPENDHT_PROXY_CLIENT=ON`, then rebuild. A custom build can
+disable proxy support with `-DOPENDHT_PROXY_CLIENT=OFF`; requesting a proxy then
+throws an explicit unsupported-build error.
+
+The loader checks local builds, then compatible Node-API binaries under `prebuilds/`.
+Set `OPENDHT_NODE_BINDING` to an absolute addon path to select an explicit build.
+Packaged binaries include OpenDHT and non-system native dependencies, so archive
+installation does not require a compiler or a system OpenDHT installation.
+
+## Usage
+
+```js
+import { DhtRunner, hash } from 'opendht';
+
+async function main() {
+    const writer = new DhtRunner();
+    const reader = new DhtRunner();
+    try {
+        writer.run({ port: 0, ipv4: '127.0.0.1', ipv6: '::1' });
+        reader.run({ port: 0, ipv4: '127.0.0.1', ipv6: '::1' });
+        writer.bootstrap('127.0.0.1', reader.getBoundPort());
+        reader.bootstrap('127.0.0.1', writer.getBoundPort());
+        const key = hash('example');
+        const stored = await writer.put(key, Buffer.from('hello'), { id: 42n });
+        if (!stored) throw new Error('DHT put failed');
+        for await (const value of reader.get(key)) {
+            console.log(value.id, value.data.toString());
+        }
+    } finally {
+        await Promise.all([writer.close(), reader.close()]);
+    }
+}
+
+main().catch(console.error);
+```
+
+## API
+
+- `hash(string | Uint8Array)` returns a SHA-1 hash as a 40-character hex string.
+  All get/put/listen keys must be hex hashes, not unhashed application keys.
+- `version` is the underlying OpenDHT version.
+- `run({port, ipv4, ipv6, network, persistPath, identity})` starts a threaded node. Port 0
+  selects a free port. The defaults bind both IP families on all interfaces.
+  `persistPath` is optional; use an empty string to disable persistence.
+  `proxyServer` and `proxyUserAgent` configure proxy mode (see below).
+- `getBoundPort(4 | 6)` defaults to IPv4; `getNodeId()` returns the node's hex ID.
+- `getStatus()` returns the latest JS-dispatched `{ipv4, ipv6}` connectivity
+  snapshot. Each family is `'disconnected'`, `'connecting'`, or `'connected'`.
+  `runner.on('statusChanged', status => {})` receives changes on the JS thread.
+  New and closing/closed runners report both families as disconnected. No status
+  events are delivered after close begins; close does not emit a final event.
+- `bootstrap(host, port)` queues bootstrap discovery. Returning does not mean the
+  peer is connected; subsequent DHT operations report their own completion.
+- `put(key, Uint8Array, {id, type, userType, permanent})` copies the input and
+  resolves to the native success boolean. IDs are unsigned 64-bit `bigint` values.
+- `get(key)` returns an async iterator of values as they arrive. The iterator
+  ends when the lookup completes, or rejects with `ERR_DHT_GET_FAILED` on failure.
+  `getAll(key)` returns a single promise resolving to the complete value array.
+  Values contain `id`, `type`, `seq`, `userType`, copied `Buffer` data, `isSigned`,
+  `isEncrypted`, and an `owner` long fingerprint (or null for unsigned values).
+- `listen(key, (value, expired) => {})` returns a listener with idempotent
+  `cancel()`. Queued deliveries are suppressed after cancellation. Callback
+  return values are ignored; callbacks may cancel or close the runner.
+- `listen(key)` without a callback returns an async iterator of `{value, expired}`
+  events. It continues until cancelled or the runner closes.
+- `close()` is idempotent and returns the same promise on repeated calls. It
+  waits off the JS thread for graceful shutdown, then joins the native threads.
+  After two seconds it forces the join if graceful shutdown has not completed.
+  Pending operations reject with `ERR_DHT_CLOSED`. A closed runner cannot restart.
+- `ref()` and `unref()` control whether the runner keeps Node's event loop alive.
+  Running nodes are referenced by default. `Symbol.asyncDispose` calls `close()`.
+
+Callbacks run only on their owning JS thread. There is no polling timer or worker
+thread waiting on each get/put. Explicitly close runners; GC cleanup and Node
+environment cleanup hooks are fallbacks, including forced worker termination.
+Pending operations, active listeners, and registered status handlers keep their
+runner alive until completion, cancellation, handler removal, or explicit close.
+Graceful persistence cannot be guaranteed if the process is killed.
+
+The binding does not cap the callback queue, accumulated `getAll()` results, or
+iterator buffers. Slow iterator consumers can accumulate values without
+backpressure. Queued callbacks retain their native values until delivery or cleanup.
+
+## Async Iteration
+
+`get()` and callback-free `listen()` start immediately and return iterators with
+`next()`, `return()`, `throw()`, `cancel()`, and `Symbol.asyncDispose`.
+Leaving a `for await` loop with `break` or an exception cancels the subscription.
+Explicit cancellation discards buffered values and settles pending reads as done.
+Closing the runner rejects active get iterators with `ERR_DHT_CLOSED`; listener
+iterators end normally. Successful get completion preserves unread buffered values.
+
+```js
+for await (const value of runner.get(hash('example'))) {
+  console.log(value.id, value.data);
+}
+const snapshots = await runner.getAll(hash('example'));
+
+for await (const { value, expired } of runner.listen(hash('updates'))) {
+  console.log(value.id, expired);
+  if (expired) break;
+}
+```
+
+## Proxy Configuration
+
+Pass the URL of an OpenDHT HTTP(S) proxy at startup:
+
+```js
+runner.run({
+  proxyServer: 'https://proxy.example.com',
+  proxyUserAgent: 'my-app/1.0',
+});
+```
+
+This selects the native OpenDHT proxy client, not an HTTP CONNECT or SOCKS proxy.
+The node does not bind UDP sockets in this mode; `port`, `ipv4`, `ipv6`, and
+`bootstrap()` are for direct DHT nodes. Omit `proxyServer` or use an empty string
+for direct networking. Proxy settings are startup-only; create a new runner to
+change transports or servers. Packaged binaries include proxy-client support.
+
+## Crypto
+
+`PrivateKey.generate(options)` and `Identity.generate(name, options)` return
+promises and generate keys off the JS thread. Options accept `algorithm: 'ec'`
+(the default, using OpenDHT's default EC curve) or `'rsa'`. RSA `bits` must be an
+integer between 2048 and 8192; the default is 2048.
+
+- `new PrivateKey(bytes, password?)` imports PEM/DER; `serialize(password?)`
+  exports PKCS#8 PEM. A nonempty password encrypts the exported key.
+- `privateKey.getPublicKey()` returns an owned public key. `sign(bytes)` and
+  `decrypt(bytes)` return copied Buffers.
+- `new PublicKey(bytes)` imports a public key; `serialize()` exports DER.
+  `checkSignature(data, signature)` returns a boolean. `encrypt(bytes)` requires
+  an RSA key; EC keys support signatures, not this encryption scheme.
+- `new Certificate(bytes)` imports PEM/DER or a PEM certificate chain;
+  `serialize()` exports a PEM chain. Import does not establish trust or validate
+  the chain against a trust store. `getPublicKey()` returns its public key.
+- Public keys and certificates expose `getId()` (40 hex characters) and
+  `getLongId()` (64 hex characters).
+- `new Identity(privateKey, certificate)` requires matching fingerprints.
+  Its read-only `privateKey` and `certificate` properties return owned wrappers.
+- Pass `identity` to `run()` to enable `putSigned(key, data, options?)` and
+  `putEncrypted(key, data, recipientPublicKey, options?)`. Both return the same
+  success boolean as `put()`. Encrypted values are signed by the sender and
+  transparently decrypted for the recipient by OpenDHT's get/listen layer.
+
+```js
+import { Identity, DhtRunner } from 'opendht';
+
+async function createAuthenticatedNode() {
+    const identity = await Identity.generate('example', { algorithm: 'rsa', bits: 2048 });
+    const runner = new DhtRunner();
+    runner.run({ port: 0, identity });
+    return { runner, identity };
+}
+```
+
+Crypto methods take Uint8Array/Buffer inputs, not implicit text encodings. Imports
+must be nonempty. Malformed handles/data,
+mismatched identities, and unsupported encryption keys raise JS exceptions.
+Only generation is asynchronous; import/export/sign/encrypt/decrypt are
+synchronous and should be used from worker threads for large workloads.
+
+## Packaging And CI
+
+From a successful Release build:
+
+```sh
+npm run package
+npm run test:package
+```
+
+`bundle` copies the addon into `prebuilds/<platform>-<arch>/`, gathers its runtime
+dependencies, rewrites native loader paths, and copies dependency license
+notices. macOS needs `dylibbundler` and Apple developer tools; Linux needs
+`patchelf` and Debian/Ubuntu dependency copyright files. Windows uses the vcpkg
+installed tree (`VCPKG_INSTALLED_DIR`, `VCPKG_DEFAULT_TRIPLET`) and MSVC tools.
+`OPENDHT_LIBRARY_PATH` adds native library search directories when bundling.
+An explicit addon path may be passed to `npm run bundle -- /absolute/addon.node`.
+Bundling replaces only the current platform's generated prebuild directory.
+
+`test:package` creates an npm archive, installs it in a temporary consumer with
+install scripts disabled and no dev dependencies, forces prebuild-only loading,
+and runs the full runtime suite. Pass an archive file or a directory containing
+one archive to test it directly, for example `npm run test:package -- dist`.
+Only runtime JS, declarations, the example's TypeScript source, documentation,
+and prebuilds are included in the archive. `prepack` compiles the example, so
+archive creation needs the development dependencies; archive installation does not.
+
+The [Node.js package workflow](../.github/workflows/nodejs-package.yml) builds:
+
+| Target | Build Baseline |
+| --- | --- |
+| Linux x64 | Ubuntu 24.04 / glibc 2.39 (Noble dependency image) |
+| macOS ARM64 and x64 | macOS 15 |
+| Windows x64 | Windows Server 2022 / MSVC |
+
+CI combines platform prebuilds into one npm archive and verifies that archive on
+Node 22, 24, and 26 on each platform, including Ubuntu 24.04 and 26.04. Branch
+pushes, pull requests, and manual runs build and test without publishing.
+musl/Alpine and other architectures are not currently built. Node-API stability
+does not remove OS/libc or native dependency compatibility requirements. Review
+the included dependency licenses and source-distribution obligations before
+redistributing binaries.
+
+Query filters, AbortSignal support, certificate trust-store validation, CA
+issuance controls, and runtime proxy switching remain future work.
@@ -0,0 +1,734 @@
+#include <napi.h>
+#include <opendht.h>
+#include <gnutls/gnutls.h>
+#include "crypto.h"
+#include <algorithm>
+#include <atomic>
+#include <chrono>
+#include <cmath>
+#include <condition_variable>
+#include <functional>
+#include <mutex>
+#include <optional>
+#include <unordered_map>
+
+namespace {
+
+struct GnuTlsContext
+{
+    const int result = gnutls_global_init();
+
+    ~GnuTlsContext()
+    {
+        if (result == GNUTLS_E_SUCCESS)
+            gnutls_global_deinit();
+    }
+};
+
+using opendht_node::guarded;
+
+uint32_t
+unsignedNumber(Napi::Value value, uint32_t maximum, const char* name)
+{
+    if (!value.IsNumber())
+        throw Napi::TypeError::New(value.Env(), std::string(name) + " must be a number");
+    const auto number = value.As<Napi::Number>().DoubleValue();
+    if (!std::isfinite(number) || number < 0 || number > maximum || std::floor(number) != number)
+        throw Napi::RangeError::New(value.Env(), std::string(name) + " is out of range");
+    return static_cast<uint32_t>(number);
+}
+
+uint64_t
+unsignedBigInt(Napi::Value value)
+{
+    if (!value.IsBigInt())
+        throw Napi::TypeError::New(value.Env(), "id must be a bigint");
+    int sign = 0;
+    size_t count = 1;
+    uint64_t word = 0;
+    value.As<Napi::BigInt>().ToWords(&sign, &count, &word);
+    if (sign || count > 1)
+        throw Napi::RangeError::New(value.Env(), "id must fit in an unsigned 64-bit integer");
+    return word;
+}
+
+std::string
+text(Napi::Value value, const char* name)
+{
+    if (!value.IsString())
+        throw Napi::TypeError::New(value.Env(), std::string(name) + " must be a string");
+    auto result = value.As<Napi::String>().Utf8Value();
+    if (result.find('\0') != std::string::npos)
+        throw Napi::TypeError::New(value.Env(), std::string(name) + " must not contain NUL bytes");
+    return result;
+}
+
+dht::InfoHash
+infoHash(Napi::Value value)
+{
+    const auto result = text(value, "hash");
+    if (result.size() != 40 || result.find_first_not_of("0123456789abcdefABCDEF") != std::string::npos)
+        throw Napi::TypeError::New(value.Env(), "Expected a 40-character hexadecimal hash");
+    return dht::InfoHash(result);
+}
+
+Napi::Object
+optionsObject(Napi::Value value)
+{
+    if (!value.IsObject() || value.IsArray() || value.IsNull())
+        throw Napi::TypeError::New(value.Env(), "options must be an object");
+    return value.As<Napi::Object>();
+}
+
+Napi::Object
+valueToJS(Napi::Env env, const dht::Value& value)
+{
+    auto result = Napi::Object::New(env);
+    result.Set("id", Napi::BigInt::New(env, value.id));
+    result.Set("type", Napi::Number::New(env, value.type));
+    result.Set("seq", Napi::Number::New(env, value.seq));
+    result.Set("data", Napi::Buffer<uint8_t>::Copy(env, value.data.data(), value.data.size()));
+    result.Set("userType", Napi::String::New(env, value.user_type));
+    result.Set("owner",
+               value.owner ? Napi::Value(Napi::String::New(env, value.owner->getLongId().to_view()))
+                           : Napi::Value(env.Null()));
+    result.Set("isSigned", Napi::Boolean::New(env, value.isSigned()));
+    result.Set("isEncrypted", Napi::Boolean::New(env, value.isEncrypted()));
+    return result;
+}
+
+struct PendingOperation
+{
+    Napi::Promise::Deferred deferred;
+    bool get;
+    std::vector<std::shared_ptr<const dht::Value>> values;
+    Napi::FunctionReference onValue;
+    std::shared_ptr<std::atomic_bool> cancelled;
+};
+
+struct Subscription
+{
+    dht::InfoHash key;
+    std::shared_future<size_t> token;
+    Napi::FunctionReference callback;
+};
+
+struct RunnerState
+{
+    using Callback = std::function<void(RunnerState&)>;
+
+    explicit RunnerState(Napi::Env environment)
+        : env(environment)
+    {}
+
+    static std::shared_ptr<RunnerState> create(Napi::Env env)
+    {
+        auto state = std::make_shared<RunnerState>(env);
+        auto dispatchOwner = std::make_unique<std::shared_ptr<RunnerState>>(state);
+        napi_threadsafe_function function;
+        if (napi_create_threadsafe_function(env,
+                                            nullptr,
+                                            nullptr,
+                                            Napi::String::New(env, "OpenDHT callbacks"),
+                                            0,
+                                            1,
+                                            dispatchOwner.get(),
+                                            finalizeDispatcher,
+                                            state.get(),
+                                            dispatch,
+                                            &function)
+            != napi_ok)
+            throw Napi::Error::New(env, "Could not create OpenDHT callback dispatcher");
+        dispatchOwner.release();
+        state->dispatcher = Napi::ThreadSafeFunction(function);
+        state->dispatcher.Unref(env);
+        auto closeOwner = std::make_unique<std::shared_ptr<RunnerState>>(state);
+        if (napi_create_async_work(env,
+                                   nullptr,
+                                   Napi::String::New(env, "OpenDHT close"),
+                                   executeClose,
+                                   completeClose,
+                                   closeOwner.get(),
+                                   &state->closeWork)
+            != napi_ok) {
+            state->dispatcher.Release();
+            throw Napi::Error::New(env, "Could not create OpenDHT cleanup work");
+        }
+        if (napi_add_async_cleanup_hook(env, cleanup, state.get(), &state->cleanupHook) != napi_ok) {
+            napi_delete_async_work(env, state->closeWork);
+            state->dispatcher.Release();
+            throw Napi::Error::New(env, "Could not register OpenDHT cleanup hook");
+        }
+        state->closeOwner = closeOwner.release();
+        return state;
+    }
+
+    void requireRunning() const
+    {
+        if (closing)
+            throw Napi::Error::New(env, "DHT runner is closed");
+        if (!started)
+            throw Napi::Error::New(env, "DHT runner is not running");
+    }
+
+    void startClose()
+    {
+        if (closing.exchange(true))
+            return;
+        if (napi_queue_async_work(env, closeWork) != napi_ok) {
+            executeClose(env, closeOwner);
+            completeClose(env, napi_ok, closeOwner);
+        }
+    }
+
+    void send(Callback callback)
+    {
+        if (closing)
+            return;
+        auto task = std::make_unique<Callback>(std::move(callback));
+        if (dispatcher.NonBlockingCall(static_cast<void*>(task.get())) == napi_ok)
+            task.release();
+    }
+
+    void sendValue(uint64_t operation, std::shared_ptr<const dht::Value> value, bool expired = false)
+    {
+        send([operation, value = std::move(value), expired](RunnerState& state) mutable {
+            const auto listener = state.listeners.find(operation);
+            if (listener != state.listeners.end()) {
+                listener->second.callback.Call({valueToJS(state.env, *value), Napi::Boolean::New(state.env, expired)});
+            } else if (const auto pending = state.operations.find(operation); pending != state.operations.end()) {
+                if (!pending->second.onValue.IsEmpty())
+                    pending->second.onValue.Call({valueToJS(state.env, *value)});
+                else
+                    pending->second.values.emplace_back(std::move(value));
+            }
+        });
+    }
+
+    void completeOperation(uint64_t identifier, bool ok)
+    {
+        const auto pending = operations.find(identifier);
+        if (pending == operations.end())
+            return;
+        auto operation = std::move(pending->second);
+        operations.erase(pending);
+        if (!operation.get) {
+            operation.deferred.Resolve(Napi::Boolean::New(env, ok));
+        } else if (!ok) {
+            auto error = Napi::Error::New(env, "DHT get failed");
+            error.Set("code", "ERR_DHT_GET_FAILED");
+            operation.deferred.Reject(error.Value());
+        } else if (!operation.onValue.IsEmpty()) {
+            operation.deferred.Resolve(env.Undefined());
+        } else {
+            auto values = Napi::Array::New(env, operation.values.size());
+            for (size_t index = 0; index < operation.values.size(); ++index)
+                values.Set(static_cast<uint32_t>(index), valueToJS(env, *operation.values[index]));
+            operation.deferred.Resolve(values);
+        }
+    }
+
+    Napi::Object status() const
+    {
+        auto result = Napi::Object::New(env);
+        result.Set("ipv4", Napi::String::New(env, dht::statusToStr(closing ? dht::NodeStatus::Disconnected : status4)));
+        result.Set("ipv6", Napi::String::New(env, dht::statusToStr(closing ? dht::NodeStatus::Disconnected : status6)));
+        return result;
+    }
+
+    static void dispatch(napi_env environment, napi_value, void* context, void* data)
+    {
+        auto state = static_cast<RunnerState*>(context);
+        std::unique_ptr<Callback> callback(static_cast<Callback*>(data));
+        if (!environment || state->envClosing || state->closing)
+            return;
+        try {
+            (*callback)(*state);
+        } catch (const Napi::Error& error) {
+            napi_fatal_exception(environment, error.Value());
+        } catch (const std::exception& error) {
+            napi_fatal_exception(environment, Napi::Error::New(environment, error.what()).Value());
+        }
+    }
+
+    static void finalizeDispatcher(napi_env, void* data, void*)
+    {
+        delete static_cast<std::shared_ptr<RunnerState>*>(data);
+    }
+
+    static void cleanup(napi_async_cleanup_hook_handle, void* data)
+    {
+        auto state = static_cast<RunnerState*>(data);
+        state->envClosing = true;
+        state->startClose();
+    }
+
+    static void executeClose(napi_env, void* data)
+    {
+        auto state = *static_cast<std::shared_ptr<RunnerState>*>(data);
+        struct ShutdownSignal
+        {
+            std::mutex mutex;
+            std::condition_variable condition;
+            bool done = false;
+        };
+        try {
+            auto signal = std::make_shared<ShutdownSignal>();
+            state->runner.shutdown(
+                [signal] {
+                    std::lock_guard lock(signal->mutex);
+                    signal->done = true;
+                    signal->condition.notify_one();
+                },
+                true);
+            std::unique_lock lock(signal->mutex);
+            signal->condition.wait_for(lock, std::chrono::seconds(2), [&] { return signal->done; });
+        } catch (const std::exception& error) {
+            state->closeError = error.what();
+        }
+        state->runner.join();
+    }
+
+    Napi::Error makeCloseError() const
+    {
+        auto error = Napi::Error::New(env, closeError.empty() ? "DHT runner is closed" : closeError);
+        error.Set("code", "ERR_DHT_CLOSED");
+        return error;
+    }
+
+    static void completeClose(napi_env environment, napi_status, void* data)
+    {
+        std::unique_ptr<std::shared_ptr<RunnerState>> owner(static_cast<std::shared_ptr<RunnerState>*>(data));
+        auto state = *owner;
+        state->finished = true;
+        if (!state->envClosing) {
+            state->dispatcher.Release();
+            auto error = state->makeCloseError();
+            for (auto& pending : state->operations)
+                pending.second.deferred.Reject(error.Value());
+            if (state->closeDeferred) {
+                if (state->closeError.empty())
+                    state->closeDeferred->Resolve(Napi::Env(environment).Undefined());
+                else
+                    state->closeDeferred->Reject(error.Value());
+            }
+        }
+        state->operations.clear();
+        state->listeners.clear();
+        state->closeDeferred.reset();
+        state->closePromise.Reset();
+        state->onStatus.Reset();
+        state->owner.Reset();
+        napi_delete_async_work(environment, state->closeWork);
+        napi_remove_async_cleanup_hook(state->cleanupHook);
+        state->closeOwner = nullptr;
+    }
+
+    Napi::Env env;
+    dht::DhtRunner runner;
+    Napi::ThreadSafeFunction dispatcher;
+    napi_async_work closeWork {};
+    napi_async_cleanup_hook_handle cleanupHook {};
+    std::shared_ptr<RunnerState>* closeOwner {};
+    std::atomic_bool closing {false};
+    bool envClosing = false;
+    bool started = false;
+    bool hasIdentity = false;
+    bool finished = false;
+    uint64_t nextOperation = 1;
+    std::string closeError;
+    std::unordered_map<uint64_t, PendingOperation> operations;
+    std::unordered_map<uint64_t, Subscription> listeners;
+    std::optional<Napi::Promise::Deferred> closeDeferred;
+    Napi::Reference<Napi::Promise> closePromise;
+    Napi::FunctionReference onStatus;
+    Napi::ObjectReference owner;
+    dht::NodeStatus status4 = dht::NodeStatus::Disconnected;
+    dht::NodeStatus status6 = dht::NodeStatus::Disconnected;
+};
+
+class Runner : public Napi::ObjectWrap<Runner>
+{
+public:
+    explicit Runner(const Napi::CallbackInfo& info)
+        : Napi::ObjectWrap<Runner>(info)
+        , state_(RunnerState::create(info.Env()))
+    {
+        if (info.Length() && info[0].IsFunction())
+            state_->onStatus = Napi::Persistent(info[0].As<Napi::Function>());
+    }
+
+    ~Runner() override { state_->startClose(); }
+
+    static Napi::Function define(Napi::Env env)
+    {
+        return DefineClass(env,
+                           "NativeRunner",
+                           {
+                               InstanceMethod("run", &Runner::run),
+                               InstanceMethod("close", &Runner::close),
+                               InstanceMethod("isRunning", &Runner::isRunning),
+                               InstanceMethod("getBoundPort", &Runner::getBoundPort),
+                               InstanceMethod("getNodeId", &Runner::getNodeId),
+                               InstanceMethod("getStatus", &Runner::getStatus),
+                               InstanceMethod("bootstrap", &Runner::bootstrap),
+                               InstanceMethod("get", &Runner::get),
+                               InstanceMethod("getAll", &Runner::getAll),
+                               InstanceMethod("cancelGet", &Runner::cancelGet),
+                               InstanceMethod("put", &Runner::put),
+                               InstanceMethod("putSigned", &Runner::putSigned),
+                               InstanceMethod("putEncrypted", &Runner::putEncrypted),
+                               InstanceMethod("listen", &Runner::listen),
+                               InstanceMethod("cancelListen", &Runner::cancelListen),
+                               InstanceMethod("ref", &Runner::ref),
+                               InstanceMethod("unref", &Runner::unref),
+                               InstanceMethod("setOwner", &Runner::setOwner),
+                           });
+    }
+
+private:
+    Napi::Value run(const Napi::CallbackInfo& info)
+    {
+        return guarded(info, [&]() -> Napi::Value {
+            if (state_->closing)
+                throw Napi::Error::New(info.Env(), "DHT runner is closed");
+            if (state_->started)
+                throw Napi::Error::New(info.Env(), "DHT runner is already running");
+            auto options = info.Length() && !info[0].IsUndefined() ? optionsObject(info[0])
+                                                                   : Napi::Object::New(info.Env());
+            const auto port = options.Has("port") ? unsignedNumber(options.Get("port"), 65535, "port") : 0;
+            const auto ipv4 = options.Has("ipv4") ? text(options.Get("ipv4"), "ipv4") : "0.0.0.0";
+            const auto ipv6 = options.Has("ipv6") ? text(options.Get("ipv6"), "ipv6") : "::";
+            dht::DhtRunner::Config config;
+            if (options.Has("network"))
+                config.dht_config.node_config.network = unsignedNumber(options.Get("network"), UINT32_MAX, "network");
+            if (options.Has("persistPath"))
+                config.dht_config.node_config.persist_path = text(options.Get("persistPath"), "persistPath");
+            if (options.Has("identity"))
+                config.dht_config.id = opendht_node::readIdentity(options.Get("identity"));
+            if (options.Has("proxyServer"))
+                config.proxy_server = text(options.Get("proxyServer"), "proxyServer");
+            if (options.Has("proxyUserAgent")) {
+                config.proxy_user_agent = text(options.Get("proxyUserAgent"), "proxyUserAgent");
+                if (config.proxy_user_agent.find_first_of("\r\n") != std::string::npos)
+                    throw Napi::TypeError::New(info.Env(), "proxyUserAgent must not contain line breaks");
+            }
+            dht::DhtRunner::Context context;
+            const std::weak_ptr<RunnerState> state = state_;
+            context.statusChangedCallback = [state](dht::NodeStatus ipv4, dht::NodeStatus ipv6) {
+                if (auto owner = state.lock())
+                    owner->send([ipv4, ipv6](RunnerState& state) {
+                        state.status4 = ipv4;
+                        state.status6 = ipv6;
+                        if (!state.onStatus.IsEmpty())
+                            state.onStatus.Call({state.status()});
+                    });
+            };
+            const auto service = std::to_string(port);
+            state_->runner.run(ipv4.c_str(), ipv6.c_str(), service.c_str(), config, std::move(context));
+            state_->started = true;
+            state_->hasIdentity = bool(config.dht_config.id.first);
+            state_->dispatcher.Ref(info.Env());
+            return info.Env().Undefined();
+        });
+    }
+
+    Napi::Value close(const Napi::CallbackInfo& info)
+    {
+        return guarded(info, [&]() -> Napi::Value {
+            if (!state_->closePromise.IsEmpty())
+                return state_->closePromise.Value();
+            auto deferred = Napi::Promise::Deferred::New(info.Env());
+            if (state_->finished) {
+                if (!state_->closeError.empty())
+                    deferred.Reject(state_->makeCloseError().Value());
+                else
+                    deferred.Resolve(info.Env().Undefined());
+            } else {
+                state_->closeDeferred = deferred;
+                state_->closePromise = Napi::Persistent(deferred.Promise());
+                state_->startClose();
+            }
+            return deferred.Promise();
+        });
+    }
+
+    Napi::Value isRunning(const Napi::CallbackInfo& info)
+    {
+        return Napi::Boolean::New(info.Env(), !state_->closing && state_->runner.isRunning());
+    }
+
+    Napi::Value getStatus(const Napi::CallbackInfo& info)
+    {
+        return guarded(info, [&]() -> Napi::Value { return state_->status(); });
+    }
+
+    Napi::Value getBoundPort(const Napi::CallbackInfo& info)
+    {
+        return guarded(info, [&]() -> Napi::Value {
+            state_->requireRunning();
+            const auto family = info.Length() ? unsignedNumber(info[0], 6, "family") : 4;
+            if (family != 4 && family != 6)
+                throw Napi::RangeError::New(info.Env(), "family must be 4 or 6");
+            return Napi::Number::New(info.Env(), state_->runner.getBoundPort(family == 4 ? AF_INET : AF_INET6));
+        });
+    }
+
+    Napi::Value getNodeId(const Napi::CallbackInfo& info)
+    {
+        return guarded(info, [&]() -> Napi::Value {
+            state_->requireRunning();
+            return Napi::String::New(info.Env(), state_->runner.getNodeId().to_view());
+        });
+    }
+
+    Napi::Value bootstrap(const Napi::CallbackInfo& info)
+    {
+        return guarded(info, [&]() -> Napi::Value {
+            state_->requireRunning();
+            const auto host = text(info[0], "host");
+            const auto port = unsignedNumber(info[1], 65535, "port");
+            if (host.empty() || !port)
+                throw Napi::RangeError::New(info.Env(), "bootstrap requires a host and nonzero port");
+            state_->runner.bootstrap(host, std::to_string(port));
+            return info.Env().Undefined();
+        });
+    }
+
+    Napi::Value get(const Napi::CallbackInfo& info) { return getValues(info, true); }
+
+    Napi::Value getAll(const Napi::CallbackInfo& info) { return getValues(info, false); }
+
+    Napi::Value getValues(const Napi::CallbackInfo& info, bool stream)
+    {
+        return guarded(info, [&]() -> Napi::Value {
+            state_->requireRunning();
+            const auto key = infoHash(info[0]);
+            if (stream && !info[1].IsFunction())
+                throw Napi::TypeError::New(info.Env(), "callback must be a function");
+            const auto operation = state_->nextOperation++;
+            auto deferred = Napi::Promise::Deferred::New(info.Env());
+            auto cancelled = std::make_shared<std::atomic_bool>(false);
+            PendingOperation pending {deferred, true, {}, {}, cancelled};
+            if (stream)
+                pending.onValue = Napi::Persistent(info[1].As<Napi::Function>());
+            state_->operations.emplace(operation, std::move(pending));
+            const std::weak_ptr<RunnerState> state = state_;
+            try {
+                state_->runner.get(key,
+                                   dht::GetCallback([state, operation, cancelled](
+                                                        const std::vector<std::shared_ptr<dht::Value>>& values) {
+                                       const auto owner = state.lock();
+                                       if (!owner || owner->closing || *cancelled)
+                                           return false;
+                                       for (const auto& value : values)
+                                           owner->sendValue(operation, value);
+                                       return !owner->closing && !*cancelled;
+                                   }),
+                                   dht::DoneCallbackSimple([state, operation](bool ok) {
+                                       if (const auto owner = state.lock())
+                                           owner->send([operation, ok](RunnerState& state) {
+                                               state.completeOperation(operation, ok);
+                                           });
+                                   }));
+            } catch (...) {
+                state_->operations.erase(operation);
+                throw;
+            }
+            if (stream) {
+                auto result = Napi::Object::New(info.Env());
+                result.Set("token", Napi::BigInt::New(info.Env(), operation));
+                result.Set("done", deferred.Promise());
+                return result;
+            }
+            return deferred.Promise();
+        });
+    }
+
+    Napi::Value cancelGet(const Napi::CallbackInfo& info)
+    {
+        return guarded(info, [&]() -> Napi::Value {
+            const auto operation = state_->operations.find(unsignedBigInt(info[0]));
+            if (operation != state_->operations.end() && !operation->second.onValue.IsEmpty()) {
+                *operation->second.cancelled = true;
+                operation->second.deferred.Resolve(info.Env().Undefined());
+                state_->operations.erase(operation);
+            }
+            return info.Env().Undefined();
+        });
+    }
+
+    Napi::Value put(const Napi::CallbackInfo& info) { return putValue(info, PutMode::Plain); }
+
+    Napi::Value putSigned(const Napi::CallbackInfo& info) { return putValue(info, PutMode::Signed); }
+
+    Napi::Value putEncrypted(const Napi::CallbackInfo& info) { return putValue(info, PutMode::Encrypted); }
+
+    enum class PutMode { Plain, Signed, Encrypted };
+
+    Napi::Value putValue(const Napi::CallbackInfo& info, PutMode mode)
+    {
+        return guarded(info, [&]() -> Napi::Value {
+            state_->requireRunning();
+            if (mode != PutMode::Plain && !state_->hasIdentity)
+                throw Napi::Error::New(info.Env(), "Signed and encrypted puts require an identity");
+            std::shared_ptr<dht::crypto::PublicKey> recipient;
+            if (mode == PutMode::Encrypted) {
+                recipient = opendht_node::readEncryptionKey(info[3]);
+            }
+            const auto key = infoHash(info[0]);
+            if (!info[1].IsTypedArray() || info[1].As<Napi::TypedArray>().TypedArrayType() != napi_uint8_array)
+                throw Napi::TypeError::New(info.Env(), "data must be a Uint8Array");
+            const auto data = info[1].As<Napi::Uint8Array>();
+            dht::Blob bytes(data.ElementLength());
+            if (!bytes.empty())
+                std::copy_n(data.Data(), bytes.size(), bytes.data());
+            auto value = std::make_shared<dht::Value>(std::move(bytes));
+            auto options = info.Length() > 2 && !info[2].IsUndefined() ? optionsObject(info[2])
+                                                                       : Napi::Object::New(info.Env());
+            if (options.Has("id"))
+                value->id = unsignedBigInt(options.Get("id"));
+            if (options.Has("type"))
+                value->type = unsignedNumber(options.Get("type"), 65535, "type");
+            if (options.Has("userType")) {
+                if (!options.Get("userType").IsString())
+                    throw Napi::TypeError::New(info.Env(), "userType must be a string");
+                value->user_type = options.Get("userType").As<Napi::String>().Utf8Value();
+            }
+            bool permanent = false;
+            if (options.Has("permanent")) {
+                if (!options.Get("permanent").IsBoolean())
+                    throw Napi::TypeError::New(info.Env(), "permanent must be a boolean");
+                permanent = options.Get("permanent").As<Napi::Boolean>().Value();
+            }
+            const auto operation = state_->nextOperation++;
+            auto deferred = Napi::Promise::Deferred::New(info.Env());
+            state_->operations.emplace(operation, PendingOperation {deferred, false, {}, {}, {}});
+            const std::weak_ptr<RunnerState> state = state_;
+            try {
+                dht::DoneCallbackSimple done = [state, operation](bool ok) {
+                    if (const auto owner = state.lock())
+                        owner->send([operation, ok](RunnerState& state) { state.completeOperation(operation, ok); });
+                };
+                if (mode == PutMode::Signed)
+                    state_->runner.putSigned(key, value, std::move(done), permanent);
+                else if (mode == PutMode::Encrypted)
+                    state_->runner.putEncrypted(key, recipient, value, std::move(done), permanent);
+                else
+                    state_->runner.put(key, value, std::move(done), dht::time_point::max(), permanent);
+            } catch (...) {
+                state_->operations.erase(operation);
+                throw;
+            }
+            return deferred.Promise();
+        });
+    }
+
+    Napi::Value listen(const Napi::CallbackInfo& info)
+    {
+        return guarded(info, [&]() -> Napi::Value {
+            state_->requireRunning();
+            const auto key = infoHash(info[0]);
+            if (!info[1].IsFunction())
+                throw Napi::TypeError::New(info.Env(), "callback must be a function");
+            const auto operation = state_->nextOperation++;
+            const std::weak_ptr<RunnerState> state = state_;
+            auto token = state_->runner
+                             .listen(key,
+                                     dht::ValueCallback(
+                                         [state, operation](const std::vector<std::shared_ptr<dht::Value>>& values,
+                                                            bool expired) {
+                                             const auto owner = state.lock();
+                                             if (!owner || owner->closing)
+                                                 return false;
+                                             for (const auto& value : values)
+                                                 owner->sendValue(operation, value, expired);
+                                             return !owner->closing;
+                                         }))
+                             .share();
+            state_->listeners.emplace(operation,
+                                      Subscription {key,
+                                                    std::move(token),
+                                                    Napi::Persistent(info[1].As<Napi::Function>())});
+            return Napi::BigInt::New(info.Env(), operation);
+        });
+    }
+
+    Napi::Value cancelListen(const Napi::CallbackInfo& info)
+    {
+        return guarded(info, [&]() -> Napi::Value {
+            if (state_->closing)
+                return info.Env().Undefined();
+            const auto listener = state_->listeners.find(unsignedBigInt(info[0]));
+            if (listener != state_->listeners.end()) {
+                state_->runner.cancelListen(listener->second.key, listener->second.token);
+                state_->listeners.erase(listener);
+            }
+            return info.Env().Undefined();
+        });
+    }
+
+    Napi::Value ref(const Napi::CallbackInfo& info)
+    {
+        return guarded(info, [&]() -> Napi::Value {
+            state_->requireRunning();
+            state_->dispatcher.Ref(info.Env());
+            return info.This();
+        });
+    }
+
+    Napi::Value unref(const Napi::CallbackInfo& info)
+    {
+        return guarded(info, [&]() -> Napi::Value {
+            state_->requireRunning();
+            state_->dispatcher.Unref(info.Env());
+            return info.This();
+        });
+    }
+
+    Napi::Value setOwner(const Napi::CallbackInfo& info)
+    {
+        if (!state_->closing) {
+            state_->owner.Reset();
+            if (info[0].IsObject())
+                state_->owner = Napi::Persistent(info[0].As<Napi::Object>());
+        }
+        return info.Env().Undefined();
+    }
+
+    std::shared_ptr<RunnerState> state_;
+};
+
+Napi::Value
+hash(const Napi::CallbackInfo& info)
+{
+    const auto env = info.Env();
+    dht::InfoHash result;
+    if (info.Length() == 1 && info[0].IsString()) {
+        result = dht::InfoHash::get(info[0].As<Napi::String>().Utf8Value());
+    } else if (info.Length() == 1 && info[0].IsTypedArray()
+               && info[0].As<Napi::TypedArray>().TypedArrayType() == napi_uint8_array) {
+        const auto data = info[0].As<Napi::Uint8Array>();
+        result = dht::InfoHash::get(data.Data(), data.ElementLength());
+    } else {
+        throw Napi::TypeError::New(env, "Expected a string or Uint8Array");
+    }
+    return Napi::String::New(env, result.to_view());
+}
+
+Napi::Object
+initialize(Napi::Env env, Napi::Object exports)
+{
+    static const GnuTlsContext crypto;
+    if (crypto.result != GNUTLS_E_SUCCESS)
+        throw Napi::Error::New(env, std::string("Unable to initialize GnuTLS: ") + gnutls_strerror(crypto.result));
+    opendht_node::initializeCrypto(env, exports);
+    exports.Set("NativeRunner", Runner::define(env));
+    exports.Set("hash", Napi::Function::New(env, hash));
+    exports.Set("version", Napi::String::New(env, dht::version()));
+    return exports;
+}
+
+} // namespace
+
+NODE_API_MODULE(opendht, initialize)
@@ -0,0 +1,304 @@
+#include "crypto.h"
+
+#include <algorithm>
+#include <cmath>
+#include <variant>
+
+namespace opendht_node {
+namespace {
+
+using PublicKey = std::shared_ptr<dht::crypto::PublicKey>;
+using PrivateKey = std::shared_ptr<dht::crypto::PrivateKey>;
+using Certificate = std::shared_ptr<dht::crypto::Certificate>;
+using Identity = dht::crypto::Identity;
+using Handle = std::variant<PublicKey, PrivateKey, Certificate, Identity>;
+
+constexpr napi_type_tag cryptoTag {0x37cdf3e4648e4cb5ULL, 0x964fb031062c245aULL};
+
+Handle&
+handle(Napi::Value value)
+{
+    bool matches = false;
+    if (!value.IsExternal() || napi_check_object_type_tag(value.Env(), value, &cryptoTag, &matches) != napi_ok
+        || !matches)
+        throw Napi::TypeError::New(value.Env(), "Invalid OpenDHT crypto handle");
+    return *value.As<Napi::External<Handle>>().Data();
+}
+
+template<typename Type>
+Type
+read(Napi::Value value)
+{
+    if (auto result = std::get_if<Type>(&handle(value)))
+        return *result;
+    throw Napi::TypeError::New(value.Env(), "Wrong OpenDHT crypto handle type");
+}
+
+Napi::Value
+wrap(Napi::Env env, Handle value)
+{
+    auto owner = std::make_unique<Handle>(std::move(value));
+    auto result = Napi::External<Handle>::New(env, owner.get(), [](Napi::Env, Handle* data) { delete data; });
+    owner.release();
+    if (napi_type_tag_object(env, result, &cryptoTag) != napi_ok)
+        throw Napi::Error::New(env, "Could not tag OpenDHT crypto handle");
+    return result;
+}
+
+dht::Blob
+bytes(Napi::Value value)
+{
+    if (!value.IsTypedArray() || value.As<Napi::TypedArray>().TypedArrayType() != napi_uint8_array)
+        throw Napi::TypeError::New(value.Env(), "Expected a Uint8Array");
+    auto array = value.As<Napi::Uint8Array>();
+    dht::Blob result(array.ElementLength());
+    if (!result.empty())
+        std::copy_n(array.Data(), result.size(), result.data());
+    return result;
+}
+
+std::string
+string(Napi::Value value)
+{
+    if (!value.IsString())
+        throw Napi::TypeError::New(value.Env(), "Expected a string");
+    auto result = value.As<Napi::String>().Utf8Value();
+    if (result.find('\0') != std::string::npos)
+        throw Napi::TypeError::New(value.Env(), "Crypto strings must not contain NUL bytes");
+    return result;
+}
+
+Napi::Buffer<uint8_t>
+buffer(Napi::Env env, const dht::Blob& value)
+{
+    return Napi::Buffer<uint8_t>::Copy(env, value.data(), value.size());
+}
+
+PublicKey
+publicKey(const Handle& value)
+{
+    if (auto key = std::get_if<PublicKey>(&value))
+        return *key;
+    if (auto key = std::get_if<PrivateKey>(&value))
+        return (*key)->getSharedPublicKey();
+    if (auto certificate = std::get_if<Certificate>(&value))
+        return (*certificate)->getSharedPublicKey();
+    return std::get<Identity>(value).second->getSharedPublicKey();
+}
+
+class GenerateWorker : public Napi::AsyncWorker
+{
+public:
+    GenerateWorker(Napi::Env env, bool identity, std::string name, bool rsa, unsigned bits)
+        : Napi::AsyncWorker(env, "OpenDHT crypto generation")
+        , deferred_(Napi::Promise::Deferred::New(env))
+        , identity_(identity)
+        , name_(std::move(name))
+        , rsa_(rsa)
+        , bits_(bits)
+    {}
+
+    Napi::Promise promise() const { return deferred_.Promise(); }
+
+    void Execute() override
+    {
+        try {
+            if (identity_)
+                result_ = rsa_ ? dht::crypto::generateIdentity(name_, {}, bits_)
+                               : dht::crypto::generateEcIdentity(name_);
+            else
+                result_ = std::make_shared<dht::crypto::PrivateKey>(rsa_ ? dht::crypto::PrivateKey::generate(bits_)
+                                                                         : dht::crypto::PrivateKey::generateEC());
+        } catch (const std::exception& error) {
+            SetError(error.what());
+        }
+    }
+
+    void OnOK() override { deferred_.Resolve(wrap(Env(), std::move(result_))); }
+    void OnError(const Napi::Error& error) override { deferred_.Reject(error.Value()); }
+
+private:
+    Napi::Promise::Deferred deferred_;
+    bool identity_;
+    std::string name_;
+    bool rsa_;
+    unsigned bits_;
+    Handle result_;
+};
+
+Napi::Value
+generate(const Napi::CallbackInfo& info)
+{
+    return guarded(info, [&]() -> Napi::Value {
+        const auto kind = string(info[0]);
+        const auto name = string(info[1]);
+        const auto algorithm = string(info[2]);
+        if (algorithm != "rsa" && algorithm != "ec")
+            throw Napi::TypeError::New(info.Env(), "algorithm must be rsa or ec");
+        if (!info[3].IsNumber())
+            throw Napi::TypeError::New(info.Env(), "bits must be a number");
+        const auto bits = info[3].As<Napi::Number>().DoubleValue();
+        if (!std::isfinite(bits) || std::floor(bits) != bits || bits < 2048 || bits > 8192)
+            throw Napi::RangeError::New(info.Env(), "RSA bits must be an integer between 2048 and 8192");
+        if (kind != "private" && kind != "identity")
+            throw Napi::TypeError::New(info.Env(), "Invalid crypto generation type");
+        auto worker = std::make_unique<GenerateWorker>(info.Env(), kind == "identity", name, algorithm == "rsa", bits);
+        auto promise = worker->promise();
+        worker->Queue();
+        worker.release();
+        return promise;
+    });
+}
+
+Napi::Value
+import(const Napi::CallbackInfo& info)
+{
+    return guarded(info, [&]() -> Napi::Value {
+        const auto kind = string(info[0]);
+        auto data = bytes(info[1]);
+        if (data.empty())
+            throw Napi::TypeError::New(info.Env(), "Crypto imports must not be empty");
+        if (kind == "private")
+            return wrap(info.Env(), std::make_shared<dht::crypto::PrivateKey>(data, string(info[2])));
+        if (kind == "public")
+            return wrap(info.Env(), std::make_shared<dht::crypto::PublicKey>(data));
+        if (kind == "certificate")
+            return wrap(info.Env(), std::make_shared<dht::crypto::Certificate>(data));
+        throw Napi::TypeError::New(info.Env(), "Invalid crypto import type");
+    });
+}
+
+Napi::Value
+serialize(const Napi::CallbackInfo& info)
+{
+    return guarded(info, [&]() -> Napi::Value {
+        auto& value = handle(info[0]);
+        if (auto key = std::get_if<PrivateKey>(&value))
+            return buffer(info.Env(), (*key)->serialize(string(info[1])));
+        if (auto certificate = std::get_if<Certificate>(&value))
+            return buffer(info.Env(), (*certificate)->getPacked());
+        dht::Blob result;
+        readPublicKey(info[0])->pack(result);
+        return buffer(info.Env(), result);
+    });
+}
+
+Napi::Value
+getPublicKey(const Napi::CallbackInfo& info)
+{
+    return guarded(info, [&] { return wrap(info.Env(), publicKey(handle(info[0]))); });
+}
+
+Napi::Value
+getId(const Napi::CallbackInfo& info)
+{
+    return guarded(info, [&]() -> Napi::Value {
+        const auto key = publicKey(handle(info[0]));
+        if (!info[1].IsBoolean())
+            throw Napi::TypeError::New(info.Env(), "Expected a boolean");
+        return Napi::String::New(info.Env(),
+                                 info[1].As<Napi::Boolean>().Value() ? key->getLongId().toString()
+                                                                     : key->getId().toString());
+    });
+}
+
+Napi::Value
+sign(const Napi::CallbackInfo& info)
+{
+    return guarded(info, [&]() -> Napi::Value {
+        return buffer(info.Env(), read<PrivateKey>(info[0])->sign(bytes(info[1])));
+    });
+}
+
+Napi::Value
+verify(const Napi::CallbackInfo& info)
+{
+    return guarded(info, [&]() -> Napi::Value {
+        return Napi::Boolean::New(info.Env(), readPublicKey(info[0])->checkSignature(bytes(info[1]), bytes(info[2])));
+    });
+}
+
+Napi::Value
+encrypt(const Napi::CallbackInfo& info)
+{
+    return guarded(info, [&]() -> Napi::Value {
+        const auto key = readEncryptionKey(info[0]);
+        return buffer(info.Env(), key->encrypt(bytes(info[1])));
+    });
+}
+
+Napi::Value
+decrypt(const Napi::CallbackInfo& info)
+{
+    return guarded(info, [&]() -> Napi::Value {
+        return buffer(info.Env(), read<PrivateKey>(info[0])->decrypt(bytes(info[1])));
+    });
+}
+
+Napi::Value
+identity(const Napi::CallbackInfo& info)
+{
+    return guarded(info, [&]() -> Napi::Value {
+        auto key = read<PrivateKey>(info[0]);
+        auto certificate = read<Certificate>(info[1]);
+        if (key->getPublicKey().getLongId() != certificate->getLongId())
+            throw Napi::TypeError::New(info.Env(), "Identity key and certificate do not match");
+        return wrap(info.Env(), Identity {std::move(key), std::move(certificate)});
+    });
+}
+
+Napi::Value
+identityPart(const Napi::CallbackInfo& info)
+{
+    return guarded(info, [&]() -> Napi::Value {
+        const auto value = readIdentity(info[0]);
+        if (!info[1].IsBoolean())
+            throw Napi::TypeError::New(info.Env(), "Expected a boolean");
+        return info[1].As<Napi::Boolean>().Value() ? wrap(info.Env(), value.first) : wrap(info.Env(), value.second);
+    });
+}
+
+} // namespace
+
+dht::crypto::Identity
+readIdentity(Napi::Value value)
+{
+    return read<Identity>(value);
+}
+std::shared_ptr<dht::crypto::PublicKey>
+readPublicKey(Napi::Value value)
+{
+    return read<PublicKey>(value);
+}
+
+std::shared_ptr<dht::crypto::PublicKey>
+readEncryptionKey(Napi::Value value)
+{
+    const auto key = readPublicKey(value);
+    const auto algorithm = gnutls_pubkey_get_pk_algorithm(key->pk, nullptr);
+    if (algorithm != GNUTLS_PK_RSA
+#if GNUTLS_VERSION_NUMBER >= 0x030804
+        && algorithm != GNUTLS_PK_RSA_OAEP
+#endif
+    )
+        throw Napi::TypeError::New(value.Env(), "Encryption requires an RSA public key");
+    return key;
+}
+
+void
+initializeCrypto(Napi::Env env, Napi::Object exports)
+{
+    exports.Set("cryptoGenerate", Napi::Function::New(env, generate));
+    exports.Set("cryptoImport", Napi::Function::New(env, import));
+    exports.Set("cryptoSerialize", Napi::Function::New(env, serialize));
+    exports.Set("cryptoPublicKey", Napi::Function::New(env, getPublicKey));
+    exports.Set("cryptoId", Napi::Function::New(env, getId));
+    exports.Set("cryptoSign", Napi::Function::New(env, sign));
+    exports.Set("cryptoVerify", Napi::Function::New(env, verify));
+    exports.Set("cryptoEncrypt", Napi::Function::New(env, encrypt));
+    exports.Set("cryptoDecrypt", Napi::Function::New(env, decrypt));
+    exports.Set("cryptoIdentity", Napi::Function::New(env, identity));
+    exports.Set("cryptoIdentityPart", Napi::Function::New(env, identityPart));
+}
+
+} // namespace opendht_node
@@ -0,0 +1,26 @@
+#pragma once
+
+#include <napi.h>
+#include <opendht/crypto.h>
+
+namespace opendht_node {
+
+template<typename Callback>
+Napi::Value
+guarded(const Napi::CallbackInfo& info, Callback&& callback)
+{
+    try {
+        return callback();
+    } catch (const Napi::Error&) {
+        throw;
+    } catch (const std::exception& error) {
+        throw Napi::Error::New(info.Env(), error.what());
+    }
+}
+
+dht::crypto::Identity readIdentity(Napi::Value value);
+std::shared_ptr<dht::crypto::PublicKey> readPublicKey(Napi::Value value);
+std::shared_ptr<dht::crypto::PublicKey> readEncryptionKey(Napi::Value value);
+void initializeCrypto(Napi::Env env, Napi::Object exports);
+
+} // namespace opendht_node
@@ -0,0 +1,56 @@
+export default function createCrypto(native) {
+    const handles = new WeakMap();
+
+    function handle(value, Type) {
+        if (!(value instanceof Type) || !handles.has(value)) throw new TypeError(`Expected ${Type.name}`);
+        return handles.get(value);
+    }
+
+    function wrap(Type, nativeHandle) {
+        const result = Object.create(Type.prototype);
+        handles.set(result, nativeHandle);
+        return result;
+    }
+
+    function generate(kind, name, options = {}) {
+        if (!options || typeof options !== 'object' || Array.isArray(options)) throw new TypeError('Invalid crypto options');
+        return native.cryptoGenerate(kind, name, options.algorithm ?? 'ec', options.bits ?? 2048);
+    }
+
+    class PublicKey {
+        constructor(data) { handles.set(this, native.cryptoImport('public', data)); }
+        serialize() { return native.cryptoSerialize(handle(this, PublicKey)); }
+        getId() { return native.cryptoId(handle(this, PublicKey), false); }
+        getLongId() { return native.cryptoId(handle(this, PublicKey), true); }
+        checkSignature(data, signature) { return native.cryptoVerify(handle(this, PublicKey), data, signature); }
+        encrypt(data) { return native.cryptoEncrypt(handle(this, PublicKey), data); }
+    }
+
+    class PrivateKey {
+        constructor(data, password = '') { handles.set(this, native.cryptoImport('private', data, password)); }
+        static generate(options) { return generate('private', '', options).then(value => wrap(PrivateKey, value)); }
+        serialize(password = '') { return native.cryptoSerialize(handle(this, PrivateKey), password); }
+        getPublicKey() { return wrap(PublicKey, native.cryptoPublicKey(handle(this, PrivateKey))); }
+        sign(data) { return native.cryptoSign(handle(this, PrivateKey), data); }
+        decrypt(data) { return native.cryptoDecrypt(handle(this, PrivateKey), data); }
+    }
+
+    class Certificate {
+        constructor(data) { handles.set(this, native.cryptoImport('certificate', data)); }
+        serialize() { return native.cryptoSerialize(handle(this, Certificate)); }
+        getPublicKey() { return wrap(PublicKey, native.cryptoPublicKey(handle(this, Certificate))); }
+        getId() { return native.cryptoId(handle(this, Certificate), false); }
+        getLongId() { return native.cryptoId(handle(this, Certificate), true); }
+    }
+
+    class Identity {
+        constructor(privateKey, certificate) {
+            handles.set(this, native.cryptoIdentity(handle(privateKey, PrivateKey), handle(certificate, Certificate)));
+        }
+        static generate(name = 'dhtnode', options) { return generate('identity', name, options).then(value => wrap(Identity, value)); }
+        get privateKey() { return wrap(PrivateKey, native.cryptoIdentityPart(handle(this, Identity), true)); }
+        get certificate() { return wrap(Certificate, native.cryptoIdentityPart(handle(this, Identity), false)); }
+    }
+
+    return { PublicKey, PrivateKey, Certificate, Identity, handle };
+}
@@ -0,0 +1,171 @@
+#!/usr/bin/env node
+
+import { clearLine, createInterface, cursorTo, type Interface } from 'node:readline';
+import { parseArgs } from 'node:util';
+import type { ConnectivityStatus, Listener, Value } from '../index.js';
+
+const commands = 'get KEY | put KEY TEXT | sign KEY TEXT | listen KEY | cancel KEY | help | quit';
+
+function portNumber(value: string, name: string, minimum = 0): number {
+    const port = Number(value);
+    if (!Number.isInteger(port) || port < minimum || port > 65535) {
+        throw new Error(`${name} must be an integer between ${minimum} and 65535`);
+    }
+    return port;
+}
+
+function errorMessage(error: unknown): string {
+    return error instanceof Error ? error.message : String(error);
+}
+
+function report(error: unknown): void {
+    console.error(errorMessage(error));
+    process.exitCode = 1;
+}
+
+async function main(): Promise<void> {
+    const { values } = parseArgs({
+        options: {
+            help: { type: 'boolean', short: 'h' },
+            port: { type: 'string', short: 'p', default: '4222' },
+            ipv4: { type: 'string', default: '0.0.0.0' },
+            ipv6: { type: 'string', default: '::' },
+            bootstrap: { type: 'string', short: 'b' },
+            'bootstrap-port': { type: 'string', default: '4222' },
+        },
+    });
+    if (values.help) {
+        console.log(`Usage: npm run dhtnode -- [options]
+
+  -p, --port PORT           Local UDP port (default: 4222; 0 selects a free port)
+  -b, --bootstrap HOST      Optional bootstrap hostname or IP address
+      --bootstrap-port PORT  Bootstrap UDP port (default: 4222)
+      --ipv4 ADDRESS       IPv4 bind address (default: 0.0.0.0)
+      --ipv6 ADDRESS       IPv6 bind address (default: ::)
+  -h, --help               Show help
+
+Commands: ${commands}
+Keys are text labels hashed with SHA-1. Values are UTF-8 text.`);
+        return;
+    }
+    const port = portNumber(values.port, 'port');
+    const bootstrapPort = portNumber(values['bootstrap-port'], 'bootstrap-port', 1);
+    const { DhtRunner, Identity, hash } = await import('../index.js');
+    const identity = await Identity.generate('dhtnode.ts');
+    const runner = new DhtRunner();
+    const listeners = new Map<string, Listener>();
+    const pending = new Set<Promise<void>>();
+    let lines: Interface | undefined;
+    let closing: Promise<void> | undefined;
+
+    function close(): Promise<void> {
+        if (!closing) {
+            for (const listener of listeners.values()) listener.cancel();
+            listeners.clear();
+            lines?.close();
+            closing = runner.close();
+        }
+        return closing;
+    }
+
+    function print(message: string): void {
+        if (process.stdout.isTTY && lines) {
+            clearLine(process.stdout, 0);
+            cursorTo(process.stdout, 0);
+        }
+        console.log(message);
+        if (!closing && process.stdin.isTTY) lines?.prompt(true);
+    }
+
+    const stop = (): void => { close().catch(report); };
+    const printValue = (label: string, value: Value): void => {
+        print(`${label} ${value.id}: ${JSON.stringify(value.data.toString('utf8'))}${value.isSigned ? ' [signed]' : ''}`);
+    };
+    const printStatus = (status: ConnectivityStatus): void => {
+        print(`Connectivity: IPv4 ${status.ipv4}, IPv6 ${status.ipv6}`);
+    };
+
+    async function execute(line: string): Promise<void> {
+        const [, command, key, data] = line.trim().match(/^(\S+)(?:\s+(\S+))?(?:\s+(.+))?$/) || [];
+        if (!command) return;
+        if (command === 'help') {
+            print(commands);
+            return;
+        }
+        if (!key) throw new Error('Expected a key. Type help for commands.');
+        const location = hash(key);
+        switch (command) {
+            case 'get': {
+                const found = await runner.getAll(location);
+                if (closing) return;
+                for (const value of found) printValue(key, value);
+                if (!found.length) print(`No values for ${key}`);
+                break;
+            }
+            case 'put':
+            case 'sign': {
+                if (data === undefined) throw new Error(`Usage: ${command} KEY TEXT`);
+                const payload = Buffer.from(data, 'utf8');
+                const ok = command === 'sign' ? await runner.putSigned(location, payload)
+                    : await runner.put(location, payload);
+                if (closing) return;
+                if (!ok) throw new Error(`Put failed for ${key}`);
+                print(`Stored ${key}`);
+                break;
+            }
+            case 'listen':
+                if (!listeners.has(key)) {
+                    listeners.set(key, runner.listen(location, (value, expired) => {
+                        printValue(`${expired ? 'Expired' : 'Value'} ${key}`, value);
+                    }));
+                }
+                print(`Listening ${key}`);
+                break;
+            case 'cancel':
+                listeners.get(key)?.cancel();
+                listeners.delete(key);
+                print(`Cancelled ${key}`);
+                break;
+            default:
+                throw new Error('Unknown command. Type help for commands.');
+        }
+    }
+
+    runner.on('error', error => { report(error); stop(); });
+    runner.on('statusChanged', printStatus);
+    process.on('SIGINT', stop);
+    process.on('SIGTERM', stop);
+    try {
+        runner.run({ port, ipv4: values.ipv4, ipv6: values.ipv6, identity });
+        if (values.bootstrap) runner.bootstrap(values.bootstrap, bootstrapPort);
+        lines = createInterface({ input: process.stdin, output: process.stdout });
+        lines.on('SIGINT', stop);
+        lines.setPrompt('dht> ');
+        print(`Node ${runner.getNodeId()} listening on UDP ${runner.getBoundPort()}`);
+        printStatus(runner.getStatus());
+        if (process.stdin.isTTY) print(commands);
+        for await (const line of lines) {
+            if (closing) break;
+            if (/^(quit|exit)(?:\s|$)/.test(line.trim())) {
+                stop();
+                break;
+            }
+            const operation = execute(line).catch(error => {
+                if (!closing) console.error(errorMessage(error));
+            }).finally(() => { pending.delete(operation); });
+            pending.add(operation);
+            if (process.stdin.isTTY) lines.prompt();
+        }
+        if (!closing) await Promise.all(pending);
+    } finally {
+        try {
+            await close();
+            await Promise.all(pending);
+        } finally {
+            process.removeListener('SIGINT', stop);
+            process.removeListener('SIGTERM', stop);
+        }
+    }
+}
+
+main().catch(report);
@@ -0,0 +1,120 @@
+import { Buffer } from 'node:buffer';
+import { EventEmitter } from 'node:events';
+
+export const version: string;
+export function hash(data: string | Uint8Array): string;
+
+export interface KeyOptions {
+    algorithm?: 'ec' | 'rsa';
+    bits?: number;
+}
+
+export class PublicKey {
+    constructor(data: Uint8Array);
+    serialize(): Buffer;
+    getId(): string;
+    getLongId(): string;
+    checkSignature(data: Uint8Array, signature: Uint8Array): boolean;
+    encrypt(data: Uint8Array): Buffer;
+}
+
+export class PrivateKey {
+    constructor(data: Uint8Array, password?: string);
+    static generate(options?: KeyOptions): Promise<PrivateKey>;
+    serialize(password?: string): Buffer;
+    getPublicKey(): PublicKey;
+    sign(data: Uint8Array): Buffer;
+    decrypt(data: Uint8Array): Buffer;
+}
+
+export class Certificate {
+    constructor(data: Uint8Array);
+    serialize(): Buffer;
+    getPublicKey(): PublicKey;
+    getId(): string;
+    getLongId(): string;
+}
+
+export class Identity {
+    constructor(privateKey: PrivateKey, certificate: Certificate);
+    static generate(name?: string, options?: KeyOptions): Promise<Identity>;
+    readonly privateKey: PrivateKey;
+    readonly certificate: Certificate;
+}
+
+export interface RunOptions {
+    port?: number;
+    ipv4?: string;
+    ipv6?: string;
+    network?: number;
+    persistPath?: string;
+    identity?: Identity;
+    proxyServer?: string;
+    proxyUserAgent?: string;
+}
+
+export interface PutOptions {
+    id?: bigint;
+    type?: number;
+    userType?: string;
+    permanent?: boolean;
+}
+
+export interface Value {
+    id: bigint;
+    type: number;
+    seq: number;
+    data: Buffer;
+    userType: string;
+    owner: string | null;
+    isSigned: boolean;
+    isEncrypted: boolean;
+}
+
+export interface Listener {
+    cancel(): void;
+}
+
+export interface ListenEvent {
+    value: Value;
+    expired: boolean;
+}
+
+export interface ValueIterator<T> extends AsyncIterableIterator<T, undefined>, Listener, AsyncDisposable {
+    return(): Promise<IteratorResult<T, undefined>>;
+    throw(error?: unknown): Promise<IteratorResult<T, undefined>>;
+}
+
+export interface ListenerIterator extends ValueIterator<ListenEvent> { }
+
+export type NodeStatus = 'disconnected' | 'connecting' | 'connected';
+
+export interface ConnectivityStatus {
+    ipv4: NodeStatus;
+    ipv6: NodeStatus;
+}
+
+export interface RunnerEvents {
+    statusChanged: [status: ConnectivityStatus];
+    error: [error: Error];
+}
+
+export class DhtRunner extends EventEmitter<RunnerEvents> implements AsyncDisposable {
+    run(options?: RunOptions): void;
+    isRunning(): boolean;
+    getBoundPort(family?: 4 | 6): number;
+    getNodeId(): string;
+    getStatus(): ConnectivityStatus;
+    bootstrap(host: string, port: number): void;
+    get(key: string): ValueIterator<Value>;
+    getAll(key: string): Promise<Value[]>;
+    put(key: string, data: Uint8Array, options?: PutOptions): Promise<boolean>;
+    putSigned(key: string, data: Uint8Array, options?: PutOptions): Promise<boolean>;
+    putEncrypted(key: string, data: Uint8Array, recipient: PublicKey, options?: PutOptions): Promise<boolean>;
+    listen(key: string): ListenerIterator;
+    listen(key: string, callback: (value: Value, expired: boolean) => void): Listener;
+    close(): Promise<void>;
+    ref(): this;
+    unref(): this;
+    [Symbol.asyncDispose](): Promise<void>;
+}
@@ -0,0 +1,187 @@
+import { EventEmitter } from 'node:events';
+import { constants } from 'node:os';
+import { dlopen } from 'node:process';
+import load from 'node-gyp-build';
+import createCrypto from './crypto.js';
+
+const binding = { exports: {} };
+const flags = process.platform === 'linux'
+    ? constants.dlopen.RTLD_LAZY | constants.dlopen.RTLD_DEEPBIND
+    : undefined;
+dlopen(binding, process.env.OPENDHT_NODE_BINDING || load.path(import.meta.dirname),
+    flags);
+const native = binding.exports;
+const { PublicKey, PrivateKey, Certificate, Identity, handle } = createCrypto(native);
+
+function eventReporter(owner, event) {
+    return value => { owner.deref()?.emit(event, value); };
+}
+
+class DhtRunner extends EventEmitter {
+    #native;
+    #closing;
+    #listeners = 0;
+    #pending = 0;
+    #iterators = new Set();
+
+    constructor() {
+        super();
+        const owner = new WeakRef(this);
+        this.#native = new native.NativeRunner(eventReporter(owner, 'statusChanged'));
+    }
+
+    #updateOwner() {
+        this.#native.setOwner(this.#listeners || this.#pending || this.listenerCount('statusChanged') ? this : null);
+    }
+
+    #track(operation) {
+        this.#pending++;
+        this.#updateOwner();
+        return operation.finally(() => {
+            this.#pending--;
+            this.#updateOwner();
+        });
+    }
+
+    on(event, listener) { super.on(event, listener); this.#updateOwner(); return this; }
+    addListener(event, listener) { return this.on(event, listener); }
+    prependListener(event, listener) { super.prependListener(event, listener); this.#updateOwner(); return this; }
+    removeListener(event, listener) { super.removeListener(event, listener); this.#updateOwner(); return this; }
+    off(event, listener) { return this.removeListener(event, listener); }
+    removeAllListeners(...args) { super.removeAllListeners(...args); this.#updateOwner(); return this; }
+
+    run(options) {
+        if (typeof options?.proxyServer === 'string' && options.proxyServer) {
+            const proxy = new URL(options.proxyServer);
+            if (proxy.protocol !== 'http:' && proxy.protocol !== 'https:')
+                throw new TypeError('proxyServer must be an HTTP(S) URL');
+        }
+        if (options?.identity !== undefined) options = { ...options, identity: handle(options.identity, Identity) };
+        this.#native.run(options);
+    }
+    isRunning() { return this.#native.isRunning(); }
+    getBoundPort(family = 4) { return this.#native.getBoundPort(family); }
+    getNodeId() { return this.#native.getNodeId(); }
+    getStatus() { return this.#native.getStatus(); }
+    bootstrap(host, port) { this.#native.bootstrap(host, port); }
+    get(key) {
+        return this.#iterate((push, finish) => {
+            const operation = this.#native.get(key, push);
+            this.#track(operation.done).then(() => finish(), finish);
+            return () => this.#native.cancelGet(operation.token);
+        }, true);
+    }
+    getAll(key) { return this.#track(this.#native.getAll(key)); }
+    put(key, data, options) { return this.#track(this.#native.put(key, data, options)); }
+    putSigned(key, data, options) { return this.#track(this.#native.putSigned(key, data, options)); }
+    putEncrypted(key, data, recipient, options) {
+        return this.#track(this.#native.putEncrypted(key, data, options, handle(recipient, PublicKey)));
+    }
+
+    listen(key, callback) {
+        if (callback === undefined) {
+            return this.#iterate(push => {
+                const subscription = this.listen(key, (value, expired) => push({ value, expired }));
+                return () => subscription.cancel();
+            });
+        }
+        const token = this.#native.listen(key, callback);
+        this.#listeners++;
+        this.#updateOwner();
+        let cancelled = false;
+        return {
+            cancel: () => {
+                if (cancelled) return;
+                this.#native.cancelListen(token);
+                cancelled = true;
+                this.#listeners--;
+                this.#updateOwner();
+            },
+        };
+    }
+
+    #iterate(subscribe, rejectOnClose = false) {
+        let values = [];
+        let offset = 0;
+        const pending = [];
+        let done = false;
+        let failure;
+        const finish = error => {
+            if (done) return;
+            done = true;
+            failure = error;
+            unsubscribe();
+            this.#iterators.delete(onClose);
+            if (failure) {
+                values = [];
+                offset = 0;
+            }
+            for (const { resolve, reject } of pending.splice(0)) {
+                if (failure) reject(failure);
+                else resolve({ value: undefined, done: true });
+            }
+        };
+        const cancel = () => {
+            values = [];
+            offset = 0;
+            failure = undefined;
+            finish();
+        };
+        const onClose = () => {
+            if (rejectOnClose) {
+                const error = new Error('DHT runner is closed');
+                error.code = 'ERR_DHT_CLOSED';
+                finish(error);
+            } else cancel();
+        };
+        const unsubscribe = subscribe(value => {
+            if (done) return;
+            const waiter = pending.shift();
+            if (waiter) waiter.resolve({ value, done: false });
+            else values.push(value);
+        }, finish);
+        this.#iterators.add(onClose);
+        return {
+            next() {
+                if (failure) return Promise.reject(failure);
+                if (offset < values.length) {
+                    const value = values[offset];
+                    values[offset++] = undefined;
+                    if (offset === values.length) {
+                        values = [];
+                        offset = 0;
+                    }
+                    return Promise.resolve({ value, done: false });
+                }
+                if (done) return Promise.resolve({ value: undefined, done: true });
+                return new Promise((resolve, reject) => pending.push({ resolve, reject }));
+            },
+            return() {
+                cancel();
+                return Promise.resolve({ value: undefined, done: true });
+            },
+            throw(error) {
+                cancel();
+                return Promise.reject(error);
+            },
+            cancel,
+            [Symbol.asyncIterator]() { return this; },
+            [Symbol.asyncDispose]() { cancel(); return Promise.resolve(); },
+        };
+    }
+
+    close() {
+        if (!this.#closing) {
+            this.#closing = this.#native.close();
+            for (const cancel of this.#iterators) cancel();
+        }
+        return this.#closing;
+    }
+    ref() { this.#native.ref(); return this; }
+    unref() { this.#native.unref(); return this; }
+    [Symbol.asyncDispose]() { return this.close(); }
+}
+
+export { DhtRunner, PublicKey, PrivateKey, Certificate, Identity };
+export const hash = native.hash;
+export const version = native.version;
@@ -0,0 +1,904 @@
+{
+    "name": "opendht",
+    "version": "0.1.0",
+    "lockfileVersion": 3,
+    "requires": true,
+    "packages": {
+        "": {
+            "name": "opendht",
+            "version": "0.1.0",
+            "license": "MIT",
+            "dependencies": {
+                "node-gyp-build": "^4.8.4"
+            },
+            "devDependencies": {
+                "@types/node": "^22.20.5",
+                "cmake-js": "^8.0.0",
+                "node-addon-api": "^8.5.0",
+                "typescript": "^7.0.2"
+            },
+            "engines": {
+                "node": ">=22.9.0"
+            }
+        },
+        "node_modules/@isaacs/fs-minipass": {
+            "version": "4.0.1",
+            "resolved": "https://registry.npmjs.org/@isaacs/fs-minipass/-/fs-minipass-4.0.1.tgz",
+            "integrity": "sha512-wgm9Ehl2jpeqP3zw/7mo3kRHFp5MEDhqAdwy1fTGkHAwnkGOVsgpvQhL8B5n1qlb01jV3n/bI0ZfZp5lWA1k4w==",
+            "dev": true,
+            "license": "ISC",
+            "dependencies": {
+                "minipass": "^7.0.4"
+            },
+            "engines": {
+                "node": ">=18.0.0"
+            }
+        },
+        "node_modules/@types/node": {
+            "version": "22.20.5",
+            "resolved": "https://registry.npmjs.org/@types/node/-/node-22.20.5.tgz",
+            "integrity": "sha512-U2+DNr+wSjpsTS/wZGYHq7GcwfuSmKiKvoPvK22zwTlRhU91yOniN4qRR5KhIjvif7ysw/dz/hKmfDH0Ris4aA==",
+            "dev": true,
+            "license": "MIT",
+            "dependencies": {
+                "undici-types": "~6.21.0"
+            }
+        },
+        "node_modules/@typescript/typescript-aix-ppc64": {
+            "version": "7.0.2",
+            "resolved": "https://registry.npmjs.org/@typescript/typescript-aix-ppc64/-/typescript-aix-ppc64-7.0.2.tgz",
+            "integrity": "sha512-MTKKkWB7p/0E9xi1d1tHtZ5PiLkGEMIq88pK2CubZjOsLtYTLqhgIgi6zepFa+9GHZ6h05NMCkQxGKiPXMxXtQ==",
+            "cpu": [
+                "ppc64"
+            ],
+            "dev": true,
+            "license": "Apache-2.0",
+            "optional": true,
+            "os": [
+                "aix"
+            ],
+            "engines": {
+                "node": ">=16.20.0"
+            }
+        },
+        "node_modules/@typescript/typescript-darwin-arm64": {
+            "version": "7.0.2",
+            "resolved": "https://registry.npmjs.org/@typescript/typescript-darwin-arm64/-/typescript-darwin-arm64-7.0.2.tgz",
+            "integrity": "sha512-gowzar9MwS/aRWp6f3a4KUqzRjAZjOsmGNCM6LcTgXum+dBfgsBVMN+AgvOCCbguXyick6LJhpBszxMebJ8syA==",
+            "cpu": [
+                "arm64"
+            ],
+            "dev": true,
+            "license": "Apache-2.0",
+            "optional": true,
+            "os": [
+                "darwin"
+            ],
+            "engines": {
+                "node": ">=16.20.0"
+            }
+        },
+        "node_modules/@typescript/typescript-darwin-x64": {
+            "version": "7.0.2",
+            "resolved": "https://registry.npmjs.org/@typescript/typescript-darwin-x64/-/typescript-darwin-x64-7.0.2.tgz",
+            "integrity": "sha512-SZ9xZInqApNlNGc9s0W1VSsktYSOe9cFqNOIqmN1Gs8SmkjKZYFt017G4VwPxASInODuAdbTW7sXiFUf893RgA==",
+            "cpu": [
+                "x64"
+            ],
+            "dev": true,
+            "license": "Apache-2.0",
+            "optional": true,
+            "os": [
+                "darwin"
+            ],
+            "engines": {
+                "node": ">=16.20.0"
+            }
+        },
+        "node_modules/@typescript/typescript-freebsd-arm64": {
+            "version": "7.0.2",
+            "resolved": "https://registry.npmjs.org/@typescript/typescript-freebsd-arm64/-/typescript-freebsd-arm64-7.0.2.tgz",
+            "integrity": "sha512-W5NH4y/J0plIIS5b2xvTEkU7JFxyqdMAOgf+Ilhl0vHQXKO5dZoxd+C/jEtq56c4F3wk71RB4BMRQ2XdI+bwYQ==",
+            "cpu": [
+                "arm64"
+            ],
+            "dev": true,
+            "license": "Apache-2.0",
+            "optional": true,
+            "os": [
+                "freebsd"
+            ],
+            "engines": {
+                "node": ">=16.20.0"
+            }
+        },
+        "node_modules/@typescript/typescript-freebsd-x64": {
+            "version": "7.0.2",
+            "resolved": "https://registry.npmjs.org/@typescript/typescript-freebsd-x64/-/typescript-freebsd-x64-7.0.2.tgz",
+            "integrity": "sha512-UMGDx5sTpzNw3WiPebH7l90IWfJggEd+egHt/q6p7/Cm3zqoV7VxkGXt+3DxPIw8CcmvAB0j3sVVfbhX+M4Tpw==",
+            "cpu": [
+                "x64"
+            ],
+            "dev": true,
+            "license": "Apache-2.0",
+            "optional": true,
+            "os": [
+                "freebsd"
+            ],
+            "engines": {
+                "node": ">=16.20.0"
+            }
+        },
+        "node_modules/@typescript/typescript-linux-arm": {
+            "version": "7.0.2",
+            "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-arm/-/typescript-linux-arm-7.0.2.tgz",
+            "integrity": "sha512-gffT3xPz9sR7j/YJExkyPntrI0P2EP9XbOyWzth2/Gs0RstK+90RBcO0ncXoXy/beYll1SXw846Nf2zdnEz0QQ==",
+            "cpu": [
+                "arm"
+            ],
+            "dev": true,
+            "license": "Apache-2.0",
+            "optional": true,
+            "os": [
+                "linux"
+            ],
+            "engines": {
+                "node": ">=16.20.0"
+            }
+        },
+        "node_modules/@typescript/typescript-linux-arm64": {
+            "version": "7.0.2",
+            "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-arm64/-/typescript-linux-arm64-7.0.2.tgz",
+            "integrity": "sha512-Qh4eU4/y3yDjnfjjyPYihMj5/ODIlmt+Bzu17OI+fiSRDW57QmU5SiN63exPRNJPKUzcc1INa1NXdrJ+MqHjUQ==",
+            "cpu": [
+                "arm64"
+            ],
+            "dev": true,
+            "license": "Apache-2.0",
+            "optional": true,
+            "os": [
+                "linux"
+            ],
+            "engines": {
+                "node": ">=16.20.0"
+            }
+        },
+        "node_modules/@typescript/typescript-linux-loong64": {
+            "version": "7.0.2",
+            "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-loong64/-/typescript-linux-loong64-7.0.2.tgz",
+            "integrity": "sha512-uEHck9i8hoAzXPiYRib1O7miOnz23SxIeVl6F4LXox+qov1K35jHcEW6VHKvZI+pyvl7fZEP4MCU5LYvIq1GuQ==",
+            "cpu": [
+                "loong64"
+            ],
+            "dev": true,
+            "license": "Apache-2.0",
+            "optional": true,
+            "os": [
+                "linux"
+            ],
+            "engines": {
+                "node": ">=16.20.0"
+            }
+        },
+        "node_modules/@typescript/typescript-linux-mips64el": {
+            "version": "7.0.2",
+            "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-mips64el/-/typescript-linux-mips64el-7.0.2.tgz",
+            "integrity": "sha512-R4KvAMnE43W5Qeqb0Ly56O3mWMWIAgsMyz36DCaycd5nbg/9kzm0liw3JocfRqyJY0KPmzFjbswozXyW0DnIYA==",
+            "cpu": [
+                "mips64el"
+            ],
+            "dev": true,
+            "license": "Apache-2.0",
+            "optional": true,
+            "os": [
+                "linux"
+            ],
+            "engines": {
+                "node": ">=16.20.0"
+            }
+        },
+        "node_modules/@typescript/typescript-linux-ppc64": {
+            "version": "7.0.2",
+            "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-ppc64/-/typescript-linux-ppc64-7.0.2.tgz",
+            "integrity": "sha512-DORx5b3sd/4S7eayxm4FQv+A7CrkUIGRaHiwI8oiHTAI1fAPWhF4J0vAlkC8biAlHSVVwxMQ3tjZ2/DVbnQiiA==",
+            "cpu": [
+                "ppc64"
+            ],
+            "dev": true,
+            "license": "Apache-2.0",
+            "optional": true,
+            "os": [
+                "linux"
+            ],
+            "engines": {
+                "node": ">=16.20.0"
+            }
+        },
+        "node_modules/@typescript/typescript-linux-riscv64": {
+            "version": "7.0.2",
+            "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-riscv64/-/typescript-linux-riscv64-7.0.2.tgz",
+            "integrity": "sha512-wf0jqEDOjrPRnKwYRyyJDRo11KMbvMFrU+q4zqKyChODBzvlkbhNQfKvLxQCcwTpdDaXSHZTVuh0JoCrKCUMHQ==",
+            "cpu": [
+                "riscv64"
+            ],
+            "dev": true,
+            "license": "Apache-2.0",
+            "optional": true,
+            "os": [
+                "linux"
+            ],
+            "engines": {
+                "node": ">=16.20.0"
+            }
+        },
+        "node_modules/@typescript/typescript-linux-s390x": {
+            "version": "7.0.2",
+            "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-s390x/-/typescript-linux-s390x-7.0.2.tgz",
+            "integrity": "sha512-IkwJc3L7yhytWd/ewjyxNDfOmswCm9GWMJT/ue/dU4aZNbwZeYAetq42VyLmsmSjvoX7z74X6ZaYCtzAr0EuGw==",
+            "cpu": [
+                "s390x"
+            ],
+            "dev": true,
+            "license": "Apache-2.0",
+            "optional": true,
+            "os": [
+                "linux"
+            ],
+            "engines": {
+                "node": ">=16.20.0"
+            }
+        },
+        "node_modules/@typescript/typescript-linux-x64": {
+            "version": "7.0.2",
+            "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-x64/-/typescript-linux-x64-7.0.2.tgz",
+            "integrity": "sha512-EYdf2cNg7rgCWJnxCdJ+F3V39O8ihb37eHAu1LK8oAFizgTQbPOK7zHHXbPt8rX24COqODXeI3sIf0fCXG7H/A==",
+            "cpu": [
+                "x64"
+            ],
+            "dev": true,
+            "license": "Apache-2.0",
+            "optional": true,
+            "os": [
+                "linux"
+            ],
+            "engines": {
+                "node": ">=16.20.0"
+            }
+        },
+        "node_modules/@typescript/typescript-netbsd-arm64": {
+            "version": "7.0.2",
+            "resolved": "https://registry.npmjs.org/@typescript/typescript-netbsd-arm64/-/typescript-netbsd-arm64-7.0.2.tgz",
+            "integrity": "sha512-+polYF4MF04aPpO5FTkHran9yUQDSXqy5GiSDKpsll5jy3l3+g9QLhpf39T+ePtefhXLOGrLl0QIjkQP6VnelA==",
+            "cpu": [
+                "arm64"
+            ],
+            "dev": true,
+            "license": "Apache-2.0",
+            "optional": true,
+            "os": [
+                "netbsd"
+            ],
+            "engines": {
+                "node": ">=16.20.0"
+            }
+        },
+        "node_modules/@typescript/typescript-netbsd-x64": {
+            "version": "7.0.2",
+            "resolved": "https://registry.npmjs.org/@typescript/typescript-netbsd-x64/-/typescript-netbsd-x64-7.0.2.tgz",
+            "integrity": "sha512-8YIT0EHM/3dq10ZOVF/A7pc/YSMtbcecct4rWtexrnSCHOPcpC2KTLXfTCR6vDpnSiY12heNb1GiN/wu+T/FyA==",
+            "cpu": [
+                "x64"
+            ],
+            "dev": true,
+            "license": "Apache-2.0",
+            "optional": true,
+            "os": [
+                "netbsd"
+            ],
+            "engines": {
+                "node": ">=16.20.0"
+            }
+        },
+        "node_modules/@typescript/typescript-openbsd-arm64": {
+            "version": "7.0.2",
+            "resolved": "https://registry.npmjs.org/@typescript/typescript-openbsd-arm64/-/typescript-openbsd-arm64-7.0.2.tgz",
+            "integrity": "sha512-APT8+ClYnuYm1u9+kgGXoMj2VzWzcymwh2gNSQVySHfkRDGOTVkoWLjCmOQSaO+PoqQ57B0flRp9SA+7GnnkzQ==",
+            "cpu": [
+                "arm64"
+            ],
+            "dev": true,
+            "license": "Apache-2.0",
+            "optional": true,
+            "os": [
+                "openbsd"
+            ],
+            "engines": {
+                "node": ">=16.20.0"
+            }
+        },
+        "node_modules/@typescript/typescript-openbsd-x64": {
+            "version": "7.0.2",
+            "resolved": "https://registry.npmjs.org/@typescript/typescript-openbsd-x64/-/typescript-openbsd-x64-7.0.2.tgz",
+            "integrity": "sha512-yX7s+Q0Dln0Dt9tEzZsAjXXR/+ytBM7AlglaqyeMPxQszJ1JhlJdZ6jLA+IzldHtflX81em7lDao1xXu+aRRkg==",
+            "cpu": [
+                "x64"
+            ],
+            "dev": true,
+            "license": "Apache-2.0",
+            "optional": true,
+            "os": [
+                "openbsd"
+            ],
+            "engines": {
+                "node": ">=16.20.0"
+            }
+        },
+        "node_modules/@typescript/typescript-sunos-x64": {
+            "version": "7.0.2",
+            "resolved": "https://registry.npmjs.org/@typescript/typescript-sunos-x64/-/typescript-sunos-x64-7.0.2.tgz",
+            "integrity": "sha512-dLJDGaLZ1D4HPQn62u1n8mBDkJREwMsAkCdkwd4Ieqw+x3TUyTsqY0YiBCtE6H6OzzgGk3iuZ3vFWRS+E8/d1g==",
+            "cpu": [
+                "x64"
+            ],
+            "dev": true,
+            "license": "Apache-2.0",
+            "optional": true,
+            "os": [
+                "sunos"
+            ],
+            "engines": {
+                "node": ">=16.20.0"
+            }
+        },
+        "node_modules/@typescript/typescript-win32-arm64": {
+            "version": "7.0.2",
+            "resolved": "https://registry.npmjs.org/@typescript/typescript-win32-arm64/-/typescript-win32-arm64-7.0.2.tgz",
+            "integrity": "sha512-Gyl1Vy6OsWesLzmq+EP0Fb7b4Nid5232AvcA2SFcdYreldpNtYFFofPjnt62y9hQy7VTaZp65ICJjuAQRaVcIQ==",
+            "cpu": [
+                "arm64"
+            ],
+            "dev": true,
+            "license": "Apache-2.0",
+            "optional": true,
+            "os": [
+                "win32"
+            ],
+            "engines": {
+                "node": ">=16.20.0"
+            }
+        },
+        "node_modules/@typescript/typescript-win32-x64": {
+            "version": "7.0.2",
+            "resolved": "https://registry.npmjs.org/@typescript/typescript-win32-x64/-/typescript-win32-x64-7.0.2.tgz",
+            "integrity": "sha512-0BQ3HkAHHlKLSp1qRvf3SUhGpGsDuhB/jgFw75guyqbxJqEaS0Cw/VFO8i2nHglJUzQCRtMMR/IBAKE3ETMC4g==",
+            "cpu": [
+                "x64"
+            ],
+            "dev": true,
+            "license": "Apache-2.0",
+            "optional": true,
+            "os": [
+                "win32"
+            ],
+            "engines": {
+                "node": ">=16.20.0"
+            }
+        },
+        "node_modules/ansi-regex": {
+            "version": "5.0.1",
+            "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
+            "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
+            "dev": true,
+            "license": "MIT",
+            "engines": {
+                "node": ">=8"
+            }
+        },
+        "node_modules/ansi-styles": {
+            "version": "4.3.0",
+            "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+            "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+            "dev": true,
+            "license": "MIT",
+            "dependencies": {
+                "color-convert": "^2.0.1"
+            },
+            "engines": {
+                "node": ">=8"
+            },
+            "funding": {
+                "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+            }
+        },
+        "node_modules/chownr": {
+            "version": "3.0.0",
+            "resolved": "https://registry.npmjs.org/chownr/-/chownr-3.0.0.tgz",
+            "integrity": "sha512-+IxzY9BZOQd/XuYPRmrvEVjF/nqj5kgT4kEq7VofrDoM1MxoRjEWkrCC3EtLi59TVawxTAn+orJwFQcrqEN1+g==",
+            "dev": true,
+            "license": "BlueOak-1.0.0",
+            "engines": {
+                "node": ">=18"
+            }
+        },
+        "node_modules/cliui": {
+            "version": "8.0.1",
+            "resolved": "https://registry.npmjs.org/cliui/-/cliui-8.0.1.tgz",
+            "integrity": "sha512-BSeNnyus75C4//NQ9gQt1/csTXyo/8Sb+afLAkzAptFuMsod9HFokGNudZpi/oQV73hnVK+sR+5PVRMd+Dr7YQ==",
+            "dev": true,
+            "license": "ISC",
+            "dependencies": {
+                "string-width": "^4.2.0",
+                "strip-ansi": "^6.0.1",
+                "wrap-ansi": "^7.0.0"
+            },
+            "engines": {
+                "node": ">=12"
+            }
+        },
+        "node_modules/cmake-js": {
+            "version": "8.0.0",
+            "resolved": "https://registry.npmjs.org/cmake-js/-/cmake-js-8.0.0.tgz",
+            "integrity": "sha512-YbUP88RDwCvoQkZhRtGURYm9RIpWdtvZuhT87fKNoLjk8kIFIFeARpKfuZQGdwfH99GZpUmqSfcDrK62X7lTgg==",
+            "dev": true,
+            "license": "MIT",
+            "dependencies": {
+                "debug": "^4.4.3",
+                "fs-extra": "^11.3.3",
+                "node-api-headers": "^1.8.0",
+                "rc": "1.2.8",
+                "semver": "^7.7.3",
+                "tar": "^7.5.6",
+                "url-join": "^4.0.1",
+                "which": "^6.0.0",
+                "yargs": "^17.7.2"
+            },
+            "bin": {
+                "cmake-js": "bin/cmake-js"
+            },
+            "engines": {
+                "node": "^20.17.0 || >=22.9.0"
+            }
+        },
+        "node_modules/color-convert": {
+            "version": "2.0.1",
+            "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+            "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+            "dev": true,
+            "license": "MIT",
+            "dependencies": {
+                "color-name": "~1.1.4"
+            },
+            "engines": {
+                "node": ">=7.0.0"
+            }
+        },
+        "node_modules/color-name": {
+            "version": "1.1.4",
+            "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+            "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+            "dev": true,
+            "license": "MIT"
+        },
+        "node_modules/debug": {
+            "version": "4.4.3",
+            "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
+            "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
+            "dev": true,
+            "license": "MIT",
+            "dependencies": {
+                "ms": "^2.1.3"
+            },
+            "engines": {
+                "node": ">=6.0"
+            },
+            "peerDependenciesMeta": {
+                "supports-color": {
+                    "optional": true
+                }
+            }
+        },
+        "node_modules/deep-extend": {
+            "version": "0.6.0",
+            "resolved": "https://registry.npmjs.org/deep-extend/-/deep-extend-0.6.0.tgz",
+            "integrity": "sha512-LOHxIOaPYdHlJRtCQfDIVZtfw/ufM8+rVj649RIHzcm/vGwQRXFt6OPqIFWsm2XEMrNIEtWR64sY1LEKD2vAOA==",
+            "dev": true,
+            "license": "MIT",
+            "engines": {
+                "node": ">=4.0.0"
+            }
+        },
+        "node_modules/emoji-regex": {
+            "version": "8.0.0",
+            "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz",
+            "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==",
+            "dev": true,
+            "license": "MIT"
+        },
+        "node_modules/escalade": {
+            "version": "3.2.0",
+            "resolved": "https://registry.npmjs.org/escalade/-/escalade-3.2.0.tgz",
+            "integrity": "sha512-WUj2qlxaQtO4g6Pq5c29GTcWGDyd8itL8zTlipgECz3JesAiiOKotd8JU6otB3PACgG6xkJUyVhboMS+bje/jA==",
+            "dev": true,
+            "license": "MIT",
+            "engines": {
+                "node": ">=6"
+            }
+        },
+        "node_modules/fs-extra": {
+            "version": "11.4.1",
+            "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-11.4.1.tgz",
+            "integrity": "sha512-KYAb4c9BJQI6QqGKthV68OHe0badztdXJWKo0WtBA9IuCFPTKvE5ZdUBglP833aMjhaSPNO4A5j/EkzZtGlKjA==",
+            "dev": true,
+            "license": "MIT",
+            "dependencies": {
+                "graceful-fs": "^4.2.0",
+                "jsonfile": "^6.0.1",
+                "universalify": "^2.0.0"
+            },
+            "engines": {
+                "node": ">=14.14"
+            }
+        },
+        "node_modules/get-caller-file": {
+            "version": "2.0.5",
+            "resolved": "https://registry.npmjs.org/get-caller-file/-/get-caller-file-2.0.5.tgz",
+            "integrity": "sha512-DyFP3BM/3YHTQOCUL/w0OZHR0lpKeGrxotcHWcqNEdnltqFwXVfhEBQ94eIo34AfQpo0rGki4cyIiftY06h2Fg==",
+            "dev": true,
+            "license": "ISC",
+            "engines": {
+                "node": "6.* || 8.* || >= 10.*"
+            }
+        },
+        "node_modules/graceful-fs": {
+            "version": "4.2.11",
+            "resolved": "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.2.11.tgz",
+            "integrity": "sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ==",
+            "dev": true,
+            "license": "ISC"
+        },
+        "node_modules/ini": {
+            "version": "1.3.8",
+            "resolved": "https://registry.npmjs.org/ini/-/ini-1.3.8.tgz",
+            "integrity": "sha512-JV/yugV2uzW5iMRSiZAyDtQd+nxtUnjeLt0acNdw98kKLrvuRVyB80tsREOE7yvGVgalhZ6RNXCmEHkUKBKxew==",
+            "dev": true,
+            "license": "ISC"
+        },
+        "node_modules/is-fullwidth-code-point": {
+            "version": "3.0.0",
+            "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-3.0.0.tgz",
+            "integrity": "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==",
+            "dev": true,
+            "license": "MIT",
+            "engines": {
+                "node": ">=8"
+            }
+        },
+        "node_modules/isexe": {
+            "version": "4.0.0",
+            "resolved": "https://registry.npmjs.org/isexe/-/isexe-4.0.0.tgz",
+            "integrity": "sha512-FFUtZMpoZ8RqHS3XeXEmHWLA4thH+ZxCv2lOiPIn1Xc7CxrqhWzNSDzD+/chS/zbYezmiwWLdQC09JdQKmthOw==",
+            "dev": true,
+            "license": "BlueOak-1.0.0",
+            "engines": {
+                "node": ">=20"
+            }
+        },
+        "node_modules/jsonfile": {
+            "version": "6.2.1",
+            "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.1.tgz",
+            "integrity": "sha512-zwOTdL3rFQ/lRdBnntKVOX6k5cKJwEc1HdilT71BWEu7J41gXIB2MRp+vxduPSwZJPWBxEzv4yH1wYLJGUHX4Q==",
+            "dev": true,
+            "license": "MIT",
+            "dependencies": {
+                "universalify": "^2.0.0"
+            },
+            "optionalDependencies": {
+                "graceful-fs": "^4.1.6"
+            }
+        },
+        "node_modules/minimist": {
+            "version": "1.2.8",
+            "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.8.tgz",
+            "integrity": "sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==",
+            "dev": true,
+            "license": "MIT",
+            "funding": {
+                "url": "https://github.com/sponsors/ljharb"
+            }
+        },
+        "node_modules/minipass": {
+            "version": "7.1.3",
+            "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.1.3.tgz",
+            "integrity": "sha512-tEBHqDnIoM/1rXME1zgka9g6Q2lcoCkxHLuc7ODJ5BxbP5d4c2Z5cGgtXAku59200Cx7diuHTOYfSBD8n6mm8A==",
+            "dev": true,
+            "license": "BlueOak-1.0.0",
+            "engines": {
+                "node": ">=16 || 14 >=14.17"
+            }
+        },
+        "node_modules/minizlib": {
+            "version": "3.1.0",
+            "resolved": "https://registry.npmjs.org/minizlib/-/minizlib-3.1.0.tgz",
+            "integrity": "sha512-KZxYo1BUkWD2TVFLr0MQoM8vUUigWD3LlD83a/75BqC+4qE0Hb1Vo5v1FgcfaNXvfXzr+5EhQ6ing/CaBijTlw==",
+            "dev": true,
+            "license": "MIT",
+            "dependencies": {
+                "minipass": "^7.1.2"
+            },
+            "engines": {
+                "node": ">= 18"
+            }
+        },
+        "node_modules/ms": {
+            "version": "2.1.3",
+            "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
+            "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
+            "dev": true,
+            "license": "MIT"
+        },
+        "node_modules/node-addon-api": {
+            "version": "8.9.2",
+            "resolved": "https://registry.npmjs.org/node-addon-api/-/node-addon-api-8.9.2.tgz",
+            "integrity": "sha512-VijLXbi3UACN69I0JVXJsX4tjACjNoQDgv2gTF6sx2wWEi8tkSg2eX8p5gSIFi8z2+DL3oHmY6OyKce38SDolg==",
+            "dev": true,
+            "license": "MIT",
+            "engines": {
+                "node": "^18 || ^20 || >= 21"
+            }
+        },
+        "node_modules/node-api-headers": {
+            "version": "1.9.0",
+            "resolved": "https://registry.npmjs.org/node-api-headers/-/node-api-headers-1.9.0.tgz",
+            "integrity": "sha512-2oNILP4jXwRB4ywnYKjVk1YyJ96n2D4EOVJO6S3oYZ5PtbJrw3Yt9TpAuX3nBLMuzn74rnfGQrv13pS9vC+YiA==",
+            "dev": true,
+            "license": "MIT"
+        },
+        "node_modules/node-gyp-build": {
+            "version": "4.8.4",
+            "resolved": "https://registry.npmjs.org/node-gyp-build/-/node-gyp-build-4.8.4.tgz",
+            "integrity": "sha512-LA4ZjwlnUblHVgq0oBF3Jl/6h/Nvs5fzBLwdEF4nuxnFdsfajde4WfxtJr3CaiH+F6ewcIB/q4jQ4UzPyid+CQ==",
+            "license": "MIT",
+            "bin": {
+                "node-gyp-build": "bin.js",
+                "node-gyp-build-optional": "optional.js",
+                "node-gyp-build-test": "build-test.js"
+            }
+        },
+        "node_modules/rc": {
+            "version": "1.2.8",
+            "resolved": "https://registry.npmjs.org/rc/-/rc-1.2.8.tgz",
+            "integrity": "sha512-y3bGgqKj3QBdxLbLkomlohkvsA8gdAiUQlSBJnBhfn+BPxg4bc62d8TcBW15wavDfgexCgccckhcZvywyQYPOw==",
+            "dev": true,
+            "license": "(BSD-2-Clause OR MIT OR Apache-2.0)",
+            "dependencies": {
+                "deep-extend": "^0.6.0",
+                "ini": "~1.3.0",
+                "minimist": "^1.2.0",
+                "strip-json-comments": "~2.0.1"
+            },
+            "bin": {
+                "rc": "cli.js"
+            }
+        },
+        "node_modules/require-directory": {
+            "version": "2.1.1",
+            "resolved": "https://registry.npmjs.org/require-directory/-/require-directory-2.1.1.tgz",
+            "integrity": "sha512-fGxEI7+wsG9xrvdjsrlmL22OMTTiHRwAMroiEeMgq8gzoLC/PQr7RsRDSTLUg/bZAZtF+TVIkHc6/4RIKrui+Q==",
+            "dev": true,
+            "license": "MIT",
+            "engines": {
+                "node": ">=0.10.0"
+            }
+        },
+        "node_modules/semver": {
+            "version": "7.8.5",
+            "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.5.tgz",
+            "integrity": "sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==",
+            "dev": true,
+            "license": "ISC",
+            "bin": {
+                "semver": "bin/semver.js"
+            },
+            "engines": {
+                "node": ">=10"
+            }
+        },
+        "node_modules/string-width": {
+            "version": "4.2.3",
+            "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
+            "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==",
+            "dev": true,
+            "license": "MIT",
+            "dependencies": {
+                "emoji-regex": "^8.0.0",
+                "is-fullwidth-code-point": "^3.0.0",
+                "strip-ansi": "^6.0.1"
+            },
+            "engines": {
+                "node": ">=8"
+            }
+        },
+        "node_modules/strip-ansi": {
+            "version": "6.0.1",
+            "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
+            "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
+            "dev": true,
+            "license": "MIT",
+            "dependencies": {
+                "ansi-regex": "^5.0.1"
+            },
+            "engines": {
+                "node": ">=8"
+            }
+        },
+        "node_modules/strip-json-comments": {
+            "version": "2.0.1",
+            "resolved": "https://registry.npmjs.org/strip-json-comments/-/strip-json-comments-2.0.1.tgz",
+            "integrity": "sha512-4gB8na07fecVVkOI6Rs4e7T6NOTki5EmL7TUduTs6bu3EdnSycntVJ4re8kgZA+wx9IueI2Y11bfbgwtzuE0KQ==",
+            "dev": true,
+            "license": "MIT",
+            "engines": {
+                "node": ">=0.10.0"
+            }
+        },
+        "node_modules/tar": {
+            "version": "7.5.22",
+            "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.22.tgz",
+            "integrity": "sha512-MFO/QzvtAOmJbkhOaCTvbGcFN9L9b+JunIsDwaKljSOdcLMea3NJ1k9Usz/rjdfSXTq4dfzfeS7W4p4YOAAHeA==",
+            "dev": true,
+            "license": "BlueOak-1.0.0",
+            "dependencies": {
+                "@isaacs/fs-minipass": "^4.0.0",
+                "chownr": "^3.0.0",
+                "minipass": "^7.1.2",
+                "minizlib": "^3.1.0",
+                "yallist": "^5.0.0"
+            },
+            "engines": {
+                "node": ">=18"
+            }
+        },
+        "node_modules/typescript": {
+            "version": "7.0.2",
+            "resolved": "https://registry.npmjs.org/typescript/-/typescript-7.0.2.tgz",
+            "integrity": "sha512-8FYau96o3NKOhbjKi/qNvG/W5jhzxkbdm5sj9AbZ/5T5sWqn3hJgLfGx27sRKZWTvyzCP8dLRBTf5tBTSRVUNA==",
+            "dev": true,
+            "license": "Apache-2.0",
+            "bin": {
+                "tsc": "bin/tsc"
+            },
+            "engines": {
+                "node": ">=16.20.0"
+            },
+            "optionalDependencies": {
+                "@typescript/typescript-aix-ppc64": "7.0.2",
+                "@typescript/typescript-darwin-arm64": "7.0.2",
+                "@typescript/typescript-darwin-x64": "7.0.2",
+                "@typescript/typescript-freebsd-arm64": "7.0.2",
+                "@typescript/typescript-freebsd-x64": "7.0.2",
+                "@typescript/typescript-linux-arm": "7.0.2",
+                "@typescript/typescript-linux-arm64": "7.0.2",
+                "@typescript/typescript-linux-loong64": "7.0.2",
+                "@typescript/typescript-linux-mips64el": "7.0.2",
+                "@typescript/typescript-linux-ppc64": "7.0.2",
+                "@typescript/typescript-linux-riscv64": "7.0.2",
+                "@typescript/typescript-linux-s390x": "7.0.2",
+                "@typescript/typescript-linux-x64": "7.0.2",
+                "@typescript/typescript-netbsd-arm64": "7.0.2",
+                "@typescript/typescript-netbsd-x64": "7.0.2",
+                "@typescript/typescript-openbsd-arm64": "7.0.2",
+                "@typescript/typescript-openbsd-x64": "7.0.2",
+                "@typescript/typescript-sunos-x64": "7.0.2",
+                "@typescript/typescript-win32-arm64": "7.0.2",
+                "@typescript/typescript-win32-x64": "7.0.2"
+            }
+        },
+        "node_modules/undici-types": {
+            "version": "6.21.0",
+            "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-6.21.0.tgz",
+            "integrity": "sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==",
+            "dev": true,
+            "license": "MIT"
+        },
+        "node_modules/universalify": {
+            "version": "2.0.1",
+            "resolved": "https://registry.npmjs.org/universalify/-/universalify-2.0.1.tgz",
+            "integrity": "sha512-gptHNQghINnc/vTGIk0SOFGFNXw7JVrlRUtConJRlvaw6DuX0wO5Jeko9sWrMBhh+PsYAZ7oXAiOnf/UKogyiw==",
+            "dev": true,
+            "license": "MIT",
+            "engines": {
+                "node": ">= 10.0.0"
+            }
+        },
+        "node_modules/url-join": {
+            "version": "4.0.1",
+            "resolved": "https://registry.npmjs.org/url-join/-/url-join-4.0.1.tgz",
+            "integrity": "sha512-jk1+QP6ZJqyOiuEI9AEWQfju/nB2Pw466kbA0LEZljHwKeMgd9WrAEgEGxjPDD2+TNbbb37rTyhEfrCXfuKXnA==",
+            "dev": true,
+            "license": "MIT"
+        },
+        "node_modules/which": {
+            "version": "6.0.1",
+            "resolved": "https://registry.npmjs.org/which/-/which-6.0.1.tgz",
+            "integrity": "sha512-oGLe46MIrCRqX7ytPUf66EAYvdeMIZYn3WaocqqKZAxrBpkqHfL/qvTyJ/bTk5+AqHCjXmrv3CEWgy368zhRUg==",
+            "dev": true,
+            "license": "ISC",
+            "dependencies": {
+                "isexe": "^4.0.0"
+            },
+            "bin": {
+                "node-which": "bin/which.js"
+            },
+            "engines": {
+                "node": "^20.17.0 || >=22.9.0"
+            }
+        },
+        "node_modules/wrap-ansi": {
+            "version": "7.0.0",
+            "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-7.0.0.tgz",
+            "integrity": "sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==",
+            "dev": true,
+            "license": "MIT",
+            "dependencies": {
+                "ansi-styles": "^4.0.0",
+                "string-width": "^4.1.0",
+                "strip-ansi": "^6.0.0"
+            },
+            "engines": {
+                "node": ">=10"
+            },
+            "funding": {
+                "url": "https://github.com/chalk/wrap-ansi?sponsor=1"
+            }
+        },
+        "node_modules/y18n": {
+            "version": "5.0.8",
+            "resolved": "https://registry.npmjs.org/y18n/-/y18n-5.0.8.tgz",
+            "integrity": "sha512-0pfFzegeDWJHJIAmTLRP2DwHjdF5s7jo9tuztdQxAhINCdvS+3nGINqPd00AphqJR/0LhANUS6/+7SCb98YOfA==",
+            "dev": true,
+            "license": "ISC",
+            "engines": {
+                "node": ">=10"
+            }
+        },
+        "node_modules/yallist": {
+            "version": "5.0.0",
+            "resolved": "https://registry.npmjs.org/yallist/-/yallist-5.0.0.tgz",
+            "integrity": "sha512-YgvUTfwqyc7UXVMrB+SImsVYSmTS8X/tSrtdNZMImM+n7+QTriRXyXim0mBrTXNeqzVF0KWGgHPeiyViFFrNDw==",
+            "dev": true,
+            "license": "BlueOak-1.0.0",
+            "engines": {
+                "node": ">=18"
+            }
+        },
+        "node_modules/yargs": {
+            "version": "17.7.3",
+            "resolved": "https://registry.npmjs.org/yargs/-/yargs-17.7.3.tgz",
+            "integrity": "sha512-GZtjxm/J/4TSxuL3FNYjCmLktBTnIw/rVmKSIyKeYAZpmJB2ig9VauCC5xsa82GNKVKDAqpOn3KVzNt0zmrU0g==",
+            "dev": true,
+            "license": "MIT",
+            "dependencies": {
+                "cliui": "^8.0.1",
+                "escalade": "^3.1.1",
+                "get-caller-file": "^2.0.5",
+                "require-directory": "^2.1.1",
+                "string-width": "^4.2.3",
+                "y18n": "^5.0.5",
+                "yargs-parser": "^21.1.1"
+            },
+            "engines": {
+                "node": ">=12"
+            }
+        },
+        "node_modules/yargs-parser": {
+            "version": "21.1.1",
+            "resolved": "https://registry.npmjs.org/yargs-parser/-/yargs-parser-21.1.1.tgz",
+            "integrity": "sha512-tVpsJW7DdjecAiFpbIB1e3qxIQsE6NoPc5/eTdrbbIC4h0LVsWhnoa3g+m2HclBIujHzsxZ4VJVA+GUuc2/LBw==",
+            "dev": true,
+            "license": "ISC",
+            "engines": {
+                "node": ">=12"
+            }
+        }
+    }
+}
@@ -0,0 +1,58 @@
+{
+    "name": "opendht",
+    "version": "0.1.0",
+    "description": "Distributed hash table for Node.js",
+    "license": "MIT",
+    "repository": {
+        "type": "git",
+        "url": "git+https://github.com/savoirfairelinux/opendht.git",
+        "directory": "nodejs"
+    },
+    "publishConfig": {
+        "access": "public",
+        "registry": "https://registry.npmjs.org/"
+    },
+    "type": "module",
+    "main": "index.js",
+    "types": "index.d.ts",
+    "exports": {
+        ".": {
+            "types": "./index.d.ts",
+            "import": "./index.js"
+        },
+        "./package.json": "./package.json"
+    },
+    "files": [
+        "index.js",
+        "index.d.ts",
+        "crypto.js",
+        "README.md",
+        "examples/dhtnode.js",
+        "examples/dhtnode.ts",
+        "prebuilds/"
+    ],
+    "engines": {
+        "node": ">=22.9.0"
+    },
+    "scripts": {
+        "build": "cmake-js compile",
+        "postbuild": "npm run build:examples",
+        "build:examples": "tsc --strict --types node --target es2024 --module Node16 --moduleResolution Node16 --rootDir examples --outDir examples examples/dhtnode.ts",
+        "dhtnode": "node examples/dhtnode.js",
+        "prepack": "npm run build:examples",
+        "bundle": "node scripts/bundle.js",
+        "package": "npm run bundle && npm pack --pack-destination dist",
+        "test:package": "node scripts/test-package.js",
+        "test": "node --test test/*.test.js",
+        "typecheck": "tsc --noEmit --strict --types node --target es2024 --module Node16 --moduleResolution Node16 test/types.ts examples/dhtnode.ts"
+    },
+    "dependencies": {
+        "node-gyp-build": "^4.8.4"
+    },
+    "devDependencies": {
+        "@types/node": "^22.20.5",
+        "cmake-js": "^8.0.0",
+        "node-addon-api": "^8.8.0",
+        "typescript": "^7.0.2"
+    }
+}
@@ -0,0 +1,105 @@
+import { execFileSync } from 'node:child_process';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+const root = path.resolve(import.meta.dirname, '..');
+const repository = path.dirname(root);
+const input = path.resolve(process.argv[2] || path.join(root, 'build/Release/opendht.node'));
+const target = `${process.platform}-${process.arch}`;
+const output = path.join(root, 'prebuilds', target);
+const temporary = fs.mkdtempSync(path.join(os.tmpdir(), 'opendht-bundle-'));
+const run = (command, args) => execFileSync(command, args, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'inherit'] });
+
+function copyNotices(dependencies) {
+    const directory = path.join(output, 'licenses');
+    fs.mkdirSync(directory, { recursive: true });
+    fs.copyFileSync(path.join(repository, 'LICENSE'), path.join(directory, 'OpenDHT-LICENSE.txt'));
+    const copied = new Set();
+    for (const dependency of dependencies) {
+        const real = fs.realpathSync(dependency);
+        if (!path.relative(repository, real).startsWith('..')) continue;
+        let name;
+        let notices;
+        if (process.platform === 'darwin') {
+            const match = real.match(/^(.*\/Cellar\/([^/]+)\/[^/]+)\//);
+            if (!match) throw new Error(`Cannot locate license notices for ${dependency}`);
+            name = match[2];
+            notices = fs.readdirSync(match[1]).filter(file => /^(COPYING|LICENSE|COPYRIGHT)([._-]|$)/i.test(file))
+                .map(file => path.join(match[1], file));
+        } else if (process.platform === 'linux' && /^libllhttp\.so(?:\.|$)/.test(path.basename(real))) {
+            name = 'llhttp';
+            notices = [path.join(repository, 'resources', 'llhttp-LICENSE-MIT')];
+        } else if (process.platform === 'linux') {
+            let owner;
+            try { owner = run('dpkg-query', ['-S', real]); }
+            catch { owner = run('dpkg-query', ['-S', real.replace(/^\/usr\//, '/')]); }
+            name = owner.split('\n')[0].split(': ')[0].split(':')[0];
+            notices = [path.join('/usr/share/doc', name, 'copyright')];
+        } else {
+            const installed = process.env.VCPKG_INSTALLED_DIR;
+            const triplet = process.env.VCPKG_DEFAULT_TRIPLET || 'x64-windows-release';
+            if (!installed) throw new Error('VCPKG_INSTALLED_DIR is required for Windows dependency notices');
+            const share = path.join(installed, triplet, 'share');
+            for (const entry of fs.readdirSync(share)) {
+                const copyright = path.join(share, entry, 'copyright');
+                if (fs.existsSync(copyright)) fs.copyFileSync(copyright, path.join(directory, `${entry}-copyright.txt`));
+            }
+            break;
+        }
+        if (!notices.length) throw new Error(`Missing license notices for ${name}`);
+        if (copied.has(name)) continue;
+        for (const notice of notices) fs.copyFileSync(notice, path.join(directory, `${name}-${path.basename(notice)}.txt`));
+        copied.add(name);
+    }
+}
+
+function fixMachO(file) {
+    const commands = run('otool', ['-l', file]);
+    const rpaths = [...commands.matchAll(/cmd LC_RPATH\s+cmdsize \d+\s+path (.+?) \(offset \d+\)/g)];
+    for (const rpath of new Set(rpaths.map(match => match[1]))) run('install_name_tool', ['-delete_rpath', rpath, file]);
+    const dependencies = [...run('otool', ['-L', file]).matchAll(/^\s+(.+?) \(compatibility version/gm)];
+    for (const [, dependency] of dependencies) {
+        if (!/^(@loader_path\/|\/usr\/lib\/|\/System\/Library\/)/.test(dependency)) {
+            throw new Error(`Non-relocatable dependency in ${path.basename(file)}: ${dependency}`);
+        }
+    }
+    run('codesign', ['--force', '--sign', '-', file]);
+}
+
+try {
+    if (!['darwin', 'linux', 'win32'].includes(process.platform)) throw new Error(`Unsupported platform ${target}`);
+    if (!fs.existsSync(input)) throw new Error(`Build the Release addon first: ${input}`);
+    if (process.platform === 'linux' && !process.report.getReport().header.glibcVersionRuntime) {
+        throw new Error('Linux prebuilds currently require glibc');
+    }
+    const directories = [path.dirname(input), ...(process.env.OPENDHT_LIBRARY_PATH || '').split(path.delimiter).filter(Boolean)];
+    const dependencyList = path.join(temporary, 'dependencies.json');
+    run('cmake', [`-DADDON=${input}`, `-DOUTPUT=${dependencyList}`, `-DSEARCH_DIRECTORIES=${directories.join(';')}`,
+        '-P', path.join(import.meta.dirname, 'dependencies.cmake')]);
+    const dependencies = JSON.parse(fs.readFileSync(dependencyList, 'utf8'));
+    fs.rmSync(output, { recursive: true, force: true });
+    fs.mkdirSync(output, { recursive: true });
+    const binary = path.join(output, process.platform === 'linux' ? 'node.napi.glibc.node' : 'node.napi.node');
+    fs.copyFileSync(input, binary);
+    if (process.platform === 'darwin') {
+        run('dylibbundler', ['-b', '-of', '-ns', '-x', binary, '-d', `${output}/`, '-p', '@loader_path/', '-s', path.dirname(input)]);
+        for (const file of fs.readdirSync(output)) fixMachO(path.join(output, file));
+    } else {
+        for (const dependency of dependencies) fs.copyFileSync(dependency, path.join(output, path.basename(dependency)));
+        if (process.platform === 'linux') {
+            for (const file of fs.readdirSync(output)) run('patchelf', ['--set-rpath', '$ORIGIN', path.join(output, file)]);
+        }
+    }
+    copyNotices(dependencies);
+    fs.writeFileSync(path.join(output, 'manifest.json'), JSON.stringify({
+        platform: process.platform,
+        arch: process.arch,
+        napi: 8,
+        libraries: fs.readdirSync(output).filter(file => /\.(node|dll|dylib)$|\.so(\.|$)/.test(file)).sort(),
+    }, null, 2) + '\n');
+    fs.mkdirSync(path.join(root, 'dist'), { recursive: true });
+    console.log(`Bundled ${target}: ${output}`);
+} finally {
+    fs.rmSync(temporary, { recursive: true, force: true });
+}
@@ -0,0 +1,39 @@
+cmake_minimum_required(VERSION 3.21)
+
+if(NOT EXISTS "${ADDON}" OR NOT DEFINED OUTPUT)
+    message(FATAL_ERROR "ADDON and OUTPUT are required")
+endif()
+
+set(pre_exclude)
+set(post_exclude)
+if(CMAKE_HOST_SYSTEM_NAME STREQUAL "Darwin")
+    list(APPEND pre_exclude "^/usr/lib/" "^/System/Library/")
+    list(APPEND post_exclude "^/usr/lib/" "^/System/Library/")
+elseif(CMAKE_HOST_SYSTEM_NAME STREQUAL "Linux")
+    list(APPEND pre_exclude "^ld-linux" "^lib(c|m|dl|rt|pthread|resolv|util|gcc_s|stdc\\+\\+)\\.so")
+elseif(CMAKE_HOST_WIN32)
+    list(APPEND pre_exclude "[Nn][Oo][Dd][Ee]\\.exe" "[Aa][Pp][Ii]-[Mm][Ss]-.*" "[Ee][Xx][Tt]-[Mm][Ss]-.*")
+    list(APPEND post_exclude ".*[Ss][Yy][Ss][Tt][Ee][Mm]32[/\\\\].*")
+endif()
+
+file(GET_RUNTIME_DEPENDENCIES
+    MODULES "${ADDON}"
+    DIRECTORIES ${SEARCH_DIRECTORIES}
+    RESOLVED_DEPENDENCIES_VAR dependencies
+    UNRESOLVED_DEPENDENCIES_VAR unresolved
+    CONFLICTING_DEPENDENCIES_PREFIX conflicts
+    PRE_EXCLUDE_REGEXES ${pre_exclude}
+    POST_EXCLUDE_REGEXES ${post_exclude}
+)
+if(unresolved OR conflicts_FILENAMES)
+    message(FATAL_ERROR "Unresolved dependencies: ${unresolved}; conflicting dependencies: ${conflicts_FILENAMES}")
+endif()
+
+set(result "[]")
+set(index 0)
+foreach(dependency IN LISTS dependencies)
+    file(TO_CMAKE_PATH "${dependency}" dependency)
+    string(JSON result SET "${result}" ${index} "\"${dependency}\"")
+    math(EXPR index "${index} + 1")
+endforeach()
+file(WRITE "${OUTPUT}" "${result}\n")
@@ -0,0 +1,38 @@
+import { execFileSync } from 'node:child_process';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+const root = path.resolve(import.meta.dirname, '..');
+const npm = process.env.npm_execpath;
+if (!npm) throw new Error('Run this check with npm run test:package');
+fs.mkdirSync(path.join(root, 'dist'), { recursive: true });
+let archive = process.argv[2] ? path.resolve(process.argv[2]) : path.join(root, 'dist',
+    JSON.parse(execFileSync(process.execPath, [npm, 'pack', '--json', '--pack-destination', 'dist'],
+        { cwd: root, encoding: 'utf8' }))[0].filename);
+if (fs.statSync(archive).isDirectory()) {
+    const archives = fs.readdirSync(archive).filter(file => file.endsWith('.tgz'));
+    if (archives.length !== 1) throw new Error('Expected exactly one npm archive');
+    archive = path.join(archive, archives[0]);
+}
+const consumer = fs.mkdtempSync(path.join(os.tmpdir(), 'opendht-consumer-'));
+const env = { ...process.env, PREBUILDS_ONLY: '1' };
+for (const variable of ['OPENDHT_NODE_BINDING', 'NODE_PATH', 'LD_LIBRARY_PATH', 'DYLD_LIBRARY_PATH', 'DYLD_FALLBACK_LIBRARY_PATH']) delete env[variable];
+const excluded = [path.join(root, 'build'), ...(process.env.OPENDHT_LIBRARY_PATH || '').split(path.delimiter).filter(Boolean)];
+const pathKey = Object.keys(env).find(key => key.toLowerCase() === 'path');
+if (pathKey) env[pathKey] = env[pathKey].split(path.delimiter)
+    .filter(entry => !excluded.some(directory => path.resolve(entry).toLowerCase().startsWith(path.resolve(directory).toLowerCase())))
+    .join(path.delimiter);
+try {
+    execFileSync(process.execPath, [npm, 'install', '--prefix', consumer, '--ignore-scripts', '--omit=dev', '--no-audit', '--no-fund', archive],
+        { cwd: consumer, env, stdio: 'inherit' });
+    const { name } = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8'));
+    const installed = path.join(consumer, 'node_modules', ...name.split('/'));
+    execFileSync(process.execPath, ['--input-type=module', '-e', 'import load from "node-gyp-build"; console.log(load.path(process.cwd()))'],
+        { cwd: installed, env, stdio: 'inherit' });
+    fs.cpSync(path.join(root, 'test'), path.join(installed, 'test'), { recursive: true });
+    execFileSync(process.execPath, [npm, 'test'], { cwd: installed, env, stdio: 'inherit' });
+    console.log(`Installed archive verified: ${archive}`);
+} finally {
+    fs.rmSync(consumer, { recursive: true, force: true });
+}
@@ -0,0 +1,549 @@
+import assert from 'node:assert/strict';
+import { execFile } from 'node:child_process';
+import { EventEmitter, once } from 'node:events';
+import { createServer } from 'node:http';
+import { test } from 'node:test';
+import { fileURLToPath } from 'node:url';
+import { promisify } from 'node:util';
+import { Worker } from 'node:worker_threads';
+import { DhtRunner, hash, version } from '../index.js';
+
+const moduleURL = new URL('../index.js', import.meta.url).href;
+const exampleURL = new URL('../examples/dhtnode.js', import.meta.url);
+const example = fileURLToPath(exampleURL);
+
+function startNode() {
+    const runner = new DhtRunner();
+    runner.run({ port: 0, ipv4: '127.0.0.1', ipv6: '::1' });
+    return runner;
+}
+
+test('hashes strings and binary data without truncating NUL bytes', () => {
+    assert.match(version, /^\d+\./);
+    assert.equal(hash('hello'), 'aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d');
+    assert.equal(hash('hello'), hash(Buffer.from('hello')));
+    assert.notEqual(hash('hello\0world'), hash('hello'));
+    assert.throws(() => hash(42), TypeError);
+});
+
+test('runner lifecycle and argument validation', async () => {
+    const runner = new DhtRunner();
+    assert.equal(runner.isRunning(), false);
+    assert.throws(() => runner.get(hash('idle')), /running/i);
+    assert.throws(() => runner.getAll(hash('idle')), /running/i);
+    assert.throws(() => runner.run({ port: -1 }), RangeError);
+    assert.throws(() => runner.run({ port: 65536 }), RangeError);
+    assert.throws(() => runner.run({ port: 1.5 }), RangeError);
+    runner.run({ port: 0, ipv4: '127.0.0.1', ipv6: '::1' });
+    try {
+        assert.equal(runner.isRunning(), true);
+        assert.ok(runner.getBoundPort() > 0);
+        assert.match(runner.getNodeId(), /^[0-9a-f]{40}$/);
+        assert.throws(() => runner.run(), /already/i);
+        assert.throws(() => runner.get('short'), /hash/i);
+        assert.throws(() => runner.get('z'.repeat(40)), /hash/i);
+        assert.throws(() => runner.put(hash('bad'), 'text'), TypeError);
+        assert.throws(() => runner.put(hash('bad'), Buffer.alloc(0), { id: 1 }), TypeError);
+        assert.throws(() => runner.put(hash('bad'), Buffer.alloc(0), { id: -1n }), RangeError);
+        assert.throws(() => runner.put(hash('bad'), Buffer.alloc(0), { id: 1n << 64n }), RangeError);
+        assert.throws(() => runner.put(hash('bad'), Buffer.alloc(0), { type: 65536 }), RangeError);
+    } finally {
+        const closing = runner.close();
+        assert.equal(runner.close(), closing);
+        await closing;
+    }
+    assert.equal(runner.isRunning(), false);
+    assert.throws(() => runner.run(), /closed/i);
+    assert.throws(() => runner.get(hash('closed')), /closed/i);
+});
+
+test('closing an idle runner is supported', async () => {
+    const runner = new DhtRunner();
+    await runner.close();
+    await runner.close();
+    assert.equal(runner.isRunning(), false);
+});
+
+test('runner reports per-family connectivity changes and snapshots', { timeout: 15000 }, async () => {
+    const runner = new DhtRunner();
+    const peer = startNode();
+    const changes = [];
+    runner.on('statusChanged', status => changes.push(status));
+    try {
+        assert.deepEqual(runner.getStatus(), { ipv4: 'disconnected', ipv6: 'disconnected' });
+        runner.run({ port: 0, ipv4: '127.0.0.1', ipv6: '::1' });
+        const connected = new Promise((resolve, reject) => {
+            const signal = AbortSignal.timeout(10000);
+            signal.addEventListener('abort', () => reject(signal.reason), { once: true });
+            runner.on('statusChanged', status => {
+                if (status.ipv4 === 'connected') resolve(status);
+            });
+        });
+        runner.bootstrap('127.0.0.1', peer.getBoundPort());
+        peer.bootstrap('127.0.0.1', runner.getBoundPort());
+        const status = await connected;
+        assert.equal(status.ipv4, 'connected');
+        assert.ok(['disconnected', 'connecting', 'connected'].includes(status.ipv6));
+        assert.deepEqual(runner.getStatus(), status);
+        status.ipv4 = 'changed by consumer';
+        assert.equal(runner.getStatus().ipv4, 'connected');
+        await runner.close();
+        const count = changes.length;
+        await new Promise(resolve => setImmediate(resolve));
+        assert.equal(changes.length, count);
+        assert.deepEqual(runner.getStatus(), { ipv4: 'disconnected', ipv6: 'disconnected' });
+    } finally {
+        await Promise.all([runner.close(), peer.close()]);
+    }
+});
+
+test('invalid bind addresses produce JS exceptions', async () => {
+    const runner = new DhtRunner();
+    try {
+        assert.throws(() => runner.run({ ipv4: '192.0.2.1', ipv6: '2001:db8::1' }));
+    } finally {
+        await runner.close();
+    }
+});
+
+test('two loopback nodes exchange binary values and cancel listeners', { timeout: 20000 }, async () => {
+    const writer = startNode();
+    const reader = startNode();
+    const events = new EventEmitter();
+    const key = hash('node-addon-api integration');
+    const payload = Buffer.from([0, 1, 255, 0, 42]);
+    let subscription;
+    let retainedValue;
+    try {
+        writer.bootstrap('127.0.0.1', reader.getBoundPort());
+        reader.bootstrap('127.0.0.1', writer.getBoundPort());
+        subscription = reader.listen(key, (value, expired) => {
+            if (!expired) events.emit('value', value);
+        });
+        const received = once(events, 'value', { signal: AbortSignal.timeout(10000) });
+        assert.equal(await writer.put(key, payload, {
+            id: 18446744073709551614n,
+            type: 0,
+            userType: 'nodejs-test',
+            permanent: true,
+        }), true);
+        const [value] = await received;
+        assert.equal(value.id, 18446744073709551614n);
+        assert.equal(value.type, 0);
+        assert.ok(Buffer.isBuffer(value.data));
+        assert.deepEqual(value.data, payload);
+        assert.equal(value.userType, 'nodejs-test');
+        assert.equal(typeof value.seq, 'number');
+        assert.equal(value.owner, null);
+        assert.equal(value.isSigned, false);
+        assert.equal(value.isEncrypted, false);
+        value.data.fill(7);
+        const values = await reader.getAll(key);
+        retainedValue = values.find(candidate => candidate.id === value.id);
+        assert.ok(retainedValue);
+        assert.deepEqual(retainedValue.data, payload);
+        subscription.cancel();
+        subscription.cancel();
+    } finally {
+        subscription?.cancel();
+        await Promise.all([writer.close(), reader.close()]);
+    }
+    assert.deepEqual(retainedValue.data, payload);
+});
+
+test('close settles pending operations and suppresses queued listener deliveries', { timeout: 10000 }, async () => {
+    const runner = startNode();
+    let deliveries = 0;
+    const subscription = runner.listen(hash('closing'), () => deliveries++);
+    const pending = runner.getAll(hash('unreachable'));
+    const settled = assert.rejects(pending, { code: 'ERR_DHT_CLOSED' });
+    await runner.close();
+    await settled;
+    subscription.cancel();
+    assert.equal(deliveries, 0);
+});
+
+test('get iterators settle pending reads on cancellation and reject on runner close', { timeout: 10000 }, async () => {
+    const runner = startNode();
+    try {
+        const cancelled = runner.get(hash('cancel get'));
+        assert.equal(cancelled[Symbol.asyncIterator](), cancelled);
+        const pending = [cancelled.next(), cancelled.next()];
+        await cancelled.return();
+        cancelled.cancel();
+        assert.deepEqual(await Promise.all(pending), [
+            { value: undefined, done: true },
+            { value: undefined, done: true },
+        ]);
+        assert.deepEqual(await cancelled.next(), { value: undefined, done: true });
+
+        const closing = runner.get(hash('close get'));
+        const rejected = assert.rejects(closing.next(), { code: 'ERR_DHT_CLOSED' });
+        await runner.close();
+        await rejected;
+        await assert.rejects(closing.next(), { code: 'ERR_DHT_CLOSED' });
+    } finally {
+        await runner.close();
+    }
+});
+
+test('async listeners deliver queued values and cancel on loop exit', { timeout: 15000 }, async () => {
+    const writer = startNode();
+    const reader = startNode();
+    const key = hash('async listener');
+    let iterator;
+    try {
+        writer.bootstrap('127.0.0.1', reader.getBoundPort());
+        reader.bootstrap('127.0.0.1', writer.getBoundPort());
+        iterator = reader.listen(key);
+        assert.equal(iterator[Symbol.asyncIterator](), iterator);
+        const pending = iterator.next();
+        assert.equal(await writer.put(key, Buffer.from('first'), { id: 1n }), true);
+        const first = await pending;
+        assert.equal(first.done, false);
+        assert.equal(first.value.expired, false);
+        assert.equal(first.value.value.id, 1n);
+        assert.equal(first.value.value.data.toString(), 'first');
+
+        assert.equal(await writer.put(key, Buffer.from('second'), { id: 2n }), true);
+        for await (const { value, expired } of iterator) {
+            assert.equal(expired, false);
+            assert.equal(value.id, 2n);
+            assert.equal(value.data.toString(), 'second');
+            break;
+        }
+        assert.deepEqual(await iterator.next(), { value: undefined, done: true });
+        iterator.cancel();
+    } finally {
+        iterator?.cancel();
+        await Promise.all([writer.close(), reader.close()]);
+    }
+});
+
+test('async listener cancellation settles concurrent reads and drops buffered values', { timeout: 10000 }, async () => {
+    const runner = startNode();
+    const peer = startNode();
+    const key = hash('async cancellation');
+    let iterator;
+    try {
+        runner.bootstrap('127.0.0.1', peer.getBoundPort());
+        peer.bootstrap('127.0.0.1', runner.getBoundPort());
+        iterator = runner.listen(key);
+        const pending = [iterator.next(), iterator.next()];
+        iterator.cancel();
+        iterator.cancel();
+        assert.deepEqual(await Promise.all(pending), [
+            { value: undefined, done: true },
+            { value: undefined, done: true },
+        ]);
+        assert.equal(await runner.put(key, Buffer.from('cancelled'), { id: 3n }), true);
+        assert.deepEqual(await iterator.next(), { value: undefined, done: true });
+
+        const buffered = runner.listen(key);
+        await runner.getAll(key);
+        await buffered.return();
+        assert.deepEqual(await buffered.next(), { value: undefined, done: true });
+    } finally {
+        iterator?.cancel();
+        await Promise.all([runner.close(), peer.close()]);
+    }
+});
+
+test('async listener throw, disposal, and runner close settle pending reads', { timeout: 10000 }, async () => {
+    const runner = startNode();
+    try {
+        const thrown = runner.listen(hash('async throw'));
+        const pendingThrow = thrown.next();
+        const failure = new Error('consumer failed');
+        await assert.rejects(thrown.throw(failure), error => error === failure);
+        assert.deepEqual(await pendingThrow, { value: undefined, done: true });
+        assert.deepEqual(await thrown.next(), { value: undefined, done: true });
+
+        const disposed = runner.listen(hash('async dispose'));
+        const pendingDispose = disposed.next();
+        await disposed[Symbol.asyncDispose]();
+        assert.deepEqual(await pendingDispose, { value: undefined, done: true });
+
+        const closing = runner.listen(hash('async close'));
+        const pendingClose = [closing.next(), closing.next()];
+        const close = runner.close();
+        assert.equal(runner.close(), close);
+        assert.deepEqual(await Promise.all(pendingClose), [
+            { value: undefined, done: true },
+            { value: undefined, done: true },
+        ]);
+        await close;
+        assert.deepEqual(await closing.next(), { value: undefined, done: true });
+        assert.throws(() => runner.listen(hash('closed iterator')), /closed/i);
+    } finally {
+        await runner.close();
+    }
+});
+
+test('proxy configuration validates option types before starting', async () => {
+    const runner = new DhtRunner();
+    try {
+        assert.throws(() => runner.run({ proxyServer: 42 }), TypeError);
+        assert.throws(() => runner.run({ proxyUserAgent: false }), TypeError);
+        assert.throws(() => runner.run({ proxyUserAgent: 'client\r\nInjected: header' }), TypeError);
+        assert.throws(() => runner.run({ proxyServer: 'http://127.0.0.1\0' }), TypeError);
+        assert.throws(() => runner.run({ proxyServer: 'ftp://127.0.0.1' }), /http/i);
+        assert.throws(() => runner.run({ proxyServer: 'not a URL' }), /url/i);
+        assert.equal(runner.isRunning(), false);
+        runner.run({ port: 0, ipv4: '127.0.0.1', ipv6: '::1', proxyServer: '' });
+        assert.ok(runner.getBoundPort() > 0);
+    } finally {
+        await runner.close();
+    }
+});
+
+test('proxy configuration routes operations through HTTP with a custom user agent', { timeout: 15000 }, async () => {
+    const runner = new DhtRunner();
+    const requests = [];
+    const values = new Map();
+    let streamNextGet = false;
+    let streamResponse;
+    const server = createServer(async (request, response) => {
+        response.setHeader('content-type', 'application/json');
+        if (request.url === '/') {
+            response.end(JSON.stringify({
+                node_id: hash('proxy fixture'),
+                ipv4: { good: 1 },
+                ipv6: {},
+                public_ip: '127.0.0.1',
+            }));
+            return;
+        }
+        requests.push({ method: request.method, url: request.url, userAgent: request.headers['user-agent'] });
+        if (request.url === `/key/${hash('proxy failure')}`) {
+            response.statusCode = 500;
+            response.end();
+            return;
+        }
+        if (request.method === 'POST') {
+            const chunks = [];
+            for await (const chunk of request) chunks.push(chunk);
+            const value = JSON.parse(Buffer.concat(chunks).toString());
+            values.set(request.url, value);
+            response.end(JSON.stringify(value));
+        } else {
+            const value = values.get(request.url);
+            const body = value ? `${JSON.stringify(value)}\n` : '';
+            if (streamNextGet) {
+                streamNextGet = false;
+                streamResponse = response;
+                response.write(body);
+            } else response.end(body);
+        }
+    });
+    server.listen(0, '127.0.0.1');
+    try {
+        await once(server, 'listening');
+        runner.run({
+            proxyServer: `http://127.0.0.1:${server.address().port}`,
+            proxyUserAgent: 'opendht-node-test/1.0',
+            persistPath: '',
+        });
+        const key = hash('proxy configuration');
+        const payload = Buffer.from([0, 255, 42]);
+        assert.equal(await runner.put(key, payload, { id: 42n }), true);
+        const received = await runner.getAll(key);
+        assert.equal(received.length, 1);
+        assert.equal(received[0].id, 42n);
+        assert.deepEqual(received[0].data, payload);
+
+        streamNextGet = true;
+        const iterator = runner.get(key);
+        const first = await iterator.next();
+        assert.equal(first.done, false);
+        assert.equal(first.value.id, 42n);
+        assert.deepEqual(first.value.data, payload);
+        assert.equal(streamResponse.writableEnded, false);
+        streamResponse.end();
+        assert.deepEqual(await iterator.next(), { value: undefined, done: true });
+        assert.deepEqual(await iterator.next(), { value: undefined, done: true });
+        assert.deepEqual(requests.map(request => request.method), ['POST', 'GET', 'GET']);
+        assert.ok(requests.every(request => request.url === `/key/${key}`));
+        assert.ok(requests.every(request => request.userAgent === 'opendht-node-test/1.0'));
+
+        const empty = runner.get(hash('proxy empty'));
+        assert.deepEqual(await empty.next(), { value: undefined, done: true });
+        const failed = runner.get(hash('proxy failure'));
+        await assert.rejects(failed.next(), { code: 'ERR_DHT_GET_FAILED' });
+        await assert.rejects(runner.getAll(hash('proxy failure')), { code: 'ERR_DHT_GET_FAILED' });
+
+        const all = [];
+        for await (const value of runner.get(key)) all.push(value);
+        assert.equal(all.length, 1);
+        assert.deepEqual(all[0].data, payload);
+
+        streamNextGet = true;
+        const cancelled = runner.get(key);
+        for await (const value of cancelled) {
+            assert.equal(value.id, 42n);
+            break;
+        }
+        assert.equal(streamResponse.writableEnded, false);
+        assert.deepEqual(await cancelled.next(), { value: undefined, done: true });
+        streamResponse.end();
+    } finally {
+        streamResponse?.end();
+        await runner.close();
+        await new Promise((resolve, reject) => server.close(error => error ? reject(error) : resolve()));
+    }
+});
+
+test('worker termination cleans up native runners', { timeout: 10000 }, async () => {
+    const source = `
+        import { parentPort } from 'node:worker_threads';
+        import { DhtRunner, hash } from ${JSON.stringify(moduleURL)};
+        const runner = new DhtRunner();
+        runner.run({ port: 0, ipv4: '127.0.0.1', ipv6: '::1' });
+        runner.listen(hash('worker'), () => {});
+        parentPort.postMessage('ready');
+    `;
+    const worker = new Worker(new URL(`data:text/javascript,${encodeURIComponent(source)}`));
+    try {
+        await once(worker, 'message');
+    } finally {
+        await worker.terminate();
+    }
+});
+
+test('listener callbacks may cancel themselves and close the runner', { timeout: 10000 }, async () => {
+    const runner = startNode();
+    const key = hash('reentrant listener');
+    let deliveries = 0;
+    let finish;
+    const received = new Promise(resolve => { finish = resolve; });
+    const subscription = runner.listen(key, () => {
+        deliveries++;
+        subscription.cancel();
+        finish(runner.close());
+    });
+    const puts = [];
+    for (let index = 0; index < 3000; index++) {
+        puts.push(runner.put(key, Buffer.from('value'), { id: BigInt(index + 1) }).catch(error => {
+            assert.equal(error.code, 'ERR_DHT_CLOSED');
+        }));
+    }
+    try {
+        await received;
+        await Promise.all(puts);
+        assert.equal(deliveries, 1);
+    } finally {
+        await runner.close();
+    }
+});
+
+test('unref and garbage collection do not strand native threads', { timeout: 20000 }, async () => {
+    for (const finish of ['runner.unref();', 'runner = null; setImmediate(() => global.gc());']) {
+        await promisify(execFile)(process.execPath, ['--input-type=module', '--expose-gc', '-e', `
+            import { DhtRunner } from ${JSON.stringify(moduleURL)};
+            let runner = new DhtRunner();
+            runner.run({ port: 0, ipv4: '127.0.0.1', ipv6: '::1' });
+            ${finish}
+        `], { timeout: 8000 });
+    }
+});
+
+test('callback queue completes bursts beyond the former event limit', { timeout: 15000 }, async () => {
+    const runner = startNode();
+    const key = hash('unbounded callback queue');
+    const errors = [];
+    const count = 3000;
+    runner.on('error', error => errors.push(error));
+    const puts = [];
+    try {
+        for (let index = 0; index < count; index++)
+            puts.push(runner.put(key, Buffer.from('value'), { id: BigInt(index + 1) }));
+        const results = await Promise.all(puts);
+        assert.equal(results.length, count);
+        assert.ok(results.every(result => typeof result === 'boolean'));
+        assert.equal(runner.isRunning(), true);
+        assert.deepEqual(errors, []);
+    } finally {
+        await runner.close();
+    }
+});
+
+test('dhtnode example prints help and validates its port', async () => {
+    const { stdout } = await promisify(execFile)(process.execPath, [example, '--help']);
+    assert.match(stdout, /Usage:.*dhtnode/);
+    assert.match(stdout, /bootstrap/);
+    await assert.rejects(promisify(execFile)(process.execPath, [example, '--port', '65536']), error => {
+        assert.equal(error.code, 1);
+        assert.match(error.stderr, /port/i);
+        return true;
+    });
+});
+
+test('dhtnode example accepts piped commands and shuts down on EOF', { timeout: 20000 }, async () => {
+    const peer = startNode();
+    try {
+        const execution = promisify(execFile)(process.execPath, [example,
+            '--port', '0', '--ipv4', '127.0.0.1',
+            '--bootstrap', '127.0.0.1', '--bootstrap-port', String(peer.getBoundPort()),
+        ], { timeout: 15000 });
+        let output = '';
+        let sentReads = false;
+        execution.child.stdout.on('data', data => {
+            output += data;
+            if (!sentReads && /Stored example/.test(output) && /Stored signed/.test(output)) {
+                sentReads = true;
+                execution.child.stdin.end('get example\nget signed\ncancel example\n');
+            }
+        });
+        execution.child.stdin.write('listen example\nput example hello world\nsign signed signed message\n');
+        const { stdout, stderr } = await execution;
+        assert.equal(stderr, '');
+        assert.match(stdout, /Node [0-9a-f]{40}/);
+        assert.match(stdout, /hello world/);
+        assert.match(stdout, /signed message.*\[signed\]/);
+        assert.match(stdout, /Cancelled example/);
+        assert.match(stdout, /Connectivity: IPv4 connected, IPv6 (disconnected|connecting|connected)/);
+    } finally {
+        await peer.close();
+    }
+});
+
+test('dhtnode example handles commands and quit while a get is pending', { timeout: 10000 }, async () => {
+    const execution = promisify(execFile)(process.execPath, ['--input-type=module', '-e', `
+        import { DhtRunner } from ${JSON.stringify(moduleURL)};
+        const close = DhtRunner.prototype.close;
+        let rejectGet;
+        DhtRunner.prototype.getAll = function () {
+            console.log('Get pending');
+            return new Promise((resolve, reject) => { rejectGet = reject; });
+        };
+        DhtRunner.prototype.close = function () {
+            rejectGet?.(new Error('DHT runner is closed'));
+            return close.call(this);
+        };
+        await import(${JSON.stringify(exampleURL.href)});
+    `, '--',
+        '--port', '0', '--ipv4', '127.0.0.1', '--ipv6', '::1',
+    ], { timeout: 8000 });
+    let output = '';
+    execution.child.stdout.on('data', data => {
+        output += data;
+        if (/get KEY \| put KEY TEXT/.test(output)) execution.child.stdin.end('quit\n');
+    });
+    execution.child.stdin.write('get waiting\nhelp\n');
+    const { stdout, stderr } = await execution;
+    assert.match(stdout, /Get pending/);
+    assert.match(stdout, /get KEY \| put KEY TEXT/);
+    assert.equal(stderr, '');
+});
+
+test('dhtnode example shuts down on SIGTERM', { timeout: 10000 }, async () => {
+    if (process.platform === 'win32') return;
+    const execution = promisify(execFile)(process.execPath, [example, '--port', '0', '--ipv4', '127.0.0.1'], { timeout: 8000 });
+    let output = '';
+    execution.child.stdout.on('data', data => {
+        output += data;
+        if (/Node [0-9a-f]{40}/.test(output)) execution.child.kill('SIGTERM');
+    });
+    const { stderr } = await execution;
+    assert.equal(stderr, '');
+});
@@ -0,0 +1,93 @@
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { Certificate, DhtRunner, Identity, PrivateKey, PublicKey, hash } from '../index.js';
+
+const payload = Buffer.from([0, 255, 1, 0, 42]);
+
+test('RSA keys sign, encrypt, and survive password-protected serialization', async () => {
+    const key = await PrivateKey.generate({ algorithm: 'rsa', bits: 2048 });
+    const publicKey = key.getPublicKey();
+    assert.match(publicKey.getId(), /^[0-9a-f]{40}$/);
+    assert.match(publicKey.getLongId(), /^[0-9a-f]{64}$/);
+    const signature = key.sign(payload);
+    assert.equal(publicKey.checkSignature(payload, signature), true);
+    assert.equal(publicKey.checkSignature(Buffer.from('other'), signature), false);
+    assert.deepEqual(key.decrypt(publicKey.encrypt(payload)), payload);
+    const restored = new PrivateKey(key.serialize('test password'), 'test password');
+    const restoredPublic = new PublicKey(publicKey.serialize());
+    assert.equal(restoredPublic.getLongId(), publicKey.getLongId());
+    assert.equal(restoredPublic.checkSignature(payload, restored.sign(payload)), true);
+    assert.deepEqual(restored.decrypt(restoredPublic.encrypt(payload)), payload);
+    assert.throws(() => new PrivateKey(key.serialize('password'), 'wrong password'));
+    assert.throws(() => key.decrypt(Buffer.from('invalid ciphertext')));
+    assert.throws(() => key.serialize('bad\0password'), TypeError);
+});
+
+test('EC keys sign and invalid crypto inputs raise JS errors', async () => {
+    const key = await PrivateKey.generate();
+    const restored = new PrivateKey(key.serialize());
+    assert.equal(restored.getPublicKey().checkSignature(payload, key.sign(payload)), true);
+    const largePayload = Buffer.alloc(16 * 1024 * 1024 + 1, 42);
+    assert.equal(restored.getPublicKey().checkSignature(largePayload, key.sign(largePayload)), true);
+    assert.throws(() => key.getPublicKey().encrypt(payload));
+    for (const Type of [PrivateKey, PublicKey, Certificate]) {
+        assert.throws(() => new Type(Buffer.alloc(0)));
+        assert.throws(() => new Type(Buffer.from('not a key or certificate')));
+        assert.throws(() => new Type(null), TypeError);
+    }
+    assert.throws(() => PrivateKey.generate({ algorithm: 'unknown' }), TypeError);
+    assert.throws(() => PrivateKey.generate({ algorithm: 'rsa', bits: 1 }), RangeError);
+    assert.throws(() => PrivateKey.generate({ algorithm: 'rsa', bits: 2048.5 }), RangeError);
+    assert.throws(() => key.sign('not bytes'), TypeError);
+    assert.throws(() => PrivateKey.prototype.sign.call({}, payload), TypeError);
+});
+
+test('identities own matching keys and certificates and support import', async () => {
+    const identity = await Identity.generate('nodejs crypto');
+    const certificate = new Certificate(identity.certificate.serialize());
+    const key = new PrivateKey(identity.privateKey.serialize());
+    const restored = new Identity(key, certificate);
+    assert.equal(restored.certificate.getLongId(), key.getPublicKey().getLongId());
+    assert.equal(certificate.getPublicKey().checkSignature(payload, key.sign(payload)), true);
+    assert.throws(() => new Identity({}, certificate), TypeError);
+    const other = await PrivateKey.generate();
+    assert.throws(() => new Identity(other, certificate), /match/i);
+});
+
+test('signed and encrypted values round-trip between authenticated nodes', { timeout: 30000 }, async () => {
+    const writerIdentity = await Identity.generate('writer');
+    const readerIdentity = await Identity.generate('reader', { algorithm: 'rsa', bits: 2048 });
+    const writer = new DhtRunner();
+    const reader = new DhtRunner();
+    try {
+        writer.run({ port: 0, ipv4: '127.0.0.1', ipv6: '::1', identity: writerIdentity });
+        reader.run({ port: 0, ipv4: '127.0.0.1', ipv6: '::1', identity: readerIdentity });
+        writer.bootstrap('127.0.0.1', reader.getBoundPort());
+        reader.bootstrap('127.0.0.1', writer.getBoundPort());
+        const signedKey = hash('nodejs signed value');
+        assert.equal(await writer.putSigned(signedKey, payload, { id: 41n }), true);
+        const signed = await reader.getAll(signedKey);
+        assert.ok(signed.some(value => value.data.equals(payload) && value.isSigned));
+        assert.equal(signed[0].owner, writerIdentity.certificate.getLongId());
+        const encryptedKey = hash('nodejs encrypted value');
+        assert.equal(await writer.putEncrypted(encryptedKey, payload, readerIdentity.certificate.getPublicKey(), { id: 42n }), true);
+        const decrypted = await reader.getAll(encryptedKey);
+        assert.ok(decrypted.some(value => value.data.equals(payload)));
+        assert.throws(() => writer.putEncrypted(encryptedKey, payload, {}), TypeError);
+        assert.throws(() => writer.putEncrypted(encryptedKey, payload, writerIdentity.certificate.getPublicKey()), /RSA/i);
+    } finally {
+        await Promise.all([writer.close(), reader.close()]);
+    }
+});
+
+test('signed operations require an identity and reject stopped runners', async () => {
+    const runner = new DhtRunner();
+    try {
+        assert.throws(() => runner.run({ identity: {} }), TypeError);
+        runner.run({ port: 0, ipv4: '127.0.0.1', ipv6: '::1' });
+        assert.throws(() => runner.putSigned(hash('unsigned'), payload), /identity/i);
+    } finally {
+        await runner.close();
+    }
+    assert.throws(() => runner.putSigned(hash('closed'), payload), /closed/i);
+});
@@ -0,0 +1,34 @@
+import assert from 'node:assert/strict';
+import { execFileSync } from 'node:child_process';
+import { readFileSync } from 'node:fs';
+import path from 'node:path';
+import { test } from 'node:test';
+
+const root = path.resolve(import.meta.dirname, '..');
+
+test('package exposes ESM-only named exports', () => {
+    const manifest = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8'));
+    assert.equal(manifest.type, 'module');
+    assert.equal(manifest.exports['.'].import, './index.js');
+    assert.equal(manifest.exports['.'].require, undefined);
+    const stdout = execFileSync(process.execPath, ['--input-type=module', '-e', `
+        import { DhtRunner, hash } from ${JSON.stringify(manifest.name)};
+        console.log(hash('hello'));
+        const runner = new DhtRunner();
+        await runner.close();
+    `], { cwd: root, encoding: 'utf8' });
+    assert.equal(stdout.trim(), 'aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d');
+});
+
+test('npm archive contains runtime files and excludes development artifacts', () => {
+    const npm = process.env.npm_execpath;
+    assert.ok(npm, 'Run the package contract with npm test');
+    const [archive] = JSON.parse(execFileSync(process.execPath,
+        [npm, 'pack', '--dry-run', '--json', '--ignore-scripts'],
+        { cwd: root, encoding: 'utf8' }));
+    const files = archive.files.map(file => file.path);
+    for (const file of ['index.js', 'index.d.ts', 'crypto.js', 'README.md', 'examples/dhtnode.js', 'examples/dhtnode.ts']) assert.ok(files.includes(file), file);
+    assert.equal(files.some(file => /^(build[^/]*|node_modules|test|scripts)\//.test(file)), false);
+    assert.equal(files.some(file => /\.(cpp|h|tsbuildinfo)$/.test(file)), false);
+    assert.ok(files.every(file => /^(index\.js|index\.d\.ts|crypto\.js|README\.md|package\.json|examples\/dhtnode\.(js|ts)|prebuilds\/)/.test(file)));
+});
@@ -0,0 +1,56 @@
+import { Certificate, DhtRunner, Identity, PrivateKey, PublicKey, hash, version } from '../index.js';
+import type { ConnectivityStatus, ListenEvent, ListenerIterator, NodeStatus, Value, ValueIterator } from '../index.js';
+
+async function exercise(): Promise<void> {
+    const privateKey: PrivateKey = await PrivateKey.generate({ algorithm: 'rsa', bits: 2048 });
+    const publicKey: PublicKey = new PublicKey(privateKey.getPublicKey().serialize());
+    const identity: Identity = await Identity.generate('typed identity');
+    const restored = new Identity(identity.privateKey, new Certificate(identity.certificate.serialize()));
+    const valid: boolean = publicKey.checkSignature(Buffer.alloc(0), privateKey.sign(Buffer.alloc(0)));
+    const plaintext: Buffer = privateKey.decrypt(publicKey.encrypt(Buffer.from('secret')));
+    const runner = new DhtRunner();
+    runner.on('error', (error: Error) => { throw error; });
+    runner.on('statusChanged', status => {
+        const ipv4: NodeStatus = status.ipv4;
+        const ipv6: NodeStatus = status.ipv6;
+        void [ipv4, ipv6];
+    });
+    const status: ConnectivityStatus = runner.getStatus();
+    runner.run({ port: 0, network: 1, persistPath: '', identity: restored });
+    runner.bootstrap('127.0.0.1', runner.getBoundPort(4));
+    const key: string = hash(new Uint8Array([0, 255]));
+    const accepted: boolean = await runner.put(key, Buffer.from(version), { id: 42n, permanent: true });
+    const signed: boolean = await runner.putSigned(key, plaintext);
+    const encrypted: boolean = await runner.putEncrypted(key, plaintext, publicKey);
+    const values: Value[] = await runner.getAll(key);
+    const get: ValueIterator<Value> = runner.get(key);
+    for await (const value of get) {
+        const payload: Buffer = value.data;
+        void payload;
+    }
+    const listener = runner.listen(key, (value, expired) => {
+        const payload: Buffer = value.data;
+        const id: bigint = value.id;
+        void [payload, id, expired];
+    });
+    runner.ref().unref();
+    listener.cancel();
+    const iterator: ListenerIterator = runner.listen(key);
+    for await (const event of iterator) {
+        const typed: ListenEvent = event;
+        const value: Value = typed.value;
+        const expired: boolean = typed.expired;
+        void [value, expired];
+        break;
+    }
+    iterator.cancel();
+    await iterator.return();
+    await iterator[Symbol.asyncDispose]();
+    await runner[Symbol.asyncDispose]();
+    const proxy = new DhtRunner();
+    proxy.run({ proxyServer: 'https://proxy.example.com', proxyUserAgent: 'typed-client/1.0' });
+    await proxy.close();
+    void [accepted, values, valid, signed, encrypted, status];
+}
+
+void exercise;
@@ -7,4 +7,4 @@ Description: Distributed Hash Table library (C Wrapper)
 Version: @VERSION@
 Libs: -L${libdir} -lopendht-c
 Requires.private: opendht gnutls >= 3.1 @argon2_lib@
-Cflags: -I${includedir}
+Cflags: -I${includedir}@opendht_c_public_cflags@
@@ -9,4 +9,4 @@ Libs: -L${libdir} -lopendht -lfmt
 Libs.private: @http_lib@ -pthread
 Requires: gnutls >= 3.3@jsoncpp_lib@@openssl_lib@
 Requires.private: nettle >= 2.4@argon2_lib@@llhttp_lib@@iouring_lib@@simdutf_lib@
-Cflags: -I${includedir}
+Cflags: -I${includedir}@opendht_public_cflags@
@@ -0,0 +1,118 @@
+diff --git a/SMP/libgnutls.vcxproj.filters b/SMP/libgnutls.vcxproj.filters
+index b182189..91ee160 100644
+--- a/SMP/libgnutls.vcxproj.filters
+++ b/SMP/libgnutls.vcxproj.filters
+@@ -103,9 +103,6 @@
+     <Filter Include="Header Files\lib\inih">
+       <UniqueIdentifier>{ae0c3eeb-53df-4c72-a85a-6b46de35e7ba}</UniqueIdentifier>
+     </Filter>
+-    <Filter Include="Source Files\libtasn1">
+-      <UniqueIdentifier>{32be60b7-8c65-486e-9df5-7e529443cf07}</UniqueIdentifier>
+-    </Filter>
+     <Filter Include="Source Files\lib\nettle\gost">
+       <UniqueIdentifier>{1f3549a8-3c3d-475f-8fd6-20451d336464}</UniqueIdentifier>
+     </Filter>
+@@ -1553,30 +1550,6 @@
+     <ClCompile Include="..\lib\nettle\sysrng-bcrypt.c">
+       <Filter>Source Files\lib\nettle</Filter>
+     </ClCompile>
+-    <ClCompile Include="..\devel\libtasn1\lib\coding.c">
+-      <Filter>Source Files\libtasn1</Filter>
+-    </ClCompile>
+-    <ClCompile Include="..\devel\libtasn1\lib\decoding.c">
+-      <Filter>Source Files\libtasn1</Filter>
+-    </ClCompile>
+-    <ClCompile Include="..\devel\libtasn1\lib\element.c">
+-      <Filter>Source Files\libtasn1</Filter>
+-    </ClCompile>
+-    <ClCompile Include="..\devel\libtasn1\lib\errors.c">
+-      <Filter>Source Files\libtasn1</Filter>
+-    </ClCompile>
+-    <ClCompile Include="..\devel\libtasn1\lib\gstr.c">
+-      <Filter>Source Files\libtasn1</Filter>
+-    </ClCompile>
+-    <ClCompile Include="..\devel\libtasn1\lib\parser_aux.c">
+-      <Filter>Source Files\libtasn1</Filter>
+-    </ClCompile>
+-    <ClCompile Include="..\devel\libtasn1\lib\structure.c">
+-      <Filter>Source Files\libtasn1</Filter>
+-    </ClCompile>
+-    <ClCompile Include="..\devel\libtasn1\lib\version.c">
+-      <Filter>Source Files\libtasn1</Filter>
+-    </ClCompile>
+     <ClCompile Include="..\lib\nettle\gost\acpkm.c">
+       <Filter>Source Files\lib\nettle\gost</Filter>
+     </ClCompile>
+diff --git a/SMP/libgnutls_files.props b/SMP/libgnutls_files.props
+index adcb074..2317c2a 100644
+--- a/SMP/libgnutls_files.props
+++ b/SMP/libgnutls_files.props
+@@ -179,13 +179,6 @@
+   <ItemGroup>
+     <ClCompile Include="lib\gnutls_asn1_tab.c" />
+     <ClCompile Include="lib\pkix_asn1_tab.c" />
+-    <ClCompile Include="..\devel\libtasn1\lib\coding.c" />
+-    <ClCompile Include="..\devel\libtasn1\lib\decoding.c" />
+-    <ClCompile Include="..\devel\libtasn1\lib\element.c" />
+-    <ClCompile Include="..\devel\libtasn1\lib\gstr.c" />
+-    <ClCompile Include="..\devel\libtasn1\lib\parser_aux.c" />
+-    <ClCompile Include="..\devel\libtasn1\lib\structure.c" />
+-    <ClCompile Include="..\devel\libtasn1\lib\version.c" />
+     <ClCompile Include="..\gnulib\lib\c-strcasecmp.c" />
+     <ClCompile Include="..\gnulib\lib\c-strncasecmp.c" />
+     <ClCompile Include="..\gnulib\lib\cloexec.c" />
+@@ -572,9 +565,6 @@
+     <ClCompile Include="..\gnulib\lib\readdir.c">
+       <ForcedIncludeFiles>dirent-private.h;%(ForcedIncludeFiles)</ForcedIncludeFiles>
+     </ClCompile>
+-    <ClCompile Include="..\devel\libtasn1\lib\errors.c">
+-      <ObjectFileName>$(IntDir)\tasn1_$(filename).obj</ObjectFileName>
+-    </ClCompile>
+     <ClCompile Include="..\lib\algorithms\ecc.c">
+       <ObjectFileName>$(IntDir)\alg_%(Filename).obj</ObjectFileName>
+     </ClCompile>
+diff --git a/SMP/libgnutls_winrt.vcxproj.filters b/SMP/libgnutls_winrt.vcxproj.filters
+index 014a408..ae5ecff 100644
+--- a/SMP/libgnutls_winrt.vcxproj.filters
+++ b/SMP/libgnutls_winrt.vcxproj.filters
+@@ -103,9 +103,6 @@
+     <Filter Include="Header Files\lib\inih">
+       <UniqueIdentifier>{ae0c3eeb-53df-4c72-a85a-6b46de35e7ba}</UniqueIdentifier>
+     </Filter>
+-    <Filter Include="Source Files\libtasn1">
+-      <UniqueIdentifier>{32be60b7-8c65-486e-9df5-7e529443cf07}</UniqueIdentifier>
+-    </Filter>
+     <Filter Include="Header Files\lib\nettle\gost">
+       <UniqueIdentifier>{4fada990-3138-4089-a6c7-ae722a0e7fe9}</UniqueIdentifier>
+     </Filter>
+@@ -1553,30 +1550,6 @@
+     <ClCompile Include="..\lib\nettle\sysrng-bcrypt.c">
+       <Filter>Source Files\lib\nettle</Filter>
+     </ClCompile>
+-    <ClCompile Include="..\devel\libtasn1\lib\coding.c">
+-      <Filter>Source Files\libtasn1</Filter>
+-    </ClCompile>
+-    <ClCompile Include="..\devel\libtasn1\lib\decoding.c">
+-      <Filter>Source Files\libtasn1</Filter>
+-    </ClCompile>
+-    <ClCompile Include="..\devel\libtasn1\lib\element.c">
+-      <Filter>Source Files\libtasn1</Filter>
+-    </ClCompile>
+-    <ClCompile Include="..\devel\libtasn1\lib\errors.c">
+-      <Filter>Source Files\libtasn1</Filter>
+-    </ClCompile>
+-    <ClCompile Include="..\devel\libtasn1\lib\gstr.c">
+-      <Filter>Source Files\libtasn1</Filter>
+-    </ClCompile>
+-    <ClCompile Include="..\devel\libtasn1\lib\parser_aux.c">
+-      <Filter>Source Files\libtasn1</Filter>
+-    </ClCompile>
+-    <ClCompile Include="..\devel\libtasn1\lib\structure.c">
+-      <Filter>Source Files\libtasn1</Filter>
+-    </ClCompile>
+-    <ClCompile Include="..\devel\libtasn1\lib\version.c">
+-      <Filter>Source Files\libtasn1</Filter>
+-    </ClCompile>
+     <ClCompile Include="..\lib\accelerated\afalg.c">
+       <Filter>Source Files\lib\accelerated</Filter>
+     </ClCompile>
@@ -0,0 +1,12 @@
+--- a/lib/gnutls.pc.in
+++ b/lib/gnutls.pc.in
+@@ -18,7 +18,7 @@
+ Name: GnuTLS
+ Description: Transport Security Layer implementation for the GNU system
+ URL: https://www.gnutls.org/
+ Version: @VERSION@
+-Libs: -L${libdir} -lgnutls
+Libs: -L${libdir} @GNUTLS_LIBS@
+ Libs.private: @LIBINTL@ @LIBSOCKET@ @INET_PTON_LIB@ @LIBPTHREAD@ @LIB_SELECT@ @TSS_LIBS@ @GMP_LIBS@ @LIBUNISTRING@ @LIBATOMIC_LIBS@ @GNUTLS_LIBS_PRIVATE@
+ @GNUTLS_REQUIRES_PRIVATE@
+ Cflags: -I${includedir}
@@ -0,0 +1,187 @@
+set(GNULIB_REF "1cc0125a28cba4e8503d853bf99b854fe4dd454c")
+
+vcpkg_from_github(
+    OUT_SOURCE_PATH SOURCE_PATH
+    REPO savoirfairelinux/gnutls
+    REF 300b0c721fc1809f3d191b7f9e289c0267eabd01
+    SHA512 8a74fbf0343e658f6321da0f28bcc05c580fb7b950f6edfb6a8fdaad6d814456ed2dbf94e8dd330c7740c836f01e04552e649d529ee29424c3641861c41344bf
+    HEAD_REF fix/ci-msvc
+    PATCHES
+        external-libtasn1.patch
+        pkgconfig.patch
+)
+
+file(REMOVE_RECURSE "${SOURCE_PATH}/devel/perlasm")
+
+vcpkg_download_distfile(
+    GNULIB_SNAPSHOT
+    URLS "https://gitlab.com/libidn/gnulib-mirror/-/archive/${GNULIB_REF}/gnulib-mirror-${GNULIB_REF}.tar.gz"
+    FILENAME "gnulib-mirror-${GNULIB_REF}.tar.gz"
+    SHA512 340539bd7b8e30b1e0f81a15fb207960e9ae3c4ef515f39f1d1bdb43ed52ad94a29c6a6ce8bbca3484ba5392e1dae7447c2f6b58124209614e884345e13914f5
+)
+
+vcpkg_extract_source_archive(
+    GNULIB_SOURCE_PATH
+    ARCHIVE "${GNULIB_SNAPSHOT}"
+    SOURCE_BASE ${GNULIB_REF}
+)
+
+file(REMOVE_RECURSE "${SOURCE_PATH}/gnulib")
+file(RENAME "${GNULIB_SOURCE_PATH}" "${SOURCE_PATH}/gnulib")
+
+include("${CURRENT_HOST_INSTALLED_DIR}/share/yasm-tool-helper/yasm-tool-helper.cmake")
+yasm_tool_helper(OUT_VAR YASM)
+file(TO_NATIVE_PATH "${YASM}" YASM)
+
+if(VCPKG_LIBRARY_LINKAGE STREQUAL "dynamic")
+    set(CONFIGURATION_RELEASE ReleaseDLL)
+    set(CONFIGURATION_DEBUG DebugDLL)
+else()
+    set(CONFIGURATION_RELEASE Release)
+    set(CONFIGURATION_DEBUG Debug)
+endif()
+
+if(VCPKG_TARGET_IS_UWP)
+    string(APPEND CONFIGURATION_RELEASE WinRT)
+    string(APPEND CONFIGURATION_DEBUG WinRT)
+endif()
+
+set(_gnutlsproject "${SOURCE_PATH}/SMP/libgnutls.vcxproj")
+file(READ "${_gnutlsproject}" _contents)
+string(REPLACE  [[<Import Project="$(VCTargetsPath)\BuildCustomizations\yasm.props" />]]
+                    "<Import Project=\"${CURRENT_HOST_INSTALLED_DIR}/share/vs-yasm/yasm.props\" />"
+                _contents "${_contents}")
+string(REPLACE  [[<Import Project="$(VCTargetsPath)\BuildCustomizations\yasm.targets" />]]
+                    "<Import Project=\"${CURRENT_HOST_INSTALLED_DIR}/share/vs-yasm/yasm.targets\" />"
+                _contents "${_contents}")
+string(REGEX REPLACE "${VCPKG_ROOT_DIR}/installed/[^/]+/share" "${CURRENT_HOST_INSTALLED_DIR}/share" _contents "${_contents}") # Above already
+file(WRITE "${_gnutlsproject}" "${_contents}")
+
+if(VCPKG_CRT_LINKAGE STREQUAL "static")
+    set(RuntimeLibraryExt "")
+else()
+    set(RuntimeLibraryExt "DLL")
+endif()
+
+# patch output library file path and name
+foreach(PROPS IN ITEMS
+"${SOURCE_PATH}/SMP/smp_deps.props"
+"${SOURCE_PATH}/SMP/smp_winrt_deps.props")
+vcpkg_replace_string(
+    "${PROPS}"
+    [=[_winrt</TargetName>]=]
+    [=[</TargetName>]=]
+    IGNORE_UNCHANGED
+)
+vcpkg_replace_string(
+    "${PROPS}"
+    [=[<TargetName>lib$(RootNamespace)]=]
+    [=[<TargetName>$(RootNamespace)]=]
+)
+endforeach()
+
+# patch hogweed, gmp, nettle, zlib libraries file names; inject RuntimeLibrary property to control CRT linkage 
+foreach(VCXPROJ IN ITEMS
+"${SOURCE_PATH}/SMP/libgnutls.vcxproj"
+"${SOURCE_PATH}/SMP/libgnutls_winrt.vcxproj")
+vcpkg_replace_string(
+    "${VCXPROJ}"
+    "_winrt.lib"
+    ".lib"
+    IGNORE_UNCHANGED
+)
+vcpkg_replace_string(
+    "${VCXPROJ}"
+    "libhogweed"
+    "hogweed"
+)
+vcpkg_replace_string(
+    "${VCXPROJ}"
+    "hogweedd"
+    "hogweed"
+)
+vcpkg_replace_string(
+    "${VCXPROJ}"
+    "libgmp"
+    "gmp"
+)
+vcpkg_replace_string(
+    "${VCXPROJ}"
+    "gmpd"
+    "gmp"
+)
+vcpkg_replace_string(
+    "${VCXPROJ}"
+    "libnettle"
+    "nettle"
+)
+vcpkg_replace_string(
+    "${VCXPROJ}"
+    "nettled"
+    "nettle"
+)
+set(zlib_basename "zlib")
+if(EXISTS "${CURRENT_INSTALLED_DIR}/lib/zs.lib")
+    set(zlib_basename "zs")
+elseif(EXISTS "${CURRENT_INSTALLED_DIR}/lib/z.lib")
+    set(zlib_basename "z")
+endif()
+vcpkg_replace_string(
+    "${VCXPROJ}"
+    "libzlib"
+    "${zlib_basename}"
+)
+vcpkg_replace_string(
+    "${VCXPROJ}"
+    "zlib"
+    "${zlib_basename}"
+)
+vcpkg_replace_string(
+    "${VCXPROJ}"
+    [=[</DisableSpecificWarnings>]=]
+    [=[</DisableSpecificWarnings><ForcedIncludeFiles>gnutls_msvc_fixes.h;%(ForcedIncludeFiles)</ForcedIncludeFiles><RuntimeLibrary>$(RuntimeLibrary)</RuntimeLibrary>]=]
+)
+endforeach()
+
+vcpkg_install_msbuild(
+    USE_VCPKG_INTEGRATION
+    SOURCE_PATH "${SOURCE_PATH}"
+    PROJECT_SUBPATH SMP/libgnutls.sln
+    PLATFORM ${TRIPLET_SYSTEM_ARCH}
+    LICENSE_SUBPATH LICENSE
+    RELEASE_CONFIGURATION ${CONFIGURATION_RELEASE}
+    DEBUG_CONFIGURATION ${CONFIGURATION_DEBUG}
+    SKIP_CLEAN
+    OPTIONS /p:YasmPath="${YASM}" /p:OutDir=..\\msvc
+    OPTIONS_DEBUG /p:RuntimeLibrary=MultiThreadedDebug${RuntimeLibraryExt}
+    OPTIONS_RELEASE /p:RuntimeLibrary=MultiThreaded${RuntimeLibraryExt}
+)
+
+get_filename_component(SOURCE_PATH_SUFFIX "${SOURCE_PATH}" NAME)
+if(VCPKG_TARGET_IS_UWP)
+    set(WINRT_SUBFOLDER libgnutls_winrt)
+endif()
+file(INSTALL "${CURRENT_BUILDTREES_DIR}/${TARGET_TRIPLET}-rel/${SOURCE_PATH_SUFFIX}/msvc/${WINRT_SUBFOLDER}/include" DESTINATION "${CURRENT_PACKAGES_DIR}")
+
+set(GNUTLS_REQUIRES_PRIVATE "Requires.private: gmp, nettle, hogweed, libtasn1, zlib")
+set(GNUTLS_LIBS_PRIVATE "-lcrypt32 -lws2_32 -lkernel32 -lncrypt")
+
+set(prefix "${CURRENT_INSTALLED_DIR}")
+set(exec_prefix "\${prefix}")
+set(libdir "\${prefix}/lib")
+set(includedir "\${prefix}/include")
+set(GNUTLS_LIBS "-lgnutls")
+configure_file("${SOURCE_PATH}/lib/gnutls.pc.in" "${CURRENT_PACKAGES_DIR}/lib/pkgconfig/gnutls.pc" @ONLY)
+
+if(NOT VCPKG_BUILD_TYPE)
+  set(prefix "${CURRENT_INSTALLED_DIR}/debug")
+  set(exec_prefix "\${prefix}")
+  set(libdir "\${prefix}/lib")
+  set(includedir "\${prefix}/../include")
+  set(GNUTLS_LIBS "-lgnutlsd")
+  configure_file("${SOURCE_PATH}/lib/gnutls.pc.in" "${CURRENT_PACKAGES_DIR}/debug/lib/pkgconfig/gnutls.pc" @ONLY)
+endif()
+
+vcpkg_fixup_pkgconfig()
+vcpkg_copy_pdbs()
+file(COPY "${CURRENT_PORT_DIR}/vcpkg-cmake-wrapper.cmake" DESTINATION "${CURRENT_PACKAGES_DIR}/share/gnutls")
@@ -0,0 +1,2 @@
+find_library(GNUTLS_LIBRARY NAMES gnutls gnutlsd NAMES_PER_DIR)
+_find_package(${ARGS})
@@ -0,0 +1,23 @@
+{
+    "name": "shiftmedia-libgnutls",
+    "version": "3.8.13",
+    "port-version": 0,
+    "description": "GnuTLS fork maintained by Savoir-faire Linux with native Visual Studio project build tools.",
+    "homepage": "https://github.com/savoirfairelinux/gnutls",
+    "license": "LGPL-2.1-only",
+    "supports": "windows & !arm & !mingw & !xbox",
+    "dependencies": [
+        "gmp",
+        "libtasn1",
+        "nettle",
+        {
+            "name": "vs-yasm",
+            "host": true
+        },
+        {
+            "name": "yasm-tool-helper",
+            "host": true
+        },
+        "zlib"
+    ]
+}
@@ -1,30 +0,0 @@
-if USE_CYTHON
-
-noinst_HEADERS = \
-	opendht.pyx \
-	opendht_cpp.pxd \
-	pyproject.toml
-
-PYTHON_INSTALL_RECORD = $(builddir)/install_record.txt
-
-pybuild.stamp:
-	LDFLAGS="-L$(top_srcdir)/src/.libs" $(PYTHON) -m build .
-	echo stamp > pybuild.stamp
-
-CLEANFILES = pybuild.stamp
-
-all-local: pybuild.stamp
-clean-local:
-	rm -rf $(builddir)/build $(builddir)/*.so $(PYTHON_INSTALL_RECORD)
-
-install-exec-local:
-	$(PYTHON) -m pip install --no-deps --no-build-isolation . \
-		--root=$(DESTDIR)/ --prefix=$(prefix)
-	rm -rf $(builddir)/build
-
-if HAVE_PIP
-uninstall-local:
-	/usr/bin/yes | $(PIP) uninstall $(PACKAGE)
-endif
-
-endif
@@ -78,12 +78,183 @@ async def dht_async_demo(key_str: str):
 asyncio.run(dht_async_demo("unique_key"))
 ```

+## Node State Persistence
+
+Set the state file path before starting a node:
+
+```python
+import threading
+import opendht as dht
+
+config = dht.DhtConfig()
+config.setPersistPath("dht-state.msgpack")
+node = dht.DhtRunner()
+node.run(config=config)
+stopped = threading.Event()
+node.shutdown(stopped.set)
+stopped.wait()
+node.join()
+```
+
+The node loads its saved DHT node ID, known peers, and stored values on startup,
+and saves state during `shutdown()`. Wait for the shutdown callback before
+calling `join()` or reusing the state path; `join()` alone does not save state.
+Port hints are
+stored in a sibling file named `<path>_port.txt`; saved ports are reused when
+available. The parent directory must already exist and be writable. Use a
+different state path for each node.
+
+Persistence is disabled by default. `config.setPersistPath("")` disables it
+explicitly. This state does not include private keys or certificates; persist
+cryptographic identities separately as described below.
+
+## Identity Persistence
+
+Keys can be imported from PEM or DER bytes. Private keys export PKCS#8 PEM;
+public keys export DER. Certificates export their complete PEM chain.
+
+```python
+import opendht as dht
+
+identity = dht.Identity.generate("my-node")
+
+private_key_pem = identity.key.serialize(password)
+certificate_pem = bytes(identity.certificate)
+public_key_der = bytes(identity.publickey)
+
+restored = dht.Identity(
+    dht.PrivateKey(private_key_pem, password),
+    dht.Certificate(certificate_pem),
+)
+public_key = dht.PublicKey(public_key_der)
+node = dht.DhtRunner()
+node.run(id=restored)
+```
+
+Here `password` is an application-supplied string. Save the exported bytes using
+your application's storage, protect private key files, and keep the password
+separate from the key. `bytes(private_key)` and `private_key.serialize()` without
+a password export **unencrypted** private keys. Empty or malformed key data,
+incorrect passwords, and passwords containing NUL characters raise exceptions.
+Exporting an uninitialized key raises `ValueError`.
+
+## Value Metadata
+
+The following properties are readable and writable on `Value`, including values
+returned by `get()` and `listen()`:
+
+| Property | Type | Meaning |
+|----------|------|---------|
+| `type` | unsigned 16-bit integer | Native value type identifier |
+| `seq` | unsigned 16-bit integer | Sequence number for signed value updates |
+| `priority` | unsigned integer | Push priority: `0` high, `1` normal |
+| `pushType` | string | Push notification type, such as `audioCall` |
+
+```python
+value = dht.Value(b"some binary data")
+value.type = 42
+value.seq = 1
+value.priority = 1
+value.pushType = "audioCall"
+```
+
+Set metadata before publishing the value. Numeric values outside the native
+integer range raise `OverflowError`.
+
+`value.isSigned()` reports whether a public key and signature are present;
+it does not verify the signature. `value.isEncrypted()` reports whether the
+value currently contains ciphertext. Values delivered by `get()` and `listen()`
+are transparently decrypted when possible, so decrypted values return `False`
+from `isEncrypted()`, even if they were published using `putEncrypted()`.
+An uninitialized `PublicKey()` cannot be used as an encryption recipient and
+raises `ValueError`.
+
+Register custom `ValueType` instances after `run()` and before `join()`.
+`registerType()` raises `RuntimeError` when the runner is stopped, `TypeError`
+for `None`, and `ValueError` for an uninitialized type.
+
+## Observability
+
+`getNodeInfo()` returns a read-only `NodeInfo` snapshot with node identifiers,
+IPv4/IPv6 routing statistics, bound ports, pending-operation count, and local
+and remote storage counters. `getNodesStats(socket.AF_INET)` and
+`getNodesStats(socket.AF_INET6)` return `NodeStats` snapshots. Snapshots remain
+valid after the runner stops. `getPublicAddress()` returns known public
+`SockAddr` objects; pass an address family to restrict the results, or use
+`getPublicAddressStr()` for strings. These lists may be empty before discovery.
+`getNodeMessageStats(incoming=True)` selects incoming message counters.
+
+```python
+info = node.getNodeInfo()
+print(info.node_id, info.bound4, info.ipv4.good_nodes, info.storage_size)
+print(node.getPublicAddressStr())
+
+node.setOnStatusChanged(lambda ipv4, ipv6: print(ipv4.name, ipv6.name))
+node.setOnStatusChanged(None)
+```
+
+The status callback receives two `NodeStatus` values: `Disconnected`,
+`Connecting`, or `Connected`. Registration replaces the previous callback and
+persists across restarts; `None` disables it. Core callbacks run on the DHT
+thread while native locks are held: do not call snapshot getters, type
+registration, logging controls, `run()`, blocking operations, or `join()` from
+them. The asyncio wrapper schedules status callbacks on its event-loop thread,
+where snapshot getters are safe to use.
+
+Call `node.connectivityChanged()` after a network-interface or IP-address
+change. It queues native connectivity recovery, including recontacting peers
+and renewing subscriptions. It is also available on the asyncio runner as a
+synchronous, nonblocking method.
+
+## Queries And Filtered Listeners
+
+`query()` retrieves metadata rather than complete value payloads. Each row is
+a dictionary keyed by `ValueField`. Network projections support `Id`,
+`ValueType`, `OwnerPk`, and `UserType`; values are integers, an `InfoHash` owner
+fingerprint, or a UTF-8 string respectively. Explicit sequence-number
+projections are not supported by the native wire format.
+
+```python
+selection = dht.Select().field(dht.ValueField.Id).field(dht.ValueField.UserType)
+query = dht.Query()
+query.buildFrom(selection, dht.Where().userType("record"))
+rows = node.query(key, query=query)
+
+query = dht.Query("SELECT id,user_type WHERE user_type=record")
+node.query(key, query_cb=lambda row: print(row) or True,
+           done_cb=lambda ok, nodes: print(ok), query=query)
+```
+
+Without an explicit query, all four supported metadata fields are selected.
+Supplying `query_cb` makes the core call nonblocking; returning `False` stops
+delivery. The blocking core API returns the collected rows, as `get()` does.
+The asyncio API offers `query()` as a context-managed async iterator and
+`await queryAll()` as a collector; these raise `RuntimeError` on failure.
+
+```python
+rows = await node.queryAll(key, query=query)
+with node.query(key, query=query) as results:
+    async for row in results:
+        print(row[dht.ValueField.Id])
+```
+
+Both core and asyncio `listen()` accept optional `where` and `filter` arguments.
+`Where` is sent to the DHT to narrow the subscription; the Python predicate
+runs locally. Existing two-argument core listeners are unchanged.
+
+```python
+token = node.listen(key, lambda value, expired: True,
+                    where=dht.Where().userType("record"),
+                    filter=lambda value: len(value.data) < 1024)
+node.cancelListen(token)
+```
+
 ## Documentation

 For more information, examples and documentation, or to repport issues, visit: https://opendht.net

 ## License

-Copyright (C) 2014-2025 Savoir-faire Linux Inc.
+Copyright (c) 2014-2026 Savoir-faire Linux Inc.

-OpenDHT is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 3 of the License, or (at your option) any later version.
+OpenDHT is released under the MIT License. See [LICENSE](LICENSE) for details.
@@ -5,34 +5,28 @@
 # distutils: libraries = opendht gnutls
 # cython: language_level=3
 #
-# Copyright (C) 2014-2025 Savoir-faire Linux Inc.
-#
-# This program is free software: you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation, either version 3 of the License, or
-# (at your option) any later version.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program. If not, see <https://www.gnu.org/licenses/>.
+# Copyright (c) 2014-2026 Savoir-faire Linux Inc.
+# SPDX-License-Identifier: MIT

 from libcpp.map cimport map as map
 from libcpp cimport bool
 from libcpp.utility cimport pair
 from libcpp.string cimport string
-from libcpp.memory cimport shared_ptr
+from libcpp.memory cimport shared_ptr, unique_ptr

 from cython.operator cimport dereference as deref, preincrement as inc, predecrement as dec
 from cpython cimport ref
 from datetime import timedelta
+from enum import IntEnum as _IntEnum
+from operator import index as _index

 cimport opendht_cpp as cpp

+ctypedef cpp.Pht* _PhtPtr
+
 import threading
+import socket as _socket
+import weakref as _weakref

 cdef inline void _initialize_gnutls():
    cdef int err = cpp.gnutls_global_init()
@@ -51,6 +45,58 @@ _initialize_gnutls()
 def version() -> str:
    return cpp.version().decode()

+class NodeStatus(_IntEnum):
+    Disconnected = 0
+    Connecting = 1
+    Connected = 2
+
+class ValueField(_IntEnum):
+    Id = 1
+    ValueType = 2
+    OwnerPk = 3
+    SeqNum = 4
+    UserType = 5
+
+class _StatusCallbackState:
+    __slots__ = ("callback", "__weakref__")
+    def __init__(self):
+        self.callback = None
+
+cdef inline void status_callback(int ipv4, int ipv6, void* user_data) noexcept with gil:
+    state = (<object>user_data)()
+    if state is None:
+        return
+    callback = state.callback
+    if callback is not None:
+        callback(NodeStatus(ipv4), NodeStatus(ipv6))
+
+cdef inline bool query_callback(shared_ptr[cpp.FieldValueIndex] value, void* user_data) noexcept with gil:
+    cdef cpp.Blob blob
+    row = {}
+    for entry in value.get().index:
+        field = ValueField(<int>entry.first)
+        if field == ValueField.OwnerPk:
+            owner = InfoHash()
+            owner._infohash = entry.second.getHash()
+            row[field] = owner
+        elif field == ValueField.UserType:
+            blob = entry.second.getBlob()
+            row[field] = (<char*>blob.data())[:blob.size()].decode()
+        else:
+            row[field] = entry.second.getInt()
+    return (<object>user_data)['query'](row)
+
+cdef inline void query_done_callback(bool done, cpp.vector[shared_ptr[cpp.Node]]* nodes, void* user_data) noexcept with gil:
+    callback = (<object>user_data)['done']
+    if callback is not None:
+        entries = []
+        for node in deref(nodes):
+            entry = NodeEntry()
+            entry._v.first = node.get().getId()
+            entry._v.second = node
+            entries.append(entry)
+        callback(done, entries)
+
 cdef inline void lookup_callback(cpp.vector[cpp.shared_ptr[cpp.IndexValue]]* values, cpp.Prefix* p, void *user_data) noexcept with gil:
    cbs = <object>user_data
    if 'lookup' in cbs and cbs['lookup']:
@@ -63,9 +109,11 @@ cdef inline void lookup_callback(cpp.vector[cpp.shared_ptr[cpp.IndexValue]]* val

 cdef inline void shutdown_callback(void* user_data) noexcept with gil:
    cbs = <object>user_data
-    if 'shutdown' in cbs and cbs['shutdown']:
-        cbs['shutdown']()
-    ref.Py_DECREF(cbs)
+    try:
+        if 'shutdown' in cbs and cbs['shutdown']:
+            cbs['shutdown']()
+    finally:
+        ref.Py_DECREF(cbs)

 cdef inline bool get_callback(shared_ptr[cpp.Value] value, void *user_data) noexcept with gil:
    cbs = <object>user_data
@@ -84,22 +132,26 @@ cdef inline bool value_callback(shared_ptr[cpp.Value] value, bool expired, void
    return cb(pv, expired) if not f or f(pv) else True

 cdef inline void done_callback(bool done, cpp.vector[shared_ptr[cpp.Node]]* nodes, void *user_data) noexcept with gil:
-    node_ids = []
-    for n in deref(nodes):
-        h = NodeEntry()
-        h._v.first = n.get().getId()
-        h._v.second = n
-        node_ids.append(h)
    cbs = <object>user_data
-    if 'done' in cbs and cbs['done']:
-        cbs['done'](done, node_ids)
-    ref.Py_DECREF(cbs)
+    try:
+        node_ids = []
+        for n in deref(nodes):
+            h = NodeEntry()
+            h._v.first = n.get().getId()
+            h._v.second = n
+            node_ids.append(h)
+        if 'done' in cbs and cbs['done']:
+            cbs['done'](done, node_ids)
+    finally:
+        ref.Py_DECREF(cbs)

 cdef inline void done_callback_simple(bool done, void *user_data) noexcept with gil:
    cbs = <object>user_data
-    if 'done' in cbs and cbs['done']:
-        cbs['done'](done)
-    ref.Py_DECREF(cbs)
+    try:
+        if 'done' in cbs and cbs['done']:
+            cbs['done'](done)
+    finally:
+        ref.Py_DECREF(cbs)

 cdef class _WithID(object):
    def __repr__(self):
@@ -113,6 +165,12 @@ cdef class _WithPk(object):
    def __str__(self):
        return self.getLongId().toString().decode()

+cdef inline unsigned _checked_bit_index(bit, unsigned bit_count) except *:
+    bit = _index(bit)
+    if bit < 0 or bit >= bit_count:
+        raise IndexError("bit index out of range")
+    return bit
+
 cdef class InfoHash(_WithID):
    cdef cpp.InfoHash _infohash
    def __cinit__(self, bytes str=b''):
@@ -128,9 +186,9 @@ cdef class InfoHash(_WithID):
            return self._infohash == other._infohash
        return NotImplemented
    def getBit(InfoHash self, bit):
-        return self._infohash.getBit(bit)
+        return self._infohash.getBit(_checked_bit_index(bit, 160))
    def setBit(InfoHash self, bit, b):
-        self._infohash.setBit(bit, b)
+        self._infohash.setBit(_checked_bit_index(bit, 160), b)
    def getId(InfoHash self):
        return self
    def toString(InfoHash self):
@@ -166,9 +224,9 @@ cdef class PkId(_WithPk):
            return self._pkid == other._pkid
        return NotImplemented
    def getBit(PkId self, bit):
-        return self._pkid.getBit(bit)
+        return self._pkid.getBit(_checked_bit_index(bit, 256))
    def setBit(PkId self, bit, b):
-        self._pkid.setBit(bit, b)
+        self._pkid.setBit(_checked_bit_index(bit, 256), b)
    def getLongId(PkId self):
        return self
    def toString(PkId self):
@@ -224,14 +282,92 @@ cdef class SockAddr(object):
 cdef class Node(_WithID):
    cdef shared_ptr[cpp.Node] _node
    def getId(self):
+        if not self._node:
+            raise ValueError("Node is not initialized")
        h = InfoHash()
        h._infohash = self._node.get().getId()
        return h
    def getAddr(self):
+        if not self._node:
+            raise ValueError("Node is not initialized")
        return self._node.get().getAddrStr()
    def isExpired(self):
+        if not self._node:
+            raise ValueError("Node is not initialized")
        return self._node.get().isExpired()

+cdef class NodeStats(object):
+    cdef cpp.NodeStats _stats
+    @property
+    def good_nodes(self):
+        return self._stats.good_nodes
+    @property
+    def dubious_nodes(self):
+        return self._stats.dubious_nodes
+    @property
+    def cached_nodes(self):
+        return self._stats.cached_nodes
+    @property
+    def incoming_nodes(self):
+        return self._stats.incoming_nodes
+    @property
+    def table_depth(self):
+        return self._stats.table_depth
+    @property
+    def searches(self):
+        return self._stats.searches
+    @property
+    def node_cache_size(self):
+        return self._stats.node_cache_size
+    def getKnownNodes(self):
+        return self._stats.getKnownNodes()
+    def getNetworkSizeEstimation(self):
+        return self._stats.getNetworkSizeEstimation()
+
+cdef class NodeInfo(object):
+    cdef cpp.NodeInfo _info
+    @property
+    def id(self):
+        result = InfoHash()
+        result._infohash = self._info.id
+        return result
+    @property
+    def node_id(self):
+        result = InfoHash()
+        result._infohash = self._info.node_id
+        return result
+    @property
+    def ipv4(self):
+        result = NodeStats()
+        result._stats = self._info.ipv4
+        return result
+    @property
+    def ipv6(self):
+        result = NodeStats()
+        result._stats = self._info.ipv6
+        return result
+    @property
+    def ongoing_ops(self):
+        return self._info.ongoing_ops
+    @property
+    def storage_values(self):
+        return self._info.storage_values
+    @property
+    def storage_size(self):
+        return self._info.storage_size
+    @property
+    def local_storage_values(self):
+        return self._info.local_storage_values
+    @property
+    def local_storage_size(self):
+        return self._info.local_storage_size
+    @property
+    def bound4(self):
+        return self._info.bound4
+    @property
+    def bound6(self):
+        return self._info.bound6
+
 cdef class NodeEntry(_WithID):
    cdef cpp.pair[cpp.InfoHash, shared_ptr[cpp.Node]] _v
    def getId(self):
@@ -265,8 +401,11 @@ cdef class Select(object):
        return self._select.toString().decode()
    def isSatisfiedBy(self, Select os):
        return self._select.isSatisfiedBy(os._select)
-    def field(self, int field):
-        self._select.field(<cpp.Field> field)
+    def field(self, field):
+        cdef int field_id = ValueField(_index(field))
+        if field_id == ValueField.SeqNum:
+            raise ValueError("The native wire format does not support sequence-number projections")
+        self._select.field(<cpp.Field>field_id)
        return self

 cdef class Where(object):
@@ -302,6 +441,10 @@ cdef class Value(object):
        self._value.reset(new cpp.Value(id, val, len(val)))
    def __str__(self):
        return self._value.get().toString().decode()
+    def isSigned(self) -> bool:
+        return self._value.get().isSigned()
+    def isEncrypted(self) -> bool:
+        return self._value.get().isEncrypted()
    @property
    def owner(self) -> PublicKey:
        h = PublicKey()
@@ -336,25 +479,51 @@ cdef class Value(object):
    def id(self, cpp.uint64_t value):
        self._value.get().id = value
    @property
+    def type(self) -> int:
+        return self._value.get().type
+    @type.setter
+    def type(self, cpp.uint16_t value):
+        self._value.get().type = value
+    @property
+    def seq(self) -> int:
+        return self._value.get().seq
+    @seq.setter
+    def seq(self, cpp.uint16_t value):
+        self._value.get().seq = value
+    @property
+    def priority(self) -> int:
+        return self._value.get().priority
+    @priority.setter
+    def priority(self, unsigned value):
+        self._value.get().priority = value
+    @property
+    def pushType(self) -> str:
+        return self._value.get().pushType.decode()
+    @pushType.setter
+    def pushType(self, str value):
+        self._value.get().pushType = value.encode()
+    @property
    def size(self) -> int:
        return self._value.get().size()

 cdef class ValueType(object):
-    cdef cpp.ValueType * _value
+    cdef unique_ptr[cpp.ValueType] _value
    def __init__(self, cpp.uint16_t id, str name, expiration: timedelta):
        if not isinstance(expiration, timedelta):
            raise TypeError("expiration argument must be of type timedelta")
        cdef cpp.seconds duration = cpp.seconds(int(expiration.total_seconds()))
-        self._value =  new cpp.ValueType(id, name.encode(), duration)
+        self._value.reset(new cpp.ValueType(id, name.encode(), duration))

 cdef class NodeSetIter(object):
-    cdef map[cpp.InfoHash, shared_ptr[cpp.Node]]* _nodes
+    cdef NodeSet _owner
    cdef map[cpp.InfoHash, shared_ptr[cpp.Node]].iterator _curIter
-    def __init__(self, NodeSet s):
-        self._nodes = &s._nodes
-        self._curIter = self._nodes.begin()
+    def __init__(self, NodeSet s not None):
+        self._owner = s
+        self._curIter = self._owner._nodes.begin()
+    def __iter__(self):
+        return self
    def __next__(self):
-        if self._curIter == self._nodes.end():
+        if self._curIter == self._owner._nodes.end():
            raise StopIteration
        h = NodeEntry()
        h._v = deref(self._curIter)
@@ -386,6 +555,8 @@ cdef class NodeSet(object):
        s = ''
        cdef map[cpp.InfoHash, shared_ptr[cpp.Node]].iterator it = self._nodes.begin()
        while it != self._nodes.end():
+            if not deref(it).second:
+                raise ValueError("Node is not initialized")
            s += deref(it).first.toString().decode() + ' ' + deref(it).second.get().getAddrStr().decode() + '\n'
            inc(it)
        return s
@@ -395,6 +566,30 @@ cdef class NodeSet(object):
 cdef class PrivateKey(_WithPk):
    cdef shared_ptr[cpp.PrivateKey] _key

+    def __init__(self, bytes data=None, str password=""):
+        cdef cpp.Blob encoded
+        if '\0' in password:
+            raise ValueError("Password must not contain NUL characters")
+        if data is not None:
+            if not data:
+                raise ValueError("Private key data must not be empty")
+            encoded = data
+            self._key = cpp.make_shared[cpp.PrivateKey](encoded, <cpp.string>password.encode())
+
+    def serialize(self, str password="") -> bytes:
+        """Export PKCS#8 PEM, encrypted when a nonempty password is supplied."""
+        if not self._key:
+            raise ValueError("PrivateKey is not initialized")
+        if '\0' in password:
+            raise ValueError("Password must not contain NUL characters")
+        cdef cpp.Blob encoded = self._key.get().serialize(password.encode())
+        if encoded.empty():
+            raise RuntimeError("Could not export private key")
+        return (<char*>encoded.data())[:encoded.size()]
+
+    def __bytes__(self):
+        return self.serialize()
+
    def getId(self) -> InfoHash:
        if not self._key:
            raise ValueError("PrivateKey is not initialized")
@@ -417,6 +612,8 @@ cdef class PrivateKey(_WithPk):
        return pk

    def decrypt(self, bytes dat) -> bytes:
+        if not self._key:
+            raise ValueError("PrivateKey is not initialized")
        cdef size_t d_len = len(dat)
        cdef cpp.uint8_t* d_ptr = <cpp.uint8_t*>dat
        cdef cpp.Blob indat
@@ -451,6 +648,25 @@ cdef class PrivateKey(_WithPk):

 cdef class PublicKey(_WithPk):
    cdef cpp.shared_ptr[cpp.PublicKey] _key
+    def __init__(self, bytes data=None):
+        cdef cpp.Blob encoded
+        if data is not None:
+            if not data:
+                raise ValueError("Public key data must not be empty")
+            encoded = data
+            self._key = cpp.make_shared[cpp.PublicKey](encoded)
+
+    def serialize(self) -> bytes:
+        """Export the public key as DER bytes."""
+        if not self._key:
+            raise ValueError("PublicKey is not initialized")
+        cdef cpp.Blob encoded
+        self._key.get().pack(encoded)
+        return (<char*>encoded.data())[:encoded.size()]
+
+    def __bytes__(self):
+        return self.serialize()
+
    def getId(self) -> InfoHash:
        if not self._key:
            raise ValueError("PublicKey is not initialized")
@@ -512,11 +728,17 @@ cdef class Certificate(_WithPk):
            return ""
        return self._cert.get().toString().decode()
    def getName(self) -> str:
+        if not self._cert:
+            raise ValueError("Certificate is not initialized")
        return self._cert.get().getName().decode()
    def revoke(self, PrivateKey k, Certificate c):
+        if not self._cert or c is None or not c._cert:
+            raise ValueError("Certificate is not initialized")
+        if k is None or not k._key:
+            raise ValueError("PrivateKey is not initialized")
        self._cert.get().revoke(deref(k._key.get()), deref(c._cert.get()));
    def __bytes__(self):
-        return self._cert.get().toString().encode() if self._cert else b''
+        return self._cert.get().toString() if self._cert else b''
    @property
    def issuer(self) -> Certificate|None:
        if self._cert and self._cert.get().issuer:
@@ -526,6 +748,10 @@ cdef class Certificate(_WithPk):
        return None
    @staticmethod
    def generate(PrivateKey k, str name, Identity i = Identity(), bool is_ca = False):
+        if k is None or not k._key:
+            raise ValueError("PrivateKey is not initialized")
+        if i is None:
+            i = Identity()
        c = Certificate()
        c._cert = cpp.make_shared[cpp.Certificate](cpp.Certificate.generate(deref(k._key.get()), name.encode(), i._id, is_ca))
        return c
@@ -540,10 +766,16 @@ cdef class VerifyResult(object):
 cdef class TrustList(object):
    cdef cpp.TrustList _trust
    def add(self, Certificate cert):
+        if cert is None or not cert._cert:
+            raise ValueError("Certificate is not initialized")
        self._trust.add(deref(cert._cert.get()))
    def remove(self, Certificate cert):
+        if cert is None or not cert._cert:
+            raise ValueError("Certificate is not initialized")
        self._trust.remove(deref(cert._cert.get()))
    def verify(self, Certificate cert):
+        if cert is None or not cert._cert:
+            raise ValueError("Certificate is not initialized")
        r = VerifyResult()
        r._result = self._trust.verify(deref(cert._cert.get()))
        return r
@@ -551,7 +783,7 @@ cdef class TrustList(object):
 cdef class ListenToken(object):
    cdef cpp.InfoHash _h
    cdef cpp.shared_future[size_t] _t
-    _cb = dict()
+    cdef bool _cancelled

 cdef class Identity(object):
    cdef cpp.Identity _id
@@ -562,6 +794,8 @@ cdef class Identity(object):
            self._id.second = c._cert
    @staticmethod
    def generate(str name = "pydht", Identity ca = Identity(), unsigned bits = 4096):
+        if ca is None:
+            ca = Identity()
        i = Identity()
        i._id = cpp.generateIdentity(name.encode(), ca._id, bits)
        return i
@@ -622,6 +856,13 @@ cdef class DhtConfig(object):
        self._config.dht_config.node_config.network = netid
    def setMaintainStorage(self, bool maintain_storage):
        self._config.dht_config.node_config.maintain_storage = maintain_storage
+    def setPersistPath(self, str path):
+        """Set the native state file path; an empty string disables persistence."""
+        if path is None:
+            raise TypeError("path must be a string")
+        if '\0' in path:
+            raise ValueError("path must not contain NUL characters")
+        self._config.dht_config.node_config.persist_path = path.encode()
    def setRateLimit(self, ssize_t max_req_per_sec, ssize_t max_peer_req_per_sec):
        self._config.dht_config.node_config.max_req_per_sec = max_req_per_sec
        self._config.dht_config.node_config.max_peer_req_per_sec = max_peer_req_per_sec
@@ -642,24 +883,65 @@ cdef class DhtConfig(object):

 cdef class DhtRunner(_WithID):
    cdef cpp.shared_ptr[cpp.DhtRunner] thisptr
+    cdef map[_PhtPtr, shared_ptr[cpp.Pht]] _indexes
+    cdef object _status_callback
    def __cinit__(self):
        self.thisptr.reset(new cpp.DhtRunner())
+        self._status_callback = _StatusCallbackState()
+    def __dealloc__(self):
+        with nogil:
+            if self.thisptr:
+                self.thisptr.get().join()
+            self._indexes.clear()
+            self.thisptr.reset()
    def getId(self) -> InfoHash:
        h = InfoHash()
        if self.thisptr:
-            h._infohash = self.thisptr.get().getId()
+            with nogil:
+                h._infohash = self.thisptr.get().getId()
        return h
    def getPublicKey(self) -> PublicKey:
        if not self.thisptr:
            raise ValueError("DhtRunner is not initialized")
        pk = PublicKey()
-        pk._key = self.thisptr.get().getPublicKey()
+        with nogil:
+            pk._key = self.thisptr.get().getPublicKey()
        return pk
    def getNodeId(self) -> InfoHash:
        h = InfoHash()
        if self.thisptr:
-            h._infohash = self.thisptr.get().getNodeId()
+            with nogil:
+                h._infohash = self.thisptr.get().getNodeId()
        return h
+    def getNodeInfo(self) -> NodeInfo:
+        result = NodeInfo()
+        with nogil:
+            result._info = self.thisptr.get().getNodeInfo()
+        return result
+    def getNodesStats(self, af=_socket.AF_INET) -> NodeStats:
+        if af not in (_socket.AF_INET, _socket.AF_INET6):
+            raise ValueError("af must be AF_INET or AF_INET6")
+        info = self.getNodeInfo()
+        return info.ipv4 if af == _socket.AF_INET else info.ipv6
+    def getPublicAddress(self, cpp.sa_family_t af=0):
+        if af not in (0, _socket.AF_INET, _socket.AF_INET6):
+            raise ValueError("af must be AF_UNSPEC, AF_INET or AF_INET6")
+        cdef cpp.vector[cpp.SockAddr] addresses
+        with nogil:
+            addresses = self.thisptr.get().getPublicAddress(af)
+        result = []
+        for address in addresses:
+            value = SockAddr()
+            value._addr = address
+            result.append(value)
+        return result
+    def getPublicAddressStr(self, cpp.sa_family_t af=0):
+        return [str(address) for address in self.getPublicAddress(af)]
+    def setOnStatusChanged(self, callback=None):
+        """Replace the DHT-thread status callback, or disable it with None."""
+        if callback is not None and not callable(callback):
+            raise TypeError("callback must be callable or None")
+        self._status_callback.callback = callback
    def ping(self, SockAddr addr, done_cb=None):
        if done_cb:
            cb_obj = {'done':done_cb}
@@ -685,44 +967,80 @@ cdef class DhtRunner(_WithID):
        host_bytes = host.encode()
        port_bytes = port.encode() if port else b'4222'
        self.thisptr.get().bootstrap(<cpp.const_char*>host_bytes, <cpp.const_char*>port_bytes)
-    def run(self, Identity id=None, is_bootstrap=False, cpp.in_port_t port=0, str ipv4="", str ipv6="", DhtConfig config=DhtConfig()):
-        if id:
-            config.setIdentity(id)
+    def connectivityChanged(self):
+        with nogil:
+            self.thisptr.get().connectivityChanged()
+    def run(self, Identity id=None, is_bootstrap=False, cpp.in_port_t port=0, str ipv4="", str ipv6="", DhtConfig config=None):
+        cdef cpp.DhtRunnerConfig run_config = config._config if config is not None else cpp.DhtRunnerConfig()
+        cdef cpp.string bind4, bind6, service
+        cdef object status_ref = _weakref.ref(self._status_callback)
+        if id is not None:
+            run_config.dht_config.id = id._id
+        if is_bootstrap:
+            run_config.dht_config.node_config.is_bootstrap = True
        if ipv4 or ipv6:
            bind4 = ipv4.encode() if ipv4 else b''
            bind6 = ipv6.encode() if ipv6 else b''
-            self.thisptr.get().run(bind4, bind6, str(port).encode(), config._config)
+            service = str(port).encode()
+            with nogil:
+                cpp.runPythonRunnerAddress(deref(self.thisptr.get()), bind4.c_str(),
+                                           bind6.c_str(), service.c_str(), run_config,
+                                           status_callback, status_ref)
        else:
-            self.thisptr.get().run(port, config._config)
+            with nogil:
+                cpp.runPythonRunner(deref(self.thisptr.get()), port, run_config,
+                                    status_callback, status_ref)
    def join(self):
-        self.thisptr.get().join()
+        with nogil:
+            self.thisptr.get().join()
+        self._indexes.clear()
    def shutdown(self, shutdown_cb=None):
        cb_obj = {'shutdown':shutdown_cb}
        ref.Py_INCREF(cb_obj)
        self.thisptr.get().shutdown(cpp.bindShutdownCb(shutdown_callback, <void*>cb_obj))
-    def registerType(self, ValueType type):
-        self.thisptr.get().registerType(deref(type._value))
+    def registerType(self, ValueType type not None):
+        if not type._value:
+            raise ValueError("ValueType is not initialized")
+        cdef cpp.ValueType run_type = deref(type._value.get())
+        with nogil:
+            self.thisptr.get().registerType(run_type)
    def enableLogging(self):
-        cpp.enableLogging(self.thisptr.get()[0])
+        with nogil:
+            cpp.enableLogging(self.thisptr.get()[0])
    def disableLogging(self):
-        cpp.disableLogging(self.thisptr.get()[0])
+        with nogil:
+            cpp.disableLogging(self.thisptr.get()[0])
    def enableFileLogging(self, str path):
-        cpp.enableFileLogging(self.thisptr.get()[0], path.encode())
+        cdef cpp.string log_path = path.encode()
+        with nogil:
+            cpp.enableFileLogging(self.thisptr.get()[0], log_path)
    def isRunning(self):
        return self.thisptr.get().isRunning()
    def getBound(self, cpp.sa_family_t af = 0):
        s = SockAddr()
-        s._addr = self.thisptr.get().getBound(af)
+        with nogil:
+            s._addr = self.thisptr.get().getBound(af)
        return s
    def getStorageLog(self):
-        return self.thisptr.get().getStorageLog().decode()
+        cdef cpp.string result
+        with nogil:
+            result = self.thisptr.get().getStorageLog()
+        return result.decode()
    def getRoutingTablesLog(self, cpp.sa_family_t af):
-        return self.thisptr.get().getRoutingTablesLog(af).decode()
+        cdef cpp.string result
+        with nogil:
+            result = self.thisptr.get().getRoutingTablesLog(af)
+        return result.decode()
    def getSearchesLog(self, cpp.sa_family_t af):
-        return self.thisptr.get().getSearchesLog(af).decode()
-    def getNodeMessageStats(self):
+        cdef cpp.string result
+        with nogil:
+            result = self.thisptr.get().getSearchesLog(af)
+        return result.decode()
+    def getNodeMessageStats(self, bool incoming=False):
        stats = []
-        cdef cpp.vector[unsigned] res = self.thisptr.get().getNodeMessageStats(False)
+        cdef cpp.vector[unsigned] res
+        with nogil:
+            res = self.thisptr.get().getNodeMessageStats(incoming)
        for n in res:
            stats.append(n)
        return stats
@@ -765,6 +1083,25 @@ cdef class DhtRunner(_WithID):
                    lock.wait()
            return res

+    def query(self, InfoHash key not None, query_cb=None, done_cb=None, Query query=None):
+        """Return projected metadata rows, or stream them through query_cb."""
+        if query is None:
+            query = Query("SELECT id,value_type,owner_pk,user_type")
+        if query_cb is None:
+            completed = threading.Event()
+            rows = []
+            def on_row(row):
+                rows.append(row)
+                return True
+            self.query(key, on_row, lambda ok, nodes: completed.set(), query)
+            completed.wait()
+            return rows
+        if not callable(query_cb) or (done_cb is not None and not callable(done_cb)):
+            raise TypeError("query callbacks must be callable")
+        callbacks = {'query': query_cb, 'done': done_cb}
+        cpp.queryPython(deref(self.thisptr.get()), key._infohash, query_callback,
+                        query_done_callback, callbacks, query._query)
+
    def put(self, InfoHash key, Value val, done_cb=None, permanent=False):
        """Publish a new value on the DHT at key.

@@ -788,7 +1125,7 @@ cdef class DhtRunner(_WithID):
                    lock.notify()
            with lock:
                pending += 1
-                self.put(key, val, done_cb=tmp_done)
+                self.put(key, val, done_cb=tmp_done, permanent=permanent)
                while pending > 0:
                    lock.wait()
            return ok
@@ -810,7 +1147,7 @@ cdef class DhtRunner(_WithID):
                    lock.notify()
            with lock:
                pending += 1
-                self.putSigned(key, val, done_cb=tmp_done)
+                self.putSigned(key, val, done_cb=tmp_done, permanent=permanent)
                while pending > 0:
                    lock.wait()
            return ok
@@ -818,6 +1155,8 @@ cdef class DhtRunner(_WithID):
    def putEncrypted(self, InfoHash key, Value val, to, done_cb=None, bool permanent=False):
        if to is None:
            raise ValueError("'to' must be provided")
+        if isinstance(to, PublicKey) and not (<PublicKey>to)._key:
+            raise ValueError("PublicKey is not initialized")
        if done_cb:
            cb_obj = {'done':done_cb}
            ref.Py_INCREF(cb_obj)
@@ -832,13 +1171,8 @@ cdef class DhtRunner(_WithID):
                        key._infohash, (<PkId>to)._pkid, val._value,
                        cpp.bindDoneCb(done_callback, <void*>cb_obj), permanent
                    )
-                elif isinstance(to, InfoHash):
-                    self.thisptr.get().putEncrypted(
-                        key._infohash, (<InfoHash>to)._infohash, val._value,
-                        cpp.bindDoneCb(done_callback, <void*>cb_obj), permanent
-                    )
                else:
-                    raise TypeError("'to' must be PublicKey, PkId, or InfoHash")
+                    raise TypeError("'to' must be PublicKey or PkId")
            except:
                ref.Py_DECREF(cb_obj)
                raise
@@ -862,19 +1196,23 @@ cdef class DhtRunner(_WithID):
    def cancelPut(self, InfoHash key, Value val):
        self.thisptr.get().cancelPut(key._infohash, val._value)

-    def listen(self, InfoHash key, value_cb):
+    def listen(self, InfoHash key not None, value_cb, filter=None, Where where=None):
+        if not callable(value_cb) or (filter is not None and not callable(filter)):
+            raise TypeError("listener callbacks must be callable")
+        if where is None:
+            where = Where()
        t = ListenToken()
        t._h = key._infohash
-        cb_obj = {'valcb':value_cb}
-        t._cb['cb'] = cb_obj
-        # avoid the callback being destructed if the token is destroyed
-        ref.Py_INCREF(cb_obj)
-        t._t = self.thisptr.get().listen(t._h, cpp.bindValueCb(value_callback, <void*>cb_obj)).share()
+        cb_obj = {'valcb':value_cb, 'filter':filter}
+        t._t = self.thisptr.get().listen(t._h, cpp.bindPythonValueCb(value_callback, cb_obj),
+                                       cpp.nullptr, where._where).share()
        return t
    def cancelListen(self, ListenToken token):
-        self.thisptr.get().cancelListen(token._h, token._t)
-        ref.Py_DECREF(<object>token._cb['cb'])
-        # fixme: not thread safe
+        if token is None:
+            raise TypeError("token must be a ListenToken")
+        if not token._cancelled and token._t.valid():
+            self.thisptr.get().cancelListen(token._h, token._t)
+            token._cancelled = True

 cdef class IndexValue(object):
    cdef cpp.shared_ptr[cpp.IndexValue] _value
@@ -891,12 +1229,18 @@ cdef class IndexValue(object):
        return self._value.get().second

 cdef class Pht(object):
-    cdef cpp.Pht* thisptr
-    def __cinit__(self, bytes name, key_spec, DhtRunner dht):
+    """PHT index; active native indexes live until the runner is joined."""
+    cdef shared_ptr[cpp.Pht] thisptr
+    cdef DhtRunner _runner
+    def __cinit__(self, bytes name, key_spec, DhtRunner dht not None):
        cdef cpp.IndexKeySpec cpp_key_spec
        for kk, size in key_spec.items():
            cpp_key_spec[bytes(kk, 'utf-8')] = size
-        self.thisptr = new cpp.Pht(name, cpp_key_spec, dht.thisptr)
+        self._runner = dht
+        self.thisptr.reset(new cpp.Pht(name, cpp_key_spec, dht.thisptr))
+    def __dealloc__(self):
+        with nogil:
+            self.thisptr.reset()
    @property
    def MAX_NODE_ENTRY_COUNT(self):
        return cpp.PHT_MAX_NODE_ENTRY_COUNT
@@ -909,16 +1253,21 @@ cdef class Pht(object):
                     representation of the prefix where the value was indexed in
                     the PHT.
        """
-        cb_obj = {'lookup':lookup_cb, 'done':done_cb} # TODO: donecallback is to be removed
-        ref.Py_INCREF(cb_obj)
        cdef cpp.IndexKey cppk
        for kk, v in key.items():
            cppk[bytes(kk, 'utf-8')] = bytes(v)
-        self.thisptr.lookup(
-                cppk,
-                cpp.Pht.bindLookupCb(lookup_callback, <void*>cb_obj),
-                cpp.bindDoneCbSimple(done_callback_simple, <void*>cb_obj)
-        )
+        self._runner._indexes[self.thisptr.get()] = self.thisptr
+        cb_obj = {'lookup':lookup_cb, 'done':done_cb} # TODO: donecallback is to be removed
+        ref.Py_INCREF(cb_obj)
+        try:
+            self.thisptr.get().lookup(
+                    cppk,
+                    cpp.Pht.bindLookupCb(lookup_callback, <void*>cb_obj),
+                    cpp.bindDoneCbSimple(done_callback_simple, <void*>cb_obj)
+            )
+        except:
+            ref.Py_DECREF(cb_obj)
+            raise
    def insert(self, key, IndexValue value, done_cb=None):
        """Add an index entry to the Index.

@@ -926,16 +1275,21 @@ cdef class Pht(object):
        value   -- an IndexValue object describing the indexed value.
        done_cb -- Called when the operation is completed.
        """
-        cb_obj = {'done':done_cb}
-        ref.Py_INCREF(cb_obj)
        cdef cpp.IndexKey cppk
        for kk, v in key.items():
            cppk[bytes(kk, 'utf-8')] = bytes(v)
        cdef cpp.IndexValue val
        val.first = (<InfoHash>value.getKey())._infohash
        val.second = value.getValueId()
-        self.thisptr.insert(
-                cppk,
-                val,
-                cpp.bindDoneCbSimple(done_callback_simple, <void*>cb_obj)
-        )
+        self._runner._indexes[self.thisptr.get()] = self.thisptr
+        cb_obj = {'done':done_cb}
+        ref.Py_INCREF(cb_obj)
+        try:
+            self.thisptr.get().insert(
+                    cppk,
+                    val,
+                    cpp.bindDoneCbSimple(done_callback_simple, <void*>cb_obj)
+            )
+        except:
+            ref.Py_DECREF(cb_obj)
+            raise