Add Connect libp2p endpoint transport

[robinbraemer]

Summary

• add the connector-side libp2p endpoint transport for Paper, Velocity, and Bungee platforms
• persist endpoint peer identity in libp2p-identity.key and expose CONNECT_LIBP2P_* configuration
• sign server-challenged relay circuit addresses so Connect edges can publish Machine-specific relay dial addresses while endpoints reserve through public bootstrap addresses
• keep the existing WatchService/WebSocket tunnel path as server-side fallback for older connectors
• remove misleading native naming from the new endpoint code path

Test Plan

• ./gradlew test
• ./gradlew :spigot:shadowJar
• CI: Build Pull Request / build succeeded
• staging Paper connector registered against connect-proxy-staging with libp2p endpoint mode
• Java status ping to codexstage18.play.minekube.net:25565 returned Codex libp2p staging Paper, protocol 775, players 0/20

Validation

• Awaiting final manual staging join validation before merge.

[robinbraemer]

Update: pushed d09e07b to reconnect native libp2p registration after Moxy restarts.\n\nVerification:\n- ./gradlew :core:test --tests '*PeerRegistrationClientTest' --tests '*NativeStatusReporterTest' --no-daemon\n- ./gradlew test shadowJar --no-daemon\n- copied rebuilt Spigot jar into local Paper and verified it re-registered automatically after staging Moxy restart/deploy without restarting Paper\n- staging Java status/login via connect-proxy-staging.fly.dev succeeded over native libp2p after reconnect

[robinbraemer]

Update after relay hardening (c02d1c9):

• Added JVM libp2p circuit relay client support for native endpoint hosts.
• Added CONNECT_LIBP2P_NATIVE_RELAY_ADDRS; endpoint reserves each relay and advertises /p2p-circuit/p2p/<endpoint-peer-id> addresses.
• Added an in-process relay test proving a Moxy-like host can open a stream to the endpoint through a relay circuit address.
• Split stable peer id from per-process endpoint instance id for registration/status records.
• Native session responder now rejects wrong-endpoint and expired offers before opening a local session.
• Status reports now refresh every 5s with 15s TTL.
• README documents the native libp2p env vars.

Fresh local verification:

git diff --check
./gradlew :core:test --no-daemon

Both passed locally on 2026-06-16. GitHub Actions build was still in progress when checked after push.

[robinbraemer]

Staging validation after af618ca:

• Built :spigot:shadowJar and installed the resulting plugin into the local Paper staging endpoint.
• Restarted Paper with native libp2p relay config:
  • CONNECT_LIBP2P_NATIVE_MOXY_ADDR=/dns4/connect-proxy-staging.fly.dev/tcp/4001/p2p/12D3KooWNXa3WQenRYKVJCHxcadnp3JPcxRALCqk97qpMiqAG1tt
  • CONNECT_LIBP2P_NATIVE_RELAY_ADDRS=/dns4/connect-proxy-staging.fly.dev/tcp/4001/p2p/12D3KooWNXa3WQenRYKVJCHxcadnp3JPcxRALCqk97qpMiqAG1tt
• Java status through Fly staging passed: mcstatus connect-proxy-staging.minekube.net status, 0/512, ~80ms.
• Java login probe through Fly staging passed: node /tmp/connect-libp2p-staging-paper/mc-login-probe.cjs connect-proxy-staging.minekube.net 25565.
• Moxy staging log shows native libp2p session accepted with endpoint instance UUID 2fddead1-e3ed-4d27-a800-7ff6a496f923 and player joined endpoint.
• Bedrock status ping through Fly staging passed: connect-proxy-staging.minekube.net:19132 OK rtt=76ms name="Minekube" sub="Bedrock cross-play" protocol=26.30.

Local verification run:

• ./gradlew :core:test --no-daemon
• ./gradlew :spigot:shadowJar --no-daemon

[robinbraemer]

Update after peer-auth review:

• Native session responder now authorizes incoming session streams against the configured Moxy peer ids from CONNECT_LIBP2P_NATIVE_MOXY_ADDR.
• Added config/test coverage for extracting the configured Moxy peer id.
• Downgraded transient native reconnect/status-report failures to warning summaries instead of full ERROR stack traces.

Verification:

• ./gradlew :core:test --no-daemon passed locally.
• ./gradlew :spigot:shadowJar --no-daemon passed locally.
• PR CI build passed: https://github.com/minekube/connect-java/actions/runs/27604045064

Staging used the freshly built Spigot plugin jar and re-registered against Moxy. Public Java login and Bedrock status probes passed through connect-proxy-staging.minekube.net; Moxy logged selectedTransport=relay for the Java login probe.

[robinbraemer]

Updated native registration signing in 4771056c:

• PeerRecordSigningPayload now writes deterministic protobuf bytes via CodedOutputStream#useDeterministicSerialization() instead of the temporary JSON payload.
• Added a golden hex test vector generated from Moxy's deterministic Go protobuf marshal path.

Fresh local verification:

./gradlew :core:test --no-daemon
# BUILD SUCCESSFUL

./gradlew :spigot:shadowJar --no-daemon
# BUILD SUCCESSFUL

This is the matching endpoint-side change for Moxy PR GeyserMC#265 commit 4a75ee8; both sides need to land/deploy together because native registration signatures are intentionally changing to the spec format.

[robinbraemer]

Latest staging evidence for 4771056c:

• Rebuilt :spigot:shadowJar and deployed the resulting Connect.jar to the local staging Paper server used for the Moxy staging test.
• The plugin registered native endpoint codexp2p3 successfully with peer 12D3KooWEzZpASrUwA3s8CM3UCDCCYjQzfh91ZyJnxRqaZ9xTi31.
• Moxy staging, running 4a75ee8, accepted a native libp2p session from that plugin: session d8ohhgji940s21q3691g, endpoint instance 0aedb6a9-31ad-41fe-9f3a-624df2416476, selected transport relay.
• Java login probe through connect-proxy-staging.minekube.net:25565 completed with login then clean end done.
• Paper logs show CodexBot joined through Connect and disconnected cleanly.
• Bedrock RakNet status against connect-proxy-staging.minekube.net:19132 returned OK with MOTD Minekube, sub-MOTD Bedrock cross-play, protocol 26.30.

GitHub Actions for this PR is green at 4771056c (build succeeded). The paired Moxy PR currently has red Actions caused by GitHub account billing/spending limits before any job step starts; local Moxy gates and staging validation passed.

[robinbraemer]

Review/staging follow-up after the senior-pass review:

• Pushed 7fc9a4f8 so native status reports half-close the write side with Stream.closeWrite() instead of resetting the full stream after a one-shot report.
• The staging symptom before this was repeated Moxy native libp2p status stream failed logs with stream reset; after installing the new jar and filtering logs from 2026-06-16T10:57:00Z, only the expected native relay session/join lines remain.
• Local verification passed on this head:
  • ./gradlew :core:test --tests 'com.minekube.connect.tunnel.p2p.NativeStatusReporterTest' --no-daemon
  • ./gradlew :core:test :spigot:shadowJar --no-daemon
• Built and installed spigot/build/libs/connect-spigot.jar into the staging Paper server; SHA-256: 588e67efa6038d3f1a977e945641abc25f24217705866a0109c0041bfa647fda.
• Runtime validation against staging passed:
  • Paper registered native libp2p for codexp2p3.
  • Java probe node /tmp/connect-libp2p-staging-paper/mc-login-probe.cjs connect-proxy-staging.fly.dev 25565 logged in successfully.
  • Moxy accepted the session via native libp2p relay with endpoint peer 12D3KooWEzZpASrUwA3s8CM3UCDCCYjQzfh91ZyJnxRqaZ9xTi31 and selectedTransport: "relay".

GitHub PR build is green on the latest commit.