@gotcos/glasses-server 6.88.0 → 6.89.0

package/docs/lan-first.md

@@ -1,158 +0,0 @@
-# LAN first: the server contract (6.88.0)
-
-The server half of the glasses "LAN first" reconnect plan (2026-10-22, decisions of 2026-10-23). The phone
-reaches the Mac over the home network first and over Tailscale second. The server adds two things, both
-additive and both capability gated:
-
-1. `GET /api/route-proof`, a public identity proof, so the phone can check WHICH Mac answers at an address
-   before it sends `X-Cos-Token` there.
-2. `routes` on authenticated `GET /api/models`: the addresses this Mac answers on, re-learned after a DHCP change.
-
-An older server has neither capability flag. A phone must then keep today's single stored URL and change
-nothing. `COS_LAN_FIRST=0` in the server environment turns both pieces off (read per request).
-
-## Capability flags
-
-Published on `GET /api/health` (public) and `GET /api/models` (token) under `capabilities`, from one helper,
-so the two surfaces always agree:
-
-```json
-"routeProof": { "protocol": 1 },
-"lanRoutes":  { "protocol": 1 }
-```
-
-| Flag | Present when | Absent means |
-|---|---|---|
-| `routeProof` | the switch is on, the server instance id is minted, and the token is at least 32 characters | do not call `/api/route-proof`; never send the token to an unproven address |
-| `lanRoutes` | the switch is on | `/api/models` will not carry `routes` |
-
-Public health carries only these flags. It never carries an address.
-
-## `GET /api/route-proof?nonce=<nonce>`
-
-Public: no `X-Cos-Token`. GET only.
-
-### Request
-
-| Part | Rule |
-|---|---|
-| `nonce` | exactly one query parameter, 22 to 64 characters of base64url (`A-Z a-z 0-9 - _`), no padding. Fresh random per request; 16 random bytes encode to 22 characters. |
-| Headers | none needed. Do not send `X-Cos-Token` to an address you have not proven. |
-| Timeout | the plan's 1.5 s for a LAN proof. |
-
-### Success: `200`
-
-```json
-{ "v": 1, "serverInstanceId": "<uuid v4>", "proof": "<64 lowercase hex>" }
-```
-
-`Cache-Control: no-store`.
-
-### The HMAC
-
-```
-message = "cos-route-proof:v1:" + nonce + ":" + serverInstanceId      (UTF-8)
-proof   = lowercase hex( HMAC-SHA256( key = token (UTF-8 bytes), message ) )
-```
-
-`token` is the exact pairing token string the phone stores (the `X-Cos-Token` value). `serverInstanceId` is the
-value in the response, which must also equal the phone's stored `active.serverInstanceId`.
-
-Known-answer vector:
-
-| Input | Value |
-|---|---|
-| token | `0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef` |
-| nonce | `AAAAAAAAAAAAAAAAAAAAAA` |
-| serverInstanceId | `00000000-0000-4000-8000-000000000000` |
-| message | `cos-route-proof:v1:AAAAAAAAAAAAAAAAAAAAAA:00000000-0000-4000-8000-000000000000` |
-| proof | `445fc7d579849fa3fdfb8c2831cf0ace04c6db74e2817b75e87139cc9a3cd207` |
-
-### Phone-side check (the whole point)
-
-The route counts only if ALL hold, and only then may the phone send `X-Cos-Token` to that address:
-
-1. Status 200 and `v === 1`.
-2. `serverInstanceId` equals the stored `active.serverInstanceId`.
-3. `proof` equals the phone's own HMAC over the nonce IT generated for this request and the STORED id.
-
-Anything else (timeout, any other status, a body that does not parse, a mismatch) means "not my Mac": drop that
-address for this cycle and never send the token there. Compare in constant time where the platform offers it;
-the comparison happens on the phone, so there is no remote timing oracle either way.
-
-### Errors
-
-Every error body is `{ "v": 1, "reason": "<code>" }` with `Cache-Control: no-store`.
-
-| Status | `reason` | When | Phone should |
-|---|---|---|---|
-| 400 | `bad_nonce` | nonce missing, repeated, wrong length or charset | fix the client; treat as not proven |
-| 401 | (the standard `pairing_token_rejected` body) | any verb other than GET without a token, or any path other than exactly `/api/route-proof` | treat as not proven |
-| 404 | `disabled` | `COS_LAN_FIRST=0` | stop LAN proofs until the capability returns |
-| 404 | (no body contract) | a server older than 6.88.0 | stop LAN proofs; it has no `routeProof` flag anyway |
-| 405 | `method_not_allowed` | a non-GET verb that carried a valid token. `Allow: GET` | fix the client |
-| 429 | `rate_limited` | over the limit below. `Retry-After` in seconds | wait `Retry-After`, keep the current route |
-| 503 | `not_ready` | the instance id is not minted yet (still binding after a restart), or the token is too short to expose. `Retry-After: 30` | keep the current route, retry later |
-| 403 | (network filter) | the caller is not on loopback, Tailscale or a private network | treat as not proven |
-
-### Rate limit
-
-Per socket address (never `X-Forwarded-For`): 20 requests in any 60 s window. Global: 240 in any 60 s window
-across all addresses. Bad-nonce requests spend the same budget. The plan's phone schedule (boot, foreground,
-reconnect, then one every 60 s while on Tailscale) stays far below it.
-
-## `routes` on `GET /api/models` (token)
-
-```json
-"routes": {
-  "v": 1,
-  "serverInstanceId": "<uuid v4, same as top-level serverInstanceId>",
-  "learnedAt": "<ISO time the interfaces were read>",
-  "lan":       [ { "ip": "192.168.1.204",   "port": 3141, "scheme": "http" } ],
-  "tailscale": [ { "ip": "100.108.149.114", "port": 3141, "scheme": "http" } ]
-}
-```
-
-| Field | Rule |
-|---|---|
-| `lan` | RFC1918 IPv4 (10/8, 172.16/12, 192.168/16) on a non-internal interface that is not a tunnel, bridge or VM network (`utun`, `tun`, `tap`, `ipsec`, `ppp`, `bridge`, `awdl`, `llw`, `vmnet`, `vboxnet`, `docker`, `br-`, `veth`, `virbr`, `lxc`, `lxd`, `cni`, `flannel`, `podman`, `cali`, `vnic`, `tailscale` are left out). Link-local 169.254/16 and public addresses never appear. |
-| `tailscale` | 100.64/10 on Tailscale's own interface (`utun*` on macOS, `tailscale*` elsewhere). A carrier-grade-NAT address on Wi-Fi is not Tailscale and is left out. |
-| `port` | the plain-http port (`PORT`, default 3141) for both kinds. HTTPS 3143 is never advertised: its certificate does not cover these addresses. |
-| `scheme` | always `http` in protocol 1. |
-| MagicDNS name | not published. Reading it means running `tailscale status --json` per request, which is not cheap; a later protocol may add `name`. |
-| order | interface order as the OS reports it; at most 8 per list; no duplicates. |
-| freshness | read from the interfaces at most every 10 s, so a new DHCP lease shows up on the next read after that. |
-| absent | the switch is off, the instance id is not minted, or the interface read failed. The rest of `/api/models` is unchanged in every case. |
-
-Node does not expose interface up/down flags; an address the OS still lists can appear. That is why every
-address must pass the route proof before the token goes there.
-
-Replace the stored LAN list each time `/api/models` is read on either path. Never hardcode an address.
-
-## What a stranger can learn
-
-| Surface | Without the token |
-|---|---|
-| `/api/route-proof` | the instance id (already public on `/api/health` as `server_instance_id`), an HMAC of a message it cannot choose, and whether the token is long enough to be proven (it gets `not_ready` otherwise) |
-| `/api/health` | the two protocol flags |
-| `/api/models` | the standard 401 |
-
-## Security decisions
-
-- **No token oracle.** The caller chooses only the nonce, its charset has no `:`, and the message always starts with
-  the fixed prefix and ends with the server's own id. The only other HMAC keyed by the token signs
-  `display-stream:<exp>` (display tickets), which can never start with the prefix, so a proof is never a ticket.
-- **Offline guessing.** A proof lets anyone who can reach the port test token guesses offline. Server- and
-  Control-generated tokens (44 and 64 characters of random) make that hopeless; a token under 32 characters gets no
-  proof and no `routeProof` flag, so that install keeps today's behaviour.
-- **What the proof does and does not stop.** It stops the token going to a DIFFERENT machine at a remembered
-  address (someone else's Wi-Fi, a reused DHCP lease). It does not stop an active attacker on the same Wi-Fi who relays
-  the proof request to the real Mac: the LAN path is plain HTTP, so the token crosses the home network unencrypted, as
-  a pasted token and "Allow pairing on this Wi-Fi" already do. Over Tailscale the traffic is encrypted.
-- **Nothing logged.** The route never logs or echoes the nonce or the proof.
-- **No state on disk.** The rate limiter is in memory; a restart clears it.
-
-## Not in this release
-
-Phase 3 of the plan (a loopback `GET /api/glasses/link` for COS Control's banner) is not built: it needs new
-tracking of the client's last path and check-in time, so it is not a trivially additive change.

package/server/lib/lan-first.ts

@@ -1,236 +0,0 @@
-// 6.88.0 LAN first (docs/lan-first.md). Two additive pieces for the phone:
-//
-// 1. A pre-token identity proof. `GET /api/route-proof?nonce=<phone nonce>` is public, so a
-//    phone can ask an address it has not used before "are you the Mac I paired with?"
-//    BEFORE it sends X-Cos-Token there. The answer is an HMAC keyed by the token over a
-//    fixed, domain-separated message; the phone computes the same HMAC with its stored
-//    token and sends the token only on a match. A machine without the token cannot make a
-//    matching proof, and the response never carries the token.
-// 2. The addresses this Mac answers on, published ONLY on authenticated /api/models (never
-//    on public /api/health), so the phone can learn its LAN route after a DHCP change.
-//
-// This module is pure apart from the cached interface read. Clock, interfaces, token and
-// instance id are injected so every rule is testable.
-
-import { createHmac } from 'node:crypto'
-import { networkInterfaces as osNetworkInterfaces } from 'node:os'
-import { isRfc1918Ipv4, isTailscaleIpv4, normalizeRemoteIp } from './network-policy.js'
-
-export const ROUTE_PROOF_PROTOCOL = 1
-export const LAN_ROUTES_PROTOCOL = 1
-
-/**
- * The fixed domain-separation prefix. The caller chooses only the nonce, never the whole
- * message, and the nonce charset has no `:`, so the message always parses one way. The only
- * other HMAC keyed by the token signs `display-stream:<exp>` (lib/display-ticket.ts), which
- * can never begin with this prefix, so a proof is never a usable display ticket.
- */
-export const ROUTE_PROOF_PREFIX = 'cos-route-proof:v1:'
-/** base64url alphabet, 22 to 64 characters. 22 base64url characters carry 132 bits. */
-export const ROUTE_PROOF_NONCE_PATTERN = /^[A-Za-z0-9_-]{22,64}$/
-/**
- * A proof lets anyone on the network check token guesses offline, so it is served only for
- * a token long enough that guessing is hopeless. COS Control writes 64 hex characters and
- * the server's own token is 44 base64url characters; a short hand-set legacy token gets no
- * proof (the phone keeps today's single-route behaviour).
- */
-export const ROUTE_PROOF_MIN_TOKEN_LENGTH = 32
-export const ROUTE_PROOF_IP_LIMIT = 20
-export const ROUTE_PROOF_GLOBAL_LIMIT = 240
-export const ROUTE_PROOF_WINDOW_MS = 60_000
-/** Past this many tracked addresses, idle ones are dropped. Live ones are bounded by the global ceiling. */
-export const ROUTE_PROOF_MAX_TRACKED_IPS = 1024
-
-export const LAN_ROUTES_CACHE_MS = 10_000
-export const LAN_ROUTES_MAX_PER_KIND = 8
-
-/** `COS_LAN_FIRST=0` turns off both pieces (read per request). Anything else leaves them on. */
-export function lanFirstEnabled(env: NodeJS.ProcessEnv = process.env): boolean {
-  return env.COS_LAN_FIRST !== '0'
-}
-
-/** The plain-http port the phone uses on both paths (server/index.ts reads the same `PORT`). */
-export function lanFirstHttpPort(env: NodeJS.ProcessEnv = process.env): number {
-  const port = parseInt(env.PORT ?? '3141', 10)
-  return Number.isInteger(port) && port > 0 && port <= 65535 ? port : 3141
-}
-
-export function isValidRouteProofNonce(value: unknown): value is string {
-  return typeof value === 'string' && ROUTE_PROOF_NONCE_PATTERN.test(value)
-}
-
-export function routeProofTokenUsable(token: unknown): token is string {
-  return typeof token === 'string' && token.length >= ROUTE_PROOF_MIN_TOKEN_LENGTH
-}
-
-export function routeProofMessage(nonce: string, serverInstanceId: string): string {
-  return `${ROUTE_PROOF_PREFIX}${nonce}:${serverInstanceId}`
-}
-
-/** Lowercase hex HMAC-SHA256(token, "cos-route-proof:v1:" + nonce + ":" + serverInstanceId). */
-export function computeRouteProof(token: string, nonce: string, serverInstanceId: string): string {
-  return createHmac('sha256', token).update(routeProofMessage(nonce, serverInstanceId), 'utf8').digest('hex')
-}
-
-/** True when the proof is servable right now: switch on, instance id minted, token strong. */
-export function routeProofAvailable(input: { token: unknown; serverInstanceId: string | null; env?: NodeJS.ProcessEnv }): boolean {
-  return lanFirstEnabled(input.env) && !!input.serverInstanceId && routeProofTokenUsable(input.token)
-}
-
-/** `capabilities.routeProof` / `capabilities.lanRoutes`, or nothing. Absent means "do not try". */
-export function lanFirstCapabilities(input: { token: unknown; serverInstanceId: string | null; env?: NodeJS.ProcessEnv }): {
-  routeProof?: { protocol: number }
-  lanRoutes?: { protocol: number }
-} {
-  if (!lanFirstEnabled(input.env)) return {}
-  return {
-    ...(routeProofAvailable(input) ? { routeProof: { protocol: ROUTE_PROOF_PROTOCOL } } : {}),
-    lanRoutes: { protocol: LAN_ROUTES_PROTOCOL },
-  }
-}
-
-// ── Rate limit ───────────────────────────────────────────────────────────────
-
-export type RouteProofAdmission = { ok: true } | { ok: false; retryAfterSeconds: number }
-
-/** Sliding one-minute window per remote address, plus a global ceiling. In memory only. */
-export class RouteProofRateLimiter {
-  private readonly perIp = new Map<string, number[]>()
-  private global: number[] = []
-
-  constructor(private readonly now: () => number = () => Date.now()) {}
-
-  admit(remoteAddress: string | undefined | null): RouteProofAdmission {
-    const at = this.now()
-    const ip = normalizeRemoteIp(remoteAddress ?? '') || 'unknown'
-    const live = (times: number[]) => times.filter(t => at - t < ROUTE_PROOF_WINDOW_MS)
-    const retry = (oldest: number) => Math.max(1, Math.ceil((ROUTE_PROOF_WINDOW_MS - (at - oldest)) / 1000))
-
-    this.global = live(this.global)
-    const recent = live(this.perIp.get(ip) ?? [])
-    if (recent.length >= ROUTE_PROOF_IP_LIMIT) {
-      this.perIp.set(ip, recent)
-      return { ok: false, retryAfterSeconds: retry(recent[0]) }
-    }
-    if (this.global.length >= ROUTE_PROOF_GLOBAL_LIMIT) {
-      // Nothing is stored for a refused address, so a flood of new addresses grows nothing.
-      if (recent.length) this.perIp.set(ip, recent)
-      return { ok: false, retryAfterSeconds: retry(this.global[0]) }
-    }
-    recent.push(at)
-    this.global.push(at)
-    this.perIp.set(ip, recent)
-    // Live entries are bounded by the global ceiling, so dropping the idle ones is enough.
-    if (this.perIp.size > ROUTE_PROOF_MAX_TRACKED_IPS) {
-      for (const [key, times] of this.perIp) if (live(times).length === 0) this.perIp.delete(key)
-    }
-    return { ok: true }
-  }
-
-  /** For tests: how many addresses the limiter is holding. */
-  trackedAddressCount(): number {
-    return this.perIp.size
-  }
-}
-
-// ── Routes ───────────────────────────────────────────────────────────────────
-
-export interface RouteEntry {
-  ip: string
-  port: number
-  scheme: 'http'
-}
-
-export interface LanRoutes {
-  v: number
-  serverInstanceId: string
-  learnedAt: string
-  lan: RouteEntry[]
-  tailscale: RouteEntry[]
-}
-
-type InterfaceInfo = { address: string; family: string | number; internal: boolean }
-export type InterfaceTable = Record<string, InterfaceInfo[] | undefined>
-
-/**
- * Interfaces a phone on the home Wi-Fi can never reach through: VPN tunnels (utun is checked
- * separately for Tailscale), Internet Sharing and VM bridges, AirDrop (awdl), low-latency WLAN
- * (llw), VM host-only networks, and Linux container bridges and veth pairs.
- */
-const NOT_LAN_INTERFACE = /^(utun|tun|tap|ipsec|ppp|bridge|awdl|llw|vmnet|vboxnet|docker|br-|veth|virbr|lxc|lxd|cni|flannel|podman|cali|vnic|tailscale)/i
-/** Tailscale's own interface: utunN on macOS, tailscale0 on Linux, "Tailscale" on Windows. */
-const TAILSCALE_INTERFACE = /^(utun|tailscale)/i
-
-function ipv4(info: InterfaceInfo): boolean {
-  const family = typeof info.family === 'number' ? (info.family === 4 ? 'IPv4' : 'IPv6') : info.family
-  return family === 'IPv4' && !info.internal
-}
-
-/**
- * Pure. LAN = RFC1918 IPv4 on a non-internal interface that is not a tunnel, bridge or VM
- * network. Tailscale = 100.64/10 on Tailscale's own interface (a carrier-grade-NAT address
- * on en0 is not Tailscale and is left out). Link-local 169.254/16 is neither. Each list keeps
- * interface order, is de-duplicated, and is capped.
- */
-export function buildRouteLists(nets: InterfaceTable, port: number): { lan: RouteEntry[]; tailscale: RouteEntry[] } {
-  const lan: RouteEntry[] = []
-  const tailscale: RouteEntry[] = []
-  const seen = new Set<string>()
-  for (const [name, infos] of Object.entries(nets)) {
-    for (const info of infos ?? []) {
-      if (!info || typeof info.address !== 'string' || !ipv4(info)) continue
-      const ip = info.address
-      if (seen.has(ip)) continue
-      if (isTailscaleIpv4(ip)) {
-        if (TAILSCALE_INTERFACE.test(name) && tailscale.length < LAN_ROUTES_MAX_PER_KIND) {
-          seen.add(ip)
-          tailscale.push({ ip, port, scheme: 'http' })
-        }
-        continue
-      }
-      if (isRfc1918Ipv4(ip) && !NOT_LAN_INTERFACE.test(name) && lan.length < LAN_ROUTES_MAX_PER_KIND) {
-        seen.add(ip)
-        lan.push({ ip, port, scheme: 'http' })
-      }
-    }
-  }
-  return { lan, tailscale }
-}
-
-let readInterfaces: () => InterfaceTable = () => osNetworkInterfaces() as InterfaceTable
-let cache: { at: number; port: number; lists: { lan: RouteEntry[]; tailscale: RouteEntry[] } } | null = null
-
-/**
- * The `routes` field for authenticated /api/models, or null to omit it. Re-read from the
- * interfaces at most every 10 s, so a DHCP change shows up within one cache period. Never
- * throws: a failed interface read omits the field and leaves the rest of the response alone.
- */
-export function lanRoutesField(input: {
-  port: number
-  serverInstanceId: string | null
-  env?: NodeJS.ProcessEnv
-  now?: () => number
-}): LanRoutes | null {
-  try {
-    if (!lanFirstEnabled(input.env) || !input.serverInstanceId) return null
-    const at = (input.now ?? Date.now)()
-    if (!cache || cache.port !== input.port || at - cache.at >= LAN_ROUTES_CACHE_MS || at < cache.at) {
-      cache = { at, port: input.port, lists: buildRouteLists(readInterfaces(), input.port) }
-    }
-    return {
-      v: LAN_ROUTES_PROTOCOL,
-      serverInstanceId: input.serverInstanceId,
-      learnedAt: new Date(cache.at).toISOString(),
-      lan: cache.lists.lan.map(r => ({ ...r })),
-      tailscale: cache.lists.tailscale.map(r => ({ ...r })),
-    }
-  } catch {
-    cache = null
-    return null
-  }
-}
-
-export function __setInterfaceReaderForTests(reader: (() => InterfaceTable) | null): void {
-  readInterfaces = reader ?? (() => osNetworkInterfaces() as InterfaceTable)
-  cache = null
-}

package/server/routes/route-proof.ts

@@ -1,83 +0,0 @@
-// 6.88.0 LAN first: the pre-token identity proof (docs/lan-first.md).
-//
-// GET /api/route-proof?nonce=<22-64 base64url chars> is PUBLIC (an exact GET door in
-// api-auth.ts), because it exists to prove which Mac answers at an address BEFORE the phone
-// sends its token there. Rules, each with its reason:
-// - The nonce is validated strictly (charset and length) and never echoed or logged.
-// - The message is fixed: "cos-route-proof:v1:" + nonce + ":" + serverInstanceId. The caller
-//   picks only the nonce, so this is never a general HMAC oracle, and the prefix keeps it
-//   apart from the display-stream ticket, the only other HMAC keyed by the token.
-// - The response carries the instance id (already on public /api/health as
-//   server_instance_id) and the HMAC. Never the token, never an address, never a version.
-// - Served only while lib/lan-first.ts `routeProofAvailable` holds: switch on, instance id
-//   minted, token at least 32 characters (a proof would let a stranger test guesses of a
-//   short token offline).
-// - Rate limited per socket address (never req.ip or X-Forwarded-For) plus a global ceiling.
-// - Writes nothing, so it takes no lease and is served during a drain.
-
-import { Router, type Request, type Response } from 'express'
-import {
-  ROUTE_PROOF_PROTOCOL,
-  RouteProofRateLimiter,
-  computeRouteProof,
-  isValidRouteProofNonce,
-  lanFirstEnabled,
-  routeProofTokenUsable,
-} from '../lib/lan-first.js'
-
-export type RouteProofReason = 'bad_nonce' | 'rate_limited' | 'not_ready' | 'disabled' | 'method_not_allowed'
-
-export const ROUTE_PROOF_REASON_STATUS: Record<RouteProofReason, number> = {
-  bad_nonce: 400,
-  disabled: 404,
-  method_not_allowed: 405,
-  rate_limited: 429,
-  not_ready: 503,
-}
-
-export interface RouteProofRouterOptions {
-  /** Read per request, so a token change is honoured without a remount. */
-  token: () => string
-  serverInstanceId: () => string | null
-  env?: () => NodeJS.ProcessEnv
-  limiter?: RouteProofRateLimiter
-}
-
-function send(res: Response, reason: RouteProofReason, retryAfterSeconds?: number): void {
-  if (retryAfterSeconds != null) res.setHeader('Retry-After', String(retryAfterSeconds))
-  res.setHeader('Cache-Control', 'no-store')
-  res.status(ROUTE_PROOF_REASON_STATUS[reason]).json({ v: ROUTE_PROOF_PROTOCOL, reason })
-}
-
-export function createRouteProofRouter(options: RouteProofRouterOptions): Router {
-  const router = Router()
-  const limiter = options.limiter ?? new RouteProofRateLimiter()
-  const env = options.env ?? (() => process.env)
-
-  router.all('/route-proof', (req: Request, res: Response) => {
-    // The public door in api-auth.ts is GET only, so any other method has already been
-    // refused without a token. With a token it is still refused here: one shape, one verb.
-    if (req.method !== 'GET') {
-      res.setHeader('Allow', 'GET')
-      return send(res, 'method_not_allowed')
-    }
-    if (!lanFirstEnabled(env())) return send(res, 'disabled')
-    // Counted before the nonce check, so malformed requests spend the same budget.
-    const admission = limiter.admit(req.socket?.remoteAddress)
-    if (!admission.ok) return send(res, 'rate_limited', admission.retryAfterSeconds)
-    const nonce = req.query.nonce
-    if (!isValidRouteProofNonce(nonce)) return send(res, 'bad_nonce')
-    let token = ''
-    try { token = options.token() } catch { token = '' }
-    const serverInstanceId = options.serverInstanceId()
-    if (!serverInstanceId || !routeProofTokenUsable(token)) return send(res, 'not_ready', 30)
-    res.setHeader('Cache-Control', 'no-store')
-    res.json({
-      v: ROUTE_PROOF_PROTOCOL,
-      serverInstanceId,
-      proof: computeRouteProof(token, nonce, serverInstanceId),
-    })
-  })
-
-  return router
-}