ccip-router 0.1.0

package/dist/mesh/sync.js

@@ -0,0 +1,154 @@
+import { recoverRecordSigner } from '../crypto/index.js';
+import { fetchPeerVni, verifyVni } from './vni.js';
+// Manual sync trigger — used by the admin dashboard "Sync now" button.
+export async function syncAll(config, db) {
+    const peers = await db.getPeers();
+    const results = await Promise.allSettled(peers.map(async (peer) => {
+        const update = await syncPeer(peer, config.syncNamespace, db, config.autoDiscover);
+        await db.upsertPeer({ ...peer, ...update });
+    }));
+    return results.filter((r) => r.status === 'fulfilled').length;
+}
+const SUPPORTED_PROTOCOL = 1;
+// Pull all new records from a single peer, paginating until cursor is null.
+// Optionally runs peer gossip (auto-discovery) after syncing.
+export async function syncPeer(peer, namespace, db, autoDiscover = true) {
+    let cursor = undefined;
+    let inserted = 0;
+    let rejected = 0;
+    let discoveredSigner = null;
+    try {
+        do {
+            const url = buildRecordsUrl(peer.url, namespace, peer.lastSyncAt, cursor);
+            const body = await fetchRecords(url);
+            if (body.protocol !== SUPPORTED_PROTOCOL) {
+                console.warn(`[sync] ${peer.url} speaks protocol ${body.protocol} — skipping`);
+                return { healthy: false, nodeVersion: body.node_version ?? peer.nodeVersion };
+            }
+            for (const record of body.records) {
+                const result = await validateAndInsert(record, db, peer.signerAddress);
+                if (result.inserted) {
+                    inserted++;
+                    if (result.signer && !discoveredSigner)
+                        discoveredSigner = result.signer;
+                }
+                else {
+                    rejected++;
+                }
+            }
+            cursor = body.cursor ?? undefined;
+        } while (cursor !== undefined);
+        if (inserted > 0 || rejected > 0) {
+            console.log(`[sync] ${peer.url} — +${inserted} inserted, ${rejected} rejected`);
+        }
+        // Fetch /vni — authoritative signed identity (preferred over health signerAddress)
+        const vni = await fetchPeerVni(peer.url);
+        const vniSigner = vni ? await verifyVni(vni) : null;
+        // Fetch /health for nodeVersion fallback
+        const health = await fetchPeerHealth(peer.url);
+        // Auto-discovery: pull peer's known peers and add any new ones
+        if (autoDiscover)
+            await discoverPeers(peer, db);
+        return {
+            healthy: true,
+            lastSyncAt: Math.floor(Date.now() / 1000),
+            nodeVersion: vni?.version ?? health?.version ?? peer.nodeVersion,
+            signerAddress: vniSigner ?? discoveredSigner ?? health?.signerAddress ?? peer.signerAddress,
+        };
+    }
+    catch (err) {
+        console.warn(`[sync] ${peer.url} unreachable — ${String(err)}`);
+        return { healthy: false };
+    }
+}
+// Validate a single record's signature then insert.
+// Signer pinning: if the peer's signer address is already known, reject any
+// record signed by a different key — prevents a compromised peer from injecting
+// records on behalf of another node.
+async function validateAndInsert(record, db, knownSigner) {
+    if (record.signature === '0x') {
+        console.warn(`[sync] unsigned record ${record.inputHash} — accepted (dry-run peer)`);
+        await db.insertRecord(record);
+        return { inserted: true, signer: null };
+    }
+    let signer;
+    try {
+        signer = await recoverRecordSigner(record);
+    }
+    catch {
+        console.warn(`[sync] malformed signature on ${record.inputHash} — rejected`);
+        return { inserted: false, signer: null };
+    }
+    if (knownSigner && signer.toLowerCase() !== knownSigner.toLowerCase()) {
+        console.warn(`[sync] signer mismatch on ${record.inputHash}: ` +
+            `expected ${knownSigner.slice(0, 10)}… got ${signer.slice(0, 10)}… — rejected`);
+        return { inserted: false, signer: null };
+    }
+    await db.insertRecord(record);
+    return { inserted: true, signer };
+}
+function buildRecordsUrl(baseUrl, namespace, since, cursor) {
+    const url = new URL('/records', baseUrl);
+    url.searchParams.set('namespace', namespace);
+    url.searchParams.set('since', String(since));
+    url.searchParams.set('limit', '500');
+    if (cursor)
+        url.searchParams.set('cursor', cursor);
+    return url.toString();
+}
+async function fetchRecords(url) {
+    const res = await fetch(url, { signal: AbortSignal.timeout(10_000) });
+    if (!res.ok)
+        throw new Error(`HTTP ${res.status}`);
+    return res.json();
+}
+async function fetchPeerHealth(baseUrl) {
+    try {
+        const res = await fetch(new URL('/health', baseUrl).toString(), {
+            signal: AbortSignal.timeout(5_000),
+        });
+        if (!res.ok)
+            return null;
+        return res.json();
+    }
+    catch {
+        return null;
+    }
+}
+// Fetch the peer's /peers list and add any newly discovered nodes to our DB.
+// Bounded to 10 new peers per sync cycle — prevents runaway growth.
+async function discoverPeers(peer, db) {
+    try {
+        const res = await fetch(new URL('/peers', peer.url).toString(), {
+            signal: AbortSignal.timeout(5_000),
+        });
+        if (!res.ok)
+            return;
+        const data = await res.json();
+        if (!data.peers?.length)
+            return;
+        const existing = new Set((await db.getPeers()).map((p) => p.url));
+        let added = 0;
+        for (const discovered of data.peers) {
+            if (added >= 10)
+                break;
+            if (!discovered.url || existing.has(discovered.url))
+                continue;
+            try {
+                new URL(discovered.url);
+            }
+            catch {
+                continue;
+            }
+            const url = discovered.url.replace(/\/$/, '');
+            await db.upsertPeer({ url, lastSyncAt: 0, healthy: true, nodeVersion: null, signerAddress: discovered.signerAddress });
+            added++;
+        }
+        if (added > 0)
+            console.log(`[sync] discovered ${added} new peer(s) from ${peer.url}`);
+    }
+    catch {
+        // non-fatal — gossip is best-effort
+    }
+}
+//# sourceMappingURL=sync.js.map

package/dist/mesh/sync.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync.js","sourceRoot":"","sources":["../../src/mesh/sync.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AACxD,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,UAAU,CAAA;AAElD,uEAAuE;AACvE,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,MAAc,EAAE,EAAM;IAClD,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAA;IACjC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CACtC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,aAAa,EAAE,EAAE,EAAE,MAAM,CAAC,YAAY,CAAC,CAAA;QAClF,MAAM,EAAE,CAAC,UAAU,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,CAAA;IAC7C,CAAC,CAAC,CACH,CAAA;IACD,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,MAAM,CAAA;AAC/D,CAAC;AAED,MAAM,kBAAkB,GAAG,CAAC,CAAA;AAe5B,4EAA4E;AAC5E,8DAA8D;AAC9D,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,IAAe,EACf,SAAiB,EACjB,EAAM,EACN,YAAY,GAAG,IAAI;IAEnB,IAAI,MAAM,GAAuB,SAAS,CAAA;IAC1C,IAAI,QAAQ,GAAG,CAAC,CAAA;IAChB,IAAI,QAAQ,GAAG,CAAC,CAAA;IAChB,IAAI,gBAAgB,GAAkB,IAAI,CAAA;IAE1C,IAAI,CAAC;QACH,GAAG,CAAC;YACF,MAAM,GAAG,GAAI,eAAe,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAA;YAC1E,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;YAEpC,IAAI,IAAI,CAAC,QAAQ,KAAK,kBAAkB,EAAE,CAAC;gBACzC,OAAO,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,GAAG,oBAAoB,IAAI,CAAC,QAAQ,aAAa,CAAC,CAAA;gBAC9E,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,WAAW,EAAE,CAAA;YAC/E,CAAC;YAED,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBAClC,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,EAAE,EAAE,IAAI,CAAC,aAAa,CAAC,CAAA;gBACtE,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;oBACpB,QAAQ,EAAE,CAAA;oBACV,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,gBAAgB;wBAAE,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAA;gBAC1E,CAAC;qBAAM,CAAC;oBACN,QAAQ,EAAE,CAAA;gBACZ,CAAC;YACH,CAAC;YAED,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,SAAS,CAAA;QACnC,CAAC,QAAQ,MAAM,KAAK,SAAS,EAAC;QAE9B,IAAI,QAAQ,GAAG,CAAC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;YACjC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,GAAG,OAAO,QAAQ,cAAc,QAAQ,WAAW,CAAC,CAAA;QACjF,CAAC;QAED,mFAAmF;QACnF,MAAM,GAAG,GAAM,MAAM,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC3C,MAAM,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QAEnD,yCAAyC;QACzC,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAE9C,+DAA+D;QAC/D,IAAI,YAAY;YAAE,MAAM,aAAa,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;QAE/C,OAAO;YACL,OAAO,EAAQ,IAAI;YACnB,UAAU,EAAK,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YAC5C,WAAW,EAAI,GAAG,EAAE,OAAO,IAAc,MAAM,EAAE,OAAO,IAAS,IAAI,CAAC,WAAW;YACjF,aAAa,EAAE,SAAS,IAAiB,gBAAgB,IAAS,MAAM,EAAE,aAAa,IAAI,IAAI,CAAC,aAAa;SAC9G,CAAA;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,GAAG,kBAAkB,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC/D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;IAC3B,CAAC;AACH,CAAC;AAED,oDAAoD;AACpD,4EAA4E;AAC5E,gFAAgF;AAChF,qCAAqC;AACrC,KAAK,UAAU,iBAAiB,CAC9B,MAAkB,EAClB,EAAM,EACN,WAA0B;IAE1B,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QAC9B,OAAO,CAAC,IAAI,CAAC,0BAA0B,MAAM,CAAC,SAAS,4BAA4B,CAAC,CAAA;QACpF,MAAM,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,CAAA;QAC7B,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;IACzC,CAAC;IAED,IAAI,MAAc,CAAA;IAClB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,mBAAmB,CAAC,MAAM,CAAC,CAAA;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,IAAI,CAAC,iCAAiC,MAAM,CAAC,SAAS,aAAa,CAAC,CAAA;QAC5E,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;IAC1C,CAAC;IAED,IAAI,WAAW,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,WAAW,CAAC,WAAW,EAAE,EAAE,CAAC;QACtE,OAAO,CAAC,IAAI,CACV,6BAA6B,MAAM,CAAC,SAAS,IAAI;YACjD,YAAY,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAC/E,CAAA;QACD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;IAC1C,CAAC;IAED,MAAM,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,CAAA;IAC7B,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;AACnC,CAAC;AAED,SAAS,eAAe,CACtB,OAAe,EACf,SAAiB,EACjB,KAAa,EACb,MAAe;IAEf,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;IACxC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAA;IAC5C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;IAC5C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IACpC,IAAI,MAAM;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;IAClD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAA;AACvB,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,GAAW;IACrC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IACrE,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,CAAA;IAClD,OAAO,GAAG,CAAC,IAAI,EAA8B,CAAA;AAC/C,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,OAAe;IAC5C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE;YAC9D,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;SACnC,CAAC,CAAA;QACF,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAA;QACxB,OAAO,GAAG,CAAC,IAAI,EAA6B,CAAA;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,oEAAoE;AACpE,KAAK,UAAU,aAAa,CAAC,IAAe,EAAE,EAAM;IAClD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;YAC9D,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;SACnC,CAAC,CAAA;QACF,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAM;QACnB,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAiE,CAAA;QAC5F,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM;YAAE,OAAM;QAE/B,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;QACjE,IAAI,KAAK,GAAG,CAAC,CAAA;QACb,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACpC,IAAI,KAAK,IAAI,EAAE;gBAAE,MAAK;YACtB,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAQ;YAC7D,IAAI,CAAC;gBAAC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,SAAQ;YAAC,CAAC;YAClD,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;YAC7C,MAAM,EAAE,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,aAAa,EAAE,UAAU,CAAC,aAAa,EAAE,CAAC,CAAA;YACtH,KAAK,EAAE,CAAA;QACT,CAAC;QACD,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,KAAK,qBAAqB,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;IACvF,CAAC;IAAC,MAAM,CAAC;QACP,oCAAoC;IACtC,CAAC;AACH,CAAC"}

package/dist/mesh/vni.d.ts

@@ -0,0 +1,14 @@
+export type VniDocument = {
+    nodeId: `0x${string}`;
+    signerAddress: `0x${string}`;
+    url: string;
+    version: string;
+    timestamp: number;
+};
+export type SignedVni = VniDocument & {
+    signature: `0x${string}`;
+};
+export declare function makeVni(gatewayKey: `0x${string}`, url: string, version?: string): Promise<SignedVni>;
+export declare function verifyVni(vni: SignedVni): Promise<`0x${string}` | null>;
+export declare function fetchPeerVni(baseUrl: string): Promise<SignedVni | null>;
+//# sourceMappingURL=vni.d.ts.map

package/dist/mesh/vni.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vni.d.ts","sourceRoot":"","sources":["../../src/mesh/vni.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,WAAW,GAAG;IACxB,MAAM,EAAS,KAAK,MAAM,EAAE,CAAA;IAC5B,aAAa,EAAE,KAAK,MAAM,EAAE,CAAA;IAC5B,GAAG,EAAY,MAAM,CAAA;IACrB,OAAO,EAAQ,MAAM,CAAA;IACrB,SAAS,EAAM,MAAM,CAAA;CACtB,CAAA;AAED,MAAM,MAAM,SAAS,GAAG,WAAW,GAAG;IAAE,SAAS,EAAE,KAAK,MAAM,EAAE,CAAA;CAAE,CAAA;AAQlE,wBAAsB,OAAO,CAC3B,UAAU,EAAE,KAAK,MAAM,EAAE,EACzB,GAAG,EAAE,MAAM,EACX,OAAO,SAAU,GAChB,OAAO,CAAC,SAAS,CAAC,CAepB;AAGD,wBAAsB,SAAS,CAAC,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,KAAK,MAAM,EAAE,GAAG,IAAI,CAAC,CAY7E;AAGD,wBAAsB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAU7E"}

package/dist/mesh/vni.js

@@ -0,0 +1,52 @@
+import { keccak256, toBytes, recoverMessageAddress } from 'viem';
+import { privateKeyToAccount } from 'viem/accounts';
+// Serialise the document body for signing — must be deterministic
+function vniMessage(doc) {
+    return 'ccip-router:vni:' + JSON.stringify(doc);
+}
+// Produce a fresh signed VNI for this node.
+export async function makeVni(gatewayKey, url, version = '0.1.0') {
+    const account = privateKeyToAccount(gatewayKey);
+    const timestamp = Math.floor(Date.now() / 1000);
+    const nodeId = keccak256(toBytes(account.address));
+    const doc = {
+        nodeId,
+        signerAddress: account.address,
+        url,
+        version,
+        timestamp,
+    };
+    const signature = await account.signMessage({ message: vniMessage(doc) });
+    return { ...doc, signature };
+}
+// Verify a VNI's signature — returns the recovered signer or null.
+export async function verifyVni(vni) {
+    try {
+        const { signature, ...doc } = vni;
+        const recovered = await recoverMessageAddress({
+            message: vniMessage(doc),
+            signature,
+        });
+        if (recovered.toLowerCase() !== vni.signerAddress.toLowerCase())
+            return null;
+        return recovered;
+    }
+    catch {
+        return null;
+    }
+}
+// Fetch and optionally verify a peer's VNI.
+export async function fetchPeerVni(baseUrl) {
+    try {
+        const res = await fetch(new URL('/vni', baseUrl).toString(), {
+            signal: AbortSignal.timeout(5_000),
+        });
+        if (!res.ok)
+            return null;
+        return res.json();
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=vni.js.map

package/dist/mesh/vni.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vni.js","sourceRoot":"","sources":["../../src/mesh/vni.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,qBAAqB,EAAE,MAAM,MAAM,CAAA;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AAYnD,kEAAkE;AAClE,SAAS,UAAU,CAAC,GAAgB;IAClC,OAAO,kBAAkB,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;AACjD,CAAC;AAED,4CAA4C;AAC5C,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,UAAyB,EACzB,GAAW,EACX,OAAO,GAAG,OAAO;IAEjB,MAAM,OAAO,GAAK,mBAAmB,CAAC,UAAU,CAAC,CAAA;IACjD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IAC/C,MAAM,MAAM,GAAM,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAkB,CAAA;IAEtE,MAAM,GAAG,GAAgB;QACvB,MAAM;QACN,aAAa,EAAE,OAAO,CAAC,OAAO;QAC9B,GAAG;QACH,OAAO;QACP,SAAS;KACV,CAAA;IAED,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IACzE,OAAO,EAAE,GAAG,GAAG,EAAE,SAAS,EAAE,CAAA;AAC9B,CAAC;AAED,mEAAmE;AACnE,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAc;IAC5C,IAAI,CAAC;QACH,MAAM,EAAE,SAAS,EAAE,GAAG,GAAG,EAAE,GAAG,GAAG,CAAA;QACjC,MAAM,SAAS,GAAG,MAAM,qBAAqB,CAAC;YAC5C,OAAO,EAAI,UAAU,CAAC,GAAkB,CAAC;YACzC,SAAS;SACV,CAAC,CAAA;QACF,IAAI,SAAS,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,aAAa,CAAC,WAAW,EAAE;YAAE,OAAO,IAAI,CAAA;QAC5E,OAAO,SAAS,CAAA;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,4CAA4C;AAC5C,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAe;IAChD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE;YAC3D,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;SACnC,CAAC,CAAA;QACF,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAA;QACxB,OAAO,GAAG,CAAC,IAAI,EAAwB,CAAA;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC"}

package/dist/router/CcipRouter.d.ts

@@ -0,0 +1,26 @@
+import { Hono } from 'hono';
+import type { DB } from '../db/types.js';
+export type ResolverFn = (sender: `0x${string}`, calldata: `0x${string}`, namespace: string) => Promise<`0x${string}`>;
+export type IdentityOpts = {
+    agentId: `0x${string}`;
+    registryAddress: `0x${string}`;
+    chainId: number;
+};
+export type CcipRouterOptions = {
+    resolver: ResolverFn;
+    namespace?: string;
+    db?: DB;
+    gatewayKey?: `0x${string}` | null;
+    identity?: IdentityOpts;
+};
+export declare class CcipRouter {
+    private resolver;
+    private namespace;
+    private db;
+    private gatewayKey;
+    private identity;
+    constructor(opts: CcipRouterOptions);
+    hono(): Hono;
+    private writeRecord;
+}
+//# sourceMappingURL=CcipRouter.d.ts.map

package/dist/router/CcipRouter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CcipRouter.d.ts","sourceRoot":"","sources":["../../src/router/CcipRouter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAG3B,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAA;AAOxC,MAAM,MAAM,UAAU,GAAG,CACvB,MAAM,EAAE,KAAK,MAAM,EAAE,EACrB,QAAQ,EAAE,KAAK,MAAM,EAAE,EACvB,SAAS,EAAE,MAAM,KACd,OAAO,CAAC,KAAK,MAAM,EAAE,CAAC,CAAA;AAK3B,MAAM,MAAM,YAAY,GAAG;IACzB,OAAO,EAAU,KAAK,MAAM,EAAE,CAAA;IAC9B,eAAe,EAAE,KAAK,MAAM,EAAE,CAAA;IAC9B,OAAO,EAAU,MAAM,CAAA;CACxB,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,QAAQ,EAAK,UAAU,CAAA;IACvB,SAAS,CAAC,EAAG,MAAM,CAAA;IACnB,EAAE,CAAC,EAAU,EAAE,CAAA;IACf,UAAU,CAAC,EAAE,KAAK,MAAM,EAAE,GAAG,IAAI,CAAA;IACjC,QAAQ,CAAC,EAAI,YAAY,CAAA;CAC1B,CAAA;AAED,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAc;IAC9B,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,EAAE,CAAmB;IAC7B,OAAO,CAAC,UAAU,CAAsB;IACxC,OAAO,CAAC,QAAQ,CAAuB;gBAE3B,IAAI,EAAE,iBAAiB;IASnC,IAAI,IAAI,IAAI;YAsDE,WAAW;CAoB1B"}

package/dist/router/CcipRouter.js

@@ -0,0 +1,85 @@
+import { Hono } from 'hono';
+import { cors } from 'hono/cors';
+import { privateKeyToAccount } from 'viem/accounts';
+import { hashCalldata, signRecord } from '../crypto/index.js';
+import { decodeRequest, encodeResponse, CcipRequestError } from '../gateway/eip3668.js';
+export class CcipRouter {
+    resolver;
+    namespace;
+    db;
+    gatewayKey;
+    identity;
+    constructor(opts) {
+        this.resolver = opts.resolver;
+        this.namespace = opts.namespace ?? 'agent-attestations';
+        this.db = opts.db ?? null;
+        this.gatewayKey = opts.gatewayKey ?? null;
+        this.identity = opts.identity ?? null;
+    }
+    // Returns a Hono app — mount at '/' via app.route('/', router.hono())
+    hono() {
+        const app = new Hono();
+        // EIP-3668 gateways are called directly from browser clients
+        app.use('*', cors({ origin: '*', allowMethods: ['GET'] }));
+        // GET /identity — ERC-8004 declared identity, machine-readable for peer discovery.
+        // 404 if not configured — callers should treat absence as "identity unknown".
+        app.get('/identity', (c) => {
+            if (!this.identity) {
+                return c.json({ declared: false }, 404);
+            }
+            const signerAddress = this.gatewayKey
+                ? privateKeyToAccount(this.gatewayKey).address
+                : null;
+            return c.json({
+                declared: true,
+                agentId: this.identity.agentId,
+                registryAddress: this.identity.registryAddress,
+                chainId: this.identity.chainId,
+                namespace: this.namespace,
+                signerAddress,
+            });
+        });
+        app.get('/:sender/:data', async (c) => {
+            let req;
+            try {
+                req = decodeRequest(c.req.param('sender'), c.req.param('data'));
+            }
+            catch (err) {
+                if (err instanceof CcipRequestError) {
+                    return c.json({ error: err.message }, err.status);
+                }
+                return c.json({ error: 'bad request' }, 400);
+            }
+            let result;
+            try {
+                result = await this.resolver(req.sender, req.calldata, this.namespace);
+            }
+            catch (err) {
+                return c.json({ error: 'resolver error', detail: String(err) }, 500);
+            }
+            // fire-and-forget — never block the CCIP response on DB write
+            this.writeRecord(req.calldata, result).catch((err) => console.error('[ccip-router] writeRecord failed:', err));
+            return c.json(encodeResponse(result));
+        });
+        return app;
+    }
+    async writeRecord(calldata, response) {
+        if (!this.db)
+            return;
+        const inputHash = hashCalldata(calldata);
+        const timestamp = Math.floor(Date.now() / 1000);
+        const signature = this.gatewayKey
+            ? await signRecord(inputHash, this.namespace, response, timestamp, this.gatewayKey)
+            : '0x'; // dry-run — unsigned, peers will accept with warning
+        await this.db.insertRecord({
+            inputHash,
+            namespace: this.namespace,
+            key: inputHash,
+            value: response,
+            timestamp,
+            signature,
+            sourcePeer: null,
+        });
+    }
+}
+//# sourceMappingURL=CcipRouter.js.map

package/dist/router/CcipRouter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CcipRouter.js","sourceRoot":"","sources":["../../src/router/CcipRouter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAC3B,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AAEnD,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAC7D,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AA4BvF,MAAM,OAAO,UAAU;IACb,QAAQ,CAAc;IACtB,SAAS,CAAS;IAClB,EAAE,CAAmB;IACrB,UAAU,CAAsB;IAChC,QAAQ,CAAuB;IAEvC,YAAY,IAAuB;QACjC,IAAI,CAAC,QAAQ,GAAK,IAAI,CAAC,QAAQ,CAAA;QAC/B,IAAI,CAAC,SAAS,GAAI,IAAI,CAAC,SAAS,IAAI,oBAAoB,CAAA;QACxD,IAAI,CAAC,EAAE,GAAW,IAAI,CAAC,EAAE,IAAI,IAAI,CAAA;QACjC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAA;QACzC,IAAI,CAAC,QAAQ,GAAK,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAA;IACzC,CAAC;IAED,sEAAsE;IACtE,IAAI;QACF,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;QAEtB,6DAA6D;QAC7D,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,YAAY,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAA;QAE1D,mFAAmF;QACnF,8EAA8E;QAC9E,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE;YACzB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACnB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,GAAG,CAAC,CAAA;YACzC,CAAC;YACD,MAAM,aAAa,GAAG,IAAI,CAAC,UAAU;gBACnC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO;gBAC9C,CAAC,CAAC,IAAI,CAAA;YACR,OAAO,CAAC,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAS,IAAI;gBACrB,OAAO,EAAU,IAAI,CAAC,QAAQ,CAAC,OAAO;gBACtC,eAAe,EAAE,IAAI,CAAC,QAAQ,CAAC,eAAe;gBAC9C,OAAO,EAAU,IAAI,CAAC,QAAQ,CAAC,OAAO;gBACtC,SAAS,EAAQ,IAAI,CAAC,SAAS;gBAC/B,aAAa;aACd,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QAEF,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YACpC,IAAI,GAAqC,CAAA;YACzC,IAAI,CAAC;gBACH,GAAG,GAAG,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAA;YACjE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,gBAAgB,EAAE,CAAC;oBACpC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;gBACnD,CAAC;gBACD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,GAAG,CAAC,CAAA;YAC9C,CAAC;YAED,IAAI,MAAqB,CAAA;YACzB,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;YACxE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;YACtE,CAAC;YAED,8DAA8D;YAC9D,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CACnD,OAAO,CAAC,KAAK,CAAC,mCAAmC,EAAE,GAAG,CAAC,CACxD,CAAA;YAED,OAAO,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAA;QACvC,CAAC,CAAC,CAAA;QAEF,OAAO,GAAG,CAAA;IACZ,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,QAAuB,EAAE,QAAuB;QACxE,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,OAAM;QAEpB,MAAM,SAAS,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAA;QACxC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;QAE/C,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU;YAC/B,CAAC,CAAC,MAAM,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC;YACnF,CAAC,CAAC,IAAI,CAAA,CAAC,qDAAqD;QAE9D,MAAM,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC;YACzB,SAAS;YACT,SAAS,EAAG,IAAI,CAAC,SAAS;YAC1B,GAAG,EAAS,SAAS;YACrB,KAAK,EAAO,QAAQ;YACpB,SAAS;YACT,SAAS;YACT,UAAU,EAAE,IAAI;SACjB,CAAC,CAAA;IACJ,CAAC;CACF"}

package/dist/router/index.d.ts

@@ -0,0 +1,3 @@
+export { CcipRouter } from './CcipRouter.js';
+export type { ResolverFn, CcipRouterOptions } from './CcipRouter.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/router/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/router/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC5C,YAAY,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA"}

package/dist/router/index.js

@@ -0,0 +1,2 @@
+export { CcipRouter } from './CcipRouter.js';
+//# sourceMappingURL=index.js.map

package/dist/router/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/router/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA"}

package/package.json

@@ -0,0 +1,63 @@
+{
+  "name": "ccip-router",
+  "version": "0.1.0",
+  "description": "The coordination layer CCIP-Read was missing. Peer sync, deduplication, and cryptographic attestation for any CCIP-Read gateway.",
+  "type": "module",
+  "main": "./dist/lib.js",
+  "types": "./dist/lib.d.ts",
+  "exports": {
+    ".": {
+      "import": "./dist/lib.js",
+      "types": "./dist/lib.d.ts"
+    }
+  },
+  "files": [
+    "dist/attestation",
+    "dist/chain",
+    "dist/crypto",
+    "dist/db",
+    "dist/gateway",
+    "dist/lib.js",
+    "dist/lib.js.map",
+    "dist/lib.d.ts",
+    "dist/lib.d.ts.map",
+    "dist/mesh",
+    "dist/router",
+    "contracts/AttestationIndex.sol",
+    "contracts/NodeRegistry.sol"
+  ],
+  "keywords": [
+    "ccip-read", "eip-3668", "ens", "ethereum", "gateway",
+    "attestation", "wyriwe", "erc-8004", "ocp"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/Echo-Merlini/ccip-router.git"
+  },
+  "homepage": "https://github.com/Echo-Merlini/ccip-router#readme",
+  "scripts": {
+    "dev": "tsx watch src/index.ts",
+    "build": "tsc",
+    "start": "node dist/index.js",
+    "lint": "tsc --noEmit",
+    "test": "node --import tsx/esm --test src/**/__tests__/**/*.test.ts"
+  },
+  "dependencies": {
+    "@hono/node-server": "^2.0.4",
+    "better-sqlite3": "^12.10.0",
+    "hono": "^4.4.0",
+    "node-cron": "^4.2.1",
+    "viem": "^2.0.0"
+  },
+  "devDependencies": {
+    "@types/better-sqlite3": "^7.6.13",
+    "@types/node": "^20.0.0",
+    "@types/node-cron": "^3.0.11",
+    "tsx": "^4.0.0",
+    "typescript": "^5.4.0"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "license": "MIT"
+}