feat(sdk): generate SPLITTER_ROUTES from the canonical registry, and fail closed on the policy window

.github/workflows/ci.yml

@@ -57,6 +57,28 @@ jobs:
       - name: Install dependencies
         run: npm ci --no-audit --no-fund
 
+      # The route table is generated from a byte-for-byte copy of the canonical
+      # registry artifact in AiFinPay/evm-contract, where every payment-critical
+      # field was read from the chain. This regenerates it and compares, so a
+      # hand-edited payout address, fee split or settlement flag turns CI red
+      # instead of shipping. It also re-hashes the vendored artifact against its
+      # recorded provenance, so editing the copy fails the same way.
+      #
+      # Offline and deterministic on purpose: this job must not depend on a
+      # network read of another repository to know whether it is in sync.
+      - name: Registry — SPLITTER_ROUTES matches the canonical registry
+        run: npm run registry:check
+
+      # The check above is offline and self-consistent: a writer who can change
+      # this repository can change the artifact, its recorded provenance and the
+      # generated table together, and the offline check would bless the set.
+      # This step breaks that loop by fetching the artifact from the OTHER
+      # repository at the exact commit provenance names and requiring the bytes
+      # to match. Both repositories are public, so no token is involved and
+      # there is nothing here for a compromised writer to forge.
+      - name: Registry — vendored artifact is byte-identical to evm-contract at the recorded commit
+        run: node scripts/check-registry-provenance.mjs
+
       - name: Build (tsc)
         run: npm run build
 

node/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aifinpay/agent",
-  "version": "2.0.0-rc.2",
+  "version": "2.0.0-rc.3",
   "description": "AiFinPay SDK for global Agent Passport identity and route-verified AIFP-1/AIFP-2 settlement for autonomous AI agents.",
   "type": "module",
   "main": "dist/index.js",
@@ -15,23 +15,62 @@
       "default": "./dist/wallet.js"
     }
   },
-  "files": ["dist", "README.md", "LICENSE"],
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
   "scripts": {
     "build": "tsc -p tsconfig.json",
+    "registry:sync": "node scripts/generate-splitter-routes.mjs",
+    "registry:check": "node scripts/generate-splitter-routes.mjs --check",
     "test": "vitest run",
     "prepublishOnly": "npm run build"
   },
   "keywords": [
-    "aifinpay", "ai-agent", "ai-agents", "ai-payments", "ai-agent-payments",
-    "agentic-ai", "autonomous-agents", "autonomous-payments", "agent-payments",
-    "agent-payment-protocol", "agent-commerce", "agentic-commerce", "agent-economy",
-    "ai-commerce", "ai-payment-infrastructure", "ai-financial-infrastructure",
-    "payment-rails", "financial-rails", "x402", "x402-payments", "http-402",
-    "mcp", "mcp-payments", "mcp-monetization", "model-context-protocol",
-    "payments", "api-payments", "api-monetization", "paid-apis", "machine-payments",
-    "m2m-payments", "programmable-payments", "crypto-payments", "stablecoin-payments",
-    "stablecoin", "usdc", "agent-wallet", "agent-passport", "non-custodial",
-    "fintech", "polygon", "solana", "ed25519"
+    "aifinpay",
+    "ai-agent",
+    "ai-agents",
+    "ai-payments",
+    "ai-agent-payments",
+    "agentic-ai",
+    "autonomous-agents",
+    "autonomous-payments",
+    "agent-payments",
+    "agent-payment-protocol",
+    "agent-commerce",
+    "agentic-commerce",
+    "agent-economy",
+    "ai-commerce",
+    "ai-payment-infrastructure",
+    "ai-financial-infrastructure",
+    "payment-rails",
+    "financial-rails",
+    "x402",
+    "x402-payments",
+    "http-402",
+    "mcp",
+    "mcp-payments",
+    "mcp-monetization",
+    "model-context-protocol",
+    "payments",
+    "api-payments",
+    "api-monetization",
+    "paid-apis",
+    "machine-payments",
+    "m2m-payments",
+    "programmable-payments",
+    "crypto-payments",
+    "stablecoin-payments",
+    "stablecoin",
+    "usdc",
+    "agent-wallet",
+    "agent-passport",
+    "non-custodial",
+    "fintech",
+    "polygon",
+    "solana",
+    "ed25519"
   ],
   "author": "CoinSecurities (SECCO) <contact@aifinpay.io>",
   "license": "MIT",
@@ -55,6 +94,10 @@
     "typescript": "^5.4.0",
     "vitest": "^4.1.5"
   },
-  "engines": { "node": ">=18" },
-  "publishConfig": { "access": "public" }
+  "engines": {
+    "node": ">=18"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
 }

node/registry/source.json

@@ -0,0 +1,14 @@
+{
+  "$comment": [
+    "Provenance for registry/splitter-table.json, which is a byte-for-byte copy of",
+    "the canonical artifact in AiFinPay/evm-contract. Nothing here is",
+    "hand-maintained: 'npm run registry:sync -- --from <path-to-evm-contract>'",
+    "rewrites both files together, and 'npm run registry:check' fails if the copy",
+    "no longer hashes to what is recorded here, or if src/splitterRoutes.generated.ts",
+    "no longer regenerates from it byte-for-byte."
+  ],
+  "repo": "AiFinPay/evm-contract",
+  "path": "registry/generated/splitter-table.json",
+  "commit": "8577d568932cae1e551fc08c7e7f22202cdffeb1",
+  "sha256": "ba556b411304c33861c778538d13921ecfbcec31937e0866a74f5e26e21e7a9f"
+}