feat: wire decentralized-first RPC endpoints with POKT as primary default (ev-iqh40)

POKT Network (Nodies) endpoints are now the first-choice RPC provider for
Ethereum, Polygon, Arbitrum, and Optimism. Adds @cygnus-wealth/rpc-infrastructure
types for canonical endpoint config, build-time bundle assertion to prevent
leaked API keys, and 52 new tests covering endpoint hierarchy and secret scanning.

Author: linuxninja39

package.json

@@ -21,6 +21,7 @@
     "verify:websocket": "tsx src/e2e/websocketVerification.ts",
     "demo": "cd demo-ui && npm install && npm run dev",
     "dev:ui": "cd test-ui && npm install && npm run dev",
+    "build:check": "tsup && tsx scripts/check-bundle-secrets.ts",
     "prepublishOnly": "npm run build"
   },
   "keywords": [

scripts/check-bundle-secrets.ts

@@ -0,0 +1,20 @@
+#!/usr/bin/env tsx
+/**
+ * Build-time assertion: scans the production bundle for leaked API keys,
+ * env var values, and managed provider URLs.
+ *
+ * Run: npx tsx scripts/check-bundle-secrets.ts
+ */
+import { readFileSync } from 'fs';
+import { assertNoBundledSecrets } from '../src/rpc/build-assertions.js';
+
+const BUNDLE_PATH = './dist/index.js';
+
+try {
+  const content = readFileSync(BUNDLE_PATH, 'utf-8');
+  assertNoBundledSecrets(content);
+  console.log('Build assertion PASSED: no bundled secrets detected in', BUNDLE_PATH);
+} catch (err) {
+  console.error('Build assertion FAILED:', (err as Error).message);
+  process.exit(1);
+}

src/index.ts

@@ -136,6 +136,15 @@ export {
   RpcProviderType,
   DEFAULT_HEALTH_CHECK_INTERVAL_MS,
   METRICS_ROLLING_WINDOW_MS,
+  // Decentralized-first defaults
+  getDecentralizedRpcConfig,
+  getChainRpcConfig,
+  assertNoBundledApiKeys,
+  SUPPORTED_CHAIN_IDS,
+  POKT_ENDPOINTS,
+  API_KEY_PATTERNS,
+  // Build-time assertions
+  assertNoBundledSecrets,
 } from './rpc/index.js';
 
 export type {

src/registry/configs/arbitrum.json

@@ -6,6 +6,7 @@
   "explorer": "https://arbiscan.io",
   "endpoints": {
     "http": [
+      "https://arb-pokt.nodies.app",
       "https://arb1.arbitrum.io/rpc",
       "https://arbitrum-one-rpc.publicnode.com",
       "https://rpc.ankr.com/arbitrum"

src/registry/configs/ethereum.json

@@ -6,6 +6,7 @@
   "explorer": "https://etherscan.io",
   "endpoints": {
     "http": [
+      "https://eth-pokt.nodies.app",
       "https://ethereum-rpc.publicnode.com",
       "https://eth.llamarpc.com",
       "https://rpc.ankr.com/eth",

src/registry/configs/optimism.json

@@ -6,6 +6,7 @@
   "explorer": "https://optimistic.etherscan.io",
   "endpoints": {
     "http": [
+      "https://op-pokt.nodies.app",
       "https://mainnet.optimism.io",
       "https://optimism-rpc.publicnode.com",
       "https://rpc.ankr.com/optimism"

src/registry/configs/polygon.json

@@ -6,6 +6,7 @@
   "explorer": "https://polygonscan.com",
   "endpoints": {
     "http": [
+      "https://polygon-pokt.nodies.app",
       "https://polygon-rpc.com",
       "https://polygon-bor-rpc.publicnode.com",
       "https://rpc.ankr.com/polygon",

src/registry/decentralized-chain-configs.test.ts

@@ -0,0 +1,59 @@
+import { describe, it, expect } from 'vitest';
+import ethereumConfig from './configs/ethereum.json';
+import polygonConfig from './configs/polygon.json';
+import arbitrumConfig from './configs/arbitrum.json';
+import optimismConfig from './configs/optimism.json';
+import baseConfig from './configs/base.json';
+
+describe('chain configs: decentralized-first endpoints', () => {
+  const configs = [
+    { name: 'Ethereum', config: ethereumConfig, poktDomain: 'eth-pokt.nodies.app' },
+    { name: 'Polygon', config: polygonConfig, poktDomain: 'polygon-pokt.nodies.app' },
+    { name: 'Arbitrum', config: arbitrumConfig, poktDomain: 'arb-pokt.nodies.app' },
+    { name: 'Optimism', config: optimismConfig, poktDomain: 'op-pokt.nodies.app' },
+  ];
+
+  for (const { name, config, poktDomain } of configs) {
+    describe(name, () => {
+      it('should have POKT (Nodies) as the first HTTP endpoint', () => {
+        expect(config.endpoints.http[0]).toContain(poktDomain);
+      });
+
+      it('should not have Alchemy or Infura endpoints', () => {
+        for (const url of config.endpoints.http) {
+          expect(url).not.toContain('alchemy');
+          expect(url).not.toContain('infura');
+        }
+      });
+
+      it('should not contain API keys in any endpoint URL', () => {
+        for (const url of config.endpoints.http) {
+          // No /v2/<key> or /v3/<key> patterns
+          expect(url).not.toMatch(/\/v[23]\/[a-zA-Z0-9]{20,}/);
+        }
+        if (config.endpoints.ws) {
+          for (const url of config.endpoints.ws) {
+            expect(url).not.toMatch(/\/v[23]\/[a-zA-Z0-9]{20,}/);
+          }
+        }
+      });
+
+      it('should have at least 3 HTTP fallback endpoints', () => {
+        expect(config.endpoints.http.length).toBeGreaterThanOrEqual(3);
+      });
+    });
+  }
+
+  describe('Base (no POKT available)', () => {
+    it('should have public endpoints as primary', () => {
+      expect(baseConfig.endpoints.http.length).toBeGreaterThanOrEqual(3);
+    });
+
+    it('should not have Alchemy or Infura endpoints', () => {
+      for (const url of baseConfig.endpoints.http) {
+        expect(url).not.toContain('alchemy');
+        expect(url).not.toContain('infura');
+      }
+    });
+  });
+});

src/rpc/build-assertions.test.ts

@@ -0,0 +1,57 @@
+import { describe, it, expect } from 'vitest';
+import { assertNoBundledSecrets } from './build-assertions.js';
+
+describe('build-assertions', () => {
+  describe('assertNoBundledSecrets', () => {
+    it('should pass for clean content', () => {
+      const clean = `
+        const url = "https://eth-pokt.nodies.app";
+        const rpc = "https://polygon-rpc.com";
+      `;
+      expect(() => assertNoBundledSecrets(clean)).not.toThrow();
+    });
+
+    it('should fail if CYGNUS_RPC_ env var value is embedded', () => {
+      const dirty = `const url = "CYGNUS_RPC_ETHEREUM_KEY_abc123";`;
+      expect(() => assertNoBundledSecrets(dirty)).toThrow(/CYGNUS_RPC_/);
+    });
+
+    it('should fail if Alchemy API key pattern is found', () => {
+      const dirty = `const url = "https://eth-mainnet.g.alchemy.com/v2/a1b2c3d4e5f6g7h8i9j0";`;
+      expect(() => assertNoBundledSecrets(dirty)).toThrow(/alchemy/i);
+    });
+
+    it('should fail if Infura project ID pattern is found', () => {
+      const dirty = `const url = "https://mainnet.infura.io/v3/a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6";`;
+      expect(() => assertNoBundledSecrets(dirty)).toThrow(/infura/i);
+    });
+
+    it('should fail if generic long hex key pattern is found after /v2/ or /v3/', () => {
+      const dirty = `const url = "https://rpc.example.com/v2/a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8";`;
+      expect(() => assertNoBundledSecrets(dirty)).toThrow(/API key/i);
+    });
+
+    it('should not false-positive on known public endpoints', () => {
+      const safe = `
+        "https://eth-pokt.nodies.app"
+        "https://polygon-rpc.com"
+        "https://arb1.arbitrum.io/rpc"
+        "https://ethereum-rpc.publicnode.com"
+        "https://eth.llamarpc.com"
+        "https://rpc.ankr.com/eth"
+        "https://cloudflare-eth.com"
+        "wss://eth-mainnet.public.blastapi.io"
+        "https://ethereum-sepolia.blockpi.network/v1/rpc/public"
+      `;
+      expect(() => assertNoBundledSecrets(safe)).not.toThrow();
+    });
+
+    it('should detect multiple violations and report all', () => {
+      const dirty = `
+        const a = "https://eth-mainnet.g.alchemy.com/v2/abc123";
+        const b = "CYGNUS_RPC_KEY_xyz";
+      `;
+      expect(() => assertNoBundledSecrets(dirty)).toThrow();
+    });
+  });
+});

src/rpc/build-assertions.ts

@@ -0,0 +1,50 @@
+/**
+ * Build-time assertions for production bundle safety.
+ *
+ * Scans bundle content for leaked API keys, env var values, and
+ * managed provider URLs that should never appear in a client-side bundle.
+ *
+ * Usage:
+ *   import { assertNoBundledSecrets } from './build-assertions.js';
+ *   assertNoBundledSecrets(bundleContent);
+ *
+ * @module rpc/build-assertions
+ */
+
+/** Patterns that should never appear in a production bundle */
+const BUNDLE_SECRET_PATTERNS: Array<{ pattern: RegExp; label: string }> = [
+  { pattern: /CYGNUS_RPC_[A-Z_]+/g, label: 'CYGNUS_RPC_ env var reference' },
+  { pattern: /alchemy\.com\/v2\/[a-zA-Z0-9_-]{10,}/g, label: 'Alchemy API key in URL' },
+  { pattern: /alchemyapi\.io\/v2\/[a-zA-Z0-9_-]{10,}/g, label: 'Alchemy API key in URL' },
+  { pattern: /infura\.io\/v3\/[a-f0-9]{20,}/g, label: 'Infura project ID in URL' },
+  { pattern: /\/v[23]\/[a-zA-Z0-9_-]{32,}/g, label: 'Possible API key in /v2/ or /v3/ path' },
+];
+
+/**
+ * Assert that the given content (e.g., a production JS bundle) does not
+ * contain any API key patterns or env var values.
+ *
+ * @param content - The string content to scan (typically a bundled JS file)
+ * @throws Error if any secret patterns are found
+ */
+export function assertNoBundledSecrets(content: string): void {
+  const violations: string[] = [];
+
+  for (const { pattern, label } of BUNDLE_SECRET_PATTERNS) {
+    // Reset lastIndex for global patterns
+    pattern.lastIndex = 0;
+    const matches = content.match(pattern);
+    if (matches) {
+      for (const match of matches) {
+        violations.push(`${label}: "${match}"`);
+      }
+    }
+  }
+
+  if (violations.length > 0) {
+    throw new Error(
+      `Production bundle contains secret patterns — build REJECTED:\n` +
+      violations.map(v => `  - ${v}`).join('\n')
+    );
+  }
+}