Merge remote-tracking branch 'origin/main' into pbio/sdk-subpaths-and-utils-logging

Author: paulbalaji

.changeset/ten-apes-smash.md

@@ -0,0 +1,5 @@
+---
+'@hyperlane-xyz/sdk': patch
+---
+
+Added narrow runtime provider-builder exports for Tron and EVM-like consumers.

.github/workflows/claude-code-review.yml

@@ -13,8 +13,8 @@ on:
     types: [created]
 
 env:
-  CLAUDE_OPUS_MODEL: claude-opus-4-6
-  CLAUDE_SONNET_MODEL: claude-sonnet-4-5
+  CLAUDE_OPUS_MODEL: claude-opus-4-7
+  CLAUDE_SONNET_MODEL: claude-sonnet-4-6
 
 concurrency:
   group: claude-review-${{ github.event.pull_request.number || github.event.issue.number }}

.github/workflows/release.yml

@@ -321,9 +321,9 @@ jobs:
           webhook: ${{ secrets.SLACK_INCIDENTS_WEBHOOK }}
           webhook-type: incoming-webhook
           payload: |
-            text: ":red-siren: NPM package publish failed — see workflow run for details"
+            text: ":alert: NPM package publish failed — see workflow run for details"
             blocks:
               - type: "section"
                 text:
                   type: "mrkdwn"
-                  text: ":red-siren: *NPM package publish failed*\n<${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|View workflow run #${{ github.run_number }}>"
+                  text: ":alert: *NPM package publish failed*\n<${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|View workflow run #${{ github.run_number }}>"

.github/workflows/test-cli-e2e.yml

@@ -44,7 +44,9 @@ jobs:
         test:
           - core-deploy
           - warp-deploy-1
+          - warp-deploy-predicate
           - warp-apply-simple-updates
+          - warp-apply-predicate-updates
           - warp-check-1
           - warp-send
     steps:
@@ -90,6 +92,7 @@ jobs:
           - warp-apply-hook-updates
           - warp-apply-ism-updates
           - warp-apply-ownership-updates
+          - warp-apply-predicate-updates
           - warp-apply-rebalancing-config
           - warp-apply-simple-updates
           - warp-apply-submitters
@@ -102,6 +105,7 @@ jobs:
           - warp-bridge-2
           - warp-deploy-1
           - warp-deploy-2
+          - warp-deploy-predicate
           - warp-deploy-remote-routers
           # check
           - warp-check-1
@@ -115,6 +119,7 @@ jobs:
           - warp-read
           - warp-rebalancer
           - warp-send
+          - warp-send-predicate
           # xerc20
           - xerc20
     steps:

.husky/pre-commit

@@ -18,6 +18,21 @@ if [ "$GITHUB_ACTIONS" != "true" ]; then
         echo "Please remove any secrets, credentials, or sensitive information before committing."
         exit 1
     fi
+
+    # Broad private key check on staged diff. May produce false positives — set SKIP_KEY_CHECK=1 to bypass if intentional.
+    if [ "$SKIP_KEY_CHECK" != "1" ]; then
+        STAGED_DIFF=$(git diff --cached | awk '/^\+\+\+ b\// { file=substr($0,7) } /^\+[^+]/ { print file ":" $0 }')
+        EVM_MATCHES=$(echo "$STAGED_DIFF"    | grep -E '\b(0x)?[0-9a-fA-F]{64}\b' || true)
+        BASE58_MATCHES=$(echo "$STAGED_DIFF" | grep -E '\b[1-9A-HJ-NP-Za-km-z]{87,88}\b' || true)
+        CLI_MATCHES=$(echo "$STAGED_DIFF"    | grep -E '\[(\s*[0-9]{1,3}\s*,\s*){63}[0-9]{1,3}\s*\]' || true)
+        ALL_MATCHES=$(printf '%s\n%s\n%s' "$EVM_MATCHES" "$BASE58_MATCHES" "$CLI_MATCHES" | sed '/^$/d')
+        if [ -n "$ALL_MATCHES" ]; then
+            echo "⚠️  Possible private key detected in staged changes."
+            echo "$ALL_MATCHES"
+            echo "   If this is a non-sensitive value (e.g. tx hash), re-run with: SKIP_KEY_CHECK=1 git commit"
+            exit 1
+        fi
+    fi
 fi
 
 pnpm lint-staged --concurrent false

.registryrc

@@ -1 +1 @@
-a0953ebb7ba67657cb61816d416a8d6780dae9a6
+1b6c789d66582d0a33e7880a45aa9f418d1502f5

rust/main/agents/relayer/src/msg/metadata/base_builder.rs

@@ -19,7 +19,7 @@ use hyperlane_base::{
 use hyperlane_core::{
     accumulator::merkle::Proof, AggregationIsm, CcipReadIsm, Checkpoint, HyperlaneDomain,
     HyperlaneMessage, InterchainSecurityModule, ModuleType, MultisigIsm, RoutingIsm,
-    ValidatorAnnounce, H160, H256,
+    ValidatorAnnounce, H160, H256, H512,
 };
 
 use crate::msg::metadata::base_builder::validator_announced_storages::fetch_storage_locations_helper;
@@ -85,6 +85,10 @@ pub trait BuildsBaseMetadata: Send + Sync + Debug {
     async fn highest_known_leaf_index(&self) -> Option<u32>;
     async fn get_merkle_leaf_id_by_message_id(&self, message_id: H256)
         -> eyre::Result<Option<u32>>;
+    async fn retrieve_origin_tx_hash_by_message_id(
+        &self,
+        message_id: H256,
+    ) -> eyre::Result<Option<H512>>;
     async fn build_ism(&self, address: H256) -> eyre::Result<Box<dyn InterchainSecurityModule>>;
     async fn build_routing_ism(&self, address: H256) -> eyre::Result<Box<dyn RoutingIsm>>;
     async fn build_multisig_ism(&self, address: H256) -> eyre::Result<Box<dyn MultisigIsm>>;
@@ -172,6 +176,15 @@ impl BuildsBaseMetadata for BaseMetadataBuilder {
         Ok(merkle_leaf)
     }
 
+    async fn retrieve_origin_tx_hash_by_message_id(
+        &self,
+        message_id: H256,
+    ) -> eyre::Result<Option<H512>> {
+        Ok(self
+            .db
+            .retrieve_dispatched_tx_hash_by_message_id(&message_id)?)
+    }
+
     async fn build_ism(&self, address: H256) -> eyre::Result<Box<dyn InterchainSecurityModule>> {
         self.destination_chain_setup
             .build_ism(address, &self.metrics)

rust/main/agents/relayer/src/msg/metadata/ccip_read/mod.rs

@@ -15,8 +15,8 @@ use sha3::{digest::Update, Digest, Keccak256};
 use tracing::{info, instrument, warn};
 
 use hyperlane_core::{
-    utils::bytes_to_hex, CcipReadIsm, HyperlaneMessage, HyperlaneSignerExt, Metadata, ModuleType,
-    RawHyperlaneMessage, Signable, H160, H256,
+    h512_to_bytes, utils::bytes_to_hex, CcipReadIsm, HyperlaneMessage, HyperlaneSignerExt,
+    Metadata, ModuleType, RawHyperlaneMessage, Signable, H160, H256,
 };
 use hyperlane_ethereum::{OffchainLookup, Signers};
 
@@ -37,6 +37,7 @@ struct OffchainLookupRequestBody {
     pub data: String,
     pub sender: String,
     pub signature: Option<String>,
+    pub origin_tx_hash: Option<String>,
 }
 
 #[derive(Serialize, Deserialize)]
@@ -223,6 +224,24 @@ async fn metadata_build(
         .call_get_offchain_verify_info(ism, message)
         .await?;
 
+    let origin_tx_hash = ism_builder
+        .base
+        .base_builder()
+        .retrieve_origin_tx_hash_by_message_id(message.id())
+        .await
+        .map_err(|err| {
+            warn!(error = %err, "Error retrieving origin tx hash for message {:?}", message.id());
+        })
+        .ok()
+        .flatten()
+        .map(|h| bytes_to_hex(&h512_to_bytes(&h)));
+    tracing::debug!(
+        message_id = ?message.id(),
+        origin_tx_hash = ?origin_tx_hash,
+        found_in_db = origin_tx_hash.is_some(),
+        "Origin tx hash lookup result",
+    );
+
     let ccip_url_regex = create_ccip_url_regex();
 
     for url in info.urls.iter() {
@@ -232,7 +251,7 @@ async fn metadata_build(
         }
 
         // if we fail, we want to try the other urls
-        match fetch_offchain_data(ism_builder, &info, url).await {
+        match fetch_offchain_data(ism_builder, &info, url, origin_tx_hash.clone()).await {
             Ok(data) => return Ok(data),
             Err(err) => {
                 tracing::warn!(?ism_address, url, ?err, "Failed to fetch offchain data");
@@ -250,6 +269,7 @@ async fn fetch_offchain_data(
     ism_builder: &CcipReadIsmMetadataBuilder,
     info: &OffchainLookup,
     url: &str,
+    origin_tx_hash: Option<String>,
 ) -> Result<Metadata, MetadataBuildError> {
     // Compute relayer authentication signature via EIP-191
     let maybe_signature_hex = if let Some(signer) = ism_builder.base.base_builder().get_signer() {
@@ -271,7 +291,13 @@ async fn fetch_offchain_data(
             sender: sender_as_bytes,
             data: data_as_bytes,
             signature: maybe_signature_hex,
+            origin_tx_hash,
         };
+        tracing::debug!(
+            url = interpolated_url,
+            ?body,
+            "Sending POST request to offchain lookup server"
+        );
         Client::new()
             .request(Method::POST, interpolated_url)
             .header(CONTENT_TYPE, "application/json")
@@ -301,6 +327,10 @@ async fn fetch_offchain_data(
         let error_msg = format!("Failed to read offchain lookup server response: ({err})");
         MetadataBuildError::FailedToBuild(error_msg)
     })?;
+    tracing::debug!(
+        response = response_body,
+        "Received response from offchain lookup server"
+    );
     let json: OffchainResponse = serde_json::from_str(&response_body).map_err(|err| {
         let error_msg = format!(
             "Failed to parse offchain lookup server json response: ({err}) ({response_body})"

rust/main/agents/relayer/src/test_utils/mock_base_builder.rs

@@ -10,7 +10,7 @@ use hyperlane_base::{
 };
 use hyperlane_core::{
     accumulator::merkle::Proof, AggregationIsm, CcipReadIsm, Checkpoint, HyperlaneDomain,
-    HyperlaneMessage, InterchainSecurityModule, Mailbox, MultisigIsm, RoutingIsm, H256,
+    HyperlaneMessage, InterchainSecurityModule, Mailbox, MultisigIsm, RoutingIsm, H256, H512,
 };
 use hyperlane_ethereum::Signers;
 use hyperlane_test::mocks::MockMailboxContract;
@@ -191,6 +191,12 @@ impl BuildsBaseMetadata for MockBaseMetadataBuilder {
             .pop_front()
             .expect("No mock get_merkle_leaf_id_by_message_id response set")
     }
+    async fn retrieve_origin_tx_hash_by_message_id(
+        &self,
+        _message_id: H256,
+    ) -> eyre::Result<Option<H512>> {
+        Ok(None)
+    }
     async fn build_ism(&self, address: H256) -> eyre::Result<Box<dyn InterchainSecurityModule>> {
         self.responses
             .build_ism

rust/main/app-contexts/mainnet_config.json

@@ -42215,6 +42215,136 @@
         }
       ]
     },
+    {
+      "name": "USDT/oft",
+      "matchingList": [
+        {
+          "originDomain": 42161,
+          "senderAddress": [
+            "0x000000000000000000000000e4c1a1e54c232454311cf68610c3885fdd991c0e"
+          ],
+          "destinationDomain": 1,
+          "recipientAddress": [
+            "0x0000000000000000000000007bb4fe8f406fb7b22487fa2e3bcbcb6a38cf29e6"
+          ]
+        },
+        {
+          "originDomain": 42161,
+          "senderAddress": [
+            "0x000000000000000000000000e4c1a1e54c232454311cf68610c3885fdd991c0e"
+          ],
+          "destinationDomain": 9745,
+          "recipientAddress": [
+            "0x00000000000000000000000093bffa2231fba5029997603fb68d9ac08024baa2"
+          ]
+        },
+        {
+          "originDomain": 1,
+          "senderAddress": [
+            "0x0000000000000000000000007bb4fe8f406fb7b22487fa2e3bcbcb6a38cf29e6"
+          ],
+          "destinationDomain": 42161,
+          "recipientAddress": [
+            "0x000000000000000000000000e4c1a1e54c232454311cf68610c3885fdd991c0e"
+          ]
+        },
+        {
+          "originDomain": 1,
+          "senderAddress": [
+            "0x0000000000000000000000007bb4fe8f406fb7b22487fa2e3bcbcb6a38cf29e6"
+          ],
+          "destinationDomain": 9745,
+          "recipientAddress": [
+            "0x00000000000000000000000093bffa2231fba5029997603fb68d9ac08024baa2"
+          ]
+        },
+        {
+          "originDomain": 9745,
+          "senderAddress": [
+            "0x00000000000000000000000093bffa2231fba5029997603fb68d9ac08024baa2"
+          ],
+          "destinationDomain": 42161,
+          "recipientAddress": [
+            "0x000000000000000000000000e4c1a1e54c232454311cf68610c3885fdd991c0e"
+          ]
+        },
+        {
+          "originDomain": 9745,
+          "senderAddress": [
+            "0x00000000000000000000000093bffa2231fba5029997603fb68d9ac08024baa2"
+          ],
+          "destinationDomain": 1,
+          "recipientAddress": [
+            "0x0000000000000000000000007bb4fe8f406fb7b22487fa2e3bcbcb6a38cf29e6"
+          ]
+        }
+      ]
+    },
+    {
+      "name": "USDT/oft-legacy",
+      "matchingList": [
+        {
+          "originDomain": 42161,
+          "senderAddress": [
+            "0x0000000000000000000000009323793fb9a071ce5fe839079925c0e39f37170f"
+          ],
+          "destinationDomain": 1,
+          "recipientAddress": [
+            "0x000000000000000000000000c0da8ef1225145e0b720d8a33471fa6360b7e73b"
+          ]
+        },
+        {
+          "originDomain": 42161,
+          "senderAddress": [
+            "0x0000000000000000000000009323793fb9a071ce5fe839079925c0e39f37170f"
+          ],
+          "destinationDomain": 728126428,
+          "recipientAddress": [
+            "0x00000000000000000000000043bb7c9c64a05af94d67b52883a60756950058d7"
+          ]
+        },
+        {
+          "originDomain": 1,
+          "senderAddress": [
+            "0x000000000000000000000000c0da8ef1225145e0b720d8a33471fa6360b7e73b"
+          ],
+          "destinationDomain": 42161,
+          "recipientAddress": [
+            "0x0000000000000000000000009323793fb9a071ce5fe839079925c0e39f37170f"
+          ]
+        },
+        {
+          "originDomain": 1,
+          "senderAddress": [
+            "0x000000000000000000000000c0da8ef1225145e0b720d8a33471fa6360b7e73b"
+          ],
+          "destinationDomain": 728126428,
+          "recipientAddress": [
+            "0x00000000000000000000000043bb7c9c64a05af94d67b52883a60756950058d7"
+          ]
+        },
+        {
+          "originDomain": 728126428,
+          "senderAddress": [
+            "0x00000000000000000000000043bb7c9c64a05af94d67b52883a60756950058d7"
+          ],
+          "destinationDomain": 42161,
+          "recipientAddress": [
+            "0x0000000000000000000000009323793fb9a071ce5fe839079925c0e39f37170f"
+          ]
+        },
+        {
+          "originDomain": 728126428,
+          "senderAddress": [
+            "0x00000000000000000000000043bb7c9c64a05af94d67b52883a60756950058d7"
+          ],
+          "destinationDomain": 1,
+          "recipientAddress": [
+            "0x000000000000000000000000c0da8ef1225145e0b720d8a33471fa6360b7e73b"
+          ]
+        }
+      ]
+    },
     {
       "name": "RISE/bsc-ethereum",
       "matchingList": [