@iicp/client 0.5.7 → 0.7.0

package/dist/token_validator.js

@@ -0,0 +1,34 @@
+"use strict";
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Constant-time bearer-token validation (parity Block E, #340).
+ *
+ * Port of iicp-adapter `services/token_validator.py`. Compares a presented token against
+ * the expected one with `crypto.timingSafeEqual` so a timing side-channel can't recover
+ * the token byte-by-byte. The expected token is updated after registration.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TokenValidator = void 0;
+const node_crypto_1 = require("node:crypto");
+class TokenValidator {
+    expected;
+    constructor(expectedToken = "") {
+        this.expected = expectedToken;
+    }
+    isValid(presented) {
+        if (!this.expected || !presented)
+            return false;
+        const a = Buffer.from(this.expected);
+        const b = Buffer.from(presented);
+        // timingSafeEqual throws on length mismatch; guard first (length is not secret).
+        if (a.length !== b.length)
+            return false;
+        return (0, node_crypto_1.timingSafeEqual)(a, b);
+    }
+    /** Set the expected token after registration (directory-issued). */
+    updateToken(newToken) {
+        this.expected = newToken;
+    }
+}
+exports.TokenValidator = TokenValidator;
+//# sourceMappingURL=token_validator.js.map

package/dist/token_validator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token_validator.js","sourceRoot":"","sources":["../src/token_validator.ts"],"names":[],"mappings":";AAAA,sCAAsC;AACtC;;;;;;GAMG;;;AAEH,6CAA8C;AAE9C,MAAa,cAAc;IACjB,QAAQ,CAAS;IAEzB,YAAY,aAAa,GAAG,EAAE;QAC5B,IAAI,CAAC,QAAQ,GAAG,aAAa,CAAC;IAChC,CAAC;IAED,OAAO,CAAC,SAAoC;QAC1C,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QAC/C,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjC,iFAAiF;QACjF,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QACxC,OAAO,IAAA,6BAAe,EAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/B,CAAC;IAED,oEAAoE;IACpE,WAAW,CAAC,QAAgB;QAC1B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;CACF;AApBD,wCAoBC"}

package/dist/trust_auditor.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Trust auditor — cross-node declaration consistency check (parity Block E, #340).
+ *
+ * Port of iicp-adapter `services/trust_auditor.py` (#118). Discovers active peers via the
+ * directory, probes each peer's `/iicp/health`, and verifies the directory-registered
+ * models actually appear in the peer's live health response. Missing models are a
+ * "declaration divergence" reported to `/v1/audit-report`.
+ *
+ * Opt-in background capability (call `runAuditPass` on a timer); not in the request hot
+ * path. The pure `modelsDiverge` helper is the unit-testable core.
+ */
+/** Registered models absent from the peer's health response (empty == consistent). */
+export declare function modelsDiverge(registered: string[], health: string[]): string[];
+export interface NodeAuditResult {
+    node_id: string;
+    endpoint: string;
+    passed: boolean;
+    health_reachable: boolean;
+    declared_models_match: boolean;
+    registered_models: string[];
+    health_models: string[];
+    latency_ms: number | null;
+    detail: string;
+}
+export interface AuditReport {
+    run_at: string;
+    nodes_probed: number;
+    nodes_passed: number;
+    nodes_failed: number;
+    results: NodeAuditResult[];
+}
+/** Discover peers, probe each concurrently, report divergences. One pass. */
+export declare function runAuditPass(directoryUrl: string, ownNodeId: string, nodeToken?: string): Promise<AuditReport>;
+//# sourceMappingURL=trust_auditor.d.ts.map

package/dist/trust_auditor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust_auditor.d.ts","sourceRoot":"","sources":["../src/trust_auditor.ts"],"names":[],"mappings":"AACA;;;;;;;;;;GAUG;AAOH,sFAAsF;AACtF,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAG9E;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,qBAAqB,EAAE,OAAO,CAAC;IAC/B,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,eAAe,EAAE,CAAC;CAC5B;AAuFD,6EAA6E;AAC7E,wBAAsB,YAAY,CAChC,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,EACjB,SAAS,SAAK,GACb,OAAO,CAAC,WAAW,CAAC,CAmBtB"}

package/dist/trust_auditor.js

@@ -0,0 +1,123 @@
+"use strict";
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Trust auditor — cross-node declaration consistency check (parity Block E, #340).
+ *
+ * Port of iicp-adapter `services/trust_auditor.py` (#118). Discovers active peers via the
+ * directory, probes each peer's `/iicp/health`, and verifies the directory-registered
+ * models actually appear in the peer's live health response. Missing models are a
+ * "declaration divergence" reported to `/v1/audit-report`.
+ *
+ * Opt-in background capability (call `runAuditPass` on a timer); not in the request hot
+ * path. The pure `modelsDiverge` helper is the unit-testable core.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.modelsDiverge = modelsDiverge;
+exports.runAuditPass = runAuditPass;
+const DISCOVER_INTENT = "urn:iicp:intent:llm:chat:v1";
+const PROBE_TIMEOUT_MS = 5000;
+const DISCOVER_TIMEOUT_MS = 8000;
+const AUDIT_REPORT_TIMEOUT_MS = 5000;
+/** Registered models absent from the peer's health response (empty == consistent). */
+function modelsDiverge(registered, health) {
+    const h = new Set(health);
+    return registered.filter((m) => !h.has(m));
+}
+async function discoverPeers(directoryUrl, ownNodeId) {
+    try {
+        const url = `${directoryUrl.replace(/\/$/, "")}/v1/discover?intent=${encodeURIComponent(DISCOVER_INTENT)}`;
+        const resp = await fetch(url, { signal: AbortSignal.timeout(DISCOVER_TIMEOUT_MS) });
+        if (!resp.ok)
+            return [];
+        const body = (await resp.json());
+        return (body.nodes ?? []).filter((n) => n.node_id !== ownNodeId);
+    }
+    catch {
+        return [];
+    }
+}
+async function probeNode(node) {
+    const nodeId = node.node_id ?? "unknown";
+    const endpoint = node.operator_url ?? node.endpoint ?? "";
+    const registered = node.models ?? [];
+    const base = {
+        node_id: nodeId,
+        endpoint,
+        passed: false,
+        health_reachable: false,
+        declared_models_match: false,
+        registered_models: registered,
+        health_models: [],
+        latency_ms: null,
+        detail: "",
+    };
+    if (!endpoint)
+        return { ...base, detail: "no endpoint" };
+    const t0 = Date.now();
+    try {
+        const resp = await fetch(`${endpoint.replace(/\/$/, "")}/iicp/health`, {
+            signal: AbortSignal.timeout(PROBE_TIMEOUT_MS),
+        });
+        const latency = Date.now() - t0;
+        if (!resp.ok)
+            return { ...base, latency_ms: latency, detail: `HTTP ${resp.status}` };
+        const health = (await resp.json());
+        const healthModels = health.models ?? [];
+        const missing = modelsDiverge(registered, healthModels);
+        const ok = missing.length === 0;
+        return {
+            ...base,
+            health_reachable: true,
+            declared_models_match: ok,
+            passed: ok,
+            health_models: healthModels,
+            latency_ms: latency,
+            detail: ok ? "OK" : `registered ${JSON.stringify(missing)} absent from health`,
+        };
+    }
+    catch (exc) {
+        const msg = exc instanceof Error ? exc.message : String(exc);
+        return { ...base, latency_ms: Date.now() - t0, detail: `connection error: ${msg}` };
+    }
+}
+async function reportDivergence(directoryUrl, ownNodeId, nodeToken, targetNodeId) {
+    if (!ownNodeId || !nodeToken)
+        return;
+    try {
+        await fetch(`${directoryUrl.replace(/\/$/, "")}/v1/audit-report`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json", Authorization: `Bearer ${nodeToken}` },
+            body: JSON.stringify({
+                node_id: ownNodeId,
+                target_node_id: targetNodeId,
+                finding: "declaration_divergence",
+            }),
+            signal: AbortSignal.timeout(AUDIT_REPORT_TIMEOUT_MS),
+        });
+    }
+    catch {
+        /* best-effort */
+    }
+}
+/** Discover peers, probe each concurrently, report divergences. One pass. */
+async function runAuditPass(directoryUrl, ownNodeId, nodeToken = "") {
+    const nodes = await discoverPeers(directoryUrl, ownNodeId);
+    const runAt = new Date().toISOString();
+    if (nodes.length === 0) {
+        return { run_at: runAt, nodes_probed: 0, nodes_passed: 0, nodes_failed: 0, results: [] };
+    }
+    const results = await Promise.all(nodes.map(probeNode));
+    for (const r of results) {
+        if (r.health_reachable && !r.declared_models_match) {
+            await reportDivergence(directoryUrl, ownNodeId, nodeToken, r.node_id);
+        }
+    }
+    return {
+        run_at: runAt,
+        nodes_probed: results.length,
+        nodes_passed: results.filter((r) => r.passed).length,
+        nodes_failed: results.filter((r) => !r.passed).length,
+        results,
+    };
+}
+//# sourceMappingURL=trust_auditor.js.map

package/dist/trust_auditor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust_auditor.js","sourceRoot":"","sources":["../src/trust_auditor.ts"],"names":[],"mappings":";AAAA,sCAAsC;AACtC;;;;;;;;;;GAUG;;AAQH,sCAGC;AA4GD,oCAuBC;AA5ID,MAAM,eAAe,GAAG,6BAA6B,CAAC;AACtD,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAC9B,MAAM,mBAAmB,GAAG,IAAI,CAAC;AACjC,MAAM,uBAAuB,GAAG,IAAI,CAAC;AAErC,sFAAsF;AACtF,SAAgB,aAAa,CAAC,UAAoB,EAAE,MAAgB;IAClE,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1B,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7C,CAAC;AA6BD,KAAK,UAAU,aAAa,CAAC,YAAoB,EAAE,SAAiB;IAClE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,uBAAuB,kBAAkB,CAAC,eAAe,CAAC,EAAE,CAAC;QAC3G,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC;QACpF,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,OAAO,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAiC,CAAC;QACjE,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAoB;IAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,IAAI,SAAS,CAAC;IACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;IAC1D,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;IACrC,MAAM,IAAI,GAAoB;QAC5B,OAAO,EAAE,MAAM;QACf,QAAQ;QACR,MAAM,EAAE,KAAK;QACb,gBAAgB,EAAE,KAAK;QACvB,qBAAqB,EAAE,KAAK;QAC5B,iBAAiB,EAAE,UAAU;QAC7B,aAAa,EAAE,EAAE;QACjB,UAAU,EAAE,IAAI;QAChB,MAAM,EAAE,EAAE;KACX,CAAC;IACF,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAEzD,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,EAAE;YACrE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC;SAC9C,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,OAAO,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QACrF,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAA0B,CAAC;QAC5D,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,aAAa,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QACxD,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC;QAChC,OAAO;YACL,GAAG,IAAI;YACP,gBAAgB,EAAE,IAAI;YACtB,qBAAqB,EAAE,EAAE;YACzB,MAAM,EAAE,EAAE;YACV,aAAa,EAAE,YAAY;YAC3B,UAAU,EAAE,OAAO;YACnB,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,qBAAqB;SAC/E,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,qBAAqB,GAAG,EAAE,EAAE,CAAC;IACtF,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,YAAoB,EACpB,SAAiB,EACjB,SAAiB,EACjB,YAAoB;IAEpB,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS;QAAE,OAAO;IACrC,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,kBAAkB,EAAE;YAChE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,SAAS,EAAE,EAAE;YACrF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,OAAO,EAAE,SAAS;gBAClB,cAAc,EAAE,YAAY;gBAC5B,OAAO,EAAE,wBAAwB;aAClC,CAAC;YACF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,uBAAuB,CAAC;SACrD,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB;IACnB,CAAC;AACH,CAAC;AAED,6EAA6E;AACtE,KAAK,UAAU,YAAY,CAChC,YAAoB,EACpB,SAAiB,EACjB,SAAS,GAAG,EAAE;IAEd,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAC3D,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACvC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC3F,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;IACxD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,CAAC,qBAAqB,EAAE,CAAC;YACnD,MAAM,gBAAgB,CAAC,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IACD,OAAO;QACL,MAAM,EAAE,KAAK;QACb,YAAY,EAAE,OAAO,CAAC,MAAM;QAC5B,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM;QACpD,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM;QACrD,OAAO;KACR,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@iicp/client",
-  "version": "0.5.7",
+  "version": "0.7.0",
   "description": "Official TypeScript/JavaScript SDK for the IICP protocol (ADR-016)",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",