@iicp/web-node 0.2.2 → 0.2.3

package/README.md

@@ -2,8 +2,8 @@
 
 Browser-native **IICP node** for the [IICP](https://iicp.network) mesh — **consume** AI
 from the network *and* **serve** a model from a browser tab. ESM, built on the platform's
-native `fetch` / `SubtleCrypto` / WebGPU (and runs in Node ≥18). End-to-end payload
-encryption is **mandatory** and on by default.
+native `fetch` / `SubtleCrypto` / WebGPU (and runs in Node ≥18). The browser
+client refuses keyless providers rather than silently sending plaintext.
 
 ```
 npm install @iicp/web-node
@@ -47,6 +47,9 @@ Browser providers advertise a generated `cx_public_key`, decrypt incoming `iicp_
 payloads locally, report task success/failure/latency in heartbeats, and use a relay path
 because browser tabs cannot accept raw inbound TCP.
 
+Browser provider mode is experimental. Tab lifetime, relay availability,
+browser policy and device resources make it unsuitable for unattended service.
+
 Startup is intentionally ticketed: the provider registers, requests a short-lived relay
 bind ticket scoped to its worker and selected relay, and presents that ticket when it binds.
 Authentication or validation failures stop serving and clean up the temporary directory
@@ -64,6 +67,13 @@ Serving requires WebLLM — add it alongside this package:
 npm install @mlc-ai/web-llm   # peer dependency, only needed to serve
 ```
 
+## Version metadata
+
+Browser package identity and directory compatibility are separate values. Provider
+registration reports `implementation_name=@iicp/web-node`, the package
+`implementation_version`, and `sdk_compatibility_version`; the legacy
+`sdk_version` field remains the compatibility alias for older directories.
+
 ## Encryption
 
 IICP-CX (S.16) Tier-1: ephemeral **X25519** key agreement → **HKDF-SHA256** →
@@ -82,3 +92,9 @@ restriction and everything works.
 ## License
 
 Apache-2.0. Part of the open [IICP protocol](https://github.com/RobLe3/IICP).
+
+## Documentation
+
+- [Connect an AI agent](https://github.com/RobLe3/IICP/blob/main/docs/agent-bootstrap.md)
+- [Browser-node guide](https://iicp.network/browser-node)
+- [Official implementation registry](https://github.com/RobLe3/IICP/blob/main/IMPLEMENTATIONS.md)

package/dist/browserNodeProvider.d.ts

@@ -31,7 +31,7 @@ export interface BrowserProviderDiagnostic {
     relay_bound: boolean;
     tasks_served: number;
 }
-export declare const BROWSER_NODE_SDK_VERSION = "0.7.86-browser";
+export { BROWSER_NODE_SDK_VERSION } from "./version.js";
 /**
  * Coarse region autodetect from the browser's timezone (no network, no
  * geolocation permission). Matches the mesh's region convention

package/dist/browserNodeProvider.js

@@ -18,8 +18,9 @@
 // consumers route to a browser worker with zero client changes.
 import { maskTunnelUrl } from "./iicpConsumer.js";
 import { createCxKeyPair, decryptPayload } from "./cxConfidentiality.js";
+import { BROWSER_NODE_SDK_COMPATIBILITY_VERSION, BROWSER_NODE_SDK_VERSION, BROWSER_NODE_VERSION, } from "./version.js";
 const CHAT_INTENT = "urn:iicp:intent:llm:chat:v1";
-export const BROWSER_NODE_SDK_VERSION = "0.7.86-browser";
+export { BROWSER_NODE_SDK_VERSION } from "./version.js";
 /**
  * Coarse region autodetect from the browser's timezone (no network, no
  * geolocation permission). Matches the mesh's region convention
@@ -276,7 +277,14 @@ export class BrowserNodeProvider {
                         relay_transport: "http-poll",
                     },
                     sdk_language: "browser",
+                    // Old directories retain sdk_version as the compatibility fallback.
                     sdk_version: BROWSER_NODE_SDK_VERSION,
+                    // Newer projections can expose the implementation and compatibility
+                    // axes independently. Unknown registration fields are safely ignored
+                    // by older directory releases.
+                    implementation_name: "@iicp/web-node",
+                    implementation_version: BROWSER_NODE_VERSION,
+                    sdk_compatibility_version: BROWSER_NODE_SDK_COMPATIBILITY_VERSION,
                     // The current directory contract accepts native backend identifiers
                     // plus "custom". Browser/WebLLM providers are non-native providers,
                     // so advertise them as custom until the protocol taxonomy grows a

package/dist/build-manifest.json

@@ -0,0 +1,8 @@
+{
+  "schema": "iicp.browser_build_provenance.v1",
+  "package": "@iicp/web-node",
+  "implementation_version": "0.2.3",
+  "sdk_compatibility_version": "0.7.101",
+  "source_commit": "1d1e5612e237894735e05526d36dfebeec3ee53e",
+  "lockfile_sha256": "1dea1f6057741f225d03d4b96cd9f963bc70623cc126e2d65f80984fb8f8c85c"
+}

package/dist/index.d.ts

@@ -2,3 +2,4 @@ export * from "./iicpConsumer.js";
 export * from "./cxConfidentiality.js";
 export * from "./browserNodeProvider.js";
 export * from "./webllmRuntime.js";
+export * from "./version.js";

package/dist/index.js

@@ -9,3 +9,4 @@ export * from "./iicpConsumer.js";
 export * from "./cxConfidentiality.js";
 export * from "./browserNodeProvider.js";
 export * from "./webllmRuntime.js";
+export * from "./version.js";

package/dist/version.d.ts

@@ -0,0 +1,4 @@
+export declare const BROWSER_NODE_VERSION = "0.2.3";
+export declare const BROWSER_NODE_SDK_COMPATIBILITY_VERSION = "0.7.101";
+/** Backward-compatible registration value for directories that know only sdk_version. */
+export declare const BROWSER_NODE_SDK_VERSION = "0.7.101";

package/dist/version.js

@@ -0,0 +1,7 @@
+// Browser implementation and IICP SDK-compatibility versions are separate axes.
+// Keep package.json synchronized with BROWSER_NODE_VERSION; the quality gate
+// rejects drift. SDK compatibility describes the registration contract only.
+export const BROWSER_NODE_VERSION = "0.2.3";
+export const BROWSER_NODE_SDK_COMPATIBILITY_VERSION = "0.7.101";
+/** Backward-compatible registration value for directories that know only sdk_version. */
+export const BROWSER_NODE_SDK_VERSION = BROWSER_NODE_SDK_COMPATIBILITY_VERSION;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@iicp/web-node",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "description": "Browser-native IICP node (consume + serve): discovery-mesh client with mandatory E2E encryption (IICP-CX) + WebLLM provider. Zero-config, ESM.",
   "type": "module",
   "main": "dist/index.js",
@@ -19,9 +19,10 @@
   ],
   "sideEffects": false,
   "scripts": {
-    "build": "tsc -p tsconfig.json",
+    "build": "tsc -p tsconfig.json && node scripts/check-package-provenance.mjs",
     "typecheck": "tsc -p tsconfig.json --noEmit",
-    "test": "tsx --test tests/*.test.ts"
+    "test": "tsx --test tests/*.test.ts",
+    "package:audit": "npm pack --dry-run --json > /tmp/iicp-web-node-pack.json && node -e \"const p=require('/tmp/iicp-web-node-pack.json')[0]; if (!p.files.some(f=>f.path==='dist/build-manifest.json')) process.exit(1); if (p.files.some(f=>/(^|\\/)(\\.env|credentials?|node_modules)(\\/|$)/i.test(f.path))) process.exit(1)\""
   },
   "keywords": [
     "iicp",