@opennodes/registry 0.1.21 → 0.1.23

package/bin.js

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 import { startRegistry } from './src/server.js';
+import { parseSite } from './src/location.js';
 
 const dbPath = process.env.ONP_DB ?? ':memory:'; // sqlite path/:memory: or postgres:// URL
 const persistent = dbPath !== ':memory:' && !dbPath.startsWith('postgres');
@@ -18,6 +19,14 @@ const registry = await startRegistry({
     livenessIntervalMs: Number(process.env.ONP_LIVENESS_MS ?? 300_000),
     blindIntervalMs: Number(process.env.ONP_BLIND_MS ?? 3_600_000),
   },
+  // Server-location checks: ONP_LOCATION=1, this registry's site, and optional remote probe agents
+  // ("FI Helsinki 60.17 24.93 https://host/onp-probe", comma-separated) sharing ONP_PROBE_AGENT_TOKEN.
+  location: process.env.ONP_LOCATION === '1' ? {
+    selfSite: parseSite(process.env.ONP_PROBE_SITE),
+    agents: (process.env.ONP_PROBE_AGENTS ?? '').split(',').map(parseSite).filter((a) => a?.url)
+      .map((a) => ({ ...a, token: process.env.ONP_PROBE_AGENT_TOKEN ?? null })),
+    intervalMs: Number(process.env.ONP_LOCATION_MS ?? 24 * 3600 * 1000),
+  } : null,
   reimport: process.env.ONP_REIMPORT === '1' ? {
     intervalMs: Number(process.env.ONP_REIMPORT_MS ?? 6 * 3600 * 1000),
     sources: (process.env.ONP_REIMPORT_SOURCES ?? 'openrouter,huggingface').split(','),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opennodes/registry",
-  "version": "0.1.21",
+  "version": "0.1.23",
   "description": "OpenNodes (ONP) reference registry: node registration with proof-of-resource qualification (Stage A/B/C), transparent ranking, enforceable estimates, catalog importers (OpenRouter, Hugging Face, models.dev, Ollama), MCP surface, and the web app (catalog, chat, advisor, Node Builder)",
   "license": "Apache-2.0",
   "type": "module",
@@ -43,7 +43,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@opennodes/core": "0.1.6",
+    "@opennodes/core": "0.1.7",
     "pg": "^8.13.1"
   }
 }

package/src/location.js

@@ -0,0 +1,172 @@
+// Server-location checks (ONP-1 §6 threat 5, ONP-3 §6.5): where a node's API host actually is,
+// compared with the operator's declared country. Two signals, both evidence rather than proof:
+//  (a) IP geolocation + network owner of the endpoint host (RIPE NCC RIPEstat, no key needed);
+//      CDN / anycast networks are reported as such, never as a location.
+//  (b) TCP connect round-trip times from the registry's own probe sites. Light in fibre covers
+//      about 100 km per millisecond of round trip, so a reply faster than physics allows for the
+//      geolocated point means that point is wrong; one far slower than expected from every site
+//      is a soft warning (congestion or a forwarding hop can also cause it).
+// A front server that forwards requests elsewhere still defeats both; attested residency
+// (an auditor's credential) is the strong guarantee, planned for Draft 0.2.
+import net from 'node:net';
+import dns from 'node:dns/promises';
+import { EEA_COUNTRIES } from '@opennodes/core';
+import { isPrivateHost } from './namespace.js';
+
+const RIPESTAT = 'https://stat.ripe.net/data';
+const LOOKUP_TIMEOUT_MS = 30_000;
+const KM_PER_MS_RTT = 100;   // ~2/3 c in fibre, out and back
+
+/** Networks whose addresses are anycast / CDN edges: their IP says nothing about where inference runs. */
+export const CDN_ASNS = new Map([
+  [13335, 'Cloudflare'], [209242, 'Cloudflare'], [54113, 'Fastly'], [20940, 'Akamai'], [16625, 'Akamai'],
+  [16702, 'Akamai'], [32787, 'Akamai'], [60068, 'CDN77'], [22822, 'Edgio'], [15133, 'Edgecast'],
+]);
+
+const EEA = new Set(EEA_COUNTRIES);
+
+export function haversineKm(a, b) {
+  const rad = (d) => (d * Math.PI) / 180;
+  const dLat = rad(b.lat - a.lat), dLon = rad(b.lon - a.lon);
+  const h = Math.sin(dLat / 2) ** 2 + Math.cos(rad(a.lat)) * Math.cos(rad(b.lat)) * Math.sin(dLon / 2) ** 2;
+  return 2 * 6371 * Math.asin(Math.sqrt(h));
+}
+
+/**
+ * Judge measured RTTs against a claimed point. vantages: [{site, lat, lon, rtt_ms}].
+ * 'too_fast'  — some site measured less than physics allows for that point: the point is wrong.
+ * 'too_slow'  — every site measured far more than the point would explain: likely farther away.
+ * 'consistent' otherwise; 'unknown' without a point or measurements.
+ */
+export function assessLatency(vantages, point) {
+  const measured = vantages.filter((v) => Number.isFinite(v.rtt_ms));
+  if (!point || !measured.length) return { verdict: 'unknown', sites: measured };
+  const sites = measured.map((v) => {
+    const km = Math.round(haversineKm(v, point));
+    const min_rtt_ms = Math.round((km / KM_PER_MS_RTT) * 10) / 10;
+    return { site: v.site, rtt_ms: v.rtt_ms, distance_km: km, min_rtt_ms, max_distance_km: Math.round(v.rtt_ms * KM_PER_MS_RTT) };
+  });
+  if (sites.some((s) => s.rtt_ms < s.min_rtt_ms * 0.9 - 1)) return { verdict: 'too_fast', sites };
+  if (sites.every((s) => s.rtt_ms > s.min_rtt_ms * 2.5 + 25)) return { verdict: 'too_slow', sites };
+  return { verdict: 'consistent', sites };
+}
+
+/** match | same_region (both in the EEA) | mismatch | cdn | unknown */
+export function countryVerdict(declared, server) {
+  if (server?.cdn) return 'cdn';
+  if (!declared || !server?.country) return 'unknown';
+  if (server.country === declared) return 'match';
+  if (EEA.has(server.country) && EEA.has(declared)) return 'same_region';
+  return 'mismatch';
+}
+
+async function ripestat(fetchImpl, path, resource) {
+  const url = `${RIPESTAT}/${path}/data.json?resource=${encodeURIComponent(resource)}&sourceapp=opennodes-registry`;
+  const res = await fetchImpl(url, { signal: AbortSignal.timeout(LOOKUP_TIMEOUT_MS) });
+  if (!res.ok) throw new Error(`ripestat ${path} ${res.status}`);
+  return (await res.json()).data ?? {};
+}
+
+/** Country, city, coordinates and network of one IP address. */
+export async function lookupIp(ip, { fetchImpl = fetch, asHolders = new Map() } = {}) {
+  const [geo, netinfo] = await Promise.all([
+    ripestat(fetchImpl, 'maxmind-geo-lite', ip).catch(() => ({})),
+    ripestat(fetchImpl, 'network-info', ip).catch(() => ({})),
+  ]);
+  const loc = (geo.located_resources ?? []).flatMap((r) => r.locations ?? [])
+    .sort((a, b) => (b.covered_percentage ?? 0) - (a.covered_percentage ?? 0))[0];
+  const asn = Number((netinfo.asns ?? [])[0]) || null;
+  let holder = asn ? (CDN_ASNS.get(asn) ?? asHolders.get(asn)) : null;
+  if (asn && !holder) {
+    holder = (await ripestat(fetchImpl, 'as-overview', `AS${asn}`).catch(() => ({}))).holder ?? null;
+    if (holder) asHolders.set(asn, holder);
+  }
+  return {
+    ip,
+    country: loc?.country ? String(loc.country).toUpperCase() : null,
+    city: loc?.city || null,
+    lat: Number.isFinite(loc?.latitude) ? loc.latitude : null,
+    lon: Number.isFinite(loc?.longitude) ? loc.longitude : null,
+    asn, network: holder, prefix: netinfo.prefix ?? null,
+    cdn: asn ? CDN_ASNS.has(asn) : false,
+  };
+}
+
+/** Median TCP connect time (ms) to host:443 from here. */
+export async function measureRtt(host, { port = 443, attempts = 3, timeoutMs = 5000 } = {}) {
+  const times = [];
+  for (let i = 0; i < attempts; i++) {
+    const t = await new Promise((resolve) => {
+      const t0 = performance.now();
+      const socket = net.connect({ host, port, timeout: timeoutMs });
+      const done = (v) => { socket.destroy(); resolve(v); };
+      socket.once('connect', () => done(performance.now() - t0));
+      socket.once('timeout', () => done(null));
+      socket.once('error', () => done(null));
+    });
+    if (t !== null) times.push(t);
+  }
+  if (!times.length) return null;
+  times.sort((a, b) => a - b);
+  return Math.round(times[Math.floor(times.length / 2)] * 10) / 10;
+}
+
+/** Ask a remote probe agent (deploy/reference-node/probe-agent) for its RTT to host. */
+export async function remoteRtt(agent, host, fetchImpl = fetch) {
+  const res = await fetchImpl(`${agent.url.replace(/\/$/, '')}/rtt`, {
+    method: 'POST',
+    headers: { 'content-type': 'application/json', ...(agent.token ? { authorization: `Bearer ${agent.token}` } : {}) },
+    body: JSON.stringify({ host }),
+    signal: AbortSignal.timeout(30_000),
+  });
+  if (!res.ok) throw new Error(`probe agent ${res.status}`);
+  const body = await res.json();
+  return { site: body.site ?? agent.site, lat: body.lat ?? agent.lat, lon: body.lon ?? agent.lon, rtt_ms: body.rtt_ms ?? null };
+}
+
+/**
+ * Check one node: resolve its API host, geolocate the first public IPv4, measure RTT from every
+ * probe site, and compare with the declared country.
+ * opts: { selfSite: {site, lat, lon}, agents: [{site, lat, lon, url, token}], fetchImpl, resolve, rtt }
+ */
+export async function checkNodeLocation(card, opts = {}) {
+  const fetchImpl = opts.fetchImpl ?? fetch;
+  let host = null;
+  try { host = new URL(card?.endpoints?.openai).hostname; } catch { /* listing without an API */ }
+  const declared = card?.node?.operator?.country ? String(card.node.operator.country).toUpperCase() : null;
+  const out = { host, declared, checked_at: new Date().toISOString() };
+  if (!host) return { ...out, verdict: 'unknown', reason: 'no API endpoint' };
+
+  const ips = net.isIP(host) ? [host] : await (opts.resolve ?? ((h) => dns.resolve4(h)))(host).catch(() => []);
+  const ip = ips.find((a) => !isPrivateHost(a));
+  if (!ip) return { ...out, ips, verdict: 'unknown', reason: 'no public IPv4 address' };
+
+  const server = await lookupIp(ip, { fetchImpl, asHolders: opts.asHolders });
+  const vantages = [];
+  const rtt = opts.rtt ?? measureRtt;
+  if (opts.selfSite) vantages.push({ ...opts.selfSite, rtt_ms: await rtt(ip).catch(() => null) });
+  for (const agent of opts.agents ?? []) {
+    vantages.push(await remoteRtt(agent, ip, fetchImpl).catch(() => ({ site: agent.site, lat: agent.lat, lon: agent.lon, rtt_ms: null })));
+  }
+  // The point to test: the geolocated position unless it's a CDN edge.
+  const point = !server.cdn && server.lat !== null ? { lat: server.lat, lon: server.lon } : null;
+  const latency = assessLatency(vantages, point);
+  let verdict = countryVerdict(declared, server);
+  if (latency.verdict === 'too_fast' && verdict !== 'cdn') verdict = 'inconsistent';   // the geolocation itself is wrong
+  return {
+    ...out, ips,
+    server: { country: server.country, city: server.city, asn: server.asn, network: server.network, cdn: server.cdn },
+    verdict,
+    latency,
+  };
+}
+
+/** Parse "FI Helsinki 60.17 24.93 https://host/onp-probe" (agents) or "DE Nuremberg 49.45 11.08" (self). */
+export function parseSite(spec) {
+  if (!spec) return null;
+  const parts = String(spec).trim().split(/\s+/);
+  const [country, city, lat, lon, url] = parts;
+  const site = { site: `${country}-${city}`, lat: Number(lat), lon: Number(lon) };
+  if (!Number.isFinite(site.lat) || !Number.isFinite(site.lon)) return null;
+  return url ? { ...site, url } : site;
+}

package/src/search.js

@@ -54,7 +54,14 @@ async function buildOfferings(store) {
     const stageA = probes.filter((p) => p.stage === 'A');
     const probeSuccess = stageA.length ? stageA.filter((p) => p.ok).length / stageA.length : 0;
     const tier = node.state === 'indexed' ? 'unverified' : node.state;
-    const availability = (await store.getObservations(node.id, '_node')).availability ?? null;
+    const nodeObs = await store.getObservations(node.id, '_node');
+    const availability = nodeObs.availability ?? null;
+    const loc = nodeObs.location ?? null;
+    // Server-location check (location.js): what the registry found, next to what the operator declared.
+    const location = loc ? {
+      verdict: loc.verdict, server_country: loc.server?.country ?? null, network: loc.server?.network ?? null,
+      cdn: Boolean(loc.server?.cdn), latency: loc.latency?.verdict ?? 'unknown', checked_at: loc.checked_at,
+    } : null;
     for (const offering of card.offerings) {
       const obs = await store.getObservations(node.id, offering.offering_id);
       // Measured values override claims (DS-ADM-03/04): cap the advertised context to
@@ -86,6 +93,7 @@ async function buildOfferings(store) {
           country: card.node?.operator?.country ?? null,
           regions: card.node?.regions ?? [],
           basis: card.node?.operator?.country ? (node.source === 'import' ? 'inferred' : 'declared') : null,
+          location,
         },
         // Allocated hardware for THIS offering (offering-level override wins over the
         // node-level description) — same artifact on different vendors runs on different

package/src/server.js

@@ -20,6 +20,7 @@ import { mcpRoutes } from './mcp.js';
 import { hostControlsNamespace, isPrivateHost, makeRateLimiter } from './namespace.js';
 import { exportRoutes } from './export.js';
 import { collapseFlaps } from './feed.js';
+import { checkNodeLocation } from './location.js';
 import {
   importModelsDev, importHuggingFace, importOpenRouter,
   importOllamaLibrary, parseOllamaLibrary,
@@ -39,6 +40,7 @@ export async function startRegistry({
   registerPerHour = 0,                  // per-client cap on register/verify calls (0 = unlimited; set in production)
   admitCooldownMs = 0,                  // minimum gap between Stage B runs per node (0 = none; set in production)
   trustProxy = false,                   // read the client address from X-Forwarded-For (behind Caddy / a CDN)
+  location = null,                      // { selfSite, agents, intervalMs, fetchImpl, resolve, rtt } to check server locations
 } = {}) {
   const store = watchStoreWrites(await createStore(dbPath)); // sqlite path/:memory: or postgres:// URL; writes refresh the cached catalog
   const safeFetch = makeSafeFetch({ allowPrivate: allowPrivateTargets });
@@ -230,6 +232,7 @@ export async function startRegistry({
       await store.setState(params.id, stageA.ok ? 'community' : 'indexed',
         stageA.ok ? 'Stage A passed' : 'Stage A failures: ' + stageA.results.filter((r) => !r.ok).map((r) => r.kind).join(','));
       const claimed = stageA.ok ? await supersedeImports(params.id) : [];
+      if (location) locateNode(params.id).catch(() => {});   // background: never delays registration
       sendJson(res, 200, {
         node_id: params.id,
         state: (await store.getNode(params.id)).state,
@@ -342,6 +345,7 @@ export async function startRegistry({
         card: await store.latestCard(params.id),
         probes: (await store.probesFor(params.id)).slice(0, 20),
         history: await store.transitionsFor(params.id),
+        location: (await store.getObservations(params.id, '_node')).location ?? null,
       });
     }],
 
@@ -407,6 +411,14 @@ export async function startRegistry({
     // Delist (admin): operator opt-out of an imported listing, or retiring a node. Search,
     // the directory and Stage C skip delisted nodes, and re-imports never revive them.
     // Body {reason}. A registered node returns by registering again; relist re-opens imports.
+    // Server-location check on demand (admin): geolocation + network + RTT from the probe sites.
+    ['POST', '/v0/admin/nodes/:id/locate', async (req, res, { params }) => {
+      if (!adminOk(req, res)) return;
+      if (!location) return problem(res, 409, 'location-checks-disabled', 'start the registry with location checks enabled');
+      const node = await store.getNode(params.id);
+      if (!node) return problem(res, 404, 'unknown-node', params.id);
+      sendJson(res, 200, await locateNode(node.id));
+    }],
     ['POST', '/v0/admin/nodes/:id/delist', async (req, res, { params }) => {
       if (!adminOk(req, res)) return;
       const node = await store.getNode(params.id);
@@ -496,8 +508,37 @@ export async function startRegistry({
     ...exportRoutes(store, registryKeys),
   ], { cors: true }); // public read API: third-party web clients may call it directly
 
+  // ---- server-location checks (location.js) ----
+  const asHolders = new Map();
+  async function locateNode(nodeId) {
+    const card = await store.latestCard(nodeId);
+    const result = await checkNodeLocation(card, { ...location, asHolders });
+    await store.setObservation(nodeId, '_node', 'location', result);
+    return result;
+  }
+  // Daily sweep over registered nodes and imports that carry a country (the ones jurisdiction
+  // filters can select), one at a time so the lookup service is never hammered.
+  function startLocationSweep() {
+    let stopped = false, timer = null;
+    const sweep = async () => {
+      for (const node of await store.allNodes()) {
+        if (stopped) return;
+        if (['delisted', 'claimed', 'submitted', 'challenged'].includes(node.state)) continue;
+        const card = await store.latestCard(node.id);
+        if (!card?.endpoints?.openai) continue;
+        if (node.source === 'import' && !card.node?.operator?.country) continue;
+        await locateNode(node.id).catch(() => {});
+        await new Promise((r) => setTimeout(r, location.pauseMs ?? 2000));
+      }
+    };
+    const loop = async () => { if (stopped) return; await sweep().catch(() => {}); if (!stopped) timer = setTimeout(loop, location.intervalMs ?? 24 * 3600 * 1000); };
+    timer = setTimeout(loop, location.firstDelayMs ?? 60_000);
+    return { stop: () => { stopped = true; clearTimeout(timer); } };
+  }
+
   const stageCHandle = stageC ? startStageC(store, { safeFetch, fetchFor: authFetch, refreshCard, ...stageC }) : null;
   const reimportHandle = reimport ? startReimport(store, { safeFetch, ...reimport }) : null;
+  const locationHandle = location ? startLocationSweep() : null;
   const actualPort = await listen(app, port, host);
   return {
     port: actualPort,
@@ -507,6 +548,7 @@ export async function startRegistry({
     close: async () => {
       stageCHandle?.stop();
       reimportHandle?.stop();
+      locationHandle?.stop();
       await closeApp(app);
       await store.close();
     },

package/src/web/index.html

@@ -1779,6 +1779,25 @@ function claimBanner(n, card) {
   </div>`;
 }
 
+/** Server-location check (registry location.js) in plain words. */
+function locationRow(loc, imported) {
+  if (!loc) return '';
+  const srv = loc.server || {};
+  const claim = imported ? 'inferred for this unclaimed listing' : 'declared by the operator';
+  const words = {
+    match: `✓ server in ${esc(srv.country)}, matching the country ${imported ? 'inferred for this unclaimed listing' : 'the operator declared'}`,
+    same_region: `✓ server in ${esc(srv.country)} (EEA); country ${claim}: ${esc(loc.declared)}`,
+    mismatch: `<b style="color:var(--bad, #b42318)">⚠ server in ${esc(srv.country)}; country ${claim}: ${esc(loc.declared)}</b>`,
+    cdn: `behind a CDN (${esc(srv.network || 'anycast')}) — location not determinable from the network`,
+    inconsistent: `<b style="color:var(--bad, #b42318)">⚠ geolocation (${esc(srv.country || '?')}) contradicted by measured latency</b>`,
+    unknown: `not determined${loc.reason ? ' — ' + esc(loc.reason) : ''}`,
+  };
+  const lat = loc.latency || {};
+  const sites = (lat.sites || []).map((v) => `${esc(v.site)} ${v.rtt_ms} ms`).join(', ');
+  const latWord = { consistent: 'consistent', too_slow: 'slower than expected from every site (soft warning)', too_fast: 'faster than physics allows for the geolocated point', unknown: 'not measured' }[lat.verdict || 'unknown'];
+  return `<tr><td style="color:var(--muted)" class="mono">server</td><td style="font-size:0.8rem">${words[loc.verdict] || esc(loc.verdict)}${srv.asn ? ` · AS${srv.asn}${srv.network ? ' ' + esc(srv.network) : ''}` : ''}<br><span style="color:var(--muted)">latency ${latWord}${sites ? ' (' + sites + ')' : ''} · checked ${esc((loc.checked_at || '').slice(0, 10))} · evidence, not proof</span></td></tr>`;
+}
+
 async function loadNode(id) {
   $('#node-title').textContent = id;
   try {
@@ -1812,6 +1831,7 @@ async function loadNode(id) {
       <div class="panel pad" style="max-width:56rem; margin-top:0.6rem"><table class="grid">
         <tr><td style="color:var(--muted); width:8rem" class="mono">endpoint</td><td class="mono" style="font-size:0.74rem">${card.endpoints?.openai ? esc(card.endpoints.openai) : '— <span style="font-family:inherit; color:var(--muted)">listing only: no known API endpoint, not callable from OpenNodes</span>'}</td></tr>
         ${docsUrl(card.endpoints) ? `<tr><td style="color:var(--muted)" class="mono">docs</td><td class="mono" style="font-size:0.74rem"><a href="${esc(docsUrl(card.endpoints))}" target="_blank" rel="noopener">${esc(docsUrl(card.endpoints))}</a></td></tr>` : ''}
+        ${locationRow(n.location, n.source === 'import')}
         ${card.hardware ? `<tr><td style="color:var(--muted)" class="mono">hardware</td><td style="font-size:0.78rem">${hwStr({ hardware: card.hardware })}</td></tr>` : ''}
         <tr><td style="color:var(--muted)" class="mono">revision</td><td class="mono" style="font-size:0.74rem">${esc(card.revision ?? '—')}</td></tr>
       </table></div>