@opennodes/registry 0.1.9 → 0.1.11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opennodes/registry",
-  "version": "0.1.9",
+  "version": "0.1.11",
   "description": "OpenNodes (ONP) reference registry: node registration with proof-of-resource qualification (Stage A/B/C), transparent ranking, enforceable estimates, catalog importers (OpenRouter, Hugging Face, models.dev, Ollama), MCP surface, and the web app (catalog, chat, advisor, Node Builder)",
   "license": "Apache-2.0",
   "type": "module",

package/src/feed.js

@@ -0,0 +1,42 @@
+// Feed shaping: a node that keeps dropping offline and coming back would otherwise fill
+// the public feed with suspended/reinstated pairs. Consecutive liveness transitions of
+// one node collapse into a single availability event; everything else passes through.
+
+const isLiveness = (e) => /^(liveness:|reinstated:)/.test(e.reason ?? '');
+
+/** events: newest first. Returns newest first, with liveness runs (2+ events) collapsed. */
+export function collapseFlaps(events) {
+  const out = [];
+  const open = new Map();   // node_id -> collapsed entry still accepting older liveness events
+  for (const e of events) {
+    if (!isLiveness(e)) {
+      open.delete(e.node_id);
+      out.push(e);
+      continue;
+    }
+    const run = open.get(e.node_id);
+    if (run) {
+      run.events.push(e);
+      continue;
+    }
+    const entry = { ...e, events: [e] };
+    open.set(e.node_id, entry);
+    out.push(entry);
+  }
+  return out.map((entry) => {
+    if (!entry.events) return entry;
+    const { events: run, ...newest } = entry;
+    if (run.length === 1) return newest;
+    const oldest = run[run.length - 1];
+    const outages = run.filter((e) => e.to === 'suspended').length;
+    const now = newest.to === 'suspended' ? 'suspended now' : `${newest.to} again`;
+    return {
+      ...newest,
+      from: oldest.from,
+      kind: 'availability',
+      collapsed: run.length,
+      since: oldest.at,
+      reason: `availability: ${outages} outage${outages === 1 ? '' : 's'} since ${oldest.at.slice(0, 10)}, ${now}`,
+    };
+  });
+}

package/src/probes.js

@@ -16,7 +16,8 @@ export async function runStageA(store, nodeId, card, { safeFetch } = {}) {
   try {
     const t0 = performance.now();
     const { status, body } = await fetchJson(card.endpoints.health);
-    const ok = status === 200 && body?.status === 'ok';
+    // ONP health ({status:'ok'}), or an OpenAI /models listing for card-only operators.
+    const ok = status === 200 && (body?.status === 'ok' || Array.isArray(body?.data));
     await record(null, 'health', ok, ok ? null : `status ${status}`, { latency_ms: Math.round(performance.now() - t0) });
   } catch (err) {
     await record(null, 'health', false, String(err.message ?? err));

package/src/search.js

@@ -7,7 +7,7 @@ const TIER_SCORE = { unverified: 0, community: 0.4, verified: 0.8, attested: 1.0
 export async function collectOfferings(store) {
   const out = [];
   for (const node of await store.allNodes()) {
-    if (['delisted', 'suspended', 'submitted', 'challenged', 'disputed'].includes(node.state)) continue;
+    if (['delisted', 'suspended', 'submitted', 'challenged', 'disputed', 'claimed'].includes(node.state)) continue;
     const card = await store.latestCard(node.id);
     if (!card) continue;
     const probes = await store.probesFor(node.id);

package/src/server.js

@@ -19,6 +19,7 @@ import { searchOfferings, searchOfferingsPaged, collectOfferings, RANK_COMPONENT
 import { mcpRoutes } from './mcp.js';
 import { hostControlsNamespace, isPrivateHost, makeRateLimiter } from './namespace.js';
 import { exportRoutes } from './export.js';
+import { collapseFlaps } from './feed.js';
 import {
   importModelsDev, importHuggingFace, importOpenRouter,
   importOllamaLibrary, parseOllamaLibrary,
@@ -92,6 +93,40 @@ export async function startRegistry({
   const clientOf = (req) => (trustProxy && req.headers['x-forwarded-for']?.split(',')[0].trim()) || req.socket.remoteAddress || 'unknown';
   const isAdmin = (req) => Boolean(adminToken) && req.headers.authorization === `Bearer ${adminToken}`;
 
+  /**
+   * Fetch for probing one node: carries the operator's probe key (card-only listings of
+   * keyed APIs), and only toward the card's own endpoint origins — never to anything else.
+   */
+  async function authFetch(nodeId, card) {
+    const key = await store.getProbeKey(nodeId);
+    if (!key || !card?.endpoints) return safeFetch;
+    const origins = new Set([card.endpoints.openai, card.endpoints.health].filter(Boolean).map((u) => new URL(u).origin));
+    return (url, opts = {}, timeoutMs) => safeFetch(url,
+      origins.has(new URL(url).origin) ? { ...opts, headers: { ...(opts.headers ?? {}), authorization: `Bearer ${key}` } } : opts,
+      timeoutMs);
+  }
+
+  /**
+   * A registered node that reaches community or higher retires imported catalog listings of
+   * the same operator — imports whose API host lies inside the node's own namespace. Bound to
+   * the namespace so nobody can 'claim' a third party's listings (e.g. Hugging Face's router).
+   */
+  async function supersedeImports(nodeId) {
+    const domain = domainForNodeId(nodeId).toLowerCase();
+    const claimed = [];
+    for (const imp of await store.allNodes()) {
+      if (imp.source !== 'import' || ['claimed', 'delisted'].includes(imp.state)) continue;
+      const card = await store.latestCard(imp.id);
+      let host;
+      try { host = new URL(card?.endpoints?.openai).hostname.toLowerCase(); } catch { continue; }
+      if (host === domain || host.endsWith('.' + domain)) {
+        await store.setState(imp.id, 'claimed', `claimed by ${nodeId}`);
+        claimed.push(imp.id);
+      }
+    }
+    return claimed;
+  }
+
   async function challengeSatisfied(node, challenge) {
     try { // HTTP method — only from a host that controls the id's namespace
       if (namespaceOk(node.origin, node.id)) {
@@ -137,7 +172,8 @@ export async function startRegistry({
   const app = createApp([
     ['POST', '/v0/nodes', async (req, res) => {
       if (!registerLimiter(clientOf(req))) return problem(res, 429, 'rate-limited', 'too many registration attempts from this address; try again later');
-      const { card_url } = await readJson(req);
+      const { card_url, probe_key } = await readJson(req);
+      if (probe_key != null && (typeof probe_key !== 'string' || probe_key.length > 4096)) return problem(res, 400, 'bad-probe-key', 'probe_key must be a string');
       if (!card_url) return problem(res, 400, 'missing-card-url', 'body must be {"card_url": "..."}');
       let card;
       try { card = await fetchCard(card_url); } catch (err) { return problem(res, 422, 'card-unfetchable', String(err.message)); }
@@ -159,6 +195,9 @@ export async function startRegistry({
       if (!listed) await store.setState(nodeId, 'challenged', 'registration received');
       const token = randomUUID();
       await store.setChallenge(nodeId, token);
+      // Held as pending: it only becomes active when this namespace's challenge is satisfied, so a
+      // stranger re-submitting someone else's card cannot replace (or break) their probe key.
+      if (probe_key) await store.setPendingProbeKey(nodeId, probe_key);
       sendJson(res, 202, {
         node_id: nodeId,
         state: listed ? existing.state : 'challenged',
@@ -181,19 +220,22 @@ export async function startRegistry({
       if (!challenge) return problem(res, 410, 'challenge-expired', 'register again');
       const check = await challengeSatisfied(node, challenge);
       if (!check.ok) return problem(res, 403, 'challenge-failed', 'neither HTTP nor DNS TXT challenge satisfied');
+      await store.promoteProbeKey(params.id);
       let indexed;
       try { indexed = await indexCard(params.id, node.card_url); }
       catch (err) { return problem(res, 422, 'card-invalid', String(err.message)); }
 
       await store.setState(params.id, 'indexed', `namespace verified via ${check.method}`);
-      const stageA = await runStageA(store, params.id, indexed.card, { safeFetch });
+      const stageA = await runStageA(store, params.id, indexed.card, { safeFetch: await authFetch(params.id, indexed.card) });
       await store.setState(params.id, stageA.ok ? 'community' : 'indexed',
         stageA.ok ? 'Stage A passed' : 'Stage A failures: ' + stageA.results.filter((r) => !r.ok).map((r) => r.kind).join(','));
+      const claimed = stageA.ok ? await supersedeImports(params.id) : [];
       sendJson(res, 200, {
         node_id: params.id,
         state: (await store.getNode(params.id)).state,
         signature_verified: indexed.sigOk,
         stage_a: stageA,
+        claimed_imports: claimed,
       });
     }],
 
@@ -202,7 +244,7 @@ export async function startRegistry({
       if (!node) return problem(res, 404, 'unknown-node', params.id);
       try {
         const { card } = await indexCard(params.id, node.card_url);
-        const stageA = await runStageA(store, params.id, card, { safeFetch });
+        const stageA = await runStageA(store, params.id, card, { safeFetch: await authFetch(params.id, card) });
         sendJson(res, 200, { node_id: params.id, revision: card.revision, stage_a_ok: stageA.ok });
       } catch (err) {
         problem(res, 422, 'refresh-failed', String(err.message));
@@ -226,7 +268,7 @@ export async function startRegistry({
       }
       await refreshCard(params.id);
       const card = await store.latestCard(params.id);
-      const stageB = await runStageB(store, params.id, card, { safeFetch, capacity: stageBCapacity });
+      const stageB = await runStageB(store, params.id, card, { safeFetch: await authFetch(params.id, card), capacity: stageBCapacity });
       if (stageB.stale) {
         return problem(res, 409, 'stale-card', 'the node changed its card revision during the battery; retry');
       }
@@ -234,6 +276,7 @@ export async function startRegistry({
         await store.setState(params.id, 'disputed', 'Stage B identity fingerprint mismatch');
       } else if (stageB.ok) {
         await store.setState(params.id, 'verified', 'Stage B passed');
+        await supersedeImports(params.id);
       }
       sendJson(res, 200, { node_id: params.id, state: (await store.getNode(params.id)).state, stage_b: stageB });
     }],
@@ -246,7 +289,7 @@ export async function startRegistry({
       const card = await store.latestCard(node_id);
       const offering = card?.offerings.find((o) => o.offering_id === offering_id);
       if (!offering) return problem(res, 404, 'unknown-offering', `${node_id}/${offering_id}`);
-      const refs = await captureFingerprints(safeFetch, card, offering);
+      const refs = await captureFingerprints(await authFetch(node_id, card), card, offering);
       await store.addFingerprints(offering.model.artifact, refs);
       sendJson(res, 200, { artifact: offering.model.artifact, references: refs.length });
     }],
@@ -255,7 +298,7 @@ export async function startRegistry({
     ['GET', '/v0/nodes', async (req, res) => {
       const out = [];
       for (const node of await store.allNodes()) {
-        if (['delisted'].includes(node.state)) continue;
+        if (['delisted', 'claimed'].includes(node.state)) continue;
         const card = await store.latestCard(node.id);
         const availability = (await store.getObservations(node.id, '_node')).availability ?? null;
         out.push({
@@ -279,13 +322,16 @@ export async function startRegistry({
 
     // Freshness feed: recent listing events (registrations, tier changes, suspensions),
     // newest first, each linked to its provenance reason.
+    // Liveness flaps (suspended/reinstated runs) collapse into one availability event;
+    // ?raw=1 returns every transition.
     ['GET', '/v0/feed', async (req, res, { query }) => {
       const limit = Math.min(Number(query.get('limit') ?? 50), 200);
-      const events = (await store.recentTransitions(limit)).map((t) => ({
+      const raw = query.get('raw') === '1';
+      const events = (await store.recentTransitions(raw ? limit : Math.min(limit * 10, 2000))).map((t) => ({
         at: t.at, node_id: t.node_id, from: t.from_state, to: t.to_state,
         reason: t.reason, source: t.source ?? 'registration',
       }));
-      sendJson(res, 200, { events });
+      sendJson(res, 200, { events: raw ? events : collapseFlaps(events).slice(0, limit) });
     }],
 
     ['GET', '/v0/nodes/:id', async (req, res, { params }) => {
@@ -357,6 +403,27 @@ export async function startRegistry({
       sendJson(res, 200, recommend(all, features, body.policy ?? {}));
     }],
 
+    // Delist (admin): operator opt-out of an imported listing, or retiring a node. Search,
+    // the directory and Stage C skip delisted nodes, and re-imports never revive them.
+    // Body {reason}. A registered node returns by registering again; relist re-opens imports.
+    ['POST', '/v0/admin/nodes/:id/delist', async (req, res, { params }) => {
+      if (!adminOk(req, res)) return;
+      const node = await store.getNode(params.id);
+      if (!node) return problem(res, 404, 'unknown-node', params.id);
+      const { reason } = await readJson(req);
+      if (node.state !== 'delisted') await store.setState(node.id, 'delisted', `delisted: ${reason || 'by registry admin'}`);
+      sendJson(res, 200, { id: node.id, state: 'delisted' });
+    }],
+    ['POST', '/v0/admin/nodes/:id/relist', async (req, res, { params }) => {
+      if (!adminOk(req, res)) return;
+      const node = await store.getNode(params.id);
+      if (!node) return problem(res, 404, 'unknown-node', params.id);
+      if (node.state !== 'delisted') return problem(res, 409, 'not-delisted', `${node.id} is ${node.state}`);
+      if (node.source !== 'import') return problem(res, 409, 'register-again', 'a registered node returns by registering again (POST /v0/nodes)');
+      await store.setState(node.id, 'indexed', 'relisted by registry admin');
+      sendJson(res, 200, { id: node.id, state: 'indexed' });
+    }],
+
     // Seed importer (admin): body {catalog} in models.dev shape, or {url} to fetch it.
     ['POST', '/v0/import/models-dev', async (req, res) => {
       if (!adminOk(req, res)) return;
@@ -428,7 +495,7 @@ export async function startRegistry({
     ...exportRoutes(store, registryKeys),
   ], { cors: true }); // public read API: third-party web clients may call it directly
 
-  const stageCHandle = stageC ? startStageC(store, { safeFetch, refreshCard, ...stageC }) : null;
+  const stageCHandle = stageC ? startStageC(store, { safeFetch, fetchFor: authFetch, refreshCard, ...stageC }) : null;
   const reimportHandle = reimport ? startReimport(store, { safeFetch, ...reimport }) : null;
   const actualPort = await listen(app, port, host);
   return {

package/src/stagec.js

@@ -9,6 +9,7 @@ const OBSERVED_STATES = ['community', 'verified', 'attested'];
 
 export function startStageC(store, {
   safeFetch,
+  fetchFor = null,                // (nodeId, card) -> fetch that carries the node's probe key
   refreshCard = null,             // re-index a node's card when its revision moved (restart / reprice)
   livenessIntervalMs = 300_000,   // spec: <=5 min; tests shorten this
   blindIntervalMs = 3_600_000,
@@ -38,8 +39,9 @@ export function startStageC(store, {
       if (!card) continue;
       let ok = false;
       try {
-        const { status, body } = await fetchJsonCapped(safeFetch, card.endpoints.health, {}, 5_000);
-        ok = status === 200 && body?.status === 'ok';
+        const f = fetchFor ? await fetchFor(node.id, card) : safeFetch;
+        const { status, body } = await fetchJsonCapped(f, card.endpoints.health, {}, 5_000);
+        ok = status === 200 && (body?.status === 'ok' || Array.isArray(body?.data));
       } catch { ok = false; }
       await store.recordProbe(node.id, null, 'C', 'liveness', ok);
 
@@ -79,7 +81,8 @@ export function startStageC(store, {
       if (!chatOfferings.length) continue;
       const offering = chatOfferings[Math.floor(Math.random() * chatOfferings.length)];
       try {
-        const { status, body } = await fetchJsonCapped(safeFetch, `${card.endpoints.openai}/chat/completions`, {
+        const f = fetchFor ? await fetchFor(node.id, card) : safeFetch;
+        const { status, body } = await fetchJsonCapped(f, `${card.endpoints.openai}/chat/completions`, {
           method: 'POST',
           headers: {
             'content-type': 'application/json',

package/src/store-pg.js

@@ -17,6 +17,9 @@ const SCHEMA = `
   CREATE TABLE IF NOT EXISTS challenges (
     node_id TEXT PRIMARY KEY, token TEXT NOT NULL, expires_at TEXT NOT NULL
   );
+  CREATE TABLE IF NOT EXISTS probe_keys (
+    node_id TEXT PRIMARY KEY, secret TEXT, pending TEXT, updated_at TEXT NOT NULL
+  );
   CREATE TABLE IF NOT EXISTS probes (
     id SERIAL PRIMARY KEY, node_id TEXT NOT NULL, offering_id TEXT,
     stage TEXT NOT NULL, kind TEXT NOT NULL, ok INTEGER NOT NULL,
@@ -74,6 +77,16 @@ export async function createPgStore({ connectionString, pool } = {}) {
       const rows = await q('SELECT raw FROM card_revisions WHERE node_id = $1 ORDER BY revision DESC LIMIT 1', [nodeId]);
       return rows[0] ? JSON.parse(rows[0].raw) : null;
     },
+    async setPendingProbeKey(nodeId, key) {
+      await q(`INSERT INTO probe_keys (node_id, secret, pending, updated_at) VALUES ($1, NULL, $2, $3)
+        ON CONFLICT (node_id) DO UPDATE SET pending=excluded.pending, updated_at=excluded.updated_at`, [nodeId, key, now()]);
+    },
+    async promoteProbeKey(nodeId) {
+      await q('UPDATE probe_keys SET secret = pending, pending = NULL, updated_at = $1 WHERE node_id = $2 AND pending IS NOT NULL', [now(), nodeId]);
+    },
+    async getProbeKey(nodeId) {
+      return (await q('SELECT secret FROM probe_keys WHERE node_id = $1', [nodeId]))[0]?.secret ?? null;
+    },
     async setChallenge(nodeId, token, ttlMs = 72 * 3600 * 1000) {
       await q(`INSERT INTO challenges (node_id, token, expires_at) VALUES ($1, $2, $3)
         ON CONFLICT (node_id) DO UPDATE SET token=excluded.token, expires_at=excluded.expires_at`,

package/src/store.js

@@ -30,6 +30,11 @@ export async function createSqliteStore(path = ':memory:') {
     CREATE TABLE IF NOT EXISTS challenges (
       node_id TEXT PRIMARY KEY, token TEXT NOT NULL, expires_at TEXT NOT NULL
     );
+    -- Operator-provided probe credentials. A separate table so they can never leak through
+    -- SELECT * FROM nodes; the pending key is activated only after the namespace challenge passes.
+    CREATE TABLE IF NOT EXISTS probe_keys (
+      node_id TEXT PRIMARY KEY, secret TEXT, pending TEXT, updated_at TEXT NOT NULL
+    );
     CREATE TABLE IF NOT EXISTS probes (
       id INTEGER PRIMARY KEY AUTOINCREMENT, node_id TEXT NOT NULL, offering_id TEXT,
       stage TEXT NOT NULL, kind TEXT NOT NULL, ok INTEGER NOT NULL,
@@ -76,6 +81,16 @@ export async function createSqliteStore(path = ':memory:') {
       const row = db.prepare('SELECT raw FROM card_revisions WHERE node_id = ? ORDER BY revision DESC LIMIT 1').get(nodeId);
       return row ? JSON.parse(row.raw) : null;
     },
+    async setPendingProbeKey(nodeId, key) {
+      db.prepare(`INSERT INTO probe_keys (node_id, secret, pending, updated_at) VALUES (?, NULL, ?, ?)
+        ON CONFLICT(node_id) DO UPDATE SET pending=excluded.pending, updated_at=excluded.updated_at`).run(nodeId, key, now());
+    },
+    async promoteProbeKey(nodeId) {
+      db.prepare('UPDATE probe_keys SET secret = pending, pending = NULL, updated_at = ? WHERE node_id = ? AND pending IS NOT NULL').run(now(), nodeId);
+    },
+    async getProbeKey(nodeId) {
+      return db.prepare('SELECT secret FROM probe_keys WHERE node_id = ?').get(nodeId)?.secret ?? null;
+    },
     async setChallenge(nodeId, token, ttlMs = 72 * 3600 * 1000) {
       db.prepare('INSERT OR REPLACE INTO challenges (node_id, token, expires_at) VALUES (?, ?, ?)')
         .run(nodeId, token, new Date(Date.now() + ttlMs).toISOString());

package/src/web/index.html

@@ -317,7 +317,7 @@
 <!-- ================= NEW (feed) ================= -->
 <div id="view-feed" hidden>
   <h1>New</h1>
-  <p class="sub">Dated listing events, newest first — registrations, tier changes, suspensions — each with its provenance. Also available as <a id="feed-json" href="/v0/feed">JSON</a> for agents.</p>
+  <p class="sub">Dated listing events, newest first — registrations, tier changes, suspensions — each with its provenance. A node that keeps dropping offline and coming back shows as one availability line. Also available as <a id="feed-json" href="/v0/feed">JSON</a> for agents (<a href="/v0/feed?raw=1">every transition</a>).</p>
   <div class="panel pad" id="feed-list"></div>
 </div>
 
@@ -1729,7 +1729,7 @@ async function loadFeed() {
     $('#feed-list').innerHTML = events.length ? events.map((e) => `<div class="feeditem">
       <span class="prov">${esc((e.at || '').replace('T', ' ').slice(0, 16))}</span>
       <span><a href="#/node/${encodeURIComponent(e.node_id)}" class="mono" style="font-size:0.78rem">${esc(e.node_id)}</a>
-        → ${tierChip(e.to)} ${e.reason ? '<span style="color:var(--muted)">— ' + esc(e.reason) + '</span>' : ''}</span>
+        → ${tierChip(e.to)} ${e.reason ? '<span style="color:var(--muted)">— ' + esc(e.reason) + (e.collapsed ? ' (' + e.collapsed + ' events)' : '') + '</span>' : ''}</span>
     </div>`).join('') : '<p class="sub">No events yet.</p>';
   } catch (e) { $('#feed-list').innerHTML = '<p class="err">' + esc(e.message) + '</p>'; }
 }