n8n-nodes-nilai 0.1.1 → 0.1.3

package/dist/nodes/NilAi/NilAi.node.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.NilAi = void 0;
 exports.verifyNilaiSignature = verifyNilaiSignature;
+const n8n_workflow_1 = require("n8n-workflow");
 const crypto_1 = require("crypto");
 const attestation_1 = require("./attestation");
 const SPKI_SECP256K1_COMPRESSED_PREFIX = Buffer.from('3036301006072a8648ce3d020106052b8104000a032200', 'hex');
@@ -37,6 +38,7 @@ class NilAi {
             version: 1,
             subtitle: '={{$parameter["model"]}}',
             description: 'Private, verifiable AI inference inside a Trusted Execution Environment (TEE), powered by Nillion nilAI.',
+            usableAsTool: true,
             defaults: {
                 name: 'nilAI',
             },
@@ -50,14 +52,14 @@ class NilAi {
             ],
             properties: [
                 {
-                    displayName: 'Model',
+                    displayName: 'Model Name or ID',
                     name: 'model',
                     type: 'options',
                     typeOptions: {
                         loadOptionsMethod: 'getModels',
                     },
-                    default: 'google/gemma-4-26B-A4B-it',
-                    description: 'The model to run inside the nilAI TEE. Loaded live from your nilAI endpoint.',
+                    default: '',
+                    description: 'The model to run inside the nilAI TEE. Loaded live from your nilAI endpoint. Choose from the list, or specify an ID using an <a href="https://docs.n8n.io/code/expressions/">expression</a>.',
                 },
                 {
                     displayName: 'Instructions',
@@ -67,7 +69,7 @@ class NilAi {
                         rows: 2,
                     },
                     default: '',
-                    description: "What you want the model to do, e.g. 'Summarise this in 3 sentences and 3-5 key bullet points'.",
+                    description: 'What you want the model to do, e.g. \'Summarise this in 3 sentences and 3-5 key bullet points\'',
                     hint: 'Plain text — the task only. Keep your data out of here (put that in Input). Leave empty to send just the Input as-is.',
                 },
                 {
@@ -87,7 +89,7 @@ class NilAi {
                     name: 'simplify',
                     type: 'boolean',
                     default: true,
-                    description: "Whether to return a clean result instead of nilAI's full raw response object.",
+                    description: 'Whether to return a clean result instead of nilAI\'s full raw response object',
                     hint: 'On: tidy output — just the answer, the verification results and token usage. Off: the complete raw nilAI response (every field), handy for debugging.',
                 },
                 {
@@ -158,7 +160,7 @@ class NilAi {
                 let teeVerified = null;
                 if (doVerify) {
                     if (publicKeyB64 === undefined) {
-                        publicKeyB64 = (await this.helpers.httpRequest({
+                        publicKeyB64 = (await this.helpers.httpRequestWithAuthentication.call(this, 'nilAiApi', {
                             method: 'GET',
                             url: `${baseUrl}/v1/public_key`,
                             json: true,
@@ -200,7 +202,7 @@ class NilAi {
                     });
                     continue;
                 }
-                throw error;
+                throw new n8n_workflow_1.NodeOperationError(this.getNode(), error);
             }
         }
         return [returnData];

package/dist/nodes/NilAi/attestation.js

@@ -5,44 +5,12 @@ exports.verifyTcbExtensions = verifyTcbExtensions;
 exports.checkReportDataBinding = checkReportDataBinding;
 exports.verifyEnclaveAttestation = verifyEnclaveAttestation;
 const crypto_1 = require("crypto");
-const tls_1 = require("tls");
-const fs_1 = require("fs");
-const path_1 = require("path");
-const os_1 = require("os");
 const KDS_DOMAIN = 'kdsintf.amd.com';
 const KNOWN_MEASUREMENTS = {
     '0.3.0': '981bcaa62bcd63cb03c7b93a67d1a8c17ff63e45e6d16323a8784bacbfcb254313741bcf32d0bccc795d6ea0e6ac1481',
 };
 const certChainCache = {};
 const vcekCache = {};
-function certCacheDir() {
-    for (const base of [(0, path_1.join)((0, os_1.homedir)(), '.n8n'), (0, os_1.tmpdir)()]) {
-        try {
-            const dir = (0, path_1.join)(base, '.nilai-cert-cache');
-            (0, fs_1.mkdirSync)(dir, { recursive: true });
-            return dir;
-        }
-        catch {
-        }
-    }
-    return (0, os_1.tmpdir)();
-}
-function readCertCache(name) {
-    try {
-        const p = (0, path_1.join)(certCacheDir(), name);
-        return (0, fs_1.existsSync)(p) ? (0, fs_1.readFileSync)(p) : null;
-    }
-    catch {
-        return null;
-    }
-}
-function writeCertCache(name, data) {
-    try {
-        (0, fs_1.writeFileSync)((0, path_1.join)(certCacheDir(), name), data);
-    }
-    catch {
-    }
-}
 function detectProcessor(family, model) {
     if (family === 0x19) {
         if (model <= 0x0f)
@@ -125,40 +93,6 @@ function parseCertChain(pem) {
         return null;
     }
 }
-async function getServerCertDer(host) {
-    return new Promise((resolve) => {
-        let settled = false;
-        let socket;
-        const finish = (v) => {
-            if (settled)
-                return;
-            settled = true;
-            clearTimeout(timer);
-            try {
-                socket?.destroy();
-            }
-            catch {
-            }
-            resolve(v);
-        };
-        const timer = setTimeout(() => finish(null), 7000);
-        try {
-            socket = (0, tls_1.connect)({ host, port: 443, servername: host, rejectUnauthorized: true }, () => {
-                try {
-                    const peer = socket.getPeerCertificate();
-                    finish(peer && peer.raw ? peer.raw : null);
-                }
-                catch {
-                    finish(null);
-                }
-            });
-            socket.on('error', () => finish(null));
-        }
-        catch {
-            finish(null);
-        }
-    });
-}
 function checkReportDataBinding(reportDataHex, certDer) {
     try {
         const spki = new crypto_1.X509Certificate(certDer).publicKey.export({ type: 'spki', format: 'der' });
@@ -177,7 +111,8 @@ async function verifyEnclaveAttestation(ctx, baseUrl) {
         const reportResp = (await ctx.helpers.httpRequest({
             method: 'GET',
             url: `${baseUrl}/nilcc/api/v2/report`,
-            json: true, timeout: 15000,
+            json: true,
+            timeout: 15000,
         }));
         const report = reportResp.report;
         const raw = Buffer.from(reportResp.raw_report, 'hex');
@@ -203,50 +138,28 @@ async function verifyEnclaveAttestation(ctx, baseUrl) {
         }
         const pad2 = (n) => String(n).padStart(2, '0');
         if (!certChainCache[processor]) {
-            const chainCacheName = `certchain_${processor}.pem`;
-            const cachedChain = readCertCache(chainCacheName);
-            let chain = cachedChain ? parseCertChain(cachedChain.toString('utf8')) : null;
-            if (!chain) {
-                const chainPem = (await ctx.helpers.httpRequest({
-                    method: 'GET',
-                    url: `https://${KDS_DOMAIN}/vcek/v1/${processor}/cert_chain`,
-                    encoding: 'text',
-                    timeout: 15000,
-                }));
-                chain = parseCertChain(chainPem);
-                if (!chain)
-                    throw new Error('AMD KDS returned an unparseable certificate chain');
-                writeCertCache(chainCacheName, Buffer.from(chainPem, 'utf8'));
-            }
+            const chainPem = (await ctx.helpers.httpRequest({
+                method: 'GET',
+                url: `https://${KDS_DOMAIN}/vcek/v1/${processor}/cert_chain`,
+                encoding: 'text',
+                timeout: 15000,
+            }));
+            const chain = parseCertChain(chainPem);
+            if (!chain)
+                throw new Error('AMD KDS returned an unparseable certificate chain');
             certChainCache[processor] = chain;
         }
         const { ark, ask } = certChainCache[processor];
         const vcekUrl = `https://${KDS_DOMAIN}/vcek/v1/${processor}/${chipIdHex}` +
             `?blSPL=${pad2(tcb.bootloader)}&teeSPL=${pad2(tcb.tee)}&snpSPL=${pad2(tcb.snp)}&ucodeSPL=${pad2(tcb.microcode)}`;
         if (!vcekCache[vcekUrl]) {
-            const vcekCacheName = `vcek_${chipIdHex}_${tcb.bootloader}_${tcb.tee}_${tcb.snp}_${tcb.microcode}.der`;
-            const cachedDer = readCertCache(vcekCacheName);
-            let vcekCert = null;
-            if (cachedDer) {
-                try {
-                    vcekCert = new crypto_1.X509Certificate(cachedDer);
-                }
-                catch {
-                    vcekCert = null;
-                }
-            }
-            if (!vcekCert) {
-                const fetched = (await ctx.helpers.httpRequest({
-                    method: 'GET',
-                    url: vcekUrl,
-                    encoding: 'arraybuffer',
-                    timeout: 15000,
-                }));
-                const der = Buffer.from(fetched);
-                vcekCert = new crypto_1.X509Certificate(der);
-                writeCertCache(vcekCacheName, der);
-            }
-            vcekCache[vcekUrl] = vcekCert;
+            const fetched = (await ctx.helpers.httpRequest({
+                method: 'GET',
+                url: vcekUrl,
+                encoding: 'arraybuffer',
+                timeout: 15000,
+            }));
+            vcekCache[vcekUrl] = new crypto_1.X509Certificate(Buffer.from(fetched));
         }
         const vcek = vcekCache[vcekUrl];
         const arkSelfSigned = ark.verify(ark.publicKey);
@@ -269,23 +182,12 @@ async function verifyEnclaveAttestation(ctx, baseUrl) {
         const measurementMatches = known ? measurement === known : null;
         const reportData = raw.subarray(0x50, 0x50 + 64).toString('hex');
         const tcbOk = verifyTcbExtensions(vcek.raw, tcb, chipIdHex);
-        const host = (() => {
-            try {
-                return new URL(baseUrl).hostname;
-            }
-            catch {
-                return '';
-            }
-        })();
-        const serverCertDer = host ? await getServerCertDer(host) : null;
-        const tlsBound = serverCertDer ? checkReportDataBinding(reportData, serverCertDer) : false;
         const checks = {
             ark_self_signed: arkSelfSigned,
             ask_signed_by_ark: askByArk,
             vcek_signed_by_ask: vcekByAsk,
             report_signature_valid: sigValid,
             vcek_tcb_matches_report: tcbOk,
-            tls_session_bound: tlsBound,
             debug_disabled: !debugAllowed,
         };
         const attestation_verified = Object.values(checks).every(Boolean) && measurementMatches !== false;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "n8n-nodes-nilai",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "Use Nillion nilAI — private LLM inference in a TEE, OpenAI-compatible — directly in n8n, with built-in cryptographic verification of every response.",
   "keywords": [
     "n8n-community-node-package",