whisper-id 0.1.0 → 0.2.0

package/README.md

@@ -25,7 +25,21 @@ await withEgress(async (e) => {
 | `egress({ agent, tier, setEnv })` | Bring up egress bound to your `/128`. → `Egress { port, proxyUrl, socksUrl, proxies, close() }`. `tier: "wireguard"` for a routed `/128`. Sets proxy env unless `setEnv:false`; call `close()` to restore. |
 | `withEgress([opts], fn)` | Run `fn(egress)` with egress up, restoring the environment afterwards. |
 | `verify(address)` | Keyless — is `address` a real Whisper agent? (DANE + DNSSEC + reverse-DNS + JWS) → `boolean` |
-| `ip()` | Your current egress IP, proving it's your `/128`. → `string` |
+| `verifyDetails(address)` | Keyless — the full verdict (`is_whisper_agent`, `fqdn`, `operator`, `dane_ok`, `jws_ok`, …) or `null` |
+| `rdap(address)` | Keyless — the public RDAP record for a `/128`, or `null` |
+| `egressIp()` | Keyless — the IP this process leaves from (a `/128` when routed, else the platform's) → `string` |
+| `ip()` | Your current egress IP via the CLI, proving it's your `/128`. → `string` |
+
+### Keyless / serverless (no CLI)
+
+`verify`, `verifyDetails`, `rdap`, and `egressIp` are **keyless** — pure HTTPS via `fetch`, **no `whisper` CLI and no key** — so they run in Cloudflare Workers, Vercel, Deno, Lambda, etc.:
+
+```js
+import { verify, rdap } from "whisper-id";
+if (await verify(addr)) console.log((await rdap(addr)).name);
+```
+
+`register`, `egress`, `withEgress`, and `ip` need the CLI on the host (egress needs the local proxy; register needs your key).
 
 ### Using it with `fetch`
 

package/index.d.ts

@@ -26,6 +26,27 @@ export function register(name: string, opts?: RegisterOptions): Promise<Agent>;
 export function egress(opts?: EgressOptions): Promise<Egress>;
 export function withEgress<T>(fn: (e: Egress) => Promise<T> | T): Promise<T>;
 export function withEgress<T>(opts: EgressOptions, fn: (e: Egress) => Promise<T> | T): Promise<T>;
+/** Full server-side verify verdict (keyless). */
+export interface VerifyVerdict {
+  is_whisper_agent: boolean;
+  fqdn?: string;
+  operator?: string;
+  tenant?: string;
+  dane_ok?: boolean;
+  jws_ok?: boolean;
+  verified_at?: number;
+  evidence?: unknown;
+  [k: string]: unknown;
+}
+
+/** Keyless, CLI-free: is `address` a real Whisper agent? (server-side DANE+DNSSEC+reverse-DNS+JWS) */
 export function verify(address: string, opts?: { timeout?: number }): Promise<boolean>;
+/** Keyless, CLI-free: the full verify verdict, or null if not an agent. */
+export function verifyDetails(address: string, opts?: { timeout?: number }): Promise<VerifyVerdict | null>;
+/** Keyless, CLI-free: the public RDAP record for a /128, or null. */
+export function rdap(address: string, opts?: { timeout?: number }): Promise<Record<string, unknown> | null>;
+/** Keyless, CLI-free: the caller's current egress IP (what this process leaves from). */
+export function egressIp(opts?: { timeout?: number }): Promise<string>;
+/** Your current egress IP via the CLI (proves your /128). */
 export function ip(opts?: { timeout?: number }): Promise<string>;
 export function firstAddr(obj: unknown): string | null;

package/index.js

@@ -127,11 +127,63 @@ export async function withEgress(optsOrFn, maybeFn) {
   }
 }
 
-/** Return true iff `address` is a real Whisper agent (DANE+DNSSEC+reverse-DNS+JWS). Keyless. */
+// Keyless public endpoint base (the same surface the CLI uses, server-side). No key, no `whisper`
+// CLI — these work in any runtime that can fetch() (serverless, edge, browser). Override via env.
+function rdapBase() {
+  return (process.env.WHISPER_RDAP_URL || "https://rdap.whisper.online").replace(/\/+$/, "");
+}
+
+async function httpGetJson(url, { timeout = 60000 } = {}) {
+  const ctrl = new AbortController();
+  const t = setTimeout(() => ctrl.abort(), timeout);
+  let res;
+  try {
+    res = await fetch(url, { headers: { Accept: "application/rdap+json, application/json, */*", "User-Agent": "whisper-id-node/0.2.0" }, signal: ctrl.signal });
+  } catch (err) {
+    throw new WhisperError(`could not reach ${url}: ${err && err.message ? err.message : err}`);
+  } finally {
+    clearTimeout(t);
+  }
+  let body = null;
+  try {
+    body = await res.json();
+  } catch {
+    body = null;
+  }
+  return { status: res.status, body };
+}
+
+/**
+ * Return true iff `address` is a real Whisper agent. **Keyless and CLI-free** — one HTTPS GET to
+ * the public /verify-identity endpoint (server-side DANE+DNSSEC+reverse-DNS+JWS chain). Works in
+ * any runtime. 200 ⇒ agent, 404 ⇒ not. Throws only if the endpoint is unreachable.
+ */
 export async function verify(address, { timeout = 60000 } = {}) {
+  return (await verifyDetails(address, { timeout })) !== null;
+}
+
+/** Full verify verdict for a real agent (is_whisper_agent, fqdn, operator, tenant, dane_ok, jws_ok, …), else null. Keyless, CLI-free. */
+export async function verifyDetails(address, { timeout = 60000 } = {}) {
   if (!address || !address.trim()) throw new WhisperError("verify() needs an address");
-  const { code } = await run(["verify", address], { timeout, check: false });
-  return code === 0;
+  const url = `${rdapBase()}/verify-identity?ip=${encodeURIComponent(address.trim())}`;
+  const { status, body } = await httpGetJson(url, { timeout });
+  if (status !== 200 || !body || !body.is_whisper_agent) return null;
+  return body;
+}
+
+/** Public RDAP record for a Whisper /128 (handle, name, status, entities, …), or null. Keyless, CLI-free. */
+export async function rdap(address, { timeout = 60000 } = {}) {
+  if (!address || !address.trim()) throw new WhisperError("rdap() needs an address");
+  const url = `${rdapBase()}/ip/${encodeURI(address.trim())}`; // path segment — keep the literal colons
+  const { status, body } = await httpGetJson(url, { timeout });
+  return status === 200 ? body : null;
+}
+
+/** The caller's current egress IP as seen by Whisper (what this process leaves from). Keyless, CLI-free. */
+export async function egressIp({ timeout = 60000 } = {}) {
+  const { status, body } = await httpGetJson(`${rdapBase()}/egress-ip`, { timeout });
+  if (status !== 200) throw new WhisperError(`egress-ip endpoint returned HTTP ${status}`);
+  return (body && body.ip) || "";
 }
 
 /** Return the current egress IP, proving it is your Whisper /128. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "whisper-id",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "A routable Whisper IPv6 identity and safe egress for any Node agent.",
   "type": "module",
   "exports": { ".": { "types": "./index.d.ts", "import": "./index.js" } },