@blockrun/clawrouter 0.12.270 → 0.12.272

package/dist/index.js

@@ -40581,6 +40581,18 @@ function isBalanceError(error) {
 function isRpcError(error) {
   return error instanceof Error && error.code === "RPC_ERROR";
 }
+function describeFetchError(error) {
+  const message = error instanceof Error ? error.message : String(error);
+  const cause = error?.cause;
+  if (!(cause instanceof Error)) return message;
+  const detail = cause;
+  const host = detail.hostname || detail.address;
+  const where = host && detail.port ? `${host}:${detail.port}` : host;
+  const parts = [detail.code, where, detail.code ? void 0 : detail.message].filter(
+    (part) => typeof part === "string" && part !== ""
+  );
+  return parts.length > 0 ? `${message} (${parts.join(" ")})` : message;
+}
 var InsufficientFundsError2, EmptyWalletError, RpcError2;
 var init_errors5 = __esm({
   "src/errors.ts"() {
@@ -55852,7 +55864,7 @@ var require_websocket = __commonJS({
     var net3 = __require("net");
     var tls2 = __require("tls");
     var { randomBytes: randomBytes9, createHash: createHash4 } = __require("crypto");
-    var { Duplex, Readable: Readable2 } = __require("stream");
+    var { Duplex, Readable: Readable3 } = __require("stream");
     var { URL: URL3 } = __require("url");
     var PerMessageDeflate2 = require_permessage_deflate();
     var Receiver2 = require_receiver();
@@ -59914,16 +59926,20 @@ function maskApiKey(key2) {
 async function readOptional2(path5) {
   try {
     return (await readTextFile(path5)).trim() || void 0;
-  } catch {
-    return void 0;
+  } catch (error) {
+    if (error.code === "ENOENT") return void 0;
+    throw new Error(
+      `Cannot read BlockRun API key file ${path5}; refusing to fall back to another account or wallet.`,
+      { cause: error }
+    );
   }
 }
 async function resolveApiKey() {
   const envKey = process["env"].BLOCKRUN_API_KEY?.trim();
   if (envKey) {
     if (isValidApiKey(envKey)) return { key: envKey, source: "env" };
-    console.warn(
-      `[ClawRouter] \u26A0 BLOCKRUN_API_KEY is set but does not look like a BlockRun key (expected brk_\u2026) \u2014 ignoring.`
+    throw new Error(
+      `BLOCKRUN_API_KEY is malformed (expected brk_\u2026). Mint one at ${PORTAL_KEYS_URL}, or unset it to pay from the wallet. Refusing to fall back silently.`
     );
   }
   for (const [path5, source] of [
@@ -59933,22 +59949,101 @@ async function resolveApiKey() {
     const stored = await readOptional2(path5);
     if (stored === void 0) continue;
     if (isValidApiKey(stored)) return { key: stored, source };
-    console.warn(
-      `[ClawRouter] \u26A0 ${path5} does not contain a BlockRun key (expected brk_\u2026) \u2014 ignoring.`
+    throw new Error(
+      `${path5} does not contain a BlockRun key (expected brk_\u2026). Run "clawrouter login" with a valid key, or "clawrouter logout" to return to wallet billing. Refusing to fall back silently: the next source could bill a different account or spend from a wallet.`
     );
   }
   return void 0;
 }
-function createApiKeyFetch(apiKey, baseFetch = fetch) {
+async function fetchCreditBalance(apiKey, timeoutMs = 5e3) {
+  try {
+    const controller = new AbortController();
+    const timer2 = setTimeout(() => controller.abort(), timeoutMs);
+    const res = await fetch(`${BLOCKRUN_API_KEY_API}/v1/credits`, {
+      headers: { authorization: `Bearer ${apiKey}` },
+      signal: controller.signal
+    });
+    clearTimeout(timer2);
+    if (!res.ok) return void 0;
+    const b = await res.json();
+    const num2 = (v) => typeof v === "number" ? v : null;
+    return {
+      accountId: typeof b.account_id === "string" ? b.account_id : void 0,
+      billingMode: typeof b.billing_mode === "string" ? b.billing_mode : void 0,
+      currency: typeof b.currency === "string" ? b.currency : "USD",
+      grantedUsd: num2(b.granted_usd),
+      spentUsd: num2(b.spent_usd),
+      remainingUsd: num2(b.remaining_usd),
+      blocked: b.blocked === true,
+      blockedReason: typeof b.blocked_reason === "string" ? b.blocked_reason : void 0
+    };
+  } catch {
+    return void 0;
+  }
+}
+function formatCreditBalance(b) {
+  const money = (v) => v === null ? void 0 : `$${v.toFixed(v < 0.01 && v > 0 ? 6 : 2)}`;
+  const remaining = money(b.remainingUsd);
+  const spent = money(b.spentUsd);
+  if (remaining) return `${remaining} remaining${spent ? ` (spent ${spent})` : ""}`;
+  const mode = b.billingMode === "ungated" ? "no prepaid limit" : b.billingMode ?? "unknown";
+  return `${spent ? `spent ${spent}` : "unknown"} \u2014 ${mode}`;
+}
+function normalizeApiKeyBase(raw) {
+  const base4 = raw.replace(/\/+$/, "").replace(/\/v1$/, "");
+  const url2 = new URL(base4);
+  if (url2.username || url2.password || url2.search || url2.hash || url2.protocol !== "https:" && !(url2.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(url2.hostname))) {
+    throw new Error(
+      "BlockRun account API URL requires HTTPS (except localhost) and no credentials, query or fragment."
+    );
+  }
+  return base4;
+}
+function createApiKeyFetch(apiKey, baseFetch = fetch, apiBase = BLOCKRUN_API_KEY_API) {
+  const base4 = new URL(normalizeApiKeyBase(apiBase));
   return async (input, init2) => {
-    const headers = new Headers(init2?.headers);
+    const request2 = input instanceof Request ? input : void 0;
+    const url2 = new URL(request2?.url ?? String(input), `${base4}/`);
+    if (url2.origin !== base4.origin || url2.username || url2.password) {
+      throw new Error("Refusing to forward a BlockRun account key to another origin.");
+    }
+    if (base4.pathname === "/" && url2.pathname.startsWith("/api/v1/")) {
+      url2.pathname = url2.pathname.slice(4);
+    }
+    const headers = new Headers(init2?.headers ?? request2?.headers);
+    for (const name of [...headers.keys()]) {
+      if (/payment/i.test(name) || name.toLowerCase() === "x-api-key") headers.delete(name);
+    }
     headers.set("authorization", `Bearer ${apiKey}`);
-    headers.delete("x-payment");
-    headers.delete("x-api-key");
-    const response = await baseFetch(input, { ...init2, headers });
+    const response = await baseFetch(request2 ? new Request(url2, request2) : url2.href, {
+      ...init2,
+      headers,
+      redirect: "error"
+    });
     return response.ok ? response : explainApiKeyFailure(response);
   };
 }
+async function pollApiKeyJob(response, payFetch, apiBase, signal, intervalMs = 2e3) {
+  if (response.status !== 202) return response;
+  const initial = await response.clone().json();
+  if (!initial.poll_url) throw new Error("Async account response missing poll_url");
+  const pollUrl = new URL(initial.poll_url, `${normalizeApiKeyBase(apiBase)}/`).href;
+  const abort = AbortSignal.any([signal, AbortSignal.timeout(15 * 6e4)]);
+  while (!abort.aborted) {
+    const polled = await payFetch(pollUrl, { signal: abort });
+    if ([502, 503, 504, 522, 524].includes(polled.status)) {
+      await polled.body?.cancel();
+    } else {
+      if (!polled.ok) return polled;
+      const data = await polled.clone().json();
+      if (data.status === "completed") return polled;
+      if (data.status === "failed") return polled;
+      await polled.body?.cancel();
+    }
+    await new Promise((resolve) => setTimeout(resolve, intervalMs));
+  }
+  throw new Error("Async account job did not complete before the client aborted or timed out.");
+}
 async function explainApiKeyFailure(response) {
   const hint = HINTS[response.status];
   if (!hint) return response;
@@ -59982,7 +60077,7 @@ var init_api_key = __esm({
     PORTAL_URL = "https://user.blockrun.ai";
     PORTAL_KEYS_URL = `${PORTAL_URL}/dashboard/keys`;
     PORTAL_CREDITS_URL = `${PORTAL_URL}/dashboard/credits`;
-    BLOCKRUN_API_KEY_API = process["env"].BLOCKRUN_API_BASE_URL?.replace(/\/+$/, "") || "https://api.blockrun.ai";
+    BLOCKRUN_API_KEY_API = process["env"].BLOCKRUN_API_BASE_URL?.replace(/\/+$/, "").replace(/\/v1$/, "") || "https://api.blockrun.ai";
     HINTS = {
       401: `Check BLOCKRUN_API_KEY, or mint a new key at ${PORTAL_KEYS_URL}.`,
       402: `Top up your BlockRun credit at ${PORTAL_CREDITS_URL}.`,
@@ -69128,7 +69223,7 @@ var require_client_h2 = __commonJS({
   "node_modules/undici/lib/dispatcher/client-h2.js"(exports, module) {
     "use strict";
     var assert10 = __require("assert");
-    var { pipeline } = __require("stream");
+    var { pipeline: pipeline2 } = __require("stream");
     var util5 = require_util();
     var {
       RequestContentLengthMismatchError,
@@ -70275,7 +70370,7 @@ var require_client_h2 = __commonJS({
     }
     function writeStream(abort, socket, expectsPayload, h2stream, body, client, request2, contentLength) {
       assert10(contentLength !== 0 || client[kRunning] === 0, "stream body cannot be pipelined");
-      const pipe2 = pipeline(
+      const pipe2 = pipeline2(
         body,
         h2stream,
         (err) => {
@@ -73430,7 +73525,7 @@ var require_readable = __commonJS({
     "use strict";
     var assert10 = __require("assert");
     var { addAbortListener } = __require("events");
-    var { Readable: Readable2 } = __require("stream");
+    var { Readable: Readable3 } = __require("stream");
     var { RequestAbortedError, NotSupportedError, InvalidArgumentError, AbortError } = require_errors();
     var util5 = require_util();
     var { ReadableStreamFrom } = require_util();
@@ -73444,7 +73539,7 @@ var require_readable = __commonJS({
     var kBytesRead = /* @__PURE__ */ Symbol("kBytesRead");
     var noop2 = () => {
     };
-    var BodyReadable = class extends Readable2 {
+    var BodyReadable = class extends Readable3 {
       /**
        * @param {object} opts
        * @param {(this: Readable, size: number) => void} opts.resume
@@ -73843,7 +73938,7 @@ var require_api_request = __commonJS({
     "use strict";
     var assert10 = __require("assert");
     var { AsyncResource } = __require("async_hooks");
-    var { Readable: Readable2 } = require_readable();
+    var { Readable: Readable3 } = require_readable();
     var { InvalidArgumentError, RequestAbortedError } = require_errors();
     var util5 = require_util();
     function noop2() {
@@ -73929,7 +74024,7 @@ var require_api_request = __commonJS({
         const parsedHeaders = headers;
         const contentType = parsedHeaders?.["content-type"];
         const contentLength = parsedHeaders?.["content-length"];
-        const res = new Readable2({
+        const res = new Readable3({
           resume: () => controller.resume(),
           abort: (reason) => controller.abort(reason),
           contentType,
@@ -74305,7 +74400,7 @@ var require_api_pipeline = __commonJS({
   "node_modules/undici/lib/api/api-pipeline.js"(exports, module) {
     "use strict";
     var {
-      Readable: Readable2,
+      Readable: Readable3,
       Duplex,
       PassThrough
     } = __require("stream");
@@ -74322,7 +74417,7 @@ var require_api_pipeline = __commonJS({
     function noop2() {
     }
     var kResume = /* @__PURE__ */ Symbol("resume");
-    var PipelineRequest = class extends Readable2 {
+    var PipelineRequest = class extends Readable3 {
       constructor() {
         super({ autoDestroy: true });
         this[kResume] = null;
@@ -74340,7 +74435,7 @@ var require_api_pipeline = __commonJS({
         callback(err);
       }
     };
-    var PipelineResponse = class extends Readable2 {
+    var PipelineResponse = class extends Readable3 {
       constructor(resume2) {
         super({ autoDestroy: true });
         this[kResume] = resume2;
@@ -74494,7 +74589,7 @@ var require_api_pipeline = __commonJS({
         util5.destroy(ret, err);
       }
     };
-    function pipeline(opts, handler) {
+    function pipeline2(opts, handler) {
       try {
         const pipelineHandler = new PipelineHandler(opts, handler);
         this.dispatch({ ...opts, body: pipelineHandler.req }, pipelineHandler);
@@ -74503,7 +74598,7 @@ var require_api_pipeline = __commonJS({
         return new PassThrough().destroy(err);
       }
     }
-    module.exports = pipeline;
+    module.exports = pipeline2;
   }
 });
 
@@ -79621,7 +79716,7 @@ var require_cache2 = __commonJS({
   "node_modules/undici/lib/interceptor/cache.js"(exports, module) {
     "use strict";
     var assert10 = __require("assert");
-    var { Readable: Readable2 } = __require("stream");
+    var { Readable: Readable3 } = __require("stream");
     var util5 = require_util();
     var CacheHandler = require_cache_handler();
     var MemoryCacheStore = require_memory_cache_store();
@@ -79797,7 +79892,7 @@ var require_cache2 = __commonJS({
       return dispatch(opts, new CacheHandler(globalOpts, cacheKey2, handler));
     }
     function sendCachedValue(handler, opts, result, age, context, isStale2) {
-      const stream4 = util5.isStream(result.body) ? result.body : Readable2.from(result.body ?? []);
+      const stream4 = util5.isStream(result.body) ? result.body : Readable3.from(result.body ?? []);
       assert10(!stream4.destroyed, "stream should not be destroyed");
       assert10(!stream4.readableDidRead, "stream should not be readableDidRead");
       const controller = {
@@ -80042,7 +80137,7 @@ var require_decompress = __commonJS({
   "node_modules/undici/lib/interceptor/decompress.js"(exports, module) {
     "use strict";
     var { createInflate, createGunzip, createBrotliDecompress, createZstdDecompress } = __require("zlib");
-    var { pipeline } = __require("stream");
+    var { pipeline: pipeline2 } = __require("stream");
     var DecoratorHandler = require_decorator_handler();
     var supportedEncodings = {
       gzip: createGunzip,
@@ -80152,7 +80247,7 @@ var require_decompress = __commonJS({
       #setupMultipleDecompressors(controller) {
         const lastDecompressor = this.#decompressors[this.#decompressors.length - 1];
         this.#setupDecompressorEvents(lastDecompressor, controller);
-        pipeline(this.#decompressors, (err) => {
+        pipeline2(this.#decompressors, (err) => {
           if (err) {
             super.onResponseError(controller, err);
             return;
@@ -82946,7 +83041,7 @@ var require_fetch = __commonJS({
       subresourceSet
     } = require_constants4();
     var EE = __require("events");
-    var { Readable: Readable2, pipeline, finished: finished2, isErrored, isReadable } = __require("stream");
+    var { Readable: Readable3, pipeline: pipeline2, finished: finished2, isErrored, isReadable } = __require("stream");
     var { addAbortListener, bufferToLowerCasedHeaderName } = require_util();
     var { dataURLProcessor, serializeAMimeType, minimizeSupportedMimeType } = require_data_url();
     var { getGlobalDispatcher } = require_global2();
@@ -83922,7 +84017,7 @@ var require_fetch = __commonJS({
                 const headersList = new HeadersList();
                 appendHeadersListFromResponseHeaders(headersList, headers, rawHeaders);
                 const location = headersList.get("location", true);
-                this.body = new Readable2({ read: () => controller.resume() });
+                this.body = new Readable3({ read: () => controller.resume() });
                 const willFollow = location && request2.redirect === "follow" && redirectStatusSet.has(status);
                 const decoders = [];
                 if (request2.method !== "HEAD" && request2.method !== "CONNECT" && !nullBodyStatus.includes(status) && !willFollow) {
@@ -83970,7 +84065,7 @@ var require_fetch = __commonJS({
                   status,
                   statusText,
                   headersList,
-                  body: decoders.length ? pipeline(this.body, ...decoders, (err) => {
+                  body: decoders.length ? pipeline2(this.body, ...decoders, (err) => {
                     if (err) {
                       this.onResponseError(controller, err);
                     }
@@ -87782,7 +87877,7 @@ ${value}`;
 var require_eventsource = __commonJS({
   "node_modules/undici/lib/web/eventsource/eventsource.js"(exports, module) {
     "use strict";
-    var { pipeline } = __require("stream");
+    var { pipeline: pipeline2 } = __require("stream");
     var { fetching } = require_fetch();
     var { webidl } = require_webidl();
     var { EventSourceStream } = require_eventsource_stream();
@@ -87932,7 +88027,7 @@ var require_eventsource = __commonJS({
               ));
             }
           });
-          pipeline(
+          pipeline2(
             response.body.stream,
             eventSourceStream,
             (error) => {
@@ -90460,11 +90555,30 @@ var init_client3 = __esm({
   }
 });
 
+// node_modules/@x402/svm/dist/esm/v1/index.mjs
+var v1_exports = {};
+__export(v1_exports, {
+  ExactSvmSchemeV1: () => ExactSvmSchemeV1,
+  NETWORKS: () => NETWORKS2
+});
+var init_v1 = __esm({
+  "node_modules/@x402/svm/dist/esm/v1/index.mjs"() {
+    "use strict";
+    init_chunk_WWACQNRQ();
+    init_chunk_MNNIECS4();
+    init_chunk_WIPN332D();
+    init_chunk_FVTMOTG6();
+    init_chunk_FJ6REVHH();
+    init_chunk_QEBTC3LJ();
+  }
+});
+
 // src/proxy.ts
 import { AsyncLocalStorage } from "async_hooks";
 import { createHmac } from "crypto";
 import { createServer } from "http";
-import { finished } from "stream";
+import { finished, Readable } from "stream";
+import { pipeline } from "stream/promises";
 import { homedir as homedir8 } from "os";
 import { join as join11 } from "path";
 import { mkdir as mkdir5, writeFile as writeFile3, readFile as readFile2, stat as fsStat } from "fs/promises";
@@ -90473,10 +90587,10 @@ async function loadGatewayCatalog(apiBase, apiKey) {
   try {
     const controller = new AbortController();
     const timer2 = setTimeout(() => controller.abort(), GATEWAY_CATALOG_TIMEOUT_MS);
-    const res = await fetch(`${apiBase}/v1/models`, {
-      signal: controller.signal,
-      ...apiKey ? { headers: { authorization: `Bearer ${apiKey}` } } : {}
-    });
+    const res = await (apiKey ? createApiKeyFetch(apiKey, fetch, apiBase) : fetch)(
+      `${apiBase}/v1/models`,
+      { signal: controller.signal }
+    );
     clearTimeout(timer2);
     if (!res.ok) return;
     const body = await res.json();
@@ -91214,7 +91328,57 @@ function estimateImageCost(model, size5, n = 1) {
   const pricePerImage = sizePrice ?? pricing.default;
   return pricePerImage * n * 1.05;
 }
-async function proxyPaidApiRequest(req, res, apiBase, payFetch, getActualPaymentUsd) {
+function blockrunRequestId(response) {
+  if (!response) return void 0;
+  for (const name of ["x-blockrun-request-id", "x-request-id", "request-id"]) {
+    const value = response.headers.get(name)?.trim();
+    if (value) return value;
+  }
+  return void 0;
+}
+function gatewayRemainingCreditUsd(response) {
+  const raw = response?.headers.get("x-blockrun-credit-remaining-usd");
+  if (raw === null || raw === void 0) return void 0;
+  const trimmed = raw.trim();
+  if (trimmed === "") return void 0;
+  const value = Number(trimmed);
+  if (!Number.isFinite(value) || value < 0) return void 0;
+  return value;
+}
+function settledMediaCostUsd(upstream, body, x402AmountUsd, estimate) {
+  const header = gatewaySettledCostUsd(upstream);
+  if (header !== void 0) return header;
+  const price = body?.price?.amount;
+  if (typeof price === "string" || typeof price === "number") {
+    const parsed = Number(price);
+    if (Number.isFinite(parsed) && parsed >= 0) return parsed;
+  }
+  if (typeof x402AmountUsd === "number" && x402AmountUsd > 0) return x402AmountUsd;
+  return estimate;
+}
+function noteRemainingCredit(response) {
+  const remaining = gatewayRemainingCreditUsd(response);
+  if (remaining === void 0) return;
+  if (remaining > LOW_CREDIT_USD) {
+    lowCreditWarned = false;
+    return;
+  }
+  if (lowCreditWarned) return;
+  lowCreditWarned = true;
+  console.warn(
+    remaining <= 0 ? `[ClawRouter] \u26A0 BlockRun account credit is exhausted \u2014 calls will fail with 402. Top up: ${PORTAL_CREDITS_URL}` : `[ClawRouter] \u26A0 BlockRun account credit low: $${remaining.toFixed(2)} remaining. Top up: ${PORTAL_CREDITS_URL}`
+  );
+}
+function gatewaySettledCostUsd(response) {
+  const raw = response?.headers.get("x-blockrun-cost-usd");
+  if (raw === null || raw === void 0) return void 0;
+  const trimmed = raw.trim();
+  if (trimmed === "") return void 0;
+  const value = Number(trimmed);
+  if (!Number.isFinite(value) || value < 0) return void 0;
+  return value;
+}
+async function proxyPaidApiRequest(req, res, apiBase, payFetch, getActualPaymentUsd, accountPassthrough = false, authMode = "wallet") {
   const startTime = Date.now();
   const upstreamUrl = `${apiBase}${req.url}`;
   const isBlockrunExa = req.url?.startsWith("/v1/exa/") ?? false;
@@ -91253,18 +91417,35 @@ async function proxyPaidApiRequest(req, res, apiBase, payFetch, getActualPayment
       return;
     responseHeaders[key2] = value;
   });
+  if (accountPassthrough || authMode === "api-key") {
+    responseHeaders["cache-control"] = "no-store";
+  }
   res.writeHead(upstream.status, responseHeaders);
-  if (upstream.body) {
-    const chunks = await readBodyWithTimeout(upstream.body, ERROR_BODY_READ_TIMEOUT_MS);
-    for (const chunk of chunks) {
-      safeWrite(res, Buffer.from(chunk));
+  if (accountPassthrough) {
+    if (upstream.body) {
+      await pipeline(
+        Readable.fromWeb(upstream.body),
+        res,
+        { signal: clientAbort.signal }
+      );
+    } else {
+      res.end();
+    }
+  } else {
+    if (upstream.body) {
+      const chunks = await readBodyWithTimeout(upstream.body, ERROR_BODY_READ_TIMEOUT_MS);
+      for (const chunk of chunks) {
+        safeWrite(res, Buffer.from(chunk));
+      }
     }
+    res.end();
   }
-  res.end();
   const latencyMs = Date.now() - startTime;
   console.log(`[ClawRouter] ${requestLabel} response: ${upstream.status} (${latencyMs}ms)`);
-  const paidAmount = getActualPaymentUsd();
-  const requestCost = resolvePhoneTelemetryCost({
+  noteRemainingCredit(upstream);
+  const settledCostUsd = gatewaySettledCostUsd(upstream);
+  const paidAmount = settledCostUsd ?? getActualPaymentUsd();
+  const requestCost = settledCostUsd !== void 0 ? settledCostUsd : resolvePhoneTelemetryCost({
     paidAmount,
     isPhone,
     upstreamStatus: upstream.status,
@@ -91273,6 +91454,7 @@ async function proxyPaidApiRequest(req, res, apiBase, payFetch, getActualPayment
   });
   logUsage({
     timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    ...blockrunRequestId(upstream) ? { requestId: blockrunRequestId(upstream) } : {},
     model: isBlockrunExa ? "blockrun-exa" : isModalSandbox ? "modal-sandbox" : isPhone ? (req.url ?? "").replace(/^\/v1\//, "").split("?")[0] : isSurf ? (req.url ?? "").replace(/^\/v1\//, "").split("?")[0] : "partner",
     tier: isPhone ? "PHONE" : isSurf ? "SURF" : "PARTNER",
     cost: requestCost,
@@ -91364,7 +91546,8 @@ async function startProxy(options) {
   const walletKey = options.wallet === void 0 ? void 0 : typeof options.wallet === "string" ? options.wallet : options.wallet.key;
   const solanaPrivateKeyBytes = options.wallet === void 0 || typeof options.wallet === "string" ? void 0 : options.wallet.solanaPrivateKeyBytes;
   const paymentChain = options.paymentChain ?? await resolvePaymentChain();
-  const apiBase = options.apiBase ?? (authMode === "api-key" ? BLOCKRUN_API_KEY_API : paymentChain === "solana" && solanaPrivateKeyBytes ? BLOCKRUN_SOLANA_API : BLOCKRUN_API);
+  const requestedApiBase = options.apiBase ?? (authMode === "api-key" ? BLOCKRUN_API_KEY_API : paymentChain === "solana" && solanaPrivateKeyBytes ? BLOCKRUN_SOLANA_API : BLOCKRUN_API);
+  const apiBase = authMode === "api-key" ? normalizeApiKeyBase(requestedApiBase) : requestedApiBase;
   if (authMode === "api-key") {
     console.log(`[ClawRouter] Auth: BlockRun API key ${maskApiKey(apiKey)} (${apiBase})`);
     console.log(`[ClawRouter] Billing: account credit \u2014 top up at ${PORTAL_CREDITS_URL}`);
@@ -91464,8 +91647,20 @@ async function startProxy(options) {
     const { createKeyPairSignerFromPrivateKeyBytes: createKeyPairSignerFromPrivateKeyBytes2 } = await Promise.resolve().then(() => (init_index_node37(), index_node_exports));
     const solanaSigner = await createKeyPairSignerFromPrivateKeyBytes2(solanaPrivateKeyBytes);
     solanaAddress = solanaSigner.address;
+    const solanaRpcUrl = process["env"].CLAWROUTER_SOLANA_RPC_URL;
     registerExactSvmScheme2(x402, { signer: solanaSigner });
+    if (solanaRpcUrl) {
+      const { ExactSvmScheme: ExactSvmScheme2 } = await Promise.resolve().then(() => (init_client3(), client_exports));
+      const { ExactSvmSchemeV1: ExactSvmSchemeV12, NETWORKS: SVM_V1_NETWORKS } = await Promise.resolve().then(() => (init_v1(), v1_exports));
+      x402.register("solana:*", new ExactSvmScheme2(solanaSigner, { rpcUrl: solanaRpcUrl }));
+      for (const network of SVM_V1_NETWORKS) {
+        x402.registerV1(network, new ExactSvmSchemeV12(solanaSigner, { rpcUrl: solanaRpcUrl }));
+      }
+    }
     console.log(`[ClawRouter] Solana wallet: ${solanaAddress}`);
+    if (solanaRpcUrl) {
+      console.log(`[ClawRouter] Solana RPC (payment signing + balance): ${solanaRpcUrl}`);
+    }
   }
   x402?.onAfterPaymentCreation(async (context) => {
     if (!context.selectedRequirements.network.startsWith("eip155")) return;
@@ -91481,7 +91676,7 @@ async function startProxy(options) {
     if (store) store.amountUsd = amountUsd;
     console.log(`[ClawRouter] Payment signed on ${chain3} (${network}) \u2014 $${amountUsd.toFixed(6)}`);
   });
-  const payFetch = authMode === "api-key" ? createApiKeyFetch(apiKey) : createPayFetchWithPreAuth(fetch, x402, void 0, {
+  const payFetch = authMode === "api-key" ? createApiKeyFetch(apiKey, fetch, apiBase) : createPayFetchWithPreAuth(fetch, x402, void 0, {
     skipPreAuth: paymentChain === "solana",
     // Per-request cost estimate so pre-auth is only reused when the cached
     // payment still covers the (possibly larger) request — BlockRun prices per
@@ -91565,7 +91760,15 @@ async function startProxy(options) {
               )
             ]);
             if (authMode === "api-key") {
-              response.balance = null;
+              const credit = await fetchCreditBalance(apiKey, BALANCE_CHECK_TIMEOUT_MS);
+              response.balance = credit?.remainingUsd ?? null;
+              response.creditSpent = credit?.spentUsd ?? null;
+              response.creditGranted = credit?.grantedUsd ?? null;
+              response.billingMode = credit?.billingMode ?? null;
+              response.creditSummary = credit ? formatCreditBalance(credit) : null;
+              response.blocked = credit?.blocked ?? false;
+              if (credit?.blockedReason) response.blockedReason = credit.blockedReason;
+              response.isEmpty = credit?.remainingUsd !== null && (credit?.remainingUsd ?? 1) <= 0;
               response.billing = "BlockRun account credit";
               response.topUpUrl = PORTAL_CREDITS_URL;
             } else {
@@ -91977,9 +92180,15 @@ async function startProxy(options) {
               }
             }
           }
-          const imgActualCost = paymentStore.getStore()?.amountUsd ?? imgCost;
+          const imgActualCost = settledMediaCostUsd(
+            upstream,
+            result,
+            paymentStore.getStore()?.amountUsd,
+            imgCost
+          );
           logUsage({
             timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+            ...blockrunRequestId(upstream) ? { requestId: blockrunRequestId(upstream) } : {},
             model: imgModel,
             tier: "IMAGE",
             cost: imgActualCost,
@@ -92048,12 +92257,15 @@ async function startProxy(options) {
           return;
         }
         try {
-          const upstream = await payFetch(`${apiBase}/v1/images/image2image`, {
+          let upstream = await payFetch(`${apiBase}/v1/images/image2image`, {
             method: "POST",
             headers: { "content-type": "application/json", "user-agent": USER_AGENT },
             body: reqBody,
             signal: clientAbort.signal
           });
+          if (authMode === "api-key") {
+            upstream = await pollApiKeyJob(upstream, payFetch, apiBase, clientAbort.signal);
+          }
           const text = await upstream.text();
           if (!upstream.ok) {
             res.writeHead(upstream.status, { "Content-Type": "application/json" });
@@ -92100,9 +92312,15 @@ async function startProxy(options) {
               }
             }
           }
-          const img2imgActualCost = paymentStore.getStore()?.amountUsd ?? img2imgCost;
+          const img2imgActualCost = settledMediaCostUsd(
+            upstream,
+            result,
+            paymentStore.getStore()?.amountUsd,
+            img2imgCost
+          );
           logUsage({
             timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+            ...blockrunRequestId(upstream) ? { requestId: blockrunRequestId(upstream) } : {},
             model: img2imgModel,
             tier: "IMAGE",
             cost: img2imgActualCost,
@@ -92142,12 +92360,15 @@ async function startProxy(options) {
         } catch {
         }
         try {
-          const upstream = await payFetch(`${apiBase}/v1/audio/generations`, {
+          let upstream = await payFetch(`${apiBase}/v1/audio/generations`, {
             method: "POST",
             headers: { "content-type": "application/json", "user-agent": USER_AGENT },
             body: reqBody,
             signal: clientAbort.signal
           });
+          if (authMode === "api-key") {
+            upstream = await pollApiKeyJob(upstream, payFetch, apiBase, clientAbort.signal);
+          }
           const text = await upstream.text();
           if (!upstream.ok) {
             res.writeHead(upstream.status, { "Content-Type": "application/json" });
@@ -92186,9 +92407,15 @@ async function startProxy(options) {
               }
             }
           }
-          const audioActualCost = paymentStore.getStore()?.amountUsd ?? 0.15;
+          const audioActualCost = settledMediaCostUsd(
+            upstream,
+            result,
+            paymentStore.getStore()?.amountUsd,
+            0.15
+          );
           logUsage({
             timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+            ...blockrunRequestId(upstream) ? { requestId: blockrunRequestId(upstream) } : {},
             model: audioModel,
             tier: "AUDIO",
             cost: audioActualCost,
@@ -92346,7 +92573,12 @@ async function startProxy(options) {
               }
             }
           }
-          const videoActualCost = paymentStore.getStore()?.amountUsd ?? estimateVideoCost(videoModel, videoDuration, videoHasImageInput);
+          const videoActualCost = settledMediaCostUsd(
+            void 0,
+            submitResult,
+            paymentStore.getStore()?.amountUsd,
+            estimateVideoCost(videoModel, videoDuration, videoHasImageInput)
+          );
           logUsage({
             timestamp: (/* @__PURE__ */ new Date()).toISOString(),
             model: videoModel,
@@ -92380,7 +92612,9 @@ async function startProxy(options) {
             res,
             apiBase,
             payFetch,
-            () => paymentStore.getStore()?.amountUsd ?? 0
+            () => paymentStore.getStore()?.amountUsd ?? 0,
+            false,
+            authMode
           );
         } catch (err) {
           const error = err instanceof Error ? err : new Error(String(err));
@@ -92403,6 +92637,33 @@ async function startProxy(options) {
         res.end(JSON.stringify({ error: "Not found" }));
         return;
       }
+      if (authMode === "api-key" && /^\/v1\//.test(req.url ?? "") && !/^\/v1\/(?:chat\/completions|messages)(?:\?|$)/.test(req.url ?? "")) {
+        try {
+          await proxyPaidApiRequest(
+            req,
+            res,
+            apiBase,
+            payFetch,
+            () => paymentStore.getStore()?.amountUsd ?? 0,
+            true,
+            authMode
+          );
+        } catch (err) {
+          const error = err instanceof Error ? err : new Error(String(err));
+          options.onError?.(error);
+          if (!res.headersSent) {
+            res.writeHead(502, { "Content-Type": "application/json" });
+            res.end(
+              JSON.stringify({
+                error: { message: `Account API error: ${error.message}`, type: "account_error" }
+              })
+            );
+          } else if (!res.writableEnded) {
+            res.end();
+          }
+        }
+        return;
+      }
       if (!req.url.includes("/chat/completions")) {
         res.writeHead(404, { "Content-Type": "application/json" });
         res.end(
@@ -92670,7 +92931,8 @@ async function tryModelRequest(upstreamUrl, method, headers, body, modelId, maxT
         errorBody,
         errorStatus: response.status,
         isProviderError: category !== null,
-        errorCategory: category ?? void 0
+        errorCategory: category ?? void 0,
+        upstreamRequestId: blockrunRequestId(response)
       };
     }
     const contentType = response.headers.get("content-type") || "";
@@ -92707,9 +92969,12 @@ async function tryModelRequest(upstreamUrl, method, headers, body, modelId, maxT
         errorCategory: "payment_error"
       };
     }
+    const networkMsg = describeFetchError(err);
+    const solanaSigningHint = upstreamUrl.startsWith(BLOCKRUN_SOLANA_API) && networkMsg.startsWith("fetch failed") ? " \u2014 on the Solana rail this may be the RPC that signs the payment rather than the gateway; if api.mainnet-beta.solana.com is unreachable from this host, set CLAWROUTER_SOLANA_RPC_URL to your own endpoint" : "";
+    console.error(`[ClawRouter] ${modelId} network error: ${networkMsg}${solanaSigningHint}`);
     return {
       success: false,
-      errorBody: errorMsg,
+      errorBody: `${networkMsg}${solanaSigningHint}`,
       errorStatus: 500,
       isProviderError: true
       // Network errors are retryable
@@ -92742,6 +93007,7 @@ async function proxyRequest(req, res, apiBase, payFetch, options, routerOpts, de
   let accumulatedContent = "";
   let responseInputTokens;
   let responseOutputTokens;
+  let upstreamRequestId;
   let requestHadError = false;
   let requestSummaryForStore = "";
   const isChatCompletion = req.url?.includes("/chat/completions");
@@ -93081,9 +93347,15 @@ async function proxyRequest(req, res, apiBase, payFetch, options, routerOpts, de
               responseText = lines.join("\n");
             }
             console.log(`[ClawRouter] /imagegen success: ${images.length} image(s) generated`);
-            const imagegenActualCost = paymentStore.getStore()?.amountUsd ?? estimateImageCost(imageModel, imageSize, 1);
+            const imagegenActualCost = settledMediaCostUsd(
+              imageResponse,
+              imageResult,
+              paymentStore.getStore()?.amountUsd,
+              estimateImageCost(imageModel, imageSize, 1)
+            );
             logUsage({
               timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+              ...blockrunRequestId(imageResponse) ? { requestId: blockrunRequestId(imageResponse) } : {},
               model: imageModel,
               tier: "IMAGE",
               cost: imagegenActualCost,
@@ -93307,9 +93579,15 @@ async function proxyRequest(req, res, apiBase, payFetch, options, routerOpts, de
               responseText = lines.join("\n");
             }
             console.log(`[ClawRouter] /img2img success: ${images.length} image(s)`);
-            const img2imgActualCost2 = paymentStore.getStore()?.amountUsd ?? estimateImageCost(img2imgModel, img2imgSize, 1);
+            const img2imgActualCost2 = settledMediaCostUsd(
+              img2imgResponse,
+              img2imgResult,
+              paymentStore.getStore()?.amountUsd,
+              estimateImageCost(img2imgModel, img2imgSize, 1)
+            );
             logUsage({
               timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+              ...blockrunRequestId(img2imgResponse) ? { requestId: blockrunRequestId(img2imgResponse) } : {},
               model: img2imgModel,
               tier: "IMAGE",
               cost: img2imgActualCost2,
@@ -94148,7 +94426,8 @@ data: [DONE]
       }
       lastError = {
         body: result.errorBody || "Unknown error",
-        status: result.errorStatus || 500
+        status: result.errorStatus || 500,
+        requestId: result.upstreamRequestId
       };
       failedAttempts.push({
         model: tryModel,
@@ -94220,7 +94499,8 @@ data: [DONE]
           }
           lastError = {
             body: retryResult.errorBody || lastError?.body || "Unknown error",
-            status: retryResult.errorStatus || lastError?.status || 500
+            status: retryResult.errorStatus || lastError?.status || 500,
+            requestId: retryResult.upstreamRequestId ?? lastError?.requestId
           };
           failedAttempts.push({
             model: tryModel,
@@ -94362,10 +94642,14 @@ data: [DONE]
         }
       }
     }
+    upstreamRequestId = blockrunRequestId(upstream);
+    noteRemainingCredit(upstream);
     if (!upstream) {
       const attemptSummary = failedAttempts.length > 0 ? failedAttempts.map((a) => `${a.model} (${a.reason})`).join(", ") : "unknown";
       const structuredMessage = failedAttempts.length > 0 ? `All ${failedAttempts.length} models failed. Tried: ${attemptSummary}` : "All models in fallback chain failed";
-      console.log(`[ClawRouter] ${structuredMessage}`);
+      console.log(
+        `[ClawRouter] ${structuredMessage}${lastError?.requestId ? ` | gateway request id: ${lastError.requestId}` : ""}`
+      );
       const rawErrBody = lastError?.body || structuredMessage;
       const errStatus = lastError?.status || 502;
       const transformedErr = transformPaymentError(rawErrBody);
@@ -94403,7 +94687,8 @@ data: [DONE]
         res.writeHead(errStatus, {
           "Content-Type": "application/json",
           "x-context-used-kb": String(originalContextSizeKB),
-          "x-context-limit-kb": String(CONTEXT_LIMIT_KB)
+          "x-context-limit-kb": String(CONTEXT_LIMIT_KB),
+          ...lastError?.requestId ? { "x-blockrun-request-id": lastError.requestId } : {}
         });
         res.end(transformedErr);
         deduplicator.complete(dedupKey, {
@@ -94867,12 +95152,24 @@ data: [DONE]
         maxTokens,
         routingProfile ?? void 0
       );
-      logCost = FREE_MODELS.has(logModel) ? 0 : costs.costEstimate;
+      const apiKeyPricing = options.apiKey ? routerOpts.modelPricing.get(logModel) : void 0;
+      if (FREE_MODELS.has(logModel)) {
+        logCost = 0;
+        logSavings = 1;
+      } else if (apiKeyPricing) {
+        const inTokens = responseInputTokens ?? chargedInputTokens;
+        const outTokens = responseOutputTokens ?? 0;
+        logCost = (inTokens * (apiKeyPricing.inputPrice ?? 0) + outTokens * (apiKeyPricing.outputPrice ?? 0)) / 1e6;
+        logSavings = costs.baselineCost > 0 ? Math.max(0, (costs.baselineCost - logCost) / costs.baselineCost) : 0;
+      } else {
+        logCost = costs.costEstimate;
+        logSavings = costs.savings;
+      }
       logBaseline = costs.baselineCost;
-      logSavings = FREE_MODELS.has(logModel) ? 1 : costs.savings;
     }
     const entry = {
       timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      ...upstreamRequestId ? { requestId: upstreamRequestId } : {},
       model: logModel,
       tier: routingDecision?.tier ?? "DIRECT",
       cost: logCost,
@@ -94887,7 +95184,7 @@ data: [DONE]
     });
   }
 }
-var paymentStore, BLOCKRUN_API, BLOCKRUN_SOLANA_API, DESKTOP_SERVICE_TOKEN_FILE, IMAGE_DIR, AUDIO_DIR, VIDEO_DIR, AUTO_MODEL, ROUTING_PROFILES, FREE_MODELS, gatewayModelIds, FREE_MODEL, FREE_UPSTREAM_OVERRIDES, MAX_MESSAGES, CONTEXT_LIMIT_KB, HEARTBEAT_INTERVAL_MS, BALANCE_CHECK_TIMEOUT_MS, GATEWAY_CATALOG_TIMEOUT_MS, DEFAULT_REQUEST_TIMEOUT_MS, PER_MODEL_TIMEOUT_MS, REASONING_MODEL_TIMEOUT_MS, REASONING_MODEL_IDS, MAX_FALLBACK_ATTEMPTS, HEALTH_CHECK_TIMEOUT_MS, RATE_LIMIT_COOLDOWN_MS, OVERLOAD_COOLDOWN_MS, PORT_RETRY_ATTEMPTS, PORT_RETRY_DELAY_MS, MODEL_BODY_READ_TIMEOUT_MS, ERROR_BODY_READ_TIMEOUT_MS, ClientDisconnectedError, rateLimitedModels, overloadedModels, perProviderErrors, BALANCE_CHECK_BUFFER, BALANCE_PREFLIGHT_OUTPUT_TOKEN_CAP, PROVIDER_ERROR_PATTERNS, DEGRADED_RESPONSE_PATTERNS, DEGRADED_LOOP_PATTERNS, VALID_ROLES, ROLE_MAPPINGS, VALID_TOOL_ID_PATTERN, KIMI_BLOCK_RE, KIMI_TOKEN_RE, THINKING_TAG_RE, THINKING_BLOCK_RE, BLOCKRUN_MODEL_BY_ID, IMAGE_PRICING, IMAGE_MODEL_IDS, IMAGE_MODEL_SIZES, IMAGE_MODEL_ALIASES, VIDEO_PRICING, PHONE_PRICING;
+var paymentStore, BLOCKRUN_API, BLOCKRUN_SOLANA_API, DESKTOP_SERVICE_TOKEN_FILE, IMAGE_DIR, AUDIO_DIR, VIDEO_DIR, AUTO_MODEL, ROUTING_PROFILES, FREE_MODELS, gatewayModelIds, FREE_MODEL, FREE_UPSTREAM_OVERRIDES, MAX_MESSAGES, CONTEXT_LIMIT_KB, HEARTBEAT_INTERVAL_MS, BALANCE_CHECK_TIMEOUT_MS, GATEWAY_CATALOG_TIMEOUT_MS, DEFAULT_REQUEST_TIMEOUT_MS, PER_MODEL_TIMEOUT_MS, REASONING_MODEL_TIMEOUT_MS, REASONING_MODEL_IDS, MAX_FALLBACK_ATTEMPTS, HEALTH_CHECK_TIMEOUT_MS, RATE_LIMIT_COOLDOWN_MS, OVERLOAD_COOLDOWN_MS, PORT_RETRY_ATTEMPTS, PORT_RETRY_DELAY_MS, MODEL_BODY_READ_TIMEOUT_MS, ERROR_BODY_READ_TIMEOUT_MS, ClientDisconnectedError, rateLimitedModels, overloadedModels, perProviderErrors, BALANCE_CHECK_BUFFER, BALANCE_PREFLIGHT_OUTPUT_TOKEN_CAP, PROVIDER_ERROR_PATTERNS, DEGRADED_RESPONSE_PATTERNS, DEGRADED_LOOP_PATTERNS, VALID_ROLES, ROLE_MAPPINGS, VALID_TOOL_ID_PATTERN, KIMI_BLOCK_RE, KIMI_TOKEN_RE, THINKING_TAG_RE, THINKING_BLOCK_RE, BLOCKRUN_MODEL_BY_ID, IMAGE_PRICING, IMAGE_MODEL_IDS, IMAGE_MODEL_SIZES, IMAGE_MODEL_ALIASES, VIDEO_PRICING, PHONE_PRICING, LOW_CREDIT_USD, lowCreditWarned;
 var init_proxy = __esm({
   "src/proxy.ts"() {
     "use strict";
@@ -94912,6 +95209,7 @@ var init_proxy = __esm({
     init_api_key();
     init_spend_control();
     init_compression();
+    init_errors5();
     init_version4();
     init_session();
     init_updater();
@@ -95148,6 +95446,8 @@ var init_proxy = __esm({
       "phone/numbers/release": 0,
       "voice/call": 0.54
     };
+    LOW_CREDIT_USD = 1;
+    lowCreditWarned = false;
   }
 });
 
@@ -111977,7 +112277,7 @@ var init_readBlob = __esm({
 
 // node_modules/axios/lib/helpers/formDataToStream.js
 import util2 from "util";
-import { Readable } from "stream";
+import { Readable as Readable2 } from "stream";
 var BOUNDARY_ALPHABET, textEncoder, CRLF, CRLF_BYTES, CRLF_BYTES_COUNT, FormDataPart, formDataToStream, formDataToStream_default;
 var init_formDataToStream = __esm({
   "node_modules/axios/lib/helpers/formDataToStream.js"() {
@@ -112057,7 +112357,7 @@ var init_formDataToStream = __esm({
         computedHeaders["Content-Length"] = contentLength;
       }
       headersHandler && headersHandler(computedHeaders);
-      return Readable.from(
+      return Readable2.from(
         (async function* () {
           for (const part of parts) {
             yield boundaryBytes;
@@ -228167,12 +228467,12 @@ async function startProxyInBackground(api, startupGeneration) {
     proc.__clawrouterStartupPhase = "starting";
   }
   const pluginApiKey = api.pluginConfig?.apiKey;
-  const resolvedApiKey = typeof pluginApiKey === "string" && isValidApiKey(pluginApiKey) ? { key: pluginApiKey.trim(), source: "config" } : await resolveApiKey();
-  if (typeof pluginApiKey === "string" && !isValidApiKey(pluginApiKey)) {
-    api.logger.warn(
-      `pluginConfig.apiKey is set but invalid (expected brk_...) \u2014 ignoring it and looking elsewhere`
+  if (typeof pluginApiKey === "string" && pluginApiKey.trim() && !isValidApiKey(pluginApiKey)) {
+    throw new Error(
+      `pluginConfig.apiKey is set but is not a BlockRun key (expected brk_\u2026). Fix it or remove it \u2014 refusing to fall back to another credential.`
     );
   }
+  const resolvedApiKey = typeof pluginApiKey === "string" && isValidApiKey(pluginApiKey) ? { key: pluginApiKey.trim(), source: "config" } : await resolveApiKey();
   const apiKey = resolvedApiKey?.key;
   const configKey = api.pluginConfig?.walletKey;
   let wallet;
@@ -229358,7 +229658,18 @@ ${errText}`
         if (!isGatewayMode()) {
           if (shouldLogRegistration) {
             void (async () => {
-              const keyResolution = await resolveApiKey().catch(() => void 0);
+              let keyResolution;
+              try {
+                keyResolution = await resolveApiKey();
+              } catch (error) {
+                api.logger.error(
+                  `BlockRun API key is configured but unusable: ${error instanceof Error ? error.message : String(error)}`
+                );
+                api.logger.error(
+                  `Not falling back to a wallet \u2014 fix the key, or run "clawrouter logout" to pay from the wallet deliberately.`
+                );
+                return;
+              }
               if (keyResolution) {
                 api.logger.info(
                   `Using BlockRun API key ${maskApiKey(keyResolution.key)} (from ${keyResolution.source}) \u2014 billing account credit, no wallet`