@fangorn-network/westmarch 0.0.20-dev → 0.1.0

package/src/agent/tools.js

@@ -29,7 +29,8 @@ const PLUMBING = new Set(["text", "vector", "norm", "id", "owner", "embed"]);
 export const brief = (r, roles, fields = []) => {
     const out = briefOf(r, roles, fields);
     const link = linkOf(r, roles);
-    return link ? { ...out, url: link } : out;
+    // Whose it is, and its price when sold: what an agent needs to cite or buy a hit.
+    return { ...out, ...(link ? { url: link } : {}), ...(r.owner ? { publisher: r.owner } : {}), ...(r.sale ? { sale: r.sale } : {}) };
 };
 
 /**
@@ -275,7 +276,7 @@ export function getRow(rows, id, roles) {
 }
 
 // ── self-check: `node tools.js` — no browser, no network ────────────────────
-if (typeof process !== "undefined" && import.meta.url === `file://${process.argv[1]}` && process.argv[1].endsWith("/tools.js")) {
+if (import.meta.url === `file://${globalThis.process?.argv?.[1]}` && process.argv[1].endsWith("/tools.js")) {
     const { rolesFrom } = await import("../core/roles.js");
     const row = (id, fields, vector) => ({
         id, owner: "0xa", ...fields,

package/src/agent/ui.js

@@ -505,7 +505,7 @@ export function stage({ picks = [], heading = "", note = "" } = {}) {
 }
 
 // ── self-check: `node src/agent/ui.js` ────────────────────────────────────────
-if (typeof process !== "undefined" && import.meta.url === `file://${process.argv[1]}` && process.argv[1].endsWith("/ui.js")) {
+if (import.meta.url === `file://${globalThis.process?.argv?.[1]}` && process.argv[1].endsWith("/ui.js")) {
     const roles = { measures: ["rating", "year", "runtime", "votes"] };
     const html = rankedList({
         heading: 'search "frozen"', note: "2 corpora",

package/src/agent/view-tools.js

@@ -11,7 +11,7 @@
 //   - a search goes to the 3 views whose coverage sketch best matches the query,
 //     not to all of them (Kingsfoil: ~3 of 23 views, ~92% of the true top 10 with
 //     a 32-vector sketch). The result names what was searched and what was not.
-//   - `warm()` starts the embedder the moment an app is opened, and a search
+//   - `warm()` starts the embedder before the first query, and a search
 //     never waits on a first-time model download.
 //
 // `get`/`similar`/`count` answer over what is loaded, and say so.
@@ -69,9 +69,10 @@ const WHERE = { type: "object", description: 'Equality filters, e.g. {"phase":"P
  * The tools for one app, or null when its card names no views.
  * `app` is `{ name, desc, views }` from a verified card. `fetchCatalog(url)` may
  * answer from a stale copy: the survey only describes and routes, and loading a
- * view re-reads its catalog through shard.js either way.
+ * view re-reads its catalog through shard.js either way. `queryVector(q)` embeds a
+ * query (null to rank by words); a Worker passes its own encoder.
  */
-export function viewTools(app, { fetchCatalog = fetch } = {}) {
+export function viewTools(app, { fetchCatalog = fetch, queryVector: embedQ = queryVector } = {}) {
     if (!app.views?.length) return null;
     const names = new Map();   // view url → its name in every result
     const label = (url) => names.get(url) ?? url.split("/").pop();
@@ -85,6 +86,7 @@ export function viewTools(app, { fetchCatalog = fetch } = {}) {
             view, name: label(view),
             description: domains.map((d) => d.description).filter(Boolean).join(" "),
             count: domains.reduce((s, d) => s + (d.count ?? 0), 0),
+            repos: domains.filter((d) => d.publisher).map((d) => ({ publisher: d.publisher, repo: d.repo, rows: d.count ?? 0, description: d.description ?? "" })),
             coverage: { vectors: domains.flatMap((d) => d.coverage?.vectors ?? []) },
         };
     })).catch((e) => { surveyed = null; throw e; }));
@@ -111,11 +113,12 @@ export function viewTools(app, { fetchCatalog = fetch } = {}) {
     const run = {
         describe: async () => ({
             app: app.name, description: app.desc,
-            views: (await survey()).map((v) => ({ view: v.name, rows: v.count, description: v.description, loaded: loaded.has(v.view) })),
+            views: (await survey()).map((v) => ({ view: v.name, rows: v.count, description: v.description, loaded: loaded.has(v.view),
+                                                  ...(v.repos.length ? { repos: v.repos } : {}) })),
         }),
         search: async ({ query, limit = 10, views, where: w }) => {
             if (!query) throw new Error("query is required");
-            const qv = await queryVector(query);
+            const qv = await embedQ(query);
             const ranked = views?.length ? await pick(views) : (await route(query, qv)).slice(0, ROUTE_TOP);
             const others = views?.length ? [] : (await route(query, qv)).slice(ROUTE_TOP, ROUTE_TOP + 5).map((v) => v.name);
             const per = await Promise.all(ranked.map(async (v) =>
@@ -125,7 +128,9 @@ export function viewTools(app, { fetchCatalog = fetch } = {}) {
                      next_views: others, hits };
         },
         get: async ({ id, view }) => {
-            if (view) for (const v of await pick([view])) await load(v);
+            // Nothing loaded (a fresh Worker isolate: each request may land on a new one): load every view.
+            // ponytail: downloads every view for an app with many; route by id when that shows.
+            for (const v of view ? await pick([view]) : loaded.size ? [] : await survey()) await load(v);
             for (const [v, rows] of loaded) { const r = getRow(rows, id, rolesOf(v)); if (r) return r; }
             return { error: `${id} is not in a loaded view. Search for it, or pass its view.`, loaded: [...loaded.keys()].map(label) };
         },
@@ -173,30 +178,6 @@ export function viewTools(app, { fetchCatalog = fetch } = {}) {
         { name: "threads", description: `One thing followed across records of a ${n} view (a matter from committee to council): steps in date order, the latest-moving first. Views that declare no thread say so.`,
           inputSchema: { type: "object", properties: { view: str("View name from describe"), id: str("One thread, by a step's thread field"), limit: num("default 20"), offset: num("default 0"), where: WHERE }, required: ["view"] } },
     ];
-    // Records the app sells over x402 (its card's `paid`). Paid from this server's wallet,
-    // never above FANGORN_MCP_MAX_PRICE, and checked against the sha256 the app published
-    // for that record, so what was paid for is what was committed.
-    if (app.paid) {
-        const p = app.paid, dec = p.decimals ?? 6;
-        const price = `${(Number(p.price) / 10 ** dec).toFixed(dec).replace(/0+$/, "").replace(/\.$/, "")} ${p.symbol ?? "USDC"}`;
-        const cap = BigInt(Math.round(Number(process.env.FANGORN_MCP_MAX_PRICE ?? "0.10") * 10 ** dec));
-        run.buy = async ({ id }) => {
-            if (!id) throw new Error("id is required");
-            const hit = loadedRows().find(({ r, view }) => r.id === id || r[rolesOf(view).identity] === id);
-            const key = hit ? hit.r[rolesOf(hit.view).identity] ?? id : id;
-            const { buyRecord } = await import("./x402.js");
-            const want = hit?.r.paid_sha256;
-            const r = await buyRecord(p, key, { want, privateKey: process.env.FANGORN_MCP_WALLET_KEY, maxPrice: cap });
-            if (r.error) return r;
-            return { id: key, paid: r.price ? price : "free", transaction: r.receipt?.transaction ?? null, network: r.receipt?.network ?? p.network,
-                     verified: want ? (r.verified ? "matches the published sha256" : `MISMATCH: published ${want}, got ${r.digest}`) : "not checked (search for the record first)",
-                     record: r.record };
-        };
-        tools.push({ name: "buy", description: `Buy one ${n} record's paid detail for ${price} (x402 on ${p.network}): ${p.description || "the structured record"}. ` +
-                "Pass an id from search. Paid from this server's wallet (FANGORN_MCP_WALLET_KEY), never above FANGORN_MCP_MAX_PRICE.",
-            inputSchema: { type: "object", properties: { id: str("A record id from search or get") }, required: ["id"] } });
-    }
-
     return { tools, call: async (name, args = {}) => {
         if (!run[name]) throw new Error(`no tool ${name}`);
         return text(await run[name](args));

package/src/agent/x402.js

@@ -1,105 +1,214 @@
-// Paying for a resource over x402 (v1, "exact" scheme): the buyer's half.
+// Buying a record over x402 (v2, scheme "fangorn"): the buyer's half.
 //
-//   const { body, receipt, price } = await payAndFetch(url, { privateKey, maxPrice: 50000n });
+//   const { fields, price, tx } = await buyRecord(quoteUrl, { privateKey, fangorn, maxPrice: 50000n });
 //
-// 1. GET url → 402 with `accepts`: what it costs, in which token, on which chain, to whom.
-// 2. Sign an EIP-3009 transferWithAuthorization for exactly that (EIP-712, the token's own
-//    domain). Nothing is sent on chain by the buyer: the seller's facilitator submits it.
-// 3. GET url again with X-PAYMENT: the seller verifies, settles, and returns the resource,
-//    with the settlement (the tx hash) in X-PAYMENT-RESPONSE.
+// `quoteUrl` is an app's GET /paid/<publisher>/<repo>/<id> (site/worker.js). The publisher signed
+// the record's price (its terms); paying is SettlementRegistry.register, sent by the facilitator.
+//   1. GET → 402: the requirement (the terms, paid to the registry in USDC), the sealed fields'
+//      handles, the repo's deposit, and the relay
+//   2. a Semaphore identity from one wallet signature, and an ERC-3009 receiveWithAuthorization to
+//      the registry for exactly the price. Its nonce binds the subject, the identity's commitment,
+//      the referrer and a salt, so nobody can reuse it for anything else.
+//   3. GET again with PAYMENT-SIGNATURE: the app has the facilitator verify it and send `register`
+//   4. a Semaphore proof that some identity that paid names `reader` (message = reader, scope =
+//      subject), sent to the relay's /relay/settle. `reader` is derived from the identity, so the
+//      chain doesn't link it to the paying wallet (the relay could, by timing: PLAN.md, Known gaps).
+//   5. each field's key from the deposit's key server, asked as `reader`; each field decrypted (JSON)
+// A retry picks up where the last one stopped: a registered identity doesn't pay again, and a
+// reader that can already read doesn't settle again.
 //
-// `maxPrice` (token base units) is checked BEFORE signing: a seller cannot ask for more
-// than the caller agreed to, whatever its 402 says.
+// `maxPrice` (USDC base units) is checked before anything is signed.
+
+import { concat, createPublicClient, http, keccak256, parseSignature, toHex } from "viem";
+import { privateKeyToAccount } from "viem/accounts";
+import { openField, recordKey, registerNonce, repoId, subjectOf } from "@fangorn-network/sdk";
 
-const CHAIN_IDS = { "arbitrum-sepolia": 421614, arbitrum: 42161, "base-sepolia": 84532, base: 8453 };
 const b64 = (s) => (typeof btoa === "function" ? btoa(s) : Buffer.from(s, "utf8").toString("base64"));
 const unb64 = (s) => (typeof atob === "function" ? atob(s) : Buffer.from(s, "base64").toString("utf8"));
+const semaphore = () => import("@semaphore-protocol/core").catch(() => {
+    throw new Error("buying needs @semaphore-protocol/core: npm i @semaphore-protocol/core");
+});
 
-/** The one requirement we can pay: exact scheme, a chain we know, within `maxPrice`. */
-export function choose(accepts = [], { maxPrice, networks = Object.keys(CHAIN_IDS) } = {}) {
-    const ok = accepts.filter((a) => a.scheme === "exact" && networks.includes(a.network));
-    if (!ok.length) throw new Error(`no payable option: ${JSON.stringify(accepts.map((a) => `${a.scheme}/${a.network}`))}`);
-    const cheapest = ok.sort((a, b) => (BigInt(a.maxAmountRequired) < BigInt(b.maxAmountRequired) ? -1 : 1))[0];
-    if (maxPrice != null && BigInt(cheapest.maxAmountRequired) > BigInt(maxPrice))
-        throw new Error(`price ${cheapest.maxAmountRequired} exceeds the cap ${maxPrice} (token base units)`);
-    return cheapest;
+/** A 402's PaymentRequired, from its PAYMENT-REQUIRED header. */
+export function paymentRequired(res) {
+    const h = res.headers.get("PAYMENT-REQUIRED");
+    if (!h) throw new Error(`HTTP ${res.status} has no PAYMENT-REQUIRED header (not x402 v2)`);
+    return JSON.parse(unb64(h));
 }
 
-/** The X-PAYMENT header value for requirement `req`, signed by `account` (a viem account). */
-export async function paymentHeader(req, account, { now = Math.floor(Date.now() / 1000) } = {}) {
-    const chainId = CHAIN_IDS[req.network];
-    if (!chainId) throw new Error(`unknown network ${req.network}`);
-    const nonce = `0x${[...crypto.getRandomValues(new Uint8Array(32))].map((b) => b.toString(16).padStart(2, "0")).join("")}`;
-    const authorization = {
-        from: account.address, to: req.payTo, value: String(req.maxAmountRequired),
-        validAfter: String(now - 600), validBefore: String(now + (req.maxTimeoutSeconds ?? 120)), nonce,
-    };
+/** The requirement we can pay: scheme "fangorn" on an EVM chain, within `maxPrice`. */
+export function choose(accepts = [], { maxPrice } = {}) {
+    const r = accepts.find((a) => a.scheme === "fangorn" && /^eip155:\d+$/.test(a.network));
+    if (!r) throw new Error(`no payable option: ${JSON.stringify(accepts.map((a) => `${a.scheme}/${a.network}`))}`);
+    if (maxPrice != null && BigInt(r.amount) > BigInt(maxPrice)) throw new Error(`price ${r.amount} exceeds the cap ${maxPrice} (USDC base units)`);
+    return r;
+}
+
+/** The Semaphore identity and reading account a wallet derives: the same on any machine, from one signature. */
+export async function identityOf(account) {
+    const sig = await account.signMessage({ message: "fangorn:identity:v1" });
+    const { Identity } = await semaphore();
+    return { identity: new Identity(sig), reader: privateKeyToAccount(keccak256(concat([toHex("fangorn:reader:v1"), sig]))) };
+}
+
+/** An ERC-3009 receiveWithAuthorization from `account` to `req.payTo` for exactly `req.amount`, bound to this purchase. */
+export async function signPayment(req, account, { subject, commitment, salt, now = Math.floor(Date.now() / 1000) }) {
+    const message = { from: account.address, to: req.payTo, value: BigInt(req.amount), validAfter: 0n,
+                      validBefore: BigInt(now + (req.maxTimeoutSeconds ?? 300)), nonce: registerNonce(subject, commitment, req.extra.referrer, salt) };
     const signature = await account.signTypedData({
-        domain: { name: req.extra?.name ?? "USD Coin", version: req.extra?.version ?? "2", chainId, verifyingContract: req.asset },
-        types: { TransferWithAuthorization: [
-            { name: "from", type: "address" }, { name: "to", type: "address" }, { name: "value", type: "uint256" },
+        domain: { name: req.extra.name, version: req.extra.version, chainId: Number(req.network.split(":")[1]), verifyingContract: req.asset },
+        types: { ReceiveWithAuthorization: [{ name: "from", type: "address" }, { name: "to", type: "address" }, { name: "value", type: "uint256" },
             { name: "validAfter", type: "uint256" }, { name: "validBefore", type: "uint256" }, { name: "nonce", type: "bytes32" }] },
-        primaryType: "TransferWithAuthorization",
-        message: { ...authorization, value: BigInt(authorization.value), validAfter: BigInt(authorization.validAfter), validBefore: BigInt(authorization.validBefore) },
+        primaryType: "ReceiveWithAuthorization", message,
     });
-    return b64(JSON.stringify({ x402Version: 1, scheme: "exact", network: req.network, payload: { signature, authorization } }));
+    const { v, r, s, yParity } = parseSignature(signature);
+    return { from: message.from, value: req.amount, validAfter: "0", validBefore: String(message.validBefore), nonce: message.nonce,
+             v: Number(v ?? 27n + BigInt(yParity)), r, s };
 }
 
-/** GET `url`, paying once if it answers 402. Returns { status, body, price, receipt }. */
-export async function payAndFetch(url, { privateKey, account, maxPrice, fetchImpl = fetch } = {}) {
-    const first = await fetchImpl(url);
-    if (first.status !== 402) return { status: first.status, body: await first.text(), price: null, receipt: null };
-    const offer = await first.json();
-    const req = choose(offer.accepts, { maxPrice });
-    if (!account) {
-        if (!privateKey) throw new Error(`${url} costs ${req.maxAmountRequired} (base units of ${req.asset} on ${req.network}); no wallet configured to pay`);
-        account = (await import("viem/accounts")).privateKeyToAccount(privateKey);
-    }
-    const paid = await fetchImpl(url, { headers: { "X-PAYMENT": await paymentHeader(req, account) } });
-    const receiptHeader = paid.headers.get("X-PAYMENT-RESPONSE");
-    const body = await paid.text();
-    if (paid.status === 402) throw new Error(`payment refused: ${JSON.parse(body).error ?? body}`);
-    return { status: paid.status, body, price: req.maxAmountRequired, receipt: receiptHeader ? JSON.parse(unb64(receiptHeader)) : null };
+/** A Semaphore proof that `identity` is in the group, naming `reader`, scoped to `subject`, as `settle` checks it. */
+async function prove({ identity, members, reader, subject }) {
+    const { Group, generateProof } = await semaphore();
+    const p = await generateProof(identity, new Group(members), BigInt(reader), BigInt(subject));
+    return { merkleTreeDepth: String(p.merkleTreeDepth), merkleTreeRoot: String(p.merkleTreeRoot), nullifier: String(p.nullifier), points: p.points.map(String) };
 }
 
-/** Buy one record an app sells (its agent card's `paid`) and check it against the sha256 the
- *  app published for it (`want`, the row's `paid_sha256`): what was paid for is what was
- *  committed. Shared by fangorn-mcp's `buy` and the stock page. */
-export async function buyRecord(paid, key, { want, account, privateKey, maxPrice = paid.price, fetchImpl } = {}) {
-    const r = await payAndFetch(paid.url.replace("{id}", encodeURIComponent(key)), { account, privateKey, maxPrice, fetchImpl });
-    if (r.status !== 200) return { id: key, error: `HTTP ${r.status}: ${r.body.slice(0, 200)}` };
-    const digest = [...new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(r.body)))]
-        .map((b) => b.toString(16).padStart(2, "0")).join("");
-    return { id: key, price: r.price, receipt: r.receipt, digest, verified: want ? want === digest : null, record: JSON.parse(r.body) };
+/**
+ * Buy one record and open its sealed fields. `fangorn` is an SDK client on the record's chain:
+ * it reads the registry and the ciphertext. `deps` replaces the chain reads and the proof in tests.
+ */
+export async function buyRecord(quoteUrl, { privateKey, account = privateKeyToAccount(privateKey), fangorn, maxPrice, fetchImpl = fetch, deps = {} } = {}) {
+    const first = await fetchImpl(quoteUrl);
+    if (first.status !== 402) throw new Error(`${quoteUrl}: expected a 402 quote, got HTTP ${first.status} ${(await first.text()).slice(0, 200)}`);
+    const req = choose(paymentRequired(first).accepts, { maxPrice });
+    const { record, fields, deposit, relay } = await first.json();
+    const terms = req.extra.terms;
+    // The quote is the app's word; the terms are the publisher's, and must be this record's.
+    if (terms.publisher.toLowerCase() !== record.publisher.toLowerCase() || terms.repo !== repoId(record.repo) || terms.key !== recordKey(record.id))
+        throw new Error("the quote's terms are for another record");
+    const subject = subjectOf(terms.publisher, terms.repo, terms.key);
+    // Every sealed field must be readable before anything is paid: a sale we can't open is money lost.
+    const storage = fangorn.getStorage(), held = new Map();
+    for (const h of Object.values(fields)) {
+        try { held.set(h.cid, await storage.getFile(h.cid)); }
+        catch (e) { throw new Error(`not buying: the record's sealed data (${h.cid}) can't be read: ${e.message}`); }
+    }
+
+    const config = fangorn.getConfig(), settlement = fangorn.getSettlementRegistry();
+    const pub = deps.pub ?? createPublicClient({ transport: http(config.rpcUrl) });
+    const members = deps.members ?? ((s) => settlement.membersOf(s).then((m) => [...m]));
+    const { identity, reader } = await identityOf(account);
+
+    let tx = null;
+    if (!(await settlement.canRead(reader.address, terms.publisher, terms.repo, terms.key))) {
+        if (!(await settlement.isRegistered(subject, identity.commitment))) {
+            const salt = toHex(crypto.getRandomValues(new Uint8Array(32)));
+            const payment = await signPayment(req, account, { subject, commitment: identity.commitment, salt });
+            const payload = { commitment: identity.commitment.toString(), salt, payment };
+            const paid = await fetchImpl(quoteUrl, { headers: { "PAYMENT-SIGNATURE": b64(JSON.stringify({ x402Version: 2, accepted: req, payload })) } });
+            if (!paid.ok) throw new Error(`payment refused: ${(await paid.json().catch(() => ({}))).error ?? `HTTP ${paid.status}`}`);
+            tx = JSON.parse(unb64(paid.headers.get("PAYMENT-RESPONSE") ?? b64("{}"))).transaction || null;
+            if (tx) await pub.waitForTransactionReceipt({ hash: tx });
+        }
+        // A load-balanced RPC can answer from a node behind the one that mined `register`:
+        // our commitment is registered, so read until it shows up.
+        const has = (g) => !!deps.members || g.some((c) => BigInt(c) === identity.commitment);
+        let group = await members(subject);
+        for (let i = 0; i < 10 && !has(group); i++) {
+            await new Promise((r) => setTimeout(r, 3000));
+            group = await members(subject);
+        }
+        if (!has(group)) throw new Error("our commitment is registered but the RPC doesn't show it yet; retry the purchase");
+        const proof = await (deps.prove ?? prove)({ identity, members: group, reader: reader.address, subject });
+        const res = await fetchImpl(`${relay}/relay/settle`, { method: "POST", headers: { "content-type": "application/json" },
+            body: JSON.stringify({ subject, reader: reader.address, ...proof }) });
+        const out = await res.json().catch(() => ({}));
+        if (!res.ok) throw new Error(`settle refused: ${out.error ?? `HTTP ${res.status}`}`);
+        await pub.waitForTransactionReceipt({ hash: out.tx });
+    }
+
+    const opened = {};
+    for (const [field, handle] of Object.entries(fields)) {
+        const bytes = await openField({ handle, deposit, key: terms.key, field, signer: reader, storage: { getFile: async (cid) => held.get(cid) ?? storage.getFile(cid) }, fetch: fetchImpl });
+        opened[field] = JSON.parse(new TextDecoder().decode(bytes));
+    }
+    return { record, fields: opened, price: req.amount, tx };
 }
 
-// ── self-check: `node src/agent/x402.js` — a stand-in seller that checks the signature ──
-if (typeof process !== "undefined" && import.meta.url === `file://${process.argv[1]}` && process.argv[1].endsWith("/x402.js")) {
-    const { privateKeyToAccount, generatePrivateKey } = await import("viem/accounts");
-    const { verifyTypedData } = await import("viem");
-    const buyer = privateKeyToAccount(generatePrivateKey());
-    const USDC = "0x75faf114eafb1BDbe2F0316DF893fd58CE46AA4d", SELLER = `0x${"5e".repeat(20)}`;
-    const req = { scheme: "exact", network: "arbitrum-sepolia", maxAmountRequired: "10000", resource: "https://x/paid/1",
-                  payTo: SELLER, asset: USDC, maxTimeoutSeconds: 120, extra: { name: "USD Coin", version: "2" } };
-    let settled = null;
-    const seller = async (url, init = {}) => {
-        const h = init.headers?.["X-PAYMENT"];
-        if (!h) return new Response(JSON.stringify({ x402Version: 1, accepts: [req] }), { status: 402 });
-        const p = JSON.parse(unb64(h)).payload, a = p.authorization;
-        const ok = await verifyTypedData({ address: a.from, signature: p.signature,
-            domain: { name: "USD Coin", version: "2", chainId: 421614, verifyingContract: USDC },
-            types: { TransferWithAuthorization: [{ name: "from", type: "address" }, { name: "to", type: "address" }, { name: "value", type: "uint256" },
-                { name: "validAfter", type: "uint256" }, { name: "validBefore", type: "uint256" }, { name: "nonce", type: "bytes32" }] },
-            primaryType: "TransferWithAuthorization",
-            message: { ...a, value: BigInt(a.value), validAfter: BigInt(a.validAfter), validBefore: BigInt(a.validBefore) } });
-        if (!ok || a.to !== SELLER || a.value !== "10000") return new Response(JSON.stringify({ error: "bad payment" }), { status: 402 });
-        settled = a;
-        return new Response('{"secret":42}', { status: 200, headers: { "X-PAYMENT-RESPONSE": b64(JSON.stringify({ success: true, transaction: "0xabc" })) } });
+// ── self-check: `node src/agent/x402.js` — a stand-in app, relay and key server; no chain ──
+if (import.meta.url === `file://${globalThis.process?.argv?.[1]}` && process.argv[1].endsWith("/x402.js")) {
+    const { x25519 } = await import("@noble/curves/ed25519");
+    const { generatePrivateKey } = await import("viem/accounts");
+    const { recoverTypedDataAddress } = await import("viem");
+    const sdk = await import("@fangorn-network/sdk");
+    const { testKeyServer } = await import("@fangorn-network/sdk/lib/test/key-server.js");
+    const eq = (a, b, m) => { if (JSON.stringify(a) !== JSON.stringify(b)) throw new Error(`${m}: ${JSON.stringify(a)} != ${JSON.stringify(b)}`); };
+
+    const publisher = privateKeyToAccount(generatePrivateKey()), buyer = privateKeyToAccount(generatePrivateKey());
+    const REGISTRY = `0x${"e0".repeat(20)}`, USDC = `0x${"aa".repeat(20)}`, REFERRER = `0x${"fe".repeat(20)}`;
+    const repo = sdk.repoId("notes"), key = sdk.recordKey("a");
+    const scope = { chainId: 84532, registry: REGISTRY, publisher: publisher.address, repo, generation: 0n };
+    const ksSecret = x25519.utils.randomSecretKey(), kRepo = sdk.newRepoKey();
+    const deposit = sdk.makeDeposit({ kRepo, keyServerPubkey: x25519.getPublicKey(ksSecret), keyServer: "https://keys.test", scope });
+    const files = new Map();
+    const storage = { putFile: async (b) => { const cid = `bafy${files.size}`; files.set(cid, b); return cid; }, getFile: async (cid) => files.get(cid) };
+    const body = await sdk.sealField({ plaintext: new TextEncoder().encode(JSON.stringify({ text: "the body" })), kRepo, scope, key, field: "body", storage });
+    const terms = { publisher: publisher.address, repo, key, price: "10000", shareBps: 500, generation: "0", deadline: "2000000000" };
+    const req = { scheme: "fangorn", network: "eip155:84532", amount: "10000", asset: USDC, payTo: REGISTRY, maxTimeoutSeconds: 300,
+                  extra: { terms, signature: "0x12", referrer: REFERRER, name: "USDC", version: "2" } };
+
+    // The chain as the buyer sees it: settled once the relay has the proof.
+    let settled = false, registered = false, signed = null, proven = null;
+    const fangorn = { getConfig: () => ({ rpcUrl: "http://unused", fromBlock: 0n }), getStorage: () => storage,
+        getSettlementRegistry: () => ({ getAddress: () => REGISTRY, canRead: async () => settled, isRegistered: async () => registered }) };
+    const pub = { waitForTransactionReceipt: async () => ({}) };
+    const quoteUrl = `https://app.test/paid/${publisher.address}/notes/a`;
+    const fetchImpl = async (url, init = {}) => {
+        if (url === quoteUrl) {
+            const pay = init.headers?.["PAYMENT-SIGNATURE"];
+            if (!pay) return new Response(JSON.stringify({ record: { publisher: publisher.address, repo: "notes", id: "a" }, fields: { body }, deposit, relay: "https://relay.test" }),
+                { status: 402, headers: { "PAYMENT-REQUIRED": b64(JSON.stringify({ x402Version: 2, accepts: [req] })) } });
+            signed = JSON.parse(unb64(pay)).payload;
+            registered = true;
+            return new Response("{}", { headers: { "PAYMENT-RESPONSE": b64(JSON.stringify({ success: true, transaction: "0xabc" })) } });
+        }
+        if (url === "https://relay.test/relay/settle") { proven = JSON.parse(init.body); settled = true; return new Response(JSON.stringify({ tx: "0xdef" })); }
+        if (url === "https://keys.test/access") return testKeyServer(JSON.parse(init.body), { secret: ksSecret, chainId: 84532, registry: REGISTRY,
+            canRead: async (r) => settled && r === proven.reader });
+        throw new Error(`unexpected fetch ${url}`);
     };
-    const r = await payAndFetch("https://x/paid/1", { account: buyer, maxPrice: 10000n, fetchImpl: seller });
-    if (r.body !== '{"secret":42}' || r.receipt.transaction !== "0xabc" || settled.from !== buyer.address) throw new Error(`paid fetch: ${JSON.stringify(r)}`);
-    let refused = false;
-    try { await payAndFetch("https://x/paid/1", { account: buyer, maxPrice: 9999n, fetchImpl: seller }); } catch (e) { refused = /exceeds the cap/.test(e.message); }
-    if (!refused) throw new Error("a price over the cap must be refused before signing");
-    console.log("x402.js self-check ok — a signed EIP-3009 authorization the seller can verify, exactly the asked amount to the asked payee, the receipt read back, and a price over the cap refused before signing");
+    const deps = { pub, members: async () => [1n], prove: async ({ reader, subject }) => ({ merkleTreeDepth: "1", merkleTreeRoot: "1", nullifier: "1", points: Array(8).fill("0"), reader, subject }) };
+
+    await buyRecord(quoteUrl, { account: buyer, fangorn, fetchImpl, deps, maxPrice: 9999n }).then(() => { throw new Error("over the cap must refuse"); },
+        (e) => { if (!/exceeds the cap/.test(e.message)) throw e; });
+    eq(signed, null, "nothing is signed over the cap");
+    const gone = { ...fangorn, getStorage: () => ({ getFile: async () => { throw new Error("HTTP 404"); } }) };
+    await buyRecord(quoteUrl, { account: buyer, fangorn: gone, fetchImpl, deps }).then(() => { throw new Error("unreadable data must refuse"); },
+        (e) => { if (!/can't be read/.test(e.message)) throw e; });
+    eq(signed, null, "nothing is paid for data that can't be read");
+
+    const got = await buyRecord(quoteUrl, { account: buyer, fangorn, fetchImpl, deps, maxPrice: 10000n });
+    eq([got.fields, got.price, got.tx], [{ body: { text: "the body" } }, "10000", "0xabc"], "paid, settled, and the field opens as JSON");
+    const { identity, reader } = await identityOf(buyer);
+    eq([signed.commitment, proven.reader, proven.subject], [identity.commitment.toString(), reader.address, subjectOf(publisher.address, repo, key)], "the payment carries the identity; the proof names the reader");
+    if (reader.address === buyer.address) throw new Error("the reader must not be the paying wallet");
+    const p = signed.payment;
+    const from = await recoverTypedDataAddress({ domain: { name: "USDC", version: "2", chainId: 84532, verifyingContract: USDC },
+        types: { ReceiveWithAuthorization: [{ name: "from", type: "address" }, { name: "to", type: "address" }, { name: "value", type: "uint256" },
+            { name: "validAfter", type: "uint256" }, { name: "validBefore", type: "uint256" }, { name: "nonce", type: "bytes32" }] },
+        primaryType: "ReceiveWithAuthorization", message: { from: p.from, to: p.payTo ?? REGISTRY, value: BigInt(p.value), validAfter: 0n, validBefore: BigInt(p.validBefore), nonce: p.nonce },
+        signature: concat([p.r, p.s, toHex(p.v, { size: 1 })]) });
+    eq([from, p.value, p.nonce], [buyer.address, "10000", registerNonce(subjectOf(publisher.address, repo, key), identity.commitment, REFERRER, signed.salt)],
+        "an ERC-3009 authorization from the buyer for exactly the price, its nonce bound to this purchase and referrer");
+
+    signed = null;
+    const again = await buyRecord(quoteUrl, { account: buyer, fangorn, fetchImpl, deps });
+    eq([again.fields.body.text, signed, again.tx], ["the body", null, null], "a reader that can already read pays nothing again");
+
+    const other = { ...req, extra: { ...req.extra, terms: { ...terms, key: sdk.recordKey("b") } } };
+    const lying = async (url, init) => url === quoteUrl && !init?.headers ? new Response(JSON.stringify({ record: { publisher: publisher.address, repo: "notes", id: "a" }, fields: { body }, deposit, relay: "https://relay.test" }),
+        { status: 402, headers: { "PAYMENT-REQUIRED": b64(JSON.stringify({ x402Version: 2, accepts: [other] })) } }) : fetchImpl(url, init);
+    await buyRecord(quoteUrl, { account: privateKeyToAccount(generatePrivateKey()), fangorn, fetchImpl: lying, deps }).then(() => { throw new Error("must refuse"); },
+        (e) => { if (!/another record/.test(e.message)) throw e; });
+    console.log("x402.js self-check ok — the cap holds before signing, the payment is an ERC-3009 authorization bound to this purchase, the proof names a reader that isn't the wallet, a retry pays nothing, a quote for another record is refused, nothing is paid when the sealed data can't be read, and the field opens");
 }

package/src/core/embed.js

@@ -1,55 +1,58 @@
-// In-browser query embedder. Lifted from embeddings/examples/src/lib/embed.ts —
-// the query vector MUST come out of the same model and post-processing as the
+// The network's one embedding model, on both sides of every search. The query
+// vector MUST come out of the same model, prompt and post-processing as the
 // document vectors in the shard, or cosine is meaningless.
 //
-// Document side (quickbeam/embeddings.py): fastembed nomic-embed-text-v1.5 on
-//   "search_document: " + text, then matryoshka(vec, 256).
-// Query side (here): same model on "search_query: " + text (nomic is asymmetric),
-//   then the identical matryoshka.
+// EmbeddingGemma-300m, asymmetric by prompt (QUERY / DOCUMENT below), truncated
+// to 256 dims (it is Matryoshka-trained) and L2-normalized. Two runtimes run it:
+//   - a Fangorn app's Worker (Workers AI `@cf/google/embeddinggemma-300m`), the
+//     free tier's indexer (site/worker.js), on the document side;
+//   - transformers.js here, in a reader's tab or a Node publisher, on either side.
+// They agree closely but not bit for bit, so a view names its `embedder` and is only
+// ever appended to by the runtime that made it (view.js).
 //
-// If the embedding pipeline switches model or dim, change MODEL/DIM here to match.
-// transformers.js is dynamically imported so its ~MB runtime stays out of the main
+// transformers.js is dynamically imported so its runtime stays out of the main
 // bundle and a load failure degrades to lexical search instead of breaking the app.
 
-const MODEL = "nomic-ai/nomic-embed-text-v1.5";
+const MODEL = "google/embeddinggemma-300m";
+const ONNX = "onnx-community/embeddinggemma-300m-ONNX";
 const DIM = 256;
-// The document side's precision. q8 everywhere by default (the browser's queries are q8).
-// WESTMARCH_EMBED_DTYPE=fp16 is a different encoder (~0.96 cosine to q8): a view records it
-// and refuses to mix the two (view.js), so switching an app is one --rebake.
+/** The model card's retrieval prompts. Exported so every runtime uses the same text. */
+export const QUERY = "task: search result | query: ";
+export const DOCUMENT = "title: none | text: ";
+// The document side's precision in transformers.js. q8 by default (the browser's queries are q8).
+// EmbeddingGemma's activations do not survive fp16; WESTMARCH_EMBED_DTYPE=fp32 is the slow exact one.
 const DTYPE = globalThis.process?.env?.WESTMARCH_EMBED_DTYPE ?? "q8";
 export const EMBED_DTYPE = DTYPE;
 
-// Stamped onto every vector a publisher commits. Vectors from different models
-// (or dims) are not comparable — cosine between them is noise, and silently so.
-// The shard bake drops any vector whose stamp doesn't match rather than blending
-// corpora, which is the one thing that can quietly ruin a shared index.
+// Stamped onto every view. Vectors from different models (or dims) are not
+// comparable — cosine between them is noise, and silently so.
 export const EMBED_MODEL = MODEL;
 export const EMBED_DIM = DIM;
+/** A short name for the space a taste or a reaction lives in. */
+export const SPACE = `embeddinggemma-${DIM}`;
 
-let _extractor = null;
-const extractor = () => (_extractor ??= (async () => {
-    const { pipeline } = await import("@huggingface/transformers");
-    // WESTMARCH_EMBED_DEVICE=cuda puts the publisher's document side on a GPU (Node only; needs
-    // onnxruntime-node's CUDA binaries and the matching CUDA runtime, cuBLAS, cuRAND and cuDNN on
-    // LD_LIBRARY_PATH). q8's integer ops do not run on CUDA, so q8 there is slower than on CPU:
-    // pair it with WESTMARCH_EMBED_DTYPE=fp16, which is ~4x faster than CPU q8, batched.
+let _model = null, _progress = null;
+/** Hear the model download: transformers.js's own events ({status, file, loaded, total}), on
+ *  the thread that loads it (the page's own worker, when it calls the *Direct functions). */
+export const onModelProgress = (f) => { _progress = f; };
+const model = () => (_model ??= (async () => {
+    const { AutoModel, AutoTokenizer } = await import("@huggingface/transformers");
+    // WESTMARCH_EMBED_DEVICE=cuda puts a Node publisher's document side on a GPU.
     const device = globalThis.process?.env?.WESTMARCH_EMBED_DEVICE;
-    return pipeline("feature-extraction", MODEL, { dtype: DTYPE, ...(device && { device }) });
+    const progress_callback = (p) => _progress?.(p);
+    const [tokenizer, m] = await Promise.all([AutoTokenizer.from_pretrained(ONNX, { progress_callback }),
+        AutoModel.from_pretrained(ONNX, { dtype: DTYPE, progress_callback, ...(device && { device }) })]);
+    // `sentence_embedding`, not mean pooling: the model's dense head runs after the pool.
+    return async (texts) => {
+        const { sentence_embedding: e } = await m(await tokenizer(texts, { padding: true, truncation: true }));
+        const d = e.dims.at(-1);
+        return texts.map((_, j) => matryoshka(e.data.slice(j * d, (j + 1) * d)));
+    };
 })());
 
-/** Standardize over the full vector, slice to `dim`, L2-normalize the slice. */
-function matryoshka(vec, dim = DIM) {
-    const n = vec.length;
-    let mean = 0;
-    for (let i = 0; i < n; i++) mean += vec[i];
-    mean /= n;
-    let varsum = 0;
-    for (let i = 0; i < n; i++) varsum += (vec[i] - mean) ** 2;
-    const std = Math.sqrt(varsum / n + 1e-5);
-
-    const out = new Array(Math.min(dim, n));
-    for (let i = 0; i < out.length; i++) out[i] = (vec[i] - mean) / std;
-
+/** Truncate to `dim` and L2-normalize: EmbeddingGemma's Matryoshka truncation. */
+export function matryoshka(vec, dim = DIM) {
+    const out = Array.from(vec.slice(0, dim), Number);
     let norm = 0;
     for (const x of out) norm += x * x;
     norm = Math.sqrt(norm);
@@ -60,9 +63,8 @@ function matryoshka(vec, dim = DIM) {
 /** Free text → 256-d L2-normalized vector. Throws if the model can't load —
  *  callers fall back to lexical. First call downloads the model (slow). */
 export async function embedQueryDirect(text) {
-    const ex = await extractor();
-    const output = await ex(`search_query: ${text}`, { pooling: "mean", normalize: false });
-    return matryoshka(output.data);
+    const [v] = await (await model())([QUERY + text]);
+    return v;
 }
 
 /** One document, in-process. Calls made together are embedded as one batch (a GPU's
@@ -79,20 +81,22 @@ async function flushDocuments() {
     const all = pending;
     pending = [];
     try {
-        const ex = await extractor();
-        for (let i = 0; i < all.length; i += BATCH) {
-            const part = all.slice(i, i + BATCH);
-            const output = await ex(part.map((p) => `search_document: ${p.text}`), { pooling: "mean", normalize: false });
-            const d = output.dims.at(-1);
-            part.forEach((p, j) => p.resolve(matryoshka(output.data.slice(j * d, (j + 1) * d))));
-        }
+        const vs = await embedRaw(all.map((p) => DOCUMENT + p.text));
+        all.forEach((p, j) => p.resolve(vs[j]));
     } catch (e) {
         for (const p of all) p.reject(e);
     }
 }
 
+/** Texts that already carry their prompt → vectors, in-process: a stand-in for the Worker's AI binding (devnet.js). */
+export async function embedRaw(texts) {
+    const run = await model(), out = [];
+    for (let i = 0; i < texts.length; i += BATCH) out.push(...await run(texts.slice(i, i + BATCH)));
+    return out;
+}
+
 /** Load the model in-process, and settle when it is actually ready. */
-export const warmDirect = () => extractor().then(() => {});
+export const warmDirect = () => model().then(() => {});
 
 // ── off the main thread ──────────────────────────────────────────────────────
 //
@@ -136,9 +140,8 @@ const ask = (kind, text) => new Promise((resolve, reject) => {
 export const embedQuery = (text) => (offThread() ? ask("query", text) : embedQueryDirect(text));
 
 /**
- * Document side. Same model, the OTHER nomic prefix — it's an asymmetric model,
- * so documents embedded with "search_query: " would rank against real queries
- * about as well as random.
+ * Document side. Same model, the OTHER prompt — it's asymmetric, so documents
+ * embedded with the query prompt rank against real queries worse.
  *
  * Runs one at a time on purpose: this executes in a publisher's browser during
  * publish, and a batch large enough to matter is a batch large enough to lock
@@ -235,7 +238,7 @@ export function unpackBits(b64) {
  * focus — the pipeline is a memoized singleton on whichever thread owns it.
  *
  * Call this on INTENT (the search box taking focus), never on page load: it is a
- * 131MB download, and until someone types there is nothing for it to embed. The
+ * ~300MB download, and until someone types there is nothing for it to embed. The
  * whole first-paint path — browse, shelves, channels, the field, the compass —
  * runs on the document vectors already in the shard.
  */
@@ -245,7 +248,7 @@ export const warmEmbedder = () => {
 };
 
 // ── self-check: `node src/llm/embed.js` — quantization only, no model download ────
-if (typeof process !== "undefined" && import.meta.url === `file://${process.argv[1]}` && process.argv[1].endsWith("/embed.js")) {
+if (import.meta.url === `file://${globalThis.process?.argv?.[1]}` && process.argv[1].endsWith("/embed.js")) {
     const v = matryoshka(Array.from({ length: 768 }, (_, i) => Math.sin(i)));
     let norm = 0;
     for (const x of v) norm += x * x;