@genkaku/protocol 0.1.10 → 0.1.12

package/dist/bridge.d.ts

@@ -13,6 +13,8 @@ export type BridgeStatus = {
         offer: ReturnType<typeof toWire>;
     }>;
     url: string;
+    /** addr → the path its last session took: direct libp2p or the seed relay. */
+    transports?: Record<string, 'direct' | 'relay'>;
 };
 export type BridgeOptions = {
     workers: string[];
@@ -25,6 +27,8 @@ export type BridgeOptions = {
     settle: boolean;
     log: (line: string) => void;
     /** optional extra fields merged over the base status JSON (dashboard extension hook) */
+    /** Relay hops to fall back to once a direct dial keeps failing. */
+    getRelays?: () => Promise<string[]>;
     status?: (base: BridgeStatus) => Record<string, unknown> | Promise<Record<string, unknown>>;
     /** optional live mode switch from POST /genkaku/mode */
     onMode?: (mode: RoleMode) => void | Promise<void>;

package/dist/bridge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bridge.d.ts","sourceRoot":"","sources":["../src/bridge.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AACpC,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,MAAM,CAAA;AAc/B,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AACpD,OAAO,EAAgB,MAAM,EAAc,MAAM,YAAY,CAAA;AAI7D,uEAAuE;AACvE,MAAM,MAAM,YAAY,GAAG;IACzB,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,UAAU,CAAC,OAAO,MAAM,CAAC,CAAA;KAAE,CAAC,CAAA;IACjE,GAAG,EAAE,MAAM,CAAA;CACZ,CAAA;AAED,MAAM,MAAM,aAAa,GAAG;IAC1B,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,EAAE,cAAc,CAAA;IACnB,WAAW,EAAE,WAAW,CAAA;IACxB,OAAO,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;IAC9B,OAAO,EAAE,MAAM,GAAG,CAAA;IAClB,yEAAyE;IACzE,MAAM,EAAE,OAAO,CAAA;IACf,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IAC3B,wFAAwF;IACxF,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,YAAY,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IAC3F,wDAAwD;IACxD,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACjD;4DACwD;IACxD,MAAM,CAAC,EAAE,CACP,OAAO,EAAE,MAAM,EAAE,KACd,GAAG,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAA;CAClH,CAAA;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAC3B,CAAA;AAuJD,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,CAmflF"}
+{"version":3,"file":"bridge.d.ts","sourceRoot":"","sources":["../src/bridge.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AACpC,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,MAAM,CAAA;AAc/B,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AACpD,OAAO,EAAgB,MAAM,EAAc,MAAM,YAAY,CAAA;AAI7D,uEAAuE;AACvE,MAAM,MAAM,YAAY,GAAG;IACzB,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,UAAU,CAAC,OAAO,MAAM,CAAC,CAAA;KAAE,CAAC,CAAA;IACjE,GAAG,EAAE,MAAM,CAAA;IACX,8EAA8E;IAC9E,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,CAAA;CAChD,CAAA;AAED,MAAM,MAAM,aAAa,GAAG;IAC1B,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,EAAE,cAAc,CAAA;IACnB,WAAW,EAAE,WAAW,CAAA;IACxB,OAAO,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;IAC9B,OAAO,EAAE,MAAM,GAAG,CAAA;IAClB,yEAAyE;IACzE,MAAM,EAAE,OAAO,CAAA;IACf,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IAC3B,wFAAwF;IACxF,mEAAmE;IACnE,SAAS,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;IACnC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,YAAY,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IAC3F,wDAAwD;IACxD,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACjD;4DACwD;IACxD,MAAM,CAAC,EAAE,CACP,OAAO,EAAE,MAAM,EAAE,KACd,GAAG,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAA;CAClH,CAAA;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAC3B,CAAA;AAuJD,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,CA6flF"}

package/dist/bridge.js

@@ -5,7 +5,7 @@
 import { appendFileSync } from 'node:fs';
 import { createServer } from 'node:http';
 import { openEscrow, publicClientFor, readWorker, refundSession, settleSession, signReceiptPayload, walletAddress, walletClientFor, } from "./chain.js";
-import { dialWorker, fetchOffers, requestSettleCosign } from "./dial.js";
+import { dialWorkerAny, fetchOffers, requestSettleCosign } from "./dial.js";
 import { dedupeOffers, toWire } from "./offer.js";
 import { bindingOf, peerIdOf } from "./registry.js";
 import { runUserSession } from "./userSession.js";
@@ -140,6 +140,7 @@ setInterval(load,5000);
 </html>`;
 export async function startOpenAiBridge(opts) {
     const cache = new Map();
+    const transports = new Map();
     let bridgeUrl = '';
     async function offersOf(addr) {
         const hit = cache.get(addr);
@@ -245,6 +246,7 @@ export async function startOpenAiBridge(opts) {
             wallet: walletAddress(opts.userKey()),
             offers,
             url: bridgeUrl,
+            ...(transports.size === 0 ? {} : { transports: Object.fromEntries(transports) }),
         };
         const extra = opts.status == null ? undefined : await opts.status(base);
         json(res, 200, extra == null ? base : { ...base, ...extra });
@@ -317,7 +319,13 @@ export async function startOpenAiBridge(opts) {
             }
         }
         const node = await opts.getNode();
-        const transport = await dialWorker(node, picked.addr);
+        const relays = opts.getRelays == null ? [] : await opts.getRelays().catch(() => []);
+        const dialed = await dialWorkerAny(node, picked.addr, { relays });
+        const transport = dialed.transport;
+        transports.set(picked.addr, dialed.route);
+        if (dialed.route === 'relay') {
+            opts.log(`transport: ${picked.addr} reached through the seed relay`);
+        }
         const jobId = `dsh-${Date.now().toString(36)}`;
         const created = Math.floor(Date.now() / 1000);
         const id = `chatcmpl-${jobId}`;
@@ -465,7 +473,9 @@ export async function startOpenAiBridge(opts) {
                     debugLog(`receipt ${jobId}: hash=${receiptHash} billed=${result.billed} tokens=${result.tokens}`);
                     await settle({
                         node,
-                        addr: picked.addr,
+                        // Co-sign over the same path the session used: a worker behind NAT
+                        // is only reachable through its relay address.
+                        addr: dialed.addr,
                         walletC,
                         jobId,
                         escrowId,

package/dist/chain.d.ts

@@ -426,12 +426,20 @@ export declare const MAX_LOCATOR_ADDRS = 4;
  *  never contains it, so parsing stays unambiguous. */
 export declare function locatorOf(addrs: readonly string[], maxBytes?: number, maxCount?: number): string;
 /** True when this address is reachable from the public internet. LAN, loopback,
- *  link-local and CGNAT (100.64/10) ranges are local-only; a relay address is
- *  signaling, not a data path (P4.9g). A user-supplied DNS name is trusted. */
+ *  link-local and CGNAT (100.64/10) ranges are local-only. A `/p2p-circuit`
+ *  address is dialable when its relay hop is a public host: the relay forwards
+ *  the stream, so a worker behind NAT is still reachable through it (P5). */
 export declare function isPublicAddr(addr: string): boolean;
 /** Does this peer announce any address the global directory can use? Without
  *  one, on-chain presence only advertises a dead end (P4.9g §39). */
 export declare function hasPublicAddr(addrs: readonly string[]): boolean;
+/** How this peer is reachable to the internet, best first: a direct public
+ *  address, a relay circuit through a public hop, or LAN only. The worker panel
+ *  reports this instead of guessing from a bare address list. */
+export declare function transportOf(addrs: readonly string[]): 'direct' | 'relay' | 'lan';
+/** The address a client should try first: a public direct address, then a
+ *  relay circuit, then anything (LAN) for a same-network peer. */
+export declare function preferredAddr(addrs: readonly string[]): string | undefined;
 /** Split a locator back into multiaddrs (tolerates `;`, newline, whitespace). */
 export declare function parseLocator(locator: string): string[];
 /** Register (or re-pin) AND publish the locator in one transaction. */

package/dist/chain.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"chain.d.ts","sourceRoot":"","sources":["../src/chain.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,MAAM,CAAA;AAKjF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAEpD,OAAO,EAAgB,KAAK,gBAAgB,EAAc,MAAM,eAAe,CAAA;AAE/E,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA6Fb,CAAA;AAEV,6EAA6E;AAC7E,MAAM,MAAM,aAAa,GAAG;IAC1B,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,KAAK,MAAM,EAAE,CAAA;IACnB,MAAM,EAAE,KAAK,MAAM,EAAE,CAAA;IACrB,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,OAAO,CAAA;IAChB,QAAQ,EAAE,OAAO,CAAA;CAClB,CAAA;AAED;iFACiF;AACjF,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,cAAc,EACnB,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAe/B;AAED;;;0EAG0E;AAC1E,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAiFf,CAAA;AAEV,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA2BX,CAAA;AAaV;kFACkF;AAClF;gFACgF;AAChF,wBAAgB,eAAe,CAAC,GAAG,EAAE,cAAc,GAAG,YAAY,CAEjE;AAED;gFACgF;AAChF,oEAAoE;AACpE,wBAAgB,eAAe,CAC7B,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,KAAK,MAAM,EAAE,GACjB,YAAY,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,CAMzC;AAED,MAAM,MAAM,aAAa,GAAG,UAAU,CAAC,OAAO,eAAe,CAAC,CAAA;AAC9D,MAAM,MAAM,aAAa,GAAG,UAAU,CAAC,OAAO,eAAe,CAAC,CAAA;AAI9D;;6DAE6D;AAC7D,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,UAAU,CAQpG;AAED;0EAC0E;AAC1E,wBAAgB,cAAc,CAAC,OAAO,EAAE,gBAAgB,GAAG,KAAK,MAAM,EAAE,CAEvE;AAID,wBAAsB,WAAW,CAAC,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,KAAK,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAgBrH;AAED,qEAAqE;AACrE,MAAM,MAAM,cAAc,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAA;AAE1D;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,KAAK,MAAM,EAAE,GACpB,OAAO,CAAC,cAAc,CAAC,CAazB;AAED;yDACyD;AACzD,wBAAgB,aAAa,CAAC,GAAG,EAAE,KAAK,MAAM,EAAE,GAAG,KAAK,MAAM,EAAE,CAE/D;AAID;;4CAE4C;AAC5C,wBAAsB,UAAU,CAC9B,OAAO,EAAE,aAAa,EACtB,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,KAAK,MAAM,EAAE,EACrB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAmFjD;AAED,wBAAsB,aAAa,CACjC,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,KAAK,MAAM,EAAE,CAAA;CAAE,GAC9F,OAAO,CAAC,KAAK,MAAM,EAAE,CAAC,CAcxB;AAED;;4DAE4D;AAC5D,wBAAsB,aAAa,CACjC,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,cAAc,EACnB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,KAAK,MAAM,EAAE,CAAC,CAUxB;AAED,wBAAsB,YAAY,CAAC,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,KAAK,MAAM,EAAE,CAAC,CActG;AAID,+EAA+E;AAC/E,wBAAsB,UAAU,CAC9B,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,KAAK,MAAM,EAAE,GACpB,OAAO,CAAC;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,KAAK,MAAM,EAAE,CAAC;IAAC,UAAU,EAAE,KAAK,MAAM,EAAE,CAAA;CAAE,GAAG,IAAI,CAAC,CAoBvF;AAED;;;yBAGyB;AACzB,wBAAsB,cAAc,CAClC,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE;IAAE,YAAY,EAAE,KAAK,MAAM,EAAE,CAAC;IAAC,UAAU,EAAE,KAAK,MAAM,EAAE,CAAA;CAAE,GAC/D,OAAO,CAAC;IAAE,MAAM,EAAE,KAAK,MAAM,EAAE,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAoBtD;AAED,yEAAyE;AACzE,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,cAAc,EAAE,MAAM,CAGhE,CAAA;AAED,+EAA+E;AAC/E,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,cAAc,EAAE,MAAM,CAG9D,CAAA;AAED,kEAAkE;AAClE,eAAO,MAAM,iBAAiB,MAAM,CAAA;AACpC,iFAAiF;AACjF,eAAO,MAAM,iBAAiB,IAAI,CAAA;AAElC;;;;uDAIuD;AACvD,wBAAgB,SAAS,CACvB,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,QAAQ,SAAoB,EAC5B,QAAQ,SAAoB,GAC3B,MAAM,CA8BR;AAED;;+EAE+E;AAC/E,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CA+BlD;AAED;qEACqE;AACrE,wBAAgB,aAAa,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAE/D;AAED,iFAAiF;AACjF,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAKtD;AAED,uEAAuE;AACvE,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE;IAAE,YAAY,EAAE,KAAK,MAAM,EAAE,CAAC;IAAC,UAAU,EAAE,KAAK,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAChF,OAAO,CAAC,KAAK,MAAM,EAAE,CAAC,CAkBxB;AAED;+EAC+E;AAC/E,wBAAsB,eAAe,CACnC,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,KAAK,MAAM,EAAE,CAAC,CAkBxB;AAED;uEACuE;AACvE,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,cAAc,GAClB,OAAO,CAAC,KAAK,MAAM,EAAE,CAAC,CAkBxB;AAED,uEAAuE;AACvE,MAAM,MAAM,cAAc,GAAG;IAC3B,MAAM,EAAE,KAAK,MAAM,EAAE,CAAA;IACrB,MAAM,EAAE,KAAK,MAAM,EAAE,CAAA;IACrB,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,MAAM,CAAA;CACpB,CAAA;AAED,6EAA6E;AAC7E,KAAK,MAAM,GAAG;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAA;AAG3D,2EAA2E;AAC3E,KAAK,aAAa,GAAG,OAAO,CAC1B,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,EAC3D;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,CAClB,CAAA;AAaD;;;eAGe;AACf,wBAAsB,WAAW,CAC/B,OAAO,EAAE,aAAa,EACtB,OAAO,EAAE,KAAK,MAAM,EAAE,EACtB,KAAK,EAAE,aAAa,EACpB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,KAAK,SAAI,GACP,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAkB7B;AAED;;;+CAG+C;AAC/C,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,cAAc,EACnB,IAAI,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,KAAK,MAAM,EAAE,CAAA;CAAO,GAC9F,OAAO,CAAC,cAAc,EAAE,CAAC,CAwE3B;AAED;;gFAEgF;AAChF,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAChE,OAAO,CAAC;IAAE,MAAM,EAAE,KAAK,MAAM,EAAE,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,EAAE,CAAC,CAmB3D;AAED,kEAAkE;AAClE,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,KAAK,MAAM,EAAE,EAAE,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAEvG"}
+{"version":3,"file":"chain.d.ts","sourceRoot":"","sources":["../src/chain.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,MAAM,CAAA;AAKjF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAEpD,OAAO,EAAgB,KAAK,gBAAgB,EAAc,MAAM,eAAe,CAAA;AAE/E,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA6Fb,CAAA;AAEV,6EAA6E;AAC7E,MAAM,MAAM,aAAa,GAAG;IAC1B,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,KAAK,MAAM,EAAE,CAAA;IACnB,MAAM,EAAE,KAAK,MAAM,EAAE,CAAA;IACrB,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,OAAO,CAAA;IAChB,QAAQ,EAAE,OAAO,CAAA;CAClB,CAAA;AAED;iFACiF;AACjF,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,cAAc,EACnB,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAe/B;AAED;;;0EAG0E;AAC1E,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAiFf,CAAA;AAEV,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA2BX,CAAA;AAaV;kFACkF;AAClF;gFACgF;AAChF,wBAAgB,eAAe,CAAC,GAAG,EAAE,cAAc,GAAG,YAAY,CAEjE;AAED;gFACgF;AAChF,oEAAoE;AACpE,wBAAgB,eAAe,CAC7B,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,KAAK,MAAM,EAAE,GACjB,YAAY,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,CAMzC;AAED,MAAM,MAAM,aAAa,GAAG,UAAU,CAAC,OAAO,eAAe,CAAC,CAAA;AAC9D,MAAM,MAAM,aAAa,GAAG,UAAU,CAAC,OAAO,eAAe,CAAC,CAAA;AAI9D;;6DAE6D;AAC7D,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,UAAU,CAQpG;AAED;0EAC0E;AAC1E,wBAAgB,cAAc,CAAC,OAAO,EAAE,gBAAgB,GAAG,KAAK,MAAM,EAAE,CAEvE;AAID,wBAAsB,WAAW,CAAC,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,KAAK,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAgBrH;AAED,qEAAqE;AACrE,MAAM,MAAM,cAAc,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAA;AAE1D;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,KAAK,MAAM,EAAE,GACpB,OAAO,CAAC,cAAc,CAAC,CAazB;AAED;yDACyD;AACzD,wBAAgB,aAAa,CAAC,GAAG,EAAE,KAAK,MAAM,EAAE,GAAG,KAAK,MAAM,EAAE,CAE/D;AAID;;4CAE4C;AAC5C,wBAAsB,UAAU,CAC9B,OAAO,EAAE,aAAa,EACtB,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,KAAK,MAAM,EAAE,EACrB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAmFjD;AAED,wBAAsB,aAAa,CACjC,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,KAAK,MAAM,EAAE,CAAA;CAAE,GAC9F,OAAO,CAAC,KAAK,MAAM,EAAE,CAAC,CAcxB;AAED;;4DAE4D;AAC5D,wBAAsB,aAAa,CACjC,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,cAAc,EACnB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,KAAK,MAAM,EAAE,CAAC,CAUxB;AAED,wBAAsB,YAAY,CAAC,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,KAAK,MAAM,EAAE,CAAC,CActG;AAID,+EAA+E;AAC/E,wBAAsB,UAAU,CAC9B,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,KAAK,MAAM,EAAE,GACpB,OAAO,CAAC;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,KAAK,MAAM,EAAE,CAAC;IAAC,UAAU,EAAE,KAAK,MAAM,EAAE,CAAA;CAAE,GAAG,IAAI,CAAC,CAoBvF;AAED;;;yBAGyB;AACzB,wBAAsB,cAAc,CAClC,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE;IAAE,YAAY,EAAE,KAAK,MAAM,EAAE,CAAC;IAAC,UAAU,EAAE,KAAK,MAAM,EAAE,CAAA;CAAE,GAC/D,OAAO,CAAC;IAAE,MAAM,EAAE,KAAK,MAAM,EAAE,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAoBtD;AAED,yEAAyE;AACzE,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,cAAc,EAAE,MAAM,CAGhE,CAAA;AAED,+EAA+E;AAC/E,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,cAAc,EAAE,MAAM,CAG9D,CAAA;AAED,kEAAkE;AAClE,eAAO,MAAM,iBAAiB,MAAM,CAAA;AACpC,iFAAiF;AACjF,eAAO,MAAM,iBAAiB,IAAI,CAAA;AAElC;;;;uDAIuD;AACvD,wBAAgB,SAAS,CACvB,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,QAAQ,SAAoB,EAC5B,QAAQ,SAAoB,GAC3B,MAAM,CA8BR;AAED;;;6EAG6E;AAC7E,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAqClD;AAED;qEACqE;AACrE,wBAAgB,aAAa,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAE/D;AAED;;iEAEiE;AACjE,wBAAgB,WAAW,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,QAAQ,GAAG,OAAO,GAAG,KAAK,CAKhF;AAED;kEACkE;AAClE,wBAAgB,aAAa,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAO1E;AAED,iFAAiF;AACjF,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAKtD;AAED,uEAAuE;AACvE,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE;IAAE,YAAY,EAAE,KAAK,MAAM,EAAE,CAAC;IAAC,UAAU,EAAE,KAAK,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAChF,OAAO,CAAC,KAAK,MAAM,EAAE,CAAC,CAkBxB;AAED;+EAC+E;AAC/E,wBAAsB,eAAe,CACnC,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,KAAK,MAAM,EAAE,CAAC,CAkBxB;AAED;uEACuE;AACvE,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,cAAc,GAClB,OAAO,CAAC,KAAK,MAAM,EAAE,CAAC,CAkBxB;AAED,uEAAuE;AACvE,MAAM,MAAM,cAAc,GAAG;IAC3B,MAAM,EAAE,KAAK,MAAM,EAAE,CAAA;IACrB,MAAM,EAAE,KAAK,MAAM,EAAE,CAAA;IACrB,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,MAAM,CAAA;CACpB,CAAA;AAED,6EAA6E;AAC7E,KAAK,MAAM,GAAG;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAA;AAG3D,2EAA2E;AAC3E,KAAK,aAAa,GAAG,OAAO,CAC1B,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,EAC3D;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,CAClB,CAAA;AAaD;;;eAGe;AACf,wBAAsB,WAAW,CAC/B,OAAO,EAAE,aAAa,EACtB,OAAO,EAAE,KAAK,MAAM,EAAE,EACtB,KAAK,EAAE,aAAa,EACpB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,KAAK,SAAI,GACP,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAkB7B;AAED;;;+CAG+C;AAC/C,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,cAAc,EACnB,IAAI,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,KAAK,MAAM,EAAE,CAAA;CAAO,GAC9F,OAAO,CAAC,cAAc,EAAE,CAAC,CAwE3B;AAED;;gFAEgF;AAChF,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAChE,OAAO,CAAC;IAAE,MAAM,EAAE,KAAK,MAAM,EAAE,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,EAAE,CAAC,CAmB3D;AAED,kEAAkE;AAClE,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,KAAK,MAAM,EAAE,EAAE,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAEvG"}

package/dist/chain.js

@@ -535,13 +535,17 @@ export function locatorOf(addrs, maxBytes = MAX_LOCATOR_BYTES, maxCount = MAX_LO
     return picked.join(';');
 }
 /** True when this address is reachable from the public internet. LAN, loopback,
- *  link-local and CGNAT (100.64/10) ranges are local-only; a relay address is
- *  signaling, not a data path (P4.9g). A user-supplied DNS name is trusted. */
+ *  link-local and CGNAT (100.64/10) ranges are local-only. A `/p2p-circuit`
+ *  address is dialable when its relay hop is a public host: the relay forwards
+ *  the stream, so a worker behind NAT is still reachable through it (P5). */
 export function isPublicAddr(addr) {
     if (!addr.startsWith('/'))
         return false;
-    if (addr.includes('/p2p-circuit/'))
-        return false;
+    const circuit = addr.indexOf('/p2p-circuit');
+    if (circuit >= 0) {
+        // Judge the relay hop only; the tail after /p2p-circuit is our own peer id.
+        return isPublicAddr(addr.slice(0, circuit));
+    }
     const v4 = /^\/ip4\/(\d+)\.(\d+)\.(\d+)\.(\d+)\//.exec(addr);
     if (v4 != null) {
         const a = Number(v4[1]);
@@ -574,6 +578,27 @@ export function isPublicAddr(addr) {
 export function hasPublicAddr(addrs) {
     return addrs.some(isPublicAddr);
 }
+/** How this peer is reachable to the internet, best first: a direct public
+ *  address, a relay circuit through a public hop, or LAN only. The worker panel
+ *  reports this instead of guessing from a bare address list. */
+export function transportOf(addrs) {
+    if (addrs.some(a => isPublicAddr(a) && !a.includes('/p2p-circuit')))
+        return 'direct';
+    if (addrs.some(a => a.includes('/p2p-circuit') && isPublicAddr(a)))
+        return 'relay';
+    return 'lan';
+}
+/** The address a client should try first: a public direct address, then a
+ *  relay circuit, then anything (LAN) for a same-network peer. */
+export function preferredAddr(addrs) {
+    const direct = addrs.find(a => isPublicAddr(a) && !a.includes('/p2p-circuit'));
+    if (direct != null)
+        return direct;
+    const relay = addrs.find(a => a.includes('/p2p-circuit') && isPublicAddr(a));
+    if (relay != null)
+        return relay;
+    return addrs.find(a => a.startsWith('/'));
+}
 /** Split a locator back into multiaddrs (tolerates `;`, newline, whitespace). */
 export function parseLocator(locator) {
     return locator

package/dist/dial.d.ts

@@ -2,6 +2,13 @@ import type { Libp2p } from 'libp2p';
 import { type HelloProof } from './hello.ts';
 import { type Offer } from './offer.ts';
 import type { OpenEnvelope } from './workerSession.ts';
+/** Direct dials before a worker's address is considered unreachable and the
+ *  seed-VM relay path is preferred for subsequent sessions. */
+export declare const DIRECT_ATTEMPTS_BEFORE_RELAY = 3;
+export type DialRoute = 'direct' | 'relay';
+/** Build `/p2p-circuit` addresses for `peerId` from the relays the seed handed
+ *  out. The relay hop keeps its own `/p2p/<id>`; ours is appended last. */
+export declare function circuitAddrsFor(relays: readonly string[], peerId: string): string[];
 export type WorkerToolCall = {
     index: number;
     id: string;
@@ -21,15 +28,33 @@ export type WorkerTransport = {
     close(): Promise<void>;
 };
 export declare function dialWorker(node: Libp2p, addr: string): Promise<WorkerTransport>;
-/** Fetch + deserialize a worker's offer board (one dial, whole-board read). */
 /** P4.9e: ask the peer to prove it holds the EVM key of the wallet it puts on
  *  its offers. Throws when the answer is missing, malformed, signed by another
  *  key, or claims a different PeerId than the one we dialed. */
 export declare function helloWorker(node: Libp2p, addr: string): Promise<HelloProof>;
+/** Dial a worker: direct libp2p first, and after repeated failures fall back
+ *  to the seed-VM circuit relay. The route is returned so the caller can say
+ *  which path a session actually took. */
+export declare function dialWorkerAny(node: Libp2p, addr: string, opts?: {
+    relays?: readonly string[];
+}): Promise<{
+    transport: WorkerTransport;
+    route: DialRoute;
+    addr: string;
+}>;
+/** Open (or reuse) a connection to a relay hop. The circuit transport only
+ *  reserves a slot while a HOP-capable peer is connected, so a seed restart
+ *  needs this again with the seed's new peer id. */
+export declare function connectRelay(node: Libp2p, relay: string): void;
+/** Fetch + deserialize a worker's offer board (one dial, whole-board read). */
 export declare function fetchOffers(node: Libp2p, addr: string): Promise<Offer[]>;
 /** P4.5 seed discovery: ask a bootstrap seed which peers it currently sees.
  *  The seed is a pure matchmaker — one frame in, one frame out, no storage. */
 export declare function fetchSeedPeers(node: Libp2p, addr: string): Promise<string[]>;
+/** Relay hops the seed advertises. A worker reserves a slot on one of these and
+ *  a client uses them to reach workers that are not directly dialable. Both the
+ *  HTTP and the libp2p seed paths answer with a `relay` array. */
+export declare function fetchSeedRelays(node: Libp2p | null, seed: string): Promise<string[]>;
 /**
  * P4.4 settle co-sign (one dial, one frame each way): the user, at session
  * end, presents (jobId, escrowId, receiptHash, spend); the worker checks its

package/dist/dial.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dial.d.ts","sourceRoot":"","sources":["../src/dial.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAEpC,OAAO,EAAyB,KAAK,UAAU,EAAE,MAAM,YAAY,CAAA;AAEnE,OAAO,EAAY,KAAK,KAAK,EAAE,MAAM,YAAY,CAAA;AAGjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAQtD,MAAM,MAAM,cAAc,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,CAAA;AAEhG,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACtC,OAAO,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,IAAI,CAAA;IAC1C,uDAAuD;IACvD,UAAU,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,cAAc,KAAK,IAAI,GAAG,IAAI,CAAA;IACpD,KAAK,CAAC,EAAE,EAAE,MAAM,IAAI,GAAG,IAAI,CAAA;IAC3B,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,KAAK,IAAI,GAAG,IAAI,CAAA;IACrC;6DACyD;IACzD,WAAW,CACT,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,EACd,GAAG,CAAC,EAAE,MAAM,EACZ,SAAS,CAAC,EAAE,KAAK,MAAM,EAAE,EACzB,UAAU,CAAC,EAAE,KAAK,MAAM,EAAE,GACzB,OAAO,CAAC,IAAI,CAAC,CAAA;IAChB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACvB,CAAA;AAED,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAwJrF;AAED,+EAA+E;AAC/E;;gEAEgE;AAChE,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAqDjF;AAED,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,CAqB9E;AA4BD;+EAC+E;AAC/E,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAkClF;AAED;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACnF,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,KAAK,MAAM,EAAE,GAAG,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAgCtE;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAelG"}
+{"version":3,"file":"dial.d.ts","sourceRoot":"","sources":["../src/dial.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAEpC,OAAO,EAAyB,KAAK,UAAU,EAAE,MAAM,YAAY,CAAA;AAEnE,OAAO,EAAY,KAAK,KAAK,EAAE,MAAM,YAAY,CAAA;AAGjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAQtD;+DAC+D;AAC/D,eAAO,MAAM,4BAA4B,IAAI,CAAA;AAY7C,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,OAAO,CAAA;AAE1C;2EAC2E;AAC3E,wBAAgB,eAAe,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAUnF;AAED,MAAM,MAAM,cAAc,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,CAAA;AAEhG,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACtC,OAAO,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,IAAI,CAAA;IAC1C,uDAAuD;IACvD,UAAU,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,cAAc,KAAK,IAAI,GAAG,IAAI,CAAA;IACpD,KAAK,CAAC,EAAE,EAAE,MAAM,IAAI,GAAG,IAAI,CAAA;IAC3B,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,KAAK,IAAI,GAAG,IAAI,CAAA;IACrC;6DACyD;IACzD,WAAW,CACT,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,EACd,GAAG,CAAC,EAAE,MAAM,EACZ,SAAS,CAAC,EAAE,KAAK,MAAM,EAAE,EACzB,UAAU,CAAC,EAAE,KAAK,MAAM,EAAE,GACzB,OAAO,CAAC,IAAI,CAAC,CAAA;IAChB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACvB,CAAA;AAED,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAwJrF;AAED;;gEAEgE;AAChE,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAqDjF;AA0BD;;0CAE0C;AAC1C,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAO,GACxC,OAAO,CAAC;IAAE,SAAS,EAAE,eAAe,CAAC;IAAC,KAAK,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAsCzE;AAED;;oDAEoD;AACpD,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAG9D;AAED,+EAA+E;AAC/E,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,CAqB9E;AA4BD;+EAC+E;AAC/E,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAkClF;AAED;;kEAEkE;AAClE,wBAAsB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAsC1F;AAED;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACnF,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,KAAK,MAAM,EAAE,GAAG,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAgCtE;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAiClG"}

package/dist/dial.js

@@ -4,6 +4,7 @@
 // open handler never blocks on them. Offers are fetched per-discovered peer
 // and sorted locally — the marketplace columns never touch the wire twice.
 import { multiaddr } from '@multiformats/multiaddr';
+import { peerIdFromString } from '@libp2p/peer-id';
 import { newNonce, verifyHello } from "./hello.js";
 import { FrameReader, lpEncode, WriteQueue } from "./lp.js";
 import { fromWire } from "./offer.js";
@@ -12,6 +13,29 @@ import { peerIdOf } from "./registry.js";
 /** How long to wait for the worker's admission ack before assuming an older
  *  worker that streams without one. */
 const ADMISSION_TIMEOUT_MS = 8_000;
+/** Direct dials before a worker's address is considered unreachable and the
+ *  seed-VM relay path is preferred for subsequent sessions. */
+export const DIRECT_ATTEMPTS_BEFORE_RELAY = 3;
+/** addr → consecutive direct-dial failures. Kept per process so a client that
+ *  learned a worker is behind NAT stops paying the direct timeout every turn. */
+const directFailures = new Map();
+/** A circuit-relayed connection carries a relay-imposed byte/duration limit, so
+ *  libp2p marks it "limited" and refuses new streams unless the caller opts in.
+ *  Every GenKaKu protocol is application data and must opt in; on a direct
+ *  connection the flag is ignored. */
+const RELAY_STREAM = { runOnLimitedConnection: true };
+/** Build `/p2p-circuit` addresses for `peerId` from the relays the seed handed
+ *  out. The relay hop keeps its own `/p2p/<id>`; ours is appended last. */
+export function circuitAddrsFor(relays, peerId) {
+    const out = [];
+    for (const relay of relays) {
+        if (!relay.startsWith('/') || !relay.includes('/p2p/'))
+            continue;
+        const hop = relay.split('/p2p-circuit')[0] ?? relay;
+        out.push(`${hop}/p2p-circuit/p2p/${peerId}`);
+    }
+    return [...new Set(out)];
+}
 export async function dialWorker(node, addr) {
     const ma = multiaddr(addr);
     const oq = new WriteQueue();
@@ -97,7 +121,7 @@ export async function dialWorker(node, addr) {
     }
     return {
         async open(env) {
-            openStream = await node.dialProtocol(ma, '/genkaku/open/0');
+            openStream = await node.dialProtocol(ma, '/genkaku/open/0', RELAY_STREAM);
             // errors surface via the read side
             openSinkDone = openStream.sink(oq.source()).catch(() => { });
             oq.push(lpEncode(env));
@@ -131,7 +155,7 @@ export async function dialWorker(node, addr) {
         onError(cb) { errCbs.add(cb); },
         async sendReceipt(jobId, seq, amount, sig = '', inputHash = ZERO_HASH, outputHash = ZERO_HASH) {
             if (!receiptStream) {
-                receiptStream = await node.dialProtocol(ma, '/genkaku/receipt/0');
+                receiptStream = await node.dialProtocol(ma, '/genkaku/receipt/0', RELAY_STREAM);
                 receiptSinkDone = receiptStream.sink(rq.source()).catch(() => { });
             }
             rq.push(lpEncode({
@@ -153,14 +177,13 @@ export async function dialWorker(node, addr) {
         },
     };
 }
-/** Fetch + deserialize a worker's offer board (one dial, whole-board read). */
 /** P4.9e: ask the peer to prove it holds the EVM key of the wallet it puts on
  *  its offers. Throws when the answer is missing, malformed, signed by another
  *  key, or claims a different PeerId than the one we dialed. */
 export async function helloWorker(node, addr) {
     const expectedPeer = peerIdOf(addr);
     const nonce = newNonce();
-    const stream = await node.dialProtocol(multiaddr(addr), '/genkaku/hello/0');
+    const stream = await node.dialProtocol(multiaddr(addr), '/genkaku/hello/0', RELAY_STREAM);
     let reply;
     try {
         stream.sink([lpEncode({ proto: 'hello/0', nonce })]).catch(() => { });
@@ -194,6 +217,76 @@ export async function helloWorker(node, addr) {
     }
     return proof;
 }
+/** Which path an established connection actually uses. libp2p reuses an
+ *  existing connection to the same peer even when a different address was
+ *  requested, so the request alone cannot tell us: read the connection's
+ *  remote address. */
+function routeOf(node, addr) {
+    const peer = peerIdOf(addr);
+    if (peer == null)
+        return null;
+    try {
+        const conns = node.getConnections(peerIdFromString(peer));
+        if (conns.length === 0)
+            return null;
+        const relayed = conns.some(c => c.remoteAddr.toString().includes('/p2p-circuit'));
+        const direct = conns.some(c => !c.remoteAddr.toString().includes('/p2p-circuit'));
+        if (direct)
+            return 'direct';
+        if (relayed)
+            return 'relay';
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Dial a worker: direct libp2p first, and after repeated failures fall back
+ *  to the seed-VM circuit relay. The route is returned so the caller can say
+ *  which path a session actually took. */
+export async function dialWorkerAny(node, addr, opts = {}) {
+    // The board already handed us a relay address: no direct attempt to make.
+    if (addr.includes('/p2p-circuit')) {
+        return { transport: await dialWorker(node, addr), route: 'relay', addr };
+    }
+    const peer = peerIdOf(addr);
+    const circuits = peer == null ? [] : circuitAddrsFor(opts.relays ?? [], peer);
+    const failures = directFailures.get(addr) ?? 0;
+    const relayFirst = failures >= DIRECT_ATTEMPTS_BEFORE_RELAY && circuits.length > 0;
+    const order = relayFirst ? ['relay', 'direct'] : ['direct', 'relay'];
+    let lastError;
+    for (const route of order) {
+        if (route === 'relay' && circuits.length === 0)
+            continue;
+        const target = route === 'relay' ? circuits[0] : addr;
+        try {
+            const transport = await dialWorker(node, target);
+            // Trust the connection, not the request: a relay connection established
+            // earlier is reused for a "direct" dial to the same peer.
+            const actual = routeOf(node, target) ?? route;
+            if (actual === 'direct')
+                directFailures.delete(addr);
+            else
+                directFailures.set(addr, DIRECT_ATTEMPTS_BEFORE_RELAY);
+            return { transport, route: actual, addr: target };
+        }
+        catch (error) {
+            lastError = error;
+            if (route === 'direct')
+                directFailures.set(addr, (directFailures.get(addr) ?? 0) + 1);
+        }
+    }
+    throw lastError instanceof Error ? lastError : new Error(String(lastError));
+}
+/** Open (or reuse) a connection to a relay hop. The circuit transport only
+ *  reserves a slot while a HOP-capable peer is connected, so a seed restart
+ *  needs this again with the seed's new peer id. */
+export function connectRelay(node, relay) {
+    if (!relay.startsWith('/'))
+        return;
+    void node.dial(multiaddr(relay)).catch(() => { });
+}
+/** Fetch + deserialize a worker's offer board (one dial, whole-board read). */
 export async function fetchOffers(node, addr) {
     const offers = await fetchOfferBoard(node, addr);
     let proof;
@@ -215,7 +308,7 @@ export async function fetchOffers(node, addr) {
     });
 }
 async function fetchOfferBoard(node, addr) {
-    const s = await node.dialProtocol(multiaddr(addr), '/genkaku/offers/0');
+    const s = await node.dialProtocol(multiaddr(addr), '/genkaku/offers/0', RELAY_STREAM);
     const reader = new FrameReader();
     let board = [];
     for await (const chunk of s.source) {
@@ -254,7 +347,7 @@ export async function fetchSeedPeers(node, addr) {
             return [];
         }
     }
-    const s = await node.dialProtocol(multiaddr(addr), '/genkaku/peers/0');
+    const s = await node.dialProtocol(multiaddr(addr), '/genkaku/peers/0', RELAY_STREAM);
     const reader = new FrameReader();
     for await (const chunk of s.source) {
         reader.push(chunk);
@@ -267,6 +360,46 @@ export async function fetchSeedPeers(node, addr) {
     await s.close().catch(() => { });
     return [];
 }
+/** Relay hops the seed advertises. A worker reserves a slot on one of these and
+ *  a client uses them to reach workers that are not directly dialable. Both the
+ *  HTTP and the libp2p seed paths answer with a `relay` array. */
+export async function fetchSeedRelays(node, seed) {
+    if (seed.startsWith('http://') || seed.startsWith('https://')) {
+        try {
+            const res = await fetch(`${seed.replace(/\/$/, '')}/peers`);
+            if (!res.ok)
+                return [];
+            const body = (await res.json());
+            return Array.isArray(body.relay)
+                ? body.relay.filter((p) => typeof p === 'string' && p.startsWith('/'))
+                : [];
+        }
+        catch {
+            return [];
+        }
+    }
+    if (node == null)
+        return [];
+    try {
+        const s = await node.dialProtocol(multiaddr(seed), '/genkaku/peers/0', RELAY_STREAM);
+        const reader = new FrameReader();
+        for await (const chunk of s.source) {
+            reader.push(chunk);
+            const f = reader.next();
+            if (f?.proto === 'peers/0') {
+                await s.close().catch(() => { });
+                return Array.isArray(f.relay)
+                    ? f.relay.filter((p) => typeof p === 'string' && p.startsWith('/'))
+                    : [];
+            }
+        }
+        await s.close().catch(() => { });
+    }
+    catch {
+        // fall through
+    }
+    return [];
+}
 /**
  * P4.4 settle co-sign (one dial, one frame each way): the user, at session
  * end, presents (jobId, escrowId, receiptHash, spend); the worker checks its
@@ -276,7 +409,7 @@ export async function fetchSeedPeers(node, addr) {
  * digest JobEscrow.settle recovers against the session's worker address.
  */
 export async function requestSettleCosign(node, addr, args) {
-    const s = await node.dialProtocol(multiaddr(addr), '/genkaku/settle/0');
+    const s = await node.dialProtocol(multiaddr(addr), '/genkaku/settle/0', RELAY_STREAM);
     const reader = new FrameReader();
     let reply = null;
     const sinkDone = s.sink([lpEncode({
@@ -310,20 +443,34 @@ export async function requestSettleCosign(node, addr, args) {
 export async function announceToSeed(node, seed, addrs) {
     if (addrs.length === 0)
         return false;
-    const s = await node.dialProtocol(multiaddr(seed), '/genkaku/announce/0');
-    try {
-        s.sink([lpEncode({ proto: 'announce/0', addrs })]);
-        const reader = new FrameReader();
-        for await (const chunk of s.source) {
-            reader.push(chunk);
-            const f = reader.next();
-            if (f?.proto === 'announced/0')
-                return f.ok === true;
+    // A seed may be configured as a URL (the shipped default): its peer id
+    // changes on restart, so the address to dial is whatever it reports right
+    // now. `relay` is the seed's own address; `peers` are workers, never dial
+    // those for an announcement.
+    const targets = seed.startsWith('http://') || seed.startsWith('https://')
+        ? await fetchSeedRelays(node, seed)
+        : [seed];
+    for (const target of targets) {
+        try {
+            const s = await node.dialProtocol(multiaddr(target), '/genkaku/announce/0', RELAY_STREAM);
+            try {
+                s.sink([lpEncode({ proto: 'announce/0', addrs })]).catch(() => { });
+                const reader = new FrameReader();
+                for await (const chunk of s.source) {
+                    reader.push(chunk);
+                    const f = reader.next();
+                    if (f?.proto === 'announced/0' && f.ok === true)
+                        return true;
+                }
+            }
+            finally {
+                await s.close().catch(() => { });
+            }
+        }
+        catch {
+            // try the next address the URL reported
         }
-        return false;
-    }
-    finally {
-        await s.close().catch(() => { });
     }
+    return false;
 }
 //# sourceMappingURL=dial.js.map

package/dist/p2pNode.d.ts

@@ -23,10 +23,12 @@ export type SidecarOptions = {
     /** P4.4: with a worker wallet, priced receipts MUST carry a valid signature,
      *  offers self-report the wallet, and settle co-signing becomes available. */
     workerKey?: Hex;
+    /** Public relay multiaddrs (the seed VM). Dialed at boot so the circuit
+     *  transport can reserve a slot, which makes a NAT'd worker dialable. */
+    relayHints?: string[];
 };
 /** One stored (latest) receipt per jobId — the evidence the settle co-sign
- *  defends against (spend == max cumulative receipt the client piped). */
-export type StoredReceipt = {
+ *  defends against (spend == max cumulative receipt the client piped). */ export type StoredReceipt = {
     seq: number;
     amount: bigint;
     sig: string;

package/dist/p2pNode.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"p2pNode.d.ts","sourceRoot":"","sources":["../src/p2pNode.ts"],"names":[],"mappings":"AAYA,OAAO,EAAgB,KAAK,MAAM,EAAE,MAAM,QAAQ,CAAA;AAClD,OAAO,EAAE,KAAK,GAAG,EAAW,MAAM,MAAM,CAAA;AAIxC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAC3C,OAAO,KAAK,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAA;AAE5E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAGnD,OAAO,EAAoB,KAAK,KAAK,EAAU,MAAM,YAAY,CAAA;AAajE,OAAO,KAAK,EAAgB,YAAY,EAAiB,MAAM,oBAAoB,CAAA;AAGnF,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AACzD,YAAY,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AAExC,eAAO,MAAM,iBAAiB,2JAQpB,CAAA;AAEV,MAAM,MAAM,cAAc,GAAG;IAC3B,WAAW,EAAE,WAAW,CAAA;IACxB,MAAM,EAAE,qBAAqB,CAAA;IAC7B,+DAA+D;IAC/D,UAAU,CAAC,EAAE,eAAe,CAAA;IAC5B,2EAA2E;IAC3E,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,+EAA+E;IAC/E,OAAO,EAAE,KAAK,EAAE,CAAA;IAChB,aAAa,CAAC,EAAE,CAAC,CAAC,EAAE,YAAY,KAAK,IAAI,CAAA;IACzC,gFAAgF;IAChF,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;kFAC8E;IAC9E,SAAS,CAAC,EAAE,GAAG,CAAA;CAChB,CAAA;AAED;0EAC0E;AAC1E,MAAM,MAAM,aAAa,GAAG;IAC1B,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,MAAM,CAAA;IACd,GAAG,EAAE,MAAM,CAAA;IACX,2EAA2E;IAC3E,QAAQ,EAAE,MAAM,CAAA;IAChB,kEAAkE;IAClE,SAAS,EAAE,KAAK,MAAM,EAAE,CAAA;IACxB,UAAU,EAAE,KAAK,MAAM,EAAE,CAAA;CAC1B,CAAA;AAkBD,+EAA+E;AAC/E,wBAAsB,cAAc,CAAC,MAAM,GAAE,MAAM,EAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAY3E;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,MAAM,EAAE,CAAA;IACzB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IACrB,cAAc,EAAE,MAAM,MAAM,CAAA;IAC5B,+DAA+D;IAC/D,SAAS,EAAE,MAAM,MAAM,CAAA;IACvB,qEAAqE;IACrE,UAAU,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,IAAI,CAAA;CACtC,CAAA;AAED,wBAAsB,aAAa,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,CAkfjF"}
+{"version":3,"file":"p2pNode.d.ts","sourceRoot":"","sources":["../src/p2pNode.ts"],"names":[],"mappings":"AAcA,OAAO,EAAgB,KAAK,MAAM,EAAE,MAAM,QAAQ,CAAA;AAClD,OAAO,EAAE,KAAK,GAAG,EAAW,MAAM,MAAM,CAAA;AAIxC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAC3C,OAAO,KAAK,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAA;AAE5E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAGnD,OAAO,EAAoB,KAAK,KAAK,EAAU,MAAM,YAAY,CAAA;AAajE,OAAO,KAAK,EAAgB,YAAY,EAAiB,MAAM,oBAAoB,CAAA;AAGnF,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AACzD,YAAY,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AAExC,eAAO,MAAM,iBAAiB,2JAQpB,CAAA;AAEV,MAAM,MAAM,cAAc,GAAG;IAC3B,WAAW,EAAE,WAAW,CAAA;IACxB,MAAM,EAAE,qBAAqB,CAAA;IAC7B,+DAA+D;IAC/D,UAAU,CAAC,EAAE,eAAe,CAAA;IAC5B,2EAA2E;IAC3E,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,+EAA+E;IAC/E,OAAO,EAAE,KAAK,EAAE,CAAA;IAChB,aAAa,CAAC,EAAE,CAAC,CAAC,EAAE,YAAY,KAAK,IAAI,CAAA;IACzC,gFAAgF;IAChF,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;kFAC8E;IAC9E,SAAS,CAAC,EAAE,GAAG,CAAA;IACf;6EACyE;IACzE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;CACtB,CAAA;AAED;0EAC0E,CAAA,MAAM,MAAM,aAAa,GAAG;IACpG,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,MAAM,CAAA;IACd,GAAG,EAAE,MAAM,CAAA;IACX,2EAA2E;IAC3E,QAAQ,EAAE,MAAM,CAAA;IAChB,kEAAkE;IAClE,SAAS,EAAE,KAAK,MAAM,EAAE,CAAA;IACxB,UAAU,EAAE,KAAK,MAAM,EAAE,CAAA;CAC1B,CAAA;AAkBD,+EAA+E;AAC/E,wBAAsB,cAAc,CAAC,MAAM,GAAE,MAAM,EAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAY3E;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,MAAM,EAAE,CAAA;IACzB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IACrB,cAAc,EAAE,MAAM,MAAM,CAAA;IAC5B,+DAA+D;IAC/D,SAAS,EAAE,MAAM,MAAM,CAAA;IACvB,qEAAqE;IACrE,UAAU,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,IAAI,CAAA;CACtC,CAAA;AAOD,wBAAsB,aAAa,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,CAggBjF"}

package/dist/p2pNode.js

@@ -5,10 +5,12 @@
 // in depth, P4-ADAPTATION §2).
 import { noise } from '@chainsafe/libp2p-noise';
 import { yamux } from '@chainsafe/libp2p-yamux';
-import { Secp256k1PrivateKey } from '@libp2p/crypto/keys';
+import { circuitRelayTransport } from '@libp2p/circuit-relay-v2';
+import { generateKeyPair, privateKeyFromRaw } from '@libp2p/crypto/keys';
 import { identify } from '@libp2p/identify';
-import { createFromPrivKey, createSecp256k1PeerId } from '@libp2p/peer-id-factory';
+import { peerIdFromPrivateKey } from '@libp2p/peer-id';
 import { tcp } from '@libp2p/tcp';
+import { multiaddr } from '@multiformats/multiaddr';
 import { createLibp2p } from 'libp2p';
 import { toBytes } from 'viem';
 import { settleDigest, walletAddress } from "./chain.js";
@@ -43,17 +45,21 @@ const RECEIPT_DRAIN_MS = 250;
 const CLOCK_SLACK_MS = 2_000;
 /** A bare libp2p node for the USER side (no genkaku handlers — dials only). */
 export async function createUserNode(listen = []) {
-    const peerId = await createSecp256k1PeerId();
+    const privateKey = await generateKeyPair('secp256k1');
     return createLibp2p({
-        peerId,
+        privateKey,
         nodeInfo: NODE_INFO,
         addresses: { listen },
-        transports: [tcp()],
-        connectionEncryption: [noise()],
+        transports: [tcp(), circuitRelayTransport()],
+        connectionEncrypters: [noise()],
         streamMuxers: [yamux()],
         services: { identify: identify() },
     });
 }
+/** Every GenKaKu protocol must accept a relayed (limited) connection: a worker
+ *  behind NAT is ONLY reachable that way. libp2p refuses streams on a limited
+ *  connection unless both the dialer and the handler opt in. */
+const RELAY_HANDLER = { runOnLimitedConnection: true };
 export async function createSidecar(opts) {
     // D-block: do not even construct listeners without a sharing-capable mode.
     const mode = opts.modeManager.current();
@@ -101,19 +107,28 @@ export async function createSidecar(opts) {
     // SAME curve as the EVM wallet, so the P4.4 registry binding proves one key
     // owns both sides of (PeerId, wallet) address. With a worker wallet, derive
     // the PeerId from that exact key; otherwise keep a random identity.
-    const peerId = opts.workerKey != null
-        ? await createFromPrivKey(new Secp256k1PrivateKey(toBytes(opts.workerKey)))
-        : await createSecp256k1PeerId();
+    const privateKey = opts.workerKey != null
+        ? privateKeyFromRaw(toBytes(opts.workerKey))
+        : await generateKeyPair('secp256k1');
+    const peerId = peerIdFromPrivateKey(privateKey);
     const node = await createLibp2p({
-        peerId,
+        privateKey,
         nodeInfo: NODE_INFO,
-        addresses: { listen: opts.listen },
-        transports: [tcp()],
-        connectionEncryption: [noise()],
+        addresses: { listen: [...new Set([...opts.listen, '/p2p-circuit'])] },
+        transports: [tcp(), circuitRelayTransport()],
+        connectionEncrypters: [noise()],
         streamMuxers: [yamux()],
         services: { identify: identify() },
     });
-    await node.handle('/genkaku/open/0', ({ connection, stream }) => {
+    // Connect to the public relay up front: the circuit transport reserves a
+    // slot only once a HOP-capable peer is connected. Failures are non-fatal —
+    // a worker with a public address is still directly dialable.
+    for (const hint of opts.relayHints ?? []) {
+        void node.dial(multiaddr(hint)).catch(() => { });
+    }
+    /** Register a protocol that may run over a relayed (limited) connection. */
+    const handle = (protocol, handler) => node.handle(protocol, handler, RELAY_HANDLER);
+    await handle('/genkaku/open/0', ({ connection, stream }) => {
         void (async () => {
             // Read ONLY the open envelope, then start serving — the client keeps its
             // write half open for the session, so a drain-to-EOS read would deadlock
@@ -236,7 +251,7 @@ export async function createSidecar(opts) {
             void connection;
         })();
     });
-    await node.handle('/genkaku/receipt/0', ({ stream }) => {
+    await handle('/genkaku/receipt/0', ({ stream }) => {
         void (async () => {
             const reader = new FrameReader();
             for await (const chunk of stream.source) {
@@ -299,7 +314,7 @@ export async function createSidecar(opts) {
     // only compared against it), and the spend must equal the held max
     // cumulative receipt — anti-inflation by construction (P1 §8). JobEscrow.
     // settle() then recovers this EIP-191 sig against the session's worker.
-    await node.handle('/genkaku/settle/0', ({ stream }) => {
+    await handle('/genkaku/settle/0', ({ stream }) => {
         void (async () => {
             const reader = new FrameReader();
             let req;
@@ -356,7 +371,7 @@ export async function createSidecar(opts) {
     });
     // P4.9e identity proof: one nonce in, one signed proof out. The client
     // recovers the signer and refuses offers whose wallet it cannot prove.
-    await node.handle('/genkaku/hello/0', ({ stream }) => {
+    await handle('/genkaku/hello/0', ({ stream }) => {
         void (async () => {
             const reader = new FrameReader();
             let req;
@@ -385,14 +400,14 @@ export async function createSidecar(opts) {
     // locally (P4.3). bigint prices travel as decimal strings (OfferWire); the
     // wallet here is a CLAIM — the client only trusts it after /genkaku/hello/0
     // proves the key (P4.9e) or the registry binds it (P4.5).
-    await node.handle('/genkaku/offers/0', ({ stream }) => {
+    await handle('/genkaku/offers/0', ({ stream }) => {
         const wallet = opts.workerKey != null ? walletAddress(opts.workerKey) : undefined;
         const board = currentCatalog.map(o => toWire(wallet == null ? o : { ...o, workerWallet: wallet }));
         void stream.sink([lpEncode({ proto: 'offers/0', board })]).then(() => stream.close());
     });
     // token is served in-session (open handler); policy is reserved v0.
-    await node.handle('/genkaku/token/0', ({ stream }) => { void stream.close(); });
-    await node.handle('/genkaku/policy/0', ({ stream }) => {
+    await handle('/genkaku/token/0', ({ stream }) => { void stream.close(); });
+    await handle('/genkaku/policy/0', ({ stream }) => {
         // P4.5: the wire advertises the SAME digest the worker pins on
         // WorkerRegistry, so a user can compare registry.policyHash against it.
         void stream.sink([lpEncode({ proto: 'policy/0', policyHash: policyHashOf(POLICY_VERSION), policyVersion: POLICY_VERSION })]).then(() => stream.close());

package/dist/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAoBA,6EAA6E;AAC7E,eAAO,MAAM,cAAc,aAAa,CAAA;AAExC,kEAAkE;AAClE,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,MAAM,EAAE,CAM5D;AAED,yEAAyE;AACzE,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,MAAM,EAAE,CAE1D;AAED,kFAAkF;AAClF,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CASpD;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,MAAM,EAAE,OAAO,CAAA;IACf,MAAM,EAAE,KAAK,MAAM,EAAE,CAAA;IACrB,UAAU,EAAE,KAAK,MAAM,EAAE,CAAA;CAC1B,CAAA;AAED;;;qEAGqE;AACrE,wBAAgB,SAAS,CAAC,GAAG,EAAE,cAAc,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,GAAG,UAAU,CAMrG"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAoBA,6EAA6E;AAC7E,eAAO,MAAM,cAAc,aAAa,CAAA;AAExC,kEAAkE;AAClE,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,MAAM,EAAE,CAM5D;AAED,yEAAyE;AACzE,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,MAAM,EAAE,CAE1D;AAED,kFAAkF;AAClF,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAYpD;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,MAAM,EAAE,OAAO,CAAA;IACf,MAAM,EAAE,KAAK,MAAM,EAAE,CAAA;IACrB,UAAU,EAAE,KAAK,MAAM,EAAE,CAAA;CAC1B,CAAA;AAED;;;qEAGqE;AACrE,wBAAgB,SAAS,CAAC,GAAG,EAAE,cAAc,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,GAAG,UAAU,CAMrG"}

package/dist/registry.js

@@ -30,7 +30,10 @@ export function policyHashOf(policy) {
 }
 /** The libp2p PeerId encoded in a worker multiaddr (the grain of the compare). */
 export function peerIdOf(addr) {
-    const tail = addr.split('/p2p/')[1];
+    // A relay address carries TWO peer ids (relay and destination); the
+    // destination is the tail. Taking the first one would identify the seed.
+    const segments = addr.split('/p2p/');
+    const tail = segments.length > 1 ? segments[segments.length - 1] : undefined;
     if (tail != null && tail !== '') {
         // trim any stray suffix (addresses end at the peer id in our dialer)
         return tail.split('/')[0] || null;

package/dist/status.d.ts

@@ -18,6 +18,14 @@ export type StatusSnapshot = {
     reachable: boolean;
     /** config.publishAddress: may a public address be written to the chain? */
     publishAddress: boolean;
+    /** publishAddress AND a globally dialable address: the entry can be dialed. */
+    published?: boolean;
+    /** true when the profile forces publishing on, so the switch cannot turn it off. */
+    publishForced?: boolean;
+    /** How this worker is reachable: direct libp2p, a relay circuit, or LAN only. */
+    transport?: 'direct' | 'relay' | 'lan';
+    /** Relay hops this worker reserved (seed VM), for the panel to explain relay mode. */
+    relayHints?: string[];
 };
 export type StatusHandle = {
     url: string;

package/dist/status.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../src/status.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAChD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAE3C,+CAA+C;AAC/C,MAAM,MAAM,WAAW,GAAG;IACxB,0EAA0E;IAC1E,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,SAAS,CAAA;CACjB,CAAA;AAED,0EAA0E;AAC1E,MAAM,MAAM,cAAc,GAAG;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,EAAE,CAAA;IACnB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,WAAW,EAAE,CAAA;IACrB,cAAc,EAAE,MAAM,CAAA;IACtB,4EAA4E;IAC5E,SAAS,EAAE,OAAO,CAAA;IAClB,2EAA2E;IAC3E,cAAc,EAAE,OAAO,CAAA;CACxB,CAAA;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAC3B,CAAA;AAED,mEAAmE;AACnE,MAAM,MAAM,iBAAiB,GAAG;IAC9B,KAAK,EAAE,MAAM,CAAA;IACb,YAAY,EAAE,MAAM,CAAA;IACpB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB,CAAA;AAED,6DAA6D;AAC7D,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,EAAE,iBAAiB,EAAE,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;AAEzF,0DAA0D;AAC1D,MAAM,MAAM,iBAAiB,GAAG,CAAC,IAAI,EAAE,QAAQ,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;AAExE,2DAA2D;AAC3D,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;AAE7E,8DAA8D;AAC9D,MAAM,MAAM,aAAa,GAAG;IAC1B,mEAAmE;IACnE,KAAK,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;IAC7B,2CAA2C;IAC3C,aAAa,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;IACrC,sEAAsE;IACtE,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,QAAQ,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,KAAK,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC1H,0CAA0C;IAC1C,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CACzC,CAAA;AAsKD,6DAA6D;AAC7D,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,EACxD,SAAS,CAAC,EAAE,oBAAoB,EAChC,MAAM,CAAC,EAAE,iBAAiB,EAC1B,MAAM,CAAC,EAAE,aAAa,EACtB,SAAS,CAAC,EAAE,oBAAoB,GAC/B,OAAO,CAAC,YAAY,CAAC,CA+LvB"}
+{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../src/status.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAChD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAE3C,+CAA+C;AAC/C,MAAM,MAAM,WAAW,GAAG;IACxB,0EAA0E;IAC1E,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,SAAS,CAAA;CACjB,CAAA;AAED,0EAA0E;AAC1E,MAAM,MAAM,cAAc,GAAG;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,EAAE,CAAA;IACnB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,WAAW,EAAE,CAAA;IACrB,cAAc,EAAE,MAAM,CAAA;IACtB,4EAA4E;IAC5E,SAAS,EAAE,OAAO,CAAA;IAClB,2EAA2E;IAC3E,cAAc,EAAE,OAAO,CAAA;IACvB,+EAA+E;IAC/E,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,oFAAoF;IACpF,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,iFAAiF;IACjF,SAAS,CAAC,EAAE,QAAQ,GAAG,OAAO,GAAG,KAAK,CAAA;IACtC,sFAAsF;IACtF,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;CACtB,CAAA;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAC3B,CAAA;AAED,mEAAmE;AACnE,MAAM,MAAM,iBAAiB,GAAG;IAC9B,KAAK,EAAE,MAAM,CAAA;IACb,YAAY,EAAE,MAAM,CAAA;IACpB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB,CAAA;AAED,6DAA6D;AAC7D,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,EAAE,iBAAiB,EAAE,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;AAEzF,0DAA0D;AAC1D,MAAM,MAAM,iBAAiB,GAAG,CAAC,IAAI,EAAE,QAAQ,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;AAExE,2DAA2D;AAC3D,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;AAE7E,8DAA8D;AAC9D,MAAM,MAAM,aAAa,GAAG;IAC1B,mEAAmE;IACnE,KAAK,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;IAC7B,2CAA2C;IAC3C,aAAa,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;IACrC,sEAAsE;IACtE,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,QAAQ,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,KAAK,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC1H,0CAA0C;IAC1C,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CACzC,CAAA;AAyKD,6DAA6D;AAC7D,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,EACxD,SAAS,CAAC,EAAE,oBAAoB,EAChC,MAAM,CAAC,EAAE,iBAAiB,EAC1B,MAAM,CAAC,EAAE,aAAa,EACtB,SAAS,CAAC,EAAE,oBAAoB,GAC/B,OAAO,CAAC,YAAY,CAAC,CA+LvB"}

package/dist/status.js

@@ -84,6 +84,9 @@ function renderInfo(s){
   document.getElementById('info').innerHTML=roleRow(s.role)+card('peer id',s.peerId)
     +card('peer addresses',(s.peerAddrs||[]).join(', '))+card('wallet',s.wallet)
     +card('active sessions',s.activeSessions)
+    +card('connection',s.transport==='direct'?'libp2p direct'
+      :s.transport==='relay'?'seed VM relay (traffic is forwarded; clients try direct first)'
+      :'this network only — no public address and no relay reservation yet')
     +card('discovery',s.reachable
       ? (s.publishAddress
           ? 'global directory (public address published)'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@genkaku/protocol",
-  "version": "0.1.10",
+  "version": "0.1.12",
   "description": "GenKaKu protocol core: on-chain worker directory, USDC escrow billing, libp2p transport, Ollama lifecycle",
   "license": "MIT",
   "type": "module",
@@ -21,14 +21,15 @@
     "LICENSE"
   ],
   "dependencies": {
-    "@chainsafe/libp2p-noise": "15.1.2",
-    "@chainsafe/libp2p-yamux": "6.0.2",
-    "@libp2p/crypto": "4.1.9",
-    "@libp2p/identify": "2.1.5",
-    "@libp2p/peer-id-factory": "4.2.4",
-    "@libp2p/tcp": "9.1.6",
+    "@chainsafe/libp2p-noise": "16.1.5",
+    "@chainsafe/libp2p-yamux": "7.0.4",
+    "@libp2p/circuit-relay-v2": "3.2.24",
+    "@libp2p/crypto": "5.1.8",
+    "@libp2p/identify": "3.0.39",
+    "@libp2p/peer-id": "5.1.9",
+    "@libp2p/tcp": "10.1.19",
     "@multiformats/multiaddr": "12.5.1",
-    "libp2p": "1.9.4",
+    "libp2p": "2.10.0",
     "viem": "2.57.16"
   },
   "repository": {
@@ -51,6 +52,9 @@
     "usdc",
     "base"
   ],
+  "engines": {
+    "node": ">=22"
+  },
   "scripts": {
     "build": "tsc -p tsconfig.json",
     "typecheck": "tsc -p tsconfig.json --noEmit",