@prismnetwork/agent-sdk 0.6.1 → 0.7.0

package/prism.mjs

@@ -1,6 +1,7 @@
 // Prism Network agent SDK: headless GPU leasing for wallet-holding agents.
 // No browser, no Privy. Authenticate with a wallet signature, pay on-chain, run.
 import { execFileSync, spawn } from "node:child_process";
+import { createHash } from "node:crypto";
 import { mkdtempSync, readFileSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
@@ -14,10 +15,14 @@ import {
   stringToBytes,
 } from "viem";
 import { privateKeyToAccount } from "viem/accounts";
+import { appraiseWorkload, DEFAULT_CONFIDENTIAL_BASE, EXPECTED_WORKLOAD, verifyConfidential } from "./attest.mjs";
+import { decryptResponse, encryptChatRequest } from "./e2ee.mjs";
 import { openRelayForwarder } from "./relay.mjs";
 import { PrismVault } from "./vault.mjs";
+import { toHex, verifyComposeMeasurement, verifyQuote, verifyReportBinding } from "./vendor/aci-verifier/index.mjs";
 import { PrismWorkspace } from "./workspace.mjs";
 
+export { DEFAULT_CONFIDENTIAL_BASE, EXPECTED_WORKLOAD, renderChecks, verifyConfidential } from "./attest.mjs";
 export { PrismVault, VaultError, DEFAULT_TRUST_FLOOR, VAULT_KEY_STATEMENT } from "./vault.mjs";
 export {
   PrismWorkspace,
@@ -46,6 +51,12 @@ export const TRUST_CLASSES = ["open", "isolated", "attested", "confidential"];
 
 const CONFIRMATIONS = 12;
 const FETCH_TIMEOUT_MS = 30_000;
+// A generation can wait on a cold box, so the paid call gets its own budget and
+// keeps the payment across the wait rather than paying twice.
+const PAID_CALL_TIMEOUT_MS = 620_000;
+const PAID_CALL_DEADLINE_MS = 600_000;
+const PAID_CALL_RETRY_MS = 15_000;
+const DEFAULT_MAX_TOKENS = 512;
 
 const erc20Abi = parseAbi([
   "function approve(address spender, uint256 value) returns (bool)",
@@ -105,6 +116,32 @@ function isSshWarmup(res) {
 
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 
+const asBytes = (body) =>
+  typeof body === "string" || body instanceof Uint8Array ? body : Buffer.from(JSON.stringify(body), "utf8");
+
+/// A sealed answer, or an error that names the reason it did not open. The
+/// service marks an encrypted answer with `x-e2ee-applied`, and a plaintext one
+/// fails the AEAD for a reason that has nothing to do with the key.
+function decryptAnswer(bytes, clientKey, headers, receiptId) {
+  const applied = headers.get("x-e2ee-applied");
+  const paidFor = `the generation is paid for, and receipt ${receiptId} still verifies what the workload served`;
+  if (applied !== null && applied.toLowerCase() !== "true") {
+    throw new PrismError(502, "e2ee_not_applied", {
+      cause: `the endpoint answered with x-e2ee-applied: ${applied}`,
+      hint: `the enclave returned the answer unencrypted; ${paidFor}`,
+    });
+  }
+  try {
+    return decryptResponse(bytes, clientKey);
+  } catch (err) {
+    if (applied !== null) throw err;
+    throw new PrismError(502, "e2ee_not_applied", {
+      cause: err?.message ?? String(err),
+      hint: `the endpoint marked no answer as encrypted and this one did not open under this call's key; ${paidFor}`,
+    });
+  }
+}
+
 export class PrismAgent {
   constructor({ privateKey, apiBase = "https://prismnetwork.tech", escrow, rpcUrl }) {
     if (!escrow) throw new Error("escrow address is required");
@@ -175,12 +212,14 @@ export class PrismAgent {
 
   async transferUsdg(to, amountMicros) {
     try {
-      const hash = await this.walletClient.writeContract({
-        address: USDG,
-        abi: erc20Abi,
-        functionName: "transfer",
-        args: [to, BigInt(amountMicros)],
-      });
+      const hash = await this.#submit(() =>
+        this.walletClient.writeContract({
+          address: USDG,
+          abi: erc20Abi,
+          functionName: "transfer",
+          args: [to, BigInt(amountMicros)],
+        }),
+      );
       const receipt = await this.publicClient.waitForTransactionReceipt({ hash });
       if (receipt.status !== "success") throw new PrismError(502, "transfer_reverted", { hash });
       return hash;
@@ -213,6 +252,10 @@ export class PrismAgent {
   // Approve USDG and create the on-chain lease bound to the quote. The escrow
   // binds funding to keccak256(quote_id), so reproduce it exactly or confirm rejects.
   async fund(quote) {
+    return this.#submit(() => this.#fundNow(quote));
+  }
+
+  async #fundNow(quote) {
     if (typeof quote?.quote_id !== "string" || typeof quote?.node_id !== "string") {
       throw new PrismError(400, "invalid_quote");
     }
@@ -220,28 +263,37 @@ export class PrismAgent {
     const duration = parseDuration(quote.duration_seconds);
     const clientReference = keccak256(stringToBytes(quote.quote_id));
     try {
-      const allowance = await this.publicClient.readContract({
-        address: USDG,
-        abi: erc20Abi,
-        functionName: "allowance",
-        args: [this.address, this.escrow],
-      });
-      if (allowance < deposit) {
-        const approveHash = await this.walletClient.writeContract({
+      // Approving and spending are one indivisible step. The approval covers
+      // exactly this deposit, so a second lease that read the allowance before
+      // this one spent it would find it gone by the time the chain ran it.
+      const hash = await (async () => {
+        const allowance = await this.publicClient.readContract({
           address: USDG,
           abi: erc20Abi,
-          functionName: "approve",
-          args: [this.escrow, deposit],
+          functionName: "allowance",
+          args: [this.address, this.escrow],
         });
-        const approved = await this.publicClient.waitForTransactionReceipt({ hash: approveHash });
-        if (approved.status !== "success") throw new PrismError(402, "approve_reverted", { hash: approveHash });
-      }
-      const hash = await this.walletClient.writeContract({
-        address: this.escrow,
-        abi: escrowAbi,
-        functionName: "createLease",
-        args: [quote.node_id, duration, clientReference],
-      });
+        if (allowance < deposit) {
+          const approveHash = await this.walletClient.writeContract({
+            address: USDG,
+            abi: erc20Abi,
+            functionName: "approve",
+            args: [this.escrow, deposit],
+          });
+          const approved = await this.publicClient.waitForTransactionReceipt({ hash: approveHash });
+          if (approved.status !== "success") throw new PrismError(402, "approve_reverted", { hash: approveHash });
+        }
+        const funding = await this.walletClient.writeContract({
+          address: this.escrow,
+          abi: escrowAbi,
+          functionName: "createLease",
+          args: [quote.node_id, duration, clientReference],
+        });
+        // One confirmation here, not for the control-plane's benefit but so the
+        // allowance and the nonce are settled before the next lease reads them.
+        await this.publicClient.waitForTransactionReceipt({ hash: funding });
+        return funding;
+      })();
       // 12 confirmations: the control-plane rejects funding until the tx is final.
       const receipt = await this.publicClient.waitForTransactionReceipt({ hash, confirmations: CONFIRMATIONS });
       if (receipt.status !== "success") throw new PrismError(402, "lease_funding_reverted", { hash });
@@ -358,26 +410,35 @@ export class PrismAgent {
         hint: "the wallet needs USDG for the deposit and native ETH for gas on Robinhood Chain (id 4663) before it can lease",
       });
     }
-    const quote = await this.quote({
-      image,
-      durationSeconds,
-      minVramMib,
-      preferredNodeId,
-      minTrustClass,
-      command,
-    });
-    if (maxDeposit != null && parseBaseUnits(quote.maximum_escrow, "maximum_escrow") > BigInt(maxDeposit)) {
-      throw new PrismError(402, "cost_exceeds_max", { required: quote.maximum_escrow, max: String(maxDeposit) });
-    }
     const key = this.#generateSshKey();
+    let quote = null;
     let funded = null;
     let leaseId = null;
     try {
-      funded = await this.fund(quote);
-      const record = await this.confirm({
-        quoteId: quote.quote_id,
-        transactionHash: funded.hash,
-        sshAuthorizedKey: key.publicKey,
+      // One renter takes one machine at a time, up to the point the chain knows
+      // it is taken. Asking for a quote releases this renter's other open
+      // quotes, so two quotes held at once can name the same machine and the
+      // second lease reverts against a node that is no longer free. Only the
+      // claim is serialised: provisioning, which is the part that takes
+      // minutes, still runs in parallel.
+      const record = await this.#submit(async () => {
+        quote = await this.quote({
+          image,
+          durationSeconds,
+          minVramMib,
+          preferredNodeId,
+          minTrustClass,
+          command,
+        });
+        if (maxDeposit != null && parseBaseUnits(quote.maximum_escrow, "maximum_escrow") > BigInt(maxDeposit)) {
+          throw new PrismError(402, "cost_exceeds_max", { required: quote.maximum_escrow, max: String(maxDeposit) });
+        }
+        funded = await this.#fundNow(quote);
+        return this.confirm({
+          quoteId: quote.quote_id,
+          transactionHash: funded.hash,
+          sshAuthorizedKey: key.publicKey,
+        });
       });
       if (!Number.isInteger(record?.lease_id)) {
         throw new PrismError(502, "malformed_lease_record", { funding_hash: funded.hash });
@@ -496,6 +557,361 @@ export class PrismAgent {
     }
   }
 
+  // Unconsumed inference payments, keyed by the endpoint, the price and the
+  // request they paid for, so a generation that never happened is retried with
+  // the payment already made instead of paying for it twice, and a different
+  // prompt never inherits it.
+  #pendingPayments = new Map();
+
+  /// Pay for one call to a metered endpoint and keep the payment until the
+  /// endpoint actually serves. A 503 from an upstream that is merely
+  /// unavailable and a 402 for a payment that is only too young both heal by
+  /// themselves, so both retry with the same payment; everything else is final
+  /// and the payment stays cached for the next attempt at the same request.
+  ///
+  /// `body` is sent verbatim when it is already bytes, which is what a signed
+  /// receipt over the request needs: nothing between the caller and the workload
+  /// re-serializes it. Pass `seal` instead for a request that has to be built
+  /// fresh per attempt, such as an end-to-end encrypted one whose timestamp the
+  /// service only accepts inside a five-minute window, and pass `fingerprint`
+  /// so the cache still recognises two attempts as the same request.
+  async payAndPost({
+    base,
+    path,
+    price,
+    payTo,
+    body = null,
+    headers = {},
+    seal = null,
+    fingerprint = null,
+    retryDelayMs = PAID_CALL_RETRY_MS,
+    caller = "call",
+  }) {
+    let sent = seal ? seal() : { bytes: asBytes(body), headers };
+    const identity = createHash("sha256").update(fingerprint ?? sent.bytes).digest("hex");
+    const key = `${base}${path}:${price}:${identity}`;
+    let pending = this.#pendingPayments.get(key);
+    if (!pending) {
+      const tx = await this.transferUsdg(payTo, price);
+      const signature = await this.account.signMessage({ message: tx });
+      pending = { tx, header: Buffer.from(JSON.stringify({ txHash: tx, signature })).toString("base64") };
+      this.#pendingPayments.set(key, pending);
+    }
+    // The transfer is on-chain and irreversible from here. The signed header is
+    // the only thing that redeems it, and it lives in this process.
+    const kept = {
+      payment_tx: pending.tx,
+      payment_header: pending.header,
+      hint:
+        `the payment (tx ${pending.tx}) settled on-chain and the endpoint did not serve. While this process lives, ` +
+        `the next ${caller} for this same request redeems it without paying again. payment_header is what redeems ` +
+        "it, so keep it to do that from anywhere else.",
+    };
+    const deadline = Date.now() + PAID_CALL_DEADLINE_MS;
+    for (;;) {
+      let res;
+      let bytes;
+      try {
+        res = await fetch(`${base}${path}`, {
+          method: "POST",
+          headers: { "content-type": "application/json", "x-payment": pending.header, ...sent.headers },
+          body: sent.bytes,
+          signal: AbortSignal.timeout(PAID_CALL_TIMEOUT_MS),
+        });
+        bytes = Buffer.from(await res.arrayBuffer());
+      } catch (err) {
+        throw new PrismError(504, "endpoint_unreachable", { cause: err?.message ?? String(err), ...kept });
+      }
+      if (res.status === 200) {
+        this.#pendingPayments.delete(key);
+        // The endpoint replays a stored answer when it sees a payment it has
+        // already consumed. That is an answer to an earlier call, so it is not
+        // this one's, whatever the status line says.
+        if (String(res.headers.get("x-prism-replayed") ?? "").toLowerCase() === "true") {
+          throw new PrismError(409, "payment_replayed", {
+            cause: `the endpoint replayed an earlier answer for tx ${pending.tx}`,
+            hint: "this payment was already consumed by another call; pay again to have this request served",
+          });
+        }
+        return { status: 200, headers: res.headers, bytes, tx: pending.tx, sent };
+      }
+      const answered = (() => {
+        try {
+          return JSON.parse(bytes.toString("utf8"));
+        } catch {
+          return null;
+        }
+      })();
+      // A payment the endpoint has already consumed will never serve anything
+      // again, so it stops being something to retry with.
+      if (answered?.error === "payment_reused") this.#pendingPayments.delete(key);
+      const retryAfter = Number(res.headers.get("retry-after") ?? 0);
+      const retryable =
+        (res.status === 503 && answered?.error === "upstream_unavailable" && !(retryAfter > 120)) ||
+        (res.status === 402 && ["insufficient_confirmations", "tx_not_found"].includes(answered?.error));
+      if (!retryable || Date.now() > deadline) {
+        const said = [answered?.detail, answered?.retry].filter(Boolean).join("; ");
+        throw new PrismError(res.status, answered?.error ?? "generation_failed", {
+          cause: said || answered?.error || `status ${res.status}`,
+          ...(this.#pendingPayments.has(key) ? kept : { payment_tx: pending.tx }),
+        });
+      }
+      await sleep(retryDelayMs);
+      if (seal) sent = seal();
+    }
+  }
+
+  /// Buy one generation from the confidential tier: an OpenAI-shaped chat
+  /// request served by a model running in a GPU TEE, answered with a signed
+  /// receipt over the exact bytes of the exchange.
+  ///
+  /// With `e2ee` on (the default) the message contents are encrypted to a key
+  /// the enclave's own attestation quote commits to, established here before
+  /// anything is sent or paid, so the relay in between carries ciphertext. The
+  /// returned handle keeps those bytes and `verify()` checks the whole chain
+  /// against them.
+  ///
+  /// `expectedWorkload` is the code that enclave must be running, defaulting to
+  /// the deployment this SDK ships pinned. Passing `null` skips that appraisal
+  /// and leaves the prompt protected only by "some TDX enclave holds the key".
+  async confidentialInfer({
+    prompt = null,
+    messages = null,
+    model = null,
+    maxUsdg = 0.25,
+    maxTokens = DEFAULT_MAX_TOKENS,
+    e2ee = true,
+    expectedWorkload = EXPECTED_WORKLOAD,
+    endpoint = DEFAULT_CONFIDENTIAL_BASE,
+  } = {}) {
+    const chat = messages ?? (typeof prompt === "string" && prompt.trim() !== "" ? [{ role: "user", content: prompt }] : null);
+    if (!Array.isArray(chat) || chat.length === 0) {
+      throw new PrismError(400, "prompt_required", { hint: "pass a prompt string or a messages array" });
+    }
+    if (!Number.isInteger(maxTokens) || maxTokens <= 0) throw new PrismError(400, "invalid_max_tokens");
+    const base = String(endpoint).replace(/\/$/, "");
+    const chosen = await this.#confidentialModel(base, model, maxTokens);
+
+    // Everything that protects the prompt happens before it is sent: the key it
+    // is encrypted to has to be one the hardware quote commits to and the code
+    // behind that quote has to be the code this SDK pins, not whatever the
+    // relay offered.
+    const body = { model: chosen.model, messages: chat, max_tokens: maxTokens };
+    const plaintext = Buffer.from(JSON.stringify(body), "utf8");
+    let keysetDigest = null;
+    let seal = null;
+    if (e2ee) {
+      const established = await this.#establishKeyset(base, expectedWorkload);
+      keysetDigest = established.digest;
+      // The service rejects a request whose timestamp is more than five minutes
+      // old, and the retry budget is longer than that, so each attempt seals
+      // its own envelope with a fresh nonce and clock.
+      seal = () => encryptChatRequest(body, established.keyset);
+    }
+
+    // Encryption roughly doubles the body, and the relay refuses an oversized
+    // one after the payment has been made, so one envelope is built here purely
+    // to measure and the attempts seal their own.
+    const sized = seal ? seal().bytes : plaintext;
+    if (Number.isInteger(chosen.card.max_body_bytes) && sized.length > chosen.card.max_body_bytes) {
+      throw new PrismError(413, "request_too_large", {
+        required: String(sized.length),
+        max: String(chosen.card.max_body_bytes),
+      });
+    }
+
+    const quote = await this.#confidentialQuote(base, chosen, maxTokens);
+    const cap = BigInt(Math.round(maxUsdg * 1e6));
+    if (quote.price <= 0n || quote.price > cap) {
+      throw new PrismError(402, "cost_exceeds_max", { required: quote.price.toString(), max: cap.toString() });
+    }
+
+    const served = await this.payAndPost({
+      base,
+      path: "/v1/chat/completions",
+      price: quote.price,
+      payTo: quote.payTo,
+      ...(seal ? { seal, fingerprint: plaintext } : { body: plaintext }),
+      caller: "confidentialInfer",
+    });
+    const receiptId = served.headers.get("x-receipt-id");
+    const sent = served.sent;
+    const answer = seal
+      ? decryptAnswer(served.bytes, sent.clientKey, served.headers, receiptId)
+      : JSON.parse(served.bytes.toString("utf8"));
+
+    // The workload keeps receipts in memory only, so this one is fetched now
+    // and kept, whether or not the caller ever verifies it.
+    const receipt = receiptId ? await this.#confidentialReceipt(base, receiptId) : null;
+
+    return {
+      model: chosen.model,
+      content: answer?.choices?.[0]?.message?.content ?? null,
+      usage: answer?.usage ?? null,
+      receiptId,
+      receipt,
+      keysetDigest,
+      e2ee: Boolean(seal),
+      priceMicros: quote.price.toString(),
+      priceUsdg: (Number(quote.price) / 1e6).toFixed(6),
+      tx: served.tx,
+      bytes: {
+        request: sent.bytes,
+        response: served.bytes,
+        ...(seal ? { restoredRequest: sent.restored } : {}),
+      },
+      verify: (options = {}) =>
+        verifyConfidential({
+          base,
+          model: chosen.model,
+          receiptId,
+          receipt,
+          requestBytes: sent.bytes,
+          responseBytes: served.bytes,
+          restoredRequestBytes: seal ? sent.restored : null,
+          e2ee: Boolean(seal),
+          expectedWorkload,
+          expectedKeysetDigest: keysetDigest,
+          ...options,
+        }),
+    };
+  }
+
+  /// The confidential half of the endpoint's rate card, and the model this call
+  /// should use. The card also states the caps the endpoint enforces, so a
+  /// request it would refuse is refused here instead, before it is paid for.
+  async #confidentialModel(base, requested, maxTokens) {
+    const offer = await this.#publicJson(`${base}/v1/models`, "inference_endpoint_unavailable");
+    const card = offer.confidential;
+    const models = Object.keys(card?.models ?? {});
+    if (models.length === 0) {
+      throw new PrismError(503, "no_confidential_model", { hint: `${base} offers no confidential model right now` });
+    }
+    const model = requested ?? models[0];
+    if (!models.includes(model)) {
+      throw new PrismError(400, "unknown_model", { hint: `confidential models: ${models.join(", ")}` });
+    }
+    if (Number.isInteger(card.max_tokens) && maxTokens > card.max_tokens) {
+      throw new PrismError(400, "invalid_max_tokens", { hint: `the endpoint caps max_tokens at ${card.max_tokens}` });
+    }
+    return { model, card, payTo: offer.pay_to ?? null };
+  }
+
+  /// The keyset the enclave's quote commits to, and the code behind that quote.
+  /// Only the checks that protect the prompt run here, which is every check that
+  /// says who can read it: the quote verifies to Intel's root and commits to
+  /// this key set and this nonce, the boot log replays to the measurement that
+  /// quote states, and the measured compose runs the pinned launcher and source.
+  /// The rest of the transcript, receipt included, runs after the answer comes
+  /// back. Anything short of all of that refuses to hand over a prompt.
+  async #establishKeyset(base, expectedWorkload = EXPECTED_WORKLOAD) {
+    const nonce = Buffer.from(globalThis.crypto.getRandomValues(new Uint8Array(32))).toString("hex");
+    const report = await this.#publicJson(`${base}/v1/attestation?nonce=${nonce}`, "attestation_unavailable");
+    const binding = await verifyReportBinding(report, nonce);
+    if (!binding.ok) {
+      const bad = binding.checks.find((c) => !c.ok);
+      throw new PrismError(502, "attestation_unverified", { cause: bad?.detail ?? bad?.name });
+    }
+    // Which code the report describes is appraised before its quote is, so a
+    // report naming the wrong workload is refused whatever hardware signed it.
+    let measurement;
+    try {
+      measurement = await verifyComposeMeasurement(report);
+    } catch (err) {
+      throw new PrismError(502, "attestation_unverified", {
+        cause: `the report's boot evidence could not be read: ${err?.message ?? err}`,
+      });
+    }
+    const composeHash = measurement.checks.find((c) => c.name === "compose_hash");
+    if (!composeHash.ok) throw new PrismError(502, "attestation_unverified", { cause: composeHash.detail });
+    const identity = await appraiseWorkload(report, measurement, expectedWorkload);
+    if (!identity.ok) {
+      throw new PrismError(502, "attestation_unverified", {
+        cause: identity.detail,
+        hint: "the enclave quoting this key set is not running the code this SDK pins, so no prompt was sent to it",
+      });
+    }
+
+    const quote = await verifyQuote(report);
+    if (!quote.ok) throw new PrismError(502, "quote_unverified", { cause: quote.detail });
+    if (quote.status !== "UpToDate") {
+      throw new PrismError(502, "quote_unverified", { cause: `the platform TCB is ${quote.status}` });
+    }
+    // What makes the measurement above authentic: the log replays to the RTMR3
+    // the verified quote itself states.
+    if (toHex(quote.report.rtMr3) !== toHex(measurement.rtmr3)) {
+      throw new PrismError(502, "attestation_unverified", {
+        cause: "the boot event log does not replay to the RTMR3 the verified quote states",
+      });
+    }
+    return { digest: binding.workloadKeysetDigest, keyset: binding.keyset, provenance: identity.provenance ?? null };
+  }
+
+  /// The endpoint prices each request itself, so the figure comes from an
+  /// unpaid request rather than from arithmetic on the rate card.
+  async #confidentialQuote(base, chosen, maxTokens) {
+    let res;
+    try {
+      res = await fetch(`${base}/v1/chat/completions`, {
+        method: "POST",
+        headers: { "content-type": "application/json", accept: "application/json" },
+        body: JSON.stringify({ model: chosen.model, max_tokens: maxTokens }),
+        signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+      });
+    } catch (err) {
+      throw new PrismError(504, "inference_endpoint_unavailable", { cause: err?.message ?? String(err) });
+    }
+    if (res.status !== 402) {
+      throw new PrismError(res.status, "no_quote", { hint: "the endpoint did not answer an unpaid request with a price" });
+    }
+    const body = await res.json().catch(() => null);
+    const accepted = (body?.accepts ?? []).find((a) => a.network === "eip155:4663" || a.network === "robinhood");
+    const micros = body?.quote?.price_micros ?? accepted?.amount ?? accepted?.maxAmountRequired;
+    const payTo = accepted?.payTo ?? chosen.payTo;
+    if (micros == null || !payTo) throw new PrismError(502, "no_quote", { cause: "the 402 named no USDG price to pay" });
+    return { price: BigInt(micros), payTo };
+  }
+
+  async #confidentialReceipt(base, receiptId) {
+    try {
+      return await this.#publicJson(`${base}/v1/receipts/${encodeURIComponent(receiptId)}`, "receipt_unavailable");
+    } catch {
+      // The generation is paid for and delivered; a receipt that cannot be
+      // fetched right now is a verification the caller loses, not a failure of
+      // the call. verify() says so plainly when it runs.
+      return null;
+    }
+  }
+
+  async #publicJson(url, code) {
+    let res;
+    try {
+      res = await fetch(url, { headers: { accept: "application/json" }, signal: AbortSignal.timeout(FETCH_TIMEOUT_MS) });
+    } catch (err) {
+      throw new PrismError(504, code, { cause: err?.message ?? String(err) });
+    }
+    if (!res.ok) throw new PrismError(res.status, code, { cause: `${url} answered ${res.status}` });
+    const body = await res.json().catch(() => null);
+    if (body === null) throw new PrismError(502, code, { cause: `${url} answered with something that is not JSON` });
+    return body;
+  }
+
+  // A wallet has one nonce, so two transactions prepared at the same moment are
+  // handed the same one and the chain refuses the second. Everything that
+  // submits from this wallet queues here, which is what lets one wallet fund
+  // several leases at once: they provision in parallel, they just do not sign
+  // at the same instant.
+  #submitting = Promise.resolve();
+
+  #submit(send) {
+    const done = this.#submitting.then(send, send);
+    this.#submitting = done.then(
+      () => {},
+      () => {},
+    );
+    return done;
+  }
+
   #generateSshKey() {
     const dir = mkdtempSync(join(tmpdir(), "prism-ssh-"));
     try {

package/vendor/aci-verifier/crypto.mjs

@@ -0,0 +1,100 @@
+// Ported from Dstack-TEE/private-ai-gateway clients/verifier-ts @ b6b5c1b, Apache-2.0.
+//
+// Every primitive goes through the Web Crypto API on `globalThis.crypto`, so
+// the same code runs in a browser and in Node 20+ with no dependencies. ACI's
+// only signature algorithm is Ed25519 and its only hash is SHA-256 (spec
+// Appendix B); both are in Web Crypto, so nothing needs injecting.
+import { AciFormatError } from "./errors.mjs";
+
+const subtle = globalThis.crypto.subtle;
+
+export function toHex(bytes) {
+  let out = "";
+  for (const b of bytes) out += b.toString(16).padStart(2, "0");
+  return out;
+}
+
+export function fromHex(hex) {
+  const h = hex.startsWith("0x") || hex.startsWith("0X") ? hex.slice(2) : hex;
+  if (h.length % 2 !== 0) throw new AciFormatError(`hex string has odd length: ${hex.length} chars`);
+  const out = new Uint8Array(h.length / 2);
+  for (let i = 0; i < out.length; i++) {
+    const byte = Number.parseInt(h.slice(i * 2, i * 2 + 2), 16);
+    if (Number.isNaN(byte)) {
+      throw new AciFormatError(`invalid hex at offset ${i * 2}: "${h.slice(i * 2, i * 2 + 2)}"`);
+    }
+    out[i] = byte;
+  }
+  return out;
+}
+
+/// Standard base64 with padding (RFC 4648 §4), the `_b64` field form (Appendix A).
+export function toBase64(bytes) {
+  let bin = "";
+  for (const b of bytes) bin += String.fromCharCode(b);
+  return btoa(bin);
+}
+
+export function fromBase64(b64) {
+  let bin;
+  try {
+    bin = atob(b64);
+  } catch {
+    throw new AciFormatError("invalid base64");
+  }
+  const out = new Uint8Array(bin.length);
+  for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
+  return out;
+}
+
+/// JCS (RFC 8785) bytes of a parsed JSON value under the ACI artifact
+/// constraints (ASCII member names, integer numbers): compact serialization
+/// with sorted member names (§7.2, §8).
+export function jcsBytes(value) {
+  return new TextEncoder().encode(JSON.stringify(sortedValue(value)));
+}
+
+function sortedValue(value) {
+  if (Array.isArray(value)) return value.map(sortedValue);
+  if (value !== null && typeof value === "object") {
+    const out = {};
+    for (const key of Object.keys(value).sort()) out[key] = sortedValue(value[key]);
+    return out;
+  }
+  return value;
+}
+
+export async function sha256(bytes) {
+  return new Uint8Array(await subtle.digest("SHA-256", bytes));
+}
+
+/// The dstack RTMR replay hash (§9.1 policy).
+export async function sha384(bytes) {
+  return new Uint8Array(await subtle.digest("SHA-384", bytes));
+}
+
+export async function sha256Hex(bytes) {
+  return toHex(await sha256(bytes));
+}
+
+/// `sha256:<lowercase-hex>`, the ACI digest form (Appendix A) used for keyset
+/// digests, body hashes and session ids.
+export async function sha256Prefixed(bytes) {
+  return `sha256:${await sha256Hex(bytes)}`;
+}
+
+/// RFC 8032 over `message`. `publicKeyRaw` is the 32-byte raw key, `signature`
+/// the 64-byte value. A bad signature or a malformed key is false, never a throw.
+export async function verifyEd25519(publicKeyRaw, signature, message) {
+  let key;
+  try {
+    key = await subtle.importKey("raw", publicKeyRaw, { name: "Ed25519" }, false, ["verify"]);
+  } catch {
+    return false;
+  }
+  try {
+    return await subtle.verify({ name: "Ed25519" }, key, signature, message);
+  } catch {
+    return false;
+  }
+}