@verify-network/protocol 0.0.0-stage → 0.1.1

package/dist/index.js

@@ -0,0 +1,872 @@
+import { HASH_TO_CURVE_MAX_ITERATIONS, SENTINEL_PROOF, decodeProof, deriveRandomness, encodeProof, hashToCurveIterations, isFulfillable, isSentinel, proofCommitment, prove, publicKeyPoint, verify } from "./ecvrf.js";
+import { MAX_CALLBACK_DATA_BYTES, SERVICE_VRF, STALE_DELAY, isLate, remainingDelay, requestId, staleAt } from "./request.js";
+import { CALLDATA_GAS_PER_BYTE, DEFAULT_FEE_FLOOR, INTRINSIC_GAS, WHOLE_PREMIUM, ceiling, chargedGas, computeFees, fee, fulfillmentItemGas, lockedGasPrice, premiumShare, settlement, settlementAtShare } from "./fee.js";
+import { decodeRandomnessFulfilled, decodeRandomnessRequested, randomnessFulfilledEvent, randomnessRequestedEvent } from "./event.js";
+import { fulfillmentDigest, fulfillmentTypedData } from "./fulfillment.js";
+import { bytesToHex, encodeAbiParameters, getAddress, hashTypedData, hexToBigInt, isAddressEqual, keccak256, parseAbi, parseAbiItem, slice, toEventSelector } from "viem";
+import { Clock, Deferred, Duration, Effect, Exit, Layer, Option, PubSub, Result, Schema, Scope } from "effect";
+import { Socket } from "effect/socket";
+//#region src/attestation.ts
+/** Splits a 48-byte PCR the way the Nitro verifier takes it. */
+const bytes48 = (pcr) => ({
+	first: slice(pcr, 0, 32),
+	second: slice(pcr, 32, 48)
+});
+/**
+* Mirrors `NitroAttestationVerifier._hasExpectedNonce`, the Nitro verifier's check: the nonce an
+* enclave must put in its attestation for this operator to register this key on this router
+* before the deadline (seconds since the epoch), so an attestation registers nowhere else.
+*/
+const registrationNonce = ({ chainId, router, operator, publicKey, deadline }) => keccak256(encodeAbiParameters([
+	{ type: "uint256" },
+	{ type: "address" },
+	{ type: "address" },
+	{ type: "uint256[2]" },
+	{ type: "uint64" }
+], [
+	BigInt(chainId),
+	router,
+	operator,
+	[publicKey[0], publicKey[1]],
+	deadline
+]));
+/**
+* The attestation `registerNode` takes when the Nitro verifier is configured: the SP1 journal
+* and proof of the enclave's attestation document, and the deadline its nonce was bound to, as
+* `NitroAttestationVerifier.EnclaveRegistrationProof`.
+*/
+const encodeAttestation = ({ journal, proof, deadline }) => encodeAbiParameters([{
+	type: "tuple",
+	components: [
+		{
+			name: "journal",
+			type: "bytes"
+		},
+		{
+			name: "proof",
+			type: "bytes"
+		},
+		{
+			name: "deadline",
+			type: "uint64"
+		}
+	]
+}], [{
+	journal,
+	proof,
+	deadline
+}]);
+//#endregion
+//#region src/schemas.ts
+/** A `0x`-prefixed hex string of any length, as viem spells quantities, data, and keys. */
+const HexString = Schema.TemplateLiteral(["0x", Schema.String]).pipe(Schema.check(Schema.isPattern(/^0x[0-9a-fA-F]*$/)));
+/** Whole bytes in hex: exactly `size` of them, or any number when no size is given. */
+const hexBytes = (size) => HexString.pipe(Schema.check(Schema.isPattern(size === void 0 ? /^0x([0-9a-fA-F]{2})*$/ : new RegExp(`^0x[0-9a-fA-F]{${2 * size}}$`))));
+const Address = hexBytes(20);
+const Bytes32 = hexBytes(32);
+/** A whole number that fits `bits` bits, decoded as viem does: `number` up to 48 bits. */
+const uintNumber = (bits) => Schema.Number.check(Schema.isInt(), Schema.isBetween({
+	minimum: 0,
+	maximum: 2 ** bits - 1
+}));
+/** A whole number that fits `bits` bits, as a `bigint`: what viem decodes anything past 48 bits to. */
+const uintBigInt = (bits) => Schema.BigInt.check(Schema.isBetweenBigInt({
+	minimum: 0n,
+	maximum: 2n ** bits - 1n
+}));
+const uint32 = uintNumber(32);
+const uint40 = uintNumber(40);
+const uint64 = uintBigInt(64n);
+const uint96 = uintBigInt(96n);
+/** The schema of a `Request` (request.ts), which `request.test.ts` holds to the same type. */
+const Request = Schema.Struct({
+	consumer: Address,
+	sequence: uint64,
+	fulfiller: Address,
+	assignedAt: uint40,
+	fee: uint96,
+	gasPrice: uint96,
+	callbackGasLimit: uint32,
+	callbackData: hexBytes()
+});
+//#endregion
+//#region src/directRequest.ts
+/**
+* An authorization: what a signer signs to make a direct request (ADR 0026, 0027, 0028). The
+* signer is not a field; the router recovers it from the signature. `node` is the one node that
+* may fulfill it, `deadline` the last second the router takes it, `nonce` unordered and used at
+* most once per signer, `maxGasPrice` the most the charge is priced at.
+*/
+const DirectRequest = Schema.Struct({
+	consumer: Address,
+	node: Address,
+	nonce: uintBigInt(256n),
+	deadline: uintBigInt(64n),
+	callbackGasLimit: uintNumber(32),
+	maxGasPrice: uintBigInt(256n),
+	callbackData: hexBytes()
+});
+const directRequestTypes = { DirectRequest: [
+	{
+		name: "consumer",
+		type: "address"
+	},
+	{
+		name: "node",
+		type: "address"
+	},
+	{
+		name: "nonce",
+		type: "uint256"
+	},
+	{
+		name: "deadline",
+		type: "uint64"
+	},
+	{
+		name: "callbackGasLimit",
+		type: "uint32"
+	},
+	{
+		name: "maxGasPrice",
+		type: "uint256"
+	},
+	{
+		name: "callbackData",
+		type: "bytes"
+	}
+] };
+/**
+* The typed data a signer signs, as viem's `signTypedData` takes it: the fulfillment's domain
+* (`VerifyNetworkVRF` version 2, the chain, the router) over the `DirectRequest` struct.
+*/
+const directRequestTypedData = ({ chainId, router, authorization }) => ({
+	domain: {
+		name: "VerifyNetworkVRF",
+		version: "2",
+		chainId,
+		verifyingContract: router
+	},
+	types: directRequestTypes,
+	primaryType: "DirectRequest",
+	message: authorization
+});
+/**
+* The authorization's EIP-712 digest, which is the direct request's id and the VRF input; the
+* router computes the same (ticket 02) and the contracts parity test holds it to this. The domain binds the chain and the router;
+* the type hash keeps it apart from every on-chain request id.
+*/
+const directRequestId = (authorization) => hashTypedData(directRequestTypedData(authorization));
+/**
+* Signs an authorization with a viem account that signs locally (a private key or a session
+* key): the strict low-`s` signature the router recovers the signer from over `directRequestId`.
+*/
+const signDirectRequest = ({ account, ...input }) => account.signTypedData(directRequestTypedData(input));
+/**
+* `IDirectVrfReceiver.onDirectRandomness`: what a consumer implements to receive a direct
+* request's randomness. A different selector from the on-chain callback, so a consumer that never
+* opted in cannot mistake one for a request it made; `signer` is who paid and who the consumer
+* decides about.
+*/
+const onDirectRandomness = parseAbiItem("function onDirectRandomness(bytes32 requestId, address signer, bytes32 randomness, bytes callbackData)");
+/**
+* `VrfFacet.DirectRequestFulfilled`: emitted beside `RandomnessFulfilled` on a direct fulfillment,
+* with the id, the signer and the node indexed. Spelled out here because the protocol package does
+* not depend on the contracts package; the contracts package holds it to the real log once the
+* router emits it (ticket 02 of the direct request).
+*/
+const directRequestFulfilledEvent = parseAbiItem("event DirectRequestFulfilled(bytes32 indexed requestId, address indexed signer, address indexed node, address consumer)");
+/**
+* `NodesFacet.NodeEndpointSet`: an operator published or changed the endpoint a node serves
+* direct requests at. Empty means the node serves none. Held to the real log as the event above,
+* once the router has the setter (ticket 03).
+*/
+const nodeEndpointSetEvent = parseAbiItem("event NodeEndpointSet(address indexed node, address indexed operator, string endpoint)");
+//#endregion
+//#region src/directApi.ts
+/** A 65-byte secp256k1 signature, as a signer's over an authorization or the enclave's over a fulfillment. */
+const Signature = hexBytes(65);
+/**
+* `POST /direct`: the authorization as the signer signed it (`DirectRequest`, whose numbers are
+* decimal strings in JSON, as `GET /` spells the public key) and the signer's signature over it.
+*/
+const DirectRequestBody = Schema.Struct({
+	...DirectRequest.fields,
+	signature: Signature
+});
+/**
+* What `POST /direct` returns once the node's source has seen the fulfillment land: the id, the
+* randomness the consumer received, the evidence a challenge takes, and the transaction.
+*/
+const DirectResponse = Schema.Struct({
+	requestId: Bytes32,
+	randomness: Bytes32,
+	proof: Schema.Tuple([
+		Schema.BigInt,
+		Schema.BigInt,
+		Schema.BigInt,
+		Schema.BigInt
+	]),
+	enclaveSignature: Signature,
+	hash: Bytes32
+});
+/**
+* `GET /` as a signer reads it: the node the endpoint serves and its public key. The enclave's
+* status carries more (the chain, the runtime's counters); a client needs these two to know the
+* endpoint is the node's the router named, and which key its proofs verify under.
+*/
+const NodeIdentity = Schema.Struct({
+	node: hexBytes(20),
+	publicKey: Schema.Tuple([Schema.BigInt, Schema.BigInt])
+});
+/**
+* A 400: why `POST /direct` refused an authorization, cheapest check first (ADR 0026, 0028):
+* the callback data is over the router's cap; the named node is another; the deadline has
+* passed or is past the horizon; the maximum gas price is under what the sender would bid now;
+* the callback gas limit is over the router's maximum; the signer's signature recovers nobody;
+* the id has no curve point under the enclave key, so the signer picks another nonce; or the
+* signer's balance does not cover the ceiling.
+*/
+var DirectRequestRefused = class extends Schema.TaggedError()("DirectRequestRefused", { reason: Schema.Literals([
+	"too-long",
+	"wrong-node",
+	"deadline",
+	"max-gas-price",
+	"callback-gas-limit",
+	"bad-signature",
+	"unfulfillable",
+	"insufficient-balance"
+]) }) {};
+/** A 409: this node already took up, or saw land, an authorization under `signer` and `nonce`. */
+var NonceTaken = class extends Schema.TaggedError()("NonceTaken", {
+	signer: Schema.String,
+	nonce: Schema.BigInt
+}) {};
+/**
+* A 429: the node is past a bound (as many direct requests in flight as it takes at once, as
+* many under this signer, or a block on the caller's address for the incorrect authorizations it
+* sent), or the edge in front of it refused the flood with no body of the node's. Nothing was
+* checked or proven; the signer may try another node, or this one again later.
+*/
+var TooManyRequests = class extends Schema.TaggedError()("TooManyRequests", { reason: Schema.Literals([
+	"in-flight",
+	"signer",
+	"ip",
+	"edge"
+]) }) {};
+/**
+* A 503: the node serves no direct request right now: it is not set up; it is not in the active
+* set (exiting, ejected, forgotten, or stopped); its request source reports no connection, so it
+* could not see the fulfillment land; or the chain could not be read.
+*/
+var NotServing = class extends Schema.TaggedError()("NotServing", { reason: Schema.Literals([
+	"not-set-up",
+	"not-active",
+	"disconnected",
+	"chain-unreachable"
+]) }) {};
+/**
+* A 504: the authorization's deadline passed before the source saw the fulfillment land: it can
+* no longer land, so the signer may make an on-chain request instead (ADR 0026).
+*/
+var DeadlinePassed = class extends Schema.TaggedError()("DeadlinePassed", { deadline: Schema.BigInt }) {};
+/** Every refusal `POST /direct` answers with, as its body spells it. */
+const DirectRefusal = Schema.Union([
+	DirectRequestRefused,
+	NonceTaken,
+	TooManyRequests,
+	NotServing,
+	DeadlinePassed
+]);
+//#endregion
+//#region src/quote.ts
+/** How old the base fee read may be before the next question reads it again. */
+const BASE_FEE_MAX_AGE = "30 seconds";
+const routerPricing = parseAbi(["function pricing() view returns ((uint16 premiumPercent, uint32 fulfillmentOverheadGas, uint32 fulfillmentSettlementGas, uint32 defaultCallbackGasLimit, uint32 maxCallbackGasLimit))"]);
+/** The router could not be read; `operation` names the viem call. */
+var RouterUnreadable = class extends Schema.TaggedError()("RouterUnreadable", {
+	operation: Schema.String,
+	cause: Schema.Defect()
+}) {};
+const readRouter$1 = (operation, run) => Effect.tryPromise({
+	try: run,
+	catch: (cause) => new RouterUnreadable({
+		operation,
+		cause
+	})
+});
+const Quote = { make: Effect.fn("Quote.make")(function* ({ publicClient, router }) {
+	const pricing = yield* readRouter$1("pricing", () => publicClient.readContract({
+		address: router,
+		abi: routerPricing,
+		functionName: "pricing"
+	}));
+	let read;
+	const baseFee = Effect.gen(function* () {
+		const now = yield* Clock.currentTimeMillis;
+		if (read !== void 0 && now - read.at < Duration.toMillis(BASE_FEE_MAX_AGE)) return read.baseFeePerGas;
+		const baseFeePerGas = (yield* readRouter$1("getBlock", () => publicClient.getBlock({ blockTag: "latest" }))).baseFeePerGas ?? 0n;
+		read = {
+			baseFeePerGas,
+			at: now
+		};
+		return baseFeePerGas;
+	});
+	yield* baseFee;
+	const gasLimit = (input) => input.callbackGasLimit ?? pricing.defaultCallbackGasLimit;
+	return {
+		pricing,
+		bid: Effect.map(baseFee, (baseFeePerGas) => computeFees(baseFeePerGas)),
+		reservation: (input) => Effect.map(baseFee, (baseFeePerGas) => fee({
+			callbackGasLimit: gasLimit(input),
+			fulfillmentOverheadGas: pricing.fulfillmentOverheadGas,
+			callbackDataLength: input.callbackDataLength,
+			gasPrice: input.gasPrice,
+			baseFeePerGas,
+			premiumPercent: pricing.premiumPercent
+		})),
+		ceiling: (input) => ceiling({
+			callbackGasLimit: gasLimit(input),
+			fulfillmentOverheadGas: pricing.fulfillmentOverheadGas,
+			callbackDataLength: input.callbackDataLength,
+			maxGasPrice: input.maxGasPrice,
+			premiumPercent: pricing.premiumPercent
+		}),
+		charge: (input) => settlement({
+			gasUsed: input.gasUsed,
+			requestGasPrice: input.lockedGasPrice,
+			premiumPercent: pricing.premiumPercent,
+			fee: input.reservation,
+			assignedAt: input.assignedAt,
+			settledAt: input.settledAt
+		})
+	};
+}) };
+//#endregion
+//#region src/directClient.ts
+/** How long an authorization is good for when the caller names no deadline. */
+const DEFAULT_DEADLINE_SECONDS = 5;
+/**
+* Headroom over the bid the node's sender would make now: the maximum gas price an
+* authorization names by default. The charge is at the fulfillment's own gas price under it
+* (ADR 0028), so the headroom bounds the ceiling debited and refunded, not what is paid.
+*/
+const MAX_GAS_PRICE_HEADROOM = 2n;
+/** How long a `GET /` has to answer before the node is dropped from the measurement. */
+const MEASURE_TIMEOUT = "3 seconds";
+/** How long past the deadline a `POST /direct` is waited for before it is given up as unanswered. */
+const POST_GRACE = "3 seconds";
+const routerViews = parseAbi(["function activeNodes() view returns (address[])", "function endpointOf(address node) view returns (string)"]);
+/**
+* No node to post to: of `active` nodes, `published` had an endpoint the client trusts the shape
+* of, and none of those answered `GET /` as itself in time.
+*/
+var NoNodeServing = class extends Schema.TaggedError()("NoNodeServing", {
+	active: Schema.Int,
+	published: Schema.Int
+}) {};
+/** The account did not sign the authorization: a wallet refused, or the key could not. */
+var SigningFailed = class extends Schema.TaggedError()("SigningFailed", { cause: Schema.Defect() }) {};
+/**
+* The node answered something `POST /direct` does not: neither a landing nor a refusal it
+* spells, under a status that says the authorization was not taken up (a 4xx of the edge's, a
+* landing whose body cannot be read). Not a signal to fall back on: nothing here says whether
+* the fulfillment landed.
+*/
+var UnexpectedResponse = class extends Schema.TaggedError()("UnexpectedResponse", {
+	status: Schema.Int,
+	body: Schema.String
+}) {};
+const IPV4 = /^\d{1,3}(\.\d{1,3}){3}$/;
+/**
+* An endpoint as the client will use it, or nothing when it is not one the client connects to:
+* `https` only, a hostname rather than an IP literal, no credentials, no query. A trailing path
+* is kept, with a slash after it, so the routes resolve under it. A backend that fetched an
+* unvalidated URL from the chain would be an SSRF vector (ADR 0027).
+*/
+const validateEndpoint = (endpoint) => {
+	let url;
+	try {
+		url = new URL(endpoint);
+	} catch {
+		return;
+	}
+	if (url.protocol !== "https:") return void 0;
+	if (url.hostname === "" || url.hostname.startsWith("[") || IPV4.test(url.hostname)) return;
+	if (url.username !== "" || url.password !== "" || url.search !== "" || url.hash !== "") return;
+	return withTrailingSlash(url);
+};
+const withTrailingSlash = (url) => {
+	if (!url.pathname.endsWith("/")) url.pathname += "/";
+	return url;
+};
+const hasMulticall = (publicClient) => publicClient.chain?.contracts?.multicall3 !== void 0;
+const readRouter = (operation, run) => Effect.tryPromise({
+	try: run,
+	catch: (cause) => new RouterUnreadable({
+		operation,
+		cause
+	})
+});
+const readActive = (publicClient, router) => readRouter("activeNodes", () => publicClient.readContract({
+	address: router,
+	abi: routerViews,
+	functionName: "activeNodes"
+}));
+/** `endpointOf` for every node, in one multicall where the chain has one. */
+const readEndpoints = (publicClient, router, nodes) => {
+	const contracts = nodes.map((node) => ({
+		address: router,
+		abi: routerViews,
+		functionName: "endpointOf",
+		args: [node]
+	}));
+	return readRouter("endpointOf", () => hasMulticall(publicClient) ? publicClient.multicall({
+		contracts,
+		allowFailure: false
+	}) : Promise.all(contracts.map((contract) => publicClient.readContract(contract))));
+};
+/**
+* The active set with the endpoints the client will connect to: the router's `activeNodes`,
+* then the endpoints in one multicall, and every endpoint that is not `https` to a hostname
+* dropped (ADR 0027). `active` is the whole set, for telling "no node publishes an endpoint"
+* from "no node at all".
+*/
+const discoverNodes = Effect.fn("discoverNodes")(function* ({ publicClient, router }) {
+	const active = yield* readActive(publicClient, router);
+	const endpoints = active.length === 0 ? [] : yield* readEndpoints(publicClient, router, active);
+	const nodes = [];
+	active.forEach((node, i) => {
+		const url = validateEndpoint(endpoints[i] ?? "");
+		if (url !== void 0) nodes.push({
+			node: getAddress(node),
+			url
+		});
+	});
+	return {
+		active: active.length,
+		nodes
+	};
+});
+const decodeIdentity = Schema.decodeUnknownOption(Schema.toCodecJson(NodeIdentity));
+const decodeResponse = Schema.decodeUnknownOption(Schema.toCodecJson(DirectResponse));
+const decodeRefusal = Schema.decodeUnknownOption(Schema.toCodecJson(DirectRefusal));
+const encodeBody = Schema.encodeSync(Schema.toCodecJson(DirectRequestBody));
+const parseJson = (text) => {
+	try {
+		return JSON.parse(text);
+	} catch {
+		return;
+	}
+};
+/**
+* `GET /` on a candidate, timed: the node it reports must be the one the router named (an
+* endpoint answering as another node would refuse every authorization as `wrong-node`), and a
+* redirect, an error, or a slow answer drops it. The connection this opens is the warm one the
+* first request rides.
+*/
+const measure = (candidate, fetch) => Effect.promise(async (signal) => {
+	const startedAt = performance.now();
+	try {
+		const response = await fetch(candidate.url.href, {
+			method: "GET",
+			redirect: "manual",
+			signal
+		});
+		const text = await response.text();
+		const latencyMs = performance.now() - startedAt;
+		if (response.status !== 200) return void 0;
+		const identity = decodeIdentity(parseJson(text));
+		if (Option.isNone(identity)) return void 0;
+		if (candidate.node !== void 0 && !isAddressEqual(identity.value.node, candidate.node)) return;
+		return {
+			node: getAddress(identity.value.node),
+			url: candidate.url,
+			publicKey: identity.value.publicKey,
+			latencyMs
+		};
+	} catch {
+		return;
+	}
+}).pipe(Effect.timeoutOption(MEASURE_TIMEOUT), Effect.map(Option.getOrUndefined));
+const randomNonce = () => BigInt(bytesToHex(crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(32))));
+const DirectClient = { connect: Effect.fn("DirectClient.connect")(function* (options) {
+	const { publicClient, router, chainId, account } = options;
+	const fetch = options.fetch ?? ((input, init) => globalThis.fetch(input, init));
+	const domain = {
+		chainId,
+		router
+	};
+	let active;
+	let candidates;
+	if (options.endpoint === void 0) {
+		const discovered = yield* discoverNodes({
+			publicClient,
+			router
+		});
+		active = discovered.active;
+		candidates = discovered.nodes;
+	} else {
+		const url = yield* Effect.try({
+			try: () => withTrailingSlash(new URL(options.endpoint)),
+			catch: () => new NoNodeServing({
+				active: 0,
+				published: 0
+			})
+		});
+		active = 1;
+		candidates = [{ url }];
+	}
+	const answering = (yield* Effect.forEach(candidates, (candidate) => measure(candidate, fetch), { concurrency: "unbounded" })).filter((m) => m !== void 0);
+	if (answering.length === 0) return yield* new NoNodeServing({
+		active,
+		published: candidates.length
+	});
+	const node = answering.reduce((best, m) => m.latencyMs < best.latencyMs ? m : best);
+	const directUrl = new URL("direct", node.url).href;
+	const quote = yield* Quote.make({
+		publicClient,
+		router
+	});
+	const maxGasPrice = Effect.map(quote.bid, (bid) => bid.maxFeePerGas * MAX_GAS_PRICE_HEADROOM);
+	let clock;
+	const latestBlock = Effect.gen(function* () {
+		const block = yield* readRouter("getBlock", () => publicClient.getBlock({ blockTag: "latest" }));
+		const seconds = Number(block.timestamp);
+		if (Number.isFinite(seconds)) clock = {
+			seconds,
+			readAt: yield* Clock.currentTimeMillis
+		};
+		return block;
+	});
+	/** `now` on the chain's clock, in milliseconds, as far as the client has seen it: a lower bound. */
+	const chainNow = (now) => clock === void 0 ? now : clock.seconds * 1e3 + (now - clock.readAt);
+	/**
+	* The local millisecond at which the chain's clock has passed the deadline's second, the last
+	* one a fulfillment can land in. Never early, since the chain's clock held is a lower bound.
+	*/
+	const impossibleAt = (deadline, now) => now + (Number(deadline) + 1) * 1e3 - chainNow(now);
+	/** How long from `now` until `impossibleAt`; nothing once it is behind. */
+	const untilImpossible = (deadline, now) => Duration.millis(Math.max(0, impossibleAt(deadline, now) - now));
+	const deadlineSeconds = options.deadlineSeconds ?? 5;
+	yield* latestBlock;
+	return {
+		node,
+		quote,
+		maxGasPrice,
+		warm: measure(node, fetch).pipe(Effect.asVoid),
+		request: Effect.fn("DirectClient.request")(function* (input) {
+			const price = input.maxGasPrice ?? (yield* maxGasPrice);
+			const datedAt = yield* Clock.currentTimeMillis;
+			const deadline = input.deadline ?? BigInt(Math.floor(Math.max(datedAt, chainNow(datedAt)) / 1e3) + deadlineSeconds);
+			const authorize = (nonce) => ({
+				consumer: input.consumer,
+				node: node.node,
+				nonce,
+				deadline,
+				callbackGasLimit: input.callbackGasLimit ?? quote.pricing.defaultCallbackGasLimit,
+				maxGasPrice: price,
+				callbackData: input.callbackData
+			});
+			let authorization = authorize(input.nonce ?? randomNonce());
+			let requestId = directRequestId({
+				...domain,
+				authorization
+			});
+			while (input.nonce === void 0 && !isFulfillable(node.publicKey, requestId)) {
+				authorization = authorize(randomNonce());
+				requestId = directRequestId({
+					...domain,
+					authorization
+				});
+			}
+			const signature = yield* Effect.tryPromise({
+				try: () => signDirectRequest({
+					...domain,
+					authorization,
+					account: input.account ?? account
+				}),
+				catch: (cause) => new SigningFailed({ cause })
+			});
+			const body = JSON.stringify(encodeBody({
+				...authorization,
+				signature
+			}));
+			const outcome = (reason, elapsedMs) => Effect.gen(function* () {
+				yield* Effect.ignore(latestBlock);
+				yield* Effect.sleep(untilImpossible(deadline, yield* Clock.currentTimeMillis));
+				return {
+					_tag: "NotLanded",
+					node: node.node,
+					requestId,
+					authorization,
+					reason,
+					elapsedMs
+				};
+			});
+			const sentAt = performance.now();
+			const answered = yield* Effect.tryPromise((signal) => fetch(directUrl, {
+				method: "POST",
+				headers: { "content-type": "application/json" },
+				body,
+				redirect: "manual",
+				signal
+			}).then(async (response) => ({
+				status: response.status,
+				text: await response.text()
+			}))).pipe(Effect.timeoutOption(Duration.millis(Duration.toMillis(untilImpossible(deadline, datedAt)) + Duration.toMillis(POST_GRACE))), Effect.result);
+			const elapsedMs = performance.now() - sentAt;
+			if (Result.isFailure(answered) || Option.isNone(answered.success)) return yield* outcome("unreachable", elapsedMs);
+			const { status, text } = answered.success.value;
+			const json = parseJson(text);
+			if (status === 200) {
+				const response = decodeResponse(json);
+				if (Option.isNone(response)) return yield* new UnexpectedResponse({
+					status,
+					body: text.slice(0, 256)
+				});
+				if (response.value.requestId.toLowerCase() !== requestId.toLowerCase()) return yield* outcome("mismatched-answer", elapsedMs);
+				return {
+					_tag: "Landed",
+					node: node.node,
+					requestId,
+					authorization,
+					randomness: response.value.randomness,
+					proof: response.value.proof,
+					enclaveSignature: response.value.enclaveSignature,
+					hash: response.value.hash,
+					elapsedMs
+				};
+			}
+			const refusal = Option.getOrUndefined(decodeRefusal(json));
+			if (status === 504 || refusal instanceof DeadlinePassed) return yield* outcome("deadline-passed", elapsedMs);
+			if (refusal !== void 0) return yield* refusal;
+			if (status === 429) return yield* new TooManyRequests({ reason: "edge" });
+			if (status >= 500) return yield* outcome("unreachable", elapsedMs);
+			return yield* new UnexpectedResponse({
+				status,
+				body: text.slice(0, 256)
+			});
+		})
+	};
+}) };
+//#endregion
+//#region src/routerWatch.ts
+/** A JSON-RPC request as a text frame. */
+const requestFrame = (id, method, params) => JSON.stringify({
+	jsonrpc: "2.0",
+	id,
+	method,
+	params
+});
+/** The `eth_subscribe` of `pendingLogs` under `filter`, as a text frame. */
+const pendingLogsSubscribe = (id, filter) => requestFrame(id, "eth_subscribe", ["pendingLogs", filter]);
+/** The reply to a request of ours: the `eth_subscribe`, or anything else sent under an id. */
+const SubscriptionReply = Schema.Struct({
+	id: Schema.Finite,
+	result: Schema.optionalKey(Schema.String),
+	error: Schema.optionalKey(Schema.Struct({
+		code: Schema.Finite,
+		message: Schema.String
+	}))
+});
+/** A notification on a subscription; `result` is whatever the subscription carries. */
+const SubscriptionNotification = Schema.Struct({
+	method: Schema.Literal("eth_subscription"),
+	params: Schema.Struct({
+		subscription: Schema.String,
+		result: Schema.Unknown
+	})
+});
+/** What comes down the socket: one or the other. */
+const SubscriptionFrame = Schema.Union([SubscriptionReply, SubscriptionNotification]);
+const decodeSubscriptionFrame = Schema.decodeUnknownResult(SubscriptionFrame);
+/** A log as a `pendingLogs` notification carries it, as far as anything here reads it. */
+const PendingLog = Schema.Struct({
+	address: HexString,
+	topics: Schema.Array(HexString),
+	data: HexString,
+	blockNumber: HexString,
+	/** Named by the endpoints that carry it; what a sender matches its own request by. */
+	transactionHash: Schema.optionalKey(HexString),
+	removed: Schema.optionalKey(Schema.Boolean)
+});
+const decodePendingLog = Schema.decodeUnknownResult(PendingLog);
+/** The text of a frame as JSON, or nothing when it is not JSON. */
+const parseFrame = (text) => {
+	try {
+		return JSON.parse(text);
+	} catch {
+		return;
+	}
+};
+const REQUESTED_TOPIC = toEventSelector(randomnessRequestedEvent);
+const FULFILLED_TOPIC = toEventSelector(randomnessFulfilledEvent);
+/**
+* The observation a pending log carries, if it is one of the router's two the watch is for;
+* `at` is when its frame arrived. A log of another emitter, another event, or one the endpoint
+* withdrew is nothing.
+*/
+const seenIn = (router, result, at) => {
+	const log = Result.getOrUndefined(decodePendingLog(result));
+	if (log === void 0 || log.removed === true || !isAddressEqual(log.address, router)) return;
+	const topics = log.topics;
+	const observed = {
+		blockNumber: hexToBigInt(log.blockNumber),
+		transactionHash: log.transactionHash,
+		at
+	};
+	try {
+		if (topics[0] === REQUESTED_TOPIC) {
+			const { requestId, request } = decodeRandomnessRequested({
+				data: log.data,
+				topics
+			});
+			return {
+				event: "RandomnessRequested",
+				requestId,
+				request,
+				...observed
+			};
+		}
+		if (topics[0] === FULFILLED_TOPIC) return {
+			event: "RandomnessFulfilled",
+			...decodeRandomnessFulfilled({
+				data: log.data,
+				topics
+			}),
+			...observed
+		};
+	} catch {
+		return;
+	}
+};
+/** The endpoint refused the router's log subscription, or never confirmed it. */
+var SubscriptionRefused = class extends Schema.TaggedError()("SubscriptionRefused", {
+	url: Schema.String,
+	reason: Schema.String
+}) {
+	get message() {
+		return `${this.url} did not serve the router's logs: ${this.reason}`;
+	}
+};
+/** The socket carrying the router's logs ended while something was still waiting on it. */
+var WatchEnded = class extends Schema.TaggedError()("WatchEnded", { url: Schema.String }) {
+	get message() {
+		return `${this.url} ended the socket carrying the router's logs`;
+	}
+};
+const SUBSCRIBE_ID = 1;
+const DEFAULT_SUBSCRIBE_TIMEOUT = "20 seconds";
+const DEFAULT_OPEN_TIMEOUT = "20 seconds";
+/**
+* Opens the socket, subscribes to the router's request and fulfillment logs, and returns once
+* the endpoint has confirmed the subscription, so nothing is fired at the chain before the watch
+* meant to see it is in place. The WebSocket comes from the `Socket.WebSocketConstructor` in
+* context (`Socket.layerWebSocketConstructorGlobal` where there is a global one). Scoped: the
+* socket closes with the scope.
+*/
+const watchRouter = Effect.fn("watchRouter")(function* (options) {
+	const { url, router } = options;
+	const seen = yield* PubSub.unbounded();
+	const subscribed = yield* Deferred.make();
+	const ended = yield* Deferred.make();
+	const own = yield* PubSub.subscribe(seen);
+	const socket = yield* Socket.makeWebSocket(url, { openTimeout: options.openTimeout ?? DEFAULT_OPEN_TIMEOUT });
+	const { write } = yield* socket.writer;
+	let subscription;
+	const handle = (text) => {
+		const at = performance.now();
+		return Effect.gen(function* () {
+			const frame = Result.getOrUndefined(decodeSubscriptionFrame(parseFrame(text)));
+			if (frame === void 0) return;
+			if ("id" in frame) {
+				if (frame.id !== SUBSCRIBE_ID) return;
+				if (frame.error !== void 0 || frame.result === void 0) {
+					const reason = frame.error?.message ?? "the endpoint confirmed no subscription";
+					return yield* Deferred.fail(subscribed, new SubscriptionRefused({
+						url,
+						reason
+					}));
+				}
+				subscription = frame.result;
+				return yield* Deferred.succeed(subscribed, frame.result);
+			}
+			if (frame.params.subscription !== subscription) return;
+			const observed = seenIn(router, frame.params.result, at);
+			if (observed !== void 0) yield* PubSub.publish(seen, observed);
+		}).pipe(Effect.catchDefect((defect) => Effect.logWarning("routerWatch: a frame was not handled", { defect })));
+	};
+	yield* Effect.gen(function* () {
+		const pull = yield* Socket.readerString(socket);
+		for (;;) for (const text of yield* pull) yield* handle(text);
+	}).pipe(Effect.ensuring(Deferred.fail(ended, new WatchEnded({ url }))), Effect.forkScoped);
+	yield* write(pendingLogsSubscribe(SUBSCRIBE_ID, {
+		address: router,
+		topics: [[REQUESTED_TOPIC, FULFILLED_TOPIC]]
+	}));
+	const confirmed = yield* Effect.timeoutOption(Effect.raceFirst(Deferred.await(subscribed), Deferred.await(ended)), options.subscribeTimeout ?? DEFAULT_SUBSCRIBE_TIMEOUT);
+	if (Option.isNone(confirmed)) return yield* new SubscriptionRefused({
+		url,
+		reason: "the endpoint did not confirm the subscription in time"
+	});
+	const watchOver = (taken) => ({
+		next: Effect.raceFirst(PubSub.take(taken), Deferred.await(ended)),
+		branch: Effect.map(PubSub.subscribe(seen), watchOver)
+	});
+	return watchOver(own);
+});
+/**
+* The next observation `match` accepts, or `None` if `timeout` passes first. Observations before
+* it are dropped: they belong to other consumers on the same router.
+*/
+const nextSeen = Effect.fn("nextSeen")(function* (watch, match, timeout) {
+	const taking = Effect.gen(function* () {
+		for (;;) {
+			const matched = match(yield* watch.next);
+			if (matched !== void 0) return matched;
+		}
+	});
+	return yield* Effect.timeoutOption(taking, timeout);
+});
+/**
+* The watch as callbacks, for code without Effect, through the package's `run`: opens and
+* subscribes with `webSocket`, succeeds once the subscription is confirmed with the function
+* that closes it, and from then on hands `onSeen` every observation until the socket ends, which
+* `onEnded` learns of. Fails as `watchRouter` does.
+*
+*     const close = await run(observeRouter({ url, router, webSocket: WebSocket, onSeen }), signal);
+*/
+const observeRouter = Effect.fn("observeRouter")(function* (options) {
+	const scope = yield* Scope.make();
+	const runIn = Effect.runForkWith(yield* Effect.context());
+	const close = () => void runIn(Scope.close(scope, Exit.void));
+	yield* (yield* watchRouter(options).pipe(Effect.provide(Layer.succeed(Socket.WebSocketConstructor)((url) => new options.webSocket(url))), Scope.provide(scope), Effect.onError(() => Scope.close(scope, Exit.void)))).next.pipe(Effect.flatMap((seen) => Effect.sync(() => options.onSeen(seen))), Effect.forever, Effect.catch((ended) => Effect.sync(() => options.onEnded?.(ended))), Effect.forkIn(scope));
+	return close;
+});
+//#endregion
+//#region src/run.ts
+/**
+* The package's one binding for code that runs no Effect: any protocol effect, as a promise.
+* It resolves with what the effect succeeds with and rejects with the very error it fails with
+* (the typed classes, so `instanceof` works on them). `signal` aborting interrupts the effect
+* and rejects with the signal's reason. Effect stays beneath the package: a caller needs none.
+*
+*     const client = await run(DirectClient.connect(options));
+*     const result = await run(client.request(input), signal);
+*/
+const run = (effect, signal) => {
+	const settled = Effect.runPromise(Effect.result(effect), signal === void 0 ? void 0 : { signal }).then((result) => {
+		if (Result.isFailure(result)) throw result.failure;
+		return result.success;
+	});
+	if (signal === void 0) return settled;
+	return new Promise((resolve, reject) => {
+		const abort = () => reject(signal.reason);
+		signal.addEventListener("abort", abort, { once: true });
+		settled.then(resolve, reject).finally(() => signal.removeEventListener("abort", abort));
+		if (signal.aborted) abort();
+	});
+};
+//#endregion
+export { Address, Bytes32, CALLDATA_GAS_PER_BYTE, DEFAULT_DEADLINE_SECONDS, DEFAULT_FEE_FLOOR, DeadlinePassed, DirectClient, DirectRefusal, DirectRequest, DirectRequestBody, DirectRequestRefused, DirectResponse, HASH_TO_CURVE_MAX_ITERATIONS, HexString, INTRINSIC_GAS, MAX_CALLBACK_DATA_BYTES, MAX_GAS_PRICE_HEADROOM, NoNodeServing, NodeIdentity, NonceTaken, NotServing, PendingLog, Quote, Request, RouterUnreadable, SENTINEL_PROOF, SERVICE_VRF, STALE_DELAY, SigningFailed, SubscriptionFrame, SubscriptionNotification, SubscriptionRefused, SubscriptionReply, TooManyRequests, UnexpectedResponse, WHOLE_PREMIUM, WatchEnded, bytes48, ceiling, chargedGas, computeFees, decodePendingLog, decodeProof, decodeRandomnessFulfilled, decodeRandomnessRequested, decodeSubscriptionFrame, deriveRandomness, directRequestFulfilledEvent, directRequestId, directRequestTypedData, discoverNodes, encodeAttestation, encodeProof, fee, fulfillmentDigest, fulfillmentItemGas, fulfillmentTypedData, hashToCurveIterations, hexBytes, isFulfillable, isLate, isSentinel, lockedGasPrice, nextSeen, nodeEndpointSetEvent, observeRouter, onDirectRandomness, pendingLogsSubscribe, premiumShare, proofCommitment, prove, publicKeyPoint, randomnessFulfilledEvent, randomnessRequestedEvent, registrationNonce, remainingDelay, requestFrame, requestId, run, seenIn, settlement, settlementAtShare, signDirectRequest, staleAt, validateEndpoint, verify, watchRouter };