openzoo 0.9.0 → 0.9.2

package/lib/pay.js

@@ -3,7 +3,7 @@ import { getAssociatedTokenAddressSync } from '@solana/spl-token';
 import { config, fundingLine } from './config.js';
 import { loadOrCreateWallet } from './wallet.js';
 import {
-  parse402, pickAccept, railOf, buildPaymentOnline, tokenBalance,
+  parse402, orderAccepts, railOf, buildPaymentOnline, tokenBalance,
   receiptLine, decodeSettleHeader,
 } from './x402.js';
 import { buildEvmPayment, evmTokenBalance } from './evm.js';
@@ -180,15 +180,41 @@ export class PayClient {
 
     const quote = parse402(await first.json());
     // config.rail (OPENZOO_RAIL) steers every front — proxy, demo, MCP — since
-    // they all pay through this one call site.
-    const accept = pickAccept(quote, config.token, { allowRH: this.allowRH, forceRail: config.rail });
-    const billedUsd = Number(accept?.extra?.billedUsd ?? NaN);
-    if (Number.isFinite(billedUsd) && billedUsd > config.maxUsdPerCall) {
-      throw new QuoteTooHighError(billedUsd, quote);
-    }
-
+    // they all pay through this one call site. The wallet pays with whatever
+    // it HOLDS: every offered row is tried best-first, and only when NONE is
+    // affordable does the call fail — never because the first-choice asset
+    // alone ran dry while another funded one sat in the wallet.
+    const candidates = orderAccepts(quote, config.token, { allowRH: this.allowRH, forceRail: config.rail });
     onStage?.('quoted');
-    const payment = await this.buildPaymentFor(accept, onStage);
+    let accept = null;
+    let payment = null;
+    const fundErrs = [];
+    let tooHigh = null;
+    for (const cand of candidates) {
+      const billedUsd = Number(cand?.extra?.billedUsd ?? NaN);
+      if (Number.isFinite(billedUsd) && billedUsd > config.maxUsdPerCall) {
+        tooHigh = tooHigh || new QuoteTooHighError(billedUsd, quote);
+        continue;
+      }
+      try {
+        payment = await this.buildPaymentFor(cand, onStage);
+        accept = cand;
+        break;
+      } catch (e) {
+        const funding = e instanceof UnderfundedError
+          || e?.name === 'UnderlyingShortError' || e?.name === 'NeedsGasError';
+        if (!funding) throw e;
+        fundErrs.push({ sym: cand?.extra?.symbol || cand?.asset, err: e });
+      }
+    }
+    if (!payment) {
+      if (!fundErrs.length && tooHigh) throw tooHigh;
+      if (fundErrs.length === 1) throw fundErrs[0].err;
+      throw new UnderfundedError(candidates[0], null, this.address, {
+        line: `No offered payment row is affordable from this wallet (tried ${fundErrs.length}):\n`
+          + fundErrs.map(({ sym, err }) => `  · ${sym}: ${err.message.replace(/^openzoo wallet underfunded: /, '')}`).join('\n'),
+      });
+    }
     onStage?.('paying');
     const response = await fetch(url, {
       ...init,

package/lib/proxy.js

@@ -1,4 +1,5 @@
 import http from 'node:http';
+import crypto from 'node:crypto';
 import { Readable } from 'node:stream';
 import {
   config, FUNDING_ASSETS, fundingLine, liveRails, railFundingHint, railFundingAddresses, unfundableRails, RAIL_FUNDING,
@@ -55,6 +56,64 @@ function jsonErr(res, status, message, extraFields = {}) {
 
 const mb = (n) => (n / 1048576).toFixed(1);
 
+/**
+ * The zoo answers chat completions as ONE JSON object (it settles payment
+ * before serving — there is nothing to stream until generation is done).
+ * Harnesses that sent `stream: true` expect SSE and treat a JSON body as a
+ * dead connection: Cursor shows "Reconnecting…", RETRIES, and every retry is
+ * a fresh payment. So the proxy honours the contract itself — the finished
+ * completion is re-emitted as spec-shaped chat.completion.chunk events.
+ */
+function serveAsSse(res, data, upstream) {
+  const headers = {
+    'content-type': 'text/event-stream; charset=utf-8',
+    'cache-control': 'no-cache',
+  };
+  const settle = upstream?.headers?.get?.('x-payment-response');
+  if (settle) headers['x-payment-response'] = settle;
+  res.writeHead(200, headers);
+  const base = {
+    id: data.id, object: 'chat.completion.chunk', created: data.created, model: data.model,
+  };
+  const ev = (obj) => res.write(`data: ${JSON.stringify(obj)}\n\n`);
+  for (const c of data.choices || []) {
+    ev({ ...base, choices: [{ index: c.index ?? 0, delta: { role: 'assistant' }, finish_reason: null }] });
+    if (c.message?.content) {
+      ev({ ...base, choices: [{ index: c.index ?? 0, delta: { content: c.message.content }, finish_reason: null }] });
+    }
+    ev({ ...base, choices: [{ index: c.index ?? 0, delta: {}, finish_reason: c.finish_reason ?? 'stop' }], ...(data.usage ? { usage: data.usage } : {}) });
+  }
+  res.write('data: [DONE]\n\n');
+  res.end();
+}
+
+/**
+ * Replay guard — a harness that cannot consume a response retries the SAME
+ * body within seconds, and each retry used to be a fresh payment (observed:
+ * six identical $0.06 settles for one Cursor message). An identical POST body
+ * arriving within the window is served the cached completion, not re-paid.
+ * Window is deliberately short: a genuinely new turn always differs (harnesses
+ * resend the whole conversation), so only true retries can hit.
+ */
+const REPLAY_TTL_MS = 30_000;
+const replayCache = new Map(); // sha256(body) -> { at, data, settle }
+function replayKey(bodyBuf) {
+  return crypto.createHash('sha256').update(bodyBuf).digest('hex');
+}
+function replayGet(key) {
+  const hit = replayCache.get(key);
+  if (!hit) return null;
+  if (Date.now() - hit.at > REPLAY_TTL_MS) { replayCache.delete(key); return null; }
+  return hit;
+}
+function replayPut(key, data, settle) {
+  replayCache.set(key, { at: Date.now(), data, settle });
+  if (replayCache.size > 50) {
+    const oldest = [...replayCache.entries()].sort((a, b) => a[1].at - b[1].at)[0];
+    if (oldest) replayCache.delete(oldest[0]);
+  }
+}
+
 /**
  * "The body never ships twice" at the proxy. A chat body whose LAST message
  * carries a huge pasted corpus gets split at its last blank line — corpus vs
@@ -164,12 +223,31 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
     // NEAREST zoo model BEFORE anything else sees the body — any POST that
     // carries a model field, not just chat/completions, so /completions,
     // /responses and future shapes all work. Never silent.
+    let wantsStream = false;
     if (rewritablePath(req.method, req.url)) {
       const rw = await maybeRewriteModel(bodyBuf);
       if (rw) {
         log(`model "${rw.from}" is not on the zoo — nearest match ${rw.to} (OPENZOO_DEFAULT_MODEL overrides)`);
         bodyBuf = rw.body;
       }
+      try { wantsStream = JSON.parse(bodyBuf.toString('utf8'))?.stream === true; } catch { /* not JSON */ }
+    }
+
+    // Retry of a body we answered seconds ago? Serve the cached completion —
+    // never pay twice for a harness's reconnect loop.
+    const isChat = req.method === 'POST' && (req.url || '').includes('/chat/completions');
+    const rKey = isChat ? replayKey(bodyBuf) : null;
+    if (rKey) {
+      const hit = replayGet(rKey);
+      if (hit) {
+        log('identical request within 30s — served the cached completion, NOT re-paid');
+        if (wantsStream) { serveAsSse(res, hit.data, null); return; }
+        const h = { 'content-type': 'application/json' };
+        if (hit.settle) h['x-payment-response'] = hit.settle;
+        res.writeHead(200, h);
+        res.end(JSON.stringify(hit.data));
+        return;
+      }
     }
     const init = { method: req.method, headers: upstreamHeaders(req) };
     if (req.method !== 'GET' && req.method !== 'HEAD') init.body = bodyBuf;
@@ -242,6 +320,25 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
         else if (viaTunnel) log(`${line}  ·  public-url session $${tunnelSpent.toFixed(6)}`);
         else log(line);
       }
+      // Chat completions come back as one JSON object (settle-before-serve).
+      // Cache it against retries, and if the harness asked to stream, honour
+      // that contract ourselves. An upstream that someday truly streams (SSE
+      // content-type) passes straight through the relay below, untouched.
+      const upCt = response.headers.get('content-type') || '';
+      if (isChat && response.ok && upCt.includes('application/json')) {
+        let data = null;
+        try { data = await response.clone().json(); } catch { /* not JSON after all */ }
+        if (data?.object === 'chat.completion') {
+          if (rKey) replayPut(rKey, data, response.headers.get('x-payment-response'));
+          if (wantsStream) { serveAsSse(res, data, response); return; }
+          const h = { 'content-type': 'application/json' };
+          const settleHdr = response.headers.get('x-payment-response');
+          if (settleHdr) h['x-payment-response'] = settleHdr;
+          res.writeHead(200, h);
+          res.end(JSON.stringify(data));
+          return;
+        }
+      }
       await relay(res, response);
     } catch (err) {
       if (err instanceof QuoteTooHighError) {

package/lib/x402.js

@@ -74,8 +74,20 @@ export function evmChainId(network) {
  * but RH stays opt-in for DEFAULT selection because its settlement asset has
  * no auto-conversion path here.
  */
-export function pickAccept(body, preferredSymbol, { allowRH = false, forceRail = null } = {}) {
+/**
+ * ALL payable rows from a 402, best-first. The wallet pays with whatever it
+ * HOLDS — the caller walks this list and takes the first affordable row, so
+ * a wallet rich in TOKEN but short of USDC pays the TOKEN row instead of
+ * erroring on the USDC one. Preference order within the list: the preferred
+ * symbol, then the rest of Solana (sponsored fees), then Base, then Robinhood
+ * (gated — paying there costs the wallet its own gas).
+ */
+export function orderAccepts(body, preferredSymbol, { allowRH = false, forceRail = null } = {}) {
   const rows = parse402(body).accepts.filter((a) => a?.scheme === 'exact');
+  const bySym = (list) => [
+    ...list.filter((a) => a?.extra?.symbol === preferredSymbol),
+    ...list.filter((a) => a?.extra?.symbol !== preferredSymbol),
+  ];
   if (forceRail) {
     const want = String(forceRail).toLowerCase();
     if (!['solana', 'base', 'robinhood', 'evm'].includes(want)) {
@@ -88,19 +100,24 @@ export function pickAccept(body, preferredSymbol, { allowRH = false, forceRail =
         `OPENZOO_RAIL=${want} but the live 402 offers no ${want} rail (offered: ${offered.join(', ') || 'none'})`,
       );
     }
-    return match.find((a) => a?.extra?.symbol === preferredSymbol) || match[0];
+    return bySym(match);
+  }
+  const out = [
+    ...bySym(rows.filter((a) => railOf(a) === 'solana')),
+    ...rows.filter((a) => railOf(a) === 'base'),
+    ...rows.filter((a) => railOf(a) === 'evm'),
+    ...(allowRH ? rows.filter((a) => railOf(a) === 'robinhood') : []),
+  ];
+  if (!out.length) {
+    throw new Error(rows.some((a) => railOf(a) === 'robinhood')
+      ? 'only Robinhood Chain rails offered — set OPENZOO_ENABLE_RH=1 or OPENZOO_RAIL=robinhood to use them (the rail settles; you must hold its settlement asset, see https://x402.accrue.fund/start)'
+      : 'no payable rail in 402 accepts[]');
   }
-  const sol = rows.filter((a) => railOf(a) === 'solana');
-  if (sol.length) return sol.find((a) => a?.extra?.symbol === preferredSymbol) || sol[0];
-  const base = rows.filter((a) => railOf(a) === 'base');
-  if (base.length) return base[0];
-  const evm = rows.filter((a) => railOf(a) === 'evm');
-  if (evm.length) return evm[0];
-  const rh = rows.filter((a) => railOf(a) === 'robinhood');
-  if (allowRH && rh.length) return rh[0];
-  throw new Error(rh.length
-    ? 'only Robinhood Chain rails offered — set OPENZOO_ENABLE_RH=1 or OPENZOO_RAIL=robinhood to use them (the rail settles; you must hold its settlement asset, see https://x402.accrue.fund/start)'
-    : 'no payable rail in 402 accepts[]');
+  return out;
+}
+
+export function pickAccept(body, preferredSymbol, opts = {}) {
+  return orderAccepts(body, preferredSymbol, opts)[0];
 }
 
 const mintCache = new Map();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openzoo",
-  "version": "0.9.0",
+  "version": "0.9.2",
   "description": "Local x402-paying proxy + MCP server for openzoo.fun — point any OpenAI-compatible harness (Cursor, Claude Code, aider, SDKs) at localhost and it pays per call from a local burner wallet. Solana and Base rails live; Robinhood experimental.",
   "license": "MIT",
   "type": "module",