orrery-node 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Orrery contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,46 @@
-# Temporary Holding Version
+# orrery-node
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Peer-to-peer AI inference on Solana. A router on your computer sends each request straight to a provider's machine and pays it through a Solana payment channel. No server in the middle, and the program takes 0%.
+
+```
+your tool ──► router (127.0.0.1:7171) ──► provider's machine
+                    │                          │
+                    └── Solana program: channel deposit · redeem ──┘
+```
+
+## Use the network
+
+```bash
+npm i -g orrery-node
+orrery router --wallet ~/.config/solana/id.json --rpc <your RPC URL>
+```
+
+Point anything that speaks the OpenAI API at `http://127.0.0.1:7171/v1` (any API key). Add one word after the model name to pick the route:
+
+| Suffix | Picks |
+|---|---|
+| (none) | a blend of price, first-token time and reputation |
+| `:cheap` | lowest expected cost |
+| `:fast` | fastest first token this router has seen |
+| `:trusted` | most USDC settled on chain, bonded $OREY |
+| `:private` | verified enclaves only, the request sealed |
+
+The first request to a provider opens a channel with a small USDC deposit (`--deposit`, default 2). After every answer a session key on your computer signs the new running total; the provider redeems it on Solana. `--daily-cap` (default $5) stops spending for the day. The console at `http://127.0.0.1:7171/` shows every request, the provider it went to and what it cost.
+
+```bash
+orrery models      # every model on the network, cheapest price, provider count
+orrery providers   # every listed provider and what the chain says about it
+```
+
+## Run a provider
+
+Put a node in front of any OpenAI-compatible server (vLLM, SGLang, Ollama, llama.cpp, or API capacity you hold), set your prices, and list it:
+
+```bash
+orrery provider register --config provider.json --wallet wallet.json
+orrery provider start    --config provider.json
+```
+
+Only standard chat fields reach your upstream, so a caller cannot spend your key on models or tools your price list does not cover. Redemptions go straight to your wallet's USDC account.
+
+Docs: https://orrerynode.com/docs · Source: https://github.com/orrery-node/orrery (MIT)

package/dist/brand.js

@@ -0,0 +1,11 @@
+// The project name lives here and nowhere else in the node software. Renaming the project means editing this file
+// (and the web's brand file). On-chain and wire names (crate `orrery`, voucher prefix `orrery/voucher/1`, x-orrery-*
+// headers) are protocol: changing them after the mainnet deploy breaks every deployed node.
+export const NAME = 'Orrery';
+export const CLI = 'orrery';
+export const TICKER = 'OREY';
+export const HOME_DIR = '.orrery';
+export const ROUTER_PORT = 7171;
+export const PROVIDER_PORT = 7272;
+export const PROGRAM_ID = process.env.ORRERY_PROGRAM_ID ?? '7UHevY47LgbJv9hz4iymecR8FURy27jX55KYb1sxytZS';
+export const USDC_MAINNET = 'EPjFWJd5Wm8eUi4wSPdf8qJxQAXnmSeKEr5mVGYLm3CY';

package/dist/chain/program.js

@@ -0,0 +1,146 @@
+// Hand-written client for the Orrery program: PDAs, account layouts and instruction encodings. It mirrors
+// program/programs/orrery/src/lib.rs field for field; test/program.test.ts checks it against the built IDL.
+import { createHash } from 'node:crypto';
+import { PublicKey, SystemProgram, SYSVAR_INSTRUCTIONS_PUBKEY, TransactionInstruction } from '@solana/web3.js';
+import { PROGRAM_ID } from "../brand.js";
+export const TOKEN_PROGRAM = new PublicKey('TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA');
+export const ATA_PROGRAM = new PublicKey('ATokenGPvbdGVxr1b2hvZbsiqW5xWH25efTNsLJA8knL');
+export const UPGRADEABLE_LOADER = new PublicKey('BPFLoaderUpgradeab1e11111111111111111111111');
+export const programId = () => new PublicKey(PROGRAM_ID);
+const disc = (ns, name) => createHash('sha256').update(`${ns}:${name}`).digest().subarray(0, 8);
+export const IX = Object.fromEntries(['initialize', 'set_params', 'set_bond_mint', 'register_provider', 'update_provider', 'attest', 'bond', 'unbond', 'withdraw_bond', 'open_channel', 'top_up', 'redeem', 'request_close', 'close_channel'].map((n) => [n, disc('global', n)]));
+export const ACCOUNT = { Config: disc('account', 'Config'), Provider: disc('account', 'Provider'), Channel: disc('account', 'Channel') };
+export const TEE_KINDS = ['none', 'Intel TDX', 'AMD SEV-SNP', 'Intel TDX + NVIDIA CC'];
+const seed = (s) => Buffer.from(s);
+const u64le = (n) => {
+    const b = Buffer.alloc(8);
+    b.writeBigUInt64LE(n);
+    return b;
+};
+export const pda = {
+    config: (pid = programId()) => PublicKey.findProgramAddressSync([seed('config')], pid)[0],
+    provider: (authority, pid = programId()) => PublicKey.findProgramAddressSync([seed('provider'), authority.toBuffer()], pid)[0],
+    channel: (payer, provider, id, pid = programId()) => PublicKey.findProgramAddressSync([seed('channel'), payer.toBuffer(), provider.toBuffer(), u64le(id)], pid)[0],
+    ata: (owner, mint, tokenProgram = TOKEN_PROGRAM) => PublicKey.findProgramAddressSync([owner.toBuffer(), tokenProgram.toBuffer(), mint.toBuffer()], ATA_PROGRAM)[0],
+    programData: (pid = programId()) => PublicKey.findProgramAddressSync([pid.toBuffer()], UPGRADEABLE_LOADER)[0],
+};
+class Writer {
+    parts = [];
+    u8(n) { this.parts.push(Buffer.from([n])); return this; }
+    u32(n) { const b = Buffer.alloc(4); b.writeUInt32LE(n); this.parts.push(b); return this; }
+    u64(n) { this.parts.push(u64le(n)); return this; }
+    i64(n) { const b = Buffer.alloc(8); b.writeBigInt64LE(n); this.parts.push(b); return this; }
+    pk(k) { this.parts.push(k.toBuffer()); return this; }
+    bytes(b, len) {
+        if (b.length !== len)
+            throw new Error(`expected ${len} bytes, got ${b.length}`);
+        this.parts.push(Buffer.from(b));
+        return this;
+    }
+    str(s) { const b = Buffer.from(s, 'utf8'); this.u32(b.length); this.parts.push(b); return this; }
+    opt(v, put) { if (v === undefined)
+        this.u8(0);
+    else {
+        this.u8(1);
+        put(v);
+    } return this; }
+    done() { return Buffer.concat(this.parts); }
+}
+class Reader {
+    b;
+    at = 8;
+    constructor(b) {
+        this.b = b;
+    }
+    u8() { return this.b.readUInt8(this.at++); }
+    bool() { return this.u8() === 1; }
+    u32() { const v = this.b.readUInt32LE(this.at); this.at += 4; return v; }
+    u64() { const v = this.b.readBigUInt64LE(this.at); this.at += 8; return v; }
+    i64() { const v = this.b.readBigInt64LE(this.at); this.at += 8; return v; }
+    pk() { const v = new PublicKey(this.b.subarray(this.at, this.at + 32)); this.at += 32; return v; }
+    bytes(n) { const v = Buffer.from(this.b.subarray(this.at, this.at + n)); this.at += n; return v; }
+    str() { const n = this.u32(); const v = this.b.subarray(this.at, this.at + n).toString('utf8'); this.at += n; return v; }
+}
+function expect(data, d, name) {
+    if (data.length < 8 || !data.subarray(0, 8).equals(d))
+        throw new Error(`not a ${name} account`);
+}
+export function decodeConfig(data) {
+    expect(data, ACCOUNT.Config, 'Config');
+    const r = new Reader(data);
+    return {
+        admin: r.pk(), pendingAdmin: r.pk(), settleMint: r.pk(), bondMint: r.pk(),
+        closeGraceSecs: r.i64(), unbondSecs: r.i64(), minDeposit: r.u64(), providers: r.u64(), channels: r.u64(), settled: r.u64(),
+    };
+}
+export function decodeProvider(data) {
+    expect(data, ACCOUNT.Provider, 'Provider');
+    const r = new Reader(data);
+    return {
+        authority: r.pk(), nodeKey: r.pk(), endpoint: r.str(), manifestHash: r.bytes(32), manifestSeq: r.u32(), active: r.bool(),
+        teeKind: r.u8(), teeMeasurement: r.bytes(48), teeReportHash: r.bytes(32), teeKey: r.bytes(32), teeExpiresAt: r.i64(),
+        bonded: r.u64(), unbonding: r.u64(), unbondAt: r.i64(), settled: r.u64(), redeems: r.u64(), channels: r.u64(),
+        registeredAt: r.i64(), lastSettledAt: r.i64(),
+    };
+}
+export function decodeChannel(data) {
+    expect(data, ACCOUNT.Channel, 'Channel');
+    const r = new Reader(data);
+    return {
+        payer: r.pk(), provider: r.pk(), sessionKey: r.pk(), mint: r.pk(), id: r.u64(),
+        deposit: r.u64(), redeemed: r.u64(), usageHash: r.bytes(32), openedAt: r.i64(), closingAt: r.i64(),
+    };
+}
+const ix = (data, metas, pid = programId()) => new TransactionInstruction({ programId: pid, keys: metas.map(([pubkey, isSigner, isWritable]) => ({ pubkey, isSigner, isWritable })), data });
+export const ins = {
+    initialize(admin, settleMint, p, pid = programId()) {
+        const data = new Writer().bytes(IX.initialize, 8).i64(p.closeGraceSecs).i64(p.unbondSecs).u64(p.minDeposit).done();
+        return ix(data, [[admin, true, true], [pid, false, false], [pda.programData(pid), false, false], [pda.config(pid), false, true], [settleMint, false, false], [SystemProgram.programId, false, false]], pid);
+    },
+    registerProvider(authority, nodeKey, endpoint, manifestHash, pid = programId()) {
+        const data = new Writer().bytes(IX.register_provider, 8).pk(nodeKey).str(endpoint).bytes(manifestHash, 32).done();
+        return ix(data, [[authority, true, true], [pda.config(pid), false, true], [pda.provider(authority, pid), false, true], [SystemProgram.programId, false, false]], pid);
+    },
+    updateProvider(authority, a, pid = programId()) {
+        const w = new Writer().bytes(IX.update_provider, 8);
+        w.opt(a.nodeKey, (k) => w.pk(k));
+        w.opt(a.endpoint, (s) => w.str(s));
+        w.opt(a.manifestHash, (h) => w.bytes(h, 32));
+        w.opt(a.active, (v) => w.u8(v ? 1 : 0));
+        return ix(w.done(), [[authority, true, false], [pda.provider(authority, pid), false, true]], pid);
+    },
+    attest(signer, providerAuthority, a, pid = programId()) {
+        const data = new Writer().bytes(IX.attest, 8).u8(a.kind).bytes(a.measurement, 48).bytes(a.reportHash, 32).bytes(a.teeKey, 32).i64(a.expiresAt).done();
+        return ix(data, [[signer, true, false], [pda.provider(providerAuthority, pid), false, true]], pid);
+    },
+    openChannel(payer, provider, mint, id, deposit, sessionKey, pid = programId()) {
+        const channel = pda.channel(payer, provider, id, pid);
+        const data = new Writer().bytes(IX.open_channel, 8).u64(id).u64(deposit).pk(sessionKey).done();
+        return ix(data, [
+            [payer, true, true], [pda.config(pid), false, true], [provider, false, true], [channel, false, true], [mint, false, false],
+            [pda.ata(payer, mint), false, true], [pda.ata(channel, mint), false, true], [TOKEN_PROGRAM, false, false], [ATA_PROGRAM, false, false], [SystemProgram.programId, false, false],
+        ], pid);
+    },
+    topUp(payer, channel, mint, amount, pid = programId()) {
+        const data = new Writer().bytes(IX.top_up, 8).u64(amount).done();
+        return ix(data, [[payer, true, false], [channel, false, true], [mint, false, false], [pda.ata(payer, mint), false, true], [pda.ata(channel, mint), false, true], [TOKEN_PROGRAM, false, false]], pid);
+    },
+    redeem(caller, providerAuthority, channel, mint, cumulative, usageHash, pid = programId()) {
+        const provider = pda.provider(providerAuthority, pid);
+        const data = new Writer().bytes(IX.redeem, 8).u64(cumulative).bytes(usageHash, 32).done();
+        return ix(data, [
+            [caller, true, true], [pda.config(pid), false, true], [provider, false, true], [channel, false, true], [mint, false, false],
+            [pda.ata(channel, mint), false, true], [providerAuthority, false, false], [pda.ata(providerAuthority, mint), false, true],
+            [SYSVAR_INSTRUCTIONS_PUBKEY, false, false], [TOKEN_PROGRAM, false, false], [ATA_PROGRAM, false, false], [SystemProgram.programId, false, false],
+        ], pid);
+    },
+    requestClose(payer, channel, pid = programId()) {
+        return ix(new Writer().bytes(IX.request_close, 8).done(), [[payer, true, false], [pda.config(pid), false, false], [channel, false, true]], pid);
+    },
+    closeChannel(closer, providerAuthority, channel, payer, mint, pid = programId()) {
+        return ix(new Writer().bytes(IX.close_channel, 8).done(), [
+            [closer, true, true], [pda.provider(providerAuthority, pid), false, false], [channel, false, true], [payer, false, true], [mint, false, false],
+            [pda.ata(channel, mint), false, true], [pda.ata(payer, mint), false, true], [TOKEN_PROGRAM, false, false], [ATA_PROGRAM, false, false], [SystemProgram.programId, false, false],
+        ], pid);
+    },
+};

package/dist/chain/voucher.js

@@ -0,0 +1,38 @@
+// The voucher is the only thing that moves money out of a channel: 88 bytes the router's session key signs, the
+// same bytes program/programs/orrery/src/voucher.rs rebuilds and checks against the runtime's ed25519 check.
+import { Ed25519Program } from '@solana/web3.js';
+import bs58 from 'bs58';
+import { ed25519Verify } from "../keys.js";
+import { ins } from "./program.js";
+export const VOUCHER_PREFIX = Buffer.from('orrery/voucher/1');
+export function voucherMessage(channel, cumulative, usageHash) {
+    if (usageHash.length !== 32)
+        throw new Error('usage hash must be 32 bytes');
+    const amount = Buffer.alloc(8);
+    amount.writeBigUInt64LE(cumulative);
+    return Buffer.concat([VOUCHER_PREFIX, channel.toBuffer(), amount, Buffer.from(usageHash)]);
+}
+export function signVoucher(sign, channel, cumulative, usageHash) {
+    return { cumulative, usageHash: Buffer.from(usageHash), signature: Buffer.from(sign(voucherMessage(channel, cumulative, usageHash))) };
+}
+export function verifyVoucher(sessionKey, channel, v) {
+    return ed25519Verify(sessionKey.toBytes(), voucherMessage(channel, v.cumulative, v.usageHash), v.signature);
+}
+export function encodeVoucher(v) {
+    return `${v.cumulative}.${v.usageHash.toString('hex')}.${bs58.encode(v.signature)}`;
+}
+export function decodeVoucher(s) {
+    const [amount, hash, sig] = s.split('.');
+    if (!amount || !/^\d{1,20}$/.test(amount) || !hash || !/^[0-9a-f]{64}$/.test(hash) || !sig)
+        throw new Error('malformed voucher');
+    const signature = Buffer.from(bs58.decode(sig));
+    if (signature.length !== 64)
+        throw new Error('malformed voucher signature');
+    return { cumulative: BigInt(amount), usageHash: Buffer.from(hash, 'hex'), signature };
+}
+/** The pair a redeem transaction needs: the runtime's signature check, then the program call that relies on it. */
+export function redeemInstructions(o) {
+    const message = voucherMessage(o.channel, o.voucher.cumulative, o.voucher.usageHash);
+    const check = Ed25519Program.createInstructionWithPublicKey({ publicKey: o.sessionKey.toBytes(), message, signature: o.voucher.signature });
+    return [check, ins.redeem(o.caller, o.providerAuthority, o.channel, o.mint, o.voucher.cumulative, o.voucher.usageHash, o.programId)];
+}

package/dist/cli.js

@@ -0,0 +1,190 @@
+#!/usr/bin/env node
+import { readFileSync } from 'node:fs';
+import { Connection, PublicKey, Transaction, sendAndConfirmTransaction } from '@solana/web3.js';
+import { CLI, NAME, PROVIDER_PORT, ROUTER_PORT, USDC_MAINNET } from "./brand.js";
+import { decodeChannel, decodeConfig, decodeProvider, ins, pda } from "./chain/program.js";
+import { home, loadKeypair, loadOrCreateKeypair } from "./keys.js";
+import { perMillion, usd } from "./pricing.js";
+import { ProviderNode } from "./provider/node.js";
+import { Channels } from "./router/channels.js";
+import { ROUTES } from "./router/policy.js";
+import { Registry } from "./router/registry.js";
+import { Router } from "./router/server.js";
+const argv = process.argv.slice(2);
+const flag = (name, fallback) => {
+    const i = argv.indexOf(`--${name}`);
+    return i >= 0 ? argv[i + 1] : fallback;
+};
+const has = (name) => argv.includes(`--${name}`);
+const expand = (p) => p.replace(/^~(?=$|\/)/, process.env.HOME ?? '~');
+const rpc = () => flag('rpc', process.env.ORRERY_RPC_URL ?? 'https://api.mainnet-beta.solana.com');
+const mint = () => new PublicKey(flag('mint', process.env.ORRERY_SETTLE_MINT ?? USDC_MAINNET));
+const dollars = (s) => BigInt(Math.round(Number(s) * 1e6));
+const HELP = `${NAME} — peer-to-peer AI inference, settled on Solana
+
+  ${CLI} router                 run the router on http://127.0.0.1:${ROUTER_PORT}/v1
+      --wallet <keypair.json>   wallet that opens channels (signs once per provider)
+      --route <${ROUTES.join('|')}>   default route (per request: model suffix :cheap :fast :trusted :private)
+      --deposit <usd>           deposit per new channel (default 2)
+      --daily-cap <usd>         stop spending after this much per day (default 5)
+      --min-reputation <0-1>    auto route ignores providers below this (default 0.2)
+      --allow-dev-enclaves      accept software attestation (local testing only)
+  ${CLI} models                  every model on the network, cheapest price, provider count
+  ${CLI} providers               every listed provider and what the chain says about it
+  ${CLI} channels                your router's channels and what the chain says about each
+  ${CLI} close <channel> --wallet <keypair.json>            start closing (the provider keeps a grace period)
+  ${CLI} close <channel> --wallet <keypair.json> --finish   after the grace period: the rest comes back to you
+  ${CLI} provider start   --config provider.json
+  ${CLI} provider register --config provider.json --wallet <keypair.json>   list or update on chain
+  ${CLI} provider attest  --config provider.json   post the enclave claim (node key signs)
+  ${CLI} provider redeem  --config provider.json   redeem every channel now
+
+  --rpc <url>   Solana RPC (or ORRERY_RPC_URL)     --mint <address>  settlement mint (default USDC)
+`;
+async function router() {
+    const conn = new Connection(rpc(), 'confirmed');
+    const walletPath = flag('wallet', process.env.ORRERY_WALLET);
+    const wallet = walletPath ? loadKeypair(expand(walletPath)) : null;
+    const session = loadOrCreateKeypair(home('router', 'session.json'));
+    const route = flag('route', 'auto');
+    if (!ROUTES.includes(route))
+        throw new Error(`unknown route ${route}`);
+    const registry = new Registry(conn, { allowDev: has('allow-dev-enclaves'), measurements: (flag('enclave-images', '') ?? '').split(',').filter(Boolean) });
+    const channels = new Channels(conn, wallet, session, mint(), home('router', 'channels.json'), {
+        deposit: dollars(flag('deposit', '2')), topUpBelow: dollars(flag('top-up-below', '0.25')), dailyCap: dollars(flag('daily-cap', '5')),
+    });
+    const port = Number(flag('port', String(ROUTER_PORT)));
+    const r = new Router({ port, route, minReputation: Number(flag('min-reputation', '0.2')), registry, channels, conn, refreshSecs: Number(flag('refresh', '60')) });
+    await r.start();
+    const usable = registry.usable().length;
+    console.log(`${NAME} router on http://127.0.0.1:${port}/v1  ·  ${usable} providers  ·  route ${route}  ·  ${wallet ? `wallet ${wallet.publicKey.toBase58().slice(0, 6)}…` : 'no wallet (read-only)'}`);
+    console.log(`session key ${session.publicKey.toBase58()} signs vouchers; console at http://127.0.0.1:${port}/`);
+}
+async function listModels() {
+    const registry = new Registry(new Connection(rpc(), 'confirmed'), { allowDev: has('allow-dev-enclaves'), measurements: [] });
+    await registry.refresh();
+    const rows = registry.catalog();
+    if (!rows.length)
+        return console.log('No models listed yet.');
+    for (const m of rows)
+        console.log(`${m.id.padEnd(40)} ${String(m.providers).padStart(3)} providers  from ${perMillion(m.cheapest.input)} in · ${perMillion(m.cheapest.output)} out${m.private ? `  · ${m.private} private` : ''}`);
+}
+async function listProviders() {
+    const registry = new Registry(new Connection(rpc(), 'confirmed'), { allowDev: has('allow-dev-enclaves'), measurements: [] });
+    await registry.refresh();
+    for (const e of registry.entries.values()) {
+        const a = e.account;
+        console.log(`${e.address}  ${(e.manifest?.name ?? '?').padEnd(24)} ${a.active ? 'open  ' : 'closed'}  settled $${usd(a.settled, 2)} in ${a.redeems} redeems  ${e.manifest?.models.length ?? 0} models  ${e.tee ? `enclave: ${e.tee.reason}` : ''}${e.problem ? `  ✗ ${e.problem}` : ''}`);
+    }
+}
+async function listChannels() {
+    const conn = new Connection(rpc(), 'confirmed');
+    const session = loadOrCreateKeypair(home('router', 'session.json'));
+    const local = new Channels(conn, null, session, mint(), home('router', 'channels.json'), { deposit: 0n, topUpBelow: 0n, dailyCap: 0n }).list();
+    if (!local.length)
+        return console.log('No channels yet. The first request to a provider opens one.');
+    for (const c of local) {
+        const info = await conn.getAccountInfo(new PublicKey(c.channel));
+        if (!info) {
+            console.log(`${c.channel}  closed`);
+            continue;
+        }
+        const a = decodeChannel(info.data);
+        const state = a.closingAt === 0n ? 'open' : `closing, ready after ${new Date(Number(a.closingAt) * 1000).toISOString()}`;
+        console.log(`${c.channel}  provider ${c.provider.slice(0, 8)}…  deposit $${usd(a.deposit, 2)}  you signed $${usd(c.cumulative)}  redeemed $${usd(a.redeemed)}  ${state}`);
+    }
+}
+async function provider(sub) {
+    const cfgPath = flag('config');
+    if (!cfgPath)
+        throw new Error('--config <provider.json> is required');
+    const cfg = JSON.parse(readFileSync(expand(cfgPath), 'utf8'));
+    cfg.rpcUrl = flag('rpc', cfg.rpcUrl) ?? cfg.rpcUrl;
+    cfg.listen = Number(flag('port', process.env.PORT ?? '')) || cfg.listen || PROVIDER_PORT;
+    const node = new ProviderNode(cfg);
+    if (sub === 'start') {
+        await node.listen();
+        console.log(`${NAME} provider "${cfg.name}" on :${cfg.listen}  ·  listing ${node.pda.toBase58()}  ·  ${cfg.models.length} models  ·  manifest ${node.manifestHash.toString('hex').slice(0, 12)}…`);
+        return;
+    }
+    if (sub === 'register') {
+        const w = loadKeypair(expand(flag('wallet', cfg.wallet ?? '')));
+        if (!w.publicKey.equals(node.authority))
+            throw new Error('the wallet does not match the config authority');
+        const exists = await node.conn.getAccountInfo(node.pda);
+        const ix = exists ? node.updateInstruction(w.publicKey) : node.registerInstruction(w.publicKey);
+        const sig = await sendAndConfirmTransaction(node.conn, new Transaction().add(ix), [w], { commitment: 'confirmed' });
+        console.log(`${exists ? 'updated' : 'listed'} ${node.pda.toBase58()}  tx ${sig}`);
+        return;
+    }
+    if (sub === 'attest') {
+        const sig = await sendAndConfirmTransaction(node.conn, new Transaction().add(node.attestInstruction()), [node.node], { commitment: 'confirmed' });
+        console.log(`enclave claim posted  tx ${sig}`);
+        return;
+    }
+    if (sub === 'redeem') {
+        const done = await node.redeemDue(1n);
+        console.log(done.length ? done.map((d) => `$${usd(d.amount)} from ${d.channel}`).join('\n') : 'nothing to redeem');
+        return;
+    }
+    if (sub === 'show') {
+        const info = await node.conn.getAccountInfo(node.pda);
+        if (!info)
+            return console.log('not listed');
+        const p = decodeProvider(info.data);
+        console.log({ ...p, authority: p.authority.toBase58(), nodeKey: p.nodeKey.toBase58() });
+        return;
+    }
+    throw new Error(`unknown provider command ${sub}`);
+}
+async function main() {
+    const [cmd, sub] = argv;
+    if (!cmd || cmd === 'help' || has('help'))
+        return console.log(HELP);
+    if (cmd === 'router')
+        return router();
+    if (cmd === 'models')
+        return listModels();
+    if (cmd === 'providers')
+        return listProviders();
+    if (cmd === 'provider')
+        return provider(sub ?? 'start');
+    if (cmd === 'channels')
+        return listChannels();
+    if (cmd === 'close') {
+        const walletPath = flag('wallet', process.env.ORRERY_WALLET);
+        if (!sub || !walletPath)
+            throw new Error(`usage: ${CLI} close <channel> --wallet <keypair.json> [--finish]`);
+        const w = loadKeypair(expand(walletPath));
+        const ch = new PublicKey(sub);
+        const conn = new Connection(rpc(), 'confirmed');
+        const info = await conn.getAccountInfo(ch);
+        if (!info)
+            return console.log(`${ch.toBase58()} is already closed`);
+        const c = decodeChannel(info.data);
+        if (!c.payer.equals(w.publicKey))
+            throw new Error('this wallet did not open that channel');
+        if (!has('finish')) {
+            if (c.closingAt !== 0n)
+                return console.log(`already closing; the rest can come back after ${new Date(Number(c.closingAt) * 1000).toISOString()} with --finish`);
+            await sendAndConfirmTransaction(conn, new Transaction().add(ins.requestClose(w.publicKey, ch)), [w]);
+            const cfg = decodeConfig((await conn.getAccountInfo(pda.config())).data);
+            return console.log(`closing ${ch.toBase58()}; the provider has ${cfg.closeGraceSecs}s to redeem, then run: ${CLI} close ${ch.toBase58()} --wallet ${walletPath} --finish`);
+        }
+        if (c.closingAt === 0n)
+            throw new Error(`start the close first: ${CLI} close ${ch.toBase58()} --wallet ${walletPath}`);
+        const now = BigInt(Math.floor(Date.now() / 1000));
+        if (now < c.closingAt)
+            throw new Error(`the grace period ends at ${new Date(Number(c.closingAt) * 1000).toISOString()}`);
+        const prov = decodeProvider((await conn.getAccountInfo(c.provider)).data);
+        const sig = await sendAndConfirmTransaction(conn, new Transaction().add(ins.closeChannel(w.publicKey, prov.authority, ch, w.publicKey, c.mint)), [w]);
+        return console.log(`closed ${ch.toBase58()}; $${usd(c.deposit - c.redeemed)} and the account rent are back in your wallet  tx ${sig}`);
+    }
+    console.log(HELP);
+    process.exitCode = 1;
+}
+void pda;
+main().catch((e) => {
+    console.error(e.message);
+    process.exit(1);
+});

package/dist/keys.js

@@ -0,0 +1,35 @@
+import { createPrivateKey, createPublicKey, sign, verify } from 'node:crypto';
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { homedir } from 'node:os';
+import { Keypair } from '@solana/web3.js';
+import { HOME_DIR } from "./brand.js";
+const PKCS8_ED25519 = Buffer.from('302e020100300506032b657004220420', 'hex');
+const SPKI_ED25519 = Buffer.from('302a300506032b6570032100', 'hex');
+export function home(...parts) {
+    return join(process.env.ORRERY_HOME ?? join(homedir(), HOME_DIR), ...parts);
+}
+export function writePrivate(path, body) {
+    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    writeFileSync(path, body, { mode: 0o600 });
+}
+export function loadKeypair(path) {
+    return Keypair.fromSecretKey(Uint8Array.from(JSON.parse(readFileSync(path, 'utf8'))));
+}
+export function loadOrCreateKeypair(path) {
+    if (existsSync(path))
+        return loadKeypair(path);
+    const kp = Keypair.generate();
+    writePrivate(path, JSON.stringify(Array.from(kp.secretKey)));
+    return kp;
+}
+export function signerOf(kp) {
+    const key = createPrivateKey({ key: Buffer.concat([PKCS8_ED25519, Buffer.from(kp.secretKey.subarray(0, 32))]), format: 'der', type: 'pkcs8' });
+    return (message) => new Uint8Array(sign(null, message, key));
+}
+export function ed25519Verify(publicKey, message, signature) {
+    if (publicKey.length !== 32 || signature.length !== 64)
+        return false;
+    const key = createPublicKey({ key: Buffer.concat([SPKI_ED25519, Buffer.from(publicKey)]), format: 'der', type: 'spki' });
+    return verify(null, message, key, signature);
+}

package/dist/manifest.js

@@ -0,0 +1,34 @@
+// A provider's price list. The node serves it at /v1/manifest; the sha256 of its canonical bytes is on chain, so a
+// router can tell whether the list it fetched is the one the provider's wallet signed for.
+import { createHash } from 'node:crypto';
+function sortKeys(v) {
+    if (Array.isArray(v))
+        return v.map(sortKeys);
+    if (v && typeof v === 'object') {
+        return Object.fromEntries(Object.keys(v).sort().filter((k) => v[k] !== undefined).map((k) => [k, sortKeys(v[k])]));
+    }
+    return v;
+}
+export function canonical(m) {
+    return Buffer.from(JSON.stringify(sortKeys(m)), 'utf8');
+}
+export function manifestHash(m) {
+    return createHash('sha256').update(Buffer.isBuffer(m) ? m : canonical(m)).digest();
+}
+const MODEL_ID = /^[a-z0-9][a-z0-9._\-/]{0,95}$/;
+export function checkManifest(m) {
+    const x = m;
+    if (!x || x.v !== 1 || typeof x.name !== 'string' || !Array.isArray(x.models))
+        throw new Error('manifest: bad shape');
+    if (x.models.length > 512)
+        throw new Error('manifest: too many models');
+    for (const o of x.models) {
+        if (!MODEL_ID.test(o.id))
+            throw new Error(`manifest: bad model id ${o.id}`);
+        if (!Number.isSafeInteger(o.price?.input) || !Number.isSafeInteger(o.price?.output) || o.price.input < 0 || o.price.output < 0)
+            throw new Error(`manifest: bad price for ${o.id}`);
+        if (!Number.isSafeInteger(o.context) || !Number.isSafeInteger(o.maxOutput) || o.maxOutput <= 0)
+            throw new Error(`manifest: bad limits for ${o.id}`);
+    }
+    return x;
+}

package/dist/pricing.js

@@ -0,0 +1,22 @@
+const MILLION = 1000000n;
+export function costOf(p, inputTokens, outputTokens) {
+    const raw = BigInt(Math.max(0, Math.floor(inputTokens))) * BigInt(p.input) + BigInt(Math.max(0, Math.floor(outputTokens))) * BigInt(p.output);
+    return (raw + MILLION - 1n) / MILLION;
+}
+/** A rough upper bound for a request's prompt before it runs: 4 characters per token over everything the model
+ * reads (messages, tool definitions, response schema). Router and provider compute it the same way. */
+export function estimateInputTokens(body) {
+    const b = body && typeof body === 'object' && !Array.isArray(body) ? body : null;
+    const read = b && ('messages' in b || 'tools' in b) ? { m: b.messages, t: b.tools, r: b.response_format } : body;
+    return Math.ceil(JSON.stringify(read ?? '').length / 4);
+}
+export function usd(units, digits = 6) {
+    const neg = units < 0n;
+    const v = neg ? -units : units;
+    const whole = v / 1000000n;
+    const frac = (v % 1000000n).toString().padStart(6, '0').slice(0, digits);
+    return `${neg ? '-' : ''}${whole}.${frac}`;
+}
+export function perMillion(units) {
+    return `$${(units / 1_000_000).toFixed(units < 100_000 ? 3 : 2)}/M`;
+}