orrery-node 0.0.0-stage → 0.1.1

package/dist/provider/node.js

@@ -0,0 +1,352 @@
+// A provider node: sells inference from any OpenAI-compatible upstream (vLLM, SGLang, Ollama, llama.cpp, or an API
+// you hold capacity on) to routers on the network. It never sees a wallet signature per request: it checks the
+// router's running-total voucher, serves, meters, and redeems the highest voucher on chain when it chooses.
+import { createHash, randomUUID } from 'node:crypto';
+import { existsSync, readFileSync } from 'node:fs';
+import { createServer } from 'node:http';
+import { Connection, Keypair, PublicKey, Transaction, sendAndConfirmTransaction } from '@solana/web3.js';
+import { decodeChannel, ins, pda, programId } from "../chain/program.js";
+import { decodeVoucher, redeemInstructions, verifyVoucher, encodeVoucher } from "../chain/voucher.js";
+import { home, loadKeypair, loadOrCreateKeypair, writePrivate } from "../keys.js";
+import { canonical, manifestHash } from "../manifest.js";
+import { costOf, estimateInputTokens, usd } from "../pricing.js";
+import { encrypt, enclaveKeyFromSecret, newEnclaveKey, openRequest } from "../seal.js";
+import { readSse, sseFrame, fetchWithTimeout } from "../sse.js";
+import { nextUsageHash, ZERO_HASH } from "../usage.js";
+const json = (res, status, body, headers = {}) => {
+    res.writeHead(status, { 'content-type': 'application/json', ...headers });
+    res.end(JSON.stringify(body, (_, v) => (typeof v === 'bigint' ? v.toString() : v)));
+};
+const fail = (res, status, code, message, extra = {}) => json(res, status, { error: { code, message, ...extra } });
+async function readBody(req, limit = 4 * 1024 * 1024) {
+    const parts = [];
+    let n = 0;
+    for await (const c of req) {
+        n += c.length;
+        if (n > limit)
+            throw new Error('body too large');
+        parts.push(c);
+    }
+    return Buffer.concat(parts);
+}
+const expand = (p) => p.replace(/^~(?=$|\/)/, process.env.HOME ?? '~');
+// Only standard chat fields reach the upstream. A gateway upstream (OpenRouter and the like) reads extra fields such
+// as fallback model lists, plugins or provider routing, any of which would let a caller spend the operator's key on
+// something the price list does not cover. `n` is dropped for the same reason: it multiplies the output.
+const UPSTREAM_FIELDS = [
+    'messages', 'temperature', 'top_p', 'stop', 'seed', 'presence_penalty', 'frequency_penalty', 'response_format',
+    'tools', 'tool_choice', 'parallel_tool_calls', 'logit_bias', 'logprobs', 'top_logprobs', 'user',
+];
+export function upstreamBody(body, model, maxOut) {
+    const out = {};
+    for (const k of UPSTREAM_FIELDS)
+        if (body[k] !== undefined)
+            out[k] = body[k];
+    return { ...out, model, stream: true, stream_options: { include_usage: true }, max_tokens: maxOut };
+}
+function secretFromEnv(name, what) {
+    const v = process.env[name];
+    if (!v)
+        throw new Error(`${what}: environment variable ${name} is not set`);
+    return v;
+}
+export class ProviderNode {
+    cfg;
+    conn;
+    node;
+    authority;
+    pda;
+    mint;
+    manifest;
+    manifestBytes;
+    enclave;
+    attestation;
+    apiKey;
+    ledger = new Map();
+    server = null;
+    timer = null;
+    dir;
+    log = (l) => console.log(l);
+    constructor(cfg) {
+        this.cfg = cfg;
+        this.conn = new Connection(cfg.rpcUrl, 'confirmed');
+        this.dir = expand(cfg.dataDir ?? home('provider'));
+        this.node = cfg.nodeKeyEnv
+            ? Keypair.fromSecretKey(Uint8Array.from(JSON.parse(secretFromEnv(cfg.nodeKeyEnv, 'node key'))))
+            : loadOrCreateKeypair(expand(cfg.nodeKey ?? `${this.dir}/node.json`));
+        this.apiKey = cfg.upstream.apiKey ?? (cfg.upstream.apiKeyEnv ? secretFromEnv(cfg.upstream.apiKeyEnv, 'upstream key') : undefined);
+        this.authority = cfg.authority ? new PublicKey(cfg.authority) : loadKeypair(expand(cfg.wallet ?? `${this.dir}/wallet.json`)).publicKey;
+        this.pda = pda.provider(this.authority);
+        this.mint = new PublicKey(cfg.settleMint);
+        if (cfg.tee) {
+            const keyPath = `${this.dir}/enclave.key`;
+            this.enclave = existsSync(keyPath) ? enclaveKeyFromSecret(Buffer.from(readFileSync(keyPath, 'utf8').trim(), 'hex')) : newEnclaveKey();
+            if (!existsSync(keyPath))
+                writePrivate(keyPath, this.enclave.secret.toString('hex'));
+            const kind = cfg.tee.kind ?? 1;
+            const measurement = createHash('sha384').update(`orrery-dev-image:${this.node.publicKey.toBase58()}`).digest();
+            const report = Buffer.from(JSON.stringify({ dev: true, note: 'software stand-in for a hardware quote; routers must not treat it as verified', kind, measurement: measurement.toString('hex'), enclaveKey: this.enclave.publicKey.toString('hex'), node: this.node.publicKey.toBase58() }));
+            this.attestation = { kind, measurement, report, reportHash: createHash('sha256').update(report).digest() };
+        }
+        else {
+            this.enclave = null;
+            this.attestation = null;
+        }
+        this.manifest = {
+            v: 1,
+            name: cfg.name,
+            authority: this.authority.toBase58(),
+            nodeKey: this.node.publicKey.toBase58(),
+            region: cfg.region,
+            models: cfg.models.map(({ upstreamModel: _u, ...o }) => o),
+            tee: this.enclave ? { kind: this.attestation.kind, enclaveKey: this.enclave.publicKey.toString('hex') } : undefined,
+        };
+        this.manifestBytes = canonical(this.manifest);
+        this.load();
+    }
+    get manifestHash() {
+        return manifestHash(this.manifestBytes);
+    }
+    ledgerPath() {
+        return `${this.dir}/ledger.json`;
+    }
+    load() {
+        if (!existsSync(this.ledgerPath()))
+            return;
+        const raw = JSON.parse(readFileSync(this.ledgerPath(), 'utf8'));
+        for (const [k, v] of Object.entries(raw)) {
+            this.raw.set(k, Buffer.from(v.channel, 'base64'));
+            this.ledger.set(k, {
+                channel: decodeChannel(Buffer.from(v.channel, 'base64')),
+                checkedAt: 0,
+                owed: BigInt(v.owed),
+                best: v.best ? decodeVoucher(v.best) : undefined,
+                usageHash: Buffer.from(v.usageHash, 'hex'),
+                redeemed: BigInt(v.redeemed),
+                unpaid: v.unpaid.map((r) => ({ ...r, cost: BigInt(r.cost), owedAfter: BigInt(r.owedAfter) })),
+            });
+        }
+    }
+    raw = new Map();
+    save() {
+        const out = {};
+        for (const [k, e] of this.ledger) {
+            out[k] = {
+                owed: e.owed.toString(), best: e.best ? encodeVoucher(e.best) : undefined, usageHash: e.usageHash.toString('hex'), redeemed: e.redeemed.toString(),
+                channel: (this.raw.get(k) ?? Buffer.alloc(0)).toString('base64'),
+                unpaid: e.unpaid.map((r) => ({ ...r, cost: r.cost.toString(), owedAfter: r.owedAfter.toString() })),
+            };
+        }
+        writePrivate(this.ledgerPath(), JSON.stringify(out));
+    }
+    async entry(address, force = false) {
+        const have = this.ledger.get(address);
+        if (have && !force && Date.now() - have.checkedAt < 30_000)
+            return have;
+        const info = await this.conn.getAccountInfo(new PublicKey(address));
+        if (!info)
+            throw Object.assign(new Error('channel not found on chain'), { code: 'unknown_channel', status: 404 });
+        if (!info.owner.equals(programId()))
+            throw Object.assign(new Error('not a channel'), { code: 'unknown_channel', status: 400 });
+        const ch = decodeChannel(info.data);
+        if (!ch.provider.equals(this.pda))
+            throw Object.assign(new Error('channel is for another provider'), { code: 'wrong_provider', status: 400 });
+        if (!ch.mint.equals(this.mint))
+            throw Object.assign(new Error('channel is in another mint'), { code: 'wrong_mint', status: 400 });
+        this.raw.set(address, Buffer.from(info.data));
+        const e = have ?? { channel: ch, checkedAt: 0, owed: 0n, usageHash: ZERO_HASH, unpaid: [], redeemed: ch.redeemed };
+        e.channel = ch;
+        e.checkedAt = Date.now();
+        if (ch.redeemed > e.redeemed)
+            e.redeemed = ch.redeemed;
+        this.ledger.set(address, e);
+        return e;
+    }
+    accept(address, e, v) {
+        if (!verifyVoucher(e.channel.sessionKey, new PublicKey(address), v))
+            throw Object.assign(new Error('voucher signature does not match the channel session key'), { code: 'bad_voucher', status: 401 });
+        if (!e.best || v.cumulative > e.best.cumulative) {
+            e.best = v;
+            e.unpaid = e.unpaid.filter((r) => r.owedAfter > v.cumulative);
+        }
+    }
+    async handle(req, res) {
+        const url = new URL(req.url ?? '/', 'http://x');
+        try {
+            if (req.method === 'GET' && url.pathname === '/v1/manifest') {
+                res.writeHead(200, { 'content-type': 'application/json', 'x-orrery-manifest-sha256': this.manifestHash.toString('hex') });
+                return void res.end(this.manifestBytes);
+            }
+            if (req.method === 'GET' && url.pathname === '/v1/attestation') {
+                if (!this.attestation || !this.enclave)
+                    return fail(res, 404, 'no_tee', 'this node does not run in an enclave');
+                return json(res, 200, { kind: this.attestation.kind, measurement: this.attestation.measurement.toString('hex'), enclaveKey: this.enclave.publicKey.toString('hex'), report: this.attestation.report.toString('base64'), reportHash: this.attestation.reportHash.toString('hex') });
+            }
+            if (req.method === 'GET' && url.pathname === '/health') {
+                return json(res, 200, { ok: true, provider: this.pda.toBase58(), models: this.manifest.models.length, channels: this.ledger.size });
+            }
+            if (req.method === 'POST' && url.pathname === '/orrery/voucher') {
+                const b = JSON.parse((await readBody(req)).toString('utf8'));
+                const e = await this.entry(b.channel);
+                this.accept(b.channel, e, decodeVoucher(b.voucher));
+                this.save();
+                return json(res, 200, { paid: e.best?.cumulative ?? 0n, owed: e.owed });
+            }
+            if (req.method === 'POST' && url.pathname === '/v1/chat/completions')
+                return await this.complete(req, res);
+            return fail(res, 404, 'not_found', 'no such route');
+        }
+        catch (err) {
+            const e = err;
+            if (!res.headersSent)
+                return fail(res, e.status ?? 500, e.code ?? 'internal', e.message);
+            res.end();
+        }
+    }
+    async complete(req, res) {
+        const address = String(req.headers['x-orrery-channel'] ?? '');
+        if (!address)
+            return fail(res, 402, 'channel_required', 'open a channel to this provider and send x-orrery-channel');
+        let body = JSON.parse((await readBody(req)).toString('utf8'));
+        let sealKey = null;
+        if (body.sealed) {
+            if (!this.enclave)
+                return fail(res, 400, 'no_tee', 'sealed request to a node without an enclave');
+            const opened = openRequest(this.enclave, body);
+            body = JSON.parse(opened.plaintext.toString('utf8'));
+            sealKey = opened.key;
+        }
+        const offer = this.cfg.models.find((m) => m.id === body.model);
+        if (!offer)
+            return fail(res, 404, 'model_not_offered', `this node does not serve ${String(body.model)}`);
+        const e = await this.entry(address);
+        const now = BigInt(Math.floor(Date.now() / 1000));
+        if (e.channel.closingAt !== 0n && now > e.channel.closingAt - 120n)
+            return fail(res, 409, 'channel_closing', 'channel is closing; open a new one');
+        const vh = req.headers['x-orrery-voucher'];
+        if (vh) {
+            const v = decodeVoucher(String(vh));
+            if (v.cumulative > e.channel.deposit)
+                await this.entry(address, true);
+            this.accept(address, e, v);
+        }
+        const paid = e.best?.cumulative ?? 0n;
+        if (paid < e.owed)
+            return fail(res, 402, 'payment_required', 'previous requests are not paid for', { owed: e.owed.toString(), paid: paid.toString(), unpaid: e.unpaid.map((r) => ({ ...r, cost: r.cost.toString(), owedAfter: r.owedAfter.toString() })) });
+        const askedOut = Number(body.max_completion_tokens ?? body.max_tokens ?? offer.maxOutput);
+        const maxOut = Math.max(1, Math.min(Number.isFinite(askedOut) ? askedOut : offer.maxOutput, offer.maxOutput));
+        const maxCost = costOf(offer.price, estimateInputTokens(body), maxOut);
+        if (e.owed + maxCost > e.channel.deposit) {
+            await this.entry(address, true);
+            if (e.owed + maxCost > e.channel.deposit)
+                return fail(res, 402, 'channel_exhausted', 'not enough deposit left for this request', { owed: e.owed.toString(), deposit: e.channel.deposit.toString(), need: maxCost.toString() });
+        }
+        const upstream = await fetchWithTimeout(`${this.cfg.upstream.baseUrl.replace(/\/$/, '')}/chat/completions`, {
+            method: 'POST',
+            timeoutMs: 30_000,
+            headers: { 'content-type': 'application/json', ...(this.apiKey ? { authorization: `Bearer ${this.apiKey}` } : {}), ...(this.cfg.upstream.headers ?? {}) },
+            body: JSON.stringify({ ...(this.cfg.upstream.body ?? {}), ...upstreamBody(body, offer.upstreamModel ?? offer.id, maxOut) }),
+        });
+        if (!upstream.ok || !upstream.body)
+            return fail(res, 502, 'upstream_error', `upstream answered ${upstream.status}`);
+        res.writeHead(200, { 'content-type': 'text/event-stream', 'cache-control': 'no-cache', 'x-orrery-sealed': sealKey ? '1' : '0' });
+        const send = (data, event) => res.write(sseFrame(sealKey ? encrypt(sealKey, Buffer.from(data)).toString('base64') : data, event));
+        let usage = null;
+        let chars = 0;
+        for await (const ev of readSse(upstream.body)) {
+            if (ev.data === '[DONE]')
+                break;
+            let chunk;
+            try {
+                chunk = JSON.parse(ev.data);
+            }
+            catch {
+                continue;
+            }
+            if (chunk.usage)
+                usage = chunk.usage;
+            for (const c of chunk.choices ?? [])
+                chars += c.delta?.content?.length ?? 0;
+            chunk.model = offer.id;
+            send(JSON.stringify(chunk));
+        }
+        const inputTokens = usage?.prompt_tokens ?? estimateInputTokens(body);
+        const outputTokens = Math.min(usage?.completion_tokens ?? Math.ceil(chars / 4), maxOut);
+        const cost = costOf(offer.price, inputTokens, outputTokens);
+        const record = { requestId: randomUUID(), model: offer.id, inputTokens, outputTokens, cost: cost > maxCost ? maxCost : cost };
+        e.owed += record.cost;
+        e.usageHash = nextUsageHash(e.usageHash, record);
+        e.unpaid.push({ ...record, owedAfter: e.owed });
+        this.save();
+        send(JSON.stringify({ ...record, cost: record.cost.toString(), owed: e.owed.toString(), usageHash: e.usageHash.toString('hex') }), 'orrery');
+        res.write(sseFrame('[DONE]'));
+        res.end();
+        this.log(`served ${offer.id} ${inputTokens}+${outputTokens} tok  $${usd(record.cost)}  channel ${address.slice(0, 6)}  owed $${usd(e.owed)}${sealKey ? '  sealed' : ''}`);
+    }
+    /** Redeem every channel whose best voucher is ahead of what is on chain, a few channels per transaction. */
+    async redeemDue(minUnits = BigInt(this.cfg.redeem?.minUnits ?? 1)) {
+        const due = [];
+        for (const [k, e] of this.ledger) {
+            if (!e.best || e.best.cumulative <= e.redeemed)
+                continue;
+            const pending = (e.best.cumulative < e.channel.deposit ? e.best.cumulative : e.channel.deposit) - e.redeemed;
+            const closing = e.channel.closingAt !== 0n;
+            if (pending >= minUnits || (closing && pending > 0n))
+                due.push([k, e]);
+        }
+        const done = [];
+        for (let i = 0; i < due.length; i += 3) {
+            const batch = due.slice(i, i + 3);
+            const tx = new Transaction();
+            for (const [k, e] of batch) {
+                tx.add(...redeemInstructions({ caller: this.node.publicKey, providerAuthority: this.authority, channel: new PublicKey(k), mint: this.mint, sessionKey: e.channel.sessionKey, voucher: e.best }));
+            }
+            try {
+                const sig = await sendAndConfirmTransaction(this.conn, tx, [this.node], { commitment: 'confirmed' });
+                for (const [k, e] of batch) {
+                    const before = e.redeemed;
+                    await this.entry(k, true).catch(() => undefined);
+                    e.redeemed = e.channel.redeemed;
+                    const amount = e.redeemed - before;
+                    done.push({ channel: k, amount, tx: sig });
+                    this.log(`redeemed $${usd(amount)} from channel ${k.slice(0, 6)}  tx ${sig.slice(0, 12)}…`);
+                }
+                this.save();
+            }
+            catch (err) {
+                this.log(`redeem failed: ${err.message.split('\n')[0]}`);
+            }
+        }
+        return done;
+    }
+    registerInstruction(wallet) {
+        return ins.registerProvider(wallet, this.node.publicKey, this.cfg.publicUrl, this.manifestHash);
+    }
+    updateInstruction(wallet) {
+        return ins.updateProvider(wallet, { nodeKey: this.node.publicKey, endpoint: this.cfg.publicUrl, manifestHash: this.manifestHash, active: true });
+    }
+    attestInstruction(validSecs = 7 * 86_400) {
+        if (!this.attestation || !this.enclave)
+            throw new Error('no enclave configured');
+        return ins.attest(this.node.publicKey, this.authority, {
+            kind: this.attestation.kind,
+            measurement: this.attestation.measurement,
+            reportHash: this.attestation.reportHash,
+            teeKey: this.enclave.publicKey,
+            expiresAt: BigInt(Math.floor(Date.now() / 1000) + validSecs),
+        });
+    }
+    listen() {
+        return new Promise((resolve) => {
+            this.server = createServer((req, res) => void this.handle(req, res));
+            this.server.listen(this.cfg.listen, this.cfg.host ?? '0.0.0.0', () => resolve(this.server));
+            const every = (this.cfg.redeem?.everySecs ?? 60) * 1000;
+            this.timer = setInterval(() => void this.redeemDue(), every);
+        });
+    }
+    close() {
+        if (this.timer)
+            clearInterval(this.timer);
+        return new Promise((r) => (this.server ? this.server.close(() => r()) : r()));
+    }
+}

package/dist/router/channels.js

@@ -0,0 +1,130 @@
+// The router's side of each payment channel. The wallet signs once to open (and to top up); after that a session
+// key on this computer signs a running total after every request, and nothing else is needed per request.
+import { randomBytes } from 'node:crypto';
+import { existsSync, readFileSync } from 'node:fs';
+import { PublicKey, Transaction, sendAndConfirmTransaction } from '@solana/web3.js';
+import { decodeChannel, ins, pda } from "../chain/program.js";
+import { encodeVoucher, signVoucher } from "../chain/voucher.js";
+import { signerOf, writePrivate } from "../keys.js";
+import { nextUsageHash, ZERO_HASH } from "../usage.js";
+export class Channels {
+    conn;
+    wallet;
+    session;
+    mint;
+    path;
+    opts;
+    map = new Map();
+    opening = new Map();
+    sign;
+    spend = { day: '', units: 0n };
+    constructor(conn, wallet, session, mint, path, opts) {
+        this.conn = conn;
+        this.wallet = wallet;
+        this.session = session;
+        this.mint = mint;
+        this.path = path;
+        this.opts = opts;
+        this.sign = signerOf(session);
+        this.load();
+    }
+    load() {
+        if (!existsSync(this.path))
+            return;
+        const raw = JSON.parse(readFileSync(this.path, 'utf8'));
+        for (const c of raw.channels ?? []) {
+            this.map.set(c.provider, { ...c, deposit: BigInt(c.deposit), cumulative: BigInt(c.cumulative), usageHash: Buffer.from(c.usageHash, 'hex'), checkedAt: 0 });
+        }
+        if (raw.spend)
+            this.spend = { day: raw.spend.day, units: BigInt(raw.spend.units) };
+    }
+    save() {
+        const channels = [...this.map.values()].map((c) => ({ ...c, deposit: c.deposit.toString(), cumulative: c.cumulative.toString(), usageHash: c.usageHash.toString('hex') }));
+        writePrivate(this.path, JSON.stringify({ channels, spend: { day: this.spend.day, units: this.spend.units.toString() } }, null, 1));
+    }
+    list() {
+        return [...this.map.values()];
+    }
+    get(provider) {
+        return this.map.get(provider);
+    }
+    remaining(provider) {
+        const c = this.map.get(provider);
+        return c ? c.deposit - c.cumulative : 0n;
+    }
+    todaySpent() {
+        const day = new Date().toISOString().slice(0, 10);
+        if (this.spend.day !== day)
+            this.spend = { day, units: 0n };
+        return this.spend.units;
+    }
+    overBudget(next) {
+        return this.todaySpent() + next > this.opts.dailyCap;
+    }
+    /** The open channel to `provider`, opening one with the wallet if there is none or the old one is closing. */
+    async ensure(provider, need) {
+        const have = this.map.get(provider);
+        if (have && Date.now() - have.checkedAt < 5 * 60_000 && have.deposit - have.cumulative >= need)
+            return have;
+        if (have) {
+            const info = await this.conn.getAccountInfo(new PublicKey(have.channel));
+            if (info) {
+                const ch = decodeChannel(info.data);
+                if (ch.closingAt === 0n) {
+                    have.deposit = ch.deposit;
+                    have.checkedAt = Date.now();
+                    if (have.deposit - have.cumulative < need)
+                        await this.topUp(provider, need);
+                    return have;
+                }
+            }
+            this.map.delete(provider);
+        }
+        const pending = this.opening.get(provider);
+        if (pending)
+            return pending;
+        const p = this.open(provider, need > this.opts.deposit ? need : this.opts.deposit).finally(() => this.opening.delete(provider));
+        this.opening.set(provider, p);
+        return p;
+    }
+    async open(provider, deposit) {
+        if (!this.wallet)
+            throw new Error('no wallet configured: the router needs one to open a channel (orrery router --wallet <keypair.json>)');
+        const id = randomBytes(8).readBigUInt64LE();
+        const providerKey = new PublicKey(provider);
+        const tx = new Transaction().add(ins.openChannel(this.wallet.publicKey, providerKey, this.mint, id, deposit, this.session.publicKey));
+        await sendAndConfirmTransaction(this.conn, tx, [this.wallet], { commitment: 'confirmed' });
+        const state = {
+            provider, channel: pda.channel(this.wallet.publicKey, providerKey, id).toBase58(), id: id.toString(), deposit, cumulative: 0n,
+            usageHash: ZERO_HASH, voucher: null, openedAt: Date.now(), checkedAt: Date.now(),
+        };
+        this.map.set(provider, state);
+        this.save();
+        return state;
+    }
+    async topUp(provider, atLeast) {
+        const c = this.map.get(provider);
+        if (!c || !this.wallet)
+            return;
+        const amount = atLeast > this.opts.deposit ? atLeast : this.opts.deposit;
+        const tx = new Transaction().add(ins.topUp(this.wallet.publicKey, new PublicKey(c.channel), this.mint, amount));
+        await sendAndConfirmTransaction(this.conn, tx, [this.wallet], { commitment: 'confirmed' });
+        c.deposit += amount;
+        this.save();
+    }
+    /** Pay for one finished request: extend the usage chain, sign the new total, and return the voucher. */
+    settle(provider, r) {
+        const c = this.map.get(provider);
+        if (!c)
+            throw new Error('no channel');
+        c.cumulative += r.cost;
+        c.usageHash = nextUsageHash(c.usageHash, r);
+        c.voucher = encodeVoucher(signVoucher(this.sign, new PublicKey(c.channel), c.cumulative, c.usageHash));
+        this.todaySpent();
+        this.spend.units += r.cost;
+        this.save();
+        if (c.deposit - c.cumulative < this.opts.topUpBelow)
+            void this.topUp(provider, this.opts.deposit).catch(() => undefined);
+        return c.voucher;
+    }
+}

package/dist/router/console.js

@@ -0,0 +1,49 @@
+// The page at http://127.0.0.1:7171/ — what the router did, read from /orrery/status. Plain HTML, no build step.
+import { NAME } from "../brand.js";
+export function consolePage() {
+    return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<title>${NAME} router</title>
+<link rel="preconnect" href="https://fonts.googleapis.com"><link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
+<link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=Geist+Mono:wght@400;500&family=Instrument+Sans:wght@400;500;600&display=swap">
+<style>
+:root{--bg:#000;--card:#0c0c0c;--well:#070707;--line:#1c1c1c;--line2:#2e2e2e;--fg:#f7f7f7;--fg2:#c6c6c6;--fg3:#9c9c9c;--green:#14f195;--purple:#b98aff;--warn:#f0a868;
+--sans:'Instrument Sans','Helvetica Neue',Arial,sans-serif;--mono:'Geist Mono',ui-monospace,SFMono-Regular,Menlo,monospace;color-scheme:dark}
+*{box-sizing:border-box}body{margin:0;background:var(--bg);color:var(--fg);font:15px/1.5 var(--sans);-webkit-font-smoothing:antialiased;padding:0 clamp(16px,4vw,48px) 64px}
+header{display:flex;align-items:center;gap:12px;height:64px;border-bottom:1px solid var(--line);margin:0 calc(-1*clamp(16px,4vw,48px)) 32px;padding:0 clamp(16px,4vw,48px)}
+.brand{display:inline-flex;align-items:center;gap:10px;font-weight:500;font-size:17px;letter-spacing:-.02em}
+.grad{background-image:linear-gradient(90deg,#9945ff,#5f8ff2 50%,#14f195);-webkit-background-clip:text;background-clip:text;color:transparent}
+.here{color:var(--fg3);font-size:14px}.live{margin-left:auto;display:inline-flex;align-items:center;gap:8px;font:400 12px var(--mono);color:var(--fg2)}
+.live i{width:7px;height:7px;border-radius:50%;background:var(--green);box-shadow:0 0 0 3px rgba(20,241,149,.15);animation:b 2.4s ease-in-out infinite}@keyframes b{50%{opacity:.35}}
+main{max-width:1180px;margin:0 auto;display:grid;gap:36px}
+h1{margin:0;font-size:clamp(28px,3.2vw,40px);font-weight:500;letter-spacing:-.03em;line-height:1.08}h1 span{color:var(--fg3)}
+.lede{margin:10px 0 0;color:var(--fg2);max-width:46em}.lede code{font:400 13px var(--mono);color:var(--fg)}
+.stats{display:grid;grid-template-columns:repeat(4,minmax(0,1fr));border:1px solid var(--line);border-radius:16px;background:var(--card);overflow:hidden}
+.stats div{padding:18px 20px;display:flex;flex-direction:column-reverse;gap:6px}.stats div+div{border-left:1px solid var(--line)}
+.stats b{font:500 22px var(--mono);letter-spacing:0}.cap{font:500 11px/1.4 var(--mono);letter-spacing:.16em;text-transform:uppercase;color:var(--fg3)}
+section h2{margin:0 0 12px;font:500 11px/1.4 var(--mono);letter-spacing:.16em;text-transform:uppercase;color:var(--fg3)}
+.wrap{overflow-x:auto;border:1px solid var(--line);border-radius:16px;background:var(--card)}
+table{width:100%;border-collapse:collapse;font:400 13px/1.5 var(--mono);font-variant-numeric:tabular-nums}
+th,td{text-align:left;padding:12px 16px;border-bottom:1px solid var(--line);white-space:nowrap}tbody tr:last-child td{border-bottom:0}
+th{color:var(--fg3);font-weight:500;font-size:10.5px;text-transform:uppercase;letter-spacing:.14em;background:var(--well)}
+td{color:var(--fg2)}td:first-child{color:var(--fg)}tbody tr:hover td{background:#101010}
+.go{color:var(--green)}.stop{color:var(--warn)}.sig{color:var(--purple)}.empty td{color:var(--fg3);font-family:var(--sans);font-size:14px;padding:22px 16px}
+@media (max-width:760px){.stats{grid-template-columns:repeat(2,minmax(0,1fr))}.stats div:nth-child(3){border-left:0}.stats div:nth-child(n+3){border-top:1px solid var(--line)}.live{display:none}}
+</style></head><body>
+<header><span class="brand"><svg width="22" height="22" viewBox="0 0 24 24" aria-hidden="true"><defs><linearGradient id="g" x1="2" y1="18" x2="22" y2="6" gradientUnits="userSpaceOnUse"><stop offset="0" stop-color="#9945ff"/><stop offset=".5" stop-color="#5f8ff2"/><stop offset="1" stop-color="#14f195"/></linearGradient></defs><ellipse cx="12" cy="12" rx="10.2" ry="4.3" fill="none" stroke="url(#g)" stroke-width="1.3"/><ellipse cx="12" cy="12" rx="10.2" ry="4.3" fill="none" stroke="url(#g)" stroke-width="1.3" opacity=".6" transform="rotate(62 12 12)"/><circle cx="12" cy="12" r="2.5" fill="#f5f5f5"/><circle cx="20.6" cy="9.7" r="1.7" fill="#14f195"/></svg><span class="grad">${NAME}</span></span><span class="here">Router console</span><span class="live"><i></i>live from this computer</span></header>
+<main>
+<div><h1><span>Your router.</span> Every request, straight to a provider.</h1><p class="lede">Point any OpenAI-compatible tool at <code id="base">http://127.0.0.1/v1</code>. Each answer is paid from your channel to the machine that served it; nothing in between.</p></div>
+<div class="stats" id="sum"></div>
+<section><h2>Recent requests</h2><div class="wrap"><table><thead><tr><th>time</th><th>route</th><th>model</th><th>provider</th><th>tokens</th><th>paid</th><th>first token</th></tr></thead><tbody id="trips"></tbody></table></div></section>
+<section><h2>Providers</h2><div class="wrap"><table><thead><tr><th>name</th><th>models</th><th>settled on chain</th><th>enclave</th><th>seen</th><th>state</th></tr></thead><tbody id="prov"></tbody></table></div></section>
+<section><h2>Channels</h2><div class="wrap"><table><thead><tr><th>provider</th><th>channel</th><th>deposit</th><th>spent</th><th>left</th></tr></thead><tbody id="ch"></tbody></table></div></section>
+</main><script>
+const esc=s=>String(s??'').replace(/[&<>"]/g,c=>({'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;'}[c]));
+async function tick(){try{const s=await (await fetch('/orrery/status')).json();
+document.getElementById('base').textContent='http://127.0.0.1:'+location.port+'/v1';
+document.getElementById('sum').innerHTML='<div><b>'+esc(s.route)+'</b><span class=cap>default route</span></div><div><b class=go>$'+esc(s.spentToday)+'</b><span class=cap>spent today</span></div><div><b>'+s.providers.length+'</b><span class=cap>providers</span></div><div><b>'+s.channels.length+'</b><span class=cap>open channels</span></div>';
+document.getElementById('trips').innerHTML=s.trips.map(t=>'<tr><td>'+new Date(t.at).toLocaleTimeString()+'</td><td>'+esc(t.route)+(t.sealed?' <span class=go>sealed</span>':'')+'</td><td>'+esc(t.model)+'</td><td>'+esc(t.providerName)+(t.fellThrough?' <span class=sig>after '+t.fellThrough+' failed</span>':'')+'</td><td>'+t.inputTokens+'+'+t.outputTokens+'</td><td class=go>$'+esc(t.cost)+'</td><td>'+t.ttftMs+' ms</td></tr>').join('')||'<tr class=empty><td colspan=7>No requests yet. Point a tool at http://127.0.0.1:'+location.port+'/v1</td></tr>';
+document.getElementById('prov').innerHTML=s.providers.map(p=>'<tr><td>'+esc(p.name||p.address.slice(0,8))+'</td><td>'+p.models+'</td><td>$'+esc(p.settled)+' · '+p.redeems+' redeems</td><td>'+(p.tee?(p.tee.verified?'<span class=go>verified</span>':'<span class=stop>'+esc(p.tee.reason)+'</span>'):'—')+'</td><td>'+p.observed.ok+' ok / '+p.observed.fail+' failed</td><td>'+(p.problem?'<span class=stop>'+esc(p.problem)+'</span>':p.active?'<span class=go>open</span>':'closed')+'</td></tr>').join('');
+document.getElementById('ch').innerHTML=s.channels.map(c=>'<tr><td>'+esc(c.provider.slice(0,8))+'</td><td>'+esc(c.channel.slice(0,8))+'</td><td>$'+esc(c.deposit)+'</td><td>$'+esc(c.spent)+'</td><td>$'+esc(c.left)+'</td></tr>').join('')||'<tr class=empty><td colspan=5>None yet. The first request to a provider opens one.</td></tr>';
+}catch(e){}}tick();setInterval(tick,2000);
+</script></body></html>`;
+}

package/dist/router/policy.js

@@ -0,0 +1,88 @@
+import { costOf } from "../pricing.js";
+export const ROUTES = ['auto', 'price', 'speed', 'reputation', 'privacy'];
+const SUFFIX = { cheap: 'price', floor: 'price', fast: 'speed', trusted: 'reputation', private: 'privacy' };
+/** `qwen3-32b:private` → model qwen3-32b on the privacy route. */
+export function parseModel(raw, fallback) {
+    const at = raw.lastIndexOf(':');
+    if (at > 0) {
+        const s = raw.slice(at + 1).toLowerCase();
+        if (SUFFIX[s])
+            return { model: raw.slice(0, at), route: SUFFIX[s] };
+        if (ROUTES.includes(s))
+            return { model: raw.slice(0, at), route: s };
+    }
+    return { model: raw, route: fallback };
+}
+export class Stats {
+    m = new Map();
+    get(address) {
+        return this.m.get(address) ?? { ttftMs: null, ok: 0, fail: 0, cooldownUntil: 0 };
+    }
+    ok(address, ttftMs) {
+        const o = this.get(address);
+        o.ttftMs = o.ttftMs === null ? ttftMs : Math.round(o.ttftMs * 0.7 + ttftMs * 0.3);
+        o.ok += 1;
+        this.m.set(address, o);
+    }
+    fail(address) {
+        const o = this.get(address);
+        o.fail += 1;
+        o.cooldownUntil = Date.now() + Math.min(300_000, 15_000 * 2 ** Math.min(4, o.fail - 1));
+        this.m.set(address, o);
+    }
+    all() {
+        return this.m;
+    }
+}
+const log01 = (x, cap) => Math.min(1, Math.log10(1 + Math.max(0, x)) / Math.log10(1 + cap));
+/** 0..1 from what the chain proves (money actually settled, how often, for how long, what is bonded) and what this
+ * router saw itself. Settled volume is weighted most because it is the only input that cost someone real USDC. */
+export function reputation(e, o, maxBond) {
+    const a = e.account;
+    const settled = log01(Number(a.settled) / 1e6, 1_000);
+    const redeems = log01(Number(a.redeems), 1_000);
+    const days = (Date.now() / 1000 - Number(a.registeredAt)) / 86_400;
+    const age = Math.min(1, Math.max(0, days) / 90);
+    const bond = maxBond > 0n ? Math.sqrt(Number((a.bonded * 1000000n) / maxBond) / 1_000_000) : 0;
+    const seen = o.ok + o.fail;
+    const local = seen === 0 ? 0.6 : o.ok / seen;
+    return 0.35 * settled + 0.15 * redeems + 0.15 * age + 0.1 * bond + 0.25 * local;
+}
+export function rank(offers, route, estIn, estOut, stats, minReputation = 0) {
+    const now = Date.now();
+    const maxBond = offers.reduce((m, o) => (o.entry.account.bonded > m ? o.entry.account.bonded : m), 0n);
+    let c = offers
+        .filter((o) => stats.get(o.entry.address).cooldownUntil <= now)
+        .map(({ entry, offer }) => {
+        const o = stats.get(entry.address);
+        return {
+            entry,
+            offer,
+            expected: costOf(offer.price, estIn, Math.min(estOut, offer.maxOutput)),
+            ttftMs: o.ttftMs,
+            reputation: reputation(entry, o, maxBond),
+            sealed: route === 'privacy',
+        };
+    });
+    if (route === 'privacy')
+        c = c.filter((x) => x.entry.tee?.verified);
+    const byCost = (a, b) => (a.expected === b.expected ? b.reputation - a.reputation : a.expected < b.expected ? -1 : 1);
+    const ttft = (x) => x.ttftMs ?? 1_500;
+    switch (route) {
+        case 'price':
+        case 'privacy':
+            return c.sort(byCost);
+        case 'speed':
+            return c.sort((a, b) => ttft(a) - ttft(b) || byCost(a, b));
+        case 'reputation':
+            return c.sort((a, b) => b.reputation - a.reputation || byCost(a, b));
+        case 'auto': {
+            const trusted = c.filter((x) => x.reputation >= minReputation);
+            const pool = trusted.length ? trusted : c;
+            const minCost = pool.reduce((m, x) => (x.expected < m ? x.expected : m), pool[0]?.expected ?? 0n);
+            const minT = Math.min(...pool.map(ttft));
+            const score = (x) => 0.6 * (minCost > 0n ? Number(x.expected) / Number(minCost) : 1) + 0.25 * (ttft(x) / Math.max(1, minT)) + 0.15 * (1 - x.reputation) * 3;
+            return pool.sort((a, b) => score(a) - score(b));
+        }
+    }
+}