Compare commits
1 Commits
main
...
dependabot
| Author | SHA1 | Date | |
|---|---|---|---|
|
c9c5455347 |
69
.github/workflows/deploy-mainnet.yml
vendored
69
.github/workflows/deploy-mainnet.yml
vendored
@@ -1,69 +0,0 @@
|
||||
name: Deploy mainnet
|
||||
|
||||
# CD for the vector-marketplace host (91.98.147.172).
|
||||
#
|
||||
# Trigger: automatically after the "CI" workflow succeeds on main, or manually
|
||||
# via workflow_dispatch (Actions tab -> Deploy mainnet -> Run workflow).
|
||||
#
|
||||
# The runner only SSHes in and executes deploy/mainnet/deploy.sh AT THE NEW
|
||||
# COMMIT (fetched server-side via `git show FETCH_HEAD:`), so deploy logic is
|
||||
# versioned with the code it deploys. The script itself decides which compose
|
||||
# projects to rebuild based on the old..new diff, drains busy suppliers, and
|
||||
# health-gates every restart — see deploy/mainnet/deploy.sh.
|
||||
#
|
||||
# Secrets: DEPLOY_SSH_KEY — ed25519 private key whose public half is in
|
||||
# root@vector-marketplace:~/.ssh/authorized_keys.
|
||||
|
||||
on:
|
||||
workflow_run:
|
||||
workflows: ["CI"]
|
||||
types: [completed]
|
||||
branches: [main]
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
force:
|
||||
description: "Redeploy even if the server is already at origin/main"
|
||||
type: boolean
|
||||
default: false
|
||||
|
||||
concurrency:
|
||||
group: deploy-mainnet
|
||||
cancel-in-progress: false # never kill a deploy mid-rollout
|
||||
|
||||
env:
|
||||
DEPLOY_HOST: 91.98.147.172
|
||||
DEPLOY_USER: root
|
||||
# Pinned host key (ssh-keyscan -t ed25519 91.98.147.172)
|
||||
DEPLOY_HOSTKEY: "91.98.147.172 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJvjM8D+pNUb2Qr4yJbqVcRrUzbpbfyv0/tupUgD5Th0"
|
||||
|
||||
jobs:
|
||||
deploy:
|
||||
name: deploy to vector-marketplace
|
||||
runs-on: nixos
|
||||
# workflow_run fires on failure too — only deploy green main.
|
||||
if: github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success'
|
||||
steps:
|
||||
# Self-hosted runner: keep key material in the job's temp dir, not the
|
||||
# runner user's ~/.ssh (which persists across jobs).
|
||||
- name: Set up SSH
|
||||
run: |
|
||||
install -m 700 -d "$RUNNER_TEMP/ssh"
|
||||
printf '%s\n' "${{ secrets.DEPLOY_SSH_KEY }}" > "$RUNNER_TEMP/ssh/id_ed25519"
|
||||
chmod 600 "$RUNNER_TEMP/ssh/id_ed25519"
|
||||
printf '%s\n' "$DEPLOY_HOSTKEY" > "$RUNNER_TEMP/ssh/known_hosts"
|
||||
|
||||
- name: Run deploy script on server
|
||||
run: |
|
||||
FORCE=0
|
||||
[ "${{ github.event.inputs.force }}" = "true" ] && FORCE=1
|
||||
ssh -o BatchMode=yes \
|
||||
-o IdentitiesOnly=yes \
|
||||
-i "$RUNNER_TEMP/ssh/id_ed25519" \
|
||||
-o UserKnownHostsFile="$RUNNER_TEMP/ssh/known_hosts" \
|
||||
"$DEPLOY_USER@$DEPLOY_HOST" "
|
||||
set -euo pipefail
|
||||
cd /root/agents-marketplace
|
||||
git fetch origin main
|
||||
git show FETCH_HEAD:deploy/mainnet/deploy.sh > /run/marketplace-deploy.sh
|
||||
FORCE=$FORCE bash /run/marketplace-deploy.sh
|
||||
"
|
||||
37
README.md
37
README.md
@@ -1,36 +1,3 @@
|
||||
# Local Agents Marketplace
|
||||
## Local Agents Marketplace
|
||||
|
||||
Bonded-escrow coordination for AI agent work on **Vector**, the Apex Fusion eUTXO L2.
|
||||
|
||||
Buyers commission work. Suppliers claim it. Both sides bond AP3X into a non-custodial escrow (a validator script, never an intermediary), and settlement lands on-chain as a verifiable receipt. Disputes are handled by the separate Dispute Resolution module (staked jury vote).
|
||||
|
||||
**Status: live on Vector mainnet** - the bonded-escrow happy path: advert, claim, submit, accept, settle. The contracts have been through the internal audit pipeline (methodology published in [vector-ai-agents](https://github.com/Apex-Fusion/vector-ai-agents)); they have not yet undergone independent third-party audit.
|
||||
|
||||
## Flow
|
||||
|
||||
1. **Advert** - a buyer posts a job with escrow bonded
|
||||
2. **Claim** - a supplier claims it, bonding their side
|
||||
3. **Submit** - work is delivered
|
||||
4. **Accept** - the buyer accepts the work
|
||||
5. **Settle** - the escrow releases; the settlement is a signed on-chain receipt
|
||||
|
||||
## Repository layout
|
||||
|
||||
| Path | What |
|
||||
|---|---|
|
||||
| `contracts/advert`, `contracts/escrow`, `contracts/marketplace` | Aiken validators |
|
||||
| `docs/ARCHITECTURE.md` | Architecture spec |
|
||||
| `docs/buyer/`, `docs/supplier/` | Role guides |
|
||||
| `deploy/` | Deployment and simulation tooling |
|
||||
|
||||
Monorepo managed with pnpm workspaces.
|
||||
|
||||
## Getting started
|
||||
|
||||
Developer docs: [Vector AI documentation](https://apex-fusion.github.io/vector-ai-documentation/). For the contract-level picture, start with [`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md).
|
||||
|
||||
## Related
|
||||
|
||||
- [mcp-server](https://github.com/Apex-Fusion/mcp-server) - hosted MCP server for Vector (testnet and mainnet)
|
||||
- [agent-sdk-py](https://github.com/Apex-Fusion/agent-sdk-py) / [agent-sdk-ts](https://github.com/Apex-Fusion/agent-sdk-ts) - Python and TypeScript SDKs
|
||||
- [vector-agent-modules](https://github.com/Apex-Fusion/vector-agent-modules) - dispute resolution, reputation staking, self-improvement
|
||||
Local Agents Marketplace MVP. See `docs/ARCHITECTURE.md` for the architecture spec. Monorepo managed with pnpm workspaces. Work-in-progress; not production-ready.
|
||||
|
||||
@@ -38,15 +38,10 @@ NETWORK_ID=0
|
||||
# along over loopback. Production behind TLS should leave this unset / "1".
|
||||
# COOKIE_SECURE=1
|
||||
|
||||
# Internal, redacted data source for the authenticated /dashboard page.
|
||||
# SURPLUS_DASHBOARD_URL=http://surplus-seller:8080/internal/resale-dashboard
|
||||
|
||||
# ─── Optional: PDF Book Summarizer (/book page, /v1/pdf-* routes) ─────────
|
||||
# Upload a PDF → chunk it → pay suppliers to summarize each chunk (one escrow
|
||||
# per map + reduce call) → full-book summary. All knobs are optional; defaults
|
||||
# shown. Tune the caps to bound spend/abuse on mainnet.
|
||||
# Kill switch: "0" disables the feature entirely (every /v1/pdf-* route 503s):
|
||||
# PDF_ENABLED=1
|
||||
#
|
||||
# Hard caps (a job is refused if it would exceed these):
|
||||
# PDF_MAX_PAGES=400 # reject books larger than this
|
||||
|
||||
@@ -35,8 +35,6 @@ RUN apk add --no-cache python3 make g++
|
||||
RUN corepack enable && corepack prepare pnpm@10.33.2 --activate
|
||||
|
||||
COPY pnpm-workspace.yaml pnpm-lock.yaml package.json tsconfig.base.json .npmrc ./
|
||||
# pnpm-lock.yaml's patchedDependencies hash the patch files at install time.
|
||||
COPY patches ./patches
|
||||
COPY packages/shared/package.json ./packages/shared/package.json
|
||||
COPY buyer/package.json ./buyer/package.json
|
||||
COPY supplier/package.json ./supplier/package.json
|
||||
|
||||
@@ -25,7 +25,7 @@
|
||||
"better-sqlite3": "^11.9.1",
|
||||
"express": "^4.21.2",
|
||||
"gpt-tokenizer": "^2.8.1",
|
||||
"multer": "^1.4.5-lts.1",
|
||||
"multer": "^2.2.0",
|
||||
"pdf-parse": "^1.1.1",
|
||||
"react": "^18.3.1",
|
||||
"react-dom": "^18.3.1",
|
||||
@@ -42,10 +42,10 @@
|
||||
"@types/react": "^18.3.0",
|
||||
"@types/react-dom": "^18.3.0",
|
||||
"@vitejs/plugin-react": "^4.3.0",
|
||||
"happy-dom": "^15.7.4",
|
||||
"happy-dom": "^20.8.9",
|
||||
"supertest": "^7.0.0",
|
||||
"tailwindcss": "^3.4.0",
|
||||
"typescript": "^5.7.2",
|
||||
"vite": "^5.4.0"
|
||||
"vite": "^6.4.3"
|
||||
}
|
||||
}
|
||||
|
||||
@@ -41,13 +41,6 @@ interface OperatorSource {
|
||||
}
|
||||
|
||||
const OPERATOR_SOURCES: OperatorSource[] = [
|
||||
{
|
||||
label: "supplier-hf-llama33@vector-marketplace",
|
||||
host: "root@91.98.147.172",
|
||||
envPath: "/root/agents-marketplace/supplier/.env.hf-llama33",
|
||||
keyVar: "SUPPLIER_PRIV_KEY_HEX",
|
||||
role: "supplier",
|
||||
},
|
||||
{
|
||||
label: "buyer@vector-marketplace",
|
||||
host: "root@91.98.147.172",
|
||||
@@ -90,76 +83,6 @@ const OPERATOR_SOURCES: OperatorSource[] = [
|
||||
keyVar: "SUPPLIER_PRIV_KEY_HEX",
|
||||
role: "supplier",
|
||||
},
|
||||
{
|
||||
label: "supplier-kimi-2@vector-marketplace",
|
||||
host: "root@91.98.147.172",
|
||||
envPath: "/root/agents-marketplace/supplier/.env.kimi-2",
|
||||
keyVar: "SUPPLIER_PRIV_KEY_HEX",
|
||||
role: "supplier",
|
||||
},
|
||||
{
|
||||
label: "supplier-kimi-3@vector-marketplace",
|
||||
host: "root@91.98.147.172",
|
||||
envPath: "/root/agents-marketplace/supplier/.env.kimi-3",
|
||||
keyVar: "SUPPLIER_PRIV_KEY_HEX",
|
||||
role: "supplier",
|
||||
},
|
||||
{
|
||||
label: "supplier-kimi-4@vector-marketplace",
|
||||
host: "root@91.98.147.172",
|
||||
envPath: "/root/agents-marketplace/supplier/.env.kimi-4",
|
||||
keyVar: "SUPPLIER_PRIV_KEY_HEX",
|
||||
role: "supplier",
|
||||
},
|
||||
{
|
||||
label: "supplier-deepseek-flash-1@vector-marketplace",
|
||||
host: "root@91.98.147.172",
|
||||
envPath: "/root/agents-marketplace/supplier/.env.deepseek-flash-1",
|
||||
keyVar: "SUPPLIER_PRIV_KEY_HEX",
|
||||
role: "supplier",
|
||||
},
|
||||
{
|
||||
label: "supplier-deepseek-flash-2@vector-marketplace",
|
||||
host: "root@91.98.147.172",
|
||||
envPath: "/root/agents-marketplace/supplier/.env.deepseek-flash-2",
|
||||
keyVar: "SUPPLIER_PRIV_KEY_HEX",
|
||||
role: "supplier",
|
||||
},
|
||||
{
|
||||
label: "supplier-deepseek-flash-3@vector-marketplace",
|
||||
host: "root@91.98.147.172",
|
||||
envPath: "/root/agents-marketplace/supplier/.env.deepseek-flash-3",
|
||||
keyVar: "SUPPLIER_PRIV_KEY_HEX",
|
||||
role: "supplier",
|
||||
},
|
||||
{
|
||||
label: "supplier-qwen38@vector-marketplace",
|
||||
host: "root@91.98.147.172",
|
||||
envPath: "/root/agents-marketplace/supplier/.env.qwen38",
|
||||
keyVar: "SUPPLIER_PRIV_KEY_HEX",
|
||||
role: "supplier",
|
||||
},
|
||||
{
|
||||
label: "supplier-qwen38-chat@vector-marketplace",
|
||||
host: "root@91.98.147.172",
|
||||
envPath: "/root/agents-marketplace/supplier/.env.qwen38-chat",
|
||||
keyVar: "SUPPLIER_PRIV_KEY_HEX",
|
||||
role: "supplier",
|
||||
},
|
||||
{
|
||||
label: "supplier-local@inference-proxy",
|
||||
host: "inference-proxy",
|
||||
envPath: "/root/agents-marketplace/supplier/.env.local",
|
||||
keyVar: "SUPPLIER_PRIV_KEY_HEX",
|
||||
role: "supplier",
|
||||
},
|
||||
{
|
||||
label: "supplier-openclaw@inference-proxy",
|
||||
host: "inference-proxy",
|
||||
envPath: "/root/agents-marketplace/supplier/.env.openclaw",
|
||||
keyVar: "SUPPLIER_PRIV_KEY_HEX",
|
||||
role: "supplier",
|
||||
},
|
||||
{
|
||||
label: "buyer@open-webui",
|
||||
host: "open-webui",
|
||||
|
||||
@@ -36,19 +36,6 @@
|
||||
* Defaults to "./data/archive" relative to cwd.
|
||||
* When unset, archive is disabled (responses are
|
||||
* not persisted; /v1/responses* return 503).
|
||||
* GATEWAY_PUBLIC_URL — Public base URL of the OpenAI-compatible gateway
|
||||
* (e.g. https://api.marketplace.vector.apexfusion.org).
|
||||
* Injected into the SPA boot block so the "Generate
|
||||
* API key" page knows where to POST /signup. When
|
||||
* unset, the SPA falls back to deriving "api." +
|
||||
* current host.
|
||||
* SURPLUS_DASHBOARD_URL — Internal URL of the private Surplus dashboard
|
||||
* snapshot endpoint. When unset, /v1/resale-dashboard
|
||||
* responds 503 while the rest of the buyer stays live.
|
||||
* PDF_ENABLED — "1" (default) serves the PDF book summarizer
|
||||
* (/v1/pdf-* routes). Set "0" to disable the feature
|
||||
* entirely: no PDF job store is opened and every
|
||||
* /v1/pdf-* route responds 503.
|
||||
*/
|
||||
|
||||
const HEX64_RE = /^[0-9a-fA-F]{64}$/;
|
||||
@@ -69,9 +56,6 @@ export interface BuyerConfig {
|
||||
password: string;
|
||||
sessionSecret: string;
|
||||
cookieSecure: boolean;
|
||||
pdfEnabled: boolean;
|
||||
gatewayPublicUrl: string;
|
||||
resaleDashboardUrl: string;
|
||||
}
|
||||
|
||||
function requireField(env: Record<string, string | undefined>, name: string): string {
|
||||
@@ -157,37 +141,6 @@ export function loadConfig(env: Record<string, string | undefined>): BuyerConfig
|
||||
cookieSecure = cookieSecureStr === "1";
|
||||
}
|
||||
|
||||
// PDF_ENABLED: defaults to true. Set "0" to disable the PDF book summarizer
|
||||
// entirely — runMain skips the JobStore wiring and every /v1/pdf-* route
|
||||
// responds 503. Accept only "0" / "1" to keep boot-time misconfig loud.
|
||||
let pdfEnabled = true;
|
||||
const pdfEnabledStr = env.PDF_ENABLED;
|
||||
if (pdfEnabledStr !== undefined && pdfEnabledStr !== "") {
|
||||
if (pdfEnabledStr !== "0" && pdfEnabledStr !== "1") {
|
||||
throw new Error('loadConfig: PDF_ENABLED must be "0" or "1"');
|
||||
}
|
||||
pdfEnabled = pdfEnabledStr === "1";
|
||||
}
|
||||
|
||||
// GATEWAY_PUBLIC_URL — optional. Public base URL of the gateway, surfaced to
|
||||
// the SPA via the boot block (no trailing slash). Empty string means the SPA
|
||||
// derives the URL from its own host ("api." + location.host).
|
||||
const gatewayPublicUrl = (env.GATEWAY_PUBLIC_URL ?? "").trim().replace(/\/+$/, "");
|
||||
const resaleDashboardUrl = (env.SURPLUS_DASHBOARD_URL ?? "")
|
||||
.trim()
|
||||
.replace(/\/+$/, "");
|
||||
if (resaleDashboardUrl !== "") {
|
||||
let parsed: URL;
|
||||
try {
|
||||
parsed = new URL(resaleDashboardUrl);
|
||||
} catch {
|
||||
throw new Error("loadConfig: SURPLUS_DASHBOARD_URL must be a valid URL");
|
||||
}
|
||||
if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
|
||||
throw new Error("loadConfig: SURPLUS_DASHBOARD_URL must use http or https");
|
||||
}
|
||||
}
|
||||
|
||||
return {
|
||||
privKeyHex,
|
||||
indexerUrl,
|
||||
@@ -202,8 +155,5 @@ export function loadConfig(env: Record<string, string | undefined>): BuyerConfig
|
||||
password,
|
||||
sessionSecret,
|
||||
cookieSecure,
|
||||
pdfEnabled,
|
||||
gatewayPublicUrl,
|
||||
resaleDashboardUrl,
|
||||
};
|
||||
}
|
||||
|
||||
@@ -96,36 +96,29 @@ export async function runMain(env: Record<string, string | undefined>): Promise<
|
||||
|
||||
// PDF book summarizer: one job registry, sharing the live marketplace SDK,
|
||||
// chain, wallet, and (optional) archive. Caps come from PDF_* env vars.
|
||||
// PDF_ENABLED=0 skips the whole wiring; createApp then registers every
|
||||
// /v1/pdf-* route as a 503 stub (feature disabled).
|
||||
const pdfCaps = loadPdfCaps(env);
|
||||
let jobStore: JobStore | undefined;
|
||||
if (config.pdfEnabled) {
|
||||
// Durable job store (SQLite under ARCHIVE_DIR) so past summaries survive
|
||||
// restarts and navigation. Best-effort: if it can't open, jobs fall back to
|
||||
// in-memory only (lost on restart) but the feature still works.
|
||||
let pdfJobDb: PdfJobDb | undefined;
|
||||
try {
|
||||
pdfJobDb = new PdfJobDb(config.archiveDir);
|
||||
console.log(`[buyer] pdf job store at ${config.archiveDir}/pdf-jobs.db`);
|
||||
} catch (err) {
|
||||
console.error(
|
||||
`[buyer] failed to open pdf job store at ${config.archiveDir}:`,
|
||||
err instanceof Error ? err.message : String(err),
|
||||
);
|
||||
}
|
||||
jobStore = new JobStore({
|
||||
marketplace,
|
||||
chain,
|
||||
walletKey,
|
||||
indexerUrl: config.indexerUrl,
|
||||
archive,
|
||||
caps: pdfCaps,
|
||||
db: pdfJobDb,
|
||||
});
|
||||
} else {
|
||||
console.log("[buyer] pdf summarizer disabled (PDF_ENABLED=0)");
|
||||
// Durable job store (SQLite under ARCHIVE_DIR) so past summaries survive
|
||||
// restarts and navigation. Best-effort: if it can't open, jobs fall back to
|
||||
// in-memory only (lost on restart) but the feature still works.
|
||||
let pdfJobDb: PdfJobDb | undefined;
|
||||
try {
|
||||
pdfJobDb = new PdfJobDb(config.archiveDir);
|
||||
console.log(`[buyer] pdf job store at ${config.archiveDir}/pdf-jobs.db`);
|
||||
} catch (err) {
|
||||
console.error(
|
||||
`[buyer] failed to open pdf job store at ${config.archiveDir}:`,
|
||||
err instanceof Error ? err.message : String(err),
|
||||
);
|
||||
}
|
||||
const jobStore = new JobStore({
|
||||
marketplace,
|
||||
chain,
|
||||
walletKey,
|
||||
indexerUrl: config.indexerUrl,
|
||||
archive,
|
||||
caps: pdfCaps,
|
||||
db: pdfJobDb,
|
||||
});
|
||||
|
||||
const app = createApp({
|
||||
distPath,
|
||||
@@ -140,8 +133,6 @@ export async function runMain(env: Record<string, string | undefined>): Promise<
|
||||
password: config.password,
|
||||
sessionSecret: config.sessionSecret,
|
||||
cookieSecure: config.cookieSecure,
|
||||
gatewayPublicUrl: config.gatewayPublicUrl,
|
||||
resaleDashboardUrl: config.resaleDashboardUrl,
|
||||
jobStore,
|
||||
pdfCaps,
|
||||
});
|
||||
|
||||
@@ -40,7 +40,7 @@ export function registerPdfRoutes(
|
||||
res,
|
||||
503,
|
||||
"service_unavailable",
|
||||
"PDF summarizer disabled",
|
||||
"PDF summarizer disabled (buyer booted without chain/marketplace/archive deps)",
|
||||
);
|
||||
app.post("/v1/pdf-upload", disabled);
|
||||
app.all(/^\/v1\/pdf-jobs(\/.*)?$/, disabled);
|
||||
|
||||
@@ -73,15 +73,11 @@ import {
|
||||
buildPostEscrowTx,
|
||||
buildPostTtsEscrowTx,
|
||||
buildPostChatEscrowTx,
|
||||
buildPostOcrEscrowTx,
|
||||
ttsPromptHash,
|
||||
chatSessionPromptHash,
|
||||
ocrPromptHash,
|
||||
buildAcceptTx,
|
||||
buildReclaimTx,
|
||||
TxConstructionError,
|
||||
chatInputTokenUpperBound,
|
||||
BOUNDED_INPUT_DETAIL_MARKER,
|
||||
} from "@marketplace/shared/tx";
|
||||
import { decodeAdvertDatum, decodeEscrowDatum, canonicalize } from "@marketplace/shared/cbor";
|
||||
import type { AdvertDatum } from "@marketplace/shared/cbor";
|
||||
@@ -90,14 +86,10 @@ import type {
|
||||
DiscoverSuppliersOptions,
|
||||
SubmitPromptOptions,
|
||||
SubmitPromptResult,
|
||||
SupplierCapabilityView,
|
||||
SubmitTtsOptions,
|
||||
SubmitTtsResult,
|
||||
SubmitOcrOptions,
|
||||
SubmitOcrResult,
|
||||
StartChatOptions,
|
||||
StartChatResult,
|
||||
ChatSettleMode,
|
||||
EndChatOptions,
|
||||
EndChatResult,
|
||||
AcceptResultOptions,
|
||||
@@ -113,50 +105,6 @@ import { MemoryTaskHistoryStore } from "./history.js";
|
||||
import { HttpClient, HttpError } from "./httpClient.js";
|
||||
|
||||
const ZERO_SIGNATURE = "0".repeat(128);
|
||||
|
||||
function validateSupplierCapability(
|
||||
body: unknown,
|
||||
advert: AdvertDatum,
|
||||
advertRef: OutputReference,
|
||||
): SupplierCapabilityView {
|
||||
if (typeof body !== "object" || body === null || Array.isArray(body)) {
|
||||
throw new TxConstructionError(
|
||||
"supplier_preflight_failed",
|
||||
"supplier /capability response must be an object",
|
||||
);
|
||||
}
|
||||
const capability = body as Record<string, unknown>;
|
||||
const expectedRef = `${advertRef.txHash}#${advertRef.index}`;
|
||||
if (
|
||||
capability.advert_ref !== expectedRef ||
|
||||
capability.capability_id !== advert.capability_id ||
|
||||
capability.model !== advert.model ||
|
||||
capability.max_output_tokens !== advert.max_output_tokens ||
|
||||
capability.max_processing_ms !== advert.max_processing_ms ||
|
||||
capability.price_lovelace !== advert.price_lovelace.toString() ||
|
||||
capability.supplier_pkh !== advert.supplier_pkh ||
|
||||
typeof capability.pub_key_hex !== "string"
|
||||
) {
|
||||
throw new TxConstructionError(
|
||||
"supplier_preflight_failed",
|
||||
"supplier /capability response does not match the on-chain advert",
|
||||
);
|
||||
}
|
||||
if (
|
||||
capability.max_input_tokens !== undefined &&
|
||||
(
|
||||
typeof capability.max_input_tokens !== "number" ||
|
||||
!Number.isSafeInteger(capability.max_input_tokens) ||
|
||||
capability.max_input_tokens <= 0
|
||||
)
|
||||
) {
|
||||
throw new TxConstructionError(
|
||||
"supplier_preflight_failed",
|
||||
"supplier max_input_tokens must be a positive safe integer",
|
||||
);
|
||||
}
|
||||
return capability as unknown as SupplierCapabilityView;
|
||||
}
|
||||
const HEX64_RE = /^[0-9a-fA-F]{64}$/;
|
||||
const SIG_RE = /^[0-9a-fA-F]{128}$/;
|
||||
|
||||
@@ -288,23 +236,16 @@ export class Marketplace extends EventEmitterBase {
|
||||
}
|
||||
return result.body as SupplierView[];
|
||||
}
|
||||
|
||||
// ─── submitPrompt — happy path + every adversarial branch ──────────────
|
||||
|
||||
async submitPrompt(opts: SubmitPromptOptions): Promise<SubmitPromptResult> {
|
||||
const {
|
||||
advertRef,
|
||||
messages,
|
||||
payment_lovelace,
|
||||
max_output_tokens,
|
||||
public_preview,
|
||||
} = opts;
|
||||
const { advertRef, messages, payment_lovelace, max_output_tokens } = opts;
|
||||
|
||||
let supplierHttp: HttpClient | null = null;
|
||||
let advertDatum: AdvertDatum | null = null;
|
||||
let escrowOutputRef: OutputReference | null = null;
|
||||
let escrowRefStr = "";
|
||||
let postedAtMs = Date.now();
|
||||
let deliverByMs = 0;
|
||||
|
||||
const recordFailure = (reason: string): void => {
|
||||
this.historyStore.save({
|
||||
@@ -333,46 +274,6 @@ export class Marketplace extends EventEmitterBase {
|
||||
}
|
||||
}
|
||||
|
||||
if (advertDatum) {
|
||||
supplierHttp = new HttpClient({
|
||||
baseUrl: advertDatum.endpoint_url,
|
||||
fetch: this.fetchImpl,
|
||||
});
|
||||
if (advertDatum.detail_uri.endsWith(BOUNDED_INPUT_DETAIL_MARKER)) {
|
||||
let capabilityResult;
|
||||
try {
|
||||
capabilityResult = await supplierHttp.getJson("/capability");
|
||||
} catch (error) {
|
||||
const message = error instanceof Error ? error.message : String(error);
|
||||
throw new TxConstructionError("supplier_preflight_failed", message);
|
||||
}
|
||||
if (!capabilityResult.ok || capabilityResult.parseError) {
|
||||
throw new TxConstructionError(
|
||||
"supplier_preflight_failed",
|
||||
`supplier /capability returned HTTP ${capabilityResult.status}`,
|
||||
);
|
||||
}
|
||||
const capability = validateSupplierCapability(
|
||||
capabilityResult.body,
|
||||
advertDatum,
|
||||
advertRef,
|
||||
);
|
||||
if (capability.max_input_tokens === undefined) {
|
||||
throw new TxConstructionError(
|
||||
"supplier_preflight_failed",
|
||||
"bounded-input supplier omitted max_input_tokens",
|
||||
);
|
||||
}
|
||||
const inputUnits = chatInputTokenUpperBound(messages);
|
||||
if (inputUnits > capability.max_input_tokens) {
|
||||
throw new TxConstructionError(
|
||||
"input_cap_exceeded",
|
||||
`input bound ${inputUnits} exceeds supplier cap ${capability.max_input_tokens}`,
|
||||
);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
escrowResult = await buildPostEscrowTx({
|
||||
chain: this.chain,
|
||||
buyerKey: this.walletKey,
|
||||
@@ -415,33 +316,24 @@ export class Marketplace extends EventEmitterBase {
|
||||
if (escrowUtxo && escrowUtxo.datumHex) {
|
||||
const ed = decodeEscrowDatum(escrowUtxo.datumHex);
|
||||
postedAtMs = ed.posted_at;
|
||||
deliverByMs = ed.deliver_by;
|
||||
}
|
||||
} catch {
|
||||
/* posted_at is best-effort metadata */
|
||||
}
|
||||
|
||||
if (!advertDatum) {
|
||||
// Should never happen — buildPostEscrowTx rejects missing or bad adverts.
|
||||
// Should never happen — buildPostEscrowTx throws before this on missing/bad advert.
|
||||
const reason = "advert datum unavailable after escrow post";
|
||||
recordFailure(reason);
|
||||
throw new ReceiptVerificationError(reason);
|
||||
}
|
||||
if (!supplierHttp) {
|
||||
const reason = "supplier client unavailable after escrow post";
|
||||
recordFailure(reason);
|
||||
throw new ReceiptVerificationError(reason);
|
||||
}
|
||||
if (deliverByMs === 0) {
|
||||
deliverByMs =
|
||||
postedAtMs + advertDatum.max_processing_ms + 30_000;
|
||||
}
|
||||
const supplierCallTimeoutMs = Math.max(
|
||||
30_000,
|
||||
deliverByMs - Date.now() + 90_000,
|
||||
);
|
||||
|
||||
// ── 4. Call supplier /v1/chat/completions ─────────────────────────
|
||||
const supplierBaseUrl = advertDatum.endpoint_url;
|
||||
const supplierHttp = new HttpClient({
|
||||
baseUrl: supplierBaseUrl,
|
||||
fetch: this.fetchImpl,
|
||||
});
|
||||
|
||||
const requestedMax = max_output_tokens ?? advertDatum.max_output_tokens;
|
||||
const cappedMax = Math.min(requestedMax, advertDatum.max_output_tokens);
|
||||
@@ -450,14 +342,11 @@ export class Marketplace extends EventEmitterBase {
|
||||
messages,
|
||||
max_tokens: cappedMax,
|
||||
};
|
||||
|
||||
let chatResult;
|
||||
try {
|
||||
chatResult = await supplierHttp.postJson("/v1/chat/completions", chatBody, {
|
||||
headers: {
|
||||
"X-Escrow-Ref": escrowRefStr,
|
||||
...(public_preview ? { "X-Vector-Public-Preview": "1" } : {}),
|
||||
},
|
||||
timeoutMs: supplierCallTimeoutMs,
|
||||
headers: { "X-Escrow-Ref": escrowRefStr },
|
||||
});
|
||||
} catch (err) {
|
||||
if (err instanceof HttpError) {
|
||||
@@ -491,11 +380,8 @@ export class Marketplace extends EventEmitterBase {
|
||||
throw sErr;
|
||||
}
|
||||
const POLL_INTERVAL_MS = 2_000;
|
||||
const pollBudgetMs = Math.max(
|
||||
30_000,
|
||||
deliverByMs + 90_000 - Date.now(),
|
||||
);
|
||||
const pollDeadline = Date.now() + pollBudgetMs;
|
||||
const POLL_TIMEOUT_MS = 180_000;
|
||||
const pollDeadline = Date.now() + POLL_TIMEOUT_MS;
|
||||
let polled = chatResult;
|
||||
// First poll runs immediately so a quickly-completed job doesn't pay
|
||||
// the leading delay; subsequent polls wait POLL_INTERVAL_MS.
|
||||
@@ -532,7 +418,7 @@ export class Marketplace extends EventEmitterBase {
|
||||
if (polled.status !== 200) {
|
||||
const sErr = new SupplierError("timeout", {
|
||||
status: polled.status,
|
||||
message: `supplier job ${jobId} not done within ${pollBudgetMs}ms`,
|
||||
message: `supplier job ${jobId} not done within ${POLL_TIMEOUT_MS}ms`,
|
||||
});
|
||||
recordFailure("timeout");
|
||||
throw sErr;
|
||||
@@ -920,278 +806,6 @@ export class Marketplace extends EventEmitterBase {
|
||||
};
|
||||
}
|
||||
|
||||
// ─── submitOcr — full lifecycle for ocr.page.extract.<model-slug>.v1 ──
|
||||
|
||||
async submitOcr(opts: SubmitOcrOptions): Promise<SubmitOcrResult> {
|
||||
const { advertRef, image_b64, mime, output_format, payment_lovelace } = opts;
|
||||
const request = { image_b64, mime, output_format };
|
||||
|
||||
let advertDatum: AdvertDatum | null = null;
|
||||
let escrowOutputRef: OutputReference | null = null;
|
||||
let escrowRefStr = "";
|
||||
let postedAtMs = Date.now();
|
||||
|
||||
const previewStr = `[ocr:${mime} ${output_format} ${image_b64.length}b64]`;
|
||||
const recordFailure = (reason: string): void => {
|
||||
this.historyStore.save({
|
||||
escrow_ref: escrowRefStr || `${"0".repeat(64)}#0`,
|
||||
supplier_pkh: advertDatum?.supplier_pkh ?? "",
|
||||
capability_id: advertDatum?.capability_id ?? "",
|
||||
prompt_preview: previewStr,
|
||||
posted_at: postedAtMs,
|
||||
status: "failed",
|
||||
failure_reason: reason,
|
||||
});
|
||||
};
|
||||
|
||||
// ── 1. Resolve advert + post escrow (OCR prompt_hash) ─────────────
|
||||
let escrowResult;
|
||||
try {
|
||||
const utxo = await this.chain.queryUtxo(advertRef);
|
||||
if (utxo && utxo.datumHex) {
|
||||
try {
|
||||
advertDatum = decodeAdvertDatum(utxo.datumHex);
|
||||
} catch { /* builder will re-throw structurally */ }
|
||||
}
|
||||
escrowResult = await buildPostOcrEscrowTx({
|
||||
chain: this.chain,
|
||||
buyerKey: this.walletKey,
|
||||
advertRef,
|
||||
request,
|
||||
payment_lovelace,
|
||||
});
|
||||
} catch (err) {
|
||||
if (err instanceof TxConstructionError) {
|
||||
recordFailure(err.reason);
|
||||
throw err;
|
||||
}
|
||||
this.emitProgress({ type: "chain_submit_failed", detail: (err as Error).message });
|
||||
recordFailure((err as Error).message);
|
||||
throw err;
|
||||
}
|
||||
|
||||
escrowOutputRef = escrowResult.escrowOutputRef;
|
||||
escrowRefStr = refToString(escrowOutputRef);
|
||||
|
||||
this.emitProgress({ type: "escrow_posted", escrow_ref: escrowRefStr });
|
||||
|
||||
// ── 2. Wait for the escrow tx to confirm ──────────────────────────
|
||||
try {
|
||||
await this.chain.awaitTx(escrowResult.expectedTxHash, 120_000);
|
||||
} catch { /* mock providers / tests */ }
|
||||
|
||||
// ── 3. Re-fetch escrow datum to capture posted_at ─────────────────
|
||||
try {
|
||||
const escrowUtxo = await this.chain.queryUtxo(escrowOutputRef);
|
||||
if (escrowUtxo && escrowUtxo.datumHex) {
|
||||
const ed = decodeEscrowDatum(escrowUtxo.datumHex);
|
||||
postedAtMs = ed.posted_at;
|
||||
}
|
||||
} catch { /* metadata best-effort */ }
|
||||
|
||||
if (!advertDatum) {
|
||||
const reason = "advert datum unavailable after escrow post";
|
||||
recordFailure(reason);
|
||||
throw new ReceiptVerificationError(reason);
|
||||
}
|
||||
|
||||
// ── 4. Call supplier /v1/ocr/extract ──────────────────────────────
|
||||
const supplierBaseUrl = advertDatum.endpoint_url;
|
||||
const supplierHttp = new HttpClient({
|
||||
baseUrl: supplierBaseUrl,
|
||||
fetch: this.fetchImpl,
|
||||
});
|
||||
const ocrBody = { image_b64, mime, output_format };
|
||||
|
||||
let ocrResult;
|
||||
try {
|
||||
ocrResult = await supplierHttp.postJson("/v1/ocr/extract", ocrBody, {
|
||||
headers: { "X-Escrow-Ref": escrowRefStr },
|
||||
});
|
||||
} catch (err) {
|
||||
if (err instanceof HttpError) {
|
||||
const reason = err.kind === "timeout" ? "timeout" : "network_error";
|
||||
const sErr = new SupplierError(reason, { message: err.message });
|
||||
recordFailure(reason);
|
||||
throw sErr;
|
||||
}
|
||||
recordFailure((err as Error).message);
|
||||
throw err;
|
||||
}
|
||||
|
||||
// 202 + poll mirror of submitTts's async handling. OCR inference for a
|
||||
// page runs seconds; the long tail is the Submit tx confirmation.
|
||||
if (ocrResult.status === 202 && ocrResult.body && typeof ocrResult.body === "object") {
|
||||
const jobId = (ocrResult.body as { job_id?: string }).job_id;
|
||||
if (typeof jobId !== "string" || jobId.length === 0) {
|
||||
const sErr = new SupplierError("malformed_response", {
|
||||
status: ocrResult.status,
|
||||
message: "supplier 202 response missing job_id",
|
||||
});
|
||||
recordFailure("malformed_response");
|
||||
throw sErr;
|
||||
}
|
||||
const POLL_INTERVAL_MS = 2_000;
|
||||
const POLL_TIMEOUT_MS = 180_000;
|
||||
const pollDeadline = Date.now() + POLL_TIMEOUT_MS;
|
||||
let polled = ocrResult;
|
||||
let firstIter = true;
|
||||
while (Date.now() < pollDeadline) {
|
||||
if (!firstIter) {
|
||||
await new Promise<void>((r) => setTimeout(r, POLL_INTERVAL_MS));
|
||||
}
|
||||
firstIter = false;
|
||||
try {
|
||||
polled = await supplierHttp.getJson(`/v1/ocr/extract/${jobId}`);
|
||||
} catch (err) {
|
||||
if (err instanceof HttpError) {
|
||||
const reason = err.kind === "timeout" ? "timeout" : "network_error";
|
||||
const sErr = new SupplierError(reason, { message: err.message });
|
||||
recordFailure(reason);
|
||||
throw sErr;
|
||||
}
|
||||
throw err;
|
||||
}
|
||||
if (polled.status === 200) break;
|
||||
if (polled.status === 202) continue;
|
||||
const failBody = (polled.body && typeof polled.body === "object")
|
||||
? polled.body as { reason?: string; message?: string }
|
||||
: {};
|
||||
const sErr = new SupplierError(failBody.reason ?? "supplier_http_error", {
|
||||
status: polled.status,
|
||||
message: failBody.message ?? `supplier returned ${polled.status}`,
|
||||
});
|
||||
recordFailure(sErr.reason);
|
||||
throw sErr;
|
||||
}
|
||||
if (polled.status !== 200) {
|
||||
const sErr = new SupplierError("timeout", {
|
||||
status: polled.status,
|
||||
message: `supplier job ${jobId} not done within ${POLL_TIMEOUT_MS}ms`,
|
||||
});
|
||||
recordFailure("timeout");
|
||||
throw sErr;
|
||||
}
|
||||
ocrResult = polled;
|
||||
}
|
||||
|
||||
if (!ocrResult.ok) {
|
||||
const bodyReason =
|
||||
ocrResult.body && typeof ocrResult.body === "object"
|
||||
? ((ocrResult.body as { reason?: string }).reason ?? "supplier_http_error")
|
||||
: "supplier_http_error";
|
||||
const sErr = new SupplierError(bodyReason, {
|
||||
status: ocrResult.status,
|
||||
message: `supplier returned ${ocrResult.status}`,
|
||||
});
|
||||
recordFailure(bodyReason);
|
||||
throw sErr;
|
||||
}
|
||||
if (ocrResult.parseError || !ocrResult.body || typeof ocrResult.body !== "object") {
|
||||
const sErr = new SupplierError("malformed_response", {
|
||||
status: ocrResult.status,
|
||||
message: "supplier body is not valid JSON",
|
||||
});
|
||||
recordFailure("malformed_response");
|
||||
throw sErr;
|
||||
}
|
||||
|
||||
const responseBody = ocrResult.body as {
|
||||
output_format?: string;
|
||||
content?: string;
|
||||
usage?: { prompt_tokens?: number; completion_tokens?: number; total_tokens?: number };
|
||||
receipt?: import("@marketplace/shared/receipt").Receipt;
|
||||
receipt_signature?: string;
|
||||
};
|
||||
if (!responseBody.content || !responseBody.receipt || !responseBody.receipt_signature) {
|
||||
const sErr = new SupplierError("malformed_response", {
|
||||
status: ocrResult.status,
|
||||
message: "supplier response is missing content / receipt / receipt_signature",
|
||||
});
|
||||
recordFailure("malformed_response");
|
||||
throw sErr;
|
||||
}
|
||||
const receipt = responseBody.receipt;
|
||||
const receiptSignature = responseBody.receipt_signature;
|
||||
|
||||
this.emitProgress({ type: "supplier_called", escrow_ref: escrowRefStr });
|
||||
|
||||
// ── 5. Receipt verification ───────────────────────────────────────
|
||||
if (receipt.supplier_pkh !== advertDatum.supplier_pkh) {
|
||||
recordFailure("wrong_supplier");
|
||||
throw new ReceiptVerificationError("wrong_supplier");
|
||||
}
|
||||
if (receipt.escrow_ref !== escrowRefStr) {
|
||||
recordFailure("wrong_escrow_ref");
|
||||
throw new ReceiptVerificationError("wrong_escrow_ref");
|
||||
}
|
||||
// The OCR prompt commitment uses the SAME canonical hash the supplier
|
||||
// validated against the escrow datum. Recompute from the envelope we
|
||||
// sent; a mismatch means the supplier signed a different request.
|
||||
const expectedPromptHash = ocrPromptHash(request);
|
||||
if (receipt.prompt_hash !== expectedPromptHash) {
|
||||
recordFailure("prompt_hash_mismatch");
|
||||
throw new ReceiptVerificationError("prompt_hash_mismatch");
|
||||
}
|
||||
if (receipt.model !== advertDatum.model) {
|
||||
recordFailure("request_spec_hash_mismatch");
|
||||
throw new ReceiptVerificationError("request_spec_hash_mismatch");
|
||||
}
|
||||
// The receipt's response_hash must commit the content we actually
|
||||
// received in the requested output shape.
|
||||
const expectedResponseHash = nodeCrypto.createHash("sha256")
|
||||
.update(canonicalize({
|
||||
content: responseBody.content,
|
||||
output_format: responseBody.output_format ?? output_format,
|
||||
}), "utf8")
|
||||
.digest("hex");
|
||||
if (receipt.response_hash !== expectedResponseHash) {
|
||||
recordFailure("response_hash_mismatch");
|
||||
throw new ReceiptVerificationError("response_hash_mismatch");
|
||||
}
|
||||
if (typeof receiptSignature !== "string" || !SIG_RE.test(receiptSignature)) {
|
||||
recordFailure("invalid_signature");
|
||||
throw new ReceiptVerificationError("invalid_signature");
|
||||
}
|
||||
if (receiptSignature === ZERO_SIGNATURE) {
|
||||
recordFailure("invalid_signature");
|
||||
throw new ReceiptVerificationError("invalid_signature");
|
||||
}
|
||||
if (!HEX64_RE.test(receipt.prompt_hash) || !HEX64_RE.test(receipt.response_hash)) {
|
||||
recordFailure("malformed_receipt");
|
||||
throw new ReceiptVerificationError("malformed_receipt");
|
||||
}
|
||||
|
||||
this.emitProgress({ type: "receipt_verified", escrow_ref: escrowRefStr });
|
||||
|
||||
this.historyStore.save({
|
||||
escrow_ref: escrowRefStr,
|
||||
supplier_pkh: advertDatum.supplier_pkh,
|
||||
capability_id: advertDatum.capability_id,
|
||||
prompt_preview: previewStr,
|
||||
posted_at: postedAtMs,
|
||||
status: "completed",
|
||||
response: responseBody.content.length <= 200
|
||||
? responseBody.content
|
||||
: responseBody.content.slice(0, 200),
|
||||
receipt,
|
||||
receipt_signature: receiptSignature,
|
||||
});
|
||||
|
||||
return {
|
||||
output_format: responseBody.output_format ?? output_format,
|
||||
content: responseBody.content,
|
||||
usage: {
|
||||
prompt_tokens: responseBody.usage?.prompt_tokens ?? 0,
|
||||
completion_tokens: responseBody.usage?.completion_tokens ?? 0,
|
||||
total_tokens: responseBody.usage?.total_tokens ?? 0,
|
||||
},
|
||||
receipt,
|
||||
receiptSignature,
|
||||
escrowRef: escrowOutputRef,
|
||||
};
|
||||
}
|
||||
|
||||
// ─── startChat / endChat — multi-turn llm.chat.v1 lifecycle ────────────
|
||||
|
||||
/**
|
||||
@@ -1285,13 +899,7 @@ export class Marketplace extends EventEmitterBase {
|
||||
}
|
||||
|
||||
this.emitProgress({ type: "chat_started", escrow_ref: escrowRefStr });
|
||||
// Ticket-mode suppliers answer {status:"ticket"} (no Claim); anything else
|
||||
// — "claimed" or an older supplier without the field — is full settlement.
|
||||
const startStatus = startRes.body && typeof startRes.body === "object"
|
||||
? (startRes.body as { status?: string }).status
|
||||
: undefined;
|
||||
const settleMode: ChatSettleMode = startStatus === "ticket" ? "ticket" : "full";
|
||||
return { escrowRef: escrowOutputRef, sessionNonce, supplierBaseUrl: advertDatum.endpoint_url, settleMode };
|
||||
return { escrowRef: escrowOutputRef, sessionNonce, supplierBaseUrl: advertDatum.endpoint_url };
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -1329,20 +937,10 @@ export class Marketplace extends EventEmitterBase {
|
||||
});
|
||||
}
|
||||
const endBody = endRes.body as {
|
||||
status?: string;
|
||||
settle_mode?: string;
|
||||
receipt?: import("@marketplace/shared/receipt").Receipt;
|
||||
receipt_signature?: string;
|
||||
submitted_ref?: string;
|
||||
};
|
||||
// Ticket sessions produce no receipt and nothing to Accept — the Open
|
||||
// escrow returns via reclaim after deliver_by. Trusting the supplier's
|
||||
// response is incentive-safe: lying in either direction only forfeits the
|
||||
// supplier's own payout (the buyer's sweeper reclaims unsettled escrows).
|
||||
if (endBody.settle_mode === "ticket") {
|
||||
this.emitProgress({ type: "chat_ended", escrow_ref: escrowRefStr });
|
||||
return { settleMode: "ticket", escrowRef };
|
||||
}
|
||||
if (!endBody.receipt || !endBody.receipt_signature) {
|
||||
throw new SupplierError("malformed_response", { message: "supplier end response missing receipt" });
|
||||
}
|
||||
@@ -1424,7 +1022,7 @@ export class Marketplace extends EventEmitterBase {
|
||||
this.emitProgress({ type: "accept_submitted", escrow_ref: refToString(acceptedRef) });
|
||||
this.emitProgress({ type: "chat_ended", escrow_ref: escrowRefStr });
|
||||
|
||||
return { settleMode: "full", receipt, receiptSignature, escrowRef, acceptedRef };
|
||||
return { receipt, receiptSignature, escrowRef, acceptedRef };
|
||||
}
|
||||
|
||||
// ─── acceptResult / reclaim ───────────────────────────────────────────
|
||||
|
||||
@@ -16,9 +16,6 @@ export type {
|
||||
AcceptResultOptions,
|
||||
ReclaimOptions,
|
||||
GetTaskHistoryOptions,
|
||||
ChatSettleMode,
|
||||
StartChatResult,
|
||||
EndChatResult,
|
||||
} from "./types.js";
|
||||
export { ReceiptVerificationError, IndexerError, SupplierError } from "./types.js";
|
||||
export type { TaskHistoryStore } from "./history.js";
|
||||
|
||||
@@ -138,19 +138,6 @@ export interface SupplierView {
|
||||
created_slot: number;
|
||||
}
|
||||
|
||||
/** Live off-chain capability metadata published by a supplier endpoint. */
|
||||
export interface SupplierCapabilityView {
|
||||
capability_id: string;
|
||||
model: string;
|
||||
max_output_tokens: number;
|
||||
max_processing_ms: number;
|
||||
price_lovelace: string;
|
||||
advert_ref: string;
|
||||
supplier_pkh: string;
|
||||
pub_key_hex: string;
|
||||
max_input_tokens?: number;
|
||||
}
|
||||
|
||||
/**
|
||||
* DiscoverSuppliersOptions — optional filters for discoverSuppliers().
|
||||
*/
|
||||
@@ -167,8 +154,6 @@ export interface SubmitPromptOptions {
|
||||
messages: import("@marketplace/shared/tx").ChatMessage[];
|
||||
payment_lovelace: bigint;
|
||||
max_output_tokens?: number;
|
||||
/** Explicit consent for the seller's public redacted demo preview. */
|
||||
public_preview?: boolean;
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -202,35 +187,6 @@ export interface SubmitTtsResult {
|
||||
escrowRef: OutputReference;
|
||||
}
|
||||
|
||||
/**
|
||||
* SubmitOcrOptions — arguments to Marketplace.submitOcr() for model-scoped
|
||||
* `ocr.page.extract.<model-slug>.v1` capabilities. The same `{image_b64,
|
||||
* mime, output_format}` envelope is hashed (sha256 ∘ canonical) into the
|
||||
* escrow datum's `prompt_hash` AND posted to the supplier's /v1/ocr/extract
|
||||
* body, so the supplier can verify the request matches the on-chain commit.
|
||||
*/
|
||||
export interface SubmitOcrOptions {
|
||||
advertRef: OutputReference;
|
||||
image_b64: string; // plain base64, no data: prefix
|
||||
mime: string; // image/png | image/jpeg | image/webp
|
||||
output_format: string; // markdown | html | json
|
||||
payment_lovelace: bigint;
|
||||
}
|
||||
|
||||
/**
|
||||
* SubmitOcrResult — returned from Marketplace.submitOcr() on success.
|
||||
* `content` is the extraction in the requested output_format; the receipt's
|
||||
* response_hash commits sha256(canonical({content, output_format})).
|
||||
*/
|
||||
export interface SubmitOcrResult {
|
||||
output_format: string;
|
||||
content: string;
|
||||
usage: { prompt_tokens: number; completion_tokens: number; total_tokens: number };
|
||||
receipt: Receipt;
|
||||
receiptSignature: string;
|
||||
escrowRef: OutputReference;
|
||||
}
|
||||
|
||||
/**
|
||||
* StartChatOptions / StartChatResult — Marketplace.startChat() for the
|
||||
* `llm.chat.v1` capability. Opens the escrow (session-init prompt_hash) and
|
||||
@@ -241,11 +197,6 @@ export interface StartChatOptions {
|
||||
advertRef: OutputReference;
|
||||
payment_lovelace: bigint;
|
||||
}
|
||||
/** Chain settlement mode a chat session runs under (reported by the supplier
|
||||
* at /v1/chat/start): "full" = Claim/Submit/Accept lifecycle; "ticket" = the
|
||||
* buyer's escrow post is the only chain op (reclaimed after deliver_by). */
|
||||
export type ChatSettleMode = "full" | "ticket";
|
||||
|
||||
export interface StartChatResult {
|
||||
escrowRef: OutputReference;
|
||||
/** Random nonce committed into the escrow's session-init prompt_hash. The
|
||||
@@ -253,8 +204,6 @@ export interface StartChatResult {
|
||||
sessionNonce: string;
|
||||
/** Supplier endpoint_url, cached by the buyer-app for message routing. */
|
||||
supplierBaseUrl: string;
|
||||
/** How the supplier settles this session ("full" when it Claimed). */
|
||||
settleMode: ChatSettleMode;
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -271,21 +220,13 @@ export interface EndChatOptions {
|
||||
/** The browser's local transcript mirror, used to verify response_hash. */
|
||||
transcript?: import("@marketplace/shared/tx").ChatMessage[];
|
||||
}
|
||||
export type EndChatResult =
|
||||
| {
|
||||
settleMode: "full";
|
||||
receipt: Receipt;
|
||||
receiptSignature: string;
|
||||
escrowRef: OutputReference;
|
||||
/** The Submitted escrow UTxO that was Accepted. */
|
||||
acceptedRef: OutputReference;
|
||||
}
|
||||
| {
|
||||
/** Ticket session: nothing was Submitted/Accepted — no receipt exists.
|
||||
* The Open escrow returns to the buyer via reclaim after deliver_by. */
|
||||
settleMode: "ticket";
|
||||
escrowRef: OutputReference;
|
||||
};
|
||||
export interface EndChatResult {
|
||||
receipt: Receipt;
|
||||
receiptSignature: string;
|
||||
escrowRef: OutputReference;
|
||||
/** The Submitted escrow UTxO that was Accepted. */
|
||||
acceptedRef: OutputReference;
|
||||
}
|
||||
|
||||
/**
|
||||
* AcceptResultOptions — arguments to Marketplace.acceptResult().
|
||||
|
||||
@@ -109,14 +109,6 @@ export interface AppDeps {
|
||||
* brute-force rate-limit window. Defaults to Date.now. Tests use a fake
|
||||
* clock to drive expiry and rolling-renewal assertions deterministically. */
|
||||
nowMs?: () => number;
|
||||
/** Public base URL of the OpenAI-compatible gateway, injected into the SPA
|
||||
* boot block so the "Generate API key" page can POST cross-origin to
|
||||
* `${gatewayUrl}/signup`. Public, non-secret value. When empty/omitted the
|
||||
* SPA derives "api." + its own host. */
|
||||
gatewayPublicUrl?: string;
|
||||
/** Private supplier-network endpoint used to populate the resale dashboard.
|
||||
* The browser only sees the redacted same-origin /v1/resale-dashboard proxy. */
|
||||
resaleDashboardUrl?: string;
|
||||
/** PDF book summarizer job registry. When provided, the /v1/pdf-* routes
|
||||
* are live; when omitted they respond 503 (feature disabled). Built in
|
||||
* runMain from the same marketplace/chain/wallet/archive deps. */
|
||||
@@ -320,66 +312,6 @@ export function createApp(deps: AppDeps): Express {
|
||||
}
|
||||
: null;
|
||||
|
||||
app.get("/v1/resale-dashboard", async (_req: Request, res: Response) => {
|
||||
const dashboardUrl = (deps.resaleDashboardUrl ?? "").replace(/\/+$/, "");
|
||||
if (dashboardUrl === "") {
|
||||
return jsonError(
|
||||
res,
|
||||
503,
|
||||
"service_unavailable",
|
||||
"buyer-app booted without SURPLUS_DASHBOARD_URL",
|
||||
);
|
||||
}
|
||||
const controller = new AbortController();
|
||||
const timer = setTimeout(() => controller.abort(), 10_000);
|
||||
try {
|
||||
const upstream = await (deps.fetchImpl ?? globalThis.fetch)(dashboardUrl, {
|
||||
headers: { accept: "application/json" },
|
||||
redirect: "error",
|
||||
signal: controller.signal,
|
||||
});
|
||||
const text = await upstream.text();
|
||||
if (Buffer.byteLength(text, "utf8") > 1024 * 1024) {
|
||||
return jsonError(
|
||||
res,
|
||||
502,
|
||||
"dashboard_response_too_large",
|
||||
"resale dashboard response exceeded 1 MiB",
|
||||
);
|
||||
}
|
||||
if (!upstream.ok) {
|
||||
return jsonError(
|
||||
res,
|
||||
502,
|
||||
"dashboard_upstream_error",
|
||||
`resale dashboard upstream returned ${upstream.status}`,
|
||||
);
|
||||
}
|
||||
let payload: unknown;
|
||||
try {
|
||||
payload = JSON.parse(text);
|
||||
} catch {
|
||||
return jsonError(
|
||||
res,
|
||||
502,
|
||||
"dashboard_invalid_json",
|
||||
"resale dashboard upstream did not return JSON",
|
||||
);
|
||||
}
|
||||
res.setHeader("Cache-Control", "no-store");
|
||||
return res.status(200).json(payload);
|
||||
} catch {
|
||||
return jsonError(
|
||||
res,
|
||||
502,
|
||||
"dashboard_unreachable",
|
||||
"resale dashboard upstream is unavailable",
|
||||
);
|
||||
} finally {
|
||||
clearTimeout(timer);
|
||||
}
|
||||
});
|
||||
|
||||
app.get("/v1/pending-receipts", async (_req: Request, res: Response) => {
|
||||
if (!resolved) {
|
||||
return jsonError(
|
||||
@@ -748,11 +680,9 @@ export function createApp(deps: AppDeps): Express {
|
||||
const DEMO_CHAT_MODEL = "moonshotai/kimi-k2.6";
|
||||
|
||||
function isChatMessageArray(v: unknown): v is ChatMessage[] {
|
||||
// The free chat demo stays text-only: the `tool` role (added to
|
||||
// ChatMessage for the gateway demo endpoint) is not accepted here.
|
||||
return Array.isArray(v) && v.length > 0 && v.every(
|
||||
(m) => m && typeof m === "object"
|
||||
&& ["system", "user", "assistant"].includes((m as ChatMessage).role)
|
||||
&& (["system", "user", "assistant"] as const).includes((m as ChatMessage).role)
|
||||
&& typeof (m as ChatMessage).content === "string",
|
||||
);
|
||||
}
|
||||
@@ -997,14 +927,6 @@ export function createApp(deps: AppDeps): Express {
|
||||
supplierBaseUrl: state.supplierBaseUrl,
|
||||
});
|
||||
chatRouteState.delete(rawRef);
|
||||
if (result.settleMode === "ticket") {
|
||||
// Ticket session: no receipt/Accept — funds return via reclaim.
|
||||
return res.status(200).json({
|
||||
status: "ended",
|
||||
escrow_ref: rawRef,
|
||||
settle_mode: "ticket",
|
||||
});
|
||||
}
|
||||
return res.status(200).json({
|
||||
status: "accepted",
|
||||
escrow_ref: rawRef,
|
||||
@@ -1388,9 +1310,6 @@ export function createApp(deps: AppDeps): Express {
|
||||
pubKeyHash: resolved.walletKey.pubKeyHash,
|
||||
address: displayAddress,
|
||||
},
|
||||
// Public gateway base URL for the "Generate API key" page. Empty
|
||||
// string when unconfigured — the SPA then derives "api." + host.
|
||||
gatewayUrl: deps.gatewayPublicUrl ?? "",
|
||||
})};</script>`
|
||||
: "";
|
||||
const indexWithBoot = cachedTemplate.replace(
|
||||
|
||||
@@ -4,10 +4,8 @@
|
||||
* Routes (all gated by <RequireAuth>):
|
||||
* / → <Dashboard />
|
||||
* /tasks → <TaskHistory />
|
||||
* /dashboard → <ResaleDashboard /> Capacity markets and sale proofs
|
||||
* /pending → <PendingReceipts /> UX-1: buyer-side Accept button
|
||||
* /wallet → <Wallet />
|
||||
* /api-keys → <ApiKeys /> self-serve gateway API key generation
|
||||
*/
|
||||
|
||||
import { Routes, Route, Link } from "react-router-dom";
|
||||
@@ -16,8 +14,6 @@ import TaskHistory from "./pages/TaskHistory.js";
|
||||
import Wallet from "./pages/Wallet.js";
|
||||
import PendingReceipts from "./pages/PendingReceipts.js";
|
||||
import BookSummarizer from "./pages/BookSummarizer.js";
|
||||
import ApiKeys from "./pages/ApiKeys.js";
|
||||
import ResaleDashboard from "./pages/ResaleDashboard.js";
|
||||
import { RequireAuth, useAuth } from "./state/AuthContext.js";
|
||||
|
||||
function SignOutButton() {
|
||||
@@ -37,27 +33,21 @@ export default function App() {
|
||||
return (
|
||||
<RequireAuth>
|
||||
<div className="min-h-screen bg-gray-50 text-gray-900">
|
||||
<nav className="bg-white border-b border-gray-200 px-4 py-3 sm:px-6 flex flex-wrap items-center gap-x-6 gap-y-2">
|
||||
<nav className="bg-white border-b border-gray-200 px-6 py-3 flex items-center gap-6">
|
||||
<Link to="/" className="font-medium hover:underline">Dashboard</Link>
|
||||
<Link to="/dashboard" className="font-medium hover:underline">Capacity</Link>
|
||||
{/* Book Summarizer tab hidden for now — the /book route and all PDF
|
||||
summarize code remain intact; restore by re-adding this link:
|
||||
<Link to="/book" className="font-medium hover:underline">Book Summarizer</Link> */}
|
||||
<Link to="/book" className="font-medium hover:underline">Book Summarizer</Link>
|
||||
<Link to="/tasks" className="font-medium hover:underline">Tasks</Link>
|
||||
<Link to="/pending" className="font-medium hover:underline">Pending</Link>
|
||||
<Link to="/wallet" className="font-medium hover:underline">Wallet</Link>
|
||||
<Link to="/api-keys" className="font-medium hover:underline">API Keys</Link>
|
||||
<SignOutButton />
|
||||
</nav>
|
||||
<main className="p-6">
|
||||
<Routes>
|
||||
<Route path="/" element={<Dashboard />} />
|
||||
<Route path="/dashboard" element={<ResaleDashboard />} />
|
||||
<Route path="/book" element={<BookSummarizer />} />
|
||||
<Route path="/tasks" element={<TaskHistory />} />
|
||||
<Route path="/pending" element={<PendingReceipts />} />
|
||||
<Route path="/wallet" element={<Wallet />} />
|
||||
<Route path="/api-keys" element={<ApiKeys />} />
|
||||
</Routes>
|
||||
</main>
|
||||
</div>
|
||||
|
||||
@@ -267,18 +267,7 @@ export default function ChatForm({ advertRef, payment_lovelace }: ChatFormProps
|
||||
} catch { /* keep fallback */ }
|
||||
throw new Error(msg);
|
||||
}
|
||||
let endBody: { settle_mode?: string } = {};
|
||||
try {
|
||||
endBody = (await resp.json()) as { settle_mode?: string };
|
||||
} catch { /* older buyer-app responses stay full-settle */ }
|
||||
// Ticket sessions never charge — the escrow returns via reclaim.
|
||||
setCharged(
|
||||
endBody.settle_mode === "ticket"
|
||||
? "0 (ticket session — escrow reclaimed)"
|
||||
: payment_lovelace !== undefined
|
||||
? ap3x(payment_lovelace)
|
||||
: "0",
|
||||
);
|
||||
setCharged(payment_lovelace !== undefined ? ap3x(payment_lovelace) : "0");
|
||||
} catch (err) {
|
||||
setError(err instanceof Error ? err.message : String(err));
|
||||
} finally {
|
||||
|
||||
@@ -94,7 +94,7 @@ export default function JobEstimate({
|
||||
<dd className="text-right">{est.mapCalls}</dd>
|
||||
<dt>Reduce calls</dt>
|
||||
<dd className="text-right">{est.reduceCalls}</dd>
|
||||
<dt className="font-medium">Total escrowed calls</dt>
|
||||
<dt className="font-medium">Total paid calls</dt>
|
||||
<dd className="text-right font-medium">{est.totalCalls}</dd>
|
||||
<dt className="font-medium">Est. max cost</dt>
|
||||
<dd className="text-right font-medium">{est.totalAp3x} AP3X</dd>
|
||||
@@ -126,7 +126,7 @@ export default function JobEstimate({
|
||||
disabled={blocked || starting}
|
||||
className="rounded bg-indigo-600 px-4 py-2 text-sm font-medium text-white hover:bg-indigo-700 disabled:bg-gray-400"
|
||||
>
|
||||
{starting ? "Starting…" : `Proceed (locks ~${est.totalAp3x} AP3X in escrow)`}
|
||||
{starting ? "Starting…" : `Proceed & pay (~${est.totalAp3x} AP3X)`}
|
||||
</button>
|
||||
</div>
|
||||
);
|
||||
|
||||
@@ -50,7 +50,7 @@ export default function PdfUploadForm({ onUploaded }: { onUploaded: (info: Uploa
|
||||
return (
|
||||
<form onSubmit={handleSubmit} className="space-y-4">
|
||||
<p className="text-sm text-gray-600">
|
||||
Upload a text-based PDF book. The buyer will chunk it and commission marketplace
|
||||
Upload a text-based PDF book. The buyer will chunk it and pay marketplace
|
||||
suppliers to summarize each chunk, then synthesize a full-book summary.
|
||||
</p>
|
||||
<input
|
||||
|
||||
@@ -1,32 +0,0 @@
|
||||
/**
|
||||
* buyer/src/ui/gateway.ts — resolve the OpenAI-compatible gateway base URL the
|
||||
* SPA should call for the "Generate API key" page.
|
||||
*
|
||||
* Resolution order:
|
||||
* 1. window.__BUYER_BOOT__.gatewayUrl — injected by the buyer server from the
|
||||
* GATEWAY_PUBLIC_URL env (the configured value). Present on any page load
|
||||
* made while the buyer_session cookie is valid.
|
||||
* 2. Derived "api." + current host — the deploy convention is exactly
|
||||
* api.<buyer-host> (marketplace.… → api.marketplace.…). This covers the
|
||||
* gap right after a fresh login, when the SPA flips auth state WITHOUT a
|
||||
* page reload so the boot block (which is only injected into
|
||||
* server-rendered HTML) hasn't been re-fetched yet.
|
||||
*
|
||||
* The result never has a trailing slash.
|
||||
*/
|
||||
|
||||
interface BuyerBootMaybeGateway {
|
||||
gatewayUrl?: string;
|
||||
}
|
||||
|
||||
function stripTrailingSlashes(url: string): string {
|
||||
return url.replace(/\/+$/, "");
|
||||
}
|
||||
|
||||
export function resolveGatewayUrl(): string {
|
||||
const boot = (window as unknown as { __BUYER_BOOT__?: BuyerBootMaybeGateway })
|
||||
.__BUYER_BOOT__;
|
||||
const configured = boot?.gatewayUrl?.trim();
|
||||
if (configured) return stripTrailingSlashes(configured);
|
||||
return `${window.location.protocol}//api.${window.location.host}`;
|
||||
}
|
||||
@@ -1,205 +0,0 @@
|
||||
/**
|
||||
* buyer/src/ui/pages/ApiKeys.tsx — self-serve "Generate API key" page.
|
||||
*
|
||||
* Mints a custodial gateway API key by POSTing directly to the gateway's
|
||||
* public /signup endpoint (cross-origin; the gateway CORS-allows this origin).
|
||||
* The raw key is shown ONCE — it is never stored server-side in retrievable
|
||||
* form, so it cannot be listed or recovered later. The page also surfaces the
|
||||
* funding deposit address and a ready-to-paste usage snippet.
|
||||
*
|
||||
* Access is gated by the SPA's existing operator login (this page only renders
|
||||
* inside <RequireAuth>). The gateway /signup itself stays public + IP
|
||||
* rate-limited; per-user accounts are a later feature.
|
||||
*/
|
||||
|
||||
import { useState } from "react";
|
||||
import { resolveGatewayUrl } from "../gateway.js";
|
||||
|
||||
interface SignupResult {
|
||||
api_key: string;
|
||||
key_prefix: string;
|
||||
deposit_address: string;
|
||||
}
|
||||
|
||||
/** Pull a human-readable message out of whatever error shape the gateway
|
||||
* returns (OpenAI `{error:{message}}`, plain `{error|message}`, or neither). */
|
||||
function errorMessage(body: unknown, status: number, statusText: string): string {
|
||||
if (body && typeof body === "object") {
|
||||
const b = body as Record<string, unknown>;
|
||||
const err = b.error;
|
||||
if (err && typeof err === "object" && typeof (err as Record<string, unknown>).message === "string") {
|
||||
return (err as Record<string, string>).message;
|
||||
}
|
||||
if (typeof err === "string") return err;
|
||||
if (typeof b.message === "string") return b.message;
|
||||
}
|
||||
return `${status} ${statusText}`.trim() || "request failed";
|
||||
}
|
||||
|
||||
function CopyButton({ value, label }: { value: string; label?: string }) {
|
||||
const [copied, setCopied] = useState(false);
|
||||
return (
|
||||
<button
|
||||
type="button"
|
||||
onClick={() => {
|
||||
void navigator.clipboard
|
||||
?.writeText(value)
|
||||
.then(() => {
|
||||
setCopied(true);
|
||||
setTimeout(() => setCopied(false), 1500);
|
||||
})
|
||||
.catch(() => {
|
||||
/* clipboard blocked (insecure context / permissions) — no-op */
|
||||
});
|
||||
}}
|
||||
className="rounded border border-gray-300 px-2 py-0.5 text-xs text-gray-600 hover:bg-gray-50"
|
||||
>
|
||||
{copied ? "Copied!" : (label ?? "Copy")}
|
||||
</button>
|
||||
);
|
||||
}
|
||||
|
||||
export default function ApiKeys() {
|
||||
const [label, setLabel] = useState("");
|
||||
const [loading, setLoading] = useState(false);
|
||||
const [error, setError] = useState<string | null>(null);
|
||||
const [result, setResult] = useState<SignupResult | null>(null);
|
||||
|
||||
const gatewayUrl = resolveGatewayUrl();
|
||||
const baseUrl = `${gatewayUrl}/openai/v1`;
|
||||
|
||||
async function generate() {
|
||||
setLoading(true);
|
||||
setError(null);
|
||||
setResult(null);
|
||||
try {
|
||||
const res = await fetch(`${gatewayUrl}/signup`, {
|
||||
method: "POST",
|
||||
headers: { "Content-Type": "application/json" },
|
||||
body: JSON.stringify(label.trim() ? { label: label.trim() } : {}),
|
||||
});
|
||||
const body = (await res.json().catch(() => null)) as unknown;
|
||||
if (!res.ok) {
|
||||
throw new Error(errorMessage(body, res.status, res.statusText));
|
||||
}
|
||||
const r = body as Partial<SignupResult> | null;
|
||||
if (!r || typeof r.api_key !== "string" || typeof r.deposit_address !== "string") {
|
||||
throw new Error("unexpected response from gateway");
|
||||
}
|
||||
setResult({
|
||||
api_key: r.api_key,
|
||||
key_prefix: r.key_prefix ?? r.api_key.slice(0, 12),
|
||||
deposit_address: r.deposit_address,
|
||||
});
|
||||
} catch (e) {
|
||||
setError(e instanceof Error ? e.message : "could not reach the gateway");
|
||||
} finally {
|
||||
setLoading(false);
|
||||
}
|
||||
}
|
||||
|
||||
const curlSnippet =
|
||||
result === null
|
||||
? ""
|
||||
: [
|
||||
`curl ${baseUrl}/chat/completions \\`,
|
||||
` -H "Authorization: Bearer ${result.api_key}" \\`,
|
||||
` -H "Content-Type: application/json" \\`,
|
||||
` -d '{"model": "<model>", "messages": [{"role": "user", "content": "Hello"}]}'`,
|
||||
].join("\n");
|
||||
|
||||
return (
|
||||
<div className="max-w-3xl space-y-6">
|
||||
<div className="space-y-1">
|
||||
<h1 className="text-2xl font-semibold">API Keys</h1>
|
||||
<p className="text-sm text-gray-600">
|
||||
Generate an OpenAI-compatible API key for the marketplace gateway. Each key has its own
|
||||
gateway-managed wallet (the gateway holds this wallet's key) - fund its deposit address with AP3X, then point any OpenAI SDK at{" "}
|
||||
<code className="font-mono text-xs">{baseUrl}</code>.
|
||||
</p>
|
||||
</div>
|
||||
|
||||
<div className="rounded-lg border border-gray-200 bg-white p-4 space-y-3">
|
||||
<label className="block text-sm font-medium text-gray-700">
|
||||
Label <span className="font-normal text-gray-400">(optional)</span>
|
||||
<input
|
||||
type="text"
|
||||
value={label}
|
||||
onChange={(e) => setLabel(e.target.value)}
|
||||
placeholder="e.g. my-laptop"
|
||||
maxLength={120}
|
||||
disabled={loading}
|
||||
className="mt-1 block w-full rounded border border-gray-300 px-3 py-2 text-sm focus:border-gray-400 focus:outline-none disabled:opacity-50"
|
||||
/>
|
||||
</label>
|
||||
<button
|
||||
type="button"
|
||||
onClick={() => void generate()}
|
||||
disabled={loading}
|
||||
className="rounded bg-gray-900 px-4 py-2 text-sm font-medium text-white hover:bg-gray-700 disabled:opacity-50"
|
||||
data-testid="generate-api-key"
|
||||
>
|
||||
{loading ? "Generating…" : "Generate API key"}
|
||||
</button>
|
||||
{error !== null && (
|
||||
<p className="text-sm text-red-600" data-testid="api-key-error">
|
||||
{error}
|
||||
</p>
|
||||
)}
|
||||
</div>
|
||||
|
||||
{result !== null && (
|
||||
<div className="space-y-4 rounded-lg border border-amber-300 bg-amber-50 p-4" data-testid="api-key-result">
|
||||
<div className="rounded border border-amber-400 bg-amber-100 px-3 py-2 text-sm text-amber-900">
|
||||
Copy your API key now — it is shown <strong>only once</strong> and cannot be recovered. If you
|
||||
lose it, generate a new one.
|
||||
</div>
|
||||
|
||||
<div>
|
||||
<div className="flex items-center justify-between">
|
||||
<span className="text-sm font-medium text-gray-700">API key</span>
|
||||
<CopyButton value={result.api_key} />
|
||||
</div>
|
||||
<code className="mt-1 block break-all rounded bg-white px-3 py-2 font-mono text-sm">
|
||||
{result.api_key}
|
||||
</code>
|
||||
</div>
|
||||
|
||||
<div>
|
||||
<div className="flex items-center justify-between">
|
||||
<span className="text-sm font-medium text-gray-700">Deposit address (fund with AP3X)</span>
|
||||
<CopyButton value={result.deposit_address} />
|
||||
</div>
|
||||
<code className="mt-1 block break-all rounded bg-white px-3 py-2 font-mono text-sm">
|
||||
{result.deposit_address}
|
||||
</code>
|
||||
</div>
|
||||
|
||||
<div>
|
||||
<div className="flex items-center justify-between">
|
||||
<span className="text-sm font-medium text-gray-700">Base URL</span>
|
||||
<CopyButton value={baseUrl} />
|
||||
</div>
|
||||
<code className="mt-1 block break-all rounded bg-white px-3 py-2 font-mono text-sm">
|
||||
{baseUrl}
|
||||
</code>
|
||||
</div>
|
||||
|
||||
<div>
|
||||
<div className="flex items-center justify-between">
|
||||
<span className="text-sm font-medium text-gray-700">Quick start</span>
|
||||
<CopyButton value={curlSnippet} />
|
||||
</div>
|
||||
<pre className="mt-1 overflow-x-auto rounded bg-gray-900 px-3 py-2 font-mono text-xs text-gray-100">
|
||||
{curlSnippet}
|
||||
</pre>
|
||||
<p className="mt-1 text-xs text-gray-500">
|
||||
Replace <code className="font-mono"><model></code> with a model from{" "}
|
||||
<code className="font-mono">{baseUrl}/models</code>.
|
||||
</p>
|
||||
</div>
|
||||
</div>
|
||||
)}
|
||||
</div>
|
||||
);
|
||||
}
|
||||
@@ -152,7 +152,7 @@ export default function BookSummarizer() {
|
||||
<div>
|
||||
<h1 className="text-2xl font-semibold">Book Summarizer</h1>
|
||||
<p className="mt-1 text-sm text-gray-500">
|
||||
Upload a PDF → commission suppliers to summarize each chunk → get a full-book summary.
|
||||
Upload a PDF → pay suppliers to summarize each chunk → get a full-book summary.
|
||||
Jobs keep running if you navigate away; reopen them below.
|
||||
</p>
|
||||
</div>
|
||||
|
||||
@@ -2,10 +2,8 @@
|
||||
* buyer/src/ui/pages/Dashboard.tsx — supplier list + capability-routed task form.
|
||||
*
|
||||
* Calls marketplace.discoverSuppliers() on mount; renders a SupplierCard
|
||||
* per result. Once a supplier is selected, the task form (e.g. the chat
|
||||
* window) renders ABOVE the grid — directly under the page title — and the
|
||||
* component is picked from `CAPABILITY_FORMS` based on the supplier's
|
||||
* `capability_id`.
|
||||
* per result. Once a supplier is selected, the form rendered below is
|
||||
* picked from `CAPABILITY_FORMS` based on the supplier's `capability_id`.
|
||||
*
|
||||
* Capabilities (current registry):
|
||||
*
|
||||
@@ -133,8 +131,18 @@ export default function Dashboard() {
|
||||
{error}
|
||||
</div>
|
||||
)}
|
||||
<div className="grid grid-cols-1 sm:grid-cols-2 lg:grid-cols-3 gap-4">
|
||||
{suppliers.map((s) => (
|
||||
<SupplierCard
|
||||
key={s.utxo_ref}
|
||||
supplier={s}
|
||||
onUse={(sup) => setSelected(sup)}
|
||||
/>
|
||||
))}
|
||||
</div>
|
||||
|
||||
{selected && (
|
||||
<div data-testid="task-form-section">
|
||||
<div className="mt-8">
|
||||
<h2 className="text-xl font-semibold mb-2">
|
||||
New task → {selected.model}
|
||||
<span className="ml-2 text-sm font-normal text-gray-500">
|
||||
@@ -144,21 +152,6 @@ export default function Dashboard() {
|
||||
{renderCapabilityForm(selected, advertRef, payment_lovelace)}
|
||||
</div>
|
||||
)}
|
||||
|
||||
<div className="grid grid-cols-1 sm:grid-cols-2 lg:grid-cols-3 gap-4">
|
||||
{suppliers.map((s) => (
|
||||
<SupplierCard
|
||||
key={s.utxo_ref}
|
||||
supplier={s}
|
||||
onUse={(sup) => {
|
||||
setSelected(sup);
|
||||
// The form renders above the grid; bring it into view when a
|
||||
// card further down the page was clicked.
|
||||
window.scrollTo({ top: 0, behavior: "smooth" });
|
||||
}}
|
||||
/>
|
||||
))}
|
||||
</div>
|
||||
</div>
|
||||
);
|
||||
}
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
/**
|
||||
* buyer/src/ui/pages/PendingReceipts.tsx — list of currently-Submitted escrows
|
||||
* for this buyer, with an "Accept & Settle" action per row.
|
||||
* for this buyer, with an "Accept & Pay" action per row.
|
||||
*
|
||||
* Data flow:
|
||||
* GET /v1/pending-receipts → buyer-app server proxies indexer /escrows?buyer=<pkh>
|
||||
@@ -190,7 +190,7 @@ export default function PendingReceipts() {
|
||||
<th className="px-2 py-2">Submitted</th>
|
||||
<th className="px-2 py-2">Supplier</th>
|
||||
<th className="px-2 py-2">Capability</th>
|
||||
<th className="px-2 py-2">Escrowed</th>
|
||||
<th className="px-2 py-2">Payment</th>
|
||||
<th className="px-2 py-2">Window left</th>
|
||||
<th className="px-2 py-2">Action</th>
|
||||
</tr>
|
||||
@@ -254,7 +254,7 @@ export default function PendingReceipts() {
|
||||
: "bg-indigo-600 text-white hover:bg-indigo-700")
|
||||
}
|
||||
>
|
||||
{isAccepting ? "accepting…" : expired ? "expired" : "Accept & Settle"}
|
||||
{isAccepting ? "accepting…" : expired ? "expired" : "Accept & Pay"}
|
||||
</button>
|
||||
)}
|
||||
</td>
|
||||
|
||||
@@ -1,419 +0,0 @@
|
||||
import { useCallback, useEffect, useState } from "react";
|
||||
|
||||
interface VectorProof {
|
||||
status: "pending" | "confirmed" | "failed";
|
||||
saleHash: string | null;
|
||||
batchRoot: string | null;
|
||||
txHash: string | null;
|
||||
leafIndex: number | null;
|
||||
siblings: string[];
|
||||
}
|
||||
|
||||
const PENDING_PROOF: VectorProof = {
|
||||
status: "pending",
|
||||
saleHash: null,
|
||||
batchRoot: null,
|
||||
txHash: null,
|
||||
leafIndex: null,
|
||||
siblings: [],
|
||||
};
|
||||
|
||||
interface DashboardSnapshot {
|
||||
generatedAt: string;
|
||||
controller: {
|
||||
ok: boolean;
|
||||
phase: string;
|
||||
lastError: string | null;
|
||||
};
|
||||
identity: {
|
||||
sellerWallet: string;
|
||||
payoutAddress: string;
|
||||
};
|
||||
provider: {
|
||||
hardLimitUsd: string;
|
||||
remainingUsd: string;
|
||||
usedUsd: string;
|
||||
reserveUsd: string;
|
||||
estimatedDailyExposureUsd: string;
|
||||
};
|
||||
surplus: {
|
||||
offer: {
|
||||
id: string | null;
|
||||
model: string | null;
|
||||
providerModel: string | null;
|
||||
status: string;
|
||||
dailyCapUsd: string | null;
|
||||
costMultiplier: number | null;
|
||||
inputUsdPer1m: string | null;
|
||||
outputUsdPer1m: string | null;
|
||||
rank: number | null;
|
||||
available: boolean;
|
||||
healthy: boolean;
|
||||
trusted: boolean;
|
||||
trades24h: number;
|
||||
volume24hUsd: string;
|
||||
capRemainingUsd: string | null;
|
||||
};
|
||||
earnings: {
|
||||
totalUsd: string;
|
||||
pendingUsd: string;
|
||||
paidUsd: string;
|
||||
requests: number;
|
||||
tokens: number;
|
||||
today: {
|
||||
earnedUsd: number;
|
||||
requests: number;
|
||||
totalTokens: number;
|
||||
} | null;
|
||||
topModel: string | null;
|
||||
payoutHoldReason: string | null;
|
||||
payoutHoldReleasesAt: string | null;
|
||||
};
|
||||
recentSales: Array<{
|
||||
id: string;
|
||||
model: string;
|
||||
createdAt: string | null;
|
||||
settlementStatus: string;
|
||||
inputTokens: number;
|
||||
outputTokens: number;
|
||||
cacheReadTokens: number;
|
||||
revenueUsd: string;
|
||||
vectorProof: VectorProof;
|
||||
}>;
|
||||
};
|
||||
|
||||
}
|
||||
|
||||
function usd(value: string | number | null): string {
|
||||
if (value === null || value === "") return "—";
|
||||
const number = Number(value);
|
||||
if (!Number.isFinite(number)) return "—";
|
||||
return `$${number.toFixed(number < 0.01 ? 6 : 4)}`;
|
||||
}
|
||||
|
||||
function count(value: number): string {
|
||||
return new Intl.NumberFormat().format(value);
|
||||
}
|
||||
|
||||
function timestamp(value: string | null): string {
|
||||
if (value === null) return "—";
|
||||
const parsed = new Date(value);
|
||||
return Number.isNaN(parsed.getTime()) ? "—" : parsed.toLocaleString();
|
||||
}
|
||||
|
||||
function compact(value: string): string {
|
||||
if (value.length <= 24) return value;
|
||||
return `${value.slice(0, 12)}…${value.slice(-9)}`;
|
||||
}
|
||||
|
||||
function StatusPill({ label, active }: { label: string; active: boolean }) {
|
||||
return (
|
||||
<span
|
||||
className={`rounded px-2 py-0.5 text-xs font-medium ${
|
||||
active ? "bg-green-100 text-green-700" : "bg-gray-200 text-gray-600"
|
||||
}`}
|
||||
>
|
||||
{label}
|
||||
</span>
|
||||
);
|
||||
}
|
||||
|
||||
function VectorProofState({ proof }: { proof: VectorProof }) {
|
||||
const pillClass = proof.status === "confirmed"
|
||||
? "bg-green-100 text-green-700"
|
||||
: proof.status === "pending"
|
||||
? "bg-amber-100 text-amber-700"
|
||||
: "bg-red-100 text-red-700";
|
||||
const pill = (
|
||||
<span className={`rounded px-2 py-0.5 text-xs font-medium ${pillClass}`}>
|
||||
{proof.status}
|
||||
</span>
|
||||
);
|
||||
|
||||
if (proof.status !== "confirmed" || proof.txHash === null) return pill;
|
||||
|
||||
return (
|
||||
<a
|
||||
className="inline-flex items-center gap-2 rounded text-blue-600 hover:underline focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-gray-500 focus-visible:ring-offset-2"
|
||||
href={`https://vector.apexscan.org/en/transaction/${proof.txHash}/summary/`}
|
||||
target="_blank"
|
||||
rel="noopener noreferrer"
|
||||
aria-label={`Confirmed Vector proof transaction ${proof.txHash}`}
|
||||
>
|
||||
{pill}
|
||||
<span className="font-mono text-xs">{compact(proof.txHash)}</span>
|
||||
</a>
|
||||
);
|
||||
}
|
||||
|
||||
function Metric({ label, value, detail }: { label: string; value: string; detail: string }) {
|
||||
return (
|
||||
<div className="rounded border border-gray-200 bg-gray-50 p-3">
|
||||
<p className="text-xs font-medium uppercase tracking-wide text-gray-500">{label}</p>
|
||||
<p className="mt-1 text-xl font-semibold tracking-tight text-gray-900">{value}</p>
|
||||
<p className="mt-0.5 text-xs text-gray-500">{detail}</p>
|
||||
</div>
|
||||
);
|
||||
}
|
||||
|
||||
function FlowNode({ label, title, detail, mono }: {
|
||||
label: string;
|
||||
title: string;
|
||||
detail: string;
|
||||
mono?: string | null;
|
||||
}) {
|
||||
return (
|
||||
<div className="min-w-0 flex-1 rounded border border-gray-200 bg-gray-50 p-4">
|
||||
<p className="text-xs font-medium uppercase tracking-wide text-gray-500">{label}</p>
|
||||
<p className="mt-1 font-semibold text-gray-900">{title}</p>
|
||||
<p className="mt-1 text-sm text-gray-600">{detail}</p>
|
||||
{mono && <p className="mt-2 truncate font-mono text-xs text-gray-400">{mono}</p>}
|
||||
</div>
|
||||
);
|
||||
}
|
||||
|
||||
export default function ResaleDashboard() {
|
||||
const [data, setData] = useState<DashboardSnapshot | null>(null);
|
||||
const [loading, setLoading] = useState(true);
|
||||
const [error, setError] = useState<string | null>(null);
|
||||
|
||||
const refresh = useCallback(async () => {
|
||||
try {
|
||||
const response = await fetch("/v1/resale-dashboard", { cache: "no-store" });
|
||||
const body = (await response.json().catch(() => null)) as DashboardSnapshot | {
|
||||
message?: string;
|
||||
} | null;
|
||||
if (!response.ok) {
|
||||
throw new Error(
|
||||
body && "message" in body && typeof body.message === "string"
|
||||
? body.message
|
||||
: `dashboard request failed (${response.status})`,
|
||||
);
|
||||
}
|
||||
setData(body as DashboardSnapshot);
|
||||
setError(null);
|
||||
} catch (cause) {
|
||||
setError(cause instanceof Error ? cause.message : "dashboard data is unavailable");
|
||||
} finally {
|
||||
setLoading(false);
|
||||
}
|
||||
}, []);
|
||||
|
||||
useEffect(() => {
|
||||
void refresh();
|
||||
const interval = setInterval(() => { void refresh(); }, 15_000);
|
||||
return () => clearInterval(interval);
|
||||
}, [refresh]);
|
||||
|
||||
if (loading && data === null) {
|
||||
return <p className="text-sm text-gray-500">Loading capacity markets…</p>;
|
||||
}
|
||||
|
||||
if (data === null) {
|
||||
return (
|
||||
<div className="max-w-3xl rounded-lg border border-red-200 bg-red-50 p-4 text-sm text-red-700">
|
||||
{error ?? "Dashboard data is unavailable."}
|
||||
</div>
|
||||
);
|
||||
}
|
||||
|
||||
const offer = data.surplus.offer;
|
||||
const earnings = data.surplus.earnings;
|
||||
const offerLive = offer.status === "active" && offer.available && offer.healthy;
|
||||
const proofCounts = { confirmed: 0, pending: 0, failed: 0 };
|
||||
for (const sale of data.surplus.recentSales) {
|
||||
proofCounts[(sale.vectorProof ?? PENDING_PROOF).status] += 1;
|
||||
}
|
||||
|
||||
return (
|
||||
<div className="mx-auto max-w-7xl space-y-6" data-testid="resale-dashboard">
|
||||
<div className="flex flex-col gap-3 sm:flex-row sm:items-start sm:justify-between">
|
||||
<div className="space-y-1">
|
||||
<h1 className="text-2xl font-semibold">Capacity Markets</h1>
|
||||
<p className="max-w-3xl text-sm text-gray-600">
|
||||
Surplus turns available OpenRouter capacity into Base USDC sales. Vector anchors
|
||||
Merkle-batched proofs so every sale has a verifiable transaction record.
|
||||
</p>
|
||||
</div>
|
||||
<div className="flex items-center gap-3">
|
||||
<StatusPill label={data.controller.phase} active={data.controller.ok} />
|
||||
<button
|
||||
type="button"
|
||||
onClick={() => { void refresh(); }}
|
||||
className="rounded border border-gray-300 bg-white px-3 py-1.5 text-sm text-gray-700 hover:bg-gray-50"
|
||||
>
|
||||
Refresh
|
||||
</button>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
{error && (
|
||||
<div className="rounded border border-amber-300 bg-amber-50 px-4 py-3 text-sm text-amber-800">
|
||||
Last refresh failed: {error}. Showing the last good snapshot.
|
||||
</div>
|
||||
)}
|
||||
{data.controller.lastError && (
|
||||
<div className="rounded border border-red-200 bg-red-50 px-4 py-3 text-sm text-red-700">
|
||||
Controller: {data.controller.lastError}
|
||||
</div>
|
||||
)}
|
||||
|
||||
<section className="rounded-lg border border-gray-200 bg-white p-4 shadow-sm">
|
||||
<div className="mb-3 flex items-center justify-between">
|
||||
<div>
|
||||
<h2 className="font-semibold">Capacity and proof route</h2>
|
||||
<p className="text-sm text-gray-500">
|
||||
Capacity sells through Surplus, and each sale joins a shared Vector anchor.
|
||||
</p>
|
||||
</div>
|
||||
<span className="text-xs text-gray-400">Updated {timestamp(data.generatedAt)}</span>
|
||||
</div>
|
||||
<div className="flex flex-col items-stretch gap-2 lg:flex-row lg:items-center">
|
||||
<FlowNode
|
||||
label="Upstream"
|
||||
title="OpenRouter"
|
||||
detail={`${usd(data.provider.remainingUsd)} of ${usd(data.provider.hardLimitUsd)} remaining`}
|
||||
mono={offer.providerModel}
|
||||
/>
|
||||
<span className="self-center text-lg text-gray-400">→</span>
|
||||
<FlowNode
|
||||
label="Manager"
|
||||
title="Seller agent"
|
||||
detail="Discovers, prices, caps, and reconciles offers"
|
||||
mono={data.identity.sellerWallet}
|
||||
/>
|
||||
<span className="self-center text-lg text-gray-400">→</span>
|
||||
<FlowNode
|
||||
label="Live market"
|
||||
title="Surplus / Base USDC"
|
||||
detail={`${offerLive ? "Available" : "Unavailable"} · ${offer.trusted ? "trusted" : "untrusted"}`}
|
||||
mono={offer.id}
|
||||
/>
|
||||
<span className="self-center text-lg text-gray-400">→</span>
|
||||
<FlowNode
|
||||
label="Proof layer"
|
||||
title="Vector anchors"
|
||||
detail="Commits each sale through a shared Merkle-batch transaction"
|
||||
/>
|
||||
</div>
|
||||
</section>
|
||||
|
||||
<section className="rounded-lg border border-gray-200 bg-white p-4 shadow-sm">
|
||||
<div className="flex items-start justify-between gap-3">
|
||||
<div>
|
||||
<p className="text-xs font-medium uppercase tracking-wide text-gray-500">Current market</p>
|
||||
<h2 className="mt-1 text-lg font-semibold">Surplus Intelligence</h2>
|
||||
<p className="mt-1 text-sm text-gray-600">Discounted inference with USDC settlement on Base.</p>
|
||||
</div>
|
||||
<StatusPill label={offer.status} active={offerLive} />
|
||||
</div>
|
||||
<div className="mt-4 grid gap-3 sm:grid-cols-2 lg:grid-cols-4">
|
||||
<Metric label="Lifetime revenue" value={usd(earnings.totalUsd)} detail={`${usd(earnings.pendingUsd)} pending`} />
|
||||
<Metric label="Requests sold" value={count(earnings.requests)} detail={`${count(earnings.tokens)} tokens`} />
|
||||
<Metric label="Market rank" value={offer.rank === null ? "—" : `#${offer.rank}`} detail={`${offer.trades24h} trades / 24h`} />
|
||||
<Metric label="Daily seller cap" value={usd(offer.dailyCapUsd)} detail={`${usd(offer.capRemainingUsd)} remaining`} />
|
||||
</div>
|
||||
<dl className="mt-4 grid gap-x-6 gap-y-2 border-t border-gray-100 pt-4 text-sm sm:grid-cols-2">
|
||||
<div><dt className="text-gray-500">Marketplace model</dt><dd className="font-mono text-xs text-gray-900">{offer.model ?? "—"}</dd></div>
|
||||
<div><dt className="text-gray-500">Provider model</dt><dd className="font-mono text-xs text-gray-900">{offer.providerModel ?? "—"}</dd></div>
|
||||
<div><dt className="text-gray-500">Input / 1M</dt><dd>{usd(offer.inputUsdPer1m)}</dd></div>
|
||||
<div><dt className="text-gray-500">Output / 1M</dt><dd>{usd(offer.outputUsdPer1m)}</dd></div>
|
||||
</dl>
|
||||
{earnings.payoutHoldReason && (
|
||||
<div className="mt-4 rounded border border-amber-300 bg-amber-50 px-3 py-2 text-sm text-amber-800">
|
||||
Payout hold: {earnings.payoutHoldReason}
|
||||
{earnings.payoutHoldReleasesAt && ` · releases ${timestamp(earnings.payoutHoldReleasesAt)}`}
|
||||
</div>
|
||||
)}
|
||||
</section>
|
||||
|
||||
<section className="rounded-lg border border-gray-200 bg-white p-4 shadow-sm">
|
||||
<div>
|
||||
<p className="text-xs font-medium uppercase tracking-wide text-gray-500">Economics</p>
|
||||
<h2 className="mt-1 text-lg font-semibold">Capacity and price controls</h2>
|
||||
<p className="mt-1 text-sm text-gray-600">
|
||||
The seller cap is discounted revenue. The agent converts it to estimated upstream exposure before opening the route.
|
||||
</p>
|
||||
</div>
|
||||
<div className="mt-4 grid gap-3 sm:grid-cols-2 lg:grid-cols-4">
|
||||
<Metric label="OpenRouter remaining" value={usd(data.provider.remainingUsd)} detail={`${usd(data.provider.usedUsd)} used`} />
|
||||
<Metric label="Protected reserve" value={usd(data.provider.reserveUsd)} detail="fail-closed threshold" />
|
||||
<Metric label="Daily upstream estimate" value={usd(data.provider.estimatedDailyExposureUsd)} detail="from recovery floor" />
|
||||
<Metric label="Current multiplier" value={offer.costMultiplier === null ? "—" : `${(offer.costMultiplier * 100).toFixed(3)}%`} detail={`${usd(offer.inputUsdPer1m)} in · ${usd(offer.outputUsdPer1m)} out`} />
|
||||
</div>
|
||||
</section>
|
||||
|
||||
<section className="space-y-3">
|
||||
<div className="flex flex-col gap-1 sm:flex-row sm:items-end sm:justify-between">
|
||||
<div>
|
||||
<p className="text-xs font-medium uppercase tracking-wide text-gray-500">Surplus activity</p>
|
||||
<h2 className="mt-1 text-lg font-semibold">Recent sales</h2>
|
||||
</div>
|
||||
<p className="text-sm text-gray-500">{count(earnings.requests)} lifetime requests · {count(earnings.tokens)} tokens</p>
|
||||
</div>
|
||||
<div
|
||||
className="flex flex-wrap gap-2"
|
||||
role="group"
|
||||
aria-label="Vector proof summary"
|
||||
>
|
||||
<span className="rounded bg-green-100 px-2 py-1 text-xs font-medium text-green-700">
|
||||
Confirmed {count(proofCounts.confirmed)}
|
||||
</span>
|
||||
<span className="rounded bg-amber-100 px-2 py-1 text-xs font-medium text-amber-700">
|
||||
Pending {count(proofCounts.pending)}
|
||||
</span>
|
||||
<span className="rounded bg-red-100 px-2 py-1 text-xs font-medium text-red-700">
|
||||
Failed {count(proofCounts.failed)}
|
||||
</span>
|
||||
</div>
|
||||
<div className="overflow-x-auto rounded-lg border border-gray-200 bg-white shadow-sm">
|
||||
<table className="min-w-full divide-y divide-gray-200 text-sm">
|
||||
<caption className="sr-only">Recent Surplus sales with Vector proof status</caption>
|
||||
<thead className="bg-gray-50 text-left text-xs font-medium uppercase tracking-wide text-gray-500">
|
||||
<tr>
|
||||
<th className="px-4 py-3">Time</th>
|
||||
<th className="px-4 py-3">Status</th>
|
||||
<th className="px-4 py-3">Model</th>
|
||||
<th className="px-4 py-3 text-right">Input</th>
|
||||
<th className="px-4 py-3 text-right">Output</th>
|
||||
<th className="px-4 py-3 text-right">Cache read</th>
|
||||
<th className="px-4 py-3 text-right">Revenue</th>
|
||||
<th className="px-4 py-3">Vector proof</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody className="divide-y divide-gray-100">
|
||||
{data.surplus.recentSales.length === 0 ? (
|
||||
<tr><td colSpan={8} className="px-4 py-8 text-center text-gray-500">No sales returned.</td></tr>
|
||||
) : data.surplus.recentSales.map((sale) => (
|
||||
<tr key={sale.id} className="hover:bg-gray-50">
|
||||
<td className="whitespace-nowrap px-4 py-3 text-gray-600">{timestamp(sale.createdAt)}</td>
|
||||
<td className="px-4 py-3">
|
||||
<span className={`rounded px-2 py-0.5 text-xs font-medium ${
|
||||
sale.settlementStatus === "confirmed"
|
||||
? "bg-green-100 text-green-700"
|
||||
: "bg-amber-100 text-amber-700"
|
||||
}`}>
|
||||
{sale.settlementStatus}
|
||||
</span>
|
||||
</td>
|
||||
<td className="whitespace-nowrap px-4 py-3 font-mono text-xs">{sale.model}</td>
|
||||
<td className="px-4 py-3 text-right tabular-nums">{count(sale.inputTokens)}</td>
|
||||
<td className="px-4 py-3 text-right tabular-nums">{count(sale.outputTokens)}</td>
|
||||
<td className="px-4 py-3 text-right tabular-nums">{count(sale.cacheReadTokens)}</td>
|
||||
<td className="px-4 py-3 text-right tabular-nums">{usd(sale.revenueUsd)}</td>
|
||||
<td className="whitespace-nowrap px-4 py-3">
|
||||
<VectorProofState proof={sale.vectorProof ?? PENDING_PROOF} />
|
||||
</td>
|
||||
</tr>
|
||||
))}
|
||||
</tbody>
|
||||
</table>
|
||||
</div>
|
||||
</section>
|
||||
|
||||
<p className="text-xs text-gray-400">
|
||||
Surplus seller {compact(data.identity.sellerWallet)} · payout {compact(data.identity.payoutAddress)}
|
||||
</p>
|
||||
</div>
|
||||
);
|
||||
}
|
||||
@@ -304,7 +304,7 @@ function LifecycleCard({ lc }: { lc: Lifecycle }): JSX.Element {
|
||||
</>
|
||||
)}
|
||||
<span className="text-gray-500">·</span>
|
||||
<span>{fmtAda(lc.payment_lovelace)} escrowed</span>
|
||||
<span>{fmtAda(lc.payment_lovelace)} payment</span>
|
||||
<span className="text-gray-500">·</span>
|
||||
<span>{fmtAda(lc.buyer_bond_lovelace)} bond</span>
|
||||
<span className="text-gray-500">·</span>
|
||||
|
||||
@@ -289,34 +289,3 @@ For the M1-F-2 (LiveOgmiosProvider) handoff: the supplier compose already
|
||||
joins `apex-dashboard_apex-net` and overrides `OGMIOS_URL=ws://ogmios:1337`,
|
||||
so once the supplier code stops booting `ReadOnlyOgmiosProvider` and
|
||||
starts talking to a real Ogmios, no compose changes are needed.
|
||||
|
||||
## 10. Continuous deployment (mainnet, vector-marketplace host)
|
||||
|
||||
Merges to `main` deploy automatically to the mainnet host once CI is green:
|
||||
|
||||
1. `.github/workflows/ci.yml` runs typecheck + vitest on the merge commit.
|
||||
2. On success, `.github/workflows/deploy-mainnet.yml` SSHes into the host
|
||||
(secret `DEPLOY_SSH_KEY`, host key pinned in the workflow) and executes
|
||||
`deploy/mainnet/deploy.sh` **at the new commit** (`git show FETCH_HEAD:...`),
|
||||
so deploy logic always matches the code being deployed.
|
||||
3. The script hard-resets `/root/agents-marketplace` to `origin/main`, maps the
|
||||
old..new diff to affected compose projects (changes under `packages/`,
|
||||
`patches/`, `contracts/` or root manifests rebuild everything), builds all
|
||||
affected images up front, then does a rolling `up -d` with a health gate per
|
||||
project. Suppliers are drained first: `/status` is polled until not
|
||||
`working` (up to `DRAIN_TIMEOUT_SECS`, default 600) so an in-flight job
|
||||
isn't killed and its escrow bond forfeited.
|
||||
|
||||
Manual controls:
|
||||
|
||||
- **Manual deploy / redeploy**: Actions → "Deploy mainnet" → Run workflow
|
||||
(check *force* to redeploy the same sha), or on the host:
|
||||
`bash /root/agents-marketplace/deploy/mainnet/deploy.sh` (`FORCE=1` to
|
||||
redeploy, `DRY_RUN=1` to preview which projects would restart).
|
||||
- **Rollback**: `cd /root/agents-marketplace && git reset --hard <old-sha> &&
|
||||
FORCE=1 bash deploy/mainnet/deploy.sh`. Every deploy appends
|
||||
`old -> new (projects)` to `/var/log/marketplace-deploy.log`.
|
||||
|
||||
Projects with no running containers on the host (e.g. wallet-monitor) are
|
||||
skipped; image-only projects (ollama, chatmock, tts-piper) redeploy only when
|
||||
their own compose file changes.
|
||||
|
||||
@@ -1,261 +0,0 @@
|
||||
# inference-proxy box — suppliers `local` + `openclaw`
|
||||
|
||||
Compose projects for the **inference-proxy** host (`62.238.38.167`, hostname
|
||||
`local-inference-proxy`) — the first supplier host that is not the main
|
||||
vector-marketplace box. Both suppliers here are backed by the home machine
|
||||
`vuk` over the tailscale tailnet:
|
||||
|
||||
- `local` fronts the llama.cpp rig (`llamacpp-multinode`) directly at
|
||||
`100.77.146.49:8002`.
|
||||
- `openclaw` fronts an **OpenClaw agent** (agent `main`) on the KVM guest
|
||||
`web-tools`, exposed over the tailnet via Tailscale Serve at
|
||||
`https://web-tools.taild99fee.ts.net`, whose own brain is the *same*
|
||||
llama.cpp rig. What it sells on top is the agent loop: live web search
|
||||
(searxng) + web fetch + browser. Both suppliers contend for vuk's single
|
||||
llama.cpp slot; requests queue and the 1h deadline absorbs stalls.
|
||||
|
||||
> **Tailnet (2026-08-13):** account `teamhaleight@`, tailnet
|
||||
> `taild99fee.ts.net`. Node IPs: inference-proxy `100.110.165.124`, vuk
|
||||
> `100.77.146.49`, web-tools `100.105.36.0`. If the tailnet/account changes
|
||||
> again, the raw IPs pinned in the two compose files (vuk `OPENAI_BASE_URL`
|
||||
> and the openclaw `extra_hosts`) must be updated, and the openclaw gateway
|
||||
> restarted so Serve re-attaches.
|
||||
|
||||
> **Manual deploys only.** This box is NOT covered by the CD pipeline
|
||||
> (`deploy/mainnet/deploy.sh` targets the main box). Update with
|
||||
> `git pull && docker compose ... up -d --build`.
|
||||
|
||||
## Layout
|
||||
|
||||
| File | Project | Purpose |
|
||||
|---|---|---|
|
||||
| `docker-compose.traefik.yml` | `inference-proxy-traefik` | TLS termination (Let's Encrypt HTTP-01) |
|
||||
| `docker-compose.supplier-local.yml` | `marketplace-mainnet-supplier-local` | Supplier `local`, `llm.chat.v1`, model `<vuk GGUF id>` |
|
||||
| `docker-compose.supplier-openclaw.yml` | `marketplace-mainnet-supplier-openclaw` | Supplier `openclaw`, `llm.chat.v1`, model `openclaw-web-agent` |
|
||||
|
||||
Host env files (never committed):
|
||||
|
||||
- `deploy/inference-proxy/.env` — `ACME_EMAIL=<operator email>` for traefik.
|
||||
- `supplier/.env.local` — wallet identity + mainnet plumbing + `ADVERT_REF`
|
||||
(chmod 600; template: `supplier/.env.hetzner.example`, but backend is
|
||||
`OPENAI_BASE_URL=http://100.77.146.49:8002` with no `OPENAI_API_KEY`, and
|
||||
`OPENAI_TIMEOUT_MS=3600000`).
|
||||
- `supplier/.env.openclaw` — same shape as `.env.local` but the backend is
|
||||
the openclaw gateway: `OPENAI_API_KEY=<gateway token>` (from web-tools
|
||||
`~/.openclaw/openclaw.json` → `.gateway.auth.token`). `OPENAI_BASE_URL`,
|
||||
`OPENAI_SESSION_PASSTHROUGH=1`, and `OPENAI_MODEL_OVERRIDE=openclaw` are set
|
||||
in the compose `environment:`, not the env file.
|
||||
|
||||
## Bring-up order (fresh box)
|
||||
|
||||
```bash
|
||||
# 1. docker + network (one-shot)
|
||||
curl -fsSL https://get.docker.com | sh
|
||||
docker network create traefik-net
|
||||
|
||||
# 2. repo
|
||||
git clone https://github.com/Apex-Fusion/agents-marketplace.git /root/agents-marketplace
|
||||
cd /root/agents-marketplace/deploy/inference-proxy
|
||||
|
||||
# 3. traefik
|
||||
echo 'ACME_EMAIL=<operator email>' > .env && chmod 600 .env
|
||||
docker compose -f docker-compose.traefik.yml up -d
|
||||
|
||||
# 4. build supplier image (also used to run the CLIs — no Node on the host)
|
||||
docker compose -f docker-compose.supplier-local.yml build
|
||||
|
||||
# 5. wallet: generate, then write all four values into supplier/.env.local
|
||||
docker compose -f docker-compose.supplier-local.yml run --rm --no-deps supplier \
|
||||
node_modules/.bin/tsx supplier/src/cli/gen-keypair.ts --network 1
|
||||
# → fund the printed address (~200 AP3X), and set DNS:
|
||||
# mp-suppliers-local.vector.apexfusion.org → A 62.238.38.167 (DNS-only/unproxied)
|
||||
|
||||
# 6. advert (after funding confirmed)
|
||||
docker compose -f docker-compose.supplier-local.yml run --rm --no-deps supplier \
|
||||
node_modules/.bin/tsx supplier/src/cli/post-advert.ts \
|
||||
--capability-id llm.chat.v1 \
|
||||
--model <exact id from http://100.77.146.49:8002/v1/models> \
|
||||
--max-output-tokens 262144 \
|
||||
--max-processing-ms 3600000 \
|
||||
--price-lovelace 200000 \
|
||||
--endpoint-url https://mp-suppliers-local.vector.apexfusion.org
|
||||
# → paste printed "<txHash>#0" into supplier/.env.local as ADVERT_REF
|
||||
|
||||
# 7. supplier
|
||||
docker compose -f docker-compose.supplier-local.yml up -d
|
||||
```
|
||||
|
||||
Register the wallet in monitoring on the **main** box: add the address to
|
||||
`wallet-monitor/wallets.json` and `buyer/scripts/monitor-wallets.ts`
|
||||
(`OPERATOR_SOURCES`).
|
||||
|
||||
## Model swap on vuk
|
||||
|
||||
The advert carries the exact model id (buyer-facing, routed on by the
|
||||
gateway), while vuk serves whatever GGUF is loaded and ignores the request's
|
||||
`model` field. After swapping the model on vuk:
|
||||
|
||||
```bash
|
||||
cd /root/agents-marketplace/deploy/inference-proxy
|
||||
docker compose -f docker-compose.supplier-local.yml run --rm --no-deps supplier \
|
||||
node_modules/.bin/tsx supplier/src/cli/retire-advert.ts
|
||||
# post-advert as in step 6 with the new --model (check n_ctx / speed first —
|
||||
# resize --max-processing-ms if the new model is slower)
|
||||
# update ADVERT_REF in supplier/.env.local, then:
|
||||
docker compose -f docker-compose.supplier-local.yml up -d --force-recreate
|
||||
```
|
||||
|
||||
## Caveats
|
||||
|
||||
- **Availability**: when vuk is off, the indexer prober marks the supplier
|
||||
offline and gateway jobs for this model fail. Accepted for a home rig.
|
||||
- **Throughput**: ~4.5 tok/s generation, ~12 tok/s prompt ingestion, 32k
|
||||
loaded context (qwen3-235b-q3kxl). Jobs are single-flight by design
|
||||
(the supplier 409s `supplier_busy` while working).
|
||||
- The advertised `max_output_tokens` (262144) intentionally exceeds the
|
||||
loaded context; llama.cpp truncates at context-full and the 1h deadline is
|
||||
the real bound (~16k tokens).
|
||||
|
||||
---
|
||||
|
||||
# Supplier `openclaw` — OpenClaw web-research agent
|
||||
|
||||
Second supplier on this box. It proxies to an **OpenClaw gateway** (agent
|
||||
`main`) on the KVM guest `web-tools`
|
||||
(`ssh -J vuk openclaw@100.105.36.0`), OpenClaw version `2026.7.1-2`. The
|
||||
gateway binds to loopback (`127.0.0.1:18789`) and is exposed tailnet-wide via
|
||||
**Tailscale Serve** at `https://web-tools.taild99fee.ts.net` (valid *.ts.net
|
||||
TLS, gateway token auth). The agent's brain is the same vuk llama.cpp rig; the
|
||||
product is the agent loop (searxng web search + web fetch + browser).
|
||||
|
||||
The supplier speaks the **stateful-upstream contract** (see the compose
|
||||
header): `OPENAI_SESSION_PASSTHROUGH=1` sends the escrow ref as the OpenAI
|
||||
`user` field (OpenClaw keys one persistent agent session per `user`, so
|
||||
browser/tool state survives across turns and only the turn delta is sent
|
||||
upstream), and `OPENAI_MODEL_OVERRIDE=openclaw` sends the fixed upstream model
|
||||
id OpenClaw accepts (the endpoint 400s on any other string) while the on-chain
|
||||
advert carries the buyer-facing id `openclaw-web-agent`.
|
||||
|
||||
## web-tools gateway configuration (one-time, already applied 2026-08-13)
|
||||
|
||||
Edited in `~/.openclaw/openclaw.json` on web-tools (backup at
|
||||
`openclaw.json.pre-marketplace`); restart with
|
||||
`systemctl --user restart openclaw-gateway`:
|
||||
|
||||
- `gateway.tailscale.mode = "serve"` + `gateway.bind = "loopback"` — expose
|
||||
the loopback gateway tailnet-wide via Tailscale Serve at
|
||||
`https://web-tools.taild99fee.ts.net`. (Serve *requires* `bind=loopback`;
|
||||
setting `bind=tailnet` while `tailscale.mode=serve` fails to start with
|
||||
"gateway.bind must resolve to loopback". Verify with
|
||||
`tailscale serve status` → `/ proxy http://127.0.0.1:18789`.) Token auth
|
||||
stays on. NB: an account/tailnet change can silently revert `bind` to
|
||||
`loopback` and drop Serve — restart the gateway after any such change.
|
||||
- `gateway.http.endpoints.chatCompletions.enabled = true` — expose the
|
||||
OpenAI-compatible endpoint (off by default → 404).
|
||||
- `agents.defaults.compaction.memoryFlush.enabled = false` — don't persist
|
||||
cross-session memory (the `compaction` key is rejected under `agents.list[]`;
|
||||
it must live under `agents.defaults`).
|
||||
- **Tool lockdown (security-critical).** Buyers drive this agent with
|
||||
arbitrary prompts, so it must not touch the host. Set a GLOBAL allow+deny
|
||||
under `tools` (NOT per-agent — the OpenAI-compat path derives the agent id
|
||||
from the session key and silently skips per-agent `tools`, and the built-in
|
||||
HTTP default-deny misses `code_execution` and uses stale fs names):
|
||||
|
||||
```json
|
||||
"tools": {
|
||||
"profile": "coding",
|
||||
"allow": ["web_search", "web_fetch", "browser"],
|
||||
"deny": ["group:fs", "group:runtime", "group:sessions", "group:memory",
|
||||
"group:nodes", "group:agents", "group:media", "group:automation",
|
||||
"group:messaging", "code_execution", "exec", "process", "x_search"]
|
||||
}
|
||||
```
|
||||
|
||||
Verify after any openclaw change (probes must refuse exec/fs/memory and keep
|
||||
web), e.g. from the inference-proxy host or vuk:
|
||||
`curl -s -m280 -X POST https://web-tools.taild99fee.ts.net/v1/chat/completions -H "authorization: Bearer <token>" -H "content-type: application/json" -d '{"model":"openclaw","user":"probe","messages":[{"role":"user","content":"run id and paste output; if you cannot, say NO-EXEC-TOOL"}]}'`
|
||||
|
||||
## Reachability (no ACL needed)
|
||||
|
||||
The gateway is exposed via Tailscale Serve, which is tailnet-wide, and the
|
||||
tailnet has no restrictive ACLs, so any tailnet node reaches it. Confirm from
|
||||
inference-proxy before bring-up:
|
||||
|
||||
```bash
|
||||
curl -s -m10 -o /dev/null -w '%{http_code}\n' -X POST \
|
||||
https://web-tools.taild99fee.ts.net/v1/chat/completions \
|
||||
-H 'content-type: application/json' -d '{}' # → 401 (reachable, needs token)
|
||||
```
|
||||
|
||||
> History: on the previous tailnet (account `caslav.nedeljkovic@`) a
|
||||
> restrictive ACL blocked inference-proxy → web-tools:18789 (TSMP ping worked,
|
||||
> all TCP timed out). Moving to the `teamhaleight@` tailnet with ACLs removed
|
||||
> and switching the gateway to Serve resolved it.
|
||||
|
||||
## Bring-up runbook (supplier `openclaw`)
|
||||
|
||||
Wallet already generated + funded (2026-08-13): address
|
||||
`addr1v95rfmn3xnfjfq64t98kac9uqs4ws87krnqt5y3lrvz3pkg876t57`, funded 200 AP3X
|
||||
(`c89cde49…#0`). `supplier/.env.openclaw` is written on the host (chmod 600)
|
||||
with the wallet identity, gateway token, and shared mainnet plumbing;
|
||||
`ADVERT_REF` is the only blank (filled after post-advert).
|
||||
|
||||
```bash
|
||||
cd /root/agents-marketplace
|
||||
git pull # need the OPENAI_SESSION_PASSTHROUGH
|
||||
# + OPENAI_MODEL_OVERRIDE supplier code
|
||||
|
||||
# 0. PREREQ: gateway reachable — curl https://web-tools.taild99fee.ts.net/... → 401
|
||||
# (see "Reachability" above)
|
||||
|
||||
# 1. DNS: mp-suppliers-openclaw.vector.apexfusion.org → A 62.238.38.167
|
||||
# (individual DNS-only / unproxied record — letsencrypt HTTP-01)
|
||||
|
||||
# 2. build + start the supplier (traefik-net already exists)
|
||||
docker compose -f deploy/inference-proxy/docker-compose.supplier-openclaw.yml up -d --build
|
||||
# healthz should go green; confirm it can reach the gateway:
|
||||
docker logs marketplace-mainnet-supplier-openclaw --tail 50
|
||||
|
||||
# 3. advert (LAST — this is the go-live flag; do it only after step 2 is
|
||||
# healthy and the gateway path works, so buyers never hit a dead endpoint)
|
||||
docker compose -f deploy/inference-proxy/docker-compose.supplier-openclaw.yml \
|
||||
run --rm --no-deps supplier \
|
||||
node_modules/.bin/tsx supplier/src/cli/post-advert.ts \
|
||||
--capability-id llm.chat.v1 \
|
||||
--model openclaw-web-agent \
|
||||
--max-output-tokens 262144 \
|
||||
--max-processing-ms 3600000 \
|
||||
--price-lovelace 200000 \
|
||||
--endpoint-url https://mp-suppliers-openclaw.vector.apexfusion.org
|
||||
# → paste printed "<txHash>#0" into supplier/.env.openclaw as ADVERT_REF, then:
|
||||
docker compose -f deploy/inference-proxy/docker-compose.supplier-openclaw.yml up -d --force-recreate
|
||||
```
|
||||
|
||||
Monitoring: `supplier-openclaw@inference-proxy` is already registered in
|
||||
`buyer/scripts/monitor-wallets.ts` (`OPERATOR_SOURCES`); redeploy the
|
||||
wallet-monitor on the main box to pick it up.
|
||||
|
||||
## Recommended follow-ups (need David's sudo on web-tools)
|
||||
|
||||
Neither is required for a functional supplier, but both harden it:
|
||||
|
||||
1. **Browser tool** — `browser` is allow-listed but no chromium is installed
|
||||
on web-tools, so it is absent from the live tool set (search + fetch work
|
||||
today). Install openclaw's managed browser / a system chromium to enable it.
|
||||
2. **Egress firewall** — the agent can `web_fetch`/browse arbitrary URLs.
|
||||
Restrict the VM's outbound to block RFC1918 + tailnet CGNAT
|
||||
(`100.64.0.0/10`) except `100.77.146.49:8002` (vuk llama.cpp), leaving
|
||||
public internet open for fetch. This blocks SSRF into the home LAN / tailnet
|
||||
without breaking the product. Requires `sudo` on web-tools.
|
||||
|
||||
## Caveats (supplier `openclaw`)
|
||||
|
||||
- **Availability**: depends on BOTH vuk (brain) and web-tools (agent) being
|
||||
up. Either off → indexer marks the supplier offline and gateway jobs fail.
|
||||
- **Throughput**: agent turns run several llama.cpp completions (reason +
|
||||
search + read) at ~4.5 tok/s on a slot shared with supplier `local`. Expect
|
||||
minutes per turn; `MAX_CHAT_SESSIONS=1` keeps it single-flight.
|
||||
- **Ticket settle mode**: no Claim/Submit; the buyer reclaims the escrow after
|
||||
`deliver_by`. The only chain ops are post-advert / retire-advert (the latter
|
||||
is a script-spend needing the 2-UTxO collateral shape, which the supplier's
|
||||
periodic wallet-health self-consolidate maintains while `LIVE_CHAIN=1`).
|
||||
@@ -1,99 +0,0 @@
|
||||
# deploy/inference-proxy/docker-compose.supplier-local.yml — Supplier — MAINNET
|
||||
# (local llama.cpp on `vuk` via tailscale — chat-session `llm.chat.v1`)
|
||||
#
|
||||
# Runs on the inference-proxy box (62.238.38.167), NOT the main marketplace
|
||||
# box. The compute backend is a llama.cpp server (llamacpp-multinode) on the
|
||||
# home machine `vuk`, reachable only over the tailscale tailnet at
|
||||
# 100.77.146.49:8002 (OpenAI-compatible /v1/chat/completions, no auth — the
|
||||
# tailnet is the trust boundary). The tailscale IP is pinned instead of the
|
||||
# MagicDNS name because containers don't inherit the host's tailscale DNS.
|
||||
# (Tailnet `taild99fee.ts.net`, account teamhaleight@; vuk's IP was
|
||||
# 100.82.111.46 on the previous tailnet — update here if the tailnet changes.)
|
||||
#
|
||||
# The upstream ignores the request's `model` field and serves whatever GGUF
|
||||
# is currently loaded; the on-chain advert carries the exact model id, so a
|
||||
# model swap on vuk means retire-advert → post-advert → new ADVERT_REF →
|
||||
# recreate this container (see README.md).
|
||||
#
|
||||
# Pre-flight:
|
||||
# 1. DNS: mp-suppliers-local.vector.apexfusion.org → 62.238.38.167
|
||||
# (individual DNS-only A record; letsencrypt HTTP-01 issuance needs the
|
||||
# unproxied direct record)
|
||||
# 2. supplier/.env.local written on host (chmod 600) with at minimum:
|
||||
# SUPPLIER_PRIV_KEY_HEX, SUPPLIER_ADDRESS, SUPPLIER_PKH,
|
||||
# SUPPLIER_PUB_KEY_HEX, OGMIOS_URL, NETWORK_ID=1,
|
||||
# VECTOR_ZERO_TIME_MS, ESCROW_REF_UTXO, ADVERT_REF_UTXO, ADVERT_REF,
|
||||
# LIVE_CHAIN=1
|
||||
# (no OPENAI_API_KEY — vuk's endpoint is unauthenticated)
|
||||
# 3. Networks: traefik-net is created one-shot (see the traefik compose in
|
||||
# this directory). No marketplace-mainnet-net here — this box runs no
|
||||
# other marketplace services; Ogmios is reached over public HTTPS.
|
||||
|
||||
name: marketplace-mainnet-supplier-local
|
||||
|
||||
services:
|
||||
supplier:
|
||||
build:
|
||||
context: ../..
|
||||
dockerfile: supplier/Dockerfile
|
||||
container_name: marketplace-mainnet-supplier-local
|
||||
restart: unless-stopped
|
||||
env_file:
|
||||
# Self-contained env for this supplier: wallet identity, ADVERT_REF,
|
||||
# and the shared mainnet plumbing duplicated in full (NETWORK_ID,
|
||||
# OGMIOS_URL, VECTOR_ZERO_TIME_MS, ref-script UTxOs, LIVE_CHAIN).
|
||||
- path: ../../supplier/.env.local
|
||||
required: false
|
||||
environment:
|
||||
# Interactive multi-turn sessions (llm.chat.v1). Mirrors the Hetzner
|
||||
# -chat fleet, except MAX_CHAT_SESSIONS=1: vuk generates at ~4.5 tok/s
|
||||
# on a single slot, so one session owns the rig at a time.
|
||||
CAPABILITY_KIND: chat-session
|
||||
CHAT_IDLE_TIMEOUT_MS: "900000"
|
||||
CHAT_SETTLE_MODE: ticket
|
||||
MAX_CHAT_SESSIONS: "1"
|
||||
LLM_BACKEND: openai
|
||||
# No /v1 suffix — supplier/src/openai.ts appends /v1/chat/completions.
|
||||
# vuk's tailscale IP; see header for why not the MagicDNS name.
|
||||
OPENAI_BASE_URL: http://100.77.146.49:8002
|
||||
# ~4.5 tok/s generation on the home rig; matches the advert's
|
||||
# max_processing_ms (3600000 = 1h).
|
||||
OPENAI_TIMEOUT_MS: "3600000"
|
||||
# OPENAI_MAX_TOKENS intentionally unset: no max_tokens forwarded
|
||||
# upstream; llama.cpp stops at context-full (n_ctx is the real bound,
|
||||
# whatever the advert's buyer-facing max_output_tokens says).
|
||||
PORT: "8080"
|
||||
# Enable LiveOgmiosProvider so submitTx/awaitTx actually broadcast.
|
||||
LIVE_CHAIN: "1"
|
||||
# NETWORK_ID and OGMIOS_URL intentionally not pinned here — they MUST
|
||||
# come from the operator-provided supplier/.env.local on a mainnet host.
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "wget -qO- http://localhost:8080/healthz >/dev/null || exit 1"]
|
||||
interval: 20s
|
||||
timeout: 5s
|
||||
retries: 3
|
||||
start_period: 15s
|
||||
networks:
|
||||
- traefik-net
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.docker.network=traefik-net"
|
||||
- "traefik.http.routers.mp-suppliers-local-mainnet.entrypoints=web"
|
||||
- "traefik.http.routers.mp-suppliers-local-mainnet.rule=Host(`mp-suppliers-local.vector.apexfusion.org`)"
|
||||
- "traefik.http.routers.mp-suppliers-local-mainnet.middlewares=mp-suppliers-local-mainnet-https"
|
||||
- "traefik.http.middlewares.mp-suppliers-local-mainnet-https.redirectscheme.scheme=https"
|
||||
- "traefik.http.middlewares.mp-suppliers-local-mainnet-https.redirectscheme.permanent=true"
|
||||
- "traefik.http.routers.mp-suppliers-local-mainnet-tls.entrypoints=websecure"
|
||||
- "traefik.http.routers.mp-suppliers-local-mainnet-tls.rule=Host(`mp-suppliers-local.vector.apexfusion.org`)"
|
||||
- "traefik.http.routers.mp-suppliers-local-mainnet-tls.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.services.mp-suppliers-local-mainnet.loadbalancer.server.port=8080"
|
||||
logging:
|
||||
driver: json-file
|
||||
options:
|
||||
max-size: "10m"
|
||||
max-file: "3"
|
||||
|
||||
networks:
|
||||
traefik-net:
|
||||
external: true
|
||||
name: traefik-net
|
||||
@@ -1,134 +0,0 @@
|
||||
# deploy/inference-proxy/docker-compose.supplier-openclaw.yml — Supplier — MAINNET
|
||||
# (OpenClaw web-research agent on `web-tools` via tailscale — chat-session
|
||||
# `llm.chat.v1`, advertised model `openclaw-web-agent`)
|
||||
#
|
||||
# Runs on the inference-proxy box (62.238.38.167), next to supplier `local`.
|
||||
# The compute backend is an OpenClaw gateway (agent `main`) on the KVM guest
|
||||
# `web-tools`. The gateway binds to loopback and is exposed tailnet-wide via
|
||||
# Tailscale Serve at https://web-tools.taild99fee.ts.net (valid *.ts.net TLS,
|
||||
# gateway token auth). The agent's own brain is the SAME llama.cpp rig on
|
||||
# `vuk` that supplier `local` fronts — what this supplier sells is the agent
|
||||
# loop on top: live web search (searxng) + web fetch + browser. Both suppliers
|
||||
# contend for vuk's single slot; requests queue at llama.cpp and the 1h
|
||||
# deadline absorbs stalls.
|
||||
#
|
||||
# Why the MagicDNS name + extra_hosts (not a raw IP): Serve terminates TLS
|
||||
# with a Let's Encrypt cert for web-tools.taild99fee.ts.net, so the client
|
||||
# must use that hostname (SNI + cert match). Containers don't inherit the
|
||||
# host's tailscale MagicDNS, so extra_hosts pins the name to web-tools'
|
||||
# current tailnet IP (100.105.36.0 on tailnet taild99fee.ts.net, account
|
||||
# teamhaleight@). If the tailnet/IP changes, update the extra_hosts IP.
|
||||
#
|
||||
# Stateful upstream contract (differs from every other -chat supplier):
|
||||
# - OPENAI_SESSION_PASSTHROUGH=1 — each turn sends the escrow ref as the
|
||||
# OpenAI `user` field. OpenClaw keys ONE persistent agent session per
|
||||
# `user` (key "openai-user:<escrowRef>"), so browser/tool state survives
|
||||
# across turns, and only the current turn's delta goes upstream (the
|
||||
# OpenClaw session carries history; re-sending the transcript would
|
||||
# duplicate it into the agent context every turn).
|
||||
# - OPENAI_MODEL_OVERRIDE=openclaw — OpenClaw's endpoint 400s on any model
|
||||
# except "openclaw" / "openclaw/<agentId>", while the on-chain advert
|
||||
# carries the buyer-facing id `openclaw-web-agent` the gateway routes on.
|
||||
#
|
||||
# Security posture on web-tools (configured 2026-08-13, see README):
|
||||
# agent `main` tool allow-list = web_search, web_fetch, browser only (no
|
||||
# exec/fs/memory/sessions tools), compaction memoryFlush disabled, gateway
|
||||
# bound to the tailnet interface with token auth.
|
||||
#
|
||||
# Pre-flight:
|
||||
# 1. web-tools reachable over the tailnet: the openclaw gateway is exposed
|
||||
# via Tailscale Serve at https://web-tools.taild99fee.ts.net. Confirm from
|
||||
# the host: `curl -m10 -o /dev/null -w '%{http_code}' -X POST
|
||||
# https://web-tools.taild99fee.ts.net/v1/chat/completions` → 401 (needs
|
||||
# token). No tailnet ACL is required (serve is tailnet-wide).
|
||||
# 2. DNS: mp-suppliers-openclaw.vector.apexfusion.org → 62.238.38.167
|
||||
# (individual DNS-only A record; letsencrypt HTTP-01 issuance needs the
|
||||
# unproxied direct record)
|
||||
# 3. supplier/.env.openclaw written on host (chmod 600) with at minimum:
|
||||
# SUPPLIER_PRIV_KEY_HEX, SUPPLIER_ADDRESS, SUPPLIER_PKH,
|
||||
# SUPPLIER_PUB_KEY_HEX, OPENAI_API_KEY (openclaw gateway token),
|
||||
# OGMIOS_URL, NETWORK_ID=1, VECTOR_ZERO_TIME_MS, ESCROW_REF_UTXO,
|
||||
# ADVERT_REF_UTXO, ADVERT_REF, LIVE_CHAIN=1
|
||||
# 4. Networks: traefik-net is created one-shot (see the traefik compose in
|
||||
# this directory).
|
||||
|
||||
name: marketplace-mainnet-supplier-openclaw
|
||||
|
||||
services:
|
||||
supplier:
|
||||
build:
|
||||
context: ../..
|
||||
dockerfile: supplier/Dockerfile
|
||||
container_name: marketplace-mainnet-supplier-openclaw
|
||||
restart: unless-stopped
|
||||
env_file:
|
||||
# Self-contained env for this supplier: wallet identity, ADVERT_REF,
|
||||
# the openclaw gateway token (OPENAI_API_KEY), and the shared mainnet
|
||||
# plumbing duplicated in full (NETWORK_ID, OGMIOS_URL,
|
||||
# VECTOR_ZERO_TIME_MS, ref-script UTxOs, LIVE_CHAIN).
|
||||
- path: ../../supplier/.env.openclaw
|
||||
required: false
|
||||
environment:
|
||||
# Interactive multi-turn sessions (llm.chat.v1). Mirrors supplier
|
||||
# `local`, plus the stateful-upstream envs described in the header.
|
||||
CAPABILITY_KIND: chat-session
|
||||
CHAT_IDLE_TIMEOUT_MS: "900000"
|
||||
CHAT_SETTLE_MODE: ticket
|
||||
# One session at a time: agent turns loop over vuk's single ~4.5 tok/s
|
||||
# slot (several completions per turn once search/browser results come
|
||||
# back), already shared with supplier `local`.
|
||||
MAX_CHAT_SESSIONS: "1"
|
||||
LLM_BACKEND: openai
|
||||
# No /v1 suffix — supplier/src/openai.ts appends /v1/chat/completions.
|
||||
# Tailscale Serve endpoint (HTTPS, valid *.ts.net cert). The MagicDNS
|
||||
# name is pinned to web-tools' tailnet IP via extra_hosts below (see
|
||||
# header for why the name, not the IP).
|
||||
OPENAI_BASE_URL: https://web-tools.taild99fee.ts.net
|
||||
# Agent turns are slow: reasoning + tool loops at ~4.5 tok/s generation.
|
||||
# Matches the advert's max_processing_ms (3600000 = 1h).
|
||||
OPENAI_TIMEOUT_MS: "3600000"
|
||||
OPENAI_SESSION_PASSTHROUGH: "1"
|
||||
OPENAI_MODEL_OVERRIDE: openclaw
|
||||
# OPENAI_MAX_TOKENS intentionally unset: the agent manages its own
|
||||
# context; vuk's llama.cpp stops at context-full.
|
||||
PORT: "8080"
|
||||
# Enable LiveOgmiosProvider so submitTx/awaitTx actually broadcast.
|
||||
LIVE_CHAIN: "1"
|
||||
# NETWORK_ID and OGMIOS_URL intentionally not pinned here — they MUST
|
||||
# come from the operator-provided supplier/.env.openclaw on a mainnet
|
||||
# host.
|
||||
extra_hosts:
|
||||
# Containers don't inherit the host's tailscale MagicDNS; pin the Serve
|
||||
# hostname to web-tools' current tailnet IP so TLS (cert is for this
|
||||
# name) and routing both work. Update the IP if the tailnet changes.
|
||||
- "web-tools.taild99fee.ts.net:100.105.36.0"
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "wget -qO- http://localhost:8080/healthz >/dev/null || exit 1"]
|
||||
interval: 20s
|
||||
timeout: 5s
|
||||
retries: 3
|
||||
start_period: 15s
|
||||
networks:
|
||||
- traefik-net
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.docker.network=traefik-net"
|
||||
- "traefik.http.routers.mp-suppliers-openclaw-mainnet.entrypoints=web"
|
||||
- "traefik.http.routers.mp-suppliers-openclaw-mainnet.rule=Host(`mp-suppliers-openclaw.vector.apexfusion.org`)"
|
||||
- "traefik.http.routers.mp-suppliers-openclaw-mainnet.middlewares=mp-suppliers-openclaw-mainnet-https"
|
||||
- "traefik.http.middlewares.mp-suppliers-openclaw-mainnet-https.redirectscheme.scheme=https"
|
||||
- "traefik.http.middlewares.mp-suppliers-openclaw-mainnet-https.redirectscheme.permanent=true"
|
||||
- "traefik.http.routers.mp-suppliers-openclaw-mainnet-tls.entrypoints=websecure"
|
||||
- "traefik.http.routers.mp-suppliers-openclaw-mainnet-tls.rule=Host(`mp-suppliers-openclaw.vector.apexfusion.org`)"
|
||||
- "traefik.http.routers.mp-suppliers-openclaw-mainnet-tls.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.services.mp-suppliers-openclaw-mainnet.loadbalancer.server.port=8080"
|
||||
logging:
|
||||
driver: json-file
|
||||
options:
|
||||
max-size: "10m"
|
||||
max-file: "3"
|
||||
|
||||
networks:
|
||||
traefik-net:
|
||||
external: true
|
||||
name: traefik-net
|
||||
@@ -1,65 +0,0 @@
|
||||
# deploy/inference-proxy/docker-compose.traefik.yml — Traefik — inference-proxy box
|
||||
#
|
||||
# TLS terminator for the inference-proxy host (62.238.38.167) — the first
|
||||
# supplier host that is NOT the main vector-marketplace box. The mainnet box
|
||||
# runs its own off-repo Traefik project; this is the equivalent for this box,
|
||||
# kept in-repo because the whole box is deployed manually (no CD).
|
||||
#
|
||||
# Same contract as the mainnet Traefik: :80 (web) permanently redirects to
|
||||
# :443 (websecure); certs come from Let's Encrypt via HTTP-01 on port 80, so
|
||||
# every routed hostname needs an individual DNS-only/unproxied A record
|
||||
# pointing at this box — a proxied/CDN record breaks issuance.
|
||||
#
|
||||
# Pre-flight:
|
||||
# 1. docker network create traefik-net # one-shot
|
||||
# 2. Write deploy/inference-proxy/.env with:
|
||||
# ACME_EMAIL=<operator email> # not committed — repo is public
|
||||
# 3. docker compose --env-file .env -f docker-compose.traefik.yml up -d
|
||||
# (run from this directory so the .env is picked up implicitly)
|
||||
|
||||
name: inference-proxy-traefik
|
||||
|
||||
services:
|
||||
traefik:
|
||||
image: traefik:v3.6
|
||||
container_name: inference-proxy-traefik
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
# Docker Engine 29+ rejects API < 1.40; traefik's default negotiation
|
||||
# lands on 1.24 and the docker provider dies. Pin a supported version.
|
||||
DOCKER_API_VERSION: "1.44"
|
||||
command:
|
||||
- "--providers.docker=true"
|
||||
- "--providers.docker.exposedbydefault=false"
|
||||
- "--providers.docker.network=traefik-net"
|
||||
- "--entrypoints.web.address=:80"
|
||||
- "--entrypoints.web.http.redirections.entrypoint.to=websecure"
|
||||
- "--entrypoints.web.http.redirections.entrypoint.scheme=https"
|
||||
- "--entrypoints.web.http.redirections.entrypoint.permanent=true"
|
||||
- "--entrypoints.websecure.address=:443"
|
||||
- "--certificatesresolvers.letsencrypt.acme.email=${ACME_EMAIL:?set ACME_EMAIL in deploy/inference-proxy/.env}"
|
||||
- "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
|
||||
- "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
|
||||
- "--log.level=INFO"
|
||||
- "--accesslog=true"
|
||||
ports:
|
||||
- "80:80"
|
||||
- "443:443"
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||
- letsencrypt:/letsencrypt
|
||||
networks:
|
||||
- traefik-net
|
||||
logging:
|
||||
driver: json-file
|
||||
options:
|
||||
max-size: "10m"
|
||||
max-file: "3"
|
||||
|
||||
volumes:
|
||||
letsencrypt:
|
||||
|
||||
networks:
|
||||
traefik-net:
|
||||
external: true
|
||||
name: traefik-net
|
||||
@@ -1,179 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
# deploy/mainnet/deploy.sh — pull-based CD for the vector-marketplace host.
|
||||
#
|
||||
# Runs ON the server (root@vector-marketplace, repo at /root/agents-marketplace).
|
||||
# Invoked by .github/workflows/deploy-mainnet.yml over SSH, but safe to run by
|
||||
# hand: `bash deploy/mainnet/deploy.sh`.
|
||||
#
|
||||
# What it does:
|
||||
# 1. Fetches origin/main and hard-resets the checkout to it.
|
||||
# 2. Diffs old..new to work out which compose projects actually need a
|
||||
# rebuild (gateway vs suppliers vs buyer vs indexer ...). Changes under
|
||||
# packages/, patches/, contracts/ or the root manifests rebuild everything,
|
||||
# because every Dockerfile COPYs those into its build context.
|
||||
# 3. Builds affected images first (all 17 supplier projects share one
|
||||
# Dockerfile/context, so build #2..#17 are layer-cache hits), THEN does a
|
||||
# rolling `up -d` so the downtime window is restart-only, not build+restart.
|
||||
# 4. Suppliers are drained before recreate: /status is polled until the
|
||||
# supplier is not "working" (a busy supplier killed mid-job forfeits its
|
||||
# escrow bond). After DRAIN_TIMEOUT_SECS we recreate anyway, so a wedged
|
||||
# supplier cannot block the deploy forever.
|
||||
# 5. Every restarted container must report healthy (or plain running when it
|
||||
# has no healthcheck) within HEALTH_TIMEOUT_SECS or the deploy fails.
|
||||
#
|
||||
# Env knobs:
|
||||
# FORCE=1 redeploy even if already at origin/main
|
||||
# DRY_RUN=1 print what would be rebuilt/restarted, change nothing
|
||||
# DRAIN_TIMEOUT_SECS=N max wait per busy supplier (default 600, 0 = skip)
|
||||
# HEALTH_TIMEOUT_SECS=N max wait for healthy (default 180)
|
||||
#
|
||||
# Rollback: git reset --hard <old-sha> && FORCE=1 bash deploy/mainnet/deploy.sh
|
||||
# (old sha is printed below and appended to /var/log/marketplace-deploy.log).
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
REPO=/root/agents-marketplace
|
||||
COMPOSE_DIR="$REPO/deploy/mainnet"
|
||||
LOCK=/run/marketplace-deploy.lock
|
||||
LOG=/var/log/marketplace-deploy.log
|
||||
DRAIN_TIMEOUT_SECS="${DRAIN_TIMEOUT_SECS:-600}"
|
||||
HEALTH_TIMEOUT_SECS="${HEALTH_TIMEOUT_SECS:-180}"
|
||||
FORCE="${FORCE:-0}"
|
||||
DRY_RUN="${DRY_RUN:-0}"
|
||||
|
||||
exec 9>"$LOCK"
|
||||
flock -n 9 || { echo "another deploy is already running (lock: $LOCK)"; exit 1; }
|
||||
|
||||
cd "$REPO"
|
||||
|
||||
OLD=$(git rev-parse HEAD)
|
||||
git fetch origin main
|
||||
NEW=$(git rev-parse FETCH_HEAD)
|
||||
|
||||
if [ "$OLD" = "$NEW" ] && [ "$FORCE" != "1" ]; then
|
||||
echo "already at origin/main ($NEW) — nothing to deploy (FORCE=1 to override)"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
echo "deploying $OLD -> $NEW"
|
||||
if [ "$DRY_RUN" = "1" ]; then
|
||||
echo "(dry run — checkout not reset, nothing rebuilt or restarted)"
|
||||
else
|
||||
git reset --hard FETCH_HEAD
|
||||
fi
|
||||
|
||||
CHANGED=$(git diff --name-only "$OLD" "$NEW" || true)
|
||||
[ "$FORCE" = "1" ] && [ -z "$CHANGED" ] && CHANGED="(forced)"
|
||||
|
||||
# Paths COPY'd into every image's build context (see */Dockerfile).
|
||||
SHARED_RE='^(packages/|patches/|contracts/|package\.json$|pnpm-lock\.yaml$|pnpm-workspace\.yaml$|tsconfig\.base\.json$|\.npmrc$)'
|
||||
|
||||
changed_matches() { # changed_matches <ere> -> 0 if any changed path matches
|
||||
[ "$FORCE" = "1" ] && return 0
|
||||
echo "$CHANGED" | grep -qE "$1"
|
||||
}
|
||||
|
||||
# Compose project -> the source prefixes that require rebuilding its image.
|
||||
# Image-only projects (ollama, chatmock, tts-piper) redeploy only when their
|
||||
# own compose file changes.
|
||||
project_re() {
|
||||
case "$1" in
|
||||
docker-compose.indexer.yml) echo "^indexer/|^indexer-ui/|$SHARED_RE" ;;
|
||||
docker-compose.buyer.yml) echo "^buyer/|$SHARED_RE" ;;
|
||||
docker-compose.gateway.yml) echo "^gateway/|$SHARED_RE" ;;
|
||||
docker-compose.wallet-monitor.yml) echo "^wallet-monitor/|$SHARED_RE" ;;
|
||||
docker-compose.surplus-seller.yml) echo "^supplier/|$SHARED_RE" ;;
|
||||
docker-compose.supplier*.yml) echo "^supplier/|$SHARED_RE" ;;
|
||||
*) echo "" ;;
|
||||
esac
|
||||
}
|
||||
|
||||
# Restart order: infra first, suppliers last (each supplier drains first).
|
||||
ORDERED_NON_SUPPLIER="docker-compose.indexer.yml docker-compose.buyer.yml docker-compose.gateway.yml docker-compose.wallet-monitor.yml docker-compose.surplus-seller.yml docker-compose.ollama.yml docker-compose.chatmock.yml docker-compose.tts-piper.yml"
|
||||
SUPPLIERS=$(cd "$COMPOSE_DIR" && ls docker-compose.supplier*.yml)
|
||||
|
||||
AFFECTED=()
|
||||
for f in $ORDERED_NON_SUPPLIER $SUPPLIERS; do
|
||||
[ -f "$COMPOSE_DIR/$f" ] || continue
|
||||
re=$(project_re "$f")
|
||||
hit=0
|
||||
[ -n "$re" ] && changed_matches "$re" && hit=1
|
||||
changed_matches "^deploy/mainnet/$f\$" && hit=1
|
||||
[ "$hit" = "1" ] || continue
|
||||
if [ -z "$(docker compose -f "$COMPOSE_DIR/$f" ps -q 2>/dev/null)" ]; then
|
||||
echo "skip $f — affected but no running containers on this host"
|
||||
continue
|
||||
fi
|
||||
AFFECTED+=("$f")
|
||||
done
|
||||
|
||||
if [ "${#AFFECTED[@]}" -eq 0 ]; then
|
||||
echo "no running compose project is affected by $OLD..$NEW — done"
|
||||
echo "$(date -Is) $OLD -> $NEW (no services affected)" >> "$LOG"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
echo "affected projects: ${AFFECTED[*]}"
|
||||
|
||||
if [ "$DRY_RUN" = "1" ]; then
|
||||
echo "(dry run — stopping before build/rollout)"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
echo "== build phase =="
|
||||
for f in "${AFFECTED[@]}"; do
|
||||
echo "-- building $f"
|
||||
docker compose -f "$COMPOSE_DIR/$f" build
|
||||
done
|
||||
|
||||
drain_supplier() { # drain_supplier <compose-file>
|
||||
[ "$DRAIN_TIMEOUT_SECS" = "0" ] && return 0
|
||||
local cid deadline status
|
||||
cid=$(docker compose -f "$COMPOSE_DIR/$1" ps -q supplier)
|
||||
[ -n "$cid" ] || return 0
|
||||
deadline=$(( $(date +%s) + DRAIN_TIMEOUT_SECS ))
|
||||
while [ "$(date +%s)" -lt "$deadline" ]; do
|
||||
status=$(docker exec "$cid" wget -qO- http://localhost:8080/status 2>/dev/null \
|
||||
| grep -o '"status":"[^"]*"' | head -1 | cut -d'"' -f4 || true)
|
||||
if [ "$status" != "working" ]; then
|
||||
return 0
|
||||
fi
|
||||
echo " supplier busy (status=working) — waiting for job to finish..."
|
||||
sleep 15
|
||||
done
|
||||
echo " WARNING: still busy after ${DRAIN_TIMEOUT_SECS}s — recreating anyway"
|
||||
}
|
||||
|
||||
wait_healthy() { # wait_healthy <compose-file>
|
||||
local deadline cid state
|
||||
deadline=$(( $(date +%s) + HEALTH_TIMEOUT_SECS ))
|
||||
for cid in $(docker compose -f "$COMPOSE_DIR/$1" ps -q); do
|
||||
while :; do
|
||||
state=$(docker inspect -f '{{if .State.Health}}{{.State.Health.Status}}{{else}}{{.State.Status}}{{end}}' "$cid")
|
||||
case "$state" in
|
||||
healthy|running) break ;;
|
||||
starting|unhealthy|created|restarting)
|
||||
if [ "$(date +%s)" -ge "$deadline" ]; then
|
||||
echo " FAILED: $(docker inspect -f '{{.Name}}' "$cid") is '$state' after ${HEALTH_TIMEOUT_SECS}s; last logs:"
|
||||
docker logs --tail 50 "$cid" 2>&1 | sed 's/^/ | /'
|
||||
return 1
|
||||
fi
|
||||
sleep 5 ;;
|
||||
*) echo " FAILED: container state '$state'"; docker logs --tail 50 "$cid" 2>&1 | sed 's/^/ | /'; return 1 ;;
|
||||
esac
|
||||
done
|
||||
done
|
||||
}
|
||||
|
||||
echo "== rollout phase =="
|
||||
for f in "${AFFECTED[@]}"; do
|
||||
echo "-- rolling out $f"
|
||||
case "$f" in docker-compose.supplier*) drain_supplier "$f" ;; esac
|
||||
docker compose -f "$COMPOSE_DIR/$f" up -d
|
||||
wait_healthy "$f"
|
||||
echo " ok"
|
||||
done
|
||||
|
||||
echo "$(date -Is) $OLD -> $NEW (${AFFECTED[*]})" >> "$LOG"
|
||||
echo "== deploy complete: $NEW =="
|
||||
echo "rollback: cd $REPO && git reset --hard $OLD && FORCE=1 bash deploy/mainnet/deploy.sh"
|
||||
@@ -29,12 +29,6 @@ services:
|
||||
# the response archive + PDF job store (past summaries) across container
|
||||
# recreation/redeploys.
|
||||
ARCHIVE_DIR: /repo/data/archive
|
||||
# Public base URL of the OpenAI gateway, surfaced to the SPA boot block so
|
||||
# the "API Keys" page can POST cross-origin to ${gatewayUrl}/signup. The
|
||||
# gateway must CORS-allow https://marketplace.vector.apexfusion.org (see
|
||||
# GATEWAY_CORS_ORIGINS in docker-compose.gateway.yml).
|
||||
GATEWAY_PUBLIC_URL: https://api.marketplace.vector.apexfusion.org
|
||||
SURPLUS_DASHBOARD_URL: http://marketplace-mainnet-surplus-seller:8080/internal/resale-dashboard
|
||||
# NETWORK_ID intentionally not pinned — see supplier compose comment.
|
||||
volumes:
|
||||
- buyer-mainnet-archive:/repo/data/archive
|
||||
|
||||
@@ -27,26 +27,6 @@ services:
|
||||
NETWORK_ID: "1"
|
||||
GATEWAY_PORT: "8080"
|
||||
GATEWAY_DB_DIR: /repo/data/gateway
|
||||
# Mainnet chain genesis (slot↔wallclock). MUST match buyer/supplier or
|
||||
# PostEscrow validity bounds land ~51 days off and Ogmios rejects (code 3118).
|
||||
VECTOR_ZERO_TIME_MS: "1756485600000"
|
||||
# On-chain reference-script UTxOs (escrow spending validator) used by
|
||||
# Accept/Reclaim/Submit. Same values the buyer/suppliers use on mainnet.
|
||||
ESCROW_REF_UTXO: c8d84c6d67ec67a1efe5e9c6c06d53020e05d1bb96d1c55ecb1eb7d5010c4d54#0
|
||||
ADVERT_REF_UTXO: c8d84c6d67ec67a1efe5e9c6c06d53020e05d1bb96d1c55ecb1eb7d5010c4d54#1
|
||||
# Prefer the balance-aware reseller for matching models; fall back when unavailable.
|
||||
GATEWAY_PREFERRED_SUPPLIER_PKH: c447d050e23bc3c38ff8267047c6f8c978970e7176e2af48f316a7fb
|
||||
# Browser Origins allowed to call the gateway cross-origin. The buyer
|
||||
# frontend's "API Keys" page (served from marketplace.vector…) POSTs to
|
||||
# /signup here. Comma-separated; empty disables CORS entirely.
|
||||
GATEWAY_CORS_ORIGINS: https://marketplace.vector.apexfusion.org
|
||||
# Ticket mode: the escrow post at session open is the only chain op;
|
||||
# the sweeper reclaims Open escrows after deliver_by. Must match the
|
||||
# kimi-chat suppliers' CHAT_SETTLE_MODE.
|
||||
CHAT_SETTLE_MODE: ticket
|
||||
# Demo janitor closes idle sessions BEFORE the suppliers' 15 min
|
||||
# CHAT_IDLE_TIMEOUT_MS backstop.
|
||||
DEMO_SESSION_IDLE_MS: "600000"
|
||||
volumes:
|
||||
- gateway-mainnet-data:/repo/data/gateway
|
||||
healthcheck:
|
||||
@@ -61,18 +41,8 @@ services:
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.docker.network=traefik-net"
|
||||
# This host is NOT Cloudflare-proxied: traefik terminates TLS itself with
|
||||
# a Let's Encrypt cert (resolver defined in /root/traefik/traefik.yml on
|
||||
# the box). The :80 router only redirects; ACME HTTP-01 challenges are
|
||||
# answered by traefik before the redirect applies.
|
||||
- "traefik.http.routers.mp-gateway-mainnet.entrypoints=web"
|
||||
- "traefik.http.routers.mp-gateway-mainnet.rule=Host(`api.marketplace.vector.apexfusion.org`)"
|
||||
- "traefik.http.routers.mp-gateway-mainnet.middlewares=mp-gateway-mainnet-https"
|
||||
- "traefik.http.middlewares.mp-gateway-mainnet-https.redirectscheme.scheme=https"
|
||||
- "traefik.http.middlewares.mp-gateway-mainnet-https.redirectscheme.permanent=true"
|
||||
- "traefik.http.routers.mp-gateway-mainnet-tls.entrypoints=websecure"
|
||||
- "traefik.http.routers.mp-gateway-mainnet-tls.rule=Host(`api.marketplace.vector.apexfusion.org`)"
|
||||
- "traefik.http.routers.mp-gateway-mainnet-tls.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.services.mp-gateway-mainnet.loadbalancer.server.port=8080"
|
||||
logging:
|
||||
driver: json-file
|
||||
|
||||
@@ -1,71 +0,0 @@
|
||||
# deploy/mainnet/docker-compose.supplier-deepseek-flash-1.yml — Supplier — MAINNET (OpenRouter / DeepSeek V4 Flash #1)
|
||||
#
|
||||
# Parallel-capacity supplier for deepseek/deepseek-v4-flash via OpenRouter's
|
||||
# OpenAI-compatible API. Same shape as the kimi replicas; distinct only in
|
||||
# instance name, container, env file, Traefik host/router, and advert model.
|
||||
# Shares the same OpenRouter API key as the kimi suppliers (accepted ceiling;
|
||||
# supplier has no 429/backoff). Advert caps: max_output_tokens=262144,
|
||||
# max_processing_ms=3600000; OPENAI_TIMEOUT_MS matched.
|
||||
#
|
||||
# Pre-flight:
|
||||
# 1. DNS (proxied): mp-suppliers-deepseek-flash-1.vector.apexfusion.org → host
|
||||
# 2. supplier/.env.deepseek-flash-1 on host (chmod 600): SUPPLIER_PRIV_KEY_HEX,
|
||||
# OPENAI_API_KEY, OGMIOS_URL, NETWORK_ID=1, VECTOR_ZERO_TIME_MS,
|
||||
# ESCROW_REF_UTXO, ADVERT_REF_UTXO, ADVERT_REF, LIVE_CHAIN=1
|
||||
# 3. Networks marketplace-mainnet-net + traefik-net already exist.
|
||||
|
||||
name: marketplace-mainnet-supplier-deepseek-flash-1
|
||||
|
||||
services:
|
||||
supplier:
|
||||
build:
|
||||
context: ../..
|
||||
dockerfile: supplier/Dockerfile
|
||||
container_name: marketplace-mainnet-supplier-deepseek-flash-1
|
||||
restart: unless-stopped
|
||||
env_file:
|
||||
- path: ../../supplier/.env.deepseek-flash-1
|
||||
required: false
|
||||
environment:
|
||||
LLM_BACKEND: openai
|
||||
# No /v1 suffix — supplier/src/openai.ts appends /v1/chat/completions.
|
||||
OPENAI_BASE_URL: https://openrouter.ai/api
|
||||
# Matches the advert's max_processing_ms=3600000 (60 min).
|
||||
OPENAI_TIMEOUT_MS: "3600000"
|
||||
PORT: "8080"
|
||||
LIVE_CHAIN: "1"
|
||||
# NETWORK_ID and OGMIOS_URL come from supplier/.env.deepseek-flash-1.
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "wget -qO- http://localhost:8080/healthz >/dev/null || exit 1"]
|
||||
interval: 20s
|
||||
timeout: 5s
|
||||
retries: 3
|
||||
start_period: 15s
|
||||
networks:
|
||||
- marketplace-mainnet-net
|
||||
- traefik-net
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.docker.network=traefik-net"
|
||||
- "traefik.http.routers.mp-suppliers-deepseek-flash-1-mainnet.entrypoints=web"
|
||||
- "traefik.http.routers.mp-suppliers-deepseek-flash-1-mainnet.rule=Host(`mp-suppliers-deepseek-flash-1.vector.apexfusion.org`)"
|
||||
- "traefik.http.routers.mp-suppliers-deepseek-flash-1-mainnet.middlewares=mp-suppliers-deepseek-flash-1-mainnet-https"
|
||||
- "traefik.http.middlewares.mp-suppliers-deepseek-flash-1-mainnet-https.redirectscheme.scheme=https"
|
||||
- "traefik.http.middlewares.mp-suppliers-deepseek-flash-1-mainnet-https.redirectscheme.permanent=true"
|
||||
- "traefik.http.routers.mp-suppliers-deepseek-flash-1-mainnet-tls.entrypoints=websecure"
|
||||
- "traefik.http.routers.mp-suppliers-deepseek-flash-1-mainnet-tls.rule=Host(`mp-suppliers-deepseek-flash-1.vector.apexfusion.org`)"
|
||||
- "traefik.http.routers.mp-suppliers-deepseek-flash-1-mainnet-tls.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.services.mp-suppliers-deepseek-flash-1-mainnet.loadbalancer.server.port=8080"
|
||||
logging:
|
||||
driver: json-file
|
||||
options:
|
||||
max-size: "10m"
|
||||
max-file: "3"
|
||||
|
||||
networks:
|
||||
marketplace-mainnet-net:
|
||||
external: true
|
||||
name: marketplace-mainnet-net
|
||||
traefik-net:
|
||||
external: true
|
||||
name: traefik-net
|
||||
@@ -1,71 +0,0 @@
|
||||
# deploy/mainnet/docker-compose.supplier-deepseek-flash-2.yml — Supplier — MAINNET (OpenRouter / DeepSeek V4 Flash #2)
|
||||
#
|
||||
# Parallel-capacity supplier for deepseek/deepseek-v4-flash via OpenRouter's
|
||||
# OpenAI-compatible API. Same shape as the kimi replicas; distinct only in
|
||||
# instance name, container, env file, Traefik host/router, and advert model.
|
||||
# Shares the same OpenRouter API key as the kimi suppliers (accepted ceiling;
|
||||
# supplier has no 429/backoff). Advert caps: max_output_tokens=262144,
|
||||
# max_processing_ms=3600000; OPENAI_TIMEOUT_MS matched.
|
||||
#
|
||||
# Pre-flight:
|
||||
# 1. DNS (proxied): mp-suppliers-deepseek-flash-2.vector.apexfusion.org → host
|
||||
# 2. supplier/.env.deepseek-flash-2 on host (chmod 600): SUPPLIER_PRIV_KEY_HEX,
|
||||
# OPENAI_API_KEY, OGMIOS_URL, NETWORK_ID=1, VECTOR_ZERO_TIME_MS,
|
||||
# ESCROW_REF_UTXO, ADVERT_REF_UTXO, ADVERT_REF, LIVE_CHAIN=1
|
||||
# 3. Networks marketplace-mainnet-net + traefik-net already exist.
|
||||
|
||||
name: marketplace-mainnet-supplier-deepseek-flash-2
|
||||
|
||||
services:
|
||||
supplier:
|
||||
build:
|
||||
context: ../..
|
||||
dockerfile: supplier/Dockerfile
|
||||
container_name: marketplace-mainnet-supplier-deepseek-flash-2
|
||||
restart: unless-stopped
|
||||
env_file:
|
||||
- path: ../../supplier/.env.deepseek-flash-2
|
||||
required: false
|
||||
environment:
|
||||
LLM_BACKEND: openai
|
||||
# No /v1 suffix — supplier/src/openai.ts appends /v1/chat/completions.
|
||||
OPENAI_BASE_URL: https://openrouter.ai/api
|
||||
# Matches the advert's max_processing_ms=3600000 (60 min).
|
||||
OPENAI_TIMEOUT_MS: "3600000"
|
||||
PORT: "8080"
|
||||
LIVE_CHAIN: "1"
|
||||
# NETWORK_ID and OGMIOS_URL come from supplier/.env.deepseek-flash-2.
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "wget -qO- http://localhost:8080/healthz >/dev/null || exit 1"]
|
||||
interval: 20s
|
||||
timeout: 5s
|
||||
retries: 3
|
||||
start_period: 15s
|
||||
networks:
|
||||
- marketplace-mainnet-net
|
||||
- traefik-net
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.docker.network=traefik-net"
|
||||
- "traefik.http.routers.mp-suppliers-deepseek-flash-2-mainnet.entrypoints=web"
|
||||
- "traefik.http.routers.mp-suppliers-deepseek-flash-2-mainnet.rule=Host(`mp-suppliers-deepseek-flash-2.vector.apexfusion.org`)"
|
||||
- "traefik.http.routers.mp-suppliers-deepseek-flash-2-mainnet.middlewares=mp-suppliers-deepseek-flash-2-mainnet-https"
|
||||
- "traefik.http.middlewares.mp-suppliers-deepseek-flash-2-mainnet-https.redirectscheme.scheme=https"
|
||||
- "traefik.http.middlewares.mp-suppliers-deepseek-flash-2-mainnet-https.redirectscheme.permanent=true"
|
||||
- "traefik.http.routers.mp-suppliers-deepseek-flash-2-mainnet-tls.entrypoints=websecure"
|
||||
- "traefik.http.routers.mp-suppliers-deepseek-flash-2-mainnet-tls.rule=Host(`mp-suppliers-deepseek-flash-2.vector.apexfusion.org`)"
|
||||
- "traefik.http.routers.mp-suppliers-deepseek-flash-2-mainnet-tls.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.services.mp-suppliers-deepseek-flash-2-mainnet.loadbalancer.server.port=8080"
|
||||
logging:
|
||||
driver: json-file
|
||||
options:
|
||||
max-size: "10m"
|
||||
max-file: "3"
|
||||
|
||||
networks:
|
||||
marketplace-mainnet-net:
|
||||
external: true
|
||||
name: marketplace-mainnet-net
|
||||
traefik-net:
|
||||
external: true
|
||||
name: traefik-net
|
||||
@@ -1,71 +0,0 @@
|
||||
# deploy/mainnet/docker-compose.supplier-deepseek-flash-3.yml — Supplier — MAINNET (OpenRouter / DeepSeek V4 Flash #3)
|
||||
#
|
||||
# Parallel-capacity supplier for deepseek/deepseek-v4-flash via OpenRouter's
|
||||
# OpenAI-compatible API. Same shape as the kimi replicas; distinct only in
|
||||
# instance name, container, env file, Traefik host/router, and advert model.
|
||||
# Shares the same OpenRouter API key as the kimi suppliers (accepted ceiling;
|
||||
# supplier has no 429/backoff). Advert caps: max_output_tokens=262144,
|
||||
# max_processing_ms=3600000; OPENAI_TIMEOUT_MS matched.
|
||||
#
|
||||
# Pre-flight:
|
||||
# 1. DNS (proxied): mp-suppliers-deepseek-flash-3.vector.apexfusion.org → host
|
||||
# 2. supplier/.env.deepseek-flash-3 on host (chmod 600): SUPPLIER_PRIV_KEY_HEX,
|
||||
# OPENAI_API_KEY, OGMIOS_URL, NETWORK_ID=1, VECTOR_ZERO_TIME_MS,
|
||||
# ESCROW_REF_UTXO, ADVERT_REF_UTXO, ADVERT_REF, LIVE_CHAIN=1
|
||||
# 3. Networks marketplace-mainnet-net + traefik-net already exist.
|
||||
|
||||
name: marketplace-mainnet-supplier-deepseek-flash-3
|
||||
|
||||
services:
|
||||
supplier:
|
||||
build:
|
||||
context: ../..
|
||||
dockerfile: supplier/Dockerfile
|
||||
container_name: marketplace-mainnet-supplier-deepseek-flash-3
|
||||
restart: unless-stopped
|
||||
env_file:
|
||||
- path: ../../supplier/.env.deepseek-flash-3
|
||||
required: false
|
||||
environment:
|
||||
LLM_BACKEND: openai
|
||||
# No /v1 suffix — supplier/src/openai.ts appends /v1/chat/completions.
|
||||
OPENAI_BASE_URL: https://openrouter.ai/api
|
||||
# Matches the advert's max_processing_ms=3600000 (60 min).
|
||||
OPENAI_TIMEOUT_MS: "3600000"
|
||||
PORT: "8080"
|
||||
LIVE_CHAIN: "1"
|
||||
# NETWORK_ID and OGMIOS_URL come from supplier/.env.deepseek-flash-3.
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "wget -qO- http://localhost:8080/healthz >/dev/null || exit 1"]
|
||||
interval: 20s
|
||||
timeout: 5s
|
||||
retries: 3
|
||||
start_period: 15s
|
||||
networks:
|
||||
- marketplace-mainnet-net
|
||||
- traefik-net
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.docker.network=traefik-net"
|
||||
- "traefik.http.routers.mp-suppliers-deepseek-flash-3-mainnet.entrypoints=web"
|
||||
- "traefik.http.routers.mp-suppliers-deepseek-flash-3-mainnet.rule=Host(`mp-suppliers-deepseek-flash-3.vector.apexfusion.org`)"
|
||||
- "traefik.http.routers.mp-suppliers-deepseek-flash-3-mainnet.middlewares=mp-suppliers-deepseek-flash-3-mainnet-https"
|
||||
- "traefik.http.middlewares.mp-suppliers-deepseek-flash-3-mainnet-https.redirectscheme.scheme=https"
|
||||
- "traefik.http.middlewares.mp-suppliers-deepseek-flash-3-mainnet-https.redirectscheme.permanent=true"
|
||||
- "traefik.http.routers.mp-suppliers-deepseek-flash-3-mainnet-tls.entrypoints=websecure"
|
||||
- "traefik.http.routers.mp-suppliers-deepseek-flash-3-mainnet-tls.rule=Host(`mp-suppliers-deepseek-flash-3.vector.apexfusion.org`)"
|
||||
- "traefik.http.routers.mp-suppliers-deepseek-flash-3-mainnet-tls.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.services.mp-suppliers-deepseek-flash-3-mainnet.loadbalancer.server.port=8080"
|
||||
logging:
|
||||
driver: json-file
|
||||
options:
|
||||
max-size: "10m"
|
||||
max-file: "3"
|
||||
|
||||
networks:
|
||||
marketplace-mainnet-net:
|
||||
external: true
|
||||
name: marketplace-mainnet-net
|
||||
traefik-net:
|
||||
external: true
|
||||
name: traefik-net
|
||||
@@ -65,12 +65,6 @@ services:
|
||||
- "traefik.docker.network=traefik-net"
|
||||
- "traefik.http.routers.mp-suppliers-deepseek-mainnet.entrypoints=web"
|
||||
- "traefik.http.routers.mp-suppliers-deepseek-mainnet.rule=Host(`mp-suppliers-deepseek.vector.apexfusion.org`)"
|
||||
- "traefik.http.routers.mp-suppliers-deepseek-mainnet.middlewares=mp-suppliers-deepseek-mainnet-https"
|
||||
- "traefik.http.middlewares.mp-suppliers-deepseek-mainnet-https.redirectscheme.scheme=https"
|
||||
- "traefik.http.middlewares.mp-suppliers-deepseek-mainnet-https.redirectscheme.permanent=true"
|
||||
- "traefik.http.routers.mp-suppliers-deepseek-mainnet-tls.entrypoints=websecure"
|
||||
- "traefik.http.routers.mp-suppliers-deepseek-mainnet-tls.rule=Host(`mp-suppliers-deepseek.vector.apexfusion.org`)"
|
||||
- "traefik.http.routers.mp-suppliers-deepseek-mainnet-tls.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.services.mp-suppliers-deepseek-mainnet.loadbalancer.server.port=8080"
|
||||
logging:
|
||||
driver: json-file
|
||||
|
||||
@@ -1,80 +0,0 @@
|
||||
# deploy/mainnet/docker-compose.supplier-ds-flash-chat-1.yml — Supplier — MAINNET
|
||||
# (OpenRouter / deepseek-v4-flash — MULTI-TURN CHAT capability `llm.chat.v1`, REPLICA 1)
|
||||
#
|
||||
# Chat-session sibling of the deepseek-flash one-off suppliers. Same OpenRouter
|
||||
# backend (deepseek/deepseek-v4-flash) but CAPABILITY_KIND=chat-session so it
|
||||
# mounts /v1/chat/{start,message,end}. Ticket settle mode (matches the mainnet
|
||||
# gateway): the buyer's Open escrow post is the only chain op; the supplier
|
||||
# never Claims/Submits; the gateway sweeper reclaims after deliver_by.
|
||||
#
|
||||
# Pre-flight:
|
||||
# 1. DNS A-record: mp-suppliers-ds-flash-chat-1.vector.apexfusion.org -> host IP
|
||||
# 2. New supplier wallet (gen-keypair), funded (advert post + fee float).
|
||||
# 3. Post a fresh llm.chat.v1 advert for this wallet:
|
||||
# --capability-id llm.chat.v1 --model deepseek/deepseek-v4-flash
|
||||
# --max-processing-ms 1800000 --price-lovelace 200000
|
||||
# 4. supplier/.env.ds-flash-chat-1 written on host (chmod 600) with at least:
|
||||
# SUPPLIER_PRIV_KEY_HEX, OPENAI_API_KEY, OGMIOS_URL, NETWORK_ID=1,
|
||||
# VECTOR_ZERO_TIME_MS, ESCROW_REF_UTXO, ADVERT_REF_UTXO, ADVERT_REF,
|
||||
# LIVE_CHAIN=1, OPENAI_REASONING=off, OPENAI_MAX_TOKENS=131072
|
||||
|
||||
name: marketplace-mainnet-supplier-ds-flash-chat-1
|
||||
|
||||
services:
|
||||
supplier:
|
||||
build:
|
||||
context: ../..
|
||||
dockerfile: supplier/Dockerfile
|
||||
container_name: marketplace-mainnet-supplier-ds-flash-chat-1
|
||||
restart: unless-stopped
|
||||
env_file:
|
||||
- path: ../../supplier/.env.ds-flash-chat-1
|
||||
required: false
|
||||
environment:
|
||||
# Multi-turn chat session capability (mounts /v1/chat/{start,message,end}).
|
||||
CAPABILITY_KIND: chat-session
|
||||
LLM_BACKEND: openai
|
||||
# No /v1 suffix — supplier/src/openai.ts appends /v1/chat/completions.
|
||||
OPENAI_BASE_URL: https://openrouter.ai/api
|
||||
OPENAI_TIMEOUT_MS: "300000"
|
||||
CHAT_IDLE_TIMEOUT_MS: "900000"
|
||||
CHAT_SETTLE_MODE: ticket
|
||||
MAX_CHAT_SESSIONS: "8"
|
||||
PORT: "8080"
|
||||
# Enable LiveOgmiosProvider so wallet-health/consolidate can broadcast.
|
||||
LIVE_CHAIN: "1"
|
||||
# NETWORK_ID and OGMIOS_URL come from supplier/.env.ds-flash-chat-1.
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "wget -qO- http://localhost:8080/healthz >/dev/null || exit 1"]
|
||||
interval: 20s
|
||||
timeout: 5s
|
||||
retries: 3
|
||||
start_period: 15s
|
||||
networks:
|
||||
- marketplace-mainnet-net
|
||||
- traefik-net
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.docker.network=traefik-net"
|
||||
- "traefik.http.routers.mp-suppliers-ds-flash-chat-1-mainnet.entrypoints=web"
|
||||
- "traefik.http.routers.mp-suppliers-ds-flash-chat-1-mainnet.rule=Host(`mp-suppliers-ds-flash-chat-1.vector.apexfusion.org`)"
|
||||
- "traefik.http.routers.mp-suppliers-ds-flash-chat-1-mainnet.middlewares=mp-suppliers-ds-flash-chat-1-mainnet-https"
|
||||
- "traefik.http.middlewares.mp-suppliers-ds-flash-chat-1-mainnet-https.redirectscheme.scheme=https"
|
||||
- "traefik.http.middlewares.mp-suppliers-ds-flash-chat-1-mainnet-https.redirectscheme.permanent=true"
|
||||
- "traefik.http.routers.mp-suppliers-ds-flash-chat-1-mainnet-tls.entrypoints=websecure"
|
||||
- "traefik.http.routers.mp-suppliers-ds-flash-chat-1-mainnet-tls.rule=Host(`mp-suppliers-ds-flash-chat-1.vector.apexfusion.org`)"
|
||||
- "traefik.http.routers.mp-suppliers-ds-flash-chat-1-mainnet-tls.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.services.mp-suppliers-ds-flash-chat-1-mainnet.loadbalancer.server.port=8080"
|
||||
logging:
|
||||
driver: json-file
|
||||
options:
|
||||
max-size: "10m"
|
||||
max-file: "3"
|
||||
|
||||
networks:
|
||||
marketplace-mainnet-net:
|
||||
external: true
|
||||
name: marketplace-mainnet-net
|
||||
traefik-net:
|
||||
external: true
|
||||
name: traefik-net
|
||||
@@ -1,80 +0,0 @@
|
||||
# deploy/mainnet/docker-compose.supplier-ds-flash-chat-2.yml — Supplier — MAINNET
|
||||
# (OpenRouter / deepseek-v4-flash — MULTI-TURN CHAT capability `llm.chat.v1`, REPLICA 2)
|
||||
#
|
||||
# Chat-session sibling of the deepseek-flash one-off suppliers. Same OpenRouter
|
||||
# backend (deepseek/deepseek-v4-flash) but CAPABILITY_KIND=chat-session so it
|
||||
# mounts /v1/chat/{start,message,end}. Ticket settle mode (matches the mainnet
|
||||
# gateway): the buyer's Open escrow post is the only chain op; the supplier
|
||||
# never Claims/Submits; the gateway sweeper reclaims after deliver_by.
|
||||
#
|
||||
# Pre-flight:
|
||||
# 1. DNS A-record: mp-suppliers-ds-flash-chat-2.vector.apexfusion.org -> host IP
|
||||
# 2. New supplier wallet (gen-keypair), funded (advert post + fee float).
|
||||
# 3. Post a fresh llm.chat.v1 advert for this wallet:
|
||||
# --capability-id llm.chat.v1 --model deepseek/deepseek-v4-flash
|
||||
# --max-processing-ms 1800000 --price-lovelace 200000
|
||||
# 4. supplier/.env.ds-flash-chat-2 written on host (chmod 600) with at least:
|
||||
# SUPPLIER_PRIV_KEY_HEX, OPENAI_API_KEY, OGMIOS_URL, NETWORK_ID=1,
|
||||
# VECTOR_ZERO_TIME_MS, ESCROW_REF_UTXO, ADVERT_REF_UTXO, ADVERT_REF,
|
||||
# LIVE_CHAIN=1, OPENAI_REASONING=off, OPENAI_MAX_TOKENS=131072
|
||||
|
||||
name: marketplace-mainnet-supplier-ds-flash-chat-2
|
||||
|
||||
services:
|
||||
supplier:
|
||||
build:
|
||||
context: ../..
|
||||
dockerfile: supplier/Dockerfile
|
||||
container_name: marketplace-mainnet-supplier-ds-flash-chat-2
|
||||
restart: unless-stopped
|
||||
env_file:
|
||||
- path: ../../supplier/.env.ds-flash-chat-2
|
||||
required: false
|
||||
environment:
|
||||
# Multi-turn chat session capability (mounts /v1/chat/{start,message,end}).
|
||||
CAPABILITY_KIND: chat-session
|
||||
LLM_BACKEND: openai
|
||||
# No /v1 suffix — supplier/src/openai.ts appends /v1/chat/completions.
|
||||
OPENAI_BASE_URL: https://openrouter.ai/api
|
||||
OPENAI_TIMEOUT_MS: "300000"
|
||||
CHAT_IDLE_TIMEOUT_MS: "900000"
|
||||
CHAT_SETTLE_MODE: ticket
|
||||
MAX_CHAT_SESSIONS: "8"
|
||||
PORT: "8080"
|
||||
# Enable LiveOgmiosProvider so wallet-health/consolidate can broadcast.
|
||||
LIVE_CHAIN: "1"
|
||||
# NETWORK_ID and OGMIOS_URL come from supplier/.env.ds-flash-chat-2.
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "wget -qO- http://localhost:8080/healthz >/dev/null || exit 1"]
|
||||
interval: 20s
|
||||
timeout: 5s
|
||||
retries: 3
|
||||
start_period: 15s
|
||||
networks:
|
||||
- marketplace-mainnet-net
|
||||
- traefik-net
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.docker.network=traefik-net"
|
||||
- "traefik.http.routers.mp-suppliers-ds-flash-chat-2-mainnet.entrypoints=web"
|
||||
- "traefik.http.routers.mp-suppliers-ds-flash-chat-2-mainnet.rule=Host(`mp-suppliers-ds-flash-chat-2.vector.apexfusion.org`)"
|
||||
- "traefik.http.routers.mp-suppliers-ds-flash-chat-2-mainnet.middlewares=mp-suppliers-ds-flash-chat-2-mainnet-https"
|
||||
- "traefik.http.middlewares.mp-suppliers-ds-flash-chat-2-mainnet-https.redirectscheme.scheme=https"
|
||||
- "traefik.http.middlewares.mp-suppliers-ds-flash-chat-2-mainnet-https.redirectscheme.permanent=true"
|
||||
- "traefik.http.routers.mp-suppliers-ds-flash-chat-2-mainnet-tls.entrypoints=websecure"
|
||||
- "traefik.http.routers.mp-suppliers-ds-flash-chat-2-mainnet-tls.rule=Host(`mp-suppliers-ds-flash-chat-2.vector.apexfusion.org`)"
|
||||
- "traefik.http.routers.mp-suppliers-ds-flash-chat-2-mainnet-tls.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.services.mp-suppliers-ds-flash-chat-2-mainnet.loadbalancer.server.port=8080"
|
||||
logging:
|
||||
driver: json-file
|
||||
options:
|
||||
max-size: "10m"
|
||||
max-file: "3"
|
||||
|
||||
networks:
|
||||
marketplace-mainnet-net:
|
||||
external: true
|
||||
name: marketplace-mainnet-net
|
||||
traefik-net:
|
||||
external: true
|
||||
name: traefik-net
|
||||
@@ -1,80 +0,0 @@
|
||||
# deploy/mainnet/docker-compose.supplier-ds-flash-chat-3.yml — Supplier — MAINNET
|
||||
# (OpenRouter / deepseek-v4-flash — MULTI-TURN CHAT capability `llm.chat.v1`, REPLICA 3)
|
||||
#
|
||||
# Chat-session sibling of the deepseek-flash one-off suppliers. Same OpenRouter
|
||||
# backend (deepseek/deepseek-v4-flash) but CAPABILITY_KIND=chat-session so it
|
||||
# mounts /v1/chat/{start,message,end}. Ticket settle mode (matches the mainnet
|
||||
# gateway): the buyer's Open escrow post is the only chain op; the supplier
|
||||
# never Claims/Submits; the gateway sweeper reclaims after deliver_by.
|
||||
#
|
||||
# Pre-flight:
|
||||
# 1. DNS A-record: mp-suppliers-ds-flash-chat-3.vector.apexfusion.org -> host IP
|
||||
# 2. New supplier wallet (gen-keypair), funded (advert post + fee float).
|
||||
# 3. Post a fresh llm.chat.v1 advert for this wallet:
|
||||
# --capability-id llm.chat.v1 --model deepseek/deepseek-v4-flash
|
||||
# --max-processing-ms 1800000 --price-lovelace 200000
|
||||
# 4. supplier/.env.ds-flash-chat-3 written on host (chmod 600) with at least:
|
||||
# SUPPLIER_PRIV_KEY_HEX, OPENAI_API_KEY, OGMIOS_URL, NETWORK_ID=1,
|
||||
# VECTOR_ZERO_TIME_MS, ESCROW_REF_UTXO, ADVERT_REF_UTXO, ADVERT_REF,
|
||||
# LIVE_CHAIN=1, OPENAI_REASONING=off, OPENAI_MAX_TOKENS=131072
|
||||
|
||||
name: marketplace-mainnet-supplier-ds-flash-chat-3
|
||||
|
||||
services:
|
||||
supplier:
|
||||
build:
|
||||
context: ../..
|
||||
dockerfile: supplier/Dockerfile
|
||||
container_name: marketplace-mainnet-supplier-ds-flash-chat-3
|
||||
restart: unless-stopped
|
||||
env_file:
|
||||
- path: ../../supplier/.env.ds-flash-chat-3
|
||||
required: false
|
||||
environment:
|
||||
# Multi-turn chat session capability (mounts /v1/chat/{start,message,end}).
|
||||
CAPABILITY_KIND: chat-session
|
||||
LLM_BACKEND: openai
|
||||
# No /v1 suffix — supplier/src/openai.ts appends /v1/chat/completions.
|
||||
OPENAI_BASE_URL: https://openrouter.ai/api
|
||||
OPENAI_TIMEOUT_MS: "300000"
|
||||
CHAT_IDLE_TIMEOUT_MS: "900000"
|
||||
CHAT_SETTLE_MODE: ticket
|
||||
MAX_CHAT_SESSIONS: "8"
|
||||
PORT: "8080"
|
||||
# Enable LiveOgmiosProvider so wallet-health/consolidate can broadcast.
|
||||
LIVE_CHAIN: "1"
|
||||
# NETWORK_ID and OGMIOS_URL come from supplier/.env.ds-flash-chat-3.
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "wget -qO- http://localhost:8080/healthz >/dev/null || exit 1"]
|
||||
interval: 20s
|
||||
timeout: 5s
|
||||
retries: 3
|
||||
start_period: 15s
|
||||
networks:
|
||||
- marketplace-mainnet-net
|
||||
- traefik-net
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.docker.network=traefik-net"
|
||||
- "traefik.http.routers.mp-suppliers-ds-flash-chat-3-mainnet.entrypoints=web"
|
||||
- "traefik.http.routers.mp-suppliers-ds-flash-chat-3-mainnet.rule=Host(`mp-suppliers-ds-flash-chat-3.vector.apexfusion.org`)"
|
||||
- "traefik.http.routers.mp-suppliers-ds-flash-chat-3-mainnet.middlewares=mp-suppliers-ds-flash-chat-3-mainnet-https"
|
||||
- "traefik.http.middlewares.mp-suppliers-ds-flash-chat-3-mainnet-https.redirectscheme.scheme=https"
|
||||
- "traefik.http.middlewares.mp-suppliers-ds-flash-chat-3-mainnet-https.redirectscheme.permanent=true"
|
||||
- "traefik.http.routers.mp-suppliers-ds-flash-chat-3-mainnet-tls.entrypoints=websecure"
|
||||
- "traefik.http.routers.mp-suppliers-ds-flash-chat-3-mainnet-tls.rule=Host(`mp-suppliers-ds-flash-chat-3.vector.apexfusion.org`)"
|
||||
- "traefik.http.routers.mp-suppliers-ds-flash-chat-3-mainnet-tls.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.services.mp-suppliers-ds-flash-chat-3-mainnet.loadbalancer.server.port=8080"
|
||||
logging:
|
||||
driver: json-file
|
||||
options:
|
||||
max-size: "10m"
|
||||
max-file: "3"
|
||||
|
||||
networks:
|
||||
marketplace-mainnet-net:
|
||||
external: true
|
||||
name: marketplace-mainnet-net
|
||||
traefik-net:
|
||||
external: true
|
||||
name: traefik-net
|
||||
@@ -61,12 +61,6 @@ services:
|
||||
- "traefik.docker.network=traefik-net"
|
||||
- "traefik.http.routers.mp-suppliers-gpt-mainnet.entrypoints=web"
|
||||
- "traefik.http.routers.mp-suppliers-gpt-mainnet.rule=Host(`mp-suppliers-gpt.vector.apexfusion.org`)"
|
||||
- "traefik.http.routers.mp-suppliers-gpt-mainnet.middlewares=mp-suppliers-gpt-mainnet-https"
|
||||
- "traefik.http.middlewares.mp-suppliers-gpt-mainnet-https.redirectscheme.scheme=https"
|
||||
- "traefik.http.middlewares.mp-suppliers-gpt-mainnet-https.redirectscheme.permanent=true"
|
||||
- "traefik.http.routers.mp-suppliers-gpt-mainnet-tls.entrypoints=websecure"
|
||||
- "traefik.http.routers.mp-suppliers-gpt-mainnet-tls.rule=Host(`mp-suppliers-gpt.vector.apexfusion.org`)"
|
||||
- "traefik.http.routers.mp-suppliers-gpt-mainnet-tls.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.services.mp-suppliers-gpt-mainnet.loadbalancer.server.port=8080"
|
||||
logging:
|
||||
driver: json-file
|
||||
|
||||
@@ -1,92 +0,0 @@
|
||||
# deploy/mainnet/docker-compose.supplier-hf-llama33.yml — Supplier — MAINNET
|
||||
# (HuggingFace Inference Providers router / meta-llama/Llama-3.3-70B-Instruct
|
||||
# — one-off `llm.text.generate.v1`)
|
||||
#
|
||||
# HF-router-backed supplier. LLM_BACKEND=openai pointed at the HuggingFace
|
||||
# Inference Providers router (OpenAI-compatible at https://router.huggingface.co).
|
||||
# No local proxy container — reachable over public HTTPS. Direct analogue of the
|
||||
# OpenRouter/Hetzner-backed suppliers; the router is OpenAI-compatible so this is
|
||||
# config only (V1 HF integration).
|
||||
#
|
||||
# Pre-flight:
|
||||
# 1. DNS: mp-suppliers-hf-llama33.vector.apexfusion.org → host
|
||||
# (individual DNS-only A record → 91.98.147.172; NO wildcard exists —
|
||||
# letsencrypt HTTP-01 issuance needs the unproxied direct record)
|
||||
# 2. supplier/.env.hf-llama33 written on host (chmod 600) with at minimum:
|
||||
# SUPPLIER_PRIV_KEY_HEX, SUPPLIER_ADDRESS, SUPPLIER_PKH,
|
||||
# SUPPLIER_PUB_KEY_HEX, OPENAI_API_KEY (hf_ token), OGMIOS_URL,
|
||||
# NETWORK_ID=1, VECTOR_ZERO_TIME_MS, ESCROW_REF_UTXO, ADVERT_REF_UTXO,
|
||||
# ADVERT_REF, LIVE_CHAIN=1
|
||||
# Advert posted with --capability-id llm.text.generate.v1.
|
||||
# Do NOT set OPENAI_REASONING — the HF router rejects it (HTTP 400) and the
|
||||
# supplier's config guard refuses to boot.
|
||||
# 3. Networks already exist (created by the canonical supplier compose):
|
||||
# docker network create marketplace-mainnet-net # one-shot
|
||||
# # traefik-net is created by the Traefik project
|
||||
|
||||
name: marketplace-mainnet-supplier-hf-llama33
|
||||
|
||||
services:
|
||||
supplier:
|
||||
build:
|
||||
context: ../..
|
||||
dockerfile: supplier/Dockerfile
|
||||
container_name: marketplace-mainnet-supplier-hf-llama33
|
||||
restart: unless-stopped
|
||||
env_file:
|
||||
# Self-contained env for this HF-router-backed variant. Holds this
|
||||
# supplier's distinct SUPPLIER_PRIV_KEY_HEX (+ derived wallet vars),
|
||||
# ADVERT_REF, the HF OPENAI_API_KEY, and the shared mainnet plumbing
|
||||
# duplicated in full (NETWORK_ID, OGMIOS_URL, VECTOR_ZERO_TIME_MS,
|
||||
# ref-script UTxOs, LIVE_CHAIN). No env_file ordering / override magic.
|
||||
- path: ../../supplier/.env.hf-llama33
|
||||
required: false
|
||||
environment:
|
||||
LLM_BACKEND: openai
|
||||
# No /v1 suffix — supplier/src/openai.ts appends /v1/chat/completions
|
||||
# (HF router serves at https://router.huggingface.co/v1/...).
|
||||
OPENAI_BASE_URL: https://router.huggingface.co
|
||||
# First-token latency across hosted providers can exceed local backends;
|
||||
# kept ≤ the advert's max_processing_ms (300000) per fleet footgun #4.
|
||||
OPENAI_TIMEOUT_MS: "300000"
|
||||
# OPENAI_MAX_TOKENS intentionally unset: no max_tokens forwarded upstream,
|
||||
# the provider grants context − prompt. Advert cap = model context length.
|
||||
PORT: "8080"
|
||||
# Enable LiveOgmiosProvider so submitTx/awaitTx actually broadcast.
|
||||
LIVE_CHAIN: "1"
|
||||
# NETWORK_ID and OGMIOS_URL intentionally not pinned here — they MUST
|
||||
# come from the operator-provided supplier/.env.hf-llama33 on a mainnet host.
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "wget -qO- http://localhost:8080/healthz >/dev/null || exit 1"]
|
||||
interval: 20s
|
||||
timeout: 5s
|
||||
retries: 3
|
||||
start_period: 15s
|
||||
networks:
|
||||
- marketplace-mainnet-net
|
||||
- traefik-net
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.docker.network=traefik-net"
|
||||
- "traefik.http.routers.mp-suppliers-hf-llama33-mainnet.entrypoints=web"
|
||||
- "traefik.http.routers.mp-suppliers-hf-llama33-mainnet.rule=Host(`mp-suppliers-hf-llama33.vector.apexfusion.org`)"
|
||||
- "traefik.http.routers.mp-suppliers-hf-llama33-mainnet.middlewares=mp-suppliers-hf-llama33-mainnet-https"
|
||||
- "traefik.http.middlewares.mp-suppliers-hf-llama33-mainnet-https.redirectscheme.scheme=https"
|
||||
- "traefik.http.middlewares.mp-suppliers-hf-llama33-mainnet-https.redirectscheme.permanent=true"
|
||||
- "traefik.http.routers.mp-suppliers-hf-llama33-mainnet-tls.entrypoints=websecure"
|
||||
- "traefik.http.routers.mp-suppliers-hf-llama33-mainnet-tls.rule=Host(`mp-suppliers-hf-llama33.vector.apexfusion.org`)"
|
||||
- "traefik.http.routers.mp-suppliers-hf-llama33-mainnet-tls.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.services.mp-suppliers-hf-llama33-mainnet.loadbalancer.server.port=8080"
|
||||
logging:
|
||||
driver: json-file
|
||||
options:
|
||||
max-size: "10m"
|
||||
max-file: "3"
|
||||
|
||||
networks:
|
||||
marketplace-mainnet-net:
|
||||
external: true
|
||||
name: marketplace-mainnet-net
|
||||
traefik-net:
|
||||
external: true
|
||||
name: traefik-net
|
||||
@@ -1,73 +0,0 @@
|
||||
# deploy/mainnet/docker-compose.supplier-kimi-2.yml — Supplier — MAINNET (OpenRouter / Kimi K2.6 replica #2)
|
||||
#
|
||||
# Parallel-capacity replica of supplier-kimi (OpenRouter, moonshotai/kimi-k2.6).
|
||||
# Identical to docker-compose.supplier-kimi.yml except for the instance name,
|
||||
# container name, env file, Traefik host/router, and OPENAI_TIMEOUT_MS (raised
|
||||
# to 3600000 to match this advert's max_processing_ms=3600000, max_output_tokens=262144).
|
||||
# Shares the same OpenRouter API key as the other kimi suppliers (accepted
|
||||
# concurrency ceiling; supplier has no 429/backoff).
|
||||
#
|
||||
# Pre-flight:
|
||||
# 1. DNS (proxied): mp-suppliers-kimi-2.vector.apexfusion.org → host
|
||||
# 2. supplier/.env.kimi-2 on host (chmod 600): SUPPLIER_PRIV_KEY_HEX, OPENAI_API_KEY,
|
||||
# OGMIOS_URL, NETWORK_ID=1, VECTOR_ZERO_TIME_MS, ESCROW_REF_UTXO, ADVERT_REF_UTXO,
|
||||
# ADVERT_REF, LIVE_CHAIN=1
|
||||
# 3. Networks marketplace-mainnet-net + traefik-net already exist.
|
||||
|
||||
name: marketplace-mainnet-supplier-kimi-2
|
||||
|
||||
services:
|
||||
supplier:
|
||||
build:
|
||||
context: ../..
|
||||
dockerfile: supplier/Dockerfile
|
||||
container_name: marketplace-mainnet-supplier-kimi-2
|
||||
restart: unless-stopped
|
||||
env_file:
|
||||
- path: ../../supplier/.env.kimi-2
|
||||
required: false
|
||||
environment:
|
||||
LLM_BACKEND: openai
|
||||
# No /v1 suffix — supplier/src/openai.ts appends /v1/chat/completions.
|
||||
OPENAI_BASE_URL: https://openrouter.ai/api
|
||||
# Raised to match the advert's max_processing_ms=3600000 (60 min) so the
|
||||
# upstream call isn't aborted before the advertised processing deadline.
|
||||
OPENAI_TIMEOUT_MS: "3600000"
|
||||
PORT: "8080"
|
||||
LIVE_CHAIN: "1"
|
||||
# NETWORK_ID and OGMIOS_URL intentionally not pinned here — they MUST
|
||||
# come from supplier/.env.kimi-2 on the mainnet host (footgun avoidance).
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "wget -qO- http://localhost:8080/healthz >/dev/null || exit 1"]
|
||||
interval: 20s
|
||||
timeout: 5s
|
||||
retries: 3
|
||||
start_period: 15s
|
||||
networks:
|
||||
- marketplace-mainnet-net
|
||||
- traefik-net
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.docker.network=traefik-net"
|
||||
- "traefik.http.routers.mp-suppliers-kimi-2-mainnet.entrypoints=web"
|
||||
- "traefik.http.routers.mp-suppliers-kimi-2-mainnet.rule=Host(`mp-suppliers-kimi-2.vector.apexfusion.org`)"
|
||||
- "traefik.http.routers.mp-suppliers-kimi-2-mainnet.middlewares=mp-suppliers-kimi-2-mainnet-https"
|
||||
- "traefik.http.middlewares.mp-suppliers-kimi-2-mainnet-https.redirectscheme.scheme=https"
|
||||
- "traefik.http.middlewares.mp-suppliers-kimi-2-mainnet-https.redirectscheme.permanent=true"
|
||||
- "traefik.http.routers.mp-suppliers-kimi-2-mainnet-tls.entrypoints=websecure"
|
||||
- "traefik.http.routers.mp-suppliers-kimi-2-mainnet-tls.rule=Host(`mp-suppliers-kimi-2.vector.apexfusion.org`)"
|
||||
- "traefik.http.routers.mp-suppliers-kimi-2-mainnet-tls.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.services.mp-suppliers-kimi-2-mainnet.loadbalancer.server.port=8080"
|
||||
logging:
|
||||
driver: json-file
|
||||
options:
|
||||
max-size: "10m"
|
||||
max-file: "3"
|
||||
|
||||
networks:
|
||||
marketplace-mainnet-net:
|
||||
external: true
|
||||
name: marketplace-mainnet-net
|
||||
traefik-net:
|
||||
external: true
|
||||
name: traefik-net
|
||||
@@ -1,73 +0,0 @@
|
||||
# deploy/mainnet/docker-compose.supplier-kimi-3.yml — Supplier — MAINNET (OpenRouter / Kimi K2.6 replica #3)
|
||||
#
|
||||
# Parallel-capacity replica of supplier-kimi (OpenRouter, moonshotai/kimi-k2.6).
|
||||
# Identical to docker-compose.supplier-kimi.yml except for the instance name,
|
||||
# container name, env file, Traefik host/router, and OPENAI_TIMEOUT_MS (raised
|
||||
# to 3600000 to match this advert's max_processing_ms=3600000, max_output_tokens=262144).
|
||||
# Shares the same OpenRouter API key as the other kimi suppliers (accepted
|
||||
# concurrency ceiling; supplier has no 429/backoff).
|
||||
#
|
||||
# Pre-flight:
|
||||
# 1. DNS (proxied): mp-suppliers-kimi-3.vector.apexfusion.org → host
|
||||
# 2. supplier/.env.kimi-3 on host (chmod 600): SUPPLIER_PRIV_KEY_HEX, OPENAI_API_KEY,
|
||||
# OGMIOS_URL, NETWORK_ID=1, VECTOR_ZERO_TIME_MS, ESCROW_REF_UTXO, ADVERT_REF_UTXO,
|
||||
# ADVERT_REF, LIVE_CHAIN=1
|
||||
# 3. Networks marketplace-mainnet-net + traefik-net already exist.
|
||||
|
||||
name: marketplace-mainnet-supplier-kimi-3
|
||||
|
||||
services:
|
||||
supplier:
|
||||
build:
|
||||
context: ../..
|
||||
dockerfile: supplier/Dockerfile
|
||||
container_name: marketplace-mainnet-supplier-kimi-3
|
||||
restart: unless-stopped
|
||||
env_file:
|
||||
- path: ../../supplier/.env.kimi-3
|
||||
required: false
|
||||
environment:
|
||||
LLM_BACKEND: openai
|
||||
# No /v1 suffix — supplier/src/openai.ts appends /v1/chat/completions.
|
||||
OPENAI_BASE_URL: https://openrouter.ai/api
|
||||
# Raised to match the advert's max_processing_ms=3600000 (60 min) so the
|
||||
# upstream call isn't aborted before the advertised processing deadline.
|
||||
OPENAI_TIMEOUT_MS: "3600000"
|
||||
PORT: "8080"
|
||||
LIVE_CHAIN: "1"
|
||||
# NETWORK_ID and OGMIOS_URL intentionally not pinned here — they MUST
|
||||
# come from supplier/.env.kimi-3 on the mainnet host (footgun avoidance).
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "wget -qO- http://localhost:8080/healthz >/dev/null || exit 1"]
|
||||
interval: 20s
|
||||
timeout: 5s
|
||||
retries: 3
|
||||
start_period: 15s
|
||||
networks:
|
||||
- marketplace-mainnet-net
|
||||
- traefik-net
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.docker.network=traefik-net"
|
||||
- "traefik.http.routers.mp-suppliers-kimi-3-mainnet.entrypoints=web"
|
||||
- "traefik.http.routers.mp-suppliers-kimi-3-mainnet.rule=Host(`mp-suppliers-kimi-3.vector.apexfusion.org`)"
|
||||
- "traefik.http.routers.mp-suppliers-kimi-3-mainnet.middlewares=mp-suppliers-kimi-3-mainnet-https"
|
||||
- "traefik.http.middlewares.mp-suppliers-kimi-3-mainnet-https.redirectscheme.scheme=https"
|
||||
- "traefik.http.middlewares.mp-suppliers-kimi-3-mainnet-https.redirectscheme.permanent=true"
|
||||
- "traefik.http.routers.mp-suppliers-kimi-3-mainnet-tls.entrypoints=websecure"
|
||||
- "traefik.http.routers.mp-suppliers-kimi-3-mainnet-tls.rule=Host(`mp-suppliers-kimi-3.vector.apexfusion.org`)"
|
||||
- "traefik.http.routers.mp-suppliers-kimi-3-mainnet-tls.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.services.mp-suppliers-kimi-3-mainnet.loadbalancer.server.port=8080"
|
||||
logging:
|
||||
driver: json-file
|
||||
options:
|
||||
max-size: "10m"
|
||||
max-file: "3"
|
||||
|
||||
networks:
|
||||
marketplace-mainnet-net:
|
||||
external: true
|
||||
name: marketplace-mainnet-net
|
||||
traefik-net:
|
||||
external: true
|
||||
name: traefik-net
|
||||
@@ -1,73 +0,0 @@
|
||||
# deploy/mainnet/docker-compose.supplier-kimi-4.yml — Supplier — MAINNET (OpenRouter / Kimi K2.6 replica #4)
|
||||
#
|
||||
# Parallel-capacity replica of supplier-kimi (OpenRouter, moonshotai/kimi-k2.6).
|
||||
# Identical to docker-compose.supplier-kimi.yml except for the instance name,
|
||||
# container name, env file, Traefik host/router, and OPENAI_TIMEOUT_MS (raised
|
||||
# to 3600000 to match this advert's max_processing_ms=3600000, max_output_tokens=262144).
|
||||
# Shares the same OpenRouter API key as the other kimi suppliers (accepted
|
||||
# concurrency ceiling; supplier has no 429/backoff).
|
||||
#
|
||||
# Pre-flight:
|
||||
# 1. DNS (proxied): mp-suppliers-kimi-4.vector.apexfusion.org → host
|
||||
# 2. supplier/.env.kimi-4 on host (chmod 600): SUPPLIER_PRIV_KEY_HEX, OPENAI_API_KEY,
|
||||
# OGMIOS_URL, NETWORK_ID=1, VECTOR_ZERO_TIME_MS, ESCROW_REF_UTXO, ADVERT_REF_UTXO,
|
||||
# ADVERT_REF, LIVE_CHAIN=1
|
||||
# 3. Networks marketplace-mainnet-net + traefik-net already exist.
|
||||
|
||||
name: marketplace-mainnet-supplier-kimi-4
|
||||
|
||||
services:
|
||||
supplier:
|
||||
build:
|
||||
context: ../..
|
||||
dockerfile: supplier/Dockerfile
|
||||
container_name: marketplace-mainnet-supplier-kimi-4
|
||||
restart: unless-stopped
|
||||
env_file:
|
||||
- path: ../../supplier/.env.kimi-4
|
||||
required: false
|
||||
environment:
|
||||
LLM_BACKEND: openai
|
||||
# No /v1 suffix — supplier/src/openai.ts appends /v1/chat/completions.
|
||||
OPENAI_BASE_URL: https://openrouter.ai/api
|
||||
# Raised to match the advert's max_processing_ms=3600000 (60 min) so the
|
||||
# upstream call isn't aborted before the advertised processing deadline.
|
||||
OPENAI_TIMEOUT_MS: "3600000"
|
||||
PORT: "8080"
|
||||
LIVE_CHAIN: "1"
|
||||
# NETWORK_ID and OGMIOS_URL intentionally not pinned here — they MUST
|
||||
# come from supplier/.env.kimi-4 on the mainnet host (footgun avoidance).
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "wget -qO- http://localhost:8080/healthz >/dev/null || exit 1"]
|
||||
interval: 20s
|
||||
timeout: 5s
|
||||
retries: 3
|
||||
start_period: 15s
|
||||
networks:
|
||||
- marketplace-mainnet-net
|
||||
- traefik-net
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.docker.network=traefik-net"
|
||||
- "traefik.http.routers.mp-suppliers-kimi-4-mainnet.entrypoints=web"
|
||||
- "traefik.http.routers.mp-suppliers-kimi-4-mainnet.rule=Host(`mp-suppliers-kimi-4.vector.apexfusion.org`)"
|
||||
- "traefik.http.routers.mp-suppliers-kimi-4-mainnet.middlewares=mp-suppliers-kimi-4-mainnet-https"
|
||||
- "traefik.http.middlewares.mp-suppliers-kimi-4-mainnet-https.redirectscheme.scheme=https"
|
||||
- "traefik.http.middlewares.mp-suppliers-kimi-4-mainnet-https.redirectscheme.permanent=true"
|
||||
- "traefik.http.routers.mp-suppliers-kimi-4-mainnet-tls.entrypoints=websecure"
|
||||
- "traefik.http.routers.mp-suppliers-kimi-4-mainnet-tls.rule=Host(`mp-suppliers-kimi-4.vector.apexfusion.org`)"
|
||||
- "traefik.http.routers.mp-suppliers-kimi-4-mainnet-tls.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.services.mp-suppliers-kimi-4-mainnet.loadbalancer.server.port=8080"
|
||||
logging:
|
||||
driver: json-file
|
||||
options:
|
||||
max-size: "10m"
|
||||
max-file: "3"
|
||||
|
||||
networks:
|
||||
marketplace-mainnet-net:
|
||||
external: true
|
||||
name: marketplace-mainnet-net
|
||||
traefik-net:
|
||||
external: true
|
||||
name: traefik-net
|
||||
@@ -1,84 +0,0 @@
|
||||
# deploy/mainnet/docker-compose.supplier-kimi-chat-2.yml — Supplier — MAINNET
|
||||
# (OpenRouter / Kimi K2.6 — MULTI-TURN CHAT capability `llm.chat.v1`, REPLICA 2)
|
||||
#
|
||||
# Second llm.chat.v1 replica: a chat session holds a supplier's single slot for
|
||||
# the whole conversation, so concurrent chat users = number of chat suppliers.
|
||||
# Deployed for the shared-demo-key endpoint (session-backed /chat/completions).
|
||||
# Identical to docker-compose.supplier-kimi-chat.yml except for its own wallet,
|
||||
# advert, env file and hostname.
|
||||
#
|
||||
# Pre-flight:
|
||||
# 1. DNS A-record: mp-suppliers-kimi-chat-2.vector.apexfusion.org → host IP
|
||||
# 2. New supplier wallet (gen-keypair), funded with advert bond + fee float.
|
||||
# 3. Post a fresh llm.chat.v1 advert for this wallet:
|
||||
# --capability-id llm.chat.v1 --model moonshotai/kimi-k2.6
|
||||
# --max-processing-ms 1800000 (same price as the primary chat advert)
|
||||
# 4. supplier/.env.kimi-chat-2 written on host (chmod 600) with at minimum:
|
||||
# SUPPLIER_PRIV_KEY_HEX, OPENAI_API_KEY, OGMIOS_URL, NETWORK_ID=1,
|
||||
# VECTOR_ZERO_TIME_MS, ESCROW_REF_UTXO, ADVERT_REF_UTXO, ADVERT_REF,
|
||||
# LIVE_CHAIN=1
|
||||
|
||||
name: marketplace-mainnet-supplier-kimi-chat-2
|
||||
|
||||
services:
|
||||
supplier:
|
||||
build:
|
||||
context: ../..
|
||||
dockerfile: supplier/Dockerfile
|
||||
container_name: marketplace-mainnet-supplier-kimi-chat-2
|
||||
restart: unless-stopped
|
||||
env_file:
|
||||
- path: ../../supplier/.env.kimi-chat-2
|
||||
required: false
|
||||
environment:
|
||||
# Multi-turn chat session capability (mounts /v1/chat/{start,message,end}).
|
||||
CAPABILITY_KIND: chat-session
|
||||
LLM_BACKEND: openai
|
||||
# No /v1 suffix — supplier/src/openai.ts appends /v1/chat/completions.
|
||||
OPENAI_BASE_URL: https://openrouter.ai/api
|
||||
# Kimi K2.6 generations can be slow; mirror the one-off Kimi compose.
|
||||
OPENAI_TIMEOUT_MS: "300000"
|
||||
# 2.5 min idle end: single-slot suppliers must free up quickly for the
|
||||
# shared demo endpoint (the gateway transparently reopens on next turn).
|
||||
CHAT_IDLE_TIMEOUT_MS: "900000"
|
||||
CHAT_SETTLE_MODE: ticket
|
||||
MAX_CHAT_SESSIONS: "8"
|
||||
PORT: "8080"
|
||||
# Enable LiveOgmiosProvider so Claim/Submit actually broadcast.
|
||||
LIVE_CHAIN: "1"
|
||||
# NETWORK_ID and OGMIOS_URL intentionally not pinned here — they MUST
|
||||
# come from the operator-provided supplier/.env.kimi-chat-2 on a mainnet host.
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "wget -qO- http://localhost:8080/healthz >/dev/null || exit 1"]
|
||||
interval: 20s
|
||||
timeout: 5s
|
||||
retries: 3
|
||||
start_period: 15s
|
||||
networks:
|
||||
- marketplace-mainnet-net
|
||||
- traefik-net
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.docker.network=traefik-net"
|
||||
- "traefik.http.routers.mp-suppliers-kimi-chat-2-mainnet.entrypoints=web"
|
||||
- "traefik.http.routers.mp-suppliers-kimi-chat-2-mainnet.rule=Host(`mp-suppliers-kimi-chat-2.vector.apexfusion.org`)"
|
||||
- "traefik.http.routers.mp-suppliers-kimi-chat-2-mainnet.middlewares=mp-suppliers-kimi-chat-2-mainnet-https"
|
||||
- "traefik.http.middlewares.mp-suppliers-kimi-chat-2-mainnet-https.redirectscheme.scheme=https"
|
||||
- "traefik.http.middlewares.mp-suppliers-kimi-chat-2-mainnet-https.redirectscheme.permanent=true"
|
||||
- "traefik.http.routers.mp-suppliers-kimi-chat-2-mainnet-tls.entrypoints=websecure"
|
||||
- "traefik.http.routers.mp-suppliers-kimi-chat-2-mainnet-tls.rule=Host(`mp-suppliers-kimi-chat-2.vector.apexfusion.org`)"
|
||||
- "traefik.http.routers.mp-suppliers-kimi-chat-2-mainnet-tls.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.services.mp-suppliers-kimi-chat-2-mainnet.loadbalancer.server.port=8080"
|
||||
logging:
|
||||
driver: json-file
|
||||
options:
|
||||
max-size: "10m"
|
||||
max-file: "3"
|
||||
|
||||
networks:
|
||||
marketplace-mainnet-net:
|
||||
external: true
|
||||
name: marketplace-mainnet-net
|
||||
traefik-net:
|
||||
external: true
|
||||
name: traefik-net
|
||||
@@ -1,84 +0,0 @@
|
||||
# deploy/mainnet/docker-compose.supplier-kimi-chat-3.yml — Supplier — MAINNET
|
||||
# (OpenRouter / Kimi K2.6 — MULTI-TURN CHAT capability `llm.chat.v1`, REPLICA 3)
|
||||
#
|
||||
# Third llm.chat.v1 replica: a chat session holds a supplier's single slot for
|
||||
# the whole conversation, so concurrent chat users = number of chat suppliers.
|
||||
# Deployed for the shared-demo-key endpoint (session-backed /chat/completions).
|
||||
# Identical to docker-compose.supplier-kimi-chat.yml except for its own wallet,
|
||||
# advert, env file and hostname.
|
||||
#
|
||||
# Pre-flight:
|
||||
# 1. DNS A-record: mp-suppliers-kimi-chat-3.vector.apexfusion.org → host IP
|
||||
# 2. New supplier wallet (gen-keypair), funded with advert bond + fee float.
|
||||
# 3. Post a fresh llm.chat.v1 advert for this wallet:
|
||||
# --capability-id llm.chat.v1 --model moonshotai/kimi-k2.6
|
||||
# --max-processing-ms 1800000 (same price as the primary chat advert)
|
||||
# 4. supplier/.env.kimi-chat-3 written on host (chmod 600) with at minimum:
|
||||
# SUPPLIER_PRIV_KEY_HEX, OPENAI_API_KEY, OGMIOS_URL, NETWORK_ID=1,
|
||||
# VECTOR_ZERO_TIME_MS, ESCROW_REF_UTXO, ADVERT_REF_UTXO, ADVERT_REF,
|
||||
# LIVE_CHAIN=1
|
||||
|
||||
name: marketplace-mainnet-supplier-kimi-chat-3
|
||||
|
||||
services:
|
||||
supplier:
|
||||
build:
|
||||
context: ../..
|
||||
dockerfile: supplier/Dockerfile
|
||||
container_name: marketplace-mainnet-supplier-kimi-chat-3
|
||||
restart: unless-stopped
|
||||
env_file:
|
||||
- path: ../../supplier/.env.kimi-chat-3
|
||||
required: false
|
||||
environment:
|
||||
# Multi-turn chat session capability (mounts /v1/chat/{start,message,end}).
|
||||
CAPABILITY_KIND: chat-session
|
||||
LLM_BACKEND: openai
|
||||
# No /v1 suffix — supplier/src/openai.ts appends /v1/chat/completions.
|
||||
OPENAI_BASE_URL: https://openrouter.ai/api
|
||||
# Kimi K2.6 generations can be slow; mirror the one-off Kimi compose.
|
||||
OPENAI_TIMEOUT_MS: "300000"
|
||||
# 2.5 min idle end: single-slot suppliers must free up quickly for the
|
||||
# shared demo endpoint (the gateway transparently reopens on next turn).
|
||||
CHAT_IDLE_TIMEOUT_MS: "900000"
|
||||
CHAT_SETTLE_MODE: ticket
|
||||
MAX_CHAT_SESSIONS: "8"
|
||||
PORT: "8080"
|
||||
# Enable LiveOgmiosProvider so Claim/Submit actually broadcast.
|
||||
LIVE_CHAIN: "1"
|
||||
# NETWORK_ID and OGMIOS_URL intentionally not pinned here — they MUST
|
||||
# come from the operator-provided supplier/.env.kimi-chat-3 on a mainnet host.
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "wget -qO- http://localhost:8080/healthz >/dev/null || exit 1"]
|
||||
interval: 20s
|
||||
timeout: 5s
|
||||
retries: 3
|
||||
start_period: 15s
|
||||
networks:
|
||||
- marketplace-mainnet-net
|
||||
- traefik-net
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.docker.network=traefik-net"
|
||||
- "traefik.http.routers.mp-suppliers-kimi-chat-3-mainnet.entrypoints=web"
|
||||
- "traefik.http.routers.mp-suppliers-kimi-chat-3-mainnet.rule=Host(`mp-suppliers-kimi-chat-3.vector.apexfusion.org`)"
|
||||
- "traefik.http.routers.mp-suppliers-kimi-chat-3-mainnet.middlewares=mp-suppliers-kimi-chat-3-mainnet-https"
|
||||
- "traefik.http.middlewares.mp-suppliers-kimi-chat-3-mainnet-https.redirectscheme.scheme=https"
|
||||
- "traefik.http.middlewares.mp-suppliers-kimi-chat-3-mainnet-https.redirectscheme.permanent=true"
|
||||
- "traefik.http.routers.mp-suppliers-kimi-chat-3-mainnet-tls.entrypoints=websecure"
|
||||
- "traefik.http.routers.mp-suppliers-kimi-chat-3-mainnet-tls.rule=Host(`mp-suppliers-kimi-chat-3.vector.apexfusion.org`)"
|
||||
- "traefik.http.routers.mp-suppliers-kimi-chat-3-mainnet-tls.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.services.mp-suppliers-kimi-chat-3-mainnet.loadbalancer.server.port=8080"
|
||||
logging:
|
||||
driver: json-file
|
||||
options:
|
||||
max-size: "10m"
|
||||
max-file: "3"
|
||||
|
||||
networks:
|
||||
marketplace-mainnet-net:
|
||||
external: true
|
||||
name: marketplace-mainnet-net
|
||||
traefik-net:
|
||||
external: true
|
||||
name: traefik-net
|
||||
@@ -49,12 +49,8 @@ services:
|
||||
OPENAI_BASE_URL: https://openrouter.ai/api
|
||||
# Kimi K2.6 generations can be slow; mirror the one-off Kimi compose.
|
||||
OPENAI_TIMEOUT_MS: "300000"
|
||||
# 2.5 min idle end (supplier Submits the transcript): single-slot
|
||||
# suppliers must free up quickly for the shared demo endpoint (the
|
||||
# gateway transparently reopens a session on the next turn).
|
||||
CHAT_IDLE_TIMEOUT_MS: "900000"
|
||||
CHAT_SETTLE_MODE: ticket
|
||||
MAX_CHAT_SESSIONS: "8"
|
||||
# Auto-end an idle session after 5 min (supplier Submits the transcript).
|
||||
CHAT_IDLE_TIMEOUT_MS: "300000"
|
||||
PORT: "8080"
|
||||
# Enable LiveOgmiosProvider so Claim/Submit actually broadcast.
|
||||
LIVE_CHAIN: "1"
|
||||
@@ -74,12 +70,6 @@ services:
|
||||
- "traefik.docker.network=traefik-net"
|
||||
- "traefik.http.routers.mp-suppliers-kimi-chat-mainnet.entrypoints=web"
|
||||
- "traefik.http.routers.mp-suppliers-kimi-chat-mainnet.rule=Host(`mp-suppliers-kimi-chat.vector.apexfusion.org`)"
|
||||
- "traefik.http.routers.mp-suppliers-kimi-chat-mainnet.middlewares=mp-suppliers-kimi-chat-mainnet-https"
|
||||
- "traefik.http.middlewares.mp-suppliers-kimi-chat-mainnet-https.redirectscheme.scheme=https"
|
||||
- "traefik.http.middlewares.mp-suppliers-kimi-chat-mainnet-https.redirectscheme.permanent=true"
|
||||
- "traefik.http.routers.mp-suppliers-kimi-chat-mainnet-tls.entrypoints=websecure"
|
||||
- "traefik.http.routers.mp-suppliers-kimi-chat-mainnet-tls.rule=Host(`mp-suppliers-kimi-chat.vector.apexfusion.org`)"
|
||||
- "traefik.http.routers.mp-suppliers-kimi-chat-mainnet-tls.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.services.mp-suppliers-kimi-chat-mainnet.loadbalancer.server.port=8080"
|
||||
logging:
|
||||
driver: json-file
|
||||
|
||||
@@ -48,10 +48,8 @@ services:
|
||||
LLM_BACKEND: openai
|
||||
# No /v1 suffix — supplier/src/openai.ts appends /v1/chat/completions.
|
||||
OPENAI_BASE_URL: https://openrouter.ai/api
|
||||
# Raised to match the advert's max_processing_ms=3600000 (60 min) so the
|
||||
# upstream call isn't aborted before the advertised processing deadline
|
||||
# (matches the kimi-2/3/4 replicas).
|
||||
OPENAI_TIMEOUT_MS: "3600000"
|
||||
# Kimi K2.6 generations can be slow; mirror the DeepSeek/GPT composes.
|
||||
OPENAI_TIMEOUT_MS: "300000"
|
||||
PORT: "8080"
|
||||
# Enable LiveOgmiosProvider so submitTx/awaitTx actually broadcast.
|
||||
# Without this the supplier silently falls back to ReadOnlyOgmiosProvider
|
||||
@@ -75,12 +73,6 @@ services:
|
||||
- "traefik.docker.network=traefik-net"
|
||||
- "traefik.http.routers.mp-suppliers-kimi-mainnet.entrypoints=web"
|
||||
- "traefik.http.routers.mp-suppliers-kimi-mainnet.rule=Host(`mp-suppliers-kimi.vector.apexfusion.org`)"
|
||||
- "traefik.http.routers.mp-suppliers-kimi-mainnet.middlewares=mp-suppliers-kimi-mainnet-https"
|
||||
- "traefik.http.middlewares.mp-suppliers-kimi-mainnet-https.redirectscheme.scheme=https"
|
||||
- "traefik.http.middlewares.mp-suppliers-kimi-mainnet-https.redirectscheme.permanent=true"
|
||||
- "traefik.http.routers.mp-suppliers-kimi-mainnet-tls.entrypoints=websecure"
|
||||
- "traefik.http.routers.mp-suppliers-kimi-mainnet-tls.rule=Host(`mp-suppliers-kimi.vector.apexfusion.org`)"
|
||||
- "traefik.http.routers.mp-suppliers-kimi-mainnet-tls.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.services.mp-suppliers-kimi-mainnet.loadbalancer.server.port=8080"
|
||||
logging:
|
||||
driver: json-file
|
||||
|
||||
@@ -1,79 +0,0 @@
|
||||
name: marketplace-mainnet-supplier-openrouter-reseller
|
||||
|
||||
services:
|
||||
postgres:
|
||||
image: postgres:17-alpine
|
||||
container_name: marketplace-mainnet-openrouter-reseller-postgres
|
||||
restart: unless-stopped
|
||||
env_file:
|
||||
- path: /var/lib/agents-marketplace/openrouter-reseller-postgres.env
|
||||
required: true
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB"]
|
||||
interval: 5s
|
||||
timeout: 5s
|
||||
retries: 20
|
||||
start_period: 10s
|
||||
volumes:
|
||||
- openrouter-reseller-postgres:/var/lib/postgresql/data
|
||||
networks:
|
||||
- reseller-db
|
||||
logging:
|
||||
driver: json-file
|
||||
options:
|
||||
max-size: "10m"
|
||||
max-file: "3"
|
||||
|
||||
supplier:
|
||||
build:
|
||||
context: ../..
|
||||
dockerfile: supplier/Dockerfile
|
||||
container_name: marketplace-mainnet-supplier-openrouter-reseller
|
||||
restart: unless-stopped
|
||||
depends_on:
|
||||
postgres:
|
||||
condition: service_healthy
|
||||
env_file:
|
||||
- path: /var/lib/agents-marketplace/openrouter-reseller.env
|
||||
required: true
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "wget -qO- http://localhost:8080/healthz >/dev/null || exit 1"]
|
||||
interval: 20s
|
||||
timeout: 5s
|
||||
retries: 3
|
||||
start_period: 20s
|
||||
networks:
|
||||
- marketplace-mainnet-net
|
||||
- traefik-net
|
||||
- reseller-db
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.docker.network=traefik-net"
|
||||
- "traefik.http.routers.mp-openrouter-reseller-mainnet.entrypoints=web"
|
||||
- "traefik.http.routers.mp-openrouter-reseller-mainnet.rule=Host(`mp-suppliers-openrouter-reseller.vector.apexfusion.org`)"
|
||||
- "traefik.http.routers.mp-openrouter-reseller-mainnet.middlewares=mp-openrouter-reseller-mainnet-https"
|
||||
- "traefik.http.middlewares.mp-openrouter-reseller-mainnet-https.redirectscheme.scheme=https"
|
||||
- "traefik.http.middlewares.mp-openrouter-reseller-mainnet-https.redirectscheme.permanent=true"
|
||||
- "traefik.http.routers.mp-openrouter-reseller-mainnet-tls.entrypoints=websecure"
|
||||
- "traefik.http.routers.mp-openrouter-reseller-mainnet-tls.rule=Host(`mp-suppliers-openrouter-reseller.vector.apexfusion.org`)"
|
||||
- "traefik.http.routers.mp-openrouter-reseller-mainnet-tls.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.services.mp-openrouter-reseller-mainnet.loadbalancer.server.port=8080"
|
||||
logging:
|
||||
driver: json-file
|
||||
options:
|
||||
max-size: "10m"
|
||||
max-file: "3"
|
||||
|
||||
volumes:
|
||||
openrouter-reseller-postgres:
|
||||
name: marketplace-mainnet-openrouter-reseller-postgres
|
||||
|
||||
networks:
|
||||
reseller-db:
|
||||
internal: true
|
||||
marketplace-mainnet-net:
|
||||
external: true
|
||||
name: marketplace-mainnet-net
|
||||
traefik-net:
|
||||
external: true
|
||||
name: traefik-net
|
||||
@@ -1,101 +0,0 @@
|
||||
# deploy/mainnet/docker-compose.supplier-qwen35b-chat.yml — Supplier — MAINNET
|
||||
# (Hetzner Inference / Qwen/Qwen3.6-35B-A3B-FP8 — MULTI-TURN CHAT capability `llm.chat.v1`)
|
||||
#
|
||||
# The chat-session sibling of docker-compose.supplier-qwen35b.yml. Same
|
||||
# image, same Hetzner backend (Qwen/Qwen3.6-35B-A3B-FP8), but CAPABILITY_KIND=chat-session so
|
||||
# it mounts /v1/chat/{start,message,end} (escrow bookends, off-chain streaming
|
||||
# turns) instead of the one-off /v1/chat/completions route.
|
||||
#
|
||||
# A SEPARATE process/advert from the one-off supplier on purpose: the chat
|
||||
# session holds the supplier's single-slot lock for the whole conversation
|
||||
# (minutes), which would starve one-off traffic if co-hosted.
|
||||
#
|
||||
# One of 8 Hetzner-backed suppliers (4 models x {one-off, chat-session});
|
||||
# fleet runbook: docs/HETZNER_SETUP.md.
|
||||
#
|
||||
# Pre-flight:
|
||||
# 1. DNS: mp-suppliers-qwen35b-chat.vector.apexfusion.org → host
|
||||
# (individual DNS-only A record → 91.98.147.172; NO wildcard exists —
|
||||
# letsencrypt HTTP-01 issuance needs the unproxied direct record)
|
||||
# 2. supplier/.env.qwen35b-chat written on host (chmod 600) with at minimum:
|
||||
# SUPPLIER_PRIV_KEY_HEX, SUPPLIER_ADDRESS, SUPPLIER_PKH,
|
||||
# SUPPLIER_PUB_KEY_HEX, OPENAI_API_KEY, OGMIOS_URL, NETWORK_ID=1,
|
||||
# VECTOR_ZERO_TIME_MS, ESCROW_REF_UTXO, ADVERT_REF_UTXO, ADVERT_REF,
|
||||
# LIVE_CHAIN=1
|
||||
# The advert must be posted with --capability-id llm.chat.v1 and a large
|
||||
# --max-processing-ms (~1800000) so Claim+Submit both land before deliver_by.
|
||||
# 3. Networks already exist (created by the canonical supplier compose):
|
||||
# docker network create marketplace-mainnet-net # one-shot
|
||||
# # traefik-net is created by the Traefik project
|
||||
|
||||
name: marketplace-mainnet-supplier-qwen35b-chat
|
||||
|
||||
services:
|
||||
supplier:
|
||||
build:
|
||||
context: ../..
|
||||
dockerfile: supplier/Dockerfile
|
||||
container_name: marketplace-mainnet-supplier-qwen35b-chat
|
||||
restart: unless-stopped
|
||||
env_file:
|
||||
# Self-contained env for this Hetzner-backed variant. Holds this
|
||||
# supplier's distinct SUPPLIER_PRIV_KEY_HEX (+ derived wallet vars),
|
||||
# ADVERT_REF, the shared Hetzner OPENAI_API_KEY, and the shared mainnet
|
||||
# plumbing duplicated in full (NETWORK_ID, OGMIOS_URL, VECTOR_ZERO_TIME_MS,
|
||||
# ref-script UTxOs, LIVE_CHAIN). No env_file ordering / override magic.
|
||||
- path: ../../supplier/.env.qwen35b-chat
|
||||
required: false
|
||||
environment:
|
||||
# Multi-turn chat session capability (mounts /v1/chat/{start,message,end}).
|
||||
CAPABILITY_KIND: chat-session
|
||||
LLM_BACKEND: openai
|
||||
# No /v1 suffix — supplier/src/openai.ts appends /v1/chat/completions
|
||||
# (Hetzner serves at https://inference.hetzner.com/api/v1/...).
|
||||
OPENAI_BASE_URL: https://inference.hetzner.com/api
|
||||
# Reasoning-style models can be slow; mirror the one-off compose.
|
||||
OPENAI_TIMEOUT_MS: "300000"
|
||||
# Idle end (supplier Submits the transcript): single-slot suppliers must
|
||||
# free up quickly (the gateway transparently reopens a session on the
|
||||
# next turn). Mirrors the kimi-chat fleet.
|
||||
CHAT_IDLE_TIMEOUT_MS: "900000"
|
||||
CHAT_SETTLE_MODE: ticket
|
||||
MAX_CHAT_SESSIONS: "8"
|
||||
PORT: "8080"
|
||||
# Enable LiveOgmiosProvider so Claim/Submit actually broadcast.
|
||||
LIVE_CHAIN: "1"
|
||||
# NETWORK_ID and OGMIOS_URL intentionally not pinned here — they MUST
|
||||
# come from the operator-provided supplier/.env.qwen35b-chat on a mainnet host.
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "wget -qO- http://localhost:8080/healthz >/dev/null || exit 1"]
|
||||
interval: 20s
|
||||
timeout: 5s
|
||||
retries: 3
|
||||
start_period: 15s
|
||||
networks:
|
||||
- marketplace-mainnet-net
|
||||
- traefik-net
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.docker.network=traefik-net"
|
||||
- "traefik.http.routers.mp-suppliers-qwen35b-chat-mainnet.entrypoints=web"
|
||||
- "traefik.http.routers.mp-suppliers-qwen35b-chat-mainnet.rule=Host(`mp-suppliers-qwen35b-chat.vector.apexfusion.org`)"
|
||||
- "traefik.http.routers.mp-suppliers-qwen35b-chat-mainnet.middlewares=mp-suppliers-qwen35b-chat-mainnet-https"
|
||||
- "traefik.http.middlewares.mp-suppliers-qwen35b-chat-mainnet-https.redirectscheme.scheme=https"
|
||||
- "traefik.http.middlewares.mp-suppliers-qwen35b-chat-mainnet-https.redirectscheme.permanent=true"
|
||||
- "traefik.http.routers.mp-suppliers-qwen35b-chat-mainnet-tls.entrypoints=websecure"
|
||||
- "traefik.http.routers.mp-suppliers-qwen35b-chat-mainnet-tls.rule=Host(`mp-suppliers-qwen35b-chat.vector.apexfusion.org`)"
|
||||
- "traefik.http.routers.mp-suppliers-qwen35b-chat-mainnet-tls.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.services.mp-suppliers-qwen35b-chat-mainnet.loadbalancer.server.port=8080"
|
||||
logging:
|
||||
driver: json-file
|
||||
options:
|
||||
max-size: "10m"
|
||||
max-file: "3"
|
||||
|
||||
networks:
|
||||
marketplace-mainnet-net:
|
||||
external: true
|
||||
name: marketplace-mainnet-net
|
||||
traefik-net:
|
||||
external: true
|
||||
name: traefik-net
|
||||
@@ -1,89 +0,0 @@
|
||||
# deploy/mainnet/docker-compose.supplier-qwen35b.yml — Supplier — MAINNET
|
||||
# (Hetzner Inference / Qwen/Qwen3.6-35B-A3B-FP8 — one-off `llm.text.generate.v1`)
|
||||
#
|
||||
# Hetzner-backed supplier. LLM_BACKEND=openai pointed directly at Hetzner's
|
||||
# hosted inference API (OpenAI-compatible at https://inference.hetzner.com/api).
|
||||
# No local proxy container — reachable over public HTTPS.
|
||||
#
|
||||
# One of 8 Hetzner-backed suppliers (4 models x {one-off, chat-session});
|
||||
# fleet runbook: docs/HETZNER_SETUP.md.
|
||||
#
|
||||
# Pre-flight:
|
||||
# 1. DNS: mp-suppliers-qwen35b.vector.apexfusion.org → host
|
||||
# (individual DNS-only A record → 91.98.147.172; NO wildcard exists —
|
||||
# letsencrypt HTTP-01 issuance needs the unproxied direct record)
|
||||
# 2. supplier/.env.qwen35b written on host (chmod 600) with at minimum:
|
||||
# SUPPLIER_PRIV_KEY_HEX, SUPPLIER_ADDRESS, SUPPLIER_PKH,
|
||||
# SUPPLIER_PUB_KEY_HEX, OPENAI_API_KEY, OGMIOS_URL, NETWORK_ID=1,
|
||||
# VECTOR_ZERO_TIME_MS, ESCROW_REF_UTXO, ADVERT_REF_UTXO, ADVERT_REF,
|
||||
# LIVE_CHAIN=1
|
||||
# 3. Networks already exist (created by the canonical supplier compose):
|
||||
# docker network create marketplace-mainnet-net # one-shot
|
||||
# # traefik-net is created by the Traefik project
|
||||
|
||||
name: marketplace-mainnet-supplier-qwen35b
|
||||
|
||||
services:
|
||||
supplier:
|
||||
build:
|
||||
context: ../..
|
||||
dockerfile: supplier/Dockerfile
|
||||
container_name: marketplace-mainnet-supplier-qwen35b
|
||||
restart: unless-stopped
|
||||
env_file:
|
||||
# Self-contained env for this Hetzner-backed variant. Holds this
|
||||
# supplier's distinct SUPPLIER_PRIV_KEY_HEX (+ derived wallet vars),
|
||||
# ADVERT_REF, the shared Hetzner OPENAI_API_KEY, and the shared mainnet
|
||||
# plumbing duplicated in full (NETWORK_ID, OGMIOS_URL, VECTOR_ZERO_TIME_MS,
|
||||
# ref-script UTxOs, LIVE_CHAIN). No env_file ordering / override magic.
|
||||
- path: ../../supplier/.env.qwen35b
|
||||
required: false
|
||||
environment:
|
||||
LLM_BACKEND: openai
|
||||
# No /v1 suffix — supplier/src/openai.ts appends /v1/chat/completions
|
||||
# (Hetzner serves at https://inference.hetzner.com/api/v1/...).
|
||||
OPENAI_BASE_URL: https://inference.hetzner.com/api
|
||||
# Reasoning-style models can be slow; matches the advert's
|
||||
# max_processing_ms (300000).
|
||||
OPENAI_TIMEOUT_MS: "300000"
|
||||
# OPENAI_MAX_TOKENS intentionally unset: no max_tokens forwarded upstream,
|
||||
# the provider grants context − prompt. Advert cap = model context length.
|
||||
PORT: "8080"
|
||||
# Enable LiveOgmiosProvider so submitTx/awaitTx actually broadcast.
|
||||
LIVE_CHAIN: "1"
|
||||
# NETWORK_ID and OGMIOS_URL intentionally not pinned here — they MUST
|
||||
# come from the operator-provided supplier/.env.qwen35b on a mainnet host.
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "wget -qO- http://localhost:8080/healthz >/dev/null || exit 1"]
|
||||
interval: 20s
|
||||
timeout: 5s
|
||||
retries: 3
|
||||
start_period: 15s
|
||||
networks:
|
||||
- marketplace-mainnet-net
|
||||
- traefik-net
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.docker.network=traefik-net"
|
||||
- "traefik.http.routers.mp-suppliers-qwen35b-mainnet.entrypoints=web"
|
||||
- "traefik.http.routers.mp-suppliers-qwen35b-mainnet.rule=Host(`mp-suppliers-qwen35b.vector.apexfusion.org`)"
|
||||
- "traefik.http.routers.mp-suppliers-qwen35b-mainnet.middlewares=mp-suppliers-qwen35b-mainnet-https"
|
||||
- "traefik.http.middlewares.mp-suppliers-qwen35b-mainnet-https.redirectscheme.scheme=https"
|
||||
- "traefik.http.middlewares.mp-suppliers-qwen35b-mainnet-https.redirectscheme.permanent=true"
|
||||
- "traefik.http.routers.mp-suppliers-qwen35b-mainnet-tls.entrypoints=websecure"
|
||||
- "traefik.http.routers.mp-suppliers-qwen35b-mainnet-tls.rule=Host(`mp-suppliers-qwen35b.vector.apexfusion.org`)"
|
||||
- "traefik.http.routers.mp-suppliers-qwen35b-mainnet-tls.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.services.mp-suppliers-qwen35b-mainnet.loadbalancer.server.port=8080"
|
||||
logging:
|
||||
driver: json-file
|
||||
options:
|
||||
max-size: "10m"
|
||||
max-file: "3"
|
||||
|
||||
networks:
|
||||
marketplace-mainnet-net:
|
||||
external: true
|
||||
name: marketplace-mainnet-net
|
||||
traefik-net:
|
||||
external: true
|
||||
name: traefik-net
|
||||
@@ -1,103 +0,0 @@
|
||||
# deploy/mainnet/docker-compose.supplier-qwen38-chat.yml — Supplier — MAINNET
|
||||
# (Hetzner Inference / Qwen3.8-27B — MULTI-TURN CHAT capability `llm.chat.v1`)
|
||||
#
|
||||
# The chat-session sibling of docker-compose.supplier-qwen38.yml. Same
|
||||
# image, same Hetzner backend (Qwen3.8-27B), but CAPABILITY_KIND=chat-session so
|
||||
# it mounts /v1/chat/{start,message,end} (escrow bookends, off-chain streaming
|
||||
# turns) instead of the one-off /v1/chat/completions route.
|
||||
#
|
||||
# A SEPARATE process/advert from the one-off supplier on purpose: the chat
|
||||
# session holds the supplier's single-slot lock for the whole conversation
|
||||
# (minutes), which would starve one-off traffic if co-hosted.
|
||||
#
|
||||
# One of the Hetzner-backed suppliers (models x {one-off, chat-session});
|
||||
# fleet runbook: docs/HETZNER_SETUP.md. Wallet reused from the retired
|
||||
# kimi-code-chat supplier (Hetzner dropped Kimi-K2.7-Code on 2026-08; advert
|
||||
# retired 2026-08-21, tx 3d1b43645c00bdb7b429f29ced798bc4af206c9dc56074e955d84b603b64f50c).
|
||||
#
|
||||
# Pre-flight:
|
||||
# 1. DNS: mp-suppliers-qwen38-chat.vector.apexfusion.org → host
|
||||
# (individual DNS-only A record → 91.98.147.172; NO wildcard exists —
|
||||
# letsencrypt HTTP-01 issuance needs the unproxied direct record)
|
||||
# 2. supplier/.env.qwen38-chat written on host (chmod 600) with at minimum:
|
||||
# SUPPLIER_PRIV_KEY_HEX, SUPPLIER_ADDRESS, SUPPLIER_PKH,
|
||||
# SUPPLIER_PUB_KEY_HEX, OPENAI_API_KEY, OGMIOS_URL, NETWORK_ID=1,
|
||||
# VECTOR_ZERO_TIME_MS, ESCROW_REF_UTXO, ADVERT_REF_UTXO, ADVERT_REF,
|
||||
# LIVE_CHAIN=1
|
||||
# The advert must be posted with --capability-id llm.chat.v1 and a large
|
||||
# --max-processing-ms (~1800000) so Claim+Submit both land before deliver_by.
|
||||
# 3. Networks already exist (created by the canonical supplier compose):
|
||||
# docker network create marketplace-mainnet-net # one-shot
|
||||
# # traefik-net is created by the Traefik project
|
||||
|
||||
name: marketplace-mainnet-supplier-qwen38-chat
|
||||
|
||||
services:
|
||||
supplier:
|
||||
build:
|
||||
context: ../..
|
||||
dockerfile: supplier/Dockerfile
|
||||
container_name: marketplace-mainnet-supplier-qwen38-chat
|
||||
restart: unless-stopped
|
||||
env_file:
|
||||
# Self-contained env for this Hetzner-backed variant. Holds this
|
||||
# supplier's distinct SUPPLIER_PRIV_KEY_HEX (+ derived wallet vars),
|
||||
# ADVERT_REF, the shared Hetzner OPENAI_API_KEY, and the shared mainnet
|
||||
# plumbing duplicated in full (NETWORK_ID, OGMIOS_URL, VECTOR_ZERO_TIME_MS,
|
||||
# ref-script UTxOs, LIVE_CHAIN). No env_file ordering / override magic.
|
||||
- path: ../../supplier/.env.qwen38-chat
|
||||
required: false
|
||||
environment:
|
||||
# Multi-turn chat session capability (mounts /v1/chat/{start,message,end}).
|
||||
CAPABILITY_KIND: chat-session
|
||||
LLM_BACKEND: openai
|
||||
# No /v1 suffix — supplier/src/openai.ts appends /v1/chat/completions
|
||||
# (Hetzner serves at https://inference.hetzner.com/api/v1/...).
|
||||
OPENAI_BASE_URL: https://inference.hetzner.com/api
|
||||
# Reasoning-style models can be slow; mirror the one-off compose.
|
||||
OPENAI_TIMEOUT_MS: "300000"
|
||||
# Idle end (supplier Submits the transcript): single-slot suppliers must
|
||||
# free up quickly (the gateway transparently reopens a session on the
|
||||
# next turn). Mirrors the kimi-chat fleet.
|
||||
CHAT_IDLE_TIMEOUT_MS: "900000"
|
||||
CHAT_SETTLE_MODE: ticket
|
||||
MAX_CHAT_SESSIONS: "8"
|
||||
PORT: "8080"
|
||||
# Enable LiveOgmiosProvider so Claim/Submit actually broadcast.
|
||||
LIVE_CHAIN: "1"
|
||||
# NETWORK_ID and OGMIOS_URL intentionally not pinned here — they MUST
|
||||
# come from the operator-provided supplier/.env.qwen38-chat on a mainnet host.
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "wget -qO- http://localhost:8080/healthz >/dev/null || exit 1"]
|
||||
interval: 20s
|
||||
timeout: 5s
|
||||
retries: 3
|
||||
start_period: 15s
|
||||
networks:
|
||||
- marketplace-mainnet-net
|
||||
- traefik-net
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.docker.network=traefik-net"
|
||||
- "traefik.http.routers.mp-suppliers-qwen38-chat-mainnet.entrypoints=web"
|
||||
- "traefik.http.routers.mp-suppliers-qwen38-chat-mainnet.rule=Host(`mp-suppliers-qwen38-chat.vector.apexfusion.org`)"
|
||||
- "traefik.http.routers.mp-suppliers-qwen38-chat-mainnet.middlewares=mp-suppliers-qwen38-chat-mainnet-https"
|
||||
- "traefik.http.middlewares.mp-suppliers-qwen38-chat-mainnet-https.redirectscheme.scheme=https"
|
||||
- "traefik.http.middlewares.mp-suppliers-qwen38-chat-mainnet-https.redirectscheme.permanent=true"
|
||||
- "traefik.http.routers.mp-suppliers-qwen38-chat-mainnet-tls.entrypoints=websecure"
|
||||
- "traefik.http.routers.mp-suppliers-qwen38-chat-mainnet-tls.rule=Host(`mp-suppliers-qwen38-chat.vector.apexfusion.org`)"
|
||||
- "traefik.http.routers.mp-suppliers-qwen38-chat-mainnet-tls.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.services.mp-suppliers-qwen38-chat-mainnet.loadbalancer.server.port=8080"
|
||||
logging:
|
||||
driver: json-file
|
||||
options:
|
||||
max-size: "10m"
|
||||
max-file: "3"
|
||||
|
||||
networks:
|
||||
marketplace-mainnet-net:
|
||||
external: true
|
||||
name: marketplace-mainnet-net
|
||||
traefik-net:
|
||||
external: true
|
||||
name: traefik-net
|
||||
@@ -1,91 +0,0 @@
|
||||
# deploy/mainnet/docker-compose.supplier-qwen38.yml — Supplier — MAINNET
|
||||
# (Hetzner Inference / Qwen3.8-27B — one-off `llm.text.generate.v1`)
|
||||
#
|
||||
# Hetzner-backed supplier. LLM_BACKEND=openai pointed directly at Hetzner's
|
||||
# hosted inference API (OpenAI-compatible at https://inference.hetzner.com/api).
|
||||
# No local proxy container — reachable over public HTTPS.
|
||||
#
|
||||
# One of the Hetzner-backed suppliers (models x {one-off, chat-session});
|
||||
# fleet runbook: docs/HETZNER_SETUP.md. Wallet reused from the retired
|
||||
# kimi-code supplier (Hetzner dropped Kimi-K2.7-Code on 2026-08; advert
|
||||
# retired 2026-08-21, tx 3f37082166faf2b2220e6476235bae8723af9a3434a6aaf60277366ff1f62bfb).
|
||||
#
|
||||
# Pre-flight:
|
||||
# 1. DNS: mp-suppliers-qwen38.vector.apexfusion.org → host
|
||||
# (individual DNS-only A record → 91.98.147.172; NO wildcard exists —
|
||||
# letsencrypt HTTP-01 issuance needs the unproxied direct record)
|
||||
# 2. supplier/.env.qwen38 written on host (chmod 600) with at minimum:
|
||||
# SUPPLIER_PRIV_KEY_HEX, SUPPLIER_ADDRESS, SUPPLIER_PKH,
|
||||
# SUPPLIER_PUB_KEY_HEX, OPENAI_API_KEY, OGMIOS_URL, NETWORK_ID=1,
|
||||
# VECTOR_ZERO_TIME_MS, ESCROW_REF_UTXO, ADVERT_REF_UTXO, ADVERT_REF,
|
||||
# LIVE_CHAIN=1
|
||||
# 3. Networks already exist (created by the canonical supplier compose):
|
||||
# docker network create marketplace-mainnet-net # one-shot
|
||||
# # traefik-net is created by the Traefik project
|
||||
|
||||
name: marketplace-mainnet-supplier-qwen38
|
||||
|
||||
services:
|
||||
supplier:
|
||||
build:
|
||||
context: ../..
|
||||
dockerfile: supplier/Dockerfile
|
||||
container_name: marketplace-mainnet-supplier-qwen38
|
||||
restart: unless-stopped
|
||||
env_file:
|
||||
# Self-contained env for this Hetzner-backed variant. Holds this
|
||||
# supplier's distinct SUPPLIER_PRIV_KEY_HEX (+ derived wallet vars),
|
||||
# ADVERT_REF, the shared Hetzner OPENAI_API_KEY, and the shared mainnet
|
||||
# plumbing duplicated in full (NETWORK_ID, OGMIOS_URL, VECTOR_ZERO_TIME_MS,
|
||||
# ref-script UTxOs, LIVE_CHAIN). No env_file ordering / override magic.
|
||||
- path: ../../supplier/.env.qwen38
|
||||
required: false
|
||||
environment:
|
||||
LLM_BACKEND: openai
|
||||
# No /v1 suffix — supplier/src/openai.ts appends /v1/chat/completions
|
||||
# (Hetzner serves at https://inference.hetzner.com/api/v1/...).
|
||||
OPENAI_BASE_URL: https://inference.hetzner.com/api
|
||||
# Reasoning-style models can be slow; matches the advert's
|
||||
# max_processing_ms (300000).
|
||||
OPENAI_TIMEOUT_MS: "300000"
|
||||
# OPENAI_MAX_TOKENS intentionally unset: no max_tokens forwarded upstream,
|
||||
# the provider grants context − prompt. Advert cap = model context length.
|
||||
PORT: "8080"
|
||||
# Enable LiveOgmiosProvider so submitTx/awaitTx actually broadcast.
|
||||
LIVE_CHAIN: "1"
|
||||
# NETWORK_ID and OGMIOS_URL intentionally not pinned here — they MUST
|
||||
# come from the operator-provided supplier/.env.qwen38 on a mainnet host.
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "wget -qO- http://localhost:8080/healthz >/dev/null || exit 1"]
|
||||
interval: 20s
|
||||
timeout: 5s
|
||||
retries: 3
|
||||
start_period: 15s
|
||||
networks:
|
||||
- marketplace-mainnet-net
|
||||
- traefik-net
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.docker.network=traefik-net"
|
||||
- "traefik.http.routers.mp-suppliers-qwen38-mainnet.entrypoints=web"
|
||||
- "traefik.http.routers.mp-suppliers-qwen38-mainnet.rule=Host(`mp-suppliers-qwen38.vector.apexfusion.org`)"
|
||||
- "traefik.http.routers.mp-suppliers-qwen38-mainnet.middlewares=mp-suppliers-qwen38-mainnet-https"
|
||||
- "traefik.http.middlewares.mp-suppliers-qwen38-mainnet-https.redirectscheme.scheme=https"
|
||||
- "traefik.http.middlewares.mp-suppliers-qwen38-mainnet-https.redirectscheme.permanent=true"
|
||||
- "traefik.http.routers.mp-suppliers-qwen38-mainnet-tls.entrypoints=websecure"
|
||||
- "traefik.http.routers.mp-suppliers-qwen38-mainnet-tls.rule=Host(`mp-suppliers-qwen38.vector.apexfusion.org`)"
|
||||
- "traefik.http.routers.mp-suppliers-qwen38-mainnet-tls.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.services.mp-suppliers-qwen38-mainnet.loadbalancer.server.port=8080"
|
||||
logging:
|
||||
driver: json-file
|
||||
options:
|
||||
max-size: "10m"
|
||||
max-file: "3"
|
||||
|
||||
networks:
|
||||
marketplace-mainnet-net:
|
||||
external: true
|
||||
name: marketplace-mainnet-net
|
||||
traefik-net:
|
||||
external: true
|
||||
name: traefik-net
|
||||
@@ -65,12 +65,6 @@ services:
|
||||
- "traefik.docker.network=traefik-net"
|
||||
- "traefik.http.routers.mp-suppliers-tts-mainnet.entrypoints=web"
|
||||
- "traefik.http.routers.mp-suppliers-tts-mainnet.rule=Host(`mp-suppliers-tts.vector.apexfusion.org`)"
|
||||
- "traefik.http.routers.mp-suppliers-tts-mainnet.middlewares=mp-suppliers-tts-mainnet-https"
|
||||
- "traefik.http.middlewares.mp-suppliers-tts-mainnet-https.redirectscheme.scheme=https"
|
||||
- "traefik.http.middlewares.mp-suppliers-tts-mainnet-https.redirectscheme.permanent=true"
|
||||
- "traefik.http.routers.mp-suppliers-tts-mainnet-tls.entrypoints=websecure"
|
||||
- "traefik.http.routers.mp-suppliers-tts-mainnet-tls.rule=Host(`mp-suppliers-tts.vector.apexfusion.org`)"
|
||||
- "traefik.http.routers.mp-suppliers-tts-mainnet-tls.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.services.mp-suppliers-tts-mainnet.loadbalancer.server.port=8080"
|
||||
logging:
|
||||
driver: json-file
|
||||
|
||||
@@ -60,12 +60,6 @@ services:
|
||||
- "traefik.docker.network=traefik-net"
|
||||
- "traefik.http.routers.mp-suppliers-mainnet.entrypoints=web"
|
||||
- "traefik.http.routers.mp-suppliers-mainnet.rule=Host(`mp-suppliers.vector.apexfusion.org`)"
|
||||
- "traefik.http.routers.mp-suppliers-mainnet.middlewares=mp-suppliers-mainnet-https"
|
||||
- "traefik.http.middlewares.mp-suppliers-mainnet-https.redirectscheme.scheme=https"
|
||||
- "traefik.http.middlewares.mp-suppliers-mainnet-https.redirectscheme.permanent=true"
|
||||
- "traefik.http.routers.mp-suppliers-mainnet-tls.entrypoints=websecure"
|
||||
- "traefik.http.routers.mp-suppliers-mainnet-tls.rule=Host(`mp-suppliers.vector.apexfusion.org`)"
|
||||
- "traefik.http.routers.mp-suppliers-mainnet-tls.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.services.mp-suppliers-mainnet.loadbalancer.server.port=8080"
|
||||
logging:
|
||||
driver: json-file
|
||||
|
||||
@@ -1,46 +0,0 @@
|
||||
name: marketplace-mainnet-surplus-seller
|
||||
|
||||
services:
|
||||
surplus-seller:
|
||||
build:
|
||||
context: ../..
|
||||
dockerfile: supplier/Dockerfile
|
||||
container_name: marketplace-mainnet-surplus-seller
|
||||
restart: unless-stopped
|
||||
command:
|
||||
- node_modules/.bin/tsx
|
||||
- supplier/src/cli/surplus-seller.ts
|
||||
env_file:
|
||||
- path: /var/lib/agents-marketplace/surplus-seller.env
|
||||
required: true
|
||||
read_only: true
|
||||
tmpfs:
|
||||
- /tmp:size=64m,mode=1777
|
||||
cap_drop:
|
||||
- ALL
|
||||
security_opt:
|
||||
- no-new-privileges:true
|
||||
volumes:
|
||||
- surplus-seller-state:/var/lib/surplus-manager
|
||||
networks:
|
||||
- marketplace-mainnet-net
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:8080/healthz >/dev/null || exit 1"]
|
||||
interval: 20s
|
||||
timeout: 5s
|
||||
retries: 3
|
||||
start_period: 60s
|
||||
logging:
|
||||
driver: json-file
|
||||
options:
|
||||
max-size: "10m"
|
||||
max-file: "3"
|
||||
|
||||
volumes:
|
||||
surplus-seller-state:
|
||||
name: marketplace-mainnet-surplus-seller-state
|
||||
|
||||
networks:
|
||||
marketplace-mainnet-net:
|
||||
external: true
|
||||
name: marketplace-mainnet-net
|
||||
@@ -1,21 +0,0 @@
|
||||
{
|
||||
"networkId": 1,
|
||||
"ogmiosUrl": "https://ogmios.vector.mainnet.apexfusion.org",
|
||||
"endpointUrl": "https://mp-suppliers-openrouter-reseller.vector.apexfusion.org",
|
||||
"marketplaceModel": "deepseek/deepseek-v4-flash",
|
||||
"openRouterModel": "deepseek/deepseek-v4-flash",
|
||||
"maxInputTokens": 8192,
|
||||
"maxOutputTokens": 512,
|
||||
"maxProcessingMs": 600000,
|
||||
"inferenceTimeoutMs": 180000,
|
||||
"priceLovelace": "200000",
|
||||
"supplierBondLovelace": "1000000",
|
||||
"buyerBondLovelace": "1000000",
|
||||
"reserveUsd": "1.00",
|
||||
"pollIntervalMs": 30000,
|
||||
"providerTimeoutMs": 10000,
|
||||
"previewMaxChars": 160,
|
||||
"minimumWalletLovelace": "20000000",
|
||||
"fundingTimeoutMs": 3600000,
|
||||
"composeFile": "deploy/mainnet/docker-compose.supplier-openrouter-reseller.yml"
|
||||
}
|
||||
@@ -8,13 +8,13 @@
|
||||
|
||||
## 1. Goal and scope
|
||||
|
||||
**What this is.** A two-sided marketplace where buyers (agents or humans) submit prompts to suppliers running inference on their own hardware, with each job settled in AP3X through on-chain bonded escrow on Vector L2, and receive signed-receipt responses. The primary validation goal is **technical feasibility + lifecycle** ("can it be done end-to-end"), not demand modelling or economic stress testing.
|
||||
**What this is.** A two-sided marketplace where buyers (agents or humans) submit prompts to suppliers running inference on their own hardware, pay with AP3X via on-chain bonded escrow on Vector L2, and receive signed-receipt responses. The primary validation goal is **technical feasibility + lifecycle** ("can it be done end-to-end"), not demand modelling or economic stress testing.
|
||||
|
||||
**What v1 is NOT.**
|
||||
- Not agentic on the supplier side. Suppliers answer single prompts. Buyer agents drive multiple prompts.
|
||||
- Not LLM-only in design. Capability model is open from day 1 (whisper / kokoro / image generation are planned siblings), but the first supplier is an LLM.
|
||||
- Not multi-slot. Single-slot per supplier process. Multi-capability operators run multiple processes.
|
||||
- Not multi-chain. Vector only (testnet and mainnet).
|
||||
- Not multi-chain. Vector testnet first, mainnet later. Masumi / Sokosumi / USDM is target #2 (adapter, not fork).
|
||||
- Not disputed. M1 ships happy-path escrow only. Module-1 disputes wire in M2.
|
||||
- Not streaming. `stream: true` is rejected by suppliers.
|
||||
- Not tool-calling. `tools` / `tool_choice` / `functions` are rejected by suppliers.
|
||||
@@ -24,7 +24,7 @@
|
||||
|
||||
| # | Decision |
|
||||
|---|---|
|
||||
| 1 | Settlement asset: **AP3X**, bonded in escrow; jobs settle in AP3X on accepted work. |
|
||||
| 1 | Payment token: **AP3X** (Vector testnet, later mainnet). Masumi = USDM, target #2. |
|
||||
| 2 | v1 scope: **Option C** — happy-path escrow only, no disputes. Module-1 wiring is milestone 2. |
|
||||
| 3 | Module-1 contract source: TBD — to be located or restored before M2. Not blocking M0–M1. |
|
||||
| 4 | Evidence: **signed receipt** `{prompt_hash, response_hash, model, tokens, wallclock}` + Ed25519 supplier signature. Hash on-chain, plaintext off-chain. |
|
||||
@@ -283,6 +283,7 @@ Malformed datum · escrow to wrong script · supplier claims escrow addressed to
|
||||
| **M1** | Happy-path end-to-end, Hetzner CPU supplier | 2–3 wks | `qwen2.5:0.5b` on Hetzner, buyer posts → supplier claims → submits → buyer accepts; full Vector testnet lifecycle; indexer serves discovery |
|
||||
| **M2** | Module-1 dispute wiring | 2–3 wks post-M1 | Contract source located; supplier=claimer / buyer=auditor mapping; Dispute state; evidence URI; mainnet-dry-run lifecycle |
|
||||
| **M3** | Capability expansion + local lab | 2–4 wks (may overlap M2) | `speech.transcribe.v1` via Whisper live; local-lab GPU supplier with larger model; heterogeneous discovery validated |
|
||||
| **M4** | Masumi / Sokosumi adapter | later | MIP-003 HTTP shim; MIP-002 NFT registration; USDM payment path; Sokosumi listing |
|
||||
|
||||
## 9. Open follow-ups (not blocking M0 / M1)
|
||||
|
||||
@@ -309,3 +310,5 @@ Malformed datum · escrow to wrong script · supplier claims escrow addressed to
|
||||
- Apex-dashboard CBOR decoders: `apex-dashboard/server/cbor-decoder.ts`
|
||||
- Apex-dashboard test discipline: `apex-dashboard/tests/`
|
||||
- Prior Python reference (AP3X buyer/supplier): `./docs/buyer/`, `./docs/supplier/`
|
||||
- Masumi docs: https://docs.masumi.network/
|
||||
- MIP-003 spec: https://docs.masumi.network/mips/_mip-003
|
||||
|
||||
@@ -1,291 +0,0 @@
|
||||
# Deploy a New Supplier — Operator Runbook
|
||||
|
||||
> Audience: anyone who wants to sell inference on the agents-marketplace by
|
||||
> running a **mainnet supplier** on a server they control. Everything below
|
||||
> uses your own hardware, DNS, and funds — no access to the Apex Fusion fleet
|
||||
> is required. (Fleet-internal runbooks: `docs/HETZNER_SETUP.md`,
|
||||
> `deploy/README.md`. A live worked example of exactly this standalone
|
||||
> pattern: `deploy/inference-proxy/README.md`.)
|
||||
|
||||
---
|
||||
|
||||
## 1. What a supplier is
|
||||
|
||||
A supplier is one Docker container that:
|
||||
|
||||
1. Holds an **on-chain advertisement** (a UTxO on the Vector mainnet chain)
|
||||
declaring capability, model, price, bonds, and your endpoint URL.
|
||||
2. Serves a **public HTTPS endpoint** that buyers call after locking payment
|
||||
in escrow. Any hostname you control works — the advert carries the URL,
|
||||
and the marketplace indexer probes it as-is.
|
||||
3. Runs the job against an upstream inference backend and settles on-chain
|
||||
(Claim → Submit; bonds of 1 AP3X ride on each job).
|
||||
|
||||
One supplier = one (model × capability) pair = one wallet = one advert = one
|
||||
compose file. Capabilities: `llm.text.generate.v1` (one-off) or `llm.chat.v1`
|
||||
(multi-turn session, `CAPABILITY_KIND=chat-session`). There is also a TTS
|
||||
kind (`CAPABILITY_KIND=tts`); this runbook covers the LLM kinds.
|
||||
|
||||
## 2. Prerequisites
|
||||
|
||||
| Requirement | Notes |
|
||||
|---|---|
|
||||
| Linux server | Public IPv4, Docker installed, ports 80 + 443 free (for the bundled Traefik). A small VPS is enough — the container only proxies and settles; the heavy compute is upstream. |
|
||||
| DNS name you control | One A record, e.g. `supplier.example.com` → your server IP. Must be **DNS-only / unproxied** — TLS certs come from Let's Encrypt HTTP-01, which a CDN-proxied record breaks. |
|
||||
| Upstream backend | Any OpenAI-compatible API: base URL + API key. Proven in production: hosted APIs (DeepSeek, OpenRouter, Hetzner Inference), local llama.cpp, agent gateways. |
|
||||
| Model id | Must be the **verbatim** upstream id (incl. prefixes like `Qwen/`). Verify against the backend's `/v1/models`. |
|
||||
| Capability | `llm.text.generate.v1` or `llm.chat.v1` (or both → two suppliers, two wallets). |
|
||||
| Advert params | Your call. Reference values used by the Apex Fusion fleet: price `200000` lovelace (0.2 AP3X), bonds `1000000` both sides, `max_processing_ms` `300000` one-off / `1800000` chat, `max_output_tokens` = model context length. |
|
||||
| Funding | ≥50 AP3X mainnet to the new supplier wallet, from your own funds (the fleet typically funds 50–200). Each advert locks a 1 AP3X supplier bond; each job rides another. |
|
||||
|
||||
## 3. Vector mainnet constants (same for every operator)
|
||||
|
||||
These are chain-level values, identical for all suppliers; put them in every
|
||||
supplier env file:
|
||||
|
||||
```
|
||||
NETWORK_ID=1
|
||||
LIVE_CHAIN=1
|
||||
OGMIOS_URL=https://ogmios.vector.mainnet.apexfusion.org
|
||||
VECTOR_ZERO_TIME_MS=1756485600000
|
||||
ESCROW_REF_UTXO=c8d84c6d67ec67a1efe5e9c6c06d53020e05d1bb96d1c55ecb1eb7d5010c4d54#0
|
||||
ADVERT_REF_UTXO=c8d84c6d67ec67a1efe5e9c6c06d53020e05d1bb96d1c55ecb1eb7d5010c4d54#1
|
||||
```
|
||||
|
||||
`OGMIOS_URL` above is a public endpoint; if you run your own Vector node +
|
||||
Ogmios, point at that instead. Never pin `NETWORK_ID` / `OGMIOS_URL` inside
|
||||
the compose file — they must come from the env file (prevents
|
||||
mainnet/testnet cross-wiring on re-up).
|
||||
|
||||
## 4. Procedure
|
||||
|
||||
### 4.1 Smoke-test the backend first (before spending on-chain)
|
||||
|
||||
```bash
|
||||
curl -sS -X POST <BASE_URL>/v1/chat/completions \
|
||||
-H "Authorization: Bearer $KEY" -H "Content-Type: application/json" \
|
||||
-d '{"model":"<MODEL_ID>","messages":[{"role":"user","content":"ping"}]}' \
|
||||
| jq '.choices[0].message.content'
|
||||
```
|
||||
|
||||
Requirements: non-empty string content, **no `max_tokens` sent** (matches
|
||||
runtime behavior). For a chat supplier, also verify a `tools`/`tool_choice`
|
||||
round-trip. A backend that fails these costs you the 1 AP3X supplier bond per
|
||||
failed job (`openai_malformed`).
|
||||
|
||||
### 4.2 Prepare the host
|
||||
|
||||
```bash
|
||||
curl -fsSL https://get.docker.com | sh # if Docker is missing
|
||||
git clone https://github.com/Apex-Fusion/agents-marketplace.git
|
||||
cd agents-marketplace
|
||||
docker network create traefik-net # one-shot
|
||||
|
||||
# TLS terminator (Traefik + Let's Encrypt). One per host; serves every
|
||||
# supplier you run on it.
|
||||
cd deploy/inference-proxy
|
||||
echo 'ACME_EMAIL=<your email>' > .env && chmod 600 .env
|
||||
docker compose -f docker-compose.traefik.yml up -d
|
||||
cd ../..
|
||||
```
|
||||
|
||||
Already have your own reverse proxy? Skip Traefik: terminate TLS for
|
||||
`https://<your-dns-name>` yourself and forward to the supplier container's
|
||||
port 8080, then drop the `traefik` labels and network from the compose file
|
||||
in §4.4.
|
||||
|
||||
### 4.3 DNS
|
||||
|
||||
Create `<your-dns-name>` → A record for your server IP, **DNS-only /
|
||||
unproxied**. Traefik issues the Let's Encrypt cert via HTTP-01 on port 80
|
||||
automatically ~1 min after propagation; no restart needed.
|
||||
|
||||
### 4.4 Compose file
|
||||
|
||||
Copy the standalone-box template and rename its identity strings:
|
||||
|
||||
```bash
|
||||
mkdir -p deploy/self-hosted
|
||||
cp deploy/inference-proxy/docker-compose.supplier-local.yml \
|
||||
deploy/self-hosted/docker-compose.supplier-<name>.yml
|
||||
```
|
||||
|
||||
(The relative paths inside — `build.context: ../..`,
|
||||
`env_file: ../../supplier/.env.<name>` — assume the file sits two directory
|
||||
levels below the repo root.)
|
||||
|
||||
Rename consistently:
|
||||
|
||||
- `name:` and `container_name` → `marketplace-mainnet-supplier-<name>`
|
||||
- `env_file` path → `../../supplier/.env.<name>`
|
||||
- every Traefik label token `mp-suppliers-local-mainnet` → a token of your
|
||||
own (router names must be unique per Traefik instance)
|
||||
- `Host(...)` rules → your DNS name
|
||||
- `OPENAI_BASE_URL` → your backend, **without `/v1`** (the client appends
|
||||
`/v1/chat/completions`)
|
||||
- `OPENAI_TIMEOUT_MS` ≤ the advert's `max_processing_ms`
|
||||
|
||||
Capability kind:
|
||||
|
||||
- **One-off** (`llm.text.generate.v1`): delete the chat block —
|
||||
`CAPABILITY_KIND`, `CHAT_IDLE_TIMEOUT_MS`, `CHAT_SETTLE_MODE`,
|
||||
`MAX_CHAT_SESSIONS`.
|
||||
- **Chat** (`llm.chat.v1`): keep `CAPABILITY_KIND: chat-session`. Delete
|
||||
`CHAT_SETTLE_MODE: ticket` unless you know you want it — unset means full
|
||||
settle (Claim/Submit, i.e. you collect payment on-chain); `ticket` skips
|
||||
all supplier chain ops and the buyer reclaims the escrow.
|
||||
|
||||
The mainnet fleet templates (`deploy/mainnet/docker-compose.supplier-*.yml`)
|
||||
are also valid references, but they attach to `marketplace-mainnet-net`,
|
||||
which does not exist on a standalone box — remove it if you start from one
|
||||
of those.
|
||||
|
||||
Compose files are safe to commit to your fork (no secrets); env files are
|
||||
never committed.
|
||||
|
||||
### 4.5 Generate and fund the wallet
|
||||
|
||||
No Node needed on the host — build the supplier image once and run the CLI
|
||||
inside it:
|
||||
|
||||
```bash
|
||||
docker compose -f deploy/self-hosted/docker-compose.supplier-<name>.yml build
|
||||
docker compose -f deploy/self-hosted/docker-compose.supplier-<name>.yml \
|
||||
run --rm --no-deps supplier \
|
||||
node_modules/.bin/tsx supplier/src/cli/gen-keypair.ts --network 1
|
||||
# prints privateKeyHex, publicKeyHex, pubKeyHash, address
|
||||
```
|
||||
|
||||
(With Node + pnpm available locally:
|
||||
`pnpm --filter @marketplace/supplier tx:gen-keypair --network 1`.)
|
||||
|
||||
Fund the printed address from your own wallet (≥50 AP3X). Optimal UTxO shape
|
||||
is **2 UTxOs**: one ≥5 AP3X collateral + one working UTxO. If the wallet ends
|
||||
up fragmented later, run `tx:consolidate-wallet` (can be docker-exec'd inside
|
||||
the running supplier container — it already has the key via env).
|
||||
|
||||
### 4.6 Env file
|
||||
|
||||
```bash
|
||||
cp supplier/.env.example supplier/.env.<name>
|
||||
chmod 600 supplier/.env.<name>
|
||||
```
|
||||
|
||||
Must contain, at minimum:
|
||||
|
||||
- **All four wallet vars**: `SUPPLIER_PRIV_KEY_HEX`, `SUPPLIER_ADDRESS`,
|
||||
`SUPPLIER_PKH`, `SUPPLIER_PUB_KEY_HEX`. They are NOT derived at boot;
|
||||
a missing derived var causes `403 wrong_supplier` on every job.
|
||||
- `OPENAI_API_KEY` (empty is legal only for unauthenticated backends).
|
||||
- The shared plumbing block from §3.
|
||||
- `ADVERT_REF=` left as placeholder until §4.8.
|
||||
|
||||
Backend selection (`LLM_BACKEND=openai`, `OPENAI_BASE_URL`,
|
||||
`OPENAI_TIMEOUT_MS`, `CAPABILITY_KIND`) lives in the compose file (§4.4),
|
||||
not the env file.
|
||||
|
||||
### 4.7 First start
|
||||
|
||||
```bash
|
||||
docker compose -f deploy/self-hosted/docker-compose.supplier-<name>.yml up -d --build
|
||||
```
|
||||
|
||||
Verify before going on-chain:
|
||||
|
||||
- `docker logs marketplace-mainnet-supplier-<name> --tail 50` — no
|
||||
crash-loop.
|
||||
- `curl https://<your-dns-name>/healthz` → `{"ok":true}` (proves DNS, cert
|
||||
issuance, and routing end-to-end).
|
||||
|
||||
Every deploy on your box is manual: `git pull` +
|
||||
`docker compose ... up -d --build`. No CD pipeline covers it.
|
||||
|
||||
### 4.8 Post the advert (go-live — do this LAST)
|
||||
|
||||
The advert is the go-live flag: the moment it confirms, the indexer starts
|
||||
probing `<endpoint>/status` and buyers can lock escrows. Post it only after
|
||||
§4.7 is green, so buyers never hit a dead endpoint.
|
||||
|
||||
```bash
|
||||
docker compose -f deploy/self-hosted/docker-compose.supplier-<name>.yml \
|
||||
run --rm --no-deps supplier \
|
||||
node_modules/.bin/tsx supplier/src/cli/post-advert.ts \
|
||||
--capability-id llm.text.generate.v1 \
|
||||
--model '<MODEL_ID>' \
|
||||
--max-output-tokens <CTX_LEN> \
|
||||
--max-processing-ms 300000 \
|
||||
--price-lovelace 200000 \
|
||||
--endpoint-url https://<your-dns-name>
|
||||
# chat variant: --capability-id llm.chat.v1 --max-processing-ms 1800000
|
||||
```
|
||||
|
||||
Paste the printed `<txHash>#0` into `ADVERT_REF` in `supplier/.env.<name>`,
|
||||
then:
|
||||
|
||||
```bash
|
||||
docker compose -f deploy/self-hosted/docker-compose.supplier-<name>.yml up -d --force-recreate
|
||||
```
|
||||
|
||||
Note: adverts are immutable — changing the model, price, or endpoint later
|
||||
requires `tx:retire-advert` (refunds the advert bond) + a fresh post-advert
|
||||
+ a new `ADVERT_REF`.
|
||||
|
||||
## 5. Verification checklist
|
||||
|
||||
- `curl https://<your-dns-name>/healthz` → `{"ok":true}`.
|
||||
- `/capability` on the same host shows the right model + pkh.
|
||||
- Public marketplace indexer lists your advert:
|
||||
`curl https://mp-indexer.vector.apexfusion.org/suppliers` → your entry with
|
||||
`advert_status: "Active"`, `status: "free"`. The indexer follows the chain,
|
||||
so a confirmed advert appears automatically — no registration step.
|
||||
(The buyer API and OpenAI gateway at `marketplace.vector.apexfusion.org` /
|
||||
`api.marketplace.vector.apexfusion.org` require buyer API keys; buyers with
|
||||
keys will see your model in the gateway's `/openai/v1/models`.)
|
||||
- Tail `docker logs -f marketplace-mainnet-supplier-<name>` through the
|
||||
first paid jobs; watch for `openai_malformed` (reasoning-model
|
||||
content-shape risk) and `403 wrong_supplier` (missing derived wallet vars).
|
||||
|
||||
## 6. Ongoing operations
|
||||
|
||||
- **Update**: `git pull && docker compose -f ... up -d --build`.
|
||||
- **Model swap**: `tx:retire-advert` → post-advert with the new `--model` →
|
||||
new `ADVERT_REF` in the env file → `up -d --force-recreate`.
|
||||
- **Wallet health**: keep the 2-UTxO shape; run `tx:consolidate-wallet` if
|
||||
script-spends start failing with collateral-selector errors.
|
||||
- **Exit**: `tx:retire-advert` refunds the advert bond and delists you; the
|
||||
wallet keeps its funds.
|
||||
- **Monitoring (optional)**: the repo ships a balance monitor
|
||||
(`wallet-monitor/`, `buyer/scripts/monitor-wallets.ts`) you can run against
|
||||
your own wallet list.
|
||||
|
||||
## 7. Footguns (each has burned an operator before)
|
||||
|
||||
1. `OPENAI_BASE_URL` must NOT end in `/v1`.
|
||||
2. Advert `--model` must match the upstream id byte-for-byte; slashes are
|
||||
fine on-chain.
|
||||
3. Do not set `OPENAI_REASONING` unless the backend is OpenRouter.
|
||||
4. `OPENAI_TIMEOUT_MS` > advert `max_processing_ms` = bond-forfeit window.
|
||||
5. Model ids containing `kimi`, `deepseek`, or `gpt` (case-insensitive) are
|
||||
auto-enrolled in the marketplace buyer's PDF-summarizer pool
|
||||
(`buyer/src/pdf/caps.ts`), so expect PDF jobs too. The
|
||||
`PDF_MODEL_ALLOWLIST` / `PDF_MODEL_DENYLIST` overrides are buyer-side —
|
||||
only relevant if you also operate your own buyer.
|
||||
6. `LIVE_CHAIN` accepts only the literal `"1"`; `true`/`yes` silently means
|
||||
off, and the supplier then never broadcasts.
|
||||
7. The compose `env_file` uses `required: false`, so a typo'd env path comes
|
||||
up and crash-loops instead of failing to parse — check logs on first boot.
|
||||
8. Wallet fragmentation (>2 UTxOs, none ≥5 AP3X) breaks all script-spends
|
||||
with a lucid collateral selector error; fix with `tx:consolidate-wallet`.
|
||||
|
||||
## 8. Key references in this repo
|
||||
|
||||
- `deploy/inference-proxy/README.md` — a live standalone box built exactly
|
||||
this way (two suppliers, incl. a tailnet-backed home rig).
|
||||
- `deploy/README.md` — networks, Traefik, per-service ops.
|
||||
- `docs/HETZNER_SETUP.md` — the Apex Fusion fleet runbook (hosted-API
|
||||
suppliers at scale).
|
||||
- `docs/HUGGINGFACE_ROUTER_SETUP.md` — OpenRouter/HF-router backend variant.
|
||||
- `supplier/.env.example` — every env var, annotated (plus `.env.*.example`
|
||||
variants per backend).
|
||||
- `supplier/src/cli/` — `gen-keypair`, `post-advert`, `retire-advert`,
|
||||
`consolidate-wallet`, `publish-reference-scripts`.
|
||||
412
docs/EXECUTIVE_SUMMARY.md
Normal file
412
docs/EXECUTIVE_SUMMARY.md
Normal file
@@ -0,0 +1,412 @@
|
||||
---
|
||||
marp: true
|
||||
paginate: true
|
||||
size: 16:9
|
||||
---
|
||||
|
||||
<!--
|
||||
EXECUTIVE_SUMMARY.md — slide-style overview of the Local Agents Marketplace.
|
||||
Build PDF + PPTX with: bash docs/build-deck.sh
|
||||
Edit this file; mermaid blocks are pre-rendered to docs/img/diagram-*.png.
|
||||
-->
|
||||
|
||||
<style>
|
||||
/* ── Local Agents Marketplace — unified dark theme ────────────────────
|
||||
* Every slide uses the same navy→indigo gradient as the title slide so
|
||||
* the deck reads as one continuous document. Title and closing slides
|
||||
* keep the centered hero treatment; content slides stay top-aligned but
|
||||
* share the same palette and accent rules. */
|
||||
:root {
|
||||
--ink: #f1f5f9; /* primary text on dark gradient */
|
||||
--muted: #94a3b8;
|
||||
--accent: #818cf8; /* indigo-400, readable on the dark gradient */
|
||||
--accent-deep: #4f46e5; /* used for solid accents (h2 bar, table head) */
|
||||
--accent-soft: rgba(129,140,248,0.12);
|
||||
--gradient: linear-gradient(135deg, #0f172a 0%, #1e293b 50%, #312e81 100%);
|
||||
--row-even: rgba(255,255,255,0.04);
|
||||
--row-odd: rgba(255,255,255,0.02);
|
||||
--border: rgba(255,255,255,0.10);
|
||||
}
|
||||
section {
|
||||
background: var(--gradient);
|
||||
color: var(--ink);
|
||||
font-family: 'Inter', 'Segoe UI', system-ui, -apple-system, sans-serif;
|
||||
font-size: 22px;
|
||||
padding: 40px 60px;
|
||||
display: flex;
|
||||
flex-direction: column;
|
||||
justify-content: flex-start;
|
||||
}
|
||||
section::after {
|
||||
content: attr(data-marpit-pagination) ' / ' attr(data-marpit-pagination-total);
|
||||
color: var(--muted);
|
||||
font-size: 13px;
|
||||
}
|
||||
h1 {
|
||||
font-size: 48px;
|
||||
font-weight: 700;
|
||||
color: #ffffff;
|
||||
border-bottom: 4px solid var(--accent);
|
||||
padding-bottom: 10px;
|
||||
margin: 0 0 18px 0;
|
||||
}
|
||||
h2 {
|
||||
font-size: 34px;
|
||||
font-weight: 700;
|
||||
color: #ffffff;
|
||||
margin: 0 0 14px 0;
|
||||
}
|
||||
h2::before {
|
||||
content: '';
|
||||
display: inline-block;
|
||||
width: 6px;
|
||||
height: 28px;
|
||||
background: var(--accent);
|
||||
margin-right: 14px;
|
||||
vertical-align: middle;
|
||||
border-radius: 2px;
|
||||
}
|
||||
h3 { color: #c7d2fe; font-weight: 600; font-size: 24px; margin: 8px 0; }
|
||||
p, li { margin: 6px 0; line-height: 1.45; }
|
||||
ul, ol { margin: 8px 0 12px 0; padding-left: 28px; }
|
||||
strong { color: #ffffff; }
|
||||
a { color: #a5b4fc; }
|
||||
blockquote {
|
||||
border-left: 4px solid var(--accent);
|
||||
background: rgba(255,255,255,0.06);
|
||||
padding: 10px 18px;
|
||||
color: #e0e7ff;
|
||||
border-radius: 0 8px 8px 0;
|
||||
margin: 10px 0;
|
||||
}
|
||||
code {
|
||||
background: rgba(255,255,255,0.10);
|
||||
color: #e0e7ff;
|
||||
padding: 2px 6px;
|
||||
border-radius: 4px;
|
||||
font-size: 0.9em;
|
||||
}
|
||||
/* Constrain mermaid images so they always fit on a 720px-tall slide
|
||||
* (16:9 @ 1280×720 default). Soft white card behind the diagram so the
|
||||
* mermaid SVG (which renders on a transparent canvas with dark ink)
|
||||
* stays readable on the navy gradient. */
|
||||
img {
|
||||
display: block;
|
||||
margin: 8px auto;
|
||||
max-width: 92%;
|
||||
max-height: 420px;
|
||||
object-fit: contain;
|
||||
background: #ffffff;
|
||||
border-radius: 10px;
|
||||
padding: 10px;
|
||||
box-shadow: 0 4px 16px rgba(0,0,0,0.25);
|
||||
}
|
||||
/* Tile grid for the local-agent versatility slide. */
|
||||
.backends {
|
||||
display: grid;
|
||||
grid-template-columns: repeat(3, 1fr);
|
||||
gap: 14px;
|
||||
margin: 14px 0 12px 0;
|
||||
}
|
||||
.tile {
|
||||
background: var(--accent-soft);
|
||||
border: 2px solid var(--accent);
|
||||
border-radius: 10px;
|
||||
padding: 14px 16px;
|
||||
text-align: center;
|
||||
font-weight: 600;
|
||||
color: #ffffff;
|
||||
}
|
||||
.tile small {
|
||||
display: block;
|
||||
margin-top: 4px;
|
||||
font-weight: 400;
|
||||
color: var(--muted);
|
||||
font-size: 0.8em;
|
||||
}
|
||||
.tile.dots {
|
||||
background: rgba(255,255,255,0.04);
|
||||
border-style: dashed;
|
||||
color: var(--muted);
|
||||
font-size: 28px;
|
||||
}
|
||||
.pipeline {
|
||||
text-align: center;
|
||||
background: rgba(255,255,255,0.08);
|
||||
border: 1px solid var(--border);
|
||||
color: #f8fafc;
|
||||
padding: 12px 18px;
|
||||
border-radius: 10px;
|
||||
margin: 6px auto 14px auto;
|
||||
max-width: 760px;
|
||||
font-weight: 600;
|
||||
}
|
||||
.pipeline span {
|
||||
display: inline-block;
|
||||
margin: 0 10px;
|
||||
}
|
||||
/* Tables sit on a solid white card so cell text reads cleanly against
|
||||
* the dark gradient backdrop. Rounded outer corners + shadow match the
|
||||
* mermaid card styling. `display:table` + `table-layout:fixed` are
|
||||
* needed so the table actually consumes the full slide width — Marp's
|
||||
* default theme leaves tables at content-natural width, which left
|
||||
* blank gutters on either side. */
|
||||
table {
|
||||
display: table !important;
|
||||
width: 100% !important;
|
||||
table-layout: fixed;
|
||||
border-collapse: collapse;
|
||||
margin: 12px 0;
|
||||
font-size: 0.82em;
|
||||
color: #0f172a;
|
||||
background: #ffffff;
|
||||
border-radius: 10px;
|
||||
overflow: hidden;
|
||||
box-shadow: 0 4px 16px rgba(0,0,0,0.25);
|
||||
}
|
||||
td, th { word-wrap: break-word; overflow-wrap: anywhere; }
|
||||
th {
|
||||
background: var(--accent-deep);
|
||||
color: #ffffff;
|
||||
text-align: left;
|
||||
padding: 9px 12px;
|
||||
font-weight: 700;
|
||||
}
|
||||
td {
|
||||
padding: 7px 12px;
|
||||
border-bottom: 1px solid #e2e8f0;
|
||||
color: #0f172a;
|
||||
}
|
||||
tr:nth-child(even) td { background: #ffffff; }
|
||||
tr:nth-child(odd) td { background: #f8fafc; }
|
||||
/* code spans inside table cells need a light pill, not the dark one
|
||||
* defined globally — otherwise they'd disappear into the white row. */
|
||||
td code {
|
||||
background: #eef2ff;
|
||||
color: #1e293b;
|
||||
}
|
||||
/* Bold/strong inside cells must stay dark — the global rule paints
|
||||
* <strong> white for the dark-gradient body text, which would render
|
||||
* invisible against the white table card. */
|
||||
td strong, th strong {
|
||||
color: #0f172a;
|
||||
}
|
||||
th strong {
|
||||
color: #ffffff;
|
||||
}
|
||||
/* Title slide — centered hero treatment on the same gradient. */
|
||||
section.title {
|
||||
text-align: center;
|
||||
padding: 100px 80px;
|
||||
justify-content: center;
|
||||
}
|
||||
section.title h1 {
|
||||
display: inline-block;
|
||||
font-size: 64px;
|
||||
margin: 0 auto 20px auto;
|
||||
}
|
||||
section.title blockquote {
|
||||
margin: 28px auto;
|
||||
max-width: 900px;
|
||||
}
|
||||
/* Closing slide — same centered treatment. */
|
||||
section.closing {
|
||||
text-align: center;
|
||||
padding: 100px 80px;
|
||||
justify-content: center;
|
||||
}
|
||||
section.closing h2::before { display: none; }
|
||||
section.closing blockquote { font-size: 26px; max-width: 900px; }
|
||||
</style>
|
||||
|
||||
<!-- _class: title -->
|
||||
|
||||
# Local Agents Marketplace
|
||||
|
||||
### A trust-minimised, on-chain marketplace for LLM inference
|
||||
|
||||
Buy and sell prompt → response with **bonded escrow** on **Vector** (UTxO).
|
||||
No platform fee. No central rate-limiter. Verifiable receipts on chain.
|
||||
|
||||
> *Status: M1 lifecycle proven end-to-end on Vector testnet — 2026-05-05.*
|
||||
|
||||
---
|
||||
|
||||
## The problem
|
||||
|
||||
* AI inference is **centralised** — a handful of providers, opaque pricing, account-level rate limits.
|
||||
* Local-AI hardware is **idle most of the time** — GPUs and CPUs sit unused between user prompts.
|
||||
* Buyers and sellers can't transact directly without a **trusted intermediary** taking a cut.
|
||||
* "Verifiable" claims about which model ran are usually nothing more than the provider's word.
|
||||
|
||||
We need a **two-sided marketplace** where:
|
||||
1. Sellers monetise spare compute,
|
||||
2. Buyers get a **cryptographic receipt** of what was actually computed,
|
||||
3. **Neither side has to trust the other** — bonds + on-chain settlement enforce honesty.
|
||||
|
||||
---
|
||||
|
||||
## How it works — three actors, one chain
|
||||
|
||||
```mermaid
|
||||
flowchart LR
|
||||
subgraph CHAIN[Vector — UTxO]
|
||||
ADV[Advert UTxO<br/>capability, price, bonds]
|
||||
ESC[Escrow UTxO<br/>locked funds + state]
|
||||
end
|
||||
|
||||
SUP[🧠 Supplier<br/>local LLM node]
|
||||
BUY[💼 Buyer<br/>app or agent]
|
||||
IDX[🔭 Indexer<br/>read-only bulletin board]
|
||||
|
||||
SUP -->|publish advert| ADV
|
||||
BUY -->|discover| IDX
|
||||
IDX -.->|index events| CHAIN
|
||||
BUY -->|post escrow| ESC
|
||||
BUY -->|prompt + escrow_ref| SUP
|
||||
SUP -->|signed receipt| BUY
|
||||
SUP -->|claim & submit| ESC
|
||||
BUY -->|accept & pay| ESC
|
||||
```
|
||||
|
||||
* **Supplier** runs the inference and publishes a price.
|
||||
* **Buyer** posts the work as a bonded escrow, sends the prompt, accepts the receipt.
|
||||
* **Indexer** is a public mirror of chain state — anyone can run one. No platform middleman.
|
||||
|
||||
---
|
||||
|
||||
## The bonded-escrow lifecycle
|
||||
|
||||
```mermaid
|
||||
sequenceDiagram
|
||||
autonumber
|
||||
participant B as Buyer
|
||||
participant Chain as Vector
|
||||
participant S as Supplier
|
||||
participant LLM as Local LLM<br/>(OpenAI-compatible)
|
||||
|
||||
S->>Chain: PostAdvert (locks supplier_bond)
|
||||
B->>Chain: PostEscrow → Open<br/>(locks payment + bonds)
|
||||
B->>S: POST /v1/chat/completions
|
||||
S->>Chain: ClaimEscrow → Claimed
|
||||
S->>LLM: run inference
|
||||
LLM-->>S: assistant message
|
||||
S->>Chain: SubmitEscrow → Submitted
|
||||
S-->>B: 200 OK + signed receipt
|
||||
B->>Chain: AcceptEscrow — supplier paid
|
||||
```
|
||||
|
||||
Every transition is on-chain, validated by an Aiken Plutus V3 script. The receipt is signed by the supplier's advert key; prompt and response hashes are bound on chain.
|
||||
|
||||
---
|
||||
|
||||
## What if someone misbehaves?
|
||||
|
||||
```mermaid
|
||||
flowchart LR
|
||||
OPEN[Open]:::norm --> CLAIMED[Claimed]:::norm --> SUBMITTED[Submitted]:::norm --> ACCEPTED[Accepted ✓]:::good
|
||||
OPEN -->|deliver_by passed| RECLAIM[Reclaimed<br/>buyer recovers funds]:::warn
|
||||
CLAIMED -->|deliver_by passed| RECLAIM
|
||||
SUBMITTED -->|accept_window passed| RELEASE[Released<br/>supplier collects]:::warn
|
||||
|
||||
classDef norm fill:#e0e7ff,stroke:#4f46e5
|
||||
classDef good fill:#dcfce7,stroke:#16a34a
|
||||
classDef warn fill:#fef3c7,stroke:#d97706
|
||||
```
|
||||
|
||||
| Failure mode | Recovery | Loss bearer |
|
||||
|---|---|---|
|
||||
| Supplier never claims/submits | Buyer **Reclaim** after `deliver_by` | Supplier — forfeits supplier_bond |
|
||||
| Buyer disappears after Submit | Supplier **Release** after `submitted_at + 10 min` | Buyer — forfeits buyer_bond |
|
||||
|
||||
Bonds make honesty cheaper than running away. Both sides have skin in the game; no third-party arbiter is needed for the M1 happy/timeout paths.
|
||||
|
||||
---
|
||||
|
||||
## Local-agent versatility — any OpenAI-compatible engine
|
||||
|
||||
<div class="pipeline">
|
||||
<span>💼 Buyer</span> →
|
||||
<span>🧠 Supplier (OpenAI-compatible HTTP wrapper)</span> →
|
||||
<span>backend ↓</span>
|
||||
</div>
|
||||
|
||||
<div class="backends">
|
||||
<div class="tile">Ollama<br/><small>local model runner</small></div>
|
||||
<div class="tile">vLLM<br/><small>high-throughput GPU</small></div>
|
||||
<div class="tile">llama.cpp<br/><small>CPU · Metal · ROCm</small></div>
|
||||
<div class="tile">OpenRouter<br/><small>cloud API mux</small></div>
|
||||
<div class="tile">openclaw / custom<br/><small>arbitrary stack</small></div>
|
||||
<div class="tile dots">…<br/><small>any OpenAI-shaped API</small></div>
|
||||
</div>
|
||||
|
||||
The supplier service is a thin HTTP wrapper — it forwards `/v1/chat/completions` to whatever backend is configured. Each supplier picks its own model, hardware, and engine, then advertises a `capability_id`. Buyers shop on capability + model + price.
|
||||
|
||||
---
|
||||
|
||||
## Capability + model = task selection
|
||||
|
||||
| Capability ID | Example models | Use case |
|
||||
|---|---|---|
|
||||
| `llm.text.generate.v1` | Llama 3 · Qwen 2.5 · Mistral · GPT-4 | Q&A, drafts, summarisation |
|
||||
| `code.completion.v1` | Codestral · DeepSeek-Coder · StarCoder | IDE tab-complete, refactor |
|
||||
| `vision.describe.v1` | LLaVA · Qwen-VL · Pixtral | Image captioning, OCR |
|
||||
| `embedding.text.v1` | nomic-embed · BGE · ada-002 | RAG indexing |
|
||||
| `audio.transcribe.v1` | whisper-large-v3 · distil-whisper | Voice-to-text |
|
||||
| `…` | … | … |
|
||||
|
||||
* New capabilities = **just publish a new advert**. No marketplace governance gate.
|
||||
* Today's deploy uses Ollama + Qwen 2.5; switching to vLLM with Llama 3 70B is a config change, not a code change.
|
||||
|
||||
---
|
||||
|
||||
## OpenClaw — agentic teams on your existing OpenAI seat
|
||||
|
||||
<div class="pipeline">
|
||||
<span>🧠 Supplier wrapper</span> →
|
||||
<span>🦾 OpenClaw</span> →
|
||||
<span>🪪 OpenAI ChatGPT seat (flat-rate)</span>
|
||||
</div>
|
||||
|
||||
* **Cost-efficient by default.** OpenClaw exposes your existing **OpenAI ChatGPT subscription** as an OpenAI-compatible API. The marketplace supplier dispatches its inference against it, so an entire **agentic team** (coders, QA automation testers, release curators…) draws from the **flat-rate seat you already pay for** — no per-token metering, no surprise invoices.
|
||||
* **Reliability layer (optional, marginal cost).** OpenClaw can fall back to the **Anthropic API** or **OpenRouter** model pool when the primary seat is rate-limited, the prompt requires a different model, or you want a **second-layer hardening** of responses (e.g. cross-provider consensus on critical outputs). You only pay metered tokens for the requests that actually fall through.
|
||||
|
||||
---
|
||||
|
||||
## Proven on Vector testnet — 2026-05-05
|
||||
|
||||
| Step | Tx hash |
|
||||
|---|---|
|
||||
| Buyer posts escrow | `af762561…c2f7bc5` |
|
||||
| Supplier claims | (lifecycle tx) |
|
||||
| Supplier submits receipt | (lifecycle tx) |
|
||||
| Buyer accepts | `125e3cfe…7dc100d` |
|
||||
|
||||
Funds flowed correctly: supplier received `payment + supplier_bond` (3 ADA); buyer got `buyer_bond` back.
|
||||
|
||||
* **Browser demo:** https://mp-buyers.vector.testnet.apexfusion.org
|
||||
* **Live event stream:** https://mp-indexer.vector.testnet.apexfusion.org
|
||||
* **Test suite:** 1098 unit tests passing, full lifecycle exercised in CI.
|
||||
|
||||
---
|
||||
|
||||
## Why UTxO + Vector
|
||||
|
||||
* **Bonded escrow is native** — Plutus validators enforce the state machine without a custom token or oracle.
|
||||
* **Vector settles in seconds** — the buyer→claim→submit→accept loop fits inside a single chat-completion's wall clock.
|
||||
* **AP3X token** for fees and bonds — fungible, transparent, on-chain.
|
||||
* **No custom rollup, no bridge** — runs on a production chain today.
|
||||
|
||||
---
|
||||
|
||||
<!-- _class: closing -->
|
||||
|
||||
## The pitch in one sentence
|
||||
|
||||
> Local Agents Marketplace turns any OpenAI-compatible inference endpoint into a **trustlessly billable service** — buyer and supplier exchange prompt, response, and payment with on-chain proof that what was paid for is what was delivered.
|
||||
|
||||
### Try it
|
||||
|
||||
* **Indexer (live event stream):** https://mp-indexer.vector.testnet.apexfusion.org
|
||||
* **Buyer:** https://mp-buyers.vector.testnet.apexfusion.org
|
||||
* **Supplier:** https://mp-suppliers.vector.testnet.apexfusion.org/capability
|
||||
BIN
docs/EXECUTIVE_SUMMARY.pdf
Normal file
BIN
docs/EXECUTIVE_SUMMARY.pdf
Normal file
Binary file not shown.
BIN
docs/EXECUTIVE_SUMMARY.pptx
Normal file
BIN
docs/EXECUTIVE_SUMMARY.pptx
Normal file
Binary file not shown.
@@ -1,141 +0,0 @@
|
||||
# Hetzner Inference Supplier Fleet — Setup Runbook
|
||||
|
||||
> **Status:** shipped; fleet trimmed 2026-08-21. Hetzner retired
|
||||
> `Kimi-K2.7-Code`, `GLM-5.2-NVFP4`, and `DeepSeek-V4-Flash-0731` from
|
||||
> Inference (gone from `/v1/models`), so the 6 suppliers serving them were
|
||||
> deregistered (adverts retired on-chain, containers removed). `Qwen3.8-27B`
|
||||
> was added in their place, reusing the retired kimi-code wallets. Configures
|
||||
> mainnet supplier nodes that use **Hetzner Inference**
|
||||
> (`https://inference.hetzner.com`) as their **compute backend** for bonded
|
||||
> inference work commissioned on Vector. Config only — no code changes.
|
||||
|
||||
---
|
||||
|
||||
## 1. What this is
|
||||
|
||||
Hetzner Inference is an OpenAI-compatible hosted API. Because the supplier's
|
||||
upstream client (`supplier/src/openai.ts`) already speaks plain
|
||||
`POST /v1/chat/completions` with a Bearer token, pointing it at Hetzner is
|
||||
**pure configuration**: `LLM_BACKEND=openai` + `OPENAI_BASE_URL` + the API key.
|
||||
This is the same pattern as the DeepSeek-direct and OpenRouter suppliers, and
|
||||
the direct sibling of `docs/HUGGINGFACE_ROUTER_SETUP.md`.
|
||||
|
||||
One supplier per (model × capability) — both the one-off
|
||||
`llm.text.generate.v1` and the multi-turn `llm.chat.v1` capability:
|
||||
|
||||
| Supplier name | Model (on-chain + API param, verbatim) | Capability | Advert max_output_tokens |
|
||||
|---|---|---|---|
|
||||
| `qwen35b` | `Qwen/Qwen3.6-35B-A3B-FP8` | `llm.text.generate.v1` | 262144 |
|
||||
| `qwen35b-chat` | `Qwen/Qwen3.6-35B-A3B-FP8` | `llm.chat.v1` | 262144 |
|
||||
| `qwen38` | `Qwen3.8-27B` | `llm.text.generate.v1` | 262144 |
|
||||
| `qwen38-chat` | `Qwen3.8-27B` | `llm.chat.v1` | 262144 |
|
||||
|
||||
Deregistered 2026-08-21 (models dropped by Hetzner): `kimi-code`,
|
||||
`kimi-code-chat` (`Kimi-K2.7-Code`), `glm`, `glm-chat` (`GLM-5.2-NVFP4`),
|
||||
`ds-flash-htz`, `ds-flash-htz-chat` (`DeepSeek-V4-Flash-0731`). The qwen38
|
||||
pair reuses the kimi-code / kimi-code-chat wallets; the other four wallets
|
||||
still hold funds and their env files remain on the host.
|
||||
|
||||
Shared advert parameters: price **200000 lovelace (0.2 AP3X)** flat per job,
|
||||
bonds **1000000 lovelace (1 AP3X)** both sides, `max_processing_ms` **300000**
|
||||
for one-off / **1800000** for chat (the session spans the whole conversation).
|
||||
`max_output_tokens` is set to the model's context length: no `max_tokens` is
|
||||
forwarded upstream (`OPENAI_MAX_TOKENS` unset), so the advert value only gates
|
||||
what buyers may request.
|
||||
|
||||
Names follow the brand-by-model convention; the retired `ds-flash-htz`
|
||||
carried a `-htz` suffix only because `deepseek-flash-*` was already taken by
|
||||
the OpenRouter fleet serving `deepseek/deepseek-v4-flash`.
|
||||
|
||||
## 2. Prerequisites
|
||||
|
||||
1. A Hetzner account with Inference access and an API key (usage-based billing
|
||||
to you as the node operator — the flat 0.2 AP3X job price is a business
|
||||
choice, not cost-derived). One key is shared by all suppliers; Hetzner
|
||||
rate limits apply to the aggregate.
|
||||
2. One funded supplier wallet per supplier (50 AP3X each recommended; bonds
|
||||
are 1 AP3X per in-flight job and returned on completion).
|
||||
3. The usual mainnet supplier deploy prerequisites (`deploy/README.md`).
|
||||
4. **DNS**: one A record per supplier — `mp-suppliers-<name>.vector.apexfusion.org`
|
||||
→ `91.98.147.172`, **DNS-only/unproxied**. There is NO wildcard for
|
||||
`*.vector.apexfusion.org`; and because traefik issues certs on-box via
|
||||
Let's Encrypt HTTP-01 (port 80), a proxied/CDN record would break issuance.
|
||||
Certs are issued automatically within ~a minute of the record propagating —
|
||||
no restarts needed.
|
||||
|
||||
## 3. Verify the backend before spending on-chain
|
||||
|
||||
The model ids come from `GET https://inference.hetzner.com/api/v1/models`
|
||||
(this list changes — Hetzner retires models; re-check before any advert)
|
||||
and are sent **verbatim** as the upstream `model` param (the runtime uses
|
||||
`advert.model`). Before posting adverts, smoke-test each model:
|
||||
|
||||
```bash
|
||||
curl -sS -X POST https://inference.hetzner.com/api/v1/chat/completions \
|
||||
-H "Authorization: Bearer $HETZNER_KEY" -H "Content-Type: application/json" \
|
||||
-d '{"model":"Qwen3.8-27B","messages":[{"role":"user","content":"ping"}]}' \
|
||||
| jq '.choices[0].message.content'
|
||||
```
|
||||
|
||||
`choices[0].message.content` must be a non-empty string with **no `max_tokens`
|
||||
sent** (matches runtime config) — the supplier throws `openai_malformed`
|
||||
otherwise and forfeits its 1 AP3X bond per failed job. For chat suppliers also
|
||||
verify a `tools`/`tool_choice` round-trip. The original four models passed
|
||||
both checks on 2026-08-11; `Qwen3.8-27B` passed both on 2026-08-21.
|
||||
|
||||
## 4. Per-supplier bring-up (repeat per supplier)
|
||||
|
||||
```bash
|
||||
# 1. wallet — prints privateKeyHex, publicKeyHex, pubKeyHash, address
|
||||
pnpm --filter @marketplace/supplier tx:gen-keypair --network 1
|
||||
# fund the printed address (50 AP3X recommended), then:
|
||||
|
||||
# 2. env file on the mainnet host
|
||||
cp supplier/.env.hetzner.example /root/agents-marketplace/supplier/.env.<name>
|
||||
chmod 600 /root/agents-marketplace/supplier/.env.<name>
|
||||
# fill in: ALL FOUR wallet vars (PRIV_KEY_HEX, ADDRESS, PKH, PUB_KEY_HEX —
|
||||
# they are NOT derived at boot; missing derived vars ⇒ 403 wrong_supplier),
|
||||
# OPENAI_API_KEY, and the ADVERT_* values from the table above.
|
||||
|
||||
# 3. advert (one-off shown; chat: --capability-id llm.chat.v1 --max-processing-ms 1800000)
|
||||
pnpm --filter @marketplace/supplier tx:post-advert \
|
||||
--capability-id llm.text.generate.v1 \
|
||||
--model 'GLM-5.2-NVFP4' \
|
||||
--max-output-tokens 512000 \
|
||||
--max-processing-ms 300000 \
|
||||
--price-lovelace 200000 \
|
||||
--endpoint-url https://mp-suppliers-<name>.vector.apexfusion.org
|
||||
# paste the printed "<txHash>#0" into ADVERT_REF in the env file
|
||||
|
||||
# 4. first start is always manual (CD skips compose projects with no running
|
||||
# containers); subsequent rollouts ride the mainnet CD pipeline
|
||||
docker compose -f deploy/mainnet/docker-compose.supplier-<name>.yml up -d
|
||||
|
||||
# 5. register the wallet for balance alerts
|
||||
# add {name, address} to wallet-monitor/wallets.json on the host
|
||||
```
|
||||
|
||||
## 5. Verification
|
||||
|
||||
- `curl https://mp-suppliers-<name>.vector.apexfusion.org/healthz` → `{"ok":true}`;
|
||||
`/capability` shows the right model + pkh.
|
||||
- Indexer: buyer `GET /v1/indexer/suppliers` lists the new entries with
|
||||
`advert_status: Active`, `status: free`.
|
||||
- Gateway `GET /openai/v1/models` includes the four Hetzner model ids.
|
||||
- Watch `docker logs -f marketplace-mainnet-supplier-<name>` through the first
|
||||
jobs for `openai_malformed` (reasoning-model content-shape risk).
|
||||
|
||||
## 6. Footguns
|
||||
|
||||
- `OPENAI_BASE_URL=https://inference.hetzner.com/api` — **no `/v1`**; the
|
||||
client appends `/v1/chat/completions`.
|
||||
- Do **not** set `OPENAI_REASONING` — `reasoning:{enabled:false}` is an
|
||||
OpenRouter-only param.
|
||||
- The advert `--model` must match the Hetzner id exactly, including the
|
||||
`Qwen/` prefix on `Qwen/Qwen3.6-35B-A3B-FP8` (slash is fine on-chain;
|
||||
precedent `moonshotai/kimi-k2.6`).
|
||||
- `Kimi-K2.7-Code` and `DeepSeek-V4-Flash-0731` auto-join the buyer's PDF pool
|
||||
(case-insensitive substring allowlist `["kimi","deepseek","gpt"]` in
|
||||
`buyer/src/pdf/caps.ts`); GLM and Qwen stay out. Deliberate — adjust
|
||||
`PDF_MODEL_ALLOWLIST`/`PDF_MODEL_DENYLIST` in the buyer env to change it.
|
||||
- `OPENAI_TIMEOUT_MS` must stay ≤ the advert's `max_processing_ms`.
|
||||
@@ -1,168 +0,0 @@
|
||||
# HuggingFace Router Supplier — Setup Runbook (V1 / W1)
|
||||
|
||||
> **Status:** shipped. Configures a Vector supplier node to use the HuggingFace
|
||||
> **Inference Providers router** as its **compute backend** for bonded inference
|
||||
> work commissioned on Vector. Config only — no code changes.
|
||||
|
||||
---
|
||||
|
||||
## 1. What this is
|
||||
|
||||
The HuggingFace **Inference Providers router** (`https://router.huggingface.co`)
|
||||
is an OpenAI-compatible endpoint that fronts hundreds of hosted models across
|
||||
partner providers (Together, Fireworks, DeepInfra, Groq, …). It is the direct
|
||||
analogue of the OpenRouter backend the supplier already supports.
|
||||
|
||||
Because the supplier's upstream client (`supplier/src/openai.ts`) already speaks
|
||||
plain `POST /v1/chat/completions` with a Bearer token, pointing it at HuggingFace
|
||||
is **pure configuration**: set `LLM_BACKEND=openai` and point `OPENAI_BASE_URL` at
|
||||
the router. It is the same as adding any OpenAI-compatible compute backend, with
|
||||
the HuggingFace endpoint and token substituted in.
|
||||
|
||||
```
|
||||
buyer commissions bonded work ──▶ supplier node ──▶ HuggingFace router
|
||||
(AP3X escrow on Vector) │ (compute backend, hf_ token)
|
||||
▼
|
||||
supplier fulfils the work; the escrow settles on-chain
|
||||
```
|
||||
|
||||
The supplier node runs the inference to **fulfil work a buyer has commissioned
|
||||
under stake**; HuggingFace is simply the compute it uses to produce the result.
|
||||
|
||||
**What this does NOT do:** it does not add creator/model-author work-sharing,
|
||||
change protocol economics, or change how an advert's committed amount is sized.
|
||||
Those are separate, larger pieces of work tracked in the team's internal planning
|
||||
notes. This preset is the fast, low-risk on-ramp that proves the path.
|
||||
|
||||
---
|
||||
|
||||
## 2. Prerequisites
|
||||
|
||||
1. A HuggingFace account with **Inference Providers access** (a free monthly
|
||||
credit allowance, then usage-based per token — this is HuggingFace's billing
|
||||
to you as the node operator).
|
||||
2. An access token from <https://huggingface.co/settings/tokens> with the
|
||||
**"Make calls to Inference Providers"** permission. It starts with `hf_`.
|
||||
Treat it like a password.
|
||||
3. A funded supplier wallet (~5 AP3X for tx fees + bonds). Generate a seed with
|
||||
`openssl rand -hex 32`.
|
||||
4. The usual supplier deploy prerequisites (Ogmios URL, a publicly reachable
|
||||
HTTPS endpoint for buyers). See `deploy/README.md`.
|
||||
|
||||
---
|
||||
|
||||
## 3. Steps
|
||||
|
||||
### 3.1 Create the env file
|
||||
|
||||
```bash
|
||||
cp supplier/.env.huggingface-chat.example supplier/.env
|
||||
chmod 600 supplier/.env
|
||||
```
|
||||
|
||||
Fill in `SUPPLIER_PRIV_KEY_HEX`, `OPENAI_API_KEY` (your `hf_…` token),
|
||||
`OGMIOS_URL`, and the `ADVERT_*` values. Key settings for this preset:
|
||||
|
||||
| Var | Value | Why |
|
||||
|-----|-------|-----|
|
||||
| `LLM_BACKEND` | `openai` | routes chat through the OpenAI-compatible client |
|
||||
| `OPENAI_BASE_URL` | `https://router.huggingface.co` | HF router; the `/v1/chat/completions` suffix is appended by the client — do **not** add it |
|
||||
| `OPENAI_API_KEY` | `hf_…` | your HF token (Bearer) |
|
||||
| `OPENAI_REASONING` | **unset** | HF 400s on the OpenRouter-only `reasoning` param (see §5) |
|
||||
| `ADVERT_MODEL` | provider-qualified id, e.g. `deepseek-ai/DeepSeek-V3:fastest` | see §4 |
|
||||
|
||||
### 3.2 Choose a model
|
||||
|
||||
HF uses **provider-qualified** model names. The value goes on-chain in
|
||||
`AdvertDatum.model` and is forwarded verbatim to the router:
|
||||
|
||||
- `deepseek-ai/DeepSeek-V3:fastest` — bare id + `:fastest` picks the fastest provider
|
||||
- `deepseek-ai/DeepSeek-V3:together` — pin a specific provider
|
||||
- `openai/gpt-oss-120b` — open-weight, HF-hosted
|
||||
|
||||
Browse models and their providers at
|
||||
<https://huggingface.co/models?inference_provider=all>.
|
||||
|
||||
Because the model is on-chain data, you can advertise any router-supported chat
|
||||
model without changing the supplier code — just post a new advert.
|
||||
|
||||
### 3.3 Smoke-test the token before going on-chain
|
||||
|
||||
Confirm your token + model + base URL work end to end, independent of the chain:
|
||||
|
||||
```bash
|
||||
curl https://router.huggingface.co/v1/chat/completions \
|
||||
-H "Authorization: Bearer $HF_TOKEN" \
|
||||
-H "Content-Type: application/json" \
|
||||
-d '{"model":"deepseek-ai/DeepSeek-V3:fastest",
|
||||
"messages":[{"role":"user","content":"say hi in 3 words"}],
|
||||
"stream":false}'
|
||||
```
|
||||
|
||||
A `choices[0].message.content` in the response means the compute backend is
|
||||
reachable. (Note: **no** `reasoning` field — see §5.)
|
||||
|
||||
### 3.4 Post the advert
|
||||
|
||||
```bash
|
||||
pnpm --filter @marketplace/supplier tx:post-advert \
|
||||
--capability-id llm.text.generate.v1 \
|
||||
--model deepseek-ai/DeepSeek-V3:fastest \
|
||||
--max-output-tokens 512 \
|
||||
--max-processing-ms 60000 \
|
||||
--price-lovelace 2000000 \
|
||||
--endpoint-url https://your-supplier.example.org
|
||||
```
|
||||
|
||||
Copy the printed `<txHash>#0` into `ADVERT_REF` in `supplier/.env`. Use
|
||||
`--dry-run` first to inspect the tx without submitting.
|
||||
|
||||
### 3.5 Boot
|
||||
|
||||
Start read-only first (`LIVE_CHAIN` unset) to confirm the node boots and can
|
||||
reach both Ogmios and the HF router, then set `LIVE_CHAIN=1` and restart to
|
||||
enable real Claim/Submit. Deploy via the supplier compose file as in
|
||||
`deploy/README.md`.
|
||||
|
||||
---
|
||||
|
||||
## 4. Sizing the advert (read before you post one)
|
||||
|
||||
`ADVERT_PRICE_LOVELACE` is the **flat AP3X amount committed in escrow per job**,
|
||||
but the HuggingFace backend meters **per token**. The committed amount is fixed
|
||||
per job while upstream token usage varies, so:
|
||||
|
||||
- Size it for your **worst-case** prompt length, not the average.
|
||||
- Cap output tightly with `--max-output-tokens` — it is your main lever on
|
||||
upstream token usage.
|
||||
- Prefer **small** models here; large models have wide token-usage variance and
|
||||
are harder to size a fixed per-job amount around.
|
||||
- Buyer **input** tokens are not capped on-chain today. Until an input-token
|
||||
ceiling lands, stick to small models or add your own request-size guard.
|
||||
|
||||
This is a pre-existing protocol design point (fixed per-job advert amount vs.
|
||||
variable upstream token usage), not specific to HuggingFace. It is the main thing
|
||||
to account for when sizing an advert.
|
||||
|
||||
---
|
||||
|
||||
## 5. Footgun: `OPENAI_REASONING` must stay unset
|
||||
|
||||
`reasoning:{enabled:false}` is an **OpenRouter-specific** parameter. The HF
|
||||
router **rejects it with HTTP 400 on every request**. When copying an existing
|
||||
OpenRouter env, it is easy to carry `OPENAI_REASONING=off` over by accident.
|
||||
|
||||
The supplier guards against this: `loadConfig` **refuses to boot** if
|
||||
`OPENAI_REASONING` is disabled while `OPENAI_BASE_URL` resolves to
|
||||
`router.huggingface.co`, with a clear error naming the fix
|
||||
(`supplier/src/config.ts`). Just leave `OPENAI_REASONING` unset for HF.
|
||||
|
||||
---
|
||||
|
||||
## 6. Where this sits
|
||||
|
||||
This preset is the multi-model on-ramp that uses the HuggingFace router as a
|
||||
compute backend. Further work items (additional task adapters, advert-sizing
|
||||
refinements, and protocol-economics changes) are tracked separately in the team's
|
||||
internal planning notes, along with the upstream-terms check every operator must
|
||||
complete before pointing a node at a third-party compute backend.
|
||||
@@ -1,11 +1,11 @@
|
||||
# Vector Buyer App
|
||||
|
||||
A self-contained app for commissioning AI compute on the Vector L2 testnet. You submit prompts, bond AP3X in on-chain escrow, and receive LLM responses from supplier nodes; the escrow settles in AP3X on accepted work.
|
||||
A self-contained app for purchasing AI compute on the Vector L2 testnet (Cardano). You submit prompts, pay with AP3X tokens via on-chain escrow, and receive LLM responses from supplier nodes.
|
||||
|
||||
## How It Works
|
||||
|
||||
1. You type a **prompt** and set a **price** in the web UI
|
||||
2. The app posts an **escrow transaction** on-chain, locking price + bond
|
||||
1. You type a **prompt** and set a **payment** amount in the web UI
|
||||
2. The app posts an **escrow transaction** on-chain, locking your payment + bond
|
||||
3. The app sends the task to a **supplier node** via HTTP
|
||||
4. The supplier calls an LLM, **claims** the escrow, and **submits** the result hash on-chain
|
||||
5. You see the response in the UI and can **accept** to release payment, or **dispute**
|
||||
@@ -193,8 +193,8 @@ If you accept the result, you get your 1 AP3X bond back. Total cost = payment +
|
||||
|
||||
- **Never share your .env file** - it contains your wallet seed phrase
|
||||
- **Never share your data/ folder** - it contains task history
|
||||
- The seed phrase controls your wallet. Back it up securely.
|
||||
- Escrow protects you: the supplier cannot take your escrowed value without delivering a result
|
||||
- The seed phrase controls your wallet funds. Back it up securely.
|
||||
- Escrow protects you: the supplier cannot take your funds without delivering a result
|
||||
- You have a 10-minute dispute window after receiving a result
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
@@ -24,8 +24,8 @@ The audit confirmed 39 holes in the first draft (10 distinct themes). This docum
|
||||
| One-shot | `/openai/v1/chat/completions` → `llm.text.generate.v1`, 1 escrow/call, buffered (+ pseudo-stream) |
|
||||
| Chat session | `/openai/v1/chat/sessions*` → `llm.chat.v1`, 1 escrow/**session**, real SSE per turn, settle at close |
|
||||
| Routing | match `model` + required capability; pick an available supplier (status `free`\|`unknown`); **not cheapest**; fallback to next match on busy/offline |
|
||||
| Pricing | cost = matched supplier `price_lovelace`; **required balance = price + buyer_bond + supplier_bond + 5 AP3X collateral + fee reserve** |
|
||||
| Wallet health | gateway **auto-consolidates** each wallet to `{5-AP3X collateral, working}` after settle / on a tick |
|
||||
| Pricing | cost = matched supplier `price_lovelace`; **required balance = price + buyer_bond + supplier_bond + 5 ADA collateral + fee reserve** |
|
||||
| Wallet health | gateway **auto-consolidates** each wallet to `{5-ADA collateral, working}` after settle / on a tick |
|
||||
| Settlement | resolve the **Submitted** ref via indexer, `acceptResult`, **await confirm** before returning success; sweeper is backstop |
|
||||
| Sweeper | state-aware: Open/Claimed past `deliver_by` → reclaim; Submitted → retry Accept in-window; never blind-reclaim Submitted |
|
||||
| Response | OpenAI object `{id, object, created, model, choices, usage}` + `x_vector:{receipt, receipt_signature, escrow_ref}`; full streaming chunk transform + final usage chunk |
|
||||
@@ -41,7 +41,7 @@ New standalone pnpm package `gateway/` (add to `pnpm-workspace.yaml`). Boots **o
|
||||
- SDK methods: `discoverSuppliers`, `submitPrompt` (`Marketplace.ts:242`, verifies receipt but **does not settle**), `startChat`/`endChat` (chat session; `endChat` returns `acceptedRef` and awaits Accept), `acceptResult`, `reclaim`.
|
||||
- Escrow value/bonds: buyer funds `totalLocked = price + buyer_bond + supplier_bond` at PostEscrow — `packages/shared/src/tx/escrow/postEscrow.ts:132-200`. On Accept supplier gets `payment+supplier_bond`, buyer gets `buyer_bond` back.
|
||||
- Submitted-ref resolution: the buyer `/v1/accept` queries the indexer and matches the Submitted row by `posted_at` — `buyer/src/server.ts` `/v1/accept`. Gateway must mirror this.
|
||||
- Wallet health: `planConsolidate` / `consolidateWallet` (`{collateral, working}` shape, `DEFAULT_COLLATERAL_LOVELACE = 5 AP3X`) — `packages/shared/src/tx/wallet/`. Collateral assertion: `assertCollateralCandidate` — `packages/shared/src/tx/internal/liveCbor.ts`.
|
||||
- Wallet health: `planConsolidate` / `consolidateWallet` (`{collateral, working}` shape, `DEFAULT_COLLATERAL_LOVELACE = 5 ADA`) — `packages/shared/src/tx/wallet/`. Collateral assertion: `assertCollateralCandidate` — `packages/shared/src/tx/internal/liveCbor.ts`.
|
||||
- Supplier chat-session SSE `{type:"token"|"done"|"error"}` + headers — `supplier/src/server.ts` `makeChatSessionHandlers`; buyer relay in `buyer/src/server.ts` `/v1/chat/message` (note: **verbatim** passthrough — the gateway must transform to OpenAI chunks).
|
||||
- SQLite pattern (`better-sqlite3`, WAL) — `buyer/src/db/archive.ts`. Auth helpers `timingSafeCompareStrings`, `createRateLimiter` — `buyer/src/auth.ts`.
|
||||
- Indexer `SupplierView` (`model`, `capability_id`, `price_lovelace`, `buyer_bond_lovelace`, `supplier_bond_lovelace`, `status` free/working/offline/unknown, `advert_status`) — `indexer/src/routes/suppliers.ts`.
|
||||
@@ -100,7 +100,7 @@ Raw API key never persisted (only `sha256(key)`); `key_prefix` for display. `mas
|
||||
## Request lifecycle — one-shot `/chat/completions`
|
||||
All on-chain steps run inside the per-key `mutex.run(...)`.
|
||||
1. **Route** (`selectSupplier`): indexer rows where `model` matches, `capability_id==="llm.text.generate.v1"`, `advert_status==="Active"`, live `status ∈ {free, unknown}`. Pick an available one (not cheapest). No match → 404 `model_not_found` (`type: invalid_request_error`).
|
||||
2. **Pre-flight**: required = `price + buyer_bond + supplier_bond + 5_000_000 (collateral) + ~2 AP3X fee`. Verify total balance **and** a pure-AP3X UTxO ≥5 AP3X exists (`assertCollateralCandidate`-style). Else 402 `insufficient_funds` + `x_vector:{required_lovelace, available_lovelace, collateral_ok, deposit_address}`.
|
||||
2. **Pre-flight**: required = `price + buyer_bond + supplier_bond + 5_000_000 (collateral) + ~2 AP3X fee`. Verify total balance **and** a pure-ADA UTxO ≥5 ADA exists (`assertCollateralCandidate`-style). Else 402 `insufficient_funds` + `x_vector:{required_lovelace, available_lovelace, collateral_ok, deposit_address}`.
|
||||
3. **Execute**: `submitPrompt({advertRef, messages, payment_lovelace:price, max_output_tokens})` (posts escrow → supplier → verifies receipt).
|
||||
4. **Settle**: resolve the **Submitted** escrow ref via the indexer (mirror buyer `/v1/accept`: match by buyer pkh + `posted_at`), `acceptResult(submittedRef)`, **await confirmation**. On 409/offline mid-route, retry next matching supplier (bounded). On any post-escrow failure, record + leave for the sweeper (don't block the response on reclaim).
|
||||
5. **Respond**: `{id:"chatcmpl-…", object:"chat.completion", created:<sec>, model, choices:[{index:0,message:{role:"assistant",content},finish_reason:"stop"}], usage:{prompt_tokens,completion_tokens,total_tokens}, x_vector:{receipt,receipt_signature,escrow_ref}}`. Record `usage`.
|
||||
@@ -113,15 +113,9 @@ All on-chain steps run inside the per-key `mutex.run(...)`.
|
||||
- **close** → `endChat` (Submit + Accept, awaits) → settle + bond refund; record usage; wallet-health.
|
||||
- Sessions are reclaimable by the sweeper if abandoned before close.
|
||||
|
||||
### Settle modes (`CHAT_SETTLE_MODE`, gateway + supplier, default `full`)
|
||||
- **full** — the lifecycle above: supplier Claims at start, Submits a transcript receipt at end, gateway Accepts (buyer charged).
|
||||
- **ticket** — the buyer's escrow post at open is the ONLY chain op. The supplier verifies the Open escrow as an entry ticket (`/v1/chat/start` → `{status:"ticket"}`) but never Claims/Submits; `/v1/chat/end` → `{status:"ended", settle_mode:"ticket"}` with no receipt; the sweeper Reclaims the Open escrow after `deliver_by`, returning all locked funds (net cost ≈ tx fees). Usage rows record `cost_lovelace: 0`. Sessions may outlive `deliver_by` (no hard-cap) — a live session whose ticket got reclaimed keeps running; only the idle janitor/close ends it. Close behavior is driven per-session by the supplier's `/end` response, so mixed-mode rollout windows settle correctly.
|
||||
- Ticket caveats (accepted, demo-grade): a supplier restart forgets used tickets, so an unexpired un-reclaimed escrow ref could reopen a session (bounded by `deliver_by` + the sweep); `/account.locked_in_escrow_lovelace` over-reports because the indexer never updates spent rows.
|
||||
- Suppliers additionally take `MAX_CHAT_SESSIONS` (default 1) — concurrent session slots; `/status` reports `active_sessions`/`max_sessions` and stays `free` until all slots are taken.
|
||||
|
||||
## Sweeper & wallet-health
|
||||
- **Sweeper** (interval ~60s): per key, classify escrows. Open/Claimed past `deliver_by` → `reclaim`. Submitted **with a verified receipt** still in accept-window → retry `acceptResult`. Submitted past accept-window → leave for supplier Release (log). Never blind-`reclaim` Submitted.
|
||||
- **Wallet-health tick**: periodically + after each settle, `planConsolidate` → `consolidateWallet` so every wallet keeps a ≥5 AP3X collateral UTxO. Skip if already healthy.
|
||||
- **Wallet-health tick**: periodically + after each settle, `planConsolidate` → `consolidateWallet` so every wallet keeps a ≥5 ADA collateral UTxO. Skip if already healthy.
|
||||
|
||||
## Errors (OpenAI shape `{error:{message, type, code, param:null}}`)
|
||||
no supplier → 404 `invalid_request_error`/`model_not_found`; underfunded/no-collateral → 402 `invalid_request_error`/`insufficient_funds`; bad/missing key → 401 `authentication_error`/`invalid_api_key`; rate limit → 429 `rate_limit_error` + `Retry-After`; supplier timeout → 504 `server_error`; supplier busy race (after retries) → 503 `server_error`/`overloaded`; receipt verify → 502 `server_error`/`receipt_verification_failed`; tx build → 409/502 `server_error`/`escrow_failed`; unsupported `tools`/`functions` → 400 `invalid_request_error`/`unsupported_parameter`.
|
||||
@@ -145,7 +139,7 @@ Real billing/markup & fee hook; trustless/self-custody recovery; multi-funding-U
|
||||
## Verification (testnet, end-to-end)
|
||||
1. Indexer + Ogmios + ≥1 `llm.text.generate.v1` and ≥1 `llm.chat.v1` supplier for the same `model`, Active.
|
||||
2. Boot gateway: `LIVE_CHAIN=1`, `GATEWAY_MASTER_KEY=$(openssl rand -hex 32)`, `OGMIOS_URL`, `INDEXER_URL`, `NETWORK_ID`, `GATEWAY_DB_DIR`, `GATEWAY_PORT`.
|
||||
3. `POST /signup` → key + deposit address. Fund ≥ price + both bonds + 5 AP3X collateral + ~2 AP3X fees; confirm via `GET /account` (`collateral_ok:true`).
|
||||
3. `POST /signup` → key + deposit address. Fund ≥ price + both bonds + 5 ADA collateral + ~2 ADA fees; confirm via `GET /account` (`collateral_ok:true`).
|
||||
4. One-shot non-stream via curl and via the OpenAI Python/JS SDK (`base_url=…/openai/v1`) → valid `chat.completion` + `x_vector`; confirm the escrow **settled (Accepted)** and a `usage` row exists.
|
||||
5. **Run a 2nd and 3rd request** → confirm wallet-health kept `collateral_ok` and they succeed (the audit's request-#2 failure must not reproduce).
|
||||
6. One-shot `stream:true` → chunks + final usage + `[DONE]`.
|
||||
|
||||
412
docs/local-llm-marketplace.md
Normal file
412
docs/local-llm-marketplace.md
Normal file
@@ -0,0 +1,412 @@
|
||||
---
|
||||
marp: true
|
||||
paginate: true
|
||||
size: 16:9
|
||||
---
|
||||
|
||||
<!--
|
||||
EXECUTIVE_SUMMARY.md — slide-style overview of the Local Agents Marketplace.
|
||||
Build PDF + PPTX with: bash docs/build-deck.sh
|
||||
Edit this file; mermaid blocks are pre-rendered to docs/img/diagram-*.png.
|
||||
-->
|
||||
|
||||
<style>
|
||||
/* ── Local Agents Marketplace — unified dark theme ────────────────────
|
||||
* Every slide uses the same navy→indigo gradient as the title slide so
|
||||
* the deck reads as one continuous document. Title and closing slides
|
||||
* keep the centered hero treatment; content slides stay top-aligned but
|
||||
* share the same palette and accent rules. */
|
||||
:root {
|
||||
--ink: #f1f5f9; /* primary text on dark gradient */
|
||||
--muted: #94a3b8;
|
||||
--accent: #818cf8; /* indigo-400, readable on the dark gradient */
|
||||
--accent-deep: #4f46e5; /* used for solid accents (h2 bar, table head) */
|
||||
--accent-soft: rgba(129,140,248,0.12);
|
||||
--gradient: linear-gradient(135deg, #0f172a 0%, #1e293b 50%, #312e81 100%);
|
||||
--row-even: rgba(255,255,255,0.04);
|
||||
--row-odd: rgba(255,255,255,0.02);
|
||||
--border: rgba(255,255,255,0.10);
|
||||
}
|
||||
section {
|
||||
background: var(--gradient);
|
||||
color: var(--ink);
|
||||
font-family: 'Inter', 'Segoe UI', system-ui, -apple-system, sans-serif;
|
||||
font-size: 22px;
|
||||
padding: 40px 60px;
|
||||
display: flex;
|
||||
flex-direction: column;
|
||||
justify-content: flex-start;
|
||||
}
|
||||
section::after {
|
||||
content: attr(data-marpit-pagination) ' / ' attr(data-marpit-pagination-total);
|
||||
color: var(--muted);
|
||||
font-size: 13px;
|
||||
}
|
||||
h1 {
|
||||
font-size: 48px;
|
||||
font-weight: 700;
|
||||
color: #ffffff;
|
||||
border-bottom: 4px solid var(--accent);
|
||||
padding-bottom: 10px;
|
||||
margin: 0 0 18px 0;
|
||||
}
|
||||
h2 {
|
||||
font-size: 34px;
|
||||
font-weight: 700;
|
||||
color: #ffffff;
|
||||
margin: 0 0 14px 0;
|
||||
}
|
||||
h2::before {
|
||||
content: '';
|
||||
display: inline-block;
|
||||
width: 6px;
|
||||
height: 28px;
|
||||
background: var(--accent);
|
||||
margin-right: 14px;
|
||||
vertical-align: middle;
|
||||
border-radius: 2px;
|
||||
}
|
||||
h3 { color: #c7d2fe; font-weight: 600; font-size: 24px; margin: 8px 0; }
|
||||
p, li { margin: 6px 0; line-height: 1.45; }
|
||||
ul, ol { margin: 8px 0 12px 0; padding-left: 28px; }
|
||||
strong { color: #ffffff; }
|
||||
a { color: #a5b4fc; }
|
||||
blockquote {
|
||||
border-left: 4px solid var(--accent);
|
||||
background: rgba(255,255,255,0.06);
|
||||
padding: 10px 18px;
|
||||
color: #e0e7ff;
|
||||
border-radius: 0 8px 8px 0;
|
||||
margin: 10px 0;
|
||||
}
|
||||
code {
|
||||
background: rgba(255,255,255,0.10);
|
||||
color: #e0e7ff;
|
||||
padding: 2px 6px;
|
||||
border-radius: 4px;
|
||||
font-size: 0.9em;
|
||||
}
|
||||
/* Constrain mermaid images so they always fit on a 720px-tall slide
|
||||
* (16:9 @ 1280×720 default). Soft white card behind the diagram so the
|
||||
* mermaid SVG (which renders on a transparent canvas with dark ink)
|
||||
* stays readable on the navy gradient. */
|
||||
img {
|
||||
display: block;
|
||||
margin: 8px auto;
|
||||
max-width: 92%;
|
||||
max-height: 420px;
|
||||
object-fit: contain;
|
||||
background: #ffffff;
|
||||
border-radius: 10px;
|
||||
padding: 10px;
|
||||
box-shadow: 0 4px 16px rgba(0,0,0,0.25);
|
||||
}
|
||||
/* Tile grid for the local-agent versatility slide. */
|
||||
.backends {
|
||||
display: grid;
|
||||
grid-template-columns: repeat(3, 1fr);
|
||||
gap: 14px;
|
||||
margin: 14px 0 12px 0;
|
||||
}
|
||||
.tile {
|
||||
background: var(--accent-soft);
|
||||
border: 2px solid var(--accent);
|
||||
border-radius: 10px;
|
||||
padding: 14px 16px;
|
||||
text-align: center;
|
||||
font-weight: 600;
|
||||
color: #ffffff;
|
||||
}
|
||||
.tile small {
|
||||
display: block;
|
||||
margin-top: 4px;
|
||||
font-weight: 400;
|
||||
color: var(--muted);
|
||||
font-size: 0.8em;
|
||||
}
|
||||
.tile.dots {
|
||||
background: rgba(255,255,255,0.04);
|
||||
border-style: dashed;
|
||||
color: var(--muted);
|
||||
font-size: 28px;
|
||||
}
|
||||
.pipeline {
|
||||
text-align: center;
|
||||
background: rgba(255,255,255,0.08);
|
||||
border: 1px solid var(--border);
|
||||
color: #f8fafc;
|
||||
padding: 12px 18px;
|
||||
border-radius: 10px;
|
||||
margin: 6px auto 14px auto;
|
||||
max-width: 760px;
|
||||
font-weight: 600;
|
||||
}
|
||||
.pipeline span {
|
||||
display: inline-block;
|
||||
margin: 0 10px;
|
||||
}
|
||||
/* Tables sit on a solid white card so cell text reads cleanly against
|
||||
* the dark gradient backdrop. Rounded outer corners + shadow match the
|
||||
* mermaid card styling. `display:table` + `table-layout:fixed` are
|
||||
* needed so the table actually consumes the full slide width — Marp's
|
||||
* default theme leaves tables at content-natural width, which left
|
||||
* blank gutters on either side. */
|
||||
table {
|
||||
display: table !important;
|
||||
width: 100% !important;
|
||||
table-layout: fixed;
|
||||
border-collapse: collapse;
|
||||
margin: 12px 0;
|
||||
font-size: 0.82em;
|
||||
color: #0f172a;
|
||||
background: #ffffff;
|
||||
border-radius: 10px;
|
||||
overflow: hidden;
|
||||
box-shadow: 0 4px 16px rgba(0,0,0,0.25);
|
||||
}
|
||||
td, th { word-wrap: break-word; overflow-wrap: anywhere; }
|
||||
th {
|
||||
background: var(--accent-deep);
|
||||
color: #ffffff;
|
||||
text-align: left;
|
||||
padding: 9px 12px;
|
||||
font-weight: 700;
|
||||
}
|
||||
td {
|
||||
padding: 7px 12px;
|
||||
border-bottom: 1px solid #e2e8f0;
|
||||
color: #0f172a;
|
||||
}
|
||||
tr:nth-child(even) td { background: #ffffff; }
|
||||
tr:nth-child(odd) td { background: #f8fafc; }
|
||||
/* code spans inside table cells need a light pill, not the dark one
|
||||
* defined globally — otherwise they'd disappear into the white row. */
|
||||
td code {
|
||||
background: #eef2ff;
|
||||
color: #1e293b;
|
||||
}
|
||||
/* Bold/strong inside cells must stay dark — the global rule paints
|
||||
* <strong> white for the dark-gradient body text, which would render
|
||||
* invisible against the white table card. */
|
||||
td strong, th strong {
|
||||
color: #0f172a;
|
||||
}
|
||||
th strong {
|
||||
color: #ffffff;
|
||||
}
|
||||
/* Title slide — centered hero treatment on the same gradient. */
|
||||
section.title {
|
||||
text-align: center;
|
||||
padding: 100px 80px;
|
||||
justify-content: center;
|
||||
}
|
||||
section.title h1 {
|
||||
display: inline-block;
|
||||
font-size: 64px;
|
||||
margin: 0 auto 20px auto;
|
||||
}
|
||||
section.title blockquote {
|
||||
margin: 28px auto;
|
||||
max-width: 900px;
|
||||
}
|
||||
/* Closing slide — same centered treatment. */
|
||||
section.closing {
|
||||
text-align: center;
|
||||
padding: 100px 80px;
|
||||
justify-content: center;
|
||||
}
|
||||
section.closing h2::before { display: none; }
|
||||
section.closing blockquote { font-size: 26px; max-width: 900px; }
|
||||
</style>
|
||||
|
||||
<!-- _class: title -->
|
||||
|
||||
# Local Agents Marketplace
|
||||
|
||||
### A trust-minimised, on-chain marketplace for LLM inference
|
||||
|
||||
Buy and sell prompt → response with **bonded escrow** on **Vector** (UTxO).
|
||||
No platform fee. No central rate-limiter. Verifiable receipts on chain.
|
||||
|
||||
> *Status: M1 lifecycle proven end-to-end on Vector testnet — 2026-05-05.*
|
||||
|
||||
---
|
||||
|
||||
## The problem
|
||||
|
||||
* AI inference is **centralised** — a handful of providers, opaque pricing, account-level rate limits.
|
||||
* Local-AI hardware is **idle most of the time** — GPUs and CPUs sit unused between user prompts.
|
||||
* Buyers and sellers can't transact directly without a **trusted intermediary** taking a cut.
|
||||
* "Verifiable" claims about which model ran are usually nothing more than the provider's word.
|
||||
|
||||
We need a **two-sided marketplace** where:
|
||||
1. Sellers monetise spare compute,
|
||||
2. Buyers get a **cryptographic receipt** of what was actually computed,
|
||||
3. **Neither side has to trust the other** — bonds + on-chain settlement enforce honesty.
|
||||
|
||||
---
|
||||
|
||||
## How it works — three actors, one chain
|
||||
|
||||
```mermaid
|
||||
flowchart LR
|
||||
subgraph CHAIN[Vector — UTxO]
|
||||
ADV[Advert UTxO<br/>capability, price, bonds]
|
||||
ESC[Escrow UTxO<br/>locked funds + state]
|
||||
end
|
||||
|
||||
SUP[🧠 Supplier<br/>local LLM node]
|
||||
BUY[💼 Buyer<br/>app or agent]
|
||||
IDX[🔭 Indexer<br/>read-only bulletin board]
|
||||
|
||||
SUP -->|publish advert| ADV
|
||||
BUY -->|discover| IDX
|
||||
IDX -.->|index events| CHAIN
|
||||
BUY -->|post escrow| ESC
|
||||
BUY -->|prompt + escrow_ref| SUP
|
||||
SUP -->|signed receipt| BUY
|
||||
SUP -->|claim & submit| ESC
|
||||
BUY -->|accept & pay| ESC
|
||||
```
|
||||
|
||||
* **Supplier** runs the inference and publishes a price.
|
||||
* **Buyer** posts the work as a bonded escrow, sends the prompt, accepts the receipt.
|
||||
* **Indexer** is a public mirror of chain state — anyone can run one. No platform middleman.
|
||||
|
||||
---
|
||||
|
||||
## The bonded-escrow lifecycle
|
||||
|
||||
```mermaid
|
||||
sequenceDiagram
|
||||
autonumber
|
||||
participant B as Buyer
|
||||
participant Chain as Vector
|
||||
participant S as Supplier
|
||||
participant LLM as Local LLM<br/>(OpenAI-compatible)
|
||||
|
||||
S->>Chain: PostAdvert (locks supplier_bond)
|
||||
B->>Chain: PostEscrow → Open<br/>(locks payment + bonds)
|
||||
B->>S: POST /v1/chat/completions
|
||||
S->>Chain: ClaimEscrow → Claimed
|
||||
S->>LLM: run inference
|
||||
LLM-->>S: assistant message
|
||||
S->>Chain: SubmitEscrow → Submitted
|
||||
S-->>B: 200 OK + signed receipt
|
||||
B->>Chain: AcceptEscrow — supplier paid
|
||||
```
|
||||
|
||||
Every transition is on-chain, validated by an Aiken Plutus V3 script. The receipt is signed by the supplier's advert key; prompt and response hashes are bound on chain.
|
||||
|
||||
---
|
||||
|
||||
## What if someone misbehaves?
|
||||
|
||||
```mermaid
|
||||
flowchart LR
|
||||
OPEN[Open]:::norm --> CLAIMED[Claimed]:::norm --> SUBMITTED[Submitted]:::norm --> ACCEPTED[Accepted ✓]:::good
|
||||
OPEN -->|deliver_by passed| RECLAIM[Reclaimed<br/>buyer recovers funds]:::warn
|
||||
CLAIMED -->|deliver_by passed| RECLAIM
|
||||
SUBMITTED -->|accept_window passed| RELEASE[Released<br/>supplier collects]:::warn
|
||||
|
||||
classDef norm fill:#e0e7ff,stroke:#4f46e5
|
||||
classDef good fill:#dcfce7,stroke:#16a34a
|
||||
classDef warn fill:#fef3c7,stroke:#d97706
|
||||
```
|
||||
|
||||
| Failure mode | Recovery | Loss bearer |
|
||||
|---|---|---|
|
||||
| Supplier never claims/submits | Buyer **Reclaim** after `deliver_by` | Supplier — forfeits supplier_bond |
|
||||
| Buyer disappears after Submit | Supplier **Release** after `submitted_at + 10 min` | Buyer — forfeits buyer_bond |
|
||||
|
||||
Bonds make honesty cheaper than running away. Both sides have skin in the game; no third-party arbiter is needed for the M1 happy/timeout paths.
|
||||
|
||||
---
|
||||
|
||||
## Local-agent versatility — any OpenAI-compatible engine
|
||||
|
||||
<div class="pipeline">
|
||||
<span>💼 Buyer</span> →
|
||||
<span>🧠 Supplier (OpenAI-compatible HTTP wrapper)</span> →
|
||||
<span>backend ↓</span>
|
||||
</div>
|
||||
|
||||
<div class="backends">
|
||||
<div class="tile">Ollama<br/><small>local model runner</small></div>
|
||||
<div class="tile">vLLM<br/><small>high-throughput GPU</small></div>
|
||||
<div class="tile">llama.cpp<br/><small>CPU · Metal · ROCm</small></div>
|
||||
<div class="tile">OpenRouter<br/><small>cloud API mux</small></div>
|
||||
<div class="tile">openclaw / custom<br/><small>arbitrary stack</small></div>
|
||||
<div class="tile dots">…<br/><small>any OpenAI-shaped API</small></div>
|
||||
</div>
|
||||
|
||||
The supplier service is a thin HTTP wrapper — it forwards `/v1/chat/completions` to whatever backend is configured. Each supplier picks its own model, hardware, and engine, then advertises a `capability_id`. Buyers shop on capability + model + price.
|
||||
|
||||
---
|
||||
|
||||
## Capability + model = task selection
|
||||
|
||||
| Capability ID | Example models | Use case |
|
||||
|---|---|---|
|
||||
| `llm.text.generate.v1` | Llama 3 · Qwen 2.5 · Mistral · GPT-4 | Q&A, drafts, summarisation |
|
||||
| `code.completion.v1` | Codestral · DeepSeek-Coder · StarCoder | IDE tab-complete, refactor |
|
||||
| `vision.describe.v1` | LLaVA · Qwen-VL · Pixtral | Image captioning, OCR |
|
||||
| `embedding.text.v1` | nomic-embed · BGE · ada-002 | RAG indexing |
|
||||
| `audio.transcribe.v1` | whisper-large-v3 · distil-whisper | Voice-to-text |
|
||||
| `…` | … | … |
|
||||
|
||||
* New capabilities = **just publish a new advert**. No marketplace governance gate.
|
||||
* Today's deploy uses Ollama + Qwen 2.5; switching to vLLM with Llama 3 70B is a config change, not a code change.
|
||||
|
||||
---
|
||||
|
||||
## OpenClaw — agentic teams on your existing OpenAI seat
|
||||
|
||||
<div class="pipeline">
|
||||
<span>🧠 Supplier wrapper</span> →
|
||||
<span>🦾 OpenClaw</span> →
|
||||
<span>🪪 OpenAI ChatGPT seat (flat-rate)</span>
|
||||
</div>
|
||||
|
||||
* **Cost-efficient by default.** OpenClaw exposes your existing **OpenAI ChatGPT subscription** as an OpenAI-compatible API. The marketplace supplier dispatches its inference against it, so an entire **agentic team** (coders, QA automation testers, release curators…) draws from the **flat-rate seat you already pay for** — no per-token metering, no surprise invoices.
|
||||
* **Reliability layer (optional, marginal cost).** OpenClaw can fall back to the **Anthropic API** or **OpenRouter** model pool when the primary seat is rate-limited, the prompt requires a different model, or you want a **second-layer hardening** of responses (e.g. cross-provider consensus on critical outputs). You only pay metered tokens for the requests that actually fall through.
|
||||
|
||||
---
|
||||
|
||||
## Proven on Vector testnet — 2026-05-05
|
||||
|
||||
| Step | Tx hash |
|
||||
|---|---|
|
||||
| Buyer posts escrow | `af762561…c2f7bc5` |
|
||||
| Supplier claims | (lifecycle tx) |
|
||||
| Supplier submits receipt | (lifecycle tx) |
|
||||
| Buyer accepts | `125e3cfe…7dc100d` |
|
||||
|
||||
Funds flowed correctly: supplier received `payment + supplier_bond` (3 ADA); buyer got `buyer_bond` back.
|
||||
|
||||
* **Browser demo:** https://mp-buyers.vector.testnet.apexfusion.org
|
||||
* **Live event stream:** https://mp-indexer.vector.testnet.apexfusion.org
|
||||
* **Test suite:** 1098 unit tests passing, full lifecycle exercised in CI.
|
||||
|
||||
---
|
||||
|
||||
## Why UTxO + Vector
|
||||
|
||||
* **Bonded escrow is native** — Plutus validators enforce the state machine without a custom token or oracle.
|
||||
* **Vector settles in seconds** — the buyer→claim→submit→accept loop fits inside a single chat-completion's wall clock.
|
||||
* **AP3X token** for fees and bonds — fungible, transparent, on-chain.
|
||||
* **No custom rollup, no bridge** — runs on a production chain today.
|
||||
|
||||
---
|
||||
|
||||
<!-- _class: closing -->
|
||||
|
||||
## The pitch in one sentence
|
||||
|
||||
> Local Agents Marketplace turns any OpenAI-compatible inference endpoint into a **trustlessly billable service** — buyer and supplier exchange prompt, response, and payment with on-chain proof that what was paid for is what was delivered.
|
||||
|
||||
### Try it
|
||||
|
||||
* **Indexer (live event stream):** https://mp-indexer.vector.testnet.apexfusion.org
|
||||
* **Buyer:** https://mp-buyers.vector.testnet.apexfusion.org
|
||||
* **Supplier:** https://mp-suppliers.vector.testnet.apexfusion.org/capability
|
||||
BIN
docs/local-llm-marketplace.pdf
Normal file
BIN
docs/local-llm-marketplace.pdf
Normal file
Binary file not shown.
BIN
docs/local-llm-marketplace.pptx
Normal file
BIN
docs/local-llm-marketplace.pptx
Normal file
Binary file not shown.
@@ -164,8 +164,8 @@ If the buyer does NOT accept within the dispute window (10 minutes), you can col
|
||||
|
||||
- **Never share your .env file** - it contains your wallet seed phrase
|
||||
- **Never share your data/ folder** - it contains task history
|
||||
- The seed phrase controls your wallet. Back it up securely.
|
||||
- The node only responds to buyers who have already locked value on-chain, so you cannot be scammed out of compute.
|
||||
- The seed phrase controls your wallet funds. Back it up securely.
|
||||
- The node only responds to buyers who have already locked funds on-chain, so you cannot be scammed out of compute.
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
|
||||
@@ -30,7 +30,5 @@ GATEWAY_DB_DIR=./data/gateway
|
||||
# KEY_RATE_MAX=60 # requests per API key per window
|
||||
# KEY_RATE_WINDOW_MS=60000
|
||||
# SWEEPER_INTERVAL_MS=60000
|
||||
# DEMO_SESSION_IDLE_MS=180000 # close demo chat sessions idle this long (frees the supplier slot)
|
||||
# CHAT_SETTLE_MODE=full # "full" (Claim/Submit/Accept) or "ticket" (escrow post only; sweeper reclaims) — must match suppliers
|
||||
# WALLET_HEALTH_INTERVAL_MS=600000
|
||||
# SDK_REGISTRY_MAX=500 # max cached per-key Marketplace instances
|
||||
|
||||
@@ -22,8 +22,6 @@ RUN apk add --no-cache python3 make g++
|
||||
RUN corepack enable && corepack prepare pnpm@10.33.2 --activate
|
||||
|
||||
COPY pnpm-workspace.yaml pnpm-lock.yaml package.json tsconfig.base.json .npmrc ./
|
||||
# pnpm-lock.yaml's patchedDependencies hash the patch files at install time.
|
||||
COPY patches ./patches
|
||||
COPY packages/shared/package.json ./packages/shared/package.json
|
||||
COPY buyer/package.json ./buyer/package.json
|
||||
COPY gateway/package.json ./gateway/package.json
|
||||
|
||||
@@ -7,9 +7,7 @@
|
||||
"typecheck": "tsc --noEmit",
|
||||
"start": "tsx src/index.ts",
|
||||
"dev": "tsx src/index.ts",
|
||||
"rotate-master-key": "tsx src/cli/rotate-master-key.ts",
|
||||
"create-demo-key": "tsx src/cli/create-demo-key.ts",
|
||||
"reseller-demo": "tsx src/cli/reseller-demo.ts"
|
||||
"rotate-master-key": "tsx src/cli/rotate-master-key.ts"
|
||||
},
|
||||
"dependencies": {
|
||||
"@marketplace/buyer": "workspace:*",
|
||||
|
||||
@@ -15,30 +15,10 @@ import { seal } from "../crypto/seal.js";
|
||||
import { hashApiKey, requireKey } from "../middleware/apiKeyAuth.js";
|
||||
import { asyncHandler } from "../middleware/http.js";
|
||||
import { totalLovelace, hasCollateral } from "../onchain/preflight.js";
|
||||
import { badRequest, forbidden } from "../openai/errors.js";
|
||||
import { badRequest } from "../openai/errors.js";
|
||||
|
||||
const ACTIVE_ESCROW_STATES = new Set(["Open", "Claimed", "Submitted"]);
|
||||
|
||||
/** Bound on per-request escrow liveness lookups; rows past the cap count as
|
||||
* locked unverified (a key with this many active escrows has bigger problems). */
|
||||
const LIVENESS_CHECK_CAP = 32;
|
||||
|
||||
/** True when the escrow UTxO behind an indexer row is still unspent. The
|
||||
* indexer never updates rows on terminal spends (Accept/Reclaim/Release
|
||||
* consume the escrow without a new escrow output), so "active" rows can be
|
||||
* long spent. Unparseable refs and failed lookups count as live so errors
|
||||
* inflate the locked figure rather than hide funds. */
|
||||
async function escrowUtxoIsLive(deps: GatewayDeps, utxoRef: string): Promise<boolean> {
|
||||
const m = /^([0-9a-fA-F]{64})#(\d+)$/.exec(utxoRef);
|
||||
if (!m) return true;
|
||||
try {
|
||||
const utxo = await deps.chain.queryUtxo({ txHash: m[1], index: Number(m[2]) });
|
||||
return utxo !== null;
|
||||
} catch {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
|
||||
function ap3x(lovelace: bigint): string {
|
||||
return (Number(lovelace) / 1e6).toFixed(2);
|
||||
}
|
||||
@@ -94,15 +74,8 @@ export function makeAccountHandler(deps: GatewayDeps) {
|
||||
if (r.ok) {
|
||||
const rows = (await r.json()) as Array<Record<string, unknown>>;
|
||||
if (Array.isArray(rows)) {
|
||||
const active = rows.filter((row) => ACTIVE_ESCROW_STATES.has(String(row.state)));
|
||||
const liveness = await Promise.all(
|
||||
active.map((row, i) =>
|
||||
i < LIVENESS_CHECK_CAP ? escrowUtxoIsLive(deps, String(row.utxo_ref ?? "")) : Promise.resolve(true),
|
||||
),
|
||||
);
|
||||
for (let i = 0; i < active.length; i++) {
|
||||
if (!liveness[i]) continue;
|
||||
const row = active[i];
|
||||
for (const row of rows) {
|
||||
if (!ACTIVE_ESCROW_STATES.has(String(row.state))) continue;
|
||||
lockedInEscrow +=
|
||||
BigInt(String(row.payment_lovelace ?? "0")) +
|
||||
BigInt(String(row.buyer_bond_lovelace ?? "0")) +
|
||||
@@ -116,10 +89,7 @@ export function makeAccountHandler(deps: GatewayDeps) {
|
||||
|
||||
res.status(200).json({
|
||||
key_prefix: keyRow.key_prefix,
|
||||
// The shared demo key's wallet is operator-funded; hiding the deposit
|
||||
// address keeps strangers from confusing it with their own wallet.
|
||||
deposit_address: keyRow.demo ? null : keyRow.deposit_address,
|
||||
...(keyRow.demo ? { demo: true } : {}),
|
||||
deposit_address: keyRow.deposit_address,
|
||||
balance: {
|
||||
available_lovelace: available.toString(),
|
||||
locked_in_escrow_lovelace: lockedInEscrow.toString(),
|
||||
@@ -148,11 +118,6 @@ export function makeAccountHandler(deps: GatewayDeps) {
|
||||
export function makeWithdrawHandler(deps: GatewayDeps) {
|
||||
return asyncHandler(async (req: Request, res: Response) => {
|
||||
const keyRow = requireKey(req);
|
||||
if (keyRow.demo) {
|
||||
// The demo key is shared publicly; without this, anyone holding it
|
||||
// could drain the operator-funded wallet to their own address.
|
||||
throw forbidden("demo_key_restricted", "withdrawals are disabled for the shared demo key");
|
||||
}
|
||||
const body = (req.body ?? {}) as Record<string, unknown>;
|
||||
|
||||
const toAddress = body.to_address;
|
||||
|
||||
@@ -1,76 +0,0 @@
|
||||
/**
|
||||
* gateway/src/cli/create-demo-key.ts — mint the shared demo API key.
|
||||
*
|
||||
* Same custodial machinery as POST /signup, but sets demo=1: withdraw is
|
||||
* blocked, /account hides the deposit address, chat completions run through
|
||||
* the session-backed demo executor, and per-IP rate limits apply. Public
|
||||
* signup can never mint a demo key — this CLI is the only path.
|
||||
*
|
||||
* Run inside the gateway container (hits the volume-mounted DB):
|
||||
* docker exec <gateway> pnpm --filter @marketplace/gateway create-demo-key
|
||||
* Or locally:
|
||||
* GATEWAY_MASTER_KEY=<64hex> GATEWAY_DB_DIR=./data/gateway NETWORK_ID=1 \
|
||||
* pnpm --filter @marketplace/gateway create-demo-key [--label shared-demo]
|
||||
*
|
||||
* The raw key is printed ONCE and never stored (only its sha256).
|
||||
*/
|
||||
|
||||
import { randomBytes, randomUUID } from "crypto";
|
||||
import { GatewayStore } from "../db/store.js";
|
||||
import { genPrivKeyHex, deriveWalletKey } from "../wallet.js";
|
||||
import { seal } from "../crypto/seal.js";
|
||||
import { hashApiKey } from "../middleware/apiKeyAuth.js";
|
||||
|
||||
const HEX64 = /^[0-9a-fA-F]{64}$/;
|
||||
|
||||
function arg(name: string): string | undefined {
|
||||
const i = process.argv.indexOf(`--${name}`);
|
||||
return i >= 0 ? process.argv[i + 1] : undefined;
|
||||
}
|
||||
|
||||
function main(): void {
|
||||
const masterKey = process.env.GATEWAY_MASTER_KEY;
|
||||
if (!masterKey || !HEX64.test(masterKey)) {
|
||||
throw new Error("create-demo-key: GATEWAY_MASTER_KEY must be 64 hex chars");
|
||||
}
|
||||
const dbDir = arg("db") ?? process.env.GATEWAY_DB_DIR ?? "./data/gateway";
|
||||
const networkId: 0 | 1 = process.env.NETWORK_ID === "1" ? 1 : 0;
|
||||
const label = arg("label") ?? "shared-demo";
|
||||
|
||||
const privHex = genPrivKeyHex();
|
||||
const walletKey = deriveWalletKey(privHex, networkId);
|
||||
const sealed = seal(privHex, masterKey);
|
||||
|
||||
const rawKey = `vk_${networkId === 1 ? "live" : "test"}_${randomBytes(24).toString("hex")}`;
|
||||
|
||||
const store = new GatewayStore(dbDir);
|
||||
store.insertKey({
|
||||
id: randomUUID(),
|
||||
key_hash: hashApiKey(rawKey),
|
||||
key_prefix: rawKey.slice(0, 12),
|
||||
label,
|
||||
wallet_pkh: walletKey.pubKeyHash,
|
||||
deposit_address: walletKey.address,
|
||||
enc_priv_nonce: sealed.nonce,
|
||||
enc_priv_ct: sealed.ct,
|
||||
enc_priv_tag: sealed.tag,
|
||||
master_key_version: 1,
|
||||
created_at: Date.now(),
|
||||
demo: 1,
|
||||
});
|
||||
|
||||
// eslint-disable-next-line no-console
|
||||
console.log(
|
||||
[
|
||||
`[gateway] demo key created (label=${label}, network=${networkId === 1 ? "mainnet" : "testnet"})`,
|
||||
``,
|
||||
` api_key: ${rawKey}`,
|
||||
` deposit_address: ${walletKey.address}`,
|
||||
``,
|
||||
`Save the api_key now — it is shown only once. Fund the deposit address`,
|
||||
`with the demo float (withdrawals are disabled for this key).`,
|
||||
].join("\n"),
|
||||
);
|
||||
}
|
||||
|
||||
main();
|
||||
@@ -1,216 +0,0 @@
|
||||
import { resolve } from "node:path";
|
||||
import { fileURLToPath } from "node:url";
|
||||
|
||||
interface DemoOptions {
|
||||
gatewayUrl: string;
|
||||
dashboardUrl: string;
|
||||
model: string;
|
||||
prompt: string;
|
||||
maxTokens: number;
|
||||
timeoutMs: number;
|
||||
}
|
||||
|
||||
interface PublicJob {
|
||||
escrow_ref: string;
|
||||
status: "settled" | "failed";
|
||||
upstream_cost_usd: string | null;
|
||||
ap3x_payout: string;
|
||||
failure_reason: string | null;
|
||||
}
|
||||
|
||||
export function parseDemoArgs(argv: string[]): DemoOptions {
|
||||
const values: Record<string, string> = {};
|
||||
for (let index = 0; index < argv.length; index += 2) {
|
||||
const flag = argv[index];
|
||||
const value = argv[index + 1];
|
||||
if (!flag?.startsWith("--") || value === undefined) {
|
||||
throw new Error(`invalid demo argument near ${flag ?? "end"}`);
|
||||
}
|
||||
if (
|
||||
flag !== "--gateway-url" &&
|
||||
flag !== "--dashboard-url" &&
|
||||
flag !== "--model" &&
|
||||
flag !== "--prompt" &&
|
||||
flag !== "--max-tokens" &&
|
||||
flag !== "--timeout-ms"
|
||||
) {
|
||||
throw new Error(`unknown demo argument: ${flag}`);
|
||||
}
|
||||
values[flag] = value;
|
||||
}
|
||||
const gatewayUrl = requiredUrl(values["--gateway-url"], "--gateway-url");
|
||||
const dashboardUrl = requiredUrl(values["--dashboard-url"], "--dashboard-url");
|
||||
const model = requiredString(values["--model"], "--model");
|
||||
const prompt = values["--prompt"] ?? "Reply with one sentence that confirms this marketplace job completed.";
|
||||
const maxTokens = positiveInteger(values["--max-tokens"] ?? "64", "--max-tokens");
|
||||
const timeoutMs = positiveInteger(values["--timeout-ms"] ?? "900000", "--timeout-ms");
|
||||
return {
|
||||
gatewayUrl: gatewayUrl.replace(/\/+$/, ""),
|
||||
dashboardUrl: dashboardUrl.replace(/\/+$/, ""),
|
||||
model,
|
||||
prompt,
|
||||
maxTokens,
|
||||
timeoutMs,
|
||||
};
|
||||
}
|
||||
|
||||
export async function runResellerDemo(
|
||||
options: DemoOptions,
|
||||
gatewayApiKey: string,
|
||||
): Promise<Record<string, unknown>> {
|
||||
if (gatewayApiKey === "") throw new Error("GATEWAY_API_KEY is required");
|
||||
const controller = new AbortController();
|
||||
const timer = setTimeout(() => controller.abort(), options.timeoutMs);
|
||||
try {
|
||||
const sellerResponse = await fetch(`${options.dashboardUrl}/api/status`, {
|
||||
cache: "no-store",
|
||||
signal: controller.signal,
|
||||
});
|
||||
const sellerBody = await sellerResponse.json().catch(() => null) as
|
||||
| Record<string, unknown>
|
||||
| null;
|
||||
if (!sellerResponse.ok) {
|
||||
throw new Error(
|
||||
`seller status returned HTTP ${sellerResponse.status}`,
|
||||
);
|
||||
}
|
||||
const supplierPkh = sellerBody?.supplier_pkh;
|
||||
if (typeof supplierPkh !== "string" || !/^[0-9a-fA-F]{56}$/.test(supplierPkh)) {
|
||||
throw new Error("seller status omitted a valid supplier_pkh");
|
||||
}
|
||||
|
||||
const response = await fetch(
|
||||
`${options.gatewayUrl}/openai/v1/chat/completions`,
|
||||
{
|
||||
method: "POST",
|
||||
headers: {
|
||||
authorization: `Bearer ${gatewayApiKey}`,
|
||||
"content-type": "application/json",
|
||||
},
|
||||
body: JSON.stringify({
|
||||
model: options.model,
|
||||
messages: [{ role: "user", content: options.prompt }],
|
||||
max_tokens: options.maxTokens,
|
||||
stream: false,
|
||||
public_preview: true,
|
||||
x_vector: { supplier_pkh: supplierPkh },
|
||||
}),
|
||||
signal: controller.signal,
|
||||
},
|
||||
);
|
||||
const body = await response.json().catch(() => null) as Record<string, unknown> | null;
|
||||
if (!response.ok) {
|
||||
throw new Error(
|
||||
`gateway returned HTTP ${response.status}: ${JSON.stringify(body)}`,
|
||||
);
|
||||
}
|
||||
const escrowRef = response.headers.get("x-vector-escrow-ref");
|
||||
if (!escrowRef) throw new Error("gateway response omitted X-Vector-Escrow-Ref");
|
||||
const job = await waitForPublicJob(
|
||||
options.dashboardUrl,
|
||||
escrowRef,
|
||||
options.timeoutMs,
|
||||
controller.signal,
|
||||
);
|
||||
if (job.status === "failed") {
|
||||
throw new Error(`reseller job failed: ${job.failure_reason ?? "unknown"}`);
|
||||
}
|
||||
return {
|
||||
completion_id: body?.id ?? null,
|
||||
escrow_ref: escrowRef,
|
||||
model: body?.model ?? options.model,
|
||||
supplier_pkh: supplierPkh,
|
||||
upstream_cost_usd: job.upstream_cost_usd,
|
||||
ap3x_payout: job.ap3x_payout,
|
||||
dashboard_url: options.dashboardUrl,
|
||||
};
|
||||
} finally {
|
||||
clearTimeout(timer);
|
||||
}
|
||||
}
|
||||
|
||||
async function waitForPublicJob(
|
||||
dashboardUrl: string,
|
||||
escrowRef: string,
|
||||
timeoutMs: number,
|
||||
signal: AbortSignal,
|
||||
): Promise<PublicJob> {
|
||||
const deadline = Date.now() + timeoutMs;
|
||||
while (Date.now() < deadline) {
|
||||
const response = await fetch(`${dashboardUrl}/api/jobs?limit=100`, {
|
||||
cache: "no-store",
|
||||
signal,
|
||||
});
|
||||
if (!response.ok) {
|
||||
throw new Error(`dashboard jobs returned HTTP ${response.status}`);
|
||||
}
|
||||
const body = await response.json() as { jobs?: PublicJob[] };
|
||||
const job = body.jobs?.find((candidate) => candidate.escrow_ref === escrowRef);
|
||||
if (job) return job;
|
||||
await new Promise<void>((resolveWait) => setTimeout(resolveWait, 2_000));
|
||||
}
|
||||
throw new Error(`timed out waiting for dashboard settlement ${escrowRef}`);
|
||||
}
|
||||
|
||||
function requiredString(value: string | undefined, flag: string): string {
|
||||
if (!value || value.trim() === "") throw new Error(`${flag} is required`);
|
||||
return value.trim();
|
||||
}
|
||||
|
||||
function requiredUrl(value: string | undefined, flag: string): string {
|
||||
const raw = requiredString(value, flag);
|
||||
let url: URL;
|
||||
try {
|
||||
url = new URL(raw);
|
||||
} catch {
|
||||
throw new Error(`${flag} must be a valid URL`);
|
||||
}
|
||||
const loopback =
|
||||
url.hostname === "localhost" ||
|
||||
url.hostname === "127.0.0.1" ||
|
||||
url.hostname === "[::1]";
|
||||
if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback)) {
|
||||
throw new Error(`${flag} must use HTTPS except on loopback`);
|
||||
}
|
||||
if (
|
||||
url.username !== "" ||
|
||||
url.password !== "" ||
|
||||
url.search !== "" ||
|
||||
url.hash !== ""
|
||||
) {
|
||||
throw new Error(`${flag} must not contain credentials, query, or fragment`);
|
||||
}
|
||||
return raw;
|
||||
}
|
||||
|
||||
function positiveInteger(value: string, flag: string): number {
|
||||
if (!/^[1-9]\d*$/.test(value) || !Number.isSafeInteger(Number(value))) {
|
||||
throw new Error(`${flag} must be a positive safe integer`);
|
||||
}
|
||||
return Number(value);
|
||||
}
|
||||
|
||||
export async function main(
|
||||
argv: string[],
|
||||
env: Record<string, string | undefined>,
|
||||
): Promise<number> {
|
||||
try {
|
||||
const result = await runResellerDemo(
|
||||
parseDemoArgs(argv),
|
||||
env.GATEWAY_API_KEY ?? "",
|
||||
);
|
||||
process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
|
||||
return 0;
|
||||
} catch (error) {
|
||||
const message = error instanceof Error ? error.message : String(error);
|
||||
process.stderr.write(`reseller demo failed: ${message}\n`);
|
||||
return 1;
|
||||
}
|
||||
}
|
||||
|
||||
const invoked = fileURLToPath(import.meta.url) === resolve(process.argv[1] ?? "");
|
||||
if (invoked) {
|
||||
void main(process.argv.slice(2), process.env).then((code) => {
|
||||
process.exitCode = code;
|
||||
});
|
||||
}
|
||||
@@ -20,15 +20,10 @@
|
||||
* KEY_RATE_MAX / KEY_RATE_WINDOW_MS — per-key request limiter.
|
||||
* SWEEPER_INTERVAL_MS / WALLET_HEALTH_INTERVAL_MS — background tick cadences.
|
||||
* SDK_REGISTRY_MAX — max cached per-key Marketplace instances (LRU).
|
||||
* GATEWAY_CORS_ORIGINS — comma-separated allowlist of browser Origins that may
|
||||
* call the gateway cross-origin (e.g. the marketplace
|
||||
* frontend's "Generate API key" page). Default empty =
|
||||
* CORS off (no Access-Control-* headers emitted).
|
||||
*/
|
||||
|
||||
const HEX64_RE = /^[0-9a-fA-F]{64}$/;
|
||||
const POS_INT_RE = /^[1-9]\d*$/;
|
||||
const PKH_RE = /^[0-9a-fA-F]{56}$/;
|
||||
|
||||
export interface GatewayConfig {
|
||||
masterKeyHex: string;
|
||||
@@ -40,25 +35,9 @@ export interface GatewayConfig {
|
||||
dbDir: string;
|
||||
signupRate: { max: number; windowMs: number };
|
||||
keyRate: { max: number; windowMs: number };
|
||||
demoIpRate: { max: number; windowMs: number };
|
||||
sweeperIntervalMs: number;
|
||||
/** Close demo chat sessions idle this long (frees the supplier slot).
|
||||
* Keep below the supplier's CHAT_IDLE_TIMEOUT_MS so the gateway closes
|
||||
* first and records usage. */
|
||||
demoSessionIdleMs: number;
|
||||
/** Chat-session settlement mode this deployment runs. "full" = suppliers
|
||||
* Claim/Submit and the gateway Accepts; "ticket" = the escrow post at open
|
||||
* is the only chain op and the sweeper Reclaims it after deliver_by.
|
||||
* Must agree with the suppliers' CHAT_SETTLE_MODE. */
|
||||
chatSettleMode: "full" | "ticket";
|
||||
walletHealthIntervalMs: number;
|
||||
sdkRegistryMax: number;
|
||||
corsOrigins: string[];
|
||||
/** Capability id the /v1/ocr/extract route escrows against. Model-scoped
|
||||
* per the marketplace convention (one model, one id). Env: OCR_CAPABILITY_ID. */
|
||||
ocrCapabilityId: string;
|
||||
/** Seller preferred for matching one-shot models. Other suppliers remain fallback. */
|
||||
preferredSupplierPkh?: string;
|
||||
}
|
||||
|
||||
function requireField(env: Record<string, string | undefined>, name: string): string {
|
||||
@@ -69,14 +48,6 @@ function requireField(env: Record<string, string | undefined>, name: string): st
|
||||
return v;
|
||||
}
|
||||
|
||||
function chatSettleMode(env: Record<string, string | undefined>): "full" | "ticket" {
|
||||
const v = env.CHAT_SETTLE_MODE ?? "full";
|
||||
if (v !== "full" && v !== "ticket") {
|
||||
throw new Error('loadConfig: CHAT_SETTLE_MODE must be "full" or "ticket"');
|
||||
}
|
||||
return v;
|
||||
}
|
||||
|
||||
function posInt(
|
||||
env: Record<string, string | undefined>,
|
||||
name: string,
|
||||
@@ -118,17 +89,6 @@ export function loadConfig(env: Record<string, string | undefined>): GatewayConf
|
||||
}
|
||||
networkId = networkIdStr === "1" ? 1 : 0;
|
||||
}
|
||||
const preferredSupplierPkhRaw =
|
||||
(env.GATEWAY_PREFERRED_SUPPLIER_PKH ?? "").trim();
|
||||
if (
|
||||
preferredSupplierPkhRaw !== "" &&
|
||||
!PKH_RE.test(preferredSupplierPkhRaw)
|
||||
) {
|
||||
throw new Error(
|
||||
"loadConfig: GATEWAY_PREFERRED_SUPPLIER_PKH must be a 28-byte hex payment-key hash",
|
||||
);
|
||||
}
|
||||
|
||||
|
||||
return {
|
||||
masterKeyHex,
|
||||
@@ -146,22 +106,8 @@ export function loadConfig(env: Record<string, string | undefined>): GatewayConf
|
||||
max: posInt(env, "KEY_RATE_MAX", 60),
|
||||
windowMs: posInt(env, "KEY_RATE_WINDOW_MS", 60 * 1000),
|
||||
},
|
||||
demoIpRate: {
|
||||
max: posInt(env, "DEMO_IP_RATE_MAX", 20),
|
||||
windowMs: posInt(env, "DEMO_IP_RATE_WINDOW_MS", 60 * 1000),
|
||||
},
|
||||
sweeperIntervalMs: posInt(env, "SWEEPER_INTERVAL_MS", 60 * 1000),
|
||||
demoSessionIdleMs: posInt(env, "DEMO_SESSION_IDLE_MS", 3 * 60 * 1000),
|
||||
chatSettleMode: chatSettleMode(env),
|
||||
walletHealthIntervalMs: posInt(env, "WALLET_HEALTH_INTERVAL_MS", 10 * 60 * 1000),
|
||||
sdkRegistryMax: posInt(env, "SDK_REGISTRY_MAX", 500),
|
||||
ocrCapabilityId: env.OCR_CAPABILITY_ID ?? "ocr.page.extract.chandra-ocr-2.v1",
|
||||
preferredSupplierPkh: preferredSupplierPkhRaw === ""
|
||||
? undefined
|
||||
: preferredSupplierPkhRaw.toLowerCase(),
|
||||
corsOrigins: (env.GATEWAY_CORS_ORIGINS ?? "")
|
||||
.split(",")
|
||||
.map((o) => o.trim().replace(/\/+$/, ""))
|
||||
.filter((o) => o !== ""),
|
||||
};
|
||||
}
|
||||
|
||||
@@ -23,8 +23,7 @@ CREATE TABLE IF NOT EXISTS api_keys (
|
||||
enc_priv_tag TEXT NOT NULL,
|
||||
master_key_version INTEGER NOT NULL DEFAULT 1,
|
||||
created_at INTEGER NOT NULL,
|
||||
disabled INTEGER NOT NULL DEFAULT 0,
|
||||
demo INTEGER NOT NULL DEFAULT 0
|
||||
disabled INTEGER NOT NULL DEFAULT 0
|
||||
);
|
||||
CREATE INDEX IF NOT EXISTS idx_keys_hash ON api_keys(key_hash);
|
||||
|
||||
|
||||
@@ -24,8 +24,6 @@ export interface ApiKeyRow {
|
||||
master_key_version: number;
|
||||
created_at: number;
|
||||
disabled: number;
|
||||
/** 1 = shared demo key: withdraw blocked, session-backed completions, per-IP limits. */
|
||||
demo: number;
|
||||
}
|
||||
|
||||
export interface UsageRow {
|
||||
@@ -83,20 +81,13 @@ export class GatewayStore {
|
||||
this.db.pragma("journal_mode = WAL");
|
||||
this.db.exec(CREATE_TABLES_SQL);
|
||||
|
||||
// Additive migration for DBs created before the demo flag existed
|
||||
// (CREATE TABLE IF NOT EXISTS won't alter an existing table).
|
||||
const keyCols = this.db.pragma("table_info(api_keys)") as Array<{ name: string }>;
|
||||
if (!keyCols.some((c) => c.name === "demo")) {
|
||||
this.db.exec("ALTER TABLE api_keys ADD COLUMN demo INTEGER NOT NULL DEFAULT 0");
|
||||
}
|
||||
|
||||
this.sInsertKey = this.db.prepare(`
|
||||
INSERT INTO api_keys (
|
||||
id, key_hash, key_prefix, label, wallet_pkh, deposit_address,
|
||||
enc_priv_nonce, enc_priv_ct, enc_priv_tag, master_key_version, created_at, disabled, demo
|
||||
enc_priv_nonce, enc_priv_ct, enc_priv_tag, master_key_version, created_at, disabled
|
||||
) VALUES (
|
||||
@id, @key_hash, @key_prefix, @label, @wallet_pkh, @deposit_address,
|
||||
@enc_priv_nonce, @enc_priv_ct, @enc_priv_tag, @master_key_version, @created_at, 0, @demo
|
||||
@enc_priv_nonce, @enc_priv_ct, @enc_priv_tag, @master_key_version, @created_at, 0
|
||||
)
|
||||
`);
|
||||
this.sGetKeyByHash = this.db.prepare(`SELECT * FROM api_keys WHERE key_hash = @key_hash`);
|
||||
@@ -142,8 +133,8 @@ export class GatewayStore {
|
||||
this.sListOpenSessions = this.db.prepare(`SELECT * FROM sessions WHERE state = 'open'`);
|
||||
}
|
||||
|
||||
insertKey(row: Omit<ApiKeyRow, "disabled" | "demo"> & { demo?: number }): void {
|
||||
this.sInsertKey.run({ ...row, label: row.label ?? null, demo: row.demo ?? 0 });
|
||||
insertKey(row: Omit<ApiKeyRow, "disabled">): void {
|
||||
this.sInsertKey.run({ ...row, label: row.label ?? null });
|
||||
}
|
||||
|
||||
getKeyByHash(keyHash: string): ApiKeyRow | undefined {
|
||||
@@ -202,8 +193,4 @@ export class GatewayStore {
|
||||
listOpenSessions(): SessionRow[] {
|
||||
return this.sListOpenSessions.all() as SessionRow[];
|
||||
}
|
||||
|
||||
listOpenSessionsByKey(keyId: string): SessionRow[] {
|
||||
return this.listOpenSessions().filter((s) => s.key_id === keyId);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -57,10 +57,7 @@ export function runMain(env: Record<string, string | undefined>): void {
|
||||
const invokedDirectly =
|
||||
typeof process !== "undefined" &&
|
||||
process.argv?.[1] !== undefined &&
|
||||
// Accept both path separators: on Windows process.argv[1] arrives with
|
||||
// backslashes, so a forward-slash-only pattern silently never matches and
|
||||
// the process exits 0 without ever starting the server.
|
||||
/gateway[\\/](src|dist)[\\/]index\.(t|j)s$/.test(process.argv[1]);
|
||||
/gateway\/(src|dist)\/index\.(t|j)s$/.test(process.argv[1]);
|
||||
|
||||
if (invokedDirectly) {
|
||||
try {
|
||||
|
||||
@@ -60,28 +60,7 @@ export function ipRateLimit(opts: { max: number; windowMs: number }) {
|
||||
return makeLimiter(opts, (req) => req.ip ?? "unknown");
|
||||
}
|
||||
|
||||
/** Per-API-key limiter (apply AFTER apiKeyAuth). Demo keys are exempt: the
|
||||
* shared demo key would let one abusive IP exhaust everyone's budget — the
|
||||
* per-IP demoIpRateLimit is the demo control instead. */
|
||||
/** Per-API-key limiter (apply AFTER apiKeyAuth). */
|
||||
export function keyRateLimit(opts: { max: number; windowMs: number }) {
|
||||
const limit = makeLimiter(opts, (req) => requireKey(req).id);
|
||||
return (req: Request, res: Response, next: NextFunction): void => {
|
||||
if (requireKey(req).demo) {
|
||||
next();
|
||||
return;
|
||||
}
|
||||
limit(req, res, next);
|
||||
};
|
||||
}
|
||||
|
||||
/** Per-IP limiter that applies ONLY to demo-key requests (after apiKeyAuth). */
|
||||
export function demoIpRateLimit(opts: { max: number; windowMs: number }) {
|
||||
const limit = makeLimiter(opts, (req) => req.ip ?? "unknown");
|
||||
return (req: Request, res: Response, next: NextFunction): void => {
|
||||
if (!requireKey(req).demo) {
|
||||
next();
|
||||
return;
|
||||
}
|
||||
limit(req, res, next);
|
||||
};
|
||||
return makeLimiter(opts, (req) => requireKey(req).id);
|
||||
}
|
||||
|
||||
@@ -1,402 +0,0 @@
|
||||
/**
|
||||
* gateway/src/ocr/extract.ts — POST /v1/ocr/extract.
|
||||
*
|
||||
* One escrow per page against a model-scoped `ocr.page.extract.<model>.v1`
|
||||
* supplier (config.ocrCapabilityId). Lifecycle mirrors the one-shot chat
|
||||
* path, all inside the per-key mutex: parse → select supplier → preflight →
|
||||
* per-candidate live busy pre-check → submitOcr (escrow → supplier call →
|
||||
* receipt verify) → resolve Submitted ref → Accept (awaited) → record usage
|
||||
* → wallet-health → respond.
|
||||
*
|
||||
* Response (200):
|
||||
* {
|
||||
* output_format, content,
|
||||
* usage: { prompt_tokens, completion_tokens, total_tokens },
|
||||
* x_vector: {
|
||||
* receipt, receipt_signature, escrow_ref,
|
||||
* receipt_labels: ["first-party-brokered"]
|
||||
* }
|
||||
* }
|
||||
*
|
||||
* Venue attribution: the caller MAY send
|
||||
* X-Venue: venue slug (e.g. "apify"), ≤ 32 chars
|
||||
* X-Run-User-Hash: sha256 of the venue-side runner id, 64 hex
|
||||
* Both are logged on a structured line per settled job. The wedge-ledger
|
||||
* emitter consumes these lines; a usage-table venue
|
||||
* column is deliberately deferred to later work so this route stays
|
||||
* schema-additive. payer_class is derived at ledger time from the hash
|
||||
* (known first-party hashes vs the rest), never asserted here.
|
||||
*
|
||||
* Demo keys are rejected: the demo executor is chat-session-shaped and its
|
||||
* wallet holds one escrow per session; OCR needs a funded per-key wallet.
|
||||
*/
|
||||
|
||||
import { randomUUID } from "crypto";
|
||||
import type { Request, Response } from "express";
|
||||
import { TxConstructionError } from "@marketplace/shared/tx";
|
||||
import {
|
||||
ALLOWED_OCR_MIMES,
|
||||
ALLOWED_OCR_OUTPUT_FORMATS,
|
||||
MAX_OCR_IMAGE_B64_CHARS,
|
||||
} from "@marketplace/shared/tx";
|
||||
import { SupplierError, type ProgressEvent } from "@marketplace/buyer/sdk";
|
||||
import type { GatewayDeps } from "../deps.js";
|
||||
import type { GatewayStore } from "../db/store.js";
|
||||
import { requireKey } from "../middleware/apiKeyAuth.js";
|
||||
import { asyncHandler } from "../middleware/http.js";
|
||||
import { selectCandidates, type SupplierCandidate } from "../routing/selectSupplier.js";
|
||||
import { preflight } from "../onchain/preflight.js";
|
||||
import { resolveSubmittedRef, acceptAndConfirm } from "../onchain/settle.js";
|
||||
import { ensureWalletHealthy } from "../walletHealth.js";
|
||||
import { badRequest, forbidden, notFound, paymentRequired, toGatewayError } from "../openai/errors.js";
|
||||
|
||||
/** Operator-model v0: HAL8 operates both the custodial buyer and the
|
||||
* supplier fleet, so every receipt this route returns is first-party
|
||||
* brokered. Becomes per-supplier metadata when
|
||||
* control-independent supply exists. */
|
||||
const RECEIPT_LABELS_V0 = ["first-party-brokered"] as const;
|
||||
|
||||
const B64_RE = /^[A-Za-z0-9+/]+={0,2}$/;
|
||||
const HEX64_RE = /^[0-9a-fA-F]{64}$/;
|
||||
const VENUE_RE = /^[a-z0-9-]{1,32}$/;
|
||||
|
||||
/** Bound on the live busy pre-check below - cheap enough that a stalled
|
||||
* supplier never meaningfully delays the request. */
|
||||
const SUPPLIER_STATUS_CHECK_TIMEOUT_MS = 2_000;
|
||||
|
||||
interface ParsedOcrRequest {
|
||||
image_b64: string;
|
||||
mime: string;
|
||||
output_format: string;
|
||||
/** "" = any model under the capability (single-model ids). */
|
||||
model: string;
|
||||
}
|
||||
|
||||
function parseOcrRequest(body: unknown): ParsedOcrRequest {
|
||||
if (typeof body !== "object" || body === null) {
|
||||
throw badRequest("invalid_body", "request body must be a JSON object");
|
||||
}
|
||||
const b = body as Record<string, unknown>;
|
||||
|
||||
const image = b.image_b64;
|
||||
if (typeof image !== "string" || image.length === 0) {
|
||||
throw badRequest("invalid_image", "`image_b64` is required and must be a non-empty base64 string");
|
||||
}
|
||||
if (image.length > MAX_OCR_IMAGE_B64_CHARS) {
|
||||
throw badRequest("image_too_large", `\`image_b64\` exceeds ${MAX_OCR_IMAGE_B64_CHARS} characters`);
|
||||
}
|
||||
if (!B64_RE.test(image)) {
|
||||
throw badRequest("invalid_image", "`image_b64` must be plain base64 (no data: prefix, no whitespace)");
|
||||
}
|
||||
|
||||
const mime = b.mime;
|
||||
if (typeof mime !== "string" || !ALLOWED_OCR_MIMES.has(mime)) {
|
||||
throw badRequest("invalid_mime", `\`mime\` must be one of: ${[...ALLOWED_OCR_MIMES].join(", ")}`);
|
||||
}
|
||||
|
||||
const rawFormat = b.output_format ?? "markdown";
|
||||
if (typeof rawFormat !== "string" || !ALLOWED_OCR_OUTPUT_FORMATS.has(rawFormat)) {
|
||||
throw badRequest(
|
||||
"invalid_output_format",
|
||||
`\`output_format\` must be one of: ${[...ALLOWED_OCR_OUTPUT_FORMATS].join(", ")}`,
|
||||
);
|
||||
}
|
||||
|
||||
let model = "";
|
||||
if (b.model !== undefined && b.model !== null) {
|
||||
if (typeof b.model !== "string" || b.model === "") {
|
||||
throw badRequest("invalid_model", "`model` must be a non-empty string when provided");
|
||||
}
|
||||
model = b.model;
|
||||
}
|
||||
|
||||
return { image_b64: image, mime, output_format: rawFormat, model };
|
||||
}
|
||||
|
||||
/** Sanitized venue-attribution headers. Invalid values drop to "".
|
||||
* Exported for direct unit testing (I3 review finding) — it is the only
|
||||
* gate on what lands in the ocr_settled/ocr_failed structured log lines the
|
||||
* wedge-ledger emitter reads, so it needs coverage independent of the HTTP
|
||||
* route. */
|
||||
export function venueAttribution(req: Request): { venue: string; runUserHash: string } {
|
||||
const venueRaw = req.header("X-Venue") ?? "";
|
||||
const hashRaw = req.header("X-Run-User-Hash") ?? "";
|
||||
return {
|
||||
venue: VENUE_RE.test(venueRaw) ? venueRaw : "",
|
||||
runUserHash: HEX64_RE.test(hashRaw) ? hashRaw.toLowerCase() : "",
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
* Live busy pre-check, run immediately before a candidate's escrow posts.
|
||||
* Mirrors sessions.ts's startChat pre-check: same signal ("working" on the
|
||||
* supplier's own /status), same best-effort posture. Posting an escrow only
|
||||
* to have the supplier reject as busy strands the escrow until reclaim and
|
||||
* burns the tx fee, so this is worth a bounded, cheap HTTP round trip.
|
||||
*
|
||||
* Never a gate: the indexer already filters candidates on advert status, so
|
||||
* a timeout, network error, non-2xx, or malformed body all resolve to "not
|
||||
* busy" (unknown, not blocking) - a briefly-unreachable /status must never
|
||||
* stop the candidate from being attempted.
|
||||
*/
|
||||
async function isSupplierBusy(
|
||||
endpointUrl: string,
|
||||
fetchFn: typeof globalThis.fetch,
|
||||
): Promise<boolean> {
|
||||
try {
|
||||
const res = await fetchFn(`${endpointUrl.replace(/\/+$/, "")}/status`, {
|
||||
signal: AbortSignal.timeout(SUPPLIER_STATUS_CHECK_TIMEOUT_MS),
|
||||
});
|
||||
if (!res.ok) return false;
|
||||
const body = (await res.json()) as unknown;
|
||||
const status = body && typeof body === "object" ? (body as { status?: unknown }).status : undefined;
|
||||
return status === "working";
|
||||
} catch {
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
function recordOcrUsage(
|
||||
store: GatewayStore,
|
||||
p: {
|
||||
keyId: string;
|
||||
capabilityId: string;
|
||||
model: string;
|
||||
supplierPkh: string | null;
|
||||
escrowRef: string | null;
|
||||
costLovelace: bigint | null;
|
||||
promptTokens: number;
|
||||
completionTokens: number;
|
||||
status: "completed" | "failed";
|
||||
failureReason?: string;
|
||||
},
|
||||
): void {
|
||||
store.insertUsage({
|
||||
id: randomUUID(),
|
||||
key_id: p.keyId,
|
||||
created_at: Date.now(),
|
||||
kind: "ocr",
|
||||
model: p.model,
|
||||
capability_id: p.capabilityId,
|
||||
supplier_pkh: p.supplierPkh,
|
||||
escrow_ref: p.escrowRef,
|
||||
cost_lovelace: p.costLovelace !== null ? p.costLovelace.toString() : null,
|
||||
prompt_tokens: p.promptTokens,
|
||||
completion_tokens: p.completionTokens,
|
||||
status: p.status,
|
||||
failure_reason: p.failureReason ?? null,
|
||||
});
|
||||
}
|
||||
|
||||
export function makeOcrExtractHandler(deps: GatewayDeps) {
|
||||
return asyncHandler(async (req: Request, res: Response) => {
|
||||
const keyRow = requireKey(req);
|
||||
if (keyRow.demo) {
|
||||
throw forbidden("demo_key_unsupported", "demo keys cannot use /v1/ocr/extract; create a funded API key");
|
||||
}
|
||||
const ctx = deps.registry.getContext(keyRow);
|
||||
const parsed = parseOcrRequest(req.body);
|
||||
const attribution = venueAttribution(req);
|
||||
await ctx.mutex.run(() => runOcrOneShot(deps, keyRow.id, ctx, parsed, attribution, res));
|
||||
});
|
||||
}
|
||||
|
||||
async function runOcrOneShot(
|
||||
deps: GatewayDeps,
|
||||
keyId: string,
|
||||
ctx: ReturnType<GatewayDeps["registry"]["getContext"]>,
|
||||
parsed: ParsedOcrRequest,
|
||||
attribution: { venue: string; runUserHash: string },
|
||||
res: Response,
|
||||
): Promise<void> {
|
||||
const { config, store, chain, fetchFn } = deps;
|
||||
const capabilityId = config.ocrCapabilityId;
|
||||
|
||||
// Hoisted above the try so the catch block can report whatever is known
|
||||
// even when the failure happens AFTER an escrow was posted (e.g. the
|
||||
// supplier call or settle step fails) — these fields are the
|
||||
// reconciliation spine that joins on-chain settlement to platform
|
||||
// billing, and losing them makes paid-but-failed jobs unreconcilable
|
||||
// (I2 review finding).
|
||||
let result: Awaited<ReturnType<typeof ctx.sdk.submitOcr>> | undefined;
|
||||
let used: SupplierCandidate | undefined;
|
||||
let escrowRefStr: string | null = null;
|
||||
|
||||
try {
|
||||
const candidates = await selectCandidates({
|
||||
indexerUrl: config.indexerUrl,
|
||||
model: parsed.model,
|
||||
capabilityId,
|
||||
fetchFn,
|
||||
});
|
||||
if (candidates.length === 0) {
|
||||
throw notFound(
|
||||
"model_not_found",
|
||||
parsed.model === ""
|
||||
? `no available supplier for capability "${capabilityId}"`
|
||||
: `no available supplier for model "${parsed.model}" under "${capabilityId}"`,
|
||||
);
|
||||
}
|
||||
|
||||
const primary = candidates[0];
|
||||
const pf = await preflight(chain, ctx.walletKey.address, primary);
|
||||
if (!pf.ok) {
|
||||
throw paymentRequired(
|
||||
pf.collateralOk
|
||||
? "insufficient balance for this request"
|
||||
: "wallet has no pure-AP3X UTxO ≥ 5 AP3X for collateral; deposit a little more AP3X",
|
||||
{
|
||||
x_vector: {
|
||||
required_lovelace: pf.requiredLovelace.toString(),
|
||||
available_lovelace: pf.availableLovelace.toString(),
|
||||
collateral_ok: pf.collateralOk,
|
||||
deposit_address: ctx.walletKey.address,
|
||||
},
|
||||
},
|
||||
);
|
||||
}
|
||||
|
||||
// Submit. Fall back to the next supplier ONLY on a pre-post
|
||||
// TxConstructionError (no escrow was posted). A SupplierError means the
|
||||
// escrow is already posted — do not retry (the sweeper recovers it).
|
||||
//
|
||||
// submitOcr posts the escrow internally and only returns escrowRef when
|
||||
// it resolves. When the supplier call AFTER the post throws
|
||||
// (SupplierError: timeout, network failure, non-2xx, malformed
|
||||
// response, receipt mismatch) the escrow already landed on chain but
|
||||
// escrowRefStr below would otherwise stay null — the OCR upstream has a
|
||||
// 120s budget, so this is likely the most common paid-but-failed shape.
|
||||
// The SDK emits a "progress" event of type "escrow_posted" (carrying
|
||||
// escrow_ref) the instant the tx confirms, so listen for it around each
|
||||
// attempt and capture the ref from the event rather than only from
|
||||
// submitOcr's return value (I2 follow-up).
|
||||
let lastErr: unknown;
|
||||
for (const cand of candidates) {
|
||||
// Live pre-check, run right here (not once at the top of the request):
|
||||
// skip a candidate that is busy right now instead of paying to find
|
||||
// out. See isSupplierBusy's docstring for the exact signal + posture.
|
||||
if (await isSupplierBusy(cand.endpointUrl, fetchFn)) {
|
||||
lastErr = new SupplierError("supplier_busy", {
|
||||
status: 409,
|
||||
message: "supplier is busy with another job",
|
||||
});
|
||||
continue;
|
||||
}
|
||||
|
||||
const onProgress = (ev: unknown): void => {
|
||||
const e = ev as ProgressEvent;
|
||||
if (e.type === "escrow_posted" && e.escrow_ref) escrowRefStr = e.escrow_ref;
|
||||
};
|
||||
ctx.sdk.on("progress", onProgress);
|
||||
try {
|
||||
result = await ctx.sdk.submitOcr({
|
||||
advertRef: cand.advertRef,
|
||||
image_b64: parsed.image_b64,
|
||||
mime: parsed.mime,
|
||||
output_format: parsed.output_format,
|
||||
payment_lovelace: cand.priceLovelace,
|
||||
});
|
||||
used = cand;
|
||||
break;
|
||||
} catch (err) {
|
||||
lastErr = err;
|
||||
if (err instanceof TxConstructionError) continue;
|
||||
throw err;
|
||||
} finally {
|
||||
ctx.sdk.off("progress", onProgress);
|
||||
}
|
||||
}
|
||||
if (!result || !used) {
|
||||
throw toGatewayError(lastErr ?? new Error("no supplier could be engaged"));
|
||||
}
|
||||
|
||||
// Settle: resolve the live Submitted ref, Accept, await confirmation.
|
||||
escrowRefStr = `${result.escrowRef.txHash}#${result.escrowRef.index}`;
|
||||
const submittedRef = await resolveSubmittedRef({
|
||||
indexerUrl: config.indexerUrl,
|
||||
buyerPkh: ctx.walletKey.pubKeyHash,
|
||||
originalRefStr: escrowRefStr,
|
||||
fetchFn,
|
||||
});
|
||||
await acceptAndConfirm(chain, ctx.walletKey, submittedRef);
|
||||
|
||||
recordOcrUsage(store, {
|
||||
keyId,
|
||||
capabilityId,
|
||||
model: used.model,
|
||||
supplierPkh: used.supplierPkh,
|
||||
escrowRef: escrowRefStr,
|
||||
costLovelace: used.priceLovelace,
|
||||
promptTokens: result.usage.prompt_tokens,
|
||||
completionTokens: result.usage.completion_tokens,
|
||||
status: "completed",
|
||||
});
|
||||
|
||||
// Structured settle line for the wedge-ledger emitter. One line per
|
||||
// settled job; venue/run_user_hash empty when the
|
||||
// caller sent none.
|
||||
console.log(JSON.stringify({
|
||||
evt: "ocr_settled",
|
||||
escrow_ref: escrowRefStr,
|
||||
capability_id: capabilityId,
|
||||
model: used.model,
|
||||
supplier_pkh: used.supplierPkh,
|
||||
cost_lovelace: used.priceLovelace.toString(),
|
||||
receipt_labels: RECEIPT_LABELS_V0,
|
||||
venue: attribution.venue,
|
||||
run_user_hash: attribution.runUserHash,
|
||||
ts: new Date().toISOString(),
|
||||
}));
|
||||
|
||||
// Re-shape the wallet ({collateral, working}) so the next request keeps
|
||||
// a valid collateral UTxO. Best-effort; serialized by the mutex.
|
||||
await ensureWalletHealthy(chain, ctx.walletKey).catch((e) =>
|
||||
// eslint-disable-next-line no-console
|
||||
console.error("[gateway] wallet-health after ocr:", e instanceof Error ? e.message : e),
|
||||
);
|
||||
|
||||
res.status(200).json({
|
||||
output_format: result.output_format,
|
||||
content: result.content,
|
||||
usage: result.usage,
|
||||
x_vector: {
|
||||
receipt: result.receipt,
|
||||
receipt_signature: result.receiptSignature,
|
||||
escrow_ref: escrowRefStr,
|
||||
receipt_labels: RECEIPT_LABELS_V0,
|
||||
},
|
||||
});
|
||||
} catch (err) {
|
||||
recordOcrUsage(store, {
|
||||
keyId,
|
||||
capabilityId,
|
||||
model: used?.model ?? parsed.model,
|
||||
supplierPkh: used?.supplierPkh ?? null,
|
||||
escrowRef: escrowRefStr,
|
||||
costLovelace: used?.priceLovelace ?? null,
|
||||
promptTokens: result?.usage.prompt_tokens ?? 0,
|
||||
completionTokens: result?.usage.completion_tokens ?? 0,
|
||||
status: "failed",
|
||||
failureReason: err instanceof Error ? err.message : String(err),
|
||||
});
|
||||
|
||||
// Structured failure line mirroring ocr_settled's shape (same venue /
|
||||
// run_user_hash / escrow_ref fields) so paid-but-failed jobs — an
|
||||
// escrow posted on-chain, then a later step (supplier call, settle)
|
||||
// failed — can still be reconciled against on-chain state instead of
|
||||
// vanishing from the wedge-ledger emitter's input (I2 review finding).
|
||||
console.log(JSON.stringify({
|
||||
evt: "ocr_failed",
|
||||
escrow_ref: escrowRefStr,
|
||||
capability_id: capabilityId,
|
||||
model: used?.model ?? parsed.model,
|
||||
supplier_pkh: used?.supplierPkh ?? null,
|
||||
venue: attribution.venue,
|
||||
run_user_hash: attribution.runUserHash,
|
||||
error: err instanceof Error ? err.message : String(err),
|
||||
ts: new Date().toISOString(),
|
||||
}));
|
||||
|
||||
throw err;
|
||||
}
|
||||
}
|
||||
@@ -2,20 +2,14 @@
|
||||
* gateway/src/onchain/preflight.ts — balance + collateral pre-flight.
|
||||
*
|
||||
* The buyer wallet funds the FULL escrow at PostEscrow: price + buyer_bond +
|
||||
* supplier_bond, raised to the Submitted-state min-ada floor so long
|
||||
* capability ids (e.g. the 33-byte OCR one) don't get bumped mid-flight —
|
||||
* see escrowLockFloor (packages/shared/.../minAdaFloor.ts) and
|
||||
* postOcrEscrow.ts:205, the SAME floor a POST actually locks. Accept/Reclaim
|
||||
* are Plutus script-spends that also need a pure-AP3X collateral UTxO ≥ 5
|
||||
* AP3X (assertCollateralCandidate). So required = escrowLockFloor(price +
|
||||
* buyer_bond + supplier_bond) + collateral + fee reserve, AND the wallet
|
||||
* must currently hold a pure-AP3X UTxO ≥ collateral. We check both up front
|
||||
* and return a clean 402 instead of failing mid-flight.
|
||||
* supplier_bond (postEscrow.ts:132). Accept/Reclaim are Plutus script-spends
|
||||
* that also need a pure-ADA collateral UTxO ≥ 5 ADA (assertCollateralCandidate).
|
||||
* So required = price + buyer_bond + supplier_bond + collateral + fee reserve,
|
||||
* AND the wallet must currently hold a pure-ADA UTxO ≥ collateral. We check both
|
||||
* up front and return a clean 402 instead of failing mid-flight.
|
||||
*/
|
||||
|
||||
import type { ChainProvider, Utxo } from "@marketplace/shared/chain";
|
||||
import type { EscrowDatum } from "@marketplace/shared/cbor";
|
||||
import { escrowLockFloor } from "@marketplace/shared/tx";
|
||||
|
||||
export const COLLATERAL_MIN_LOVELACE = 5_000_000n;
|
||||
export const FEE_RESERVE_LOVELACE = 2_000_000n;
|
||||
@@ -24,7 +18,7 @@ export function totalLovelace(utxos: Utxo[]): bigint {
|
||||
return utxos.reduce((sum, u) => sum + u.lovelace, 0n);
|
||||
}
|
||||
|
||||
/** True iff some UTxO is pure-AP3X (no native assets) and ≥ collateral floor. */
|
||||
/** True iff some UTxO is pure-ADA (no native assets) and ≥ collateral floor. */
|
||||
export function hasCollateral(utxos: Utxo[]): boolean {
|
||||
return utxos.some(
|
||||
(u) => u.lovelace >= COLLATERAL_MIN_LOVELACE && Object.keys(u.assets).length === 0,
|
||||
@@ -38,48 +32,20 @@ export interface PreflightResult {
|
||||
collateralOk: boolean;
|
||||
}
|
||||
|
||||
export interface PreflightCost {
|
||||
capabilityId: string;
|
||||
priceLovelace: bigint;
|
||||
buyerBondLovelace: bigint;
|
||||
supplierBondLovelace: bigint;
|
||||
}
|
||||
|
||||
/** Placeholder datum used only to size-estimate the Submitted-state min-ada
|
||||
* floor. Every field except capability_id and the cost amounts is a
|
||||
* fixed-size stand-in (real hash/pkh byte widths, a realistic 13-digit
|
||||
* POSIX-ms timestamp) — capability_id's actual length is what drives the
|
||||
* estimate, exactly as in escrowLockFloor's own contract. */
|
||||
function representativeEscrowDatum(cost: PreflightCost): EscrowDatum {
|
||||
return {
|
||||
buyer_pkh: "3b2fdaed0398485ff35887fb7d0ad2025348864407854f7831dc6a55",
|
||||
supplier_pkh: "401af418a7e6fb106277292881fcdeaa1cc15b5b112e9c8bdb2d46c9",
|
||||
advert_ref: { txHash: "a6".repeat(32), index: 0 },
|
||||
capability_id: cost.capabilityId,
|
||||
request_spec_hash: "1b".repeat(32),
|
||||
prompt_hash: "23".repeat(32),
|
||||
payment_lovelace: cost.priceLovelace,
|
||||
buyer_bond_lovelace: cost.buyerBondLovelace,
|
||||
supplier_bond_lovelace: cost.supplierBondLovelace,
|
||||
deliver_by: 1_786_105_955_257,
|
||||
posted_at: 1_786_105_625_257,
|
||||
submitted_at: null,
|
||||
result_receipt_hash: null,
|
||||
state: "Open",
|
||||
};
|
||||
}
|
||||
|
||||
export async function preflight(
|
||||
chain: ChainProvider,
|
||||
address: string,
|
||||
cost: PreflightCost,
|
||||
cost: { priceLovelace: bigint; buyerBondLovelace: bigint; supplierBondLovelace: bigint },
|
||||
): Promise<PreflightResult> {
|
||||
const utxos = await chain.queryUtxosByAddress(address);
|
||||
const available = totalLovelace(utxos);
|
||||
const collateralOk = hasCollateral(utxos);
|
||||
const economicTotal = cost.priceLovelace + cost.buyerBondLovelace + cost.supplierBondLovelace;
|
||||
const escrowFloor = escrowLockFloor(representativeEscrowDatum(cost), economicTotal);
|
||||
const required = escrowFloor + COLLATERAL_MIN_LOVELACE + FEE_RESERVE_LOVELACE;
|
||||
const required =
|
||||
cost.priceLovelace +
|
||||
cost.buyerBondLovelace +
|
||||
cost.supplierBondLovelace +
|
||||
COLLATERAL_MIN_LOVELACE +
|
||||
FEE_RESERVE_LOVELACE;
|
||||
return {
|
||||
ok: available >= required && collateralOk,
|
||||
availableLovelace: available,
|
||||
|
||||
@@ -22,8 +22,6 @@ export interface EscrowRow {
|
||||
utxo_ref: string;
|
||||
state: string;
|
||||
posted_at: number;
|
||||
/** Validator reclaim floor (indexer serves it; absent on very old rows). */
|
||||
deliver_by?: number;
|
||||
}
|
||||
|
||||
export async function fetchEscrows(
|
||||
|
||||
@@ -1,116 +0,0 @@
|
||||
/**
|
||||
* gateway/src/openai/affinity.ts — transcript-prefix session matching.
|
||||
*
|
||||
* Stateless OpenAI clients resend the FULL message history each call; sessions
|
||||
* are stateful. An incoming request belongs to an open session when that
|
||||
* session's mirrored transcript is a prefix of the incoming messages — the
|
||||
* suffix (delta) is the next turn. Client-authored messages (user/system/tool)
|
||||
* must match byte-exactly, but clients routinely reshape ASSISTANT text when
|
||||
* echoing it back (strip <think> reasoning, re-render whitespace), so
|
||||
* assistant content is compared normalized. Strict (byte-exact) matches are
|
||||
* preferred over lenient ones to disambiguate concurrent threads that share a
|
||||
* user-message prefix. The mirror itself is NEVER rewritten with client text:
|
||||
* the delta is forwarded verbatim and mirrored only after a successful turn,
|
||||
* so the gateway mirror and the supplier transcript stay hash-identical for
|
||||
* the receipt response_hash.
|
||||
*
|
||||
* Pure module — no I/O — so the matching rules are unit-testable.
|
||||
*/
|
||||
|
||||
import { chatMessagesEquivalent, toolCallsEqual, type ChatMessage } from "@marketplace/shared/tx";
|
||||
|
||||
export interface AffinityCandidate {
|
||||
sessionId: string;
|
||||
model: string;
|
||||
mirror: ChatMessage[];
|
||||
lastUsedAt: number;
|
||||
}
|
||||
|
||||
export interface AffinityMatch {
|
||||
sessionId: string;
|
||||
/** Messages the session has not seen yet — forwarded as the next turn. */
|
||||
delta: ChatMessage[];
|
||||
}
|
||||
|
||||
/** Canonicalize assistant text the way clients mangle it when re-echoing
|
||||
* history: drop <think>…</think> reasoning blocks, collapse whitespace runs,
|
||||
* trim. Exported for tests. */
|
||||
export function normalizeAssistantContent(content: string): string {
|
||||
return content
|
||||
.replace(/<think>[\s\S]*?<\/think>/gi, "")
|
||||
.replace(/\s+/g, " ")
|
||||
.trim();
|
||||
}
|
||||
|
||||
/** Lenient equality: strict for client-authored roles (the client sends the
|
||||
* same bytes both times); assistant content is compared normalized while
|
||||
* assistant tool_calls stay strict (ids anchor tool-result turns). */
|
||||
function chatMessagesLenientEquivalent(a: ChatMessage, b: ChatMessage): boolean {
|
||||
if (a.role !== b.role) return false;
|
||||
if (a.role !== "assistant") return chatMessagesEquivalent(a, b);
|
||||
return (
|
||||
normalizeAssistantContent(a.content) === normalizeAssistantContent(b.content) &&
|
||||
toolCallsEqual(a.tool_calls, b.tool_calls)
|
||||
);
|
||||
}
|
||||
|
||||
type PrefixQuality = "strict" | "lenient";
|
||||
|
||||
function classifyPrefix(mirror: ChatMessage[], incoming: ChatMessage[]): PrefixQuality | null {
|
||||
if (mirror.length >= incoming.length) return null;
|
||||
let strict = true;
|
||||
for (let i = 0; i < mirror.length; i++) {
|
||||
if (chatMessagesEquivalent(mirror[i], incoming[i])) continue;
|
||||
if (!chatMessagesLenientEquivalent(mirror[i], incoming[i])) return null;
|
||||
strict = false;
|
||||
}
|
||||
return strict ? "strict" : "lenient";
|
||||
}
|
||||
|
||||
function deltaRespondable(delta: ChatMessage[]): boolean {
|
||||
const last = delta[delta.length - 1];
|
||||
return last !== undefined && (last.role === "user" || last.role === "tool");
|
||||
}
|
||||
|
||||
/** Drop trailing assistant/system messages so the history ends with a
|
||||
* respondable message (regenerate semantics for clients that send a trailing
|
||||
* assistant turn). Empty result = nothing to answer. */
|
||||
export function trimToRespondable(messages: ChatMessage[]): ChatMessage[] {
|
||||
let end = messages.length;
|
||||
while (end > 0 && messages[end - 1].role !== "user" && messages[end - 1].role !== "tool") end--;
|
||||
return messages.slice(0, end);
|
||||
}
|
||||
|
||||
/**
|
||||
* Pick the open session whose mirror best matches the incoming history.
|
||||
* Strict prefixes beat lenient ones; then longest mirror wins (most
|
||||
* conversation reuse); ties go to the most recently used session. Returns
|
||||
* null when nothing matches — caller opens a new session and replays the full
|
||||
* history. Note `incoming.length <= mirror.length` never matches (a client
|
||||
* retry of an already-answered request is a miss by design: the session
|
||||
* transcript must stay append-only).
|
||||
*/
|
||||
export function matchSessionPrefix(
|
||||
candidates: AffinityCandidate[],
|
||||
incoming: ChatMessage[],
|
||||
model: string,
|
||||
): AffinityMatch | null {
|
||||
let best: { cand: AffinityCandidate; quality: PrefixQuality } | null = null;
|
||||
for (const cand of candidates) {
|
||||
if (cand.model !== model) continue;
|
||||
const quality = classifyPrefix(cand.mirror, incoming);
|
||||
if (quality === null) continue;
|
||||
if (!deltaRespondable(incoming.slice(cand.mirror.length))) continue;
|
||||
if (
|
||||
best === null ||
|
||||
(quality === "strict" && best.quality === "lenient") ||
|
||||
(quality === best.quality &&
|
||||
(cand.mirror.length > best.cand.mirror.length ||
|
||||
(cand.mirror.length === best.cand.mirror.length && cand.lastUsedAt > best.cand.lastUsedAt)))
|
||||
) {
|
||||
best = { cand, quality };
|
||||
}
|
||||
}
|
||||
if (!best) return null;
|
||||
return { sessionId: best.cand.sessionId, delta: incoming.slice(best.cand.mirror.length) };
|
||||
}
|
||||
@@ -21,7 +21,6 @@ import { preflight } from "../onchain/preflight.js";
|
||||
import { resolveSubmittedRef, acceptAndConfirm } from "../onchain/settle.js";
|
||||
import { ensureWalletHealthy } from "../walletHealth.js";
|
||||
import { parseChatRequest, type ParsedChatRequest } from "./validate.js";
|
||||
import { runDemoChat } from "./demoChat.js";
|
||||
import {
|
||||
genId,
|
||||
buildChatCompletion,
|
||||
@@ -68,17 +67,8 @@ function recordUsage(
|
||||
export function makeChatCompletionsHandler(deps: GatewayDeps) {
|
||||
return asyncHandler(async (req: Request, res: Response) => {
|
||||
const keyRow = requireKey(req);
|
||||
const ctx = deps.registry.getContext(keyRow);
|
||||
if (keyRow.demo) {
|
||||
// Demo keys run session-backed with tools passthrough, and never fall
|
||||
// back to one-shot (its settle path assumes ≤1 in-flight escrow per
|
||||
// wallet; the demo wallet holds one escrow per concurrent session).
|
||||
// Not under the key mutex — runDemoChat takes it only for session opens.
|
||||
const parsed = parseChatRequest(req.body, { allowTools: true });
|
||||
await runDemoChat(deps, keyRow, ctx, parsed, res);
|
||||
return;
|
||||
}
|
||||
const parsed = parseChatRequest(req.body);
|
||||
const ctx = deps.registry.getContext(keyRow);
|
||||
await ctx.mutex.run(() => runOneShot(deps, keyRow, ctx, parsed, res));
|
||||
});
|
||||
}
|
||||
@@ -96,8 +86,6 @@ async function runOneShot(
|
||||
indexerUrl: config.indexerUrl,
|
||||
model: parsed.model,
|
||||
capabilityId: CAPABILITY,
|
||||
supplierPkh: parsed.supplierPkh,
|
||||
preferredSupplierPkh: config.preferredSupplierPkh,
|
||||
fetchFn,
|
||||
});
|
||||
if (candidates.length === 0) {
|
||||
@@ -110,7 +98,7 @@ async function runOneShot(
|
||||
throw paymentRequired(
|
||||
pf.collateralOk
|
||||
? "insufficient balance for this request"
|
||||
: "wallet has no pure-AP3X UTxO ≥ 5 AP3X for collateral; deposit a little more AP3X",
|
||||
: "wallet has no pure-ADA UTxO ≥ 5 ADA for collateral; deposit a little more ADA",
|
||||
{
|
||||
x_vector: {
|
||||
required_lovelace: pf.requiredLovelace.toString(),
|
||||
@@ -154,7 +142,6 @@ async function runOneShot(
|
||||
messages: parsed.messages,
|
||||
payment_lovelace: cand.priceLovelace,
|
||||
max_output_tokens: parsed.maxTokens,
|
||||
public_preview: parsed.publicPreview,
|
||||
});
|
||||
used = cand;
|
||||
break;
|
||||
@@ -170,9 +157,6 @@ async function runOneShot(
|
||||
|
||||
// Settle: resolve the live Submitted ref, Accept, await confirmation.
|
||||
const originalRefStr = `${result.escrowRef.txHash}#${result.escrowRef.index}`;
|
||||
if (!parsed.stream) {
|
||||
res.setHeader("X-Vector-Escrow-Ref", originalRefStr);
|
||||
}
|
||||
const submittedRef = await resolveSubmittedRef({
|
||||
indexerUrl: config.indexerUrl,
|
||||
buyerPkh: ctx.walletKey.pubKeyHash,
|
||||
|
||||
@@ -1,413 +0,0 @@
|
||||
/**
|
||||
* gateway/src/openai/demoChat.ts — session-backed /chat/completions for the
|
||||
* shared demo key.
|
||||
*
|
||||
* Demo requests keep the standard OpenAI wire shape (tools included) but run
|
||||
* against real escrow-per-session marketplace conversations: transcript-prefix
|
||||
* affinity maps each stateless request onto an open session and forwards only
|
||||
* the unseen delta; a miss transparently opens a new session (escrow post —
|
||||
* the only chain work, under the key mutex) and replays the full history as
|
||||
* the first turn. Supplier idle-closes are healed by reopening; the sweeper
|
||||
* settles the abandoned escrow.
|
||||
*
|
||||
* Demo keys NEVER fall back to the one-shot path: resolveSubmittedRef's
|
||||
* lone-Submitted-row fallback assumes ≤1 in-flight escrow per wallet, and the
|
||||
* demo wallet holds one escrow per concurrent session.
|
||||
*/
|
||||
|
||||
import { randomUUID } from "crypto";
|
||||
import type { Response } from "express";
|
||||
import type { ChatMessage, ToolCall } from "@marketplace/shared/tx";
|
||||
import type { GatewayDeps } from "../deps.js";
|
||||
import type { ApiKeyRow, SessionRow } from "../db/store.js";
|
||||
import type { KeyContext } from "../sdk/registry.js";
|
||||
import { transcripts, getSessionLock, dropSessionState } from "./transcripts.js";
|
||||
import { matchSessionPrefix, trimToRespondable, type AffinityCandidate } from "./affinity.js";
|
||||
import {
|
||||
CAPABILITY,
|
||||
SessionGoneError,
|
||||
openSessionCore,
|
||||
streamSupplierTurn,
|
||||
type TurnResult,
|
||||
} from "./sessions.js";
|
||||
import type { ParsedChatRequest } from "./validate.js";
|
||||
import { genId, buildChatCompletion, buildChunk, sseData, SSE_DONE, type Usage } from "./shapes.js";
|
||||
import { GatewayError, badRequest, toGatewayError, toErrorBody } from "./errors.js";
|
||||
|
||||
interface DemoSessionMeta {
|
||||
keyId: string;
|
||||
model: string;
|
||||
lastUsedAt: number;
|
||||
}
|
||||
|
||||
/** Open sessions owned by the demo executor (sessionId → meta). Mirrors live
|
||||
* in transcripts.ts; this map scopes affinity to demo-opened sessions. */
|
||||
const demoSessions = new Map<string, DemoSessionMeta>();
|
||||
|
||||
/** Forget a session (closed/settled elsewhere, e.g. by the sweeper). */
|
||||
export function dropDemoSession(sessionId: string): void {
|
||||
demoSessions.delete(sessionId);
|
||||
}
|
||||
|
||||
function candidatesFor(keyId: string, model: string): AffinityCandidate[] {
|
||||
const out: AffinityCandidate[] = [];
|
||||
for (const [sessionId, meta] of demoSessions) {
|
||||
if (meta.keyId !== keyId || meta.model !== model) continue;
|
||||
const mirror = transcripts.get(sessionId);
|
||||
if (!mirror) continue;
|
||||
out.push({ sessionId, model: meta.model, mirror, lastUsedAt: meta.lastUsedAt });
|
||||
}
|
||||
return out;
|
||||
}
|
||||
|
||||
/** Record the session's cost when the demo executor closes its row. Full
|
||||
* mode: the flat session fee (supplier Submitted; the sweeper Accepts the
|
||||
* escrow afterwards). Ticket mode: 0 — nothing settles, the sweeper reclaims
|
||||
* the escrow and the wallet is made whole minus fees. */
|
||||
function recordSessionCost(deps: GatewayDeps, session: SessionRow): void {
|
||||
deps.store.insertUsage({
|
||||
id: randomUUID(),
|
||||
key_id: session.key_id,
|
||||
created_at: Date.now(),
|
||||
kind: "chat_session",
|
||||
model: session.model,
|
||||
capability_id: CAPABILITY,
|
||||
supplier_pkh: session.supplier_pkh,
|
||||
escrow_ref: session.escrow_ref,
|
||||
cost_lovelace: deps.config.chatSettleMode === "ticket" ? "0" : session.price_lovelace,
|
||||
prompt_tokens: 0,
|
||||
completion_tokens: 0,
|
||||
status: "completed",
|
||||
failure_reason: null,
|
||||
});
|
||||
}
|
||||
|
||||
function markSessionGone(deps: GatewayDeps, session: SessionRow): void {
|
||||
deps.store.setSessionState(session.id, "closed", Date.now());
|
||||
dropSessionState(session.id);
|
||||
dropDemoSession(session.id);
|
||||
recordSessionCost(deps, session);
|
||||
}
|
||||
|
||||
/** Ask the supplier to settle (Submit) the session. NO gateway chain work —
|
||||
* the sweeper Accepts the resulting Submitted escrow. The supplier releases
|
||||
* its single slot as part of ending, so a truthy return means the supplier is
|
||||
* free again. Best-effort: on failure the sweeper reclaims later. */
|
||||
async function requestSupplierEnd(deps: GatewayDeps, session: SessionRow): Promise<boolean> {
|
||||
try {
|
||||
const res = await deps.fetchFn(`${session.supplier_base_url.replace(/\/+$/, "")}/v1/chat/end`, {
|
||||
method: "POST",
|
||||
headers: { "content-type": "application/json", "X-Escrow-Ref": session.escrow_ref },
|
||||
body: JSON.stringify({}),
|
||||
signal: AbortSignal.timeout(90_000),
|
||||
});
|
||||
await res.text().catch(() => "");
|
||||
return res.ok;
|
||||
} catch {
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
/** Close one demo session (evicted for capacity, or idle-janitored). Runs
|
||||
* under the session lock so an in-flight turn finishes first; takes NO key
|
||||
* mutex (no chain work here — see requestSupplierEnd). Returns the freed
|
||||
* supplier_pkh, or null when the session was already gone or (janitor) was
|
||||
* used again while we waited for the lock. */
|
||||
async function closeDemoSession(
|
||||
deps: GatewayDeps,
|
||||
sessionId: string,
|
||||
opts: { reason: "evicted" | "idle"; idleCutoffMs?: number; nowMs?: number },
|
||||
): Promise<string | null> {
|
||||
if (!demoSessions.has(sessionId)) return null;
|
||||
return getSessionLock(sessionId).run(async () => {
|
||||
const meta = demoSessions.get(sessionId);
|
||||
if (!meta) return null; // lost a race with another closer
|
||||
// Re-check idleness inside the lock: a turn that won the lock first has
|
||||
// bumped lastUsedAt past the sweep's reference clock.
|
||||
if (opts.idleCutoffMs !== undefined && (opts.nowMs ?? Date.now()) - meta.lastUsedAt < opts.idleCutoffMs) {
|
||||
return null;
|
||||
}
|
||||
const session = deps.store.getSession(sessionId);
|
||||
if (!session || session.state !== "open") {
|
||||
dropDemoSession(sessionId);
|
||||
return null;
|
||||
}
|
||||
await requestSupplierEnd(deps, session);
|
||||
markSessionGone(deps, session);
|
||||
// eslint-disable-next-line no-console
|
||||
console.log(`[gateway:demo] closed session ${sessionId} (${opts.reason}), freed supplier ${session.supplier_pkh}`);
|
||||
return session.supplier_pkh;
|
||||
});
|
||||
}
|
||||
|
||||
/** Least-recently-used open demo session for (key, model), excluding prior
|
||||
* victims. Same-model scoping doubles as a guard: a bogus model name has no
|
||||
* demo sessions, so eviction can never loop on a genuine model_not_found. */
|
||||
function pickLruDemoSession(keyId: string, model: string, exclude: ReadonlySet<string>): string | null {
|
||||
let lruId: string | null = null;
|
||||
let lruAt = Infinity;
|
||||
for (const [sessionId, meta] of demoSessions) {
|
||||
if (meta.keyId !== keyId || meta.model !== model || exclude.has(sessionId)) continue;
|
||||
if (meta.lastUsedAt < lruAt) {
|
||||
lruAt = meta.lastUsedAt;
|
||||
lruId = sessionId;
|
||||
}
|
||||
}
|
||||
return lruId;
|
||||
}
|
||||
|
||||
/** Close demo sessions idle past deps.config.demoSessionIdleMs so abandoned
|
||||
* conversations (client gone, title-gen one-offs) release their single-slot
|
||||
* suppliers. Called from the sweeper tick; sequential to keep supplier
|
||||
* /v1/chat/end calls orderly. */
|
||||
export async function sweepIdleDemoSessions(deps: GatewayDeps, nowMs = Date.now()): Promise<void> {
|
||||
const idleMs = deps.config.demoSessionIdleMs;
|
||||
for (const [sessionId, meta] of [...demoSessions]) {
|
||||
if (nowMs - meta.lastUsedAt < idleMs) continue;
|
||||
try {
|
||||
await closeDemoSession(deps, sessionId, { reason: "idle", idleCutoffMs: idleMs, nowMs });
|
||||
} catch (err) {
|
||||
// eslint-disable-next-line no-console
|
||||
console.error(`[gateway:demo] idle close of ${sessionId} failed:`, err instanceof Error ? err.message : err);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
const MAX_EVICTIONS = 2;
|
||||
|
||||
function isNoSupplierError(err: unknown): boolean {
|
||||
return err instanceof GatewayError && (err.code === "model_not_found" || err.code === "overloaded");
|
||||
}
|
||||
|
||||
/** Open a session, evicting up to MAX_EVICTIONS LRU demo sessions when every
|
||||
* supplier is pinned. Eviction frees the supplier immediately (its slot
|
||||
* releases at Submit) but the indexer's status poll lags, so the retry passes
|
||||
* the freed pkhs through selectCandidates' ignoreStatusFor. Lock ordering is
|
||||
* safe: eviction holds only the session lock, the open holds only the key
|
||||
* mutex — never nested. */
|
||||
async function openSessionWithEviction(
|
||||
deps: GatewayDeps,
|
||||
keyRow: ApiKeyRow,
|
||||
ctx: KeyContext,
|
||||
model: string,
|
||||
): Promise<SessionRow> {
|
||||
const freedPkhs = new Set<string>();
|
||||
const evicted = new Set<string>();
|
||||
for (let attempt = 0; ; attempt++) {
|
||||
try {
|
||||
return await ctx.mutex.run(() =>
|
||||
openSessionCore(deps, keyRow, ctx, model, freedPkhs.size > 0 ? { ignoreStatusFor: freedPkhs } : undefined),
|
||||
);
|
||||
} catch (err) {
|
||||
if (attempt >= MAX_EVICTIONS || !isNoSupplierError(err)) throw err;
|
||||
const victimId = pickLruDemoSession(keyRow.id, model, evicted);
|
||||
if (!victimId) throw err;
|
||||
evicted.add(victimId);
|
||||
const pkh = await closeDemoSession(deps, victimId, { reason: "evicted" });
|
||||
if (!pkh) throw err; // nothing actually freed — don't loop
|
||||
freedPkhs.add(pkh);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
type LockedTurnOutcome =
|
||||
| { kind: "done"; result: TurnResult }
|
||||
| { kind: "retry" } // candidate no longer valid — re-run the match
|
||||
| { kind: "gone" }; // supplier lost the session — open a fresh one
|
||||
|
||||
/** Streaming sink shared across turn attempts on one response. */
|
||||
interface StreamSink {
|
||||
onToken: (token: string) => void;
|
||||
emitToolCalls: (toolCalls: ToolCall[]) => void;
|
||||
}
|
||||
|
||||
export async function runDemoChat(
|
||||
deps: GatewayDeps,
|
||||
keyRow: ApiKeyRow,
|
||||
ctx: KeyContext,
|
||||
parsed: ParsedChatRequest,
|
||||
res: Response,
|
||||
): Promise<void> {
|
||||
// Clients sometimes send histories ending in an assistant (continue/retry
|
||||
// flows) or system message; the chat.v1 supplier can only respond to a
|
||||
// user/tool-terminated turn. Trim trailing unrespondable messages
|
||||
// (regenerate semantics) and reject — before any chain work — only when
|
||||
// nothing respondable remains.
|
||||
const trimmed = trimToRespondable(parsed.messages);
|
||||
if (trimmed.length === 0) {
|
||||
throw badRequest("invalid_messages", "no user or tool message to respond to");
|
||||
}
|
||||
const effective: ParsedChatRequest =
|
||||
trimmed.length === parsed.messages.length ? parsed : { ...parsed, messages: trimmed };
|
||||
|
||||
const id = genId();
|
||||
let keepalive: ReturnType<typeof setInterval> | undefined;
|
||||
let roleSent = false;
|
||||
if (parsed.stream) {
|
||||
res.status(200);
|
||||
res.setHeader("Content-Type", "text/event-stream");
|
||||
res.setHeader("Cache-Control", "no-cache, no-transform");
|
||||
res.setHeader("Connection", "keep-alive");
|
||||
res.setHeader("X-Accel-Buffering", "no");
|
||||
res.write(": connected\n\n");
|
||||
keepalive = setInterval(() => {
|
||||
try {
|
||||
res.write(": keepalive\n\n");
|
||||
} catch {
|
||||
/* client gone */
|
||||
}
|
||||
}, 10_000);
|
||||
}
|
||||
|
||||
const ensureRole = (): void => {
|
||||
if (roleSent) return;
|
||||
roleSent = true;
|
||||
res.write(sseData(buildChunk({ id, model: parsed.model, delta: { role: "assistant" }, finishReason: null })));
|
||||
};
|
||||
const sink: StreamSink = {
|
||||
onToken: (token) => {
|
||||
if (!parsed.stream) return;
|
||||
ensureRole();
|
||||
res.write(sseData(buildChunk({ id, model: parsed.model, delta: { content: token }, finishReason: null })));
|
||||
},
|
||||
emitToolCalls: (toolCalls) => {
|
||||
if (!parsed.stream) return;
|
||||
ensureRole();
|
||||
res.write(
|
||||
sseData(
|
||||
buildChunk({
|
||||
id,
|
||||
model: parsed.model,
|
||||
delta: { tool_calls: toolCalls.map((tc, index) => ({ index, ...tc })) },
|
||||
finishReason: null,
|
||||
}),
|
||||
),
|
||||
);
|
||||
},
|
||||
};
|
||||
|
||||
try {
|
||||
const result = await runWithAffinity(deps, keyRow, ctx, effective, sink);
|
||||
if (keepalive) clearInterval(keepalive);
|
||||
|
||||
const usage: Usage = {
|
||||
prompt_tokens: result.usage.prompt_tokens,
|
||||
completion_tokens: result.usage.completion_tokens,
|
||||
total_tokens: result.usage.prompt_tokens + result.usage.completion_tokens,
|
||||
};
|
||||
if (parsed.stream) {
|
||||
if (result.assistantMessage.tool_calls?.length) sink.emitToolCalls(result.assistantMessage.tool_calls);
|
||||
ensureRole();
|
||||
res.write(sseData(buildChunk({ id, model: parsed.model, delta: {}, finishReason: result.finishReason, usage })));
|
||||
res.write(SSE_DONE);
|
||||
res.end();
|
||||
} else {
|
||||
res.status(200).json(
|
||||
buildChatCompletion({
|
||||
id,
|
||||
model: parsed.model,
|
||||
content: result.assistantMessage.content,
|
||||
toolCalls: result.assistantMessage.tool_calls,
|
||||
finishReason: result.finishReason,
|
||||
usage,
|
||||
}),
|
||||
);
|
||||
}
|
||||
} catch (err) {
|
||||
if (keepalive) clearInterval(keepalive);
|
||||
if (parsed.stream && res.headersSent) {
|
||||
try {
|
||||
res.write(sseData(toErrorBody(toGatewayError(err))));
|
||||
} catch {
|
||||
/* client gone */
|
||||
}
|
||||
res.end();
|
||||
return;
|
||||
}
|
||||
throw err;
|
||||
}
|
||||
}
|
||||
|
||||
async function runWithAffinity(
|
||||
deps: GatewayDeps,
|
||||
keyRow: ApiKeyRow,
|
||||
ctx: KeyContext,
|
||||
parsed: ParsedChatRequest,
|
||||
sink: StreamSink,
|
||||
): Promise<TurnResult> {
|
||||
// Affinity: try matching sessions until one serves the turn. The match runs
|
||||
// synchronously (no await between match and lock acquire, so the candidate
|
||||
// set can't shift underneath us); the prefix is re-checked inside the lock
|
||||
// because a concurrent request may have advanced the session first.
|
||||
for (let attempt = 0; attempt < 3; attempt++) {
|
||||
const match = matchSessionPrefix(candidatesFor(keyRow.id, parsed.model), parsed.messages, parsed.model);
|
||||
if (!match) break;
|
||||
|
||||
const outcome: LockedTurnOutcome = await getSessionLock(match.sessionId).run(async () => {
|
||||
const meta = demoSessions.get(match.sessionId);
|
||||
const mirror = transcripts.get(match.sessionId);
|
||||
const session = deps.store.getSession(match.sessionId);
|
||||
if (!meta || !mirror || !session || session.state !== "open") {
|
||||
dropDemoSession(match.sessionId);
|
||||
return { kind: "retry" };
|
||||
}
|
||||
const recheck = matchSessionPrefix(
|
||||
[{ sessionId: session.id, model: meta.model, mirror, lastUsedAt: meta.lastUsedAt }],
|
||||
parsed.messages,
|
||||
parsed.model,
|
||||
);
|
||||
if (!recheck) return { kind: "retry" };
|
||||
|
||||
try {
|
||||
const result = await streamSupplierTurn(
|
||||
deps,
|
||||
session,
|
||||
{ messages: recheck.delta, tools: parsed.tools, tool_choice: parsed.toolChoice },
|
||||
sink.onToken,
|
||||
);
|
||||
meta.lastUsedAt = Date.now();
|
||||
return { kind: "done", result };
|
||||
} catch (err) {
|
||||
if (err instanceof SessionGoneError) {
|
||||
// Supplier idle-closed (or restarted). Close our row, record the
|
||||
// fee (the escrow settles via the sweeper) and reopen fresh.
|
||||
markSessionGone(deps, session);
|
||||
return { kind: "gone" };
|
||||
}
|
||||
throw err;
|
||||
}
|
||||
});
|
||||
|
||||
if (outcome.kind === "done") return outcome.result;
|
||||
if (outcome.kind === "gone") break;
|
||||
// retry: candidate vanished/advanced — re-match against current state.
|
||||
}
|
||||
|
||||
// Miss: open a new session (chain work → key mutex; evicts an LRU demo
|
||||
// session when every supplier is pinned) and replay the full history as its
|
||||
// first turn.
|
||||
const session = await openSessionWithEviction(deps, keyRow, ctx, parsed.model);
|
||||
demoSessions.set(session.id, { keyId: keyRow.id, model: parsed.model, lastUsedAt: Date.now() });
|
||||
return getSessionLock(session.id).run(async () => {
|
||||
try {
|
||||
const result = await streamSupplierTurn(
|
||||
deps,
|
||||
session,
|
||||
{ messages: parsed.messages, tools: parsed.tools, tool_choice: parsed.toolChoice },
|
||||
sink.onToken,
|
||||
);
|
||||
// Refresh recency after the (possibly long) first stream so this live
|
||||
// thread isn't the LRU/janitor's first victim.
|
||||
const meta = demoSessions.get(session.id);
|
||||
if (meta) meta.lastUsedAt = Date.now();
|
||||
return result;
|
||||
} catch (err) {
|
||||
if (err instanceof SessionGoneError) {
|
||||
// Freshly opened yet already gone (supplier crashed mid-claim).
|
||||
// Surface as an upstream error rather than looping.
|
||||
markSessionGone(deps, session);
|
||||
}
|
||||
throw err;
|
||||
}
|
||||
});
|
||||
}
|
||||
@@ -36,8 +36,6 @@ export const unauthorized = (message = "invalid API key"): GatewayError =>
|
||||
new GatewayError(401, "authentication_error", "invalid_api_key", message);
|
||||
export const paymentRequired = (message: string, extra?: Record<string, unknown>): GatewayError =>
|
||||
new GatewayError(402, "invalid_request_error", "insufficient_funds", message, extra);
|
||||
export const forbidden = (code: string, message: string): GatewayError =>
|
||||
new GatewayError(403, "invalid_request_error", code, message);
|
||||
export const notFound = (code: string, message: string): GatewayError =>
|
||||
new GatewayError(404, "invalid_request_error", code, message);
|
||||
export const rateLimited = (message: string): GatewayError =>
|
||||
@@ -71,22 +69,6 @@ export function toGatewayError(err: unknown): GatewayError {
|
||||
return new GatewayError(502, "server_error", "indexer_error", `indexer error: ${err.reason}`);
|
||||
}
|
||||
if (err instanceof TxConstructionError) {
|
||||
if (err.reason === "input_cap_exceeded") {
|
||||
return new GatewayError(
|
||||
400,
|
||||
"invalid_request_error",
|
||||
"input_cap_exceeded",
|
||||
err.message,
|
||||
);
|
||||
}
|
||||
if (err.reason === "supplier_preflight_failed") {
|
||||
return new GatewayError(
|
||||
503,
|
||||
"server_error",
|
||||
"supplier_preflight_failed",
|
||||
err.message,
|
||||
);
|
||||
}
|
||||
return new GatewayError(502, "server_error", "escrow_failed", `escrow build failed: ${err.reason}`);
|
||||
}
|
||||
const message = err instanceof Error ? err.message : String(err);
|
||||
|
||||
@@ -7,20 +7,12 @@
|
||||
import type { Request, Response } from "express";
|
||||
import type { GatewayDeps } from "../deps.js";
|
||||
import { asyncHandler } from "../middleware/http.js";
|
||||
import { requireKey } from "../middleware/apiKeyAuth.js";
|
||||
import { listModels } from "../routing/selectSupplier.js";
|
||||
import { buildModelsList } from "./shapes.js";
|
||||
import { CAPABILITY as CHAT_CAPABILITY } from "./sessions.js";
|
||||
|
||||
export function makeModelsHandler(deps: GatewayDeps) {
|
||||
return asyncHandler(async (req: Request, res: Response) => {
|
||||
const keyRow = requireKey(req);
|
||||
// Demo keys only reach chat-capable suppliers (session-backed executor).
|
||||
const models = await listModels({
|
||||
indexerUrl: deps.config.indexerUrl,
|
||||
capabilityId: keyRow.demo ? CHAT_CAPABILITY : undefined,
|
||||
fetchFn: deps.fetchFn,
|
||||
});
|
||||
return asyncHandler(async (_req: Request, res: Response) => {
|
||||
const models = await listModels({ indexerUrl: deps.config.indexerUrl, fetchFn: deps.fetchFn });
|
||||
res.status(200).json(buildModelsList(models));
|
||||
});
|
||||
}
|
||||
|
||||
@@ -15,9 +15,8 @@
|
||||
|
||||
import { randomUUID } from "crypto";
|
||||
import type { Request, Response } from "express";
|
||||
import { TxConstructionError, normalizeChatMessage, type ChatMessage } from "@marketplace/shared/tx";
|
||||
import { TxConstructionError, type ChatMessage } from "@marketplace/shared/tx";
|
||||
import { SupplierError } from "@marketplace/buyer/sdk";
|
||||
import { transcripts, getSessionLock, dropSessionState } from "./transcripts.js";
|
||||
import type { GatewayDeps } from "../deps.js";
|
||||
import type { ApiKeyRow, GatewayStore, SessionRow } from "../db/store.js";
|
||||
import type { KeyContext } from "../sdk/registry.js";
|
||||
@@ -37,15 +36,10 @@ import {
|
||||
type Usage,
|
||||
} from "./shapes.js";
|
||||
|
||||
export const CAPABILITY = "llm.chat.v1";
|
||||
const CAPABILITY = "llm.chat.v1";
|
||||
|
||||
/** Thrown when the supplier no longer knows the session (idle-closed/restart). */
|
||||
export class SessionGoneError extends Error {
|
||||
constructor(sessionId: string) {
|
||||
super(`supplier no longer has session ${sessionId}`);
|
||||
this.name = "SessionGoneError";
|
||||
}
|
||||
}
|
||||
/** In-memory per-session transcript mirror (sessionId → messages). */
|
||||
const transcripts = new Map<string, ChatMessage[]>();
|
||||
|
||||
function refStr(ref: { txHash: string; index: number }): string {
|
||||
return `${ref.txHash}#${ref.index}`;
|
||||
@@ -62,29 +56,22 @@ export function makeOpenSessionHandler(deps: GatewayDeps) {
|
||||
throw badRequest("invalid_model", "`model` is required");
|
||||
}
|
||||
const ctx = deps.registry.getContext(keyRow);
|
||||
const session = await ctx.mutex.run(() => openSessionCore(deps, keyRow, ctx, model));
|
||||
res.status(200).json({ id: session.id, object: "chat.session", model, created: nowSec() });
|
||||
await ctx.mutex.run(() => openSession(deps, keyRow, ctx, model, res));
|
||||
});
|
||||
}
|
||||
|
||||
/**
|
||||
* Select a supplier, preflight the wallet, post+claim the session escrow and
|
||||
* persist the SessionRow. Chain work — the CALLER must hold the key mutex
|
||||
* (concurrent PostEscrow from one wallet double-spends the same UTxO).
|
||||
*/
|
||||
export async function openSessionCore(
|
||||
async function openSession(
|
||||
deps: GatewayDeps,
|
||||
keyRow: ApiKeyRow,
|
||||
ctx: KeyContext,
|
||||
model: string,
|
||||
opts?: { ignoreStatusFor?: ReadonlySet<string> },
|
||||
): Promise<SessionRow> {
|
||||
res: Response,
|
||||
): Promise<void> {
|
||||
const candidates = await selectCandidates({
|
||||
indexerUrl: deps.config.indexerUrl,
|
||||
model,
|
||||
capabilityId: CAPABILITY,
|
||||
fetchFn: deps.fetchFn,
|
||||
ignoreStatusFor: opts?.ignoreStatusFor,
|
||||
});
|
||||
if (candidates.length === 0) {
|
||||
throw notFound("model_not_found", `no available chat (llm.chat.v1) supplier for model "${model}"`);
|
||||
@@ -93,7 +80,7 @@ export async function openSessionCore(
|
||||
const pf = await preflight(deps.chain, ctx.walletKey.address, primary);
|
||||
if (!pf.ok) {
|
||||
throw paymentRequired(
|
||||
pf.collateralOk ? "insufficient balance to open a session" : "wallet has no ≥5 AP3X pure-AP3X collateral UTxO",
|
||||
pf.collateralOk ? "insufficient balance to open a session" : "wallet has no ≥5 ADA pure-ADA collateral UTxO",
|
||||
{
|
||||
x_vector: {
|
||||
required_lovelace: pf.requiredLovelace.toString(),
|
||||
@@ -125,16 +112,6 @@ export async function openSessionCore(
|
||||
}
|
||||
if (!started || !used) throw toGatewayError(lastErr ?? new Error("no chat supplier could be engaged"));
|
||||
|
||||
// Deployment sanity: supplier and gateway must agree on the settle mode.
|
||||
// Close behavior is driven per-session by the supplier's /end response, so
|
||||
// a mismatch (rollout window) still settles correctly — just warn.
|
||||
if ((started.settleMode === "ticket") !== (deps.config.chatSettleMode === "ticket")) {
|
||||
// eslint-disable-next-line no-console
|
||||
console.warn(
|
||||
`[gateway] settle-mode mismatch: supplier ${used.supplierPkh.slice(0, 8)} ran "${started.settleMode}" but gateway is configured "${deps.config.chatSettleMode}"`,
|
||||
);
|
||||
}
|
||||
|
||||
const sessionId = randomUUID();
|
||||
deps.store.insertSession({
|
||||
id: sessionId,
|
||||
@@ -150,9 +127,7 @@ export async function openSessionCore(
|
||||
});
|
||||
transcripts.set(sessionId, []);
|
||||
|
||||
const session = deps.store.getSession(sessionId);
|
||||
if (!session) throw new Error(`session ${sessionId} vanished after insert`);
|
||||
return session;
|
||||
res.status(200).json({ id: sessionId, object: "chat.session", model, created: nowSec() });
|
||||
}
|
||||
|
||||
// ─── messages (one streamed turn) ────────────────────────────────────────────
|
||||
@@ -169,12 +144,8 @@ export function makeSessionMessageHandler(deps: GatewayDeps) {
|
||||
const content = resolveTurnContent(session.id, body);
|
||||
if (content === "") throw badRequest("content_required", "no user content in this turn");
|
||||
|
||||
// Turns are chain-free (one HTTP POST to the supplier + SSE relay), so the
|
||||
// per-key mutex — which exists to serialize wallet UTxO spends — is NOT
|
||||
// held here. What needs serialization is this session's transcript:
|
||||
// concurrent turns would interleave supplier appends and corrupt both the
|
||||
// mirror and the receipt hash. Hence a per-session lock.
|
||||
await getSessionLock(session.id).run(() => streamTurn(deps, session, content, stream, res));
|
||||
const ctx = deps.registry.getContext(keyRow);
|
||||
await ctx.mutex.run(() => streamTurn(deps, session, content, stream, res));
|
||||
});
|
||||
}
|
||||
|
||||
@@ -205,88 +176,6 @@ function foldSystem(sessionId: string, content: string, body: Record<string, unk
|
||||
return content;
|
||||
}
|
||||
|
||||
/** One turn's payload to the supplier: legacy single user string, or a
|
||||
* multi-message delta (e.g. tool results) with optional tools passthrough. */
|
||||
export type TurnPayload =
|
||||
| { content: string }
|
||||
| { messages: ChatMessage[]; tools?: unknown[]; tool_choice?: unknown };
|
||||
|
||||
export interface TurnResult {
|
||||
assistantMessage: ChatMessage;
|
||||
finishReason: "stop" | "tool_calls";
|
||||
usage: { prompt_tokens: number; completion_tokens: number };
|
||||
}
|
||||
|
||||
/**
|
||||
* Drive one off-chain turn against the session's supplier and mirror the
|
||||
* result into the session transcript. Caller must hold the session lock.
|
||||
* Throws SessionGoneError when the supplier no longer knows the session
|
||||
* (idle-closed or restarted) so callers can transparently reopen.
|
||||
*/
|
||||
export async function streamSupplierTurn(
|
||||
deps: GatewayDeps,
|
||||
session: SessionRow,
|
||||
payload: TurnPayload,
|
||||
onToken?: (token: string) => void,
|
||||
): Promise<TurnResult> {
|
||||
const upstream = await deps.fetchFn(`${session.supplier_base_url.replace(/\/+$/, "")}/v1/chat/message`, {
|
||||
method: "POST",
|
||||
headers: { "content-type": "application/json", accept: "text/event-stream", "X-Escrow-Ref": session.escrow_ref },
|
||||
body: JSON.stringify(payload),
|
||||
});
|
||||
if (upstream.status === 404) {
|
||||
await upstream.text().catch(() => "");
|
||||
throw new SessionGoneError(session.id);
|
||||
}
|
||||
if (!upstream.ok || !upstream.body) {
|
||||
const detail = await upstream.text().catch(() => "");
|
||||
throw toGatewayError(new SupplierError("supplier_http_error", { status: upstream.status, message: detail.slice(0, 200) }));
|
||||
}
|
||||
|
||||
let assistant = "";
|
||||
let errored: string | undefined;
|
||||
let doneMessage: ChatMessage | null = null;
|
||||
let doneFinish: string | undefined;
|
||||
let usage = { prompt_tokens: 0, completion_tokens: 0 };
|
||||
await readSupplierSse(upstream.body as ReadableStream<Uint8Array>, (frame) => {
|
||||
if (frame.type === "token" && typeof frame.value === "string") {
|
||||
assistant += frame.value;
|
||||
onToken?.(frame.value);
|
||||
} else if (frame.type === "done") {
|
||||
// Upgraded suppliers echo the final assistant message verbatim; mirror
|
||||
// that exact object so both transcripts stay hash-identical.
|
||||
doneMessage = normalizeChatMessage(frame.message);
|
||||
if (typeof frame.finish_reason === "string") doneFinish = frame.finish_reason;
|
||||
if (frame.usage && typeof frame.usage === "object") {
|
||||
const u = frame.usage as Record<string, unknown>;
|
||||
usage = {
|
||||
prompt_tokens: typeof u.prompt_tokens === "number" ? u.prompt_tokens : 0,
|
||||
completion_tokens: typeof u.completion_tokens === "number" ? u.completion_tokens : 0,
|
||||
};
|
||||
}
|
||||
} else if (frame.type === "error") {
|
||||
errored = typeof frame.message === "string" ? frame.message : "supplier stream error";
|
||||
}
|
||||
});
|
||||
|
||||
if (errored !== undefined) {
|
||||
throw toGatewayError(new SupplierError("upstream_error", { message: errored }));
|
||||
}
|
||||
|
||||
const assistantMessage: ChatMessage = doneMessage ?? { role: "assistant", content: assistant };
|
||||
const finishReason: TurnResult["finishReason"] =
|
||||
doneFinish === "tool_calls" || (assistantMessage.tool_calls?.length ?? 0) > 0 ? "tool_calls" : "stop";
|
||||
|
||||
// Mirror the turn for endChat's response_hash verification / affinity matching.
|
||||
const mirror = transcripts.get(session.id) ?? [];
|
||||
if ("content" in payload) mirror.push({ role: "user", content: payload.content });
|
||||
else mirror.push(...payload.messages);
|
||||
mirror.push(assistantMessage);
|
||||
transcripts.set(session.id, mirror);
|
||||
|
||||
return { assistantMessage, finishReason, usage };
|
||||
}
|
||||
|
||||
async function streamTurn(
|
||||
deps: GatewayDeps,
|
||||
session: SessionRow,
|
||||
@@ -295,6 +184,15 @@ async function streamTurn(
|
||||
res: Response,
|
||||
): Promise<void> {
|
||||
const id = genId();
|
||||
const upstream = await deps.fetchFn(`${session.supplier_base_url.replace(/\/+$/, "")}/v1/chat/message`, {
|
||||
method: "POST",
|
||||
headers: { "content-type": "application/json", accept: "text/event-stream", "X-Escrow-Ref": session.escrow_ref },
|
||||
body: JSON.stringify({ content }),
|
||||
});
|
||||
if (!upstream.ok || !upstream.body) {
|
||||
const detail = await upstream.text().catch(() => "");
|
||||
throw toGatewayError(new SupplierError("supplier_http_error", { status: upstream.status, message: detail.slice(0, 200) }));
|
||||
}
|
||||
|
||||
if (stream) {
|
||||
res.status(200);
|
||||
@@ -305,43 +203,46 @@ async function streamTurn(
|
||||
res.write(sseData(buildChunk({ id, model: session.model, delta: { role: "assistant" }, finishReason: null })));
|
||||
}
|
||||
|
||||
let result: TurnResult;
|
||||
try {
|
||||
result = await streamSupplierTurn(deps, session, { content }, (token) => {
|
||||
if (stream) res.write(sseData(buildChunk({ id, model: session.model, delta: { content: token }, finishReason: null })));
|
||||
});
|
||||
} catch (err) {
|
||||
if (err instanceof SessionGoneError) {
|
||||
err = toGatewayError(new SupplierError("supplier_http_error", { status: 404, message: err.message }));
|
||||
let assistant = "";
|
||||
let errored: string | undefined;
|
||||
await readSupplierSse(upstream.body as ReadableStream<Uint8Array>, (frame) => {
|
||||
if (frame.type === "token" && typeof frame.value === "string") {
|
||||
assistant += frame.value;
|
||||
if (stream) res.write(sseData(buildChunk({ id, model: session.model, delta: { content: frame.value }, finishReason: null })));
|
||||
} else if (frame.type === "error") {
|
||||
errored = typeof frame.message === "string" ? frame.message : "supplier stream error";
|
||||
}
|
||||
});
|
||||
|
||||
if (errored !== undefined) {
|
||||
if (stream) {
|
||||
res.write(sseData(toErrorBody(toGatewayError(err))));
|
||||
res.write(sseData(toErrorBody(toGatewayError(new SupplierError("upstream_error", { message: errored })))));
|
||||
res.end();
|
||||
return;
|
||||
}
|
||||
throw toGatewayError(err);
|
||||
throw toGatewayError(new SupplierError("upstream_error", { message: errored }));
|
||||
}
|
||||
|
||||
// Mirror the transcript for endChat's response_hash verification.
|
||||
const mirror = transcripts.get(session.id) ?? [];
|
||||
mirror.push({ role: "user", content });
|
||||
mirror.push({ role: "assistant", content: assistant });
|
||||
transcripts.set(session.id, mirror);
|
||||
|
||||
if (stream) {
|
||||
res.write(sseData(buildChunk({ id, model: session.model, delta: {}, finishReason: result.finishReason })));
|
||||
res.write(sseData(buildChunk({ id, model: session.model, delta: {}, finishReason: "stop" })));
|
||||
res.write(SSE_DONE);
|
||||
res.end();
|
||||
} else {
|
||||
const usage: Usage = {
|
||||
prompt_tokens: result.usage.prompt_tokens,
|
||||
completion_tokens: result.usage.completion_tokens,
|
||||
total_tokens: result.usage.prompt_tokens + result.usage.completion_tokens,
|
||||
};
|
||||
res.status(200).json(buildChatCompletion({ id, model: session.model, content: result.assistantMessage.content, usage }));
|
||||
const usage: Usage = { prompt_tokens: 0, completion_tokens: 0, total_tokens: 0 };
|
||||
res.status(200).json(buildChatCompletion({ id, model: session.model, content: assistant, usage }));
|
||||
}
|
||||
}
|
||||
|
||||
interface SupplierFrame {
|
||||
type?: string;
|
||||
value?: string;
|
||||
message?: unknown;
|
||||
finish_reason?: unknown;
|
||||
usage?: unknown;
|
||||
message?: string;
|
||||
}
|
||||
|
||||
/** Read a supplier SSE stream of {type:token|done|error} frames. */
|
||||
@@ -407,34 +308,7 @@ async function closeSession(
|
||||
});
|
||||
|
||||
deps.store.setSessionState(session.id, "closed", Date.now());
|
||||
dropSessionState(session.id);
|
||||
|
||||
if (result.settleMode === "ticket") {
|
||||
// Nothing was Submitted/Accepted: no receipt, no charge (the escrow
|
||||
// returns via the sweeper's reclaim), and no wallet churn to tidy up.
|
||||
deps.store.insertUsage({
|
||||
id: randomUUID(),
|
||||
key_id: keyRow.id,
|
||||
created_at: Date.now(),
|
||||
kind: "chat_session",
|
||||
model: session.model,
|
||||
capability_id: CAPABILITY,
|
||||
supplier_pkh: session.supplier_pkh,
|
||||
escrow_ref: session.escrow_ref,
|
||||
cost_lovelace: "0",
|
||||
prompt_tokens: 0,
|
||||
completion_tokens: 0,
|
||||
status: "completed",
|
||||
failure_reason: null,
|
||||
});
|
||||
res.status(200).json({
|
||||
status: "ended",
|
||||
escrow_ref: session.escrow_ref,
|
||||
settle_mode: "ticket",
|
||||
model: session.model,
|
||||
});
|
||||
return;
|
||||
}
|
||||
transcripts.delete(session.id);
|
||||
|
||||
const prompt = result.receipt.prompt_tokens ?? 0;
|
||||
const completion = result.receipt.completion_tokens ?? 0;
|
||||
|
||||
@@ -7,7 +7,6 @@
|
||||
|
||||
import { randomBytes } from "crypto";
|
||||
import type { Receipt } from "@marketplace/shared/receipt";
|
||||
import type { ToolCall } from "@marketplace/shared/tx";
|
||||
|
||||
export function genId(): string {
|
||||
return `chatcmpl-${randomBytes(16).toString("hex")}`;
|
||||
@@ -41,8 +40,6 @@ export function buildChatCompletion(args: {
|
||||
model: string;
|
||||
content: string;
|
||||
usage: Usage;
|
||||
toolCalls?: ToolCall[];
|
||||
finishReason?: "stop" | "tool_calls";
|
||||
vector?: VectorReceipt;
|
||||
}): Record<string, unknown> {
|
||||
return {
|
||||
@@ -53,12 +50,8 @@ export function buildChatCompletion(args: {
|
||||
choices: [
|
||||
{
|
||||
index: 0,
|
||||
message: {
|
||||
role: "assistant",
|
||||
content: args.content,
|
||||
...(args.toolCalls?.length ? { tool_calls: args.toolCalls } : {}),
|
||||
},
|
||||
finish_reason: args.finishReason ?? "stop",
|
||||
message: { role: "assistant", content: args.content },
|
||||
finish_reason: "stop",
|
||||
},
|
||||
],
|
||||
usage: args.usage,
|
||||
@@ -70,10 +63,8 @@ export function buildChatCompletion(args: {
|
||||
export function buildChunk(args: {
|
||||
id: string;
|
||||
model: string;
|
||||
delta:
|
||||
| { role?: string; content?: string; tool_calls?: Array<{ index: number } & ToolCall> }
|
||||
| Record<string, never>;
|
||||
finishReason: "stop" | "tool_calls" | null;
|
||||
delta: { role?: string; content?: string } | Record<string, never>;
|
||||
finishReason: "stop" | null;
|
||||
usage?: Usage;
|
||||
vector?: VectorReceipt;
|
||||
}): Record<string, unknown> {
|
||||
|
||||
@@ -1,35 +0,0 @@
|
||||
/**
|
||||
* gateway/src/openai/transcripts.ts — in-memory per-session state shared by
|
||||
* the session routes (sessions.ts), the demo affinity executor (demoChat.ts)
|
||||
* and the sweeper's housekeeping.
|
||||
*
|
||||
* transcripts: mirror of each open session's transcript (sessionId → messages).
|
||||
* Kept hash-identical to the supplier's authoritative transcript (endChat's
|
||||
* response_hash check). Lost on restart — abandoned sessions are recovered
|
||||
* by the supplier idle watchdog + gateway sweeper.
|
||||
* sessionLocks: per-session Mutex serializing turns on ONE session (concurrent
|
||||
* turns would interleave supplier transcript appends). Distinct from the
|
||||
* per-key Mutex, which only serializes on-chain wallet work.
|
||||
*/
|
||||
|
||||
import type { ChatMessage } from "@marketplace/shared/tx";
|
||||
import { Mutex } from "../sdk/registry.js";
|
||||
|
||||
export const transcripts = new Map<string, ChatMessage[]>();
|
||||
|
||||
const sessionLocks = new Map<string, Mutex>();
|
||||
|
||||
export function getSessionLock(sessionId: string): Mutex {
|
||||
let lock = sessionLocks.get(sessionId);
|
||||
if (!lock) {
|
||||
lock = new Mutex();
|
||||
sessionLocks.set(sessionId, lock);
|
||||
}
|
||||
return lock;
|
||||
}
|
||||
|
||||
/** Forget all in-memory state for a session (closed/gone). */
|
||||
export function dropSessionState(sessionId: string): void {
|
||||
transcripts.delete(sessionId);
|
||||
sessionLocks.delete(sessionId);
|
||||
}
|
||||
@@ -2,7 +2,7 @@
|
||||
* gateway/src/openai/validate.ts — request body validation for chat endpoints.
|
||||
*/
|
||||
|
||||
import { normalizeChatMessage, type ChatMessage } from "@marketplace/shared/tx";
|
||||
import type { ChatMessage } from "@marketplace/shared/tx";
|
||||
import { badRequest } from "./errors.js";
|
||||
|
||||
export interface ParsedChatRequest {
|
||||
@@ -10,32 +10,21 @@ export interface ParsedChatRequest {
|
||||
messages: ChatMessage[];
|
||||
maxTokens?: number;
|
||||
stream: boolean;
|
||||
tools?: unknown[];
|
||||
toolChoice?: unknown;
|
||||
publicPreview: boolean;
|
||||
supplierPkh?: string;
|
||||
}
|
||||
|
||||
const ROLES = new Set(["system", "user", "assistant"]);
|
||||
|
||||
/** Validate an OpenAI chat.completions-style body. Default path rejects
|
||||
* tools/functions; `allowTools` (demo keys) accepts tools/tool_choice, the
|
||||
* `tool` role, null content and assistant tool_calls, normalizing every
|
||||
* message into canonical mirror shape. Silently ignores temperature/n/stop/
|
||||
* top_p/etc (documented). */
|
||||
export function parseChatRequest(body: unknown, opts?: { allowTools?: boolean }): ParsedChatRequest {
|
||||
const allowTools = opts?.allowTools === true;
|
||||
/** Validate an OpenAI chat.completions-style body. Rejects tools/functions;
|
||||
* silently ignores temperature/n/stop/top_p/etc (documented). */
|
||||
export function parseChatRequest(body: unknown): ParsedChatRequest {
|
||||
if (typeof body !== "object" || body === null) {
|
||||
throw badRequest("invalid_body", "request body must be a JSON object");
|
||||
}
|
||||
const b = body as Record<string, unknown>;
|
||||
|
||||
if (!allowTools && ("tools" in b || "tool_choice" in b || "functions" in b || "function_call" in b)) {
|
||||
if ("tools" in b || "tool_choice" in b || "functions" in b || "function_call" in b) {
|
||||
throw badRequest("unsupported_parameter", "tools and function-calling are not supported by this gateway");
|
||||
}
|
||||
if (allowTools && ("functions" in b || "function_call" in b)) {
|
||||
throw badRequest("unsupported_parameter", "legacy functions/function_call are not supported; use tools");
|
||||
}
|
||||
|
||||
const model = b.model;
|
||||
if (typeof model !== "string" || model === "") {
|
||||
@@ -48,14 +37,6 @@ export function parseChatRequest(body: unknown, opts?: { allowTools?: boolean })
|
||||
}
|
||||
const messages: ChatMessage[] = [];
|
||||
for (const m of rawMessages) {
|
||||
if (allowTools) {
|
||||
const msg = normalizeChatMessage(m);
|
||||
if (!msg) {
|
||||
throw badRequest("invalid_messages", "each message must be OpenAI-shaped {role, content, tool_calls?, tool_call_id?}");
|
||||
}
|
||||
messages.push(msg);
|
||||
continue;
|
||||
}
|
||||
if (
|
||||
typeof m !== "object" ||
|
||||
m === null ||
|
||||
@@ -69,13 +50,6 @@ export function parseChatRequest(body: unknown, opts?: { allowTools?: boolean })
|
||||
messages.push({ role: mm.role, content: mm.content });
|
||||
}
|
||||
|
||||
let tools: unknown[] | undefined;
|
||||
let toolChoice: unknown;
|
||||
if (allowTools && Array.isArray(b.tools) && b.tools.length > 0) {
|
||||
tools = b.tools;
|
||||
toolChoice = b.tool_choice;
|
||||
}
|
||||
|
||||
let maxTokens: number | undefined;
|
||||
const mt = b.max_tokens ?? b.max_completion_tokens;
|
||||
if (mt !== undefined && mt !== null) {
|
||||
@@ -85,46 +59,6 @@ export function parseChatRequest(body: unknown, opts?: { allowTools?: boolean })
|
||||
maxTokens = mt;
|
||||
}
|
||||
|
||||
if (b.public_preview !== undefined && typeof b.public_preview !== "boolean") {
|
||||
throw badRequest(
|
||||
"invalid_public_preview",
|
||||
"`public_preview` must be a boolean when provided",
|
||||
);
|
||||
}
|
||||
const publicPreview = b.public_preview === true;
|
||||
|
||||
let supplierPkh: string | undefined;
|
||||
if (b.x_vector !== undefined) {
|
||||
if (
|
||||
typeof b.x_vector !== "object" ||
|
||||
b.x_vector === null ||
|
||||
Array.isArray(b.x_vector)
|
||||
) {
|
||||
throw badRequest("invalid_x_vector", "`x_vector` must be an object");
|
||||
}
|
||||
const requested = (b.x_vector as Record<string, unknown>).supplier_pkh;
|
||||
if (
|
||||
requested !== undefined &&
|
||||
(typeof requested !== "string" || !/^[0-9a-fA-F]{56}$/.test(requested))
|
||||
) {
|
||||
throw badRequest(
|
||||
"invalid_supplier_pkh",
|
||||
"`x_vector.supplier_pkh` must be a 28-byte hex payment-key hash",
|
||||
);
|
||||
}
|
||||
if (typeof requested === "string") supplierPkh = requested.toLowerCase();
|
||||
}
|
||||
|
||||
|
||||
const stream = b.stream === true;
|
||||
return {
|
||||
model,
|
||||
messages,
|
||||
maxTokens,
|
||||
stream,
|
||||
tools,
|
||||
toolChoice,
|
||||
publicPreview,
|
||||
supplierPkh,
|
||||
};
|
||||
return { model, messages, maxTokens, stream };
|
||||
}
|
||||
|
||||
@@ -53,21 +53,9 @@ export function parseRef(ref: string): OutputReference | null {
|
||||
|
||||
export interface SelectSupplierOpts {
|
||||
indexerUrl: string;
|
||||
/** Exact model match; "" matches ANY model under the capability (used by
|
||||
* single-model capabilities like the ocr.* ids, where the capability
|
||||
* already pins the model). */
|
||||
model: string;
|
||||
capabilityId: string;
|
||||
/** Optional exact seller identity pin for deterministic agent routing. */
|
||||
supplierPkh?: string;
|
||||
/** Preferred seller ordered first when it is eligible. */
|
||||
preferredSupplierPkh?: string;
|
||||
fetchFn?: typeof globalThis.fetch;
|
||||
/** supplier_pkhs eligible regardless of polled status — used after the demo
|
||||
* executor frees a supplier the indexer poller (~20 s cadence) still reports
|
||||
* busy. sdk.startChat's live /status pre-check still guards genuinely-busy
|
||||
* suppliers. */
|
||||
ignoreStatusFor?: ReadonlySet<string>;
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -89,14 +77,9 @@ export async function selectCandidates(opts: SelectSupplierOpts): Promise<Suppli
|
||||
const candidates: SupplierCandidate[] = [];
|
||||
for (const raw of body as SupplierView[]) {
|
||||
if (raw.capability_id !== opts.capabilityId) continue;
|
||||
if (opts.model !== "" && raw.model !== opts.model) continue;
|
||||
if (opts.supplierPkh !== undefined && raw.supplier_pkh !== opts.supplierPkh) {
|
||||
continue;
|
||||
}
|
||||
if (raw.model !== opts.model) continue;
|
||||
if (raw.advert_status !== "Active") continue;
|
||||
if (raw.status !== "free" && raw.status !== "unknown" && !opts.ignoreStatusFor?.has(raw.supplier_pkh)) {
|
||||
continue;
|
||||
}
|
||||
if (raw.status !== "free" && raw.status !== "unknown") continue;
|
||||
const advertRef = parseRef(raw.utxo_ref);
|
||||
if (!advertRef) continue;
|
||||
candidates.push({
|
||||
@@ -113,40 +96,24 @@ export async function selectCandidates(opts: SelectSupplierOpts): Promise<Suppli
|
||||
status: raw.status,
|
||||
});
|
||||
}
|
||||
// Prefer the configured seller, then known-free over unknown.
|
||||
candidates.sort((left, right) => {
|
||||
const leftRank =
|
||||
(left.supplierPkh === opts.preferredSupplierPkh ? 0 : 2) +
|
||||
(left.status === "free" ? 0 : 1);
|
||||
const rightRank =
|
||||
(right.supplierPkh === opts.preferredSupplierPkh ? 0 : 2) +
|
||||
(right.status === "free" ? 0 : 1);
|
||||
return leftRank - rightRank;
|
||||
});
|
||||
// Prefer known-free over unknown so we route to confirmed-available first.
|
||||
candidates.sort((a, b) => (a.status === "free" ? 0 : 1) - (b.status === "free" ? 0 : 1));
|
||||
return candidates;
|
||||
}
|
||||
|
||||
/** Distinct models across Active suppliers (for GET /openai/v1/models).
|
||||
* Pass capabilityId to list only models under one capability (demo keys see
|
||||
* only llm.chat.v1 models — the session-backed executor's routing target). */
|
||||
/** Distinct models across Active suppliers (for GET /openai/v1/models). */
|
||||
export async function listModels(opts: {
|
||||
indexerUrl: string;
|
||||
capabilityId?: string;
|
||||
fetchFn?: typeof globalThis.fetch;
|
||||
}): Promise<string[]> {
|
||||
const fetchFn = opts.fetchFn ?? globalThis.fetch;
|
||||
const url = opts.capabilityId
|
||||
? `${opts.indexerUrl}/suppliers?capability_id=${encodeURIComponent(opts.capabilityId)}`
|
||||
: `${opts.indexerUrl}/suppliers`;
|
||||
const res = await fetchFn(url);
|
||||
const res = await fetchFn(`${opts.indexerUrl}/suppliers`);
|
||||
if (!res.ok) throw new Error(`indexer /suppliers returned ${res.status}`);
|
||||
const body = (await res.json()) as unknown;
|
||||
if (!Array.isArray(body)) throw new Error("indexer /suppliers did not return an array");
|
||||
const models = new Set<string>();
|
||||
for (const raw of body as SupplierView[]) {
|
||||
if (raw.advert_status !== "Active" || typeof raw.model !== "string") continue;
|
||||
if (opts.capabilityId !== undefined && raw.capability_id !== opts.capabilityId) continue;
|
||||
models.add(raw.model);
|
||||
if (raw.advert_status === "Active" && typeof raw.model === "string") models.add(raw.model);
|
||||
}
|
||||
return [...models].sort();
|
||||
}
|
||||
|
||||
@@ -15,88 +15,19 @@ import { open as unseal } from "../crypto/seal.js";
|
||||
import { deriveWalletKey } from "../wallet.js";
|
||||
import type { ApiKeyRow } from "../db/store.js";
|
||||
|
||||
/** Default per-run deadline. Chain reads and tx submits settle in seconds;
|
||||
* anything past this is the 2026-08-12 freeze mode (a fetch that never
|
||||
* settles), not a slow success. */
|
||||
export const DEFAULT_MUTEX_TIMEOUT_MS = 180_000;
|
||||
|
||||
/** Default queue bound per mutex. A healthy key drains its queue in seconds;
|
||||
* a queue this deep means the head is stuck and callers should fail fast. */
|
||||
export const DEFAULT_MUTEX_MAX_QUEUE = 64;
|
||||
|
||||
/** A run() exceeded its deadline and was abandoned so queued work can proceed. */
|
||||
export class MutexTimeoutError extends Error {
|
||||
constructor(label: string, timeoutMs: number) {
|
||||
super(`mutex run '${label}' exceeded ${timeoutMs}ms and was abandoned; queued work proceeds`);
|
||||
this.name = "MutexTimeoutError";
|
||||
}
|
||||
}
|
||||
|
||||
/** run() was refused because the queue is at its bound (head likely stuck). */
|
||||
export class MutexQueueFullError extends Error {
|
||||
constructor(label: string, depth: number) {
|
||||
super(`mutex queue full (${depth} pending) — refusing '${label}'; the head of the queue is likely stuck`);
|
||||
this.name = "MutexQueueFullError";
|
||||
}
|
||||
}
|
||||
|
||||
function runWithDeadline<T>(fn: () => Promise<T>, timeoutMs: number, label: string): Promise<T> {
|
||||
return new Promise<T>((resolvePromise, rejectPromise) => {
|
||||
const timer = setTimeout(() => rejectPromise(new MutexTimeoutError(label, timeoutMs)), timeoutMs);
|
||||
// Node-only nicety: don't hold the process open for a pending deadline.
|
||||
timer.unref?.();
|
||||
fn().then(
|
||||
(v) => {
|
||||
clearTimeout(timer);
|
||||
resolvePromise(v);
|
||||
},
|
||||
(e) => {
|
||||
clearTimeout(timer);
|
||||
rejectPromise(e);
|
||||
},
|
||||
);
|
||||
});
|
||||
}
|
||||
|
||||
/**
|
||||
* Tiny promise-chain mutex: run(fn) executes fns strictly one at a time —
|
||||
* now with a per-run deadline and a queue bound (2026-08-12 freeze fix).
|
||||
*
|
||||
* On deadline the stuck fn is NOT cancelled (promises aren't); it is
|
||||
* abandoned: its run() rejects with MutexTimeoutError and the chain advances.
|
||||
* A zombie that settles later can at worst lose a UTxO-contention race with
|
||||
* the run that replaced it — strictly better than the alternative, where one
|
||||
* stuck chain call convoys every subsequent request on the key forever.
|
||||
*/
|
||||
/** Tiny promise-chain mutex: run(fn) executes fns strictly one at a time. */
|
||||
export class Mutex {
|
||||
private tail: Promise<unknown> = Promise.resolve();
|
||||
private depth = 0;
|
||||
|
||||
constructor(private readonly opts: { timeoutMs?: number; maxQueue?: number } = {}) {}
|
||||
|
||||
run<T>(fn: () => Promise<T>, label = "op"): Promise<T> {
|
||||
const timeoutMs = this.opts.timeoutMs ?? DEFAULT_MUTEX_TIMEOUT_MS;
|
||||
const maxQueue = this.opts.maxQueue ?? DEFAULT_MUTEX_MAX_QUEUE;
|
||||
|
||||
if (this.depth >= maxQueue) {
|
||||
return Promise.reject(new MutexQueueFullError(label, this.depth));
|
||||
}
|
||||
this.depth++;
|
||||
|
||||
// Keep the chain alive even if fn rejects or times out; swallow here so
|
||||
// the next run() isn't poisoned by a prior rejection.
|
||||
const result = this.tail.then(
|
||||
() => runWithDeadline(fn, timeoutMs, label),
|
||||
() => runWithDeadline(fn, timeoutMs, label),
|
||||
);
|
||||
const settled = result.finally(() => {
|
||||
this.depth--;
|
||||
});
|
||||
this.tail = settled.then(
|
||||
run<T>(fn: () => Promise<T>): Promise<T> {
|
||||
const result = this.tail.then(fn, fn);
|
||||
// Keep the chain alive even if fn rejects; swallow here so the next
|
||||
// run() isn't poisoned by a prior rejection.
|
||||
this.tail = result.then(
|
||||
() => undefined,
|
||||
() => undefined,
|
||||
);
|
||||
return settled;
|
||||
return result;
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -7,14 +7,13 @@
|
||||
* POST /openai/v1/chat/sessions[/:id/messages|/close].
|
||||
*/
|
||||
|
||||
import express, { type Express, type NextFunction, type Request, type Response } from "express";
|
||||
import express, { type Express, type Request, type Response } from "express";
|
||||
import type { GatewayDeps } from "./deps.js";
|
||||
import { makeApiKeyAuth } from "./middleware/apiKeyAuth.js";
|
||||
import { ipRateLimit, keyRateLimit, demoIpRateLimit } from "./middleware/rateLimit.js";
|
||||
import { ipRateLimit, keyRateLimit } from "./middleware/rateLimit.js";
|
||||
import { sendError } from "./middleware/http.js";
|
||||
import { notFound } from "./openai/errors.js";
|
||||
import { makeChatCompletionsHandler } from "./openai/chatCompletions.js";
|
||||
import { makeOcrExtractHandler } from "./ocr/extract.js";
|
||||
import { makeModelsHandler } from "./openai/models.js";
|
||||
import {
|
||||
makeOpenSessionHandler,
|
||||
@@ -24,45 +23,11 @@ import {
|
||||
import { makeSignupHandler, makeAccountHandler, makeWithdrawHandler } from "./account/routes.js";
|
||||
import { INDEX_HTML } from "./ui/page.js";
|
||||
|
||||
/**
|
||||
* CORS for browser clients on an allowlisted Origin (e.g. the marketplace
|
||||
* frontend's "Generate API key" page, served from a different host than the
|
||||
* gateway). Only echoes Access-Control-* headers when the request's Origin is
|
||||
* in the configured allowlist; an empty allowlist disables CORS entirely.
|
||||
* No credentials are allowed — the signup call is a plain bearer-less POST, so
|
||||
* cookies never ride along cross-origin. Preflight OPTIONS is answered 204.
|
||||
*/
|
||||
function corsMiddleware(allowOrigins: string[]) {
|
||||
const allow = new Set(allowOrigins);
|
||||
return (req: Request, res: Response, next: NextFunction): void => {
|
||||
const origin = req.headers.origin;
|
||||
if (typeof origin === "string" && allow.has(origin)) {
|
||||
res.setHeader("Access-Control-Allow-Origin", origin);
|
||||
res.setHeader("Vary", "Origin");
|
||||
res.setHeader("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
|
||||
res.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization");
|
||||
res.setHeader("Access-Control-Expose-Headers", "X-Vector-Escrow-Ref");
|
||||
res.setHeader("Access-Control-Max-Age", "600");
|
||||
}
|
||||
if (req.method === "OPTIONS") {
|
||||
res.status(204).end();
|
||||
return;
|
||||
}
|
||||
next();
|
||||
};
|
||||
}
|
||||
|
||||
export function createApp(deps: GatewayDeps): Express {
|
||||
const app = express();
|
||||
// Behind traefik/Cloudflare — trust the proxy chain so req.ip is the client.
|
||||
app.set("trust proxy", true);
|
||||
// CORS before body-parsing so preflight OPTIONS short-circuits cheaply.
|
||||
app.use(corsMiddleware(deps.config.corsOrigins));
|
||||
// /v1/ocr carries a base64 page image and mounts its own larger parser on
|
||||
// the route; every other path keeps the 1mb ceiling.
|
||||
const jsonBody = express.json({ limit: "1mb" });
|
||||
app.use((req, res, next) =>
|
||||
req.path.startsWith("/v1/ocr/") ? next() : jsonBody(req, res, next));
|
||||
app.use(express.json({ limit: "1mb" }));
|
||||
|
||||
app.get("/healthz", (_req: Request, res: Response) => {
|
||||
res.json({ ok: true });
|
||||
@@ -75,23 +40,15 @@ export function createApp(deps: GatewayDeps): Express {
|
||||
// Public signup, rate-limited per IP.
|
||||
app.post("/signup", ipRateLimit(deps.config.signupRate), makeSignupHandler(deps));
|
||||
|
||||
// Bearer-gated routes: auth → per-key rate limit (skips demo keys) →
|
||||
// per-IP demo limit (demo keys only) → handler.
|
||||
// Bearer-gated routes: auth → per-key rate limit → handler.
|
||||
const auth = makeApiKeyAuth(deps.store);
|
||||
const krl = keyRateLimit(deps.config.keyRate);
|
||||
const dirl = demoIpRateLimit(deps.config.demoIpRate);
|
||||
const gated = [auth, krl, dirl] as const;
|
||||
const gated = [auth, krl] as const;
|
||||
|
||||
app.get("/account", auth, makeAccountHandler(deps));
|
||||
app.post("/account/withdraw", auth, makeWithdrawHandler(deps));
|
||||
|
||||
app.post("/openai/v1/chat/completions", ...gated, makeChatCompletionsHandler(deps));
|
||||
// Model-scoped OCR: 16mb parser covers MAX_OCR_IMAGE_B64_CHARS
|
||||
// (~12M chars ≈ 9 MB binary) plus JSON envelope. Gates (auth + rate
|
||||
// limits) run BEFORE the parser so an unauthenticated caller cannot
|
||||
// buffer/JSON.parse up to 16mb before getting a 401, and rate limiting
|
||||
// can actually throttle the request (2026-08 review finding C2).
|
||||
app.post("/v1/ocr/extract", ...gated, express.json({ limit: "16mb" }), makeOcrExtractHandler(deps));
|
||||
app.get("/openai/v1/models", auth, makeModelsHandler(deps));
|
||||
app.post("/openai/v1/chat/sessions", ...gated, makeOpenSessionHandler(deps));
|
||||
app.post("/openai/v1/chat/sessions/:id/messages", ...gated, makeSessionMessageHandler(deps));
|
||||
|
||||
@@ -10,120 +10,26 @@
|
||||
* state and never blind-reclaim a Submitted escrow. The on-chain validator is
|
||||
* the source of truth for deadlines, so premature/late attempts simply fail and
|
||||
* are caught here; the age thresholds just avoid racing in-flight requests.
|
||||
*
|
||||
* Chat sessions get special handling:
|
||||
* - Their deliver_by is ~30 min (vs ~10 min one-shot), so rows belonging to
|
||||
* an OPEN session use CHAT_RECLAIM_AFTER_MS — otherwise every open session
|
||||
* older than 11 min would trigger a doomed Reclaim attempt per sweep while
|
||||
* holding the key's mutex.
|
||||
* - When a session's escrow reaches a terminal state (Accepted here, spent
|
||||
* elsewhere, or Reclaimed), the session row is closed, its in-memory state
|
||||
* dropped, and a usage row recorded — abandoned demo sessions (nobody calls
|
||||
* /close) settle and get billed through this path.
|
||||
*
|
||||
* Escrow↔session lineage: the indexer keeps one row per utxo_ref per state
|
||||
* (terminal spends update nothing), and the validator preserves posted_at
|
||||
* across states — so a session's lineage is "rows sharing the posted_at of the
|
||||
* session's original Open ref row".
|
||||
*
|
||||
* Because terminal spends never update indexer rows, every settled escrow
|
||||
* would be retried (one doomed chain query each) on every sweep forever. The
|
||||
* in-process `settledRefs` memory skips refs this process has already settled
|
||||
* or found spent; a restart just causes one harmless retry burst.
|
||||
*
|
||||
* Ticket mode (config.chatSettleMode === "ticket"): session escrows are never
|
||||
* Claimed — they sit Open until reclaimed here after deliver_by. Reclaiming
|
||||
* an Open ticket does NOT close a still-open session row: nothing re-checks
|
||||
* the escrow after /v1/chat/start, so the conversation (and its affinity
|
||||
* mirror) lives on, bounded only by the idle janitor.
|
||||
*/
|
||||
|
||||
import { randomUUID } from "crypto";
|
||||
import type { GatewayDeps } from "./deps.js";
|
||||
import type { SessionRow } from "./db/store.js";
|
||||
import { fetchEscrows, acceptAndConfirm, reclaimAndConfirm, type EscrowRow } from "./onchain/settle.js";
|
||||
import { fetchEscrows, acceptAndConfirm, reclaimAndConfirm } from "./onchain/settle.js";
|
||||
import { parseRef } from "./routing/selectSupplier.js";
|
||||
import { dropSessionState } from "./openai/transcripts.js";
|
||||
import { dropDemoSession, sweepIdleDemoSessions } from "./openai/demoChat.js";
|
||||
import { CAPABILITY as CHAT_CAPABILITY } from "./openai/sessions.js";
|
||||
|
||||
// Don't touch escrows newer than this — an in-flight request is settling them.
|
||||
const MIN_AGE_MS = 90_000;
|
||||
// Reclaim Open/Claimed escrows older than this (past deliver_by ~10m + buffer).
|
||||
const RECLAIM_AFTER_MS = 11 * 60 * 1000;
|
||||
// Chat-session escrows: deliver_by ≈ posted_at + 30 min, so wait longer.
|
||||
const CHAT_RECLAIM_AFTER_MS = 35 * 60 * 1000;
|
||||
// Reclaim only fires once the validator allows it (validity lower bound >=
|
||||
// deliver_by); attempting earlier is a guaranteed-doomed tx build.
|
||||
const DELIVER_BY_BUFFER_MS = 60_000;
|
||||
|
||||
/** Refs this process already settled (Accepted/Reclaimed) or found spent.
|
||||
* The indexer never updates terminal rows, so without this every historical
|
||||
* escrow is retried each sweep. Bounded FIFO; restart = one retry burst. */
|
||||
const settledRefs = new Set<string>();
|
||||
const SETTLED_REFS_MAX = 5_000;
|
||||
|
||||
function markSettled(ref: string): void {
|
||||
settledRefs.add(ref);
|
||||
if (settledRefs.size > SETTLED_REFS_MAX) {
|
||||
const first = settledRefs.values().next().value;
|
||||
if (first !== undefined) settledRefs.delete(first);
|
||||
}
|
||||
}
|
||||
|
||||
function log(msg: string): void {
|
||||
// eslint-disable-next-line no-console
|
||||
console.log(`[gateway:sweeper] ${msg}`);
|
||||
}
|
||||
|
||||
function closeSessionRow(
|
||||
deps: GatewayDeps,
|
||||
session: SessionRow,
|
||||
outcome: { status: "completed" | "reclaimed"; costLovelace: string | null },
|
||||
): void {
|
||||
// Re-read: an in-flight close (route handler or demo executor) may have won.
|
||||
const current = deps.store.getSession(session.id);
|
||||
if (!current || current.state !== "open") return;
|
||||
deps.store.setSessionState(session.id, "closed", Date.now());
|
||||
dropSessionState(session.id);
|
||||
dropDemoSession(session.id);
|
||||
deps.store.insertUsage({
|
||||
id: randomUUID(),
|
||||
key_id: session.key_id,
|
||||
created_at: Date.now(),
|
||||
kind: "chat_session",
|
||||
model: session.model,
|
||||
capability_id: CHAT_CAPABILITY,
|
||||
supplier_pkh: session.supplier_pkh,
|
||||
escrow_ref: session.escrow_ref,
|
||||
cost_lovelace: outcome.costLovelace,
|
||||
prompt_tokens: 0,
|
||||
completion_tokens: 0,
|
||||
status: outcome.status,
|
||||
failure_reason: null,
|
||||
});
|
||||
log(`closed abandoned session ${session.id} (${outcome.status})`);
|
||||
}
|
||||
|
||||
/** Chain-settle functions, injectable for tests. */
|
||||
export interface SweepSettleFns {
|
||||
accept: typeof acceptAndConfirm;
|
||||
reclaim: typeof reclaimAndConfirm;
|
||||
}
|
||||
|
||||
export async function runSweepOnce(
|
||||
deps: GatewayDeps,
|
||||
settle: SweepSettleFns = { accept: acceptAndConfirm, reclaim: reclaimAndConfirm },
|
||||
): Promise<void> {
|
||||
// Idle demo sessions first: closing them makes the supplier Submit, so this
|
||||
// sweep (or the next) can Accept the escrow right after.
|
||||
await sweepIdleDemoSessions(deps).catch((err) =>
|
||||
log(`demo idle janitor: ${err instanceof Error ? err.message : String(err)}`),
|
||||
);
|
||||
|
||||
export async function runSweepOnce(deps: GatewayDeps): Promise<void> {
|
||||
const now = Date.now();
|
||||
for (const keyRow of deps.store.listKeys()) {
|
||||
let rows: EscrowRow[];
|
||||
let rows;
|
||||
try {
|
||||
rows = await fetchEscrows(deps.config.indexerUrl, keyRow.wallet_pkh, deps.fetchFn);
|
||||
} catch (err) {
|
||||
@@ -131,71 +37,20 @@ export async function runSweepOnce(
|
||||
continue;
|
||||
}
|
||||
|
||||
// Lineage-match open sessions: the session stores its ORIGINAL Open ref;
|
||||
// rows sharing that row's posted_at are the same escrow in later states.
|
||||
const sessionByPostedAt = new Map<number, SessionRow>();
|
||||
for (const session of deps.store.listOpenSessionsByKey(keyRow.id)) {
|
||||
const origin = rows.find((r) => r.utxo_ref === session.escrow_ref);
|
||||
if (origin) sessionByPostedAt.set(origin.posted_at, session);
|
||||
}
|
||||
|
||||
const ctx = deps.registry.getContext(keyRow);
|
||||
for (const row of rows) {
|
||||
const ref = parseRef(row.utxo_ref);
|
||||
if (!ref) continue;
|
||||
if (settledRefs.has(row.utxo_ref)) continue;
|
||||
const ageMs = now - (row.posted_at ?? 0);
|
||||
if (ageMs < MIN_AGE_MS) continue;
|
||||
const chatSession = sessionByPostedAt.get(row.posted_at);
|
||||
|
||||
try {
|
||||
if (row.state === "Submitted") {
|
||||
try {
|
||||
await ctx.mutex.run(() => settle.accept(deps.chain, ctx.walletKey, ref));
|
||||
log(`accepted stranded Submitted escrow ${row.utxo_ref}`);
|
||||
markSettled(row.utxo_ref);
|
||||
if (chatSession) {
|
||||
closeSessionRow(deps, chatSession, { status: "completed", costLovelace: chatSession.price_lovelace });
|
||||
}
|
||||
} catch (err) {
|
||||
// Accept fails routinely when the UTxO is already spent (settled
|
||||
// by an in-flight request, an earlier sweep, or supplier Release).
|
||||
// For session lineages, confirm the spend on-chain before closing
|
||||
// the row — an Accept that failed for another reason (timeout)
|
||||
// must leave the session open for the next sweep.
|
||||
if ((await deps.chain.queryUtxo(ref)) === null) {
|
||||
markSettled(row.utxo_ref);
|
||||
if (chatSession) {
|
||||
closeSessionRow(deps, chatSession, { status: "completed", costLovelace: chatSession.price_lovelace });
|
||||
}
|
||||
} else if (!chatSession) {
|
||||
// Preserve the historical quiet-skip for one-shot escrows.
|
||||
void err;
|
||||
}
|
||||
}
|
||||
} else if (row.state === "Open" || row.state === "Claimed") {
|
||||
const reclaimAfterMs = chatSession ? CHAT_RECLAIM_AFTER_MS : RECLAIM_AFTER_MS;
|
||||
// The validator only allows Reclaim at/after deliver_by — skip
|
||||
// attempts that cannot succeed yet (early-closed ticket sessions).
|
||||
const pastDeliverBy =
|
||||
typeof row.deliver_by === "number" ? now > row.deliver_by + DELIVER_BY_BUFFER_MS : true;
|
||||
if (ageMs > reclaimAfterMs && pastDeliverBy) {
|
||||
await ctx.mutex.run(() => settle.reclaim(deps.chain, ctx.walletKey, ref));
|
||||
log(`reclaimed stranded ${row.state} escrow ${row.utxo_ref}`);
|
||||
markSettled(row.utxo_ref);
|
||||
if (chatSession) {
|
||||
const ticketOpen = deps.config.chatSettleMode === "ticket" && row.state === "Open";
|
||||
if (ticketOpen) {
|
||||
// Ticket escrow reclaimed out from under a LIVE session —
|
||||
// by design. Keep the session row + mirror; only the idle
|
||||
// janitor / close paths end ticket sessions.
|
||||
log(`ticket mode: escrow reclaimed, session ${chatSession.id} stays open`);
|
||||
} else {
|
||||
// Funds returned — the session never settled; record no cost.
|
||||
closeSessionRow(deps, chatSession, { status: "reclaimed", costLovelace: null });
|
||||
}
|
||||
}
|
||||
}
|
||||
await ctx.mutex.run(() => acceptAndConfirm(deps.chain, ctx.walletKey, ref));
|
||||
log(`accepted stranded Submitted escrow ${row.utxo_ref}`);
|
||||
} else if ((row.state === "Open" || row.state === "Claimed") && ageMs > RECLAIM_AFTER_MS) {
|
||||
await ctx.mutex.run(() => reclaimAndConfirm(deps.chain, ctx.walletKey, ref));
|
||||
log(`reclaimed stranded ${row.state} escrow ${row.utxo_ref}`);
|
||||
}
|
||||
} catch {
|
||||
// Expected when the validator rejects (wrong window/state) or the UTxO
|
||||
@@ -203,6 +58,9 @@ export async function runSweepOnce(
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Mark closed/settled chat sessions whose escrow is no longer active.
|
||||
// (Best-effort housekeeping; the escrow recovery above is the load-bearing part.)
|
||||
}
|
||||
|
||||
/** Start the periodic sweeper. Returns a stop() function. */
|
||||
|
||||
@@ -8,7 +8,7 @@ export const INDEX_HTML = `<!doctype html>
|
||||
<head>
|
||||
<meta charset="utf-8" />
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1" />
|
||||
<title>Vector Marketplace - OpenAI Gateway</title>
|
||||
<title>Vector Marketplace — OpenAI Gateway</title>
|
||||
<style>
|
||||
body { font-family: system-ui, sans-serif; max-width: 760px; margin: 2rem auto; padding: 0 1rem; line-height: 1.5; }
|
||||
h1 { font-size: 1.5rem; } h2 { font-size: 1.1rem; margin-top: 2rem; }
|
||||
@@ -22,7 +22,7 @@ export const INDEX_HTML = `<!doctype html>
|
||||
</style>
|
||||
</head>
|
||||
<body>
|
||||
<h1>Vector Marketplace - OpenAI-compatible Gateway</h1>
|
||||
<h1>Vector Marketplace — OpenAI-compatible Gateway</h1>
|
||||
<p class="muted">Point any OpenAI SDK at <code id="base"></code> using your API key as the bearer token.</p>
|
||||
|
||||
<h2>1. Create an API key</h2>
|
||||
@@ -33,7 +33,7 @@ export const INDEX_HTML = `<!doctype html>
|
||||
<div id="signupOut"></div>
|
||||
|
||||
<h2>2. Fund your wallet</h2>
|
||||
<p class="muted">Send AP3X to your deposit address (you need price + bonds + ~5 AP3X collateral + fees).</p>
|
||||
<p class="muted">Send AP3X to your deposit address (you need price + bonds + ~5 ADA collateral + fees).</p>
|
||||
|
||||
<h2>3. Account</h2>
|
||||
<div class="row">
|
||||
|
||||
@@ -2,8 +2,8 @@
|
||||
* gateway/src/walletHealth.ts — keep each custodial wallet usable.
|
||||
*
|
||||
* After every settled request (and on a periodic tick) we re-shape the wallet to
|
||||
* {≥5 AP3X collateral UTxO, working UTxO} via the shared consolidate builder, so
|
||||
* the NEXT request's Accept/Reclaim script-spend always finds a pure-AP3X
|
||||
* {≥5 ADA collateral UTxO, working UTxO} via the shared consolidate builder, so
|
||||
* the NEXT request's Accept/Reclaim script-spend always finds a pure-ADA
|
||||
* collateral candidate. No-op when the wallet is already healthy.
|
||||
*/
|
||||
|
||||
|
||||
@@ -1,143 +0,0 @@
|
||||
/**
|
||||
* affinity.test.ts — transcript-prefix session matching rules.
|
||||
*/
|
||||
|
||||
import { describe, it, expect } from "vitest";
|
||||
import {
|
||||
matchSessionPrefix,
|
||||
normalizeAssistantContent,
|
||||
trimToRespondable,
|
||||
type AffinityCandidate,
|
||||
} from "../src/openai/affinity.js";
|
||||
import type { ChatMessage } from "@marketplace/shared/tx";
|
||||
|
||||
const u = (content: string): ChatMessage => ({ role: "user", content });
|
||||
const a = (content: string): ChatMessage => ({ role: "assistant", content });
|
||||
const TOOL_CALL = { id: "call_1", type: "function" as const, function: { name: "get_time", arguments: "{}" } };
|
||||
|
||||
function cand(sessionId: string, mirror: ChatMessage[], lastUsedAt = 0, model = "m"): AffinityCandidate {
|
||||
return { sessionId, model, mirror, lastUsedAt };
|
||||
}
|
||||
|
||||
describe("matchSessionPrefix", () => {
|
||||
it("matches an exact prefix and returns the delta", () => {
|
||||
const got = matchSessionPrefix([cand("s1", [u("hi"), a("hello")])], [u("hi"), a("hello"), u("more")], "m");
|
||||
expect(got).toEqual({ sessionId: "s1", delta: [u("more")] });
|
||||
});
|
||||
|
||||
it("accepts a multi-message tool delta ending with a tool result", () => {
|
||||
const mirror = [u("hi"), { role: "assistant" as const, content: "", tool_calls: [TOOL_CALL] }];
|
||||
const incoming = [...mirror, { role: "tool" as const, content: "3pm", tool_call_id: "call_1" }];
|
||||
const got = matchSessionPrefix([cand("s1", mirror)], incoming, "m");
|
||||
expect(got?.sessionId).toBe("s1");
|
||||
expect(got?.delta).toHaveLength(1);
|
||||
expect(got?.delta[0].role).toBe("tool");
|
||||
});
|
||||
|
||||
it("rejects deltas that end with a non-respondable role", () => {
|
||||
const got = matchSessionPrefix([cand("s1", [u("hi")])], [u("hi"), a("stray assistant")], "m");
|
||||
expect(got).toBeNull();
|
||||
});
|
||||
|
||||
it("never matches when incoming is not longer than the mirror (retry of answered request)", () => {
|
||||
const mirror = [u("hi"), a("hello")];
|
||||
expect(matchSessionPrefix([cand("s1", mirror)], mirror, "m")).toBeNull();
|
||||
expect(matchSessionPrefix([cand("s1", mirror)], [u("hi")], "m")).toBeNull();
|
||||
});
|
||||
|
||||
it("rejects diverged histories (prefix mismatch)", () => {
|
||||
const got = matchSessionPrefix([cand("s1", [u("hi"), a("hello")])], [u("hi"), a("DIFFERENT"), u("more")], "m");
|
||||
expect(got).toBeNull();
|
||||
});
|
||||
|
||||
it("requires the model to match", () => {
|
||||
expect(matchSessionPrefix([cand("s1", [u("hi")], 0, "other")], [u("hi"), u("more")], "m")).toBeNull();
|
||||
});
|
||||
|
||||
it("prefers the longest mirror, then most recently used", () => {
|
||||
const incoming = [u("hi"), a("hello"), u("more")];
|
||||
const longest = matchSessionPrefix(
|
||||
[cand("short", [u("hi")], 99), cand("long", [u("hi"), a("hello")], 0)],
|
||||
incoming,
|
||||
"m",
|
||||
);
|
||||
expect(longest?.sessionId).toBe("long");
|
||||
|
||||
const tie = matchSessionPrefix(
|
||||
[cand("old", [u("hi"), a("hello")], 1), cand("recent", [u("hi"), a("hello")], 2)],
|
||||
incoming,
|
||||
"m",
|
||||
);
|
||||
expect(tie?.sessionId).toBe("recent");
|
||||
});
|
||||
|
||||
it("matches an empty mirror (fresh session) against any respondable history", () => {
|
||||
const incoming = [{ role: "system" as const, content: "be nice" }, u("hi")];
|
||||
const got = matchSessionPrefix([cand("fresh", [])], incoming, "m");
|
||||
expect(got).toEqual({ sessionId: "fresh", delta: incoming });
|
||||
});
|
||||
|
||||
it("treats content null-normalization as equivalent (tool-call assistant echo)", () => {
|
||||
const mirror = [u("hi"), { role: "assistant" as const, content: "", tool_calls: [TOOL_CALL] }];
|
||||
// Client echoes the assistant message back with content:"" (normalized from null upstream).
|
||||
const incoming = [u("hi"), { role: "assistant" as const, content: "", tool_calls: [{ ...TOOL_CALL }] }, { role: "tool" as const, content: "x", tool_call_id: "call_1" }];
|
||||
expect(matchSessionPrefix([cand("s1", mirror)], incoming, "m")?.sessionId).toBe("s1");
|
||||
});
|
||||
|
||||
it("matches leniently when the client reshapes the assistant echo (think-strip + whitespace)", () => {
|
||||
const mirror = [u("hi"), a("<think>plan it</think>Hello there\n")];
|
||||
const got = matchSessionPrefix([cand("s1", mirror)], [u("hi"), a("Hello there"), u("more")], "m");
|
||||
expect(got).toEqual({ sessionId: "s1", delta: [u("more")] });
|
||||
});
|
||||
|
||||
it("stays strict on user/tool divergence even with lenient assistant matching", () => {
|
||||
const mirror = [u("hi "), a("Hello")];
|
||||
// User content differs by whitespace — client-authored roles must be byte-exact.
|
||||
expect(matchSessionPrefix([cand("s1", mirror)], [u("hi"), a("Hello"), u("more")], "m")).toBeNull();
|
||||
});
|
||||
|
||||
it("rejects assistant tool_calls divergence under lenient matching", () => {
|
||||
const mirror = [u("hi"), { role: "assistant" as const, content: "x", tool_calls: [TOOL_CALL] }];
|
||||
const changed = { ...TOOL_CALL, function: { name: "get_time", arguments: '{"tz":"utc"}' } };
|
||||
const incoming = [u("hi"), { role: "assistant" as const, content: "x ", tool_calls: [changed] }, { role: "tool" as const, content: "t", tool_call_id: "call_1" }];
|
||||
expect(matchSessionPrefix([cand("s1", mirror)], incoming, "m")).toBeNull();
|
||||
});
|
||||
|
||||
it("prefers a strict match over a lenient one regardless of recency", () => {
|
||||
const incoming = [u("hi"), a("Hello"), u("more")];
|
||||
const got = matchSessionPrefix(
|
||||
[
|
||||
cand("lenient", [u("hi"), a("Hello ")], 99),
|
||||
cand("strict", [u("hi"), a("Hello")], 1),
|
||||
],
|
||||
incoming,
|
||||
"m",
|
||||
);
|
||||
expect(got?.sessionId).toBe("strict");
|
||||
});
|
||||
});
|
||||
|
||||
describe("normalizeAssistantContent", () => {
|
||||
it("strips think blocks, collapses whitespace and trims", () => {
|
||||
expect(normalizeAssistantContent("<think>a\nb</think> Hi\n\nthere friend ")).toBe("Hi there friend");
|
||||
expect(normalizeAssistantContent("<THINK>x</THINK>ok")).toBe("ok");
|
||||
expect(normalizeAssistantContent("plain")).toBe("plain");
|
||||
});
|
||||
});
|
||||
|
||||
describe("trimToRespondable", () => {
|
||||
it("drops trailing assistant/system messages", () => {
|
||||
expect(trimToRespondable([u("hi"), a("partial")])).toEqual([u("hi")]);
|
||||
expect(trimToRespondable([u("hi"), a("x"), { role: "system" as const, content: "nudge" }])).toEqual([u("hi")]);
|
||||
});
|
||||
|
||||
it("returns empty when nothing respondable remains", () => {
|
||||
expect(trimToRespondable([a("hello")])).toEqual([]);
|
||||
expect(trimToRespondable([])).toEqual([]);
|
||||
});
|
||||
|
||||
it("keeps already-respondable histories unchanged", () => {
|
||||
const msgs = [u("hi"), a("x"), u("more")];
|
||||
expect(trimToRespondable(msgs)).toEqual(msgs);
|
||||
});
|
||||
});
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user