mtok-bridge 0.3.0 → 0.3.2

package/mtok-bridge.mjs

@@ -36,11 +36,26 @@ if (!o.upstream) { console.error('need --upstream <openai-compatible url> (e.g.
 const apiKey = o.keyless ? null : (o.apiKey || 'mtok_' + crypto.randomBytes(24).toString('hex'));
 const upstream = httpUpstream({ baseUrl: o.upstream, key: o.upstreamKey });
 
+const MAX_BODY_BYTES = 2_000_000;
 const readBody = (req) => new Promise((resolve) => {
-  let data = ''; let over = false;
-  req.on('data', (c) => { data += c; if (data.length > 2_000_000) { over = true; req.destroy(); } });
-  req.on('end', () => resolve(over ? null : data));
-  req.on('error', () => resolve(null));
+  // #651: buffer the raw chunks and decode ONCE. `data += chunk` stringified each
+  // Buffer as it arrived, which corrupts a multibyte UTF-8 character split across
+  // two TCP chunks (each half decodes to replacement bytes). Track the BYTE total
+  // (not string .length) against the cap, and on overflow resolve immediately so an
+  // oversized request gets its 413 instead of leaving the handler awaiting forever.
+  const chunks = [];
+  let bytes = 0;
+  let settled = false;
+  const done = (value) => { if (!settled) { settled = true; resolve(value); } };
+  req.on('data', (c) => {
+    if (settled) return;
+    bytes += c.length;
+    if (bytes > MAX_BODY_BYTES) { req.destroy(); return done(null); }
+    chunks.push(c);
+  });
+  req.on('end', () => done(Buffer.concat(chunks).toString('utf8')));
+  req.on('error', () => done(null));
+  req.on('close', () => done(null)); // destroy() emits close, not always end/error
 });
 const send = (res, status, json) => { res.writeHead(status, { 'content-type': 'application/json' }); res.end(JSON.stringify(json)); };
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mtok-bridge",
-  "version": "0.3.0",
+  "version": "0.3.2",
   "description": "Serve any model as an OpenAI-compatible API with a key. No payment, no market, runs anywhere node runs. The transport core behind mtok.market's seller relay.",
   "type": "module",
   "bin": {

package/src/serve-core.mjs

@@ -105,11 +105,53 @@ function validateRequest(request, model, { legacy = false } = {}) {
 }
 
 /**
- * Throws if the upstream model doesn't match the offer model.
- * Protects against cheap-swap accusations: echo the real model you delivered.
+ * Normalize a model id for comparison: lowercase, drop any provider namespace
+ * (everything through the last '/', e.g. `@cf/meta/`), and strip a leading '@'.
+ * `@cf/meta/llama-3.1-8b-instruct-fp8` and `llama-3.1-8b-instruct-fp8` normalize
+ * to the same stem.
+ */
+export function normalizeModelId(m) {
+  return String(m ?? '').toLowerCase().split('/').pop().replace(/^@/, '');
+}
+
+/**
+ * True when the upstream's echoed model is a legitimate variant of the offer
+ * model. Legitimate variance is ONLY a resolved version/snapshot SUFFIX appended
+ * to the same base (`gpt-4o` -> `gpt-4o-2024-08-06`, `gpt-4` -> `gpt-4-0613`): the
+ * extra segment starts with a DIGIT. A raw prefix match is NOT enough -- model
+ * families share alphabetic prefixes (`gpt-4` is a prefix of the CHEAPER
+ * `gpt-4o-mini`; `claude-3` of `claude-3-haiku`), so accepting any prefix would
+ * pass a cheap-swap. Require the appended segment to be version-like (digit-led),
+ * which distinguishes a snapshot date/version from a different model qualifier
+ * (mini, haiku, turbo, fp8, instruct).
+ */
+export function modelsCompatible(upstreamModel, offerModel) {
+  const a = normalizeModelId(upstreamModel);
+  const b = normalizeModelId(offerModel);
+  if (!a || !b) return false;
+  if (a === b) return true;
+  // The longer must equal the shorter + a version/snapshot suffix made ONLY of
+  // digit groups separated by -/./_ (a date like -2024-08-06, a build like -0613,
+  // a point version like .1). Any alphabetic segment in the suffix means a
+  // different model qualifier (mini, haiku, turbo, instruct, fp8), so e.g.
+  // gpt-4.1-mini vs gpt-4 and claude-3.5-haiku vs claude-3 are rejected while a
+  // real snapshot passes.
+  const [longer, shorter] = a.length >= b.length ? [a, b] : [b, a];
+  if (!longer.startsWith(shorter)) return false;
+  const rest = longer.slice(shorter.length);
+  return /^([-._]\d+)+$/.test(rest);
+}
+
+/**
+ * Throws if the upstream model is NOT a legitimate variant of the offer model.
+ * #651: the old check was an exact string compare, which false-refused honest
+ * sellers whose OpenAI-compatible provider echoes a snapshot id or a namespace-
+ * stripped name (the buyer's own accept-check is exact too, so the seller then
+ * normalizes the delivered model to the offer id below). A real cheap-swap to a
+ * different model family still fails this tolerant relation.
  */
 export function enforceModelEcho(upstreamModel, offerModel) {
-  if (String(upstreamModel) !== String(offerModel))
+  if (!modelsCompatible(upstreamModel, offerModel))
     throw new Error(`model mismatch: upstream ${upstreamModel} != offer ${offerModel}`);
 }
 
@@ -119,20 +161,36 @@ export function configuredFeeAtomic({ sellerUsdAtomic, feeAddress, feeBps }) {
   return (BigInt(sellerUsdAtomic || 0) * bps + 5000n) / 10000n;
 }
 
-// Conservative tokenizer-independent upper estimate: a tokenizer cannot consume
-// more text tokens than UTF-8 bytes, plus the chat envelope around each message.
-// The core accepts plain-text messages only, so no unpriced multimodal parts
-// can bypass this bound. Pure, dependency-free, no I/O.
+// Tokenizer-independent input estimate, byte-aware with a safety margin.
+//
+// #626: this used to count one token per UTF-8 byte, i.e. a true worst-case
+// bound (a tokenizer cannot emit more text tokens than bytes). That bound is
+// correct and roughly 4x too pessimistic for real text, and the over-estimate
+// is NOT free: boundServe refuses a draw whose estimated input cost alone meets
+// the payment, and that refusal happens AFTER the buyer has paid on chain. A
+// real buyer sending a ~4KB prompt on a budget that comfortably covered it was
+// refused every night for two weeks and auto-disputed, silently.
+//
+// So estimate realistically and keep the margin explicit. BYTES_PER_TOKEN_EST
+// of 3.2 is the English average (~4 bytes/token) with ~25% headroom, and
+// staying in BYTES rather than characters keeps multibyte prompts from reading
+// artificially cheap. The seller's residual exposure when an estimate lands
+// low is bounded: actual usage is metered from the upstream response after the
+// serve, and the output cap is computed from whatever budget the input
+// estimate left, so an under-estimate eats into output headroom rather than
+// running unpriced.
 export const MESSAGE_OVERHEAD_TOKENS = 4;
+export const BYTES_PER_TOKEN_EST = 3.2;
 export function estimateInputTokens(messages) {
   const utf8 = new TextEncoder();
-  let tokens = 3; // reply priming
+  let bytes = 0;
+  let envelope = 3; // reply priming
   for (const m of messages ?? []) {
-    tokens += MESSAGE_OVERHEAD_TOKENS;
-    tokens += utf8.encode(String(m?.role ?? '')).length;
-    tokens += utf8.encode(typeof m?.content === 'string' ? m.content : JSON.stringify(m?.content ?? null)).length;
+    envelope += MESSAGE_OVERHEAD_TOKENS;
+    bytes += utf8.encode(String(m?.role ?? '')).length;
+    bytes += utf8.encode(typeof m?.content === 'string' ? m.content : JSON.stringify(m?.content ?? null)).length;
   }
-  return tokens;
+  return envelope + Math.ceil(bytes / BYTES_PER_TOKEN_EST);
 }
 
 // Bound a serve against the paid budget in BOTH legs (#495/#460). The relay used
@@ -142,7 +200,14 @@ export function estimateInputTokens(messages) {
 // exceeds the payment; otherwise cap output over the budget LEFT after input. inPrice
 // and outPrice are USD per MTok. The estimate gates the refuse ONLY; real billing
 // still meters the upstream's reported token counts, so this never over-charges.
-export function boundServe({ messages, budgetUsd, inPrice, outPrice, reqMax, contextCeil = 4096 }) {
+// #654: DEFAULT_MAX_OUTPUT_TOKENS is a generous sanity ceiling, not a money guard
+// (the paid budget below already bounds output, and billing meters real usage). The
+// old 4096 was low enough to cap honest large-output requests below what the buyer
+// funded, so they overpaid. A relay operator can raise or lower it per their upstream
+// (see createServeCore's maxOutputTokens); this default just keeps a no-max_tokens
+// request on a big budget from triggering one runaway generation.
+export const DEFAULT_MAX_OUTPUT_TOKENS = 32768;
+export function boundServe({ messages, budgetUsd, inPrice, outPrice, reqMax, contextCeil = DEFAULT_MAX_OUTPUT_TOKENS }) {
   const estIn = estimateInputTokens(messages);
   const estInCostUsd = estIn * (Number(inPrice) > 0 ? Number(inPrice) : 0) / 1e6;
   if (estInCostUsd >= budgetUsd) return { refuse: true, reason: 'input', estIn, estInCostUsd };
@@ -170,8 +235,20 @@ export function createServeCore({
   offerId, sellerAgentId, sellerWallet,
   dripContractAddress, feeRecipient, feeBps,
   screenPayer,
+  // #654: the output-token sanity ceiling for boundServe. The PAID budget already
+  // bounds output (and metering is on real usage), so this is a defensive cap on a
+  // single generation, not a money guard. It is a per-relay knob: the reference host
+  // passes MTOK_MAX_OUTPUT_TOKENS / a config value; operators serving large-context
+  // models raise it. Falls back to boundServe's own generous default when unset.
+  maxOutputTokens,
 }) {
   const serve = async (body) => {
+    // #651: feeBps/feeRecipient may be getters so a long-running relay tracks a
+    // platform fee change instead of pinning the boot rate (a fee DECREASE with a
+    // stale higher rate would refuse an already-paid draw as fee_amount_too_low).
+    // Resolve once per serve and use the resolved values everywhere below.
+    const currentFeeBps = typeof feeBps === 'function' ? feeBps() : feeBps;
+    const currentFeeRecipient = typeof feeRecipient === 'function' ? feeRecipient() : feeRecipient;
     const { bookingId, n, buyerId, request, requestNonce, drawPaidTxHash } = body;
     const hasRequestNonce = Object.hasOwn(body, 'requestNonce');
     if (!bookingId) return { status: 400, body: { error: 'bad_request', detail: 'DRAW needs bookingId' } };
@@ -217,7 +294,7 @@ export function createServeCore({
         n,
         requestHash,
         sellerWallet,
-        feeRecipient,
+        feeRecipient: currentFeeRecipient,
         // #580: refuse a payment older than the redemption window. The JSONL
         // payload cache AND the claim markers are both aged out at boot (#600),
         // so past retention this age bound is the sole replay defense (its
@@ -231,8 +308,8 @@ export function createServeCore({
     if (!paid?.ok) return { status: 402, body: { error: 'payment_unverified', detail: paid?.reason || 'unknown' } };
     const expectedFee = configuredFeeAtomic({
       sellerUsdAtomic: paid.event.sellerUsdAtomic,
-      feeAddress: feeRecipient,
-      feeBps,
+      feeAddress: currentFeeRecipient,
+      feeBps: currentFeeBps,
     });
     if (BigInt(paid.event.feeUsdAtomic || 0) < expectedFee) {
       return { status: 402, body: { error: 'payment_unverified', detail: 'fee_amount_too_low' } };
@@ -290,7 +367,7 @@ export function createServeCore({
     const eventOutPriceUsd = Number(paidEvent.outputPricePerMTokAtomic || 0) / 1e6;
     const boundInPrice = Math.max(Number(inPrice) || 0, eventInPriceUsd);
     const boundOutPrice = Math.max(Number(outPrice) || 0, eventOutPriceUsd);
-    const bound = boundServe({ messages: checked.safeRequest.messages, budgetUsd: remainingUsd, inPrice: boundInPrice, outPrice: boundOutPrice, reqMax: checked.safeRequest.max_tokens });
+    const bound = boundServe({ messages: checked.safeRequest.messages, budgetUsd: remainingUsd, inPrice: boundInPrice, outPrice: boundOutPrice, reqMax: checked.safeRequest.max_tokens, ...(Number(maxOutputTokens) > 0 ? { contextCeil: Math.floor(Number(maxOutputTokens)) } : {}) });
     if (bound.refuse) {
       const error = bound.reason === 'input' ? 'input_too_large' : 'output_unfunded';
       return { status: 402, body: { error, detail: `estimated input (~${bound.estIn} tokens, $${bound.estInCostUsd.toFixed(6)}) leaves no safely funded output in the paid amount ($${remainingUsd})`, _bookingId: bookingId, remainingUsd } };
@@ -316,6 +393,11 @@ export function createServeCore({
 
     try { enforceModelEcho(completion.model, model); }
     catch (e) { return { status: 502, body: { error: 'model_mismatch', detail: e.message } }; }
+    // #651: the upstream model passed the tolerant variant check; echo the OFFER
+    // model id in the delivered completion. The buyer's accept-check is an exact
+    // completion.model === offer.model compare, so a legitimate snapshot/namespace
+    // variant must be normalized to the offer id or an honest paid draw is disputed.
+    if (completion && typeof completion === 'object') completion.model = model;
 
     // ── Contract mode is REPORT-FREE (chain-native phase 2 stage 3, #387) ──
     // The verified DrawPaid event IS the record: the platform indexes the