mtok-bridge 0.3.2 → 0.3.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mtok-bridge",
-  "version": "0.3.2",
+  "version": "0.3.3",
   "description": "Serve any model as an OpenAI-compatible API with a key. No payment, no market, runs anywhere node runs. The transport core behind mtok.market's seller relay.",
   "type": "module",
   "bin": {

package/src/bridge.mjs

@@ -55,7 +55,7 @@ export async function serveChat({ body, authHeader, apiKey, models, upstream })
 // `baseUrl` is the API root (e.g. https://api.openai.com/v1 or a local model server); `key` is
 // its bearer token (optional for a keyless local server). This is what makes the bridge portable:
 // point it at a provider, or at ollama / LM Studio / vLLM on localhost.
-export function httpUpstream({ baseUrl, key }) {
+export function httpUpstream({ baseUrl, key, timeoutMs }) {
   const url = String(baseUrl || '').replace(/\/$/, '') + '/chat/completions';
   return async (payload) => {
     const res = await fetch(url, {
@@ -65,6 +65,7 @@ export function httpUpstream({ baseUrl, key }) {
         ...(key ? { authorization: `Bearer ${key}` } : {}),
       },
       body: JSON.stringify(payload),
+      ...(timeoutMs == null ? {} : { signal: AbortSignal.timeout(timeoutMs) }),
     });
     const text = await res.text();
     let json;

package/src/serve-core.mjs

@@ -282,6 +282,24 @@ export function createServeCore({
       return { status: 402, body: { error: 'contract_mode_required', detail: 'this relay only serves contract-mode draws; the platform is not reporting a dripContractAddress' } };
     }
     if (!drawPaidTxHash) return { status: 402, body: { error: 'draw_payment_required', detail: 'contract mode requires drawPaidTxHash before upstream delivery' } };
+    let storedKey = cacheKey;
+    // The redemption interface may be sync (fs store) or async (a Workers KV
+    // store): await normalizes both, and identity-awaits cost nothing under the
+    // host's per-booking lock.
+    let redemptionState = await redemption.state(storedKey);
+    // Preserve an upgrade's pre-scheme redemption log; missing this alias
+    // would let a legacy paid draw run upstream again after relay upgrade.
+    if (!redemptionState && oldLegacyKey) {
+      const oldLegacyState = await redemption.state(oldLegacyKey);
+      if (oldLegacyState) {
+        storedKey = oldLegacyKey;
+        redemptionState = oldLegacyState;
+      } else {
+        // Checking the legacy marker may have refreshed a prefixed record
+        // appended by another upgraded process.
+        redemptionState = await redemption.state(cacheKey);
+      }
+    }
     let paid;
     try {
       paid = await verifier.verifyDrawPaid(drawPaidTxHash, {
@@ -295,16 +313,15 @@ export function createServeCore({
         requestHash,
         sellerWallet,
         feeRecipient: currentFeeRecipient,
-        // #580: refuse a payment older than the redemption window. The JSONL
-        // payload cache AND the claim markers are both aged out at boot (#600),
-        // so past retention this age bound is the sole replay defense (its
-        // skip-on-unreadable-block residual is named in redemption.mjs). An
-        // honest retry is seconds-to-minutes old, never days.
-        maxPaidAgeMs: redemption.retentionMs,
+        // A known completion spends no new inference. New claims need a verified
+        // age because both payload and claim markers expire after retention.
+        maxPaidAgeMs: redemptionState === 'complete' ? undefined : redemption.retentionMs,
       });
     } catch (e) {
+      if (e.name === 'TimeoutError') return { status: 503, body: { error: 'relay_timeout', _bookingId: bookingId } };
       return { status: 402, body: { error: 'payment_unverified', detail: e.message } };
     }
+    if (paid?.reason === 'payment_age_unavailable') return { status: 503, body: { error: 'payment_age_unavailable', detail: 'payment age could not be verified; retry this same paid draw', _bookingId: bookingId } };
     if (!paid?.ok) return { status: 402, body: { error: 'payment_unverified', detail: paid?.reason || 'unknown' } };
     const expectedFee = configuredFeeAtomic({
       sellerUsdAtomic: paid.event.sellerUsdAtomic,
@@ -328,24 +345,6 @@ export function createServeCore({
         return { status: 403, body: { error: 'payer_denied', detail: 'payer screening failed: ' + e.message } };
       }
     }
-    let storedKey = cacheKey;
-    // The redemption interface may be sync (fs store) or async (a Workers KV
-    // store): await normalizes both, and identity-awaits cost nothing under the
-    // host's per-booking lock.
-    let redemptionState = await redemption.state(storedKey);
-    // Preserve an upgrade's pre-scheme redemption log; missing this alias
-    // would let a legacy paid draw run upstream again after relay upgrade.
-    if (!redemptionState && oldLegacyKey) {
-      const oldLegacyState = await redemption.state(oldLegacyKey);
-      if (oldLegacyState) {
-        storedKey = oldLegacyKey;
-        redemptionState = oldLegacyState;
-      } else {
-        // Checking the legacy marker may have refreshed a prefixed record
-        // appended by another upgraded process.
-        redemptionState = await redemption.state(cacheKey);
-      }
-    }
     if (redemptionState === 'complete') return { status: 200, body: await redemption.get(storedKey) };
     if (redemptionState === 'pending') {
       return { status: 409, body: { error: 'draw_pending', detail: 'this paid draw was already claimed; refusing to run upstream again', _bookingId: bookingId } };
@@ -388,6 +387,7 @@ export function createServeCore({
     try {
       completion = await upstream(safeRequest);
     } catch (e) {
+      if (e.name === 'TimeoutError') return { status: 503, body: { error: 'relay_timeout', _bookingId: bookingId } };
       return { status: 502, body: { error: 'upstream_error', detail: e.message } };
     }