mtok-bridge 0.3.2 → 0.3.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mtok-bridge",
-  "version": "0.3.2",
+  "version": "0.3.4",
   "description": "Serve any model as an OpenAI-compatible API with a key. No payment, no market, runs anywhere node runs. The transport core behind mtok.market's seller relay.",
   "type": "module",
   "bin": {

package/src/bridge.mjs

@@ -55,7 +55,7 @@ export async function serveChat({ body, authHeader, apiKey, models, upstream })
 // `baseUrl` is the API root (e.g. https://api.openai.com/v1 or a local model server); `key` is
 // its bearer token (optional for a keyless local server). This is what makes the bridge portable:
 // point it at a provider, or at ollama / LM Studio / vLLM on localhost.
-export function httpUpstream({ baseUrl, key }) {
+export function httpUpstream({ baseUrl, key, timeoutMs }) {
   const url = String(baseUrl || '').replace(/\/$/, '') + '/chat/completions';
   return async (payload) => {
     const res = await fetch(url, {
@@ -65,6 +65,7 @@ export function httpUpstream({ baseUrl, key }) {
         ...(key ? { authorization: `Bearer ${key}` } : {}),
       },
       body: JSON.stringify(payload),
+      ...(timeoutMs == null ? {} : { signal: AbortSignal.timeout(timeoutMs) }),
     });
     const text = await res.text();
     let json;

package/src/serve-core.mjs

@@ -243,11 +243,6 @@ export function createServeCore({
   maxOutputTokens,
 }) {
   const serve = async (body) => {
-    // #651: feeBps/feeRecipient may be getters so a long-running relay tracks a
-    // platform fee change instead of pinning the boot rate (a fee DECREASE with a
-    // stale higher rate would refuse an already-paid draw as fee_amount_too_low).
-    // Resolve once per serve and use the resolved values everywhere below.
-    const currentFeeBps = typeof feeBps === 'function' ? feeBps() : feeBps;
     const currentFeeRecipient = typeof feeRecipient === 'function' ? feeRecipient() : feeRecipient;
     const { bookingId, n, buyerId, request, requestNonce, drawPaidTxHash } = body;
     const hasRequestNonce = Object.hasOwn(body, 'requestNonce');
@@ -282,6 +277,24 @@ export function createServeCore({
       return { status: 402, body: { error: 'contract_mode_required', detail: 'this relay only serves contract-mode draws; the platform is not reporting a dripContractAddress' } };
     }
     if (!drawPaidTxHash) return { status: 402, body: { error: 'draw_payment_required', detail: 'contract mode requires drawPaidTxHash before upstream delivery' } };
+    let storedKey = cacheKey;
+    // The redemption interface may be sync (fs store) or async (a Workers KV
+    // store): await normalizes both, and identity-awaits cost nothing under the
+    // host's per-booking lock.
+    let redemptionState = await redemption.state(storedKey);
+    // Preserve an upgrade's pre-scheme redemption log; missing this alias
+    // would let a legacy paid draw run upstream again after relay upgrade.
+    if (!redemptionState && oldLegacyKey) {
+      const oldLegacyState = await redemption.state(oldLegacyKey);
+      if (oldLegacyState) {
+        storedKey = oldLegacyKey;
+        redemptionState = oldLegacyState;
+      } else {
+        // Checking the legacy marker may have refreshed a prefixed record
+        // appended by another upgraded process.
+        redemptionState = await redemption.state(cacheKey);
+      }
+    }
     let paid;
     try {
       paid = await verifier.verifyDrawPaid(drawPaidTxHash, {
@@ -295,25 +308,16 @@ export function createServeCore({
         requestHash,
         sellerWallet,
         feeRecipient: currentFeeRecipient,
-        // #580: refuse a payment older than the redemption window. The JSONL
-        // payload cache AND the claim markers are both aged out at boot (#600),
-        // so past retention this age bound is the sole replay defense (its
-        // skip-on-unreadable-block residual is named in redemption.mjs). An
-        // honest retry is seconds-to-minutes old, never days.
-        maxPaidAgeMs: redemption.retentionMs,
+        // A known claim spends no new inference. New claims need a verified
+        // age because both payload and claim markers expire after retention.
+        maxPaidAgeMs: redemptionState === 'complete' || redemptionState === 'pending' ? undefined : redemption.retentionMs,
       });
     } catch (e) {
+      if (e.name === 'TimeoutError') return { status: 503, body: { error: 'relay_timeout', _bookingId: bookingId } };
       return { status: 402, body: { error: 'payment_unverified', detail: e.message } };
     }
+    if (paid?.reason === 'payment_age_unavailable') return { status: 503, body: { error: 'payment_age_unavailable', detail: 'payment age could not be verified; retry this same paid draw', _bookingId: bookingId } };
     if (!paid?.ok) return { status: 402, body: { error: 'payment_unverified', detail: paid?.reason || 'unknown' } };
-    const expectedFee = configuredFeeAtomic({
-      sellerUsdAtomic: paid.event.sellerUsdAtomic,
-      feeAddress: currentFeeRecipient,
-      feeBps: currentFeeBps,
-    });
-    if (BigInt(paid.event.feeUsdAtomic || 0) < expectedFee) {
-      return { status: 402, body: { error: 'payment_unverified', detail: 'fee_amount_too_low' } };
-    }
     // Screen the verified payer before spending upstream capacity. The
     // payment already settled on-chain (that money is the buyer's loss);
     // this refuses the SERVICE, which is the only refusal an edge can
@@ -328,28 +332,23 @@ export function createServeCore({
         return { status: 403, body: { error: 'payer_denied', detail: 'payer screening failed: ' + e.message } };
       }
     }
-    let storedKey = cacheKey;
-    // The redemption interface may be sync (fs store) or async (a Workers KV
-    // store): await normalizes both, and identity-awaits cost nothing under the
-    // host's per-booking lock.
-    let redemptionState = await redemption.state(storedKey);
-    // Preserve an upgrade's pre-scheme redemption log; missing this alias
-    // would let a legacy paid draw run upstream again after relay upgrade.
-    if (!redemptionState && oldLegacyKey) {
-      const oldLegacyState = await redemption.state(oldLegacyKey);
-      if (oldLegacyState) {
-        storedKey = oldLegacyKey;
-        redemptionState = oldLegacyState;
-      } else {
-        // Checking the legacy marker may have refreshed a prefixed record
-        // appended by another upgraded process.
-        redemptionState = await redemption.state(cacheKey);
-      }
-    }
     if (redemptionState === 'complete') return { status: 200, body: await redemption.get(storedKey) };
     if (redemptionState === 'pending') {
       return { status: 409, body: { error: 'draw_pending', detail: 'this paid draw was already claimed; refusing to run upstream again', _bookingId: bookingId } };
     }
+    // Completed/pending claims already crossed the fee gate and cannot spend
+    // again. New claims use the policy at the verified payment time.
+    let currentFeeBps;
+    try {
+      currentFeeBps = typeof feeBps === 'function' ? await feeBps(paid) : feeBps ?? 0;
+      if (!Number.isSafeInteger(currentFeeBps) || currentFeeBps < 0 || currentFeeBps > 10_000) throw new TypeError('invalid fee rate');
+    } catch {
+      return { status: 503, body: { error: 'fee_policy_unavailable', detail: 'fee policy could not be verified; retry this same paid draw', _bookingId: bookingId } };
+    }
+    const expectedFee = configuredFeeAtomic({ sellerUsdAtomic: paid.event.sellerUsdAtomic, feeAddress: currentFeeRecipient, feeBps: currentFeeBps });
+    if (BigInt(paid.event.feeUsdAtomic || 0) < expectedFee) {
+      return { status: 402, body: { error: 'payment_unverified', detail: 'fee_amount_too_low' } };
+    }
     const paidEvent = paid.event;
     const remainingUsd = Number(paid.event.sellerUsdAtomic || 0) / 1e6;
     if (remainingUsd < BALANCE_EPSILON) {
@@ -388,6 +387,7 @@ export function createServeCore({
     try {
       completion = await upstream(safeRequest);
     } catch (e) {
+      if (e.name === 'TimeoutError') return { status: 503, body: { error: 'relay_timeout', _bookingId: bookingId } };
       return { status: 502, body: { error: 'upstream_error', detail: e.message } };
     }