mtok-relay 0.1.10 → 0.2.0

package/README.md

@@ -2,7 +2,7 @@
 
 Reference seller relay for [mtok.market](https://mtok.market). Run with:
 
-    npx mtok-relay --offer <id> --model <id> --upstream <url>
+    npx mtok-relay --offer <id> --model <id> --upstream <url> --out-price <positive-usd-per-MTok>
 
 
 ---

package/dist/mtok-relay.mjs

@@ -2157,7 +2157,7 @@ var secp256k1 = createCurve({
 }, sha256);
 
 // node_modules/viem/_esm/errors/version.js
-var version = "2.54.6";
+var version = "2.55.0";
 
 // node_modules/viem/_esm/errors/base.js
 var errorConfig = {
@@ -4646,15 +4646,22 @@ function readRelayConfig({ argv = process.argv.slice(2), env = process.env } = {
   const rpcFlag = flag(argv, "--rpc");
   const settlementPubkeyFlag = flag(argv, "--settlement-pubkey");
   const sellerAgentId = flag(argv, "--seller-agent");
-  const outPrice = Number(flag(argv, "--out-price") ?? 0);
+  const outPrice = Number(flag(argv, "--out-price"));
   const inPrice = Number(flag(argv, "--in-price") ?? outPrice);
   const redemptionFlag = flag(argv, "--redemption-file") ?? env.RELAY_REDEMPTION_FILE;
-  const redemptionFile = redemptionFlag === void 0 ? "./.mtok-redemption.jsonl" : redemptionFlag || null;
+  if (redemptionFlag === "") throw new Error("--redemption-file cannot be empty; paid serves require durable redemption");
+  const redemptionFile = redemptionFlag === void 0 ? "./.mtok-redemption.jsonl" : redemptionFlag;
   const denylistRaw = flag(argv, "--payer-denylist") ?? env.RELAY_PAYER_DENYLIST ?? "";
   const payerDenylist = String(denylistRaw).split(",").map((a) => a.trim().toLowerCase()).filter(Boolean);
   if (!offerId) throw new Error("--offer <id> is required");
   if (!model) throw new Error("--model <id> is required (the offer model you serve)");
   if (!upstream) throw new Error("--upstream <url> is required");
+  if (!Number.isFinite(outPrice) || outPrice <= 0) {
+    throw new Error("--out-price <usd/MTok> is required and must be finite and positive");
+  }
+  if (!Number.isFinite(inPrice) || inPrice <= 0) {
+    throw new Error("--in-price <usd/MTok> must be finite and positive");
+  }
   const mtokApiKey = env.MTOK_API_KEY;
   const upstreamKey = env.UPSTREAM_KEY;
   const relayWalletKey = env.RELAY_WALLET_KEY;
@@ -4781,56 +4788,143 @@ function configuredFeeAtomic({ sellerUsdAtomic, feeAddress, feeBps }) {
   if (!feeAddress || bps === 0n) return 0n;
   return (BigInt(sellerUsdAtomic || 0) * bps + 5000n) / 10000n;
 }
-var CHARS_PER_TOKEN_EST = 3.2;
+var MESSAGE_OVERHEAD_TOKENS = 4;
 function estimateInputTokens(messages) {
-  let chars = 0;
+  const utf8 = new TextEncoder();
+  let tokens = 3;
   for (const m of messages ?? []) {
-    const c = m?.content;
-    if (typeof c === "string") chars += c.length;
-    else if (Array.isArray(c)) for (const part of c) chars += String(part?.text ?? "").length;
+    tokens += MESSAGE_OVERHEAD_TOKENS;
+    tokens += utf8.encode(String(m?.role ?? "")).length;
+    tokens += utf8.encode(typeof m?.content === "string" ? m.content : JSON.stringify(m?.content ?? null)).length;
   }
-  return Math.ceil(chars / CHARS_PER_TOKEN_EST);
+  return tokens;
 }
 function boundServe({ messages, budgetUsd, inPrice, outPrice, reqMax, contextCeil = 4096 }) {
   const estIn = estimateInputTokens(messages);
   const estInCostUsd = estIn * (Number(inPrice) > 0 ? Number(inPrice) : 0) / 1e6;
-  if (estInCostUsd >= budgetUsd) return { refuse: true, estIn, estInCostUsd };
+  if (estInCostUsd >= budgetUsd) return { refuse: true, reason: "input", estIn, estInCostUsd };
   const outBudgetUsd = budgetUsd - estInCostUsd;
   let maxTok = contextCeil;
   if (Number(reqMax) > 0) maxTok = Math.min(maxTok, Math.floor(Number(reqMax)));
-  if (Number(outPrice) > 0) maxTok = Math.min(maxTok, Math.floor(outBudgetUsd / Number(outPrice) * 1e6));
-  return { refuse: false, maxTok: Math.max(1, maxTok), estIn, estInCostUsd };
+  if (!Number.isFinite(Number(outPrice)) || Number(outPrice) <= 0) {
+    return { refuse: true, reason: "output_price", estIn, estInCostUsd };
+  }
+  maxTok = Math.min(maxTok, Math.floor(outBudgetUsd / Number(outPrice) * 1e6));
+  if (maxTok < 1) return { refuse: true, reason: "output", estIn, estInCostUsd };
+  return { refuse: false, maxTok, estIn, estInCostUsd };
 }
 
 // src/redemption.mjs
 import fs from "node:fs";
+import crypto2 from "node:crypto";
 var DEFAULT_RETENTION_MS = 7 * 24 * 60 * 60 * 1e3;
 function createRedemptionStore({ file = null, retentionMs = DEFAULT_RETENTION_MS, now = () => Date.now(), log = console } = {}) {
   const map = /* @__PURE__ */ new Map();
+  const claimsDir = file ? `${file}.claims` : null;
   let durable = false;
+  let seenVersion = null;
+  const recordFor = (key, entry) => ({
+    k: key,
+    at: entry.at,
+    state: entry.state,
+    ...entry.state === "complete" ? { payload: entry.payload } : {}
+  });
+  const syncWrite = (target, flags, data) => {
+    const fd = fs.openSync(target, flags);
+    try {
+      fs.writeFileSync(fd, data);
+      fs.fsyncSync(fd);
+    } finally {
+      fs.closeSync(fd);
+    }
+  };
+  const readRecords = () => {
+    const loaded = /* @__PURE__ */ new Map();
+    if (!fs.existsSync(file)) return loaded;
+    const cutoff = now() - retentionMs;
+    let lineNumber = 0;
+    for (const line of fs.readFileSync(file, "utf8").split("\n")) {
+      lineNumber += 1;
+      if (!line.trim()) continue;
+      let parsed;
+      try {
+        parsed = JSON.parse(line);
+      } catch {
+        throw new Error(`malformed redemption record at line ${lineNumber}`);
+      }
+      const { k, at } = parsed;
+      if (typeof k !== "string" || !k || !Number.isFinite(Number(at))) {
+        throw new Error(`malformed redemption record at line ${lineNumber}`);
+      }
+      if (Number(at) < cutoff) continue;
+      const state2 = parsed.state === "pending" ? "pending" : "complete";
+      loaded.set(k, { state: state2, at: Number(at), ...state2 === "complete" ? { payload: parsed.payload } : {} });
+    }
+    return loaded;
+  };
+  const fileVersion = () => {
+    try {
+      const stat = fs.statSync(file);
+      return `${stat.dev}:${stat.ino}:${stat.size}:${stat.mtimeMs}`;
+    } catch {
+      return null;
+    }
+  };
   if (file) {
     try {
-      if (fs.existsSync(file)) {
-        const cutoff = now() - retentionMs;
-        for (const line of fs.readFileSync(file, "utf8").split("\n")) {
-          if (!line.trim()) continue;
-          try {
-            const { k, at, payload } = JSON.parse(line);
-            if (k && Number(at) >= cutoff) map.set(k, { payload, at: Number(at) });
-          } catch {
-          }
-        }
+      for (const [key, entry] of readRecords()) map.set(key, entry);
+      const compact = `${file}.tmp-${process.pid}-${Math.random().toString(36).slice(2)}`;
+      try {
+        syncWrite(compact, "w", [...map].map(([k, e]) => JSON.stringify(recordFor(k, e))).join("\n") + (map.size ? "\n" : ""));
+        fs.renameSync(compact, file);
+      } finally {
+        fs.rmSync(compact, { force: true });
       }
-      fs.writeFileSync(file, [...map].map(([k, e]) => JSON.stringify({ k, at: e.at, payload: e.payload })).join("\n") + (map.size ? "\n" : ""));
+      fs.mkdirSync(claimsDir, { recursive: true });
       durable = true;
+      seenVersion = fileVersion();
       log.log?.(`mtok-relay: durable redemption at ${file} (${map.size} entries loaded)`);
     } catch (e) {
-      log.warn?.(`mtok-relay: redemption file ${file} not writable (${e.message}); redemption is IN-MEMORY ONLY, a restart can re-serve a paid draw (#495). Point --redemption-file at a durable path.`);
+      map.clear();
+      log.warn?.(`mtok-relay: redemption file ${file} not writable (${e.message}); paid serves will fail closed. Point --redemption-file at a durable path.`);
       durable = false;
     }
   } else {
-    log.warn?.("mtok-relay: no --redemption-file, redemption is IN-MEMORY ONLY, a restart or long idle can re-serve one payment for a fresh inference (#495). Set --redemption-file to a durable path.");
+    log.warn?.("mtok-relay: no --redemption-file; paid serves will fail closed because a claim cannot be persisted. Set --redemption-file to a durable path.");
   }
+  const append = (key, entry) => {
+    if (!durable) throw new Error("durable redemption unavailable");
+    syncWrite(file, "a", JSON.stringify(recordFor(key, entry)) + "\n");
+    seenVersion = fileVersion();
+  };
+  const markerFor = (key) => `${claimsDir}/${crypto2.createHash("sha256").update(String(key)).digest("hex")}`;
+  const markClaimed = (key) => {
+    if (!durable) throw new Error("durable redemption unavailable");
+    const marker = markerFor(key);
+    try {
+      syncWrite(marker, "wx", String(key) + "\n");
+      return true;
+    } catch (e) {
+      if (e?.code === "EEXIST") return false;
+      throw e;
+    }
+  };
+  const refresh = () => {
+    if (!durable) return;
+    const version2 = fileVersion();
+    if (!version2 || version2 === seenVersion) return;
+    try {
+      for (const [key, entry] of readRecords()) map.set(key, entry);
+      seenVersion = version2;
+    } catch (e) {
+      log.warn?.(`mtok-relay: could not refresh redemption file ${file} (${e.message}); keeping the existing fail-closed state`);
+    }
+  };
+  const state = (key) => {
+    const current = map.get(key)?.state;
+    if (durable && (!current || current === "pending")) refresh();
+    return map.get(key)?.state ?? null;
+  };
   return {
     durable,
     retentionMs,
@@ -4838,18 +4932,30 @@ function createRedemptionStore({ file = null, retentionMs = DEFAULT_RETENTION_MS
     has(key) {
       return map.has(key);
     },
+    state,
     get(key) {
-      return map.get(key)?.payload;
+      return state(key) === "complete" ? map.get(key).payload : void 0;
+    },
+    claim(key, markerKey = key) {
+      if (map.has(key)) return false;
+      if (!markClaimed(markerKey)) return false;
+      const entry = { state: "pending", at: now() };
+      append(key, entry);
+      map.set(key, entry);
+      return true;
+    },
+    complete(key, payload) {
+      if (map.get(key)?.state !== "pending") throw new Error("redemption is not pending");
+      const entry = { state: "complete", payload, at: now() };
+      append(key, entry);
+      map.set(key, entry);
     },
+    // Backward-compatible store API for callers which only persist completed
+    // payloads. The relay runtime itself always uses claim() then complete().
     set(key, payload) {
-      const at = now();
-      map.set(key, { payload, at });
-      if (durable) {
-        try {
-          fs.appendFileSync(file, JSON.stringify({ k: key, at, payload }) + "\n");
-        } catch {
-        }
-      }
+      const entry = { state: "complete", payload, at: now() };
+      if (durable) append(key, entry);
+      map.set(key, entry);
     }
   };
 }
@@ -5162,11 +5268,85 @@ var BASE_SEPOLIA_RPCS = [
 var rpcUrlsFor = (chainId, override) => override ? [override] : Number(chainId) === 8453 ? BASE_MAINNET_RPCS : BASE_SEPOLIA_RPCS;
 
 // src/runtime.mjs
-import crypto2 from "node:crypto";
+import crypto3 from "node:crypto";
 var BALANCE_EPSILON = 1e-6;
-var hash32 = (v) => "0x" + crypto2.createHash("sha256").update(typeof v === "string" ? v : JSON.stringify(v ?? null)).digest("hex");
+var hash32 = (v) => "0x" + crypto3.createHash("sha256").update(typeof v === "string" ? v : JSON.stringify(v ?? null)).digest("hex");
+var REQUEST_NONCE_RE = /^0x[0-9a-fA-F]{32}$/;
+var CHAT_ROLES = /* @__PURE__ */ new Set(["developer", "system", "user", "assistant"]);
+var REQUEST_KEYS = /* @__PURE__ */ new Set(["model", "messages", "max_tokens", "temperature", "response_format", "stream", "n"]);
+function legacyContentText(content) {
+  const render = (part) => {
+    if (typeof part === "string") return part;
+    if (Array.isArray(part)) return part.map(render).filter(Boolean).join("\n");
+    if (part == null) return "";
+    if (typeof part !== "object") return String(part);
+    if (typeof part.text === "string") return part.text;
+    if (typeof part.content === "string") return part.content;
+    const type = typeof part.type === "string" && /^[a-z0-9_-]{1,32}$/i.test(part.type) ? part.type : "non-text";
+    return `[${type} omitted]`;
+  };
+  return render(content) || "[empty legacy content]";
+}
+function sanitizeLegacyMessage(message) {
+  const source = message && typeof message === "object" && !Array.isArray(message) ? message : { content: message };
+  if (CHAT_ROLES.has(source.role)) return { role: source.role, content: legacyContentText(source.content) };
+  const label = source.role === "tool" || source.role === "function" ? source.role : "legacy";
+  return { role: "user", content: `[${label} message]
+${legacyContentText(source.content)}` };
+}
+function validateRequest(request, model, { legacy = false } = {}) {
+  if (!request || typeof request !== "object" || Array.isArray(request)) {
+    return { error: "request must be an object" };
+  }
+  const unknown = Object.keys(request).find((key) => !REQUEST_KEYS.has(key));
+  if (unknown && !legacy) return { error: `unsupported request field: ${unknown}` };
+  if (!legacy && request.model != null && String(request.model) !== String(model)) {
+    return { error: `request model ${request.model} is not served here` };
+  }
+  if (!Array.isArray(request.messages) || request.messages.length === 0) {
+    return { error: "request.messages must be a nonempty array" };
+  }
+  if (!legacy) {
+    for (const message of request.messages) {
+      if (!message || typeof message !== "object" || Array.isArray(message)) {
+        return { error: "each message must be an object" };
+      }
+      const extra = Object.keys(message).find((key) => key !== "role" && key !== "content");
+      if (extra) return { error: `unsupported message field: ${extra}` };
+      if (!CHAT_ROLES.has(message.role)) return { error: `unsupported message role: ${message.role}` };
+      if (typeof message.content !== "string") return { error: "message content must be plain text" };
+    }
+  }
+  if (!legacy && request.stream != null && request.stream !== false) return { error: "streaming is not supported" };
+  if (!legacy && request.n != null && request.n !== 1) return { error: "request.n must be 1" };
+  const validMaxTokens = Number.isInteger(request.max_tokens) && request.max_tokens > 0;
+  if (!legacy && request.max_tokens != null && !validMaxTokens) {
+    return { error: "max_tokens must be a positive integer" };
+  }
+  const validTemperature = Number.isFinite(request.temperature) && request.temperature >= 0 && request.temperature <= 2;
+  if (!legacy && request.temperature != null && !validTemperature) {
+    return { error: "temperature must be between 0 and 2" };
+  }
+  let validResponseFormat = false;
+  if (request.response_format != null) {
+    const format = request.response_format;
+    validResponseFormat = !!format && typeof format === "object" && !Array.isArray(format) && Object.keys(format).length === 1 && ["json_object", "text"].includes(format.type);
+    if (!legacy && !validResponseFormat) {
+      return { error: 'response_format must be exactly { type: "json_object" } or { type: "text" }' };
+    }
+  }
+  return {
+    safeRequest: {
+      model,
+      messages: legacy ? request.messages.map(sanitizeLegacyMessage) : request.messages.map(({ role, content }) => ({ role, content })),
+      ...validMaxTokens ? { max_tokens: request.max_tokens } : {},
+      ...validTemperature ? { temperature: request.temperature } : {},
+      ...validResponseFormat ? { response_format: { type: request.response_format.type } } : {}
+    }
+  };
+}
 async function createRelayRuntime(config) {
-  const served = createRedemptionStore({ file: config.redemptionFile });
+  const served = createRedemptionStore({ file: config.redemptionFile, log: config.log });
   const drawLocks = /* @__PURE__ */ new Map();
   const platform = await fetchPlatformConfig(config);
   const verifier = createOnchainVerifier({ rpcUrls: rpcUrlsFor(platform.chainId, config.rpcFlag), usdcAddress: platform.usdcAddress, expectedChainId: platform.chainId });
@@ -5199,12 +5379,23 @@ async function createRelayRuntime(config) {
     }
   };
   const handleDraw = async (body, res) => {
-    const { bookingId, n, buyerId, request, drawPaidTxHash } = body;
+    const { bookingId, n, buyerId, request, requestNonce, drawPaidTxHash } = body;
+    const hasRequestNonce = Object.hasOwn(body, "requestNonce");
     if (!bookingId) return send(res, 400, { error: "bad_request", detail: "DRAW needs bookingId" });
     if (n == null) return send(res, 400, { error: "bad_request", detail: "DRAW needs a delivery index n (per-booking idempotency key)" });
+    if (!Number.isSafeInteger(n) || n < 0 || n > 4294967295) {
+      return send(res, 400, { error: "bad_request", detail: "DRAW delivery index n must be a nonnegative uint32 integer" });
+    }
+    if (hasRequestNonce && !REQUEST_NONCE_RE.test(requestNonce)) {
+      return send(res, 400, { error: "bad_request", detail: "DRAW needs requestNonce as 16 random bytes encoded as 0x-prefixed hex" });
+    }
+    const checked = validateRequest(request, config.model, { legacy: !hasRequestNonce });
+    if (checked.error) return send(res, 400, { error: "bad_request", detail: checked.error });
     return withBookingLock(bookingId, async () => {
-      const requestHash = hash32(request);
-      const cacheKey = `${bookingId}:${n}:${requestHash}`;
+      const requestHashScheme = hasRequestNonce ? "nonce-v1" : "legacy-v0";
+      const requestHash = hasRequestNonce ? hash32({ request, requestNonce }) : hash32(request);
+      const cacheKey = `${requestHashScheme}:${bookingId}:${n}:${requestHash}`;
+      const oldLegacyKey = hasRequestNonce ? null : `${bookingId}:${n}:${requestHash}`;
       if (!platform.dripContractAddress) {
         return send(res, 402, { error: "contract_mode_required", detail: "this relay only serves contract-mode draws; the platform is not reporting a dripContractAddress" });
       }
@@ -5223,10 +5414,9 @@ async function createRelayRuntime(config) {
           requestHash,
           sellerWallet: config.settlementAddr,
           feeRecipient: platform.feeAddress,
-          // #580: refuse a payment older than the redemption window. served.has() is the
-          // primary one-serve guard, but it's pruned by age and lost on an in-memory restart;
-          // this on-chain age bound closes the re-serve hole those cases open (a stale replay
-          // buying a fresh inference). An honest retry is seconds-to-minutes old, never days.
+          // #580: refuse a payment older than the redemption window. The JSONL
+          // payload cache is compacted by age (exclusive claim markers remain
+          // fail-closed), and an honest retry is seconds-to-minutes old, never days.
           maxPaidAgeMs: served.retentionMs
         });
       } catch (e) {
@@ -5248,19 +5438,43 @@ async function createRelayRuntime(config) {
       } catch (e) {
         return send(res, 403, { error: "payer_denied", detail: "payer screening failed: " + e.message });
       }
-      if (served.has(cacheKey)) return send(res, 200, served.get(cacheKey));
+      let storedKey = cacheKey;
+      let redemptionState = served.state(storedKey);
+      if (!redemptionState && oldLegacyKey) {
+        const oldLegacyState = served.state(oldLegacyKey);
+        if (oldLegacyState) {
+          storedKey = oldLegacyKey;
+          redemptionState = oldLegacyState;
+        } else {
+          redemptionState = served.state(cacheKey);
+        }
+      }
+      if (redemptionState === "complete") return send(res, 200, served.get(storedKey));
+      if (redemptionState === "pending") {
+        return send(res, 409, { error: "draw_pending", detail: "this paid draw was already claimed; refusing to run upstream again", _bookingId: bookingId });
+      }
       const paidEvent = paid.event;
       const remainingUsd = Number(paid.event.sellerUsdAtomic || 0) / 1e6;
-      if (remainingUsd <= BALANCE_EPSILON) {
+      if (remainingUsd < BALANCE_EPSILON) {
         return send(res, 402, { error: "balance_exhausted", detail: `remainingUsd=${remainingUsd}`, _bookingId: bookingId, remainingUsd });
       }
       const eventInPriceUsd = Number(paidEvent.inputPricePerMTokAtomic || 0) / 1e6;
+      const eventOutPriceUsd = Number(paidEvent.outputPricePerMTokAtomic || 0) / 1e6;
       const inPrice = Math.max(Number(config.inPrice) || 0, eventInPriceUsd);
-      const bound = boundServe({ messages: request?.messages, budgetUsd: remainingUsd, inPrice, outPrice: config.outPrice, reqMax: Number(request?.max_tokens) });
+      const outPrice = Math.max(Number(config.outPrice) || 0, eventOutPriceUsd);
+      const bound = boundServe({ messages: checked.safeRequest.messages, budgetUsd: remainingUsd, inPrice, outPrice, reqMax: checked.safeRequest.max_tokens });
       if (bound.refuse) {
-        return send(res, 402, { error: "input_too_large", detail: `estimated input (~${bound.estIn} tokens, $${bound.estInCostUsd.toFixed(6)}) meets or exceeds the paid amount ($${remainingUsd}); send a shorter prompt or pay for more`, _bookingId: bookingId, remainingUsd });
+        const error = bound.reason === "input" ? "input_too_large" : "output_unfunded";
+        return send(res, 402, { error, detail: `estimated input (~${bound.estIn} tokens, $${bound.estInCostUsd.toFixed(6)}) leaves no safely funded output in the paid amount ($${remainingUsd})`, _bookingId: bookingId, remainingUsd });
+      }
+      const safeRequest = { ...checked.safeRequest, model: config.model, max_tokens: bound.maxTok };
+      try {
+        if (!served.claim(cacheKey, oldLegacyKey ?? cacheKey)) {
+          return send(res, 409, { error: "draw_pending", detail: "this paid draw was already claimed; refusing to run upstream again", _bookingId: bookingId });
+        }
+      } catch (e) {
+        return send(res, 503, { error: "redemption_unavailable", detail: `could not durably claim the paid draw: ${e.message}`, _bookingId: bookingId });
       }
-      const safeRequest = { ...request, max_tokens: bound.maxTok };
       let completion;
       try {
         completion = await upstream(safeRequest);
@@ -5277,7 +5491,11 @@ async function createRelayRuntime(config) {
       const outTok = Number(usage.completion_tokens ?? usage.output_tokens ?? 0) || 0;
       const usedUsd = (inTok * Number(paidEvent.inputPricePerMTokAtomic || 0) + outTok * Number(paidEvent.outputPricePerMTokAtomic || 0)) / 1e12;
       const payload = { ...completion, _bookingId: bookingId, remainingUsd: Math.max(0, Math.round((remainingUsd - usedUsd) * 1e6) / 1e6) };
-      served.set(cacheKey, payload);
+      try {
+        served.complete(cacheKey, payload);
+      } catch (e) {
+        (config.log ?? console).error?.(`mtok-relay: completion for ${cacheKey} could not be persisted (${e.message}); retries will remain pending`);
+      }
       return send(res, 200, payload);
     });
   };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "mtok-relay",
-  "version": "0.1.10",
-  "description": "Reference seller relay for mtok.market — accepts on-chain-prepaid chunk draws and serves inference from an upstream you control. Run with: npx mtok-relay --offer <id> --model <id> --upstream <url>.",
+  "version": "0.2.0",
+  "description": "Reference seller relay for mtok.market — accepts on-chain-prepaid chunk draws and serves inference from an upstream you control.",
   "type": "module",
   "bin": {
     "mtok-relay": "dist/mtok-relay.mjs"