mtok-relay 0.1.8 → 0.1.10

package/dist/mtok-relay.mjs

@@ -4833,6 +4833,8 @@ function createRedemptionStore({ file = null, retentionMs = DEFAULT_RETENTION_MS
   }
   return {
     durable,
+    retentionMs,
+    // the window this store is authoritative for; the runtime also uses it as the on-chain draw-age bound (#580).
     has(key) {
       return map.has(key);
     },
@@ -4930,7 +4932,9 @@ function createOnchainVerifier({
   // a few times before giving up. Bounded so a genuinely-missing tx still fails fast.
   receiptRetries = 3,
   receiptRetryMs = 700,
-  sleepImpl = (ms) => new Promise((r) => setTimeout(r, ms))
+  sleepImpl = (ms) => new Promise((r) => setTimeout(r, ms)),
+  nowMs = () => Date.now()
+  // injectable clock for the optional draw-age guard (verifyDrawPaid maxPaidAgeMs).
 } = {}) {
   const urls = (rpcUrls?.length ? rpcUrls : String(rpcUrl || "").split(",")).map((s) => String(s).trim()).filter(Boolean);
   const configured = Boolean(urls.length && usdcAddress);
@@ -4992,7 +4996,7 @@ function createOnchainVerifier({
     for (let i = 0; i < logs.length; i++) {
       if (consumed && consumed.has(i)) continue;
       const l = logs[i];
-      if (lc(l.address) !== usdc || l.topics?.[0] !== TRANSFER_TOPIC || l.topics.length !== 3) continue;
+      if (lc(l.address) !== usdc || lc(l.topics?.[0]) !== TRANSFER_TOPIC || l.topics.length !== 3) continue;
       if (topicToAddress(l.topics[2]) !== want) continue;
       if (wantFrom && topicToAddress(l.topics[1]) !== wantFrom) continue;
       sawRecipient = true;
@@ -5029,22 +5033,51 @@ function createOnchainVerifier({
       requestHash,
       sellerWallet,
       feeRecipient,
-      minSellerAtomic = 0n
+      minSellerAtomic = 0n,
+      // Optional draw-age guard (#580). A DrawPaid receipt is a PERMANENT chain fact, so a
+      // buyer who holds the request preimage can replay the same /chunk body long after
+      // paying; if the relay's local redemption record was pruned (retention lapse) or lost
+      // (in-memory restart), served.has() misses and a stale payment buys a fresh inference.
+      // When set, refuse a payment whose block is older than maxPaidAgeMs: a legitimate
+      // first-serve or honest retry happens seconds-to-minutes after payDraw, never days.
+      maxPaidAgeMs
     } = {}) {
       if (!await assertChain()) return { ok: false, reason: "wrong_chain" };
       const contract = lc(contractAddress);
       if (!contract) return { ok: false, reason: "contract_not_configured" };
       const got = await fetchReceipt(txHash);
       if (got.error) return { ok: false, reason: got.error };
-      const log = (got.receipt.logs || []).find(
+      const drawLogs = (got.receipt.logs || []).filter(
         (l) => lc(l.address) === contract && isDrawPaidTopic(l.topics?.[0])
       );
-      if (!log) return { ok: false, reason: "no_draw_paid_event" };
-      let event;
-      try {
-        event = decodeDrawPaidLog(log);
-      } catch {
-        return { ok: false, reason: "malformed_draw_paid_event" };
+      if (!drawLogs.length) return { ok: false, reason: "no_draw_paid_event" };
+      let event = null;
+      let matchedLog = null;
+      let sawDecodable = false;
+      for (const l of drawLogs) {
+        let e;
+        try {
+          e = decodeDrawPaidLog(l);
+        } catch {
+          continue;
+        }
+        sawDecodable = true;
+        if (bookingId != null && e.bookingId !== String(bookingId)) continue;
+        if (n != null && e.n !== Number(n)) continue;
+        event = e;
+        matchedLog = l;
+        break;
+      }
+      if (!event) {
+        if (!sawDecodable) return { ok: false, reason: "malformed_draw_paid_event" };
+        for (const l of drawLogs) {
+          try {
+            event = decodeDrawPaidLog(l);
+            matchedLog = l;
+            break;
+          } catch {
+          }
+        }
       }
       if (buyerAgentId != null && event.buyerAgentId !== String(buyerAgentId)) return { ok: false, reason: "buyer_agent_mismatch" };
       if (sellerAgentId != null && event.sellerAgentId !== String(sellerAgentId)) return { ok: false, reason: "seller_agent_mismatch" };
@@ -5054,6 +5087,26 @@ function createOnchainVerifier({
       if (n != null && event.n !== Number(n)) return { ok: false, reason: "draw_n_mismatch" };
       if (requestHash != null && lc(event.requestHash) !== lc(requestHash)) return { ok: false, reason: "request_hash_mismatch" };
       if (BigInt(event.sellerUsdAtomic) < BigInt(minSellerAtomic)) return { ok: false, reason: "amount_too_low" };
+      const maxAge = Number(maxPaidAgeMs);
+      if (Number.isFinite(maxAge) && maxAge > 0) {
+        const bn = matchedLog?.blockNumber;
+        let paidAtMs = null;
+        if (bn != null) {
+          const blockTag = typeof bn === "string" && bn.startsWith("0x") ? bn : "0x" + BigInt(bn).toString(16);
+          for (let i = 0; i <= receiptRetries; i++) {
+            try {
+              const block = await rpc("eth_getBlockByNumber", [blockTag, false]);
+              if (block?.timestamp != null) {
+                paidAtMs = Number(BigInt(block.timestamp)) * 1e3;
+                break;
+              }
+            } catch {
+            }
+            if (i < receiptRetries) await sleepImpl(receiptRetryMs);
+          }
+        }
+        if (paidAtMs != null && nowMs() - paidAtMs > maxAge) return { ok: false, reason: "payment_too_old" };
+      }
       const consumed = /* @__PURE__ */ new Set();
       let sellerTransfer = null;
       if (sellerWallet) {
@@ -5169,7 +5222,12 @@ async function createRelayRuntime(config) {
           n,
           requestHash,
           sellerWallet: config.settlementAddr,
-          feeRecipient: platform.feeAddress
+          feeRecipient: platform.feeAddress,
+          // #580: refuse a payment older than the redemption window. served.has() is the
+          // primary one-serve guard, but it's pruned by age and lost on an in-memory restart;
+          // this on-chain age bound closes the re-serve hole those cases open (a stale replay
+          // buying a fresh inference). An honest retry is seconds-to-minutes old, never days.
+          maxPaidAgeMs: served.retentionMs
         });
       } catch (e) {
         return send(res, 402, { error: "payment_unverified", detail: e.message });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mtok-relay",
-  "version": "0.1.8",
+  "version": "0.1.10",
   "description": "Reference seller relay for mtok.market — accepts on-chain-prepaid chunk draws and serves inference from an upstream you control. Run with: npx mtok-relay --offer <id> --model <id> --upstream <url>.",
   "type": "module",
   "bin": {