mtok-relay 0.2.0 → 0.2.2

package/dist/mtok-relay.mjs

@@ -3,7 +3,7 @@
 
 // node_modules/@noble/hashes/esm/cryptoNode.js
 import * as nc from "node:crypto";
-var crypto = nc && typeof nc === "object" && "webcrypto" in nc ? nc.webcrypto : nc && typeof nc === "object" && "randomBytes" in nc ? nc : void 0;
+var crypto2 = nc && typeof nc === "object" && "webcrypto" in nc ? nc.webcrypto : nc && typeof nc === "object" && "randomBytes" in nc ? nc : void 0;
 
 // node_modules/@noble/hashes/esm/utils.js
 function isBytes(a) {
@@ -100,11 +100,11 @@ function createHasher(hashCons) {
   return hashC;
 }
 function randomBytes(bytesLength = 32) {
-  if (crypto && typeof crypto.getRandomValues === "function") {
-    return crypto.getRandomValues(new Uint8Array(bytesLength));
+  if (crypto2 && typeof crypto2.getRandomValues === "function") {
+    return crypto2.getRandomValues(new Uint8Array(bytesLength));
   }
-  if (crypto && typeof crypto.randomBytes === "function") {
-    return Uint8Array.from(crypto.randomBytes(bytesLength));
+  if (crypto2 && typeof crypto2.randomBytes === "function") {
+    return Uint8Array.from(crypto2.randomBytes(bytesLength));
   }
   throw new Error("crypto.getRandomValues must be defined");
 }
@@ -2016,14 +2016,14 @@ function weierstrass(curveDef) {
     const sg = signature;
     msgHash = ensureBytes("msgHash", msgHash);
     publicKey = ensureBytes("publicKey", publicKey);
-    const { lowS, prehash, format } = opts;
+    const { lowS, prehash, format: format2 } = opts;
     validateSigVerOpts(opts);
     if ("strict" in opts)
       throw new Error("options.strict was renamed to lowS");
-    if (format !== void 0 && format !== "compact" && format !== "der")
+    if (format2 !== void 0 && format2 !== "compact" && format2 !== "der")
       throw new Error("format must be compact or der");
     const isHex2 = typeof sg === "string" || isBytes2(sg);
-    const isObj = !isHex2 && !format && typeof sg === "object" && sg !== null && typeof sg.r === "bigint" && typeof sg.s === "bigint";
+    const isObj = !isHex2 && !format2 && typeof sg === "object" && sg !== null && typeof sg.r === "bigint" && typeof sg.s === "bigint";
     if (!isHex2 && !isObj)
       throw new Error("invalid signature, expected Uint8Array, hex string or Signature instance");
     let _sig = void 0;
@@ -2033,13 +2033,13 @@ function weierstrass(curveDef) {
         _sig = new Signature(sg.r, sg.s);
       if (isHex2) {
         try {
-          if (format !== "compact")
+          if (format2 !== "compact")
             _sig = Signature.fromDER(sg);
         } catch (derError) {
           if (!(derError instanceof DER.Err))
             throw derError;
         }
-        if (!_sig && format !== "der")
+        if (!_sig && format2 !== "der")
           _sig = Signature.fromCompact(sg);
       }
       P = Point.fromHex(publicKey);
@@ -2157,7 +2157,7 @@ var secp256k1 = createCurve({
 }, sha256);
 
 // node_modules/viem/_esm/errors/version.js
-var version = "2.55.0";
+var version = "2.55.10";
 
 // node_modules/viem/_esm/errors/base.js
 var errorConfig = {
@@ -3215,14 +3215,17 @@ async function signMessage({ message, privateKey }) {
   return await sign({ hash: hashMessage(message), privateKey, to: "hex" });
 }
 
-// node_modules/viem/_esm/constants/unit.js
-var gweiUnits = {
-  ether: -9,
-  wei: 9
+// node_modules/viem/_esm/utils/unit/Value.js
+var exponents = {
+  wei: 0,
+  gwei: 9,
+  szabo: 12,
+  finney: 15,
+  ether: 18
 };
-
-// node_modules/viem/_esm/utils/unit/formatUnits.js
-function formatUnits(value, decimals) {
+function format(value, decimals = 0) {
+  if (!Number.isInteger(decimals) || decimals < 0)
+    throw new InvalidDecimalsError({ decimals });
   let display = value.toString();
   const negative = display.startsWith("-");
   if (negative)
@@ -3235,10 +3238,24 @@ function formatUnits(value, decimals) {
   fraction = fraction.replace(/(0+)$/, "");
   return `${negative ? "-" : ""}${integer || "0"}${fraction ? `.${fraction}` : ""}`;
 }
+function formatGwei(wei, unit = "wei") {
+  return format(wei, exponents.gwei - exponents[unit]);
+}
+var InvalidDecimalsError = class extends Error {
+  constructor({ decimals }) {
+    super(`\`decimals\` must be a non-negative integer. Got \`${decimals}\`.`);
+    Object.defineProperty(this, "name", {
+      enumerable: true,
+      configurable: true,
+      writable: true,
+      value: "Value.InvalidDecimalsError"
+    });
+  }
+};
 
 // node_modules/viem/_esm/utils/unit/formatGwei.js
-function formatGwei(wei, unit = "wei") {
-  return formatUnits(wei, gweiUnits[unit]);
+function formatGwei2(wei, unit = "wei") {
+  return formatGwei(wei, unit);
 }
 
 // node_modules/viem/_esm/errors/transaction.js
@@ -3591,7 +3608,7 @@ Object.defineProperty(ExecutionRevertedError, "nodeMessage", {
 });
 var FeeCapTooHighError = class extends BaseError {
   constructor({ cause, maxFeePerGas } = {}) {
-    super(`The fee cap (\`maxFeePerGas\`${maxFeePerGas ? ` = ${formatGwei(maxFeePerGas)} gwei` : ""}) cannot be higher than the maximum allowed value (2^256-1).`, {
+    super(`The fee cap (\`maxFeePerGas\`${maxFeePerGas ? ` = ${formatGwei2(maxFeePerGas)} gwei` : ""}) cannot be higher than the maximum allowed value (2^256-1).`, {
       cause,
       name: "FeeCapTooHighError"
     });
@@ -3605,7 +3622,7 @@ Object.defineProperty(FeeCapTooHighError, "nodeMessage", {
 });
 var FeeCapTooLowError = class extends BaseError {
   constructor({ cause, maxFeePerGas } = {}) {
-    super(`The fee cap (\`maxFeePerGas\`${maxFeePerGas ? ` = ${formatGwei(maxFeePerGas)}` : ""} gwei) cannot be lower than the block base fee.`, {
+    super(`The fee cap (\`maxFeePerGas\`${maxFeePerGas ? ` = ${formatGwei2(maxFeePerGas)}` : ""} gwei) cannot be lower than the block base fee.`, {
       cause,
       name: "FeeCapTooLowError"
     });
@@ -3724,7 +3741,7 @@ Object.defineProperty(TransactionTypeNotSupportedError, "nodeMessage", {
 var TipAboveFeeCapError = class extends BaseError {
   constructor({ cause, maxPriorityFeePerGas, maxFeePerGas } = {}) {
     super([
-      `The provided tip (\`maxPriorityFeePerGas\`${maxPriorityFeePerGas ? ` = ${formatGwei(maxPriorityFeePerGas)} gwei` : ""}) cannot be higher than the fee cap (\`maxFeePerGas\`${maxFeePerGas ? ` = ${formatGwei(maxFeePerGas)} gwei` : ""}).`
+      `The provided tip (\`maxPriorityFeePerGas\`${maxPriorityFeePerGas ? ` = ${formatGwei2(maxPriorityFeePerGas)} gwei` : ""}) cannot be higher than the fee cap (\`maxFeePerGas\`${maxFeePerGas ? ` = ${formatGwei2(maxFeePerGas)} gwei` : ""}).`
     ].join("\n"), {
       cause,
       name: "TipAboveFeeCapError"
@@ -4778,45 +4795,9 @@ function startRelayServer({ config, handleDraw }) {
   return server;
 }
 
-// lib.mjs
-function enforceModelEcho(upstreamModel, offerModel) {
-  if (String(upstreamModel) !== String(offerModel))
-    throw new Error(`model mismatch: upstream ${upstreamModel} != offer ${offerModel}`);
-}
-function configuredFeeAtomic({ sellerUsdAtomic, feeAddress, feeBps }) {
-  const bps = BigInt(Math.trunc(Math.max(0, Number(feeBps) || 0)));
-  if (!feeAddress || bps === 0n) return 0n;
-  return (BigInt(sellerUsdAtomic || 0) * bps + 5000n) / 10000n;
-}
-var MESSAGE_OVERHEAD_TOKENS = 4;
-function estimateInputTokens(messages) {
-  const utf8 = new TextEncoder();
-  let tokens = 3;
-  for (const m of messages ?? []) {
-    tokens += MESSAGE_OVERHEAD_TOKENS;
-    tokens += utf8.encode(String(m?.role ?? "")).length;
-    tokens += utf8.encode(typeof m?.content === "string" ? m.content : JSON.stringify(m?.content ?? null)).length;
-  }
-  return tokens;
-}
-function boundServe({ messages, budgetUsd, inPrice, outPrice, reqMax, contextCeil = 4096 }) {
-  const estIn = estimateInputTokens(messages);
-  const estInCostUsd = estIn * (Number(inPrice) > 0 ? Number(inPrice) : 0) / 1e6;
-  if (estInCostUsd >= budgetUsd) return { refuse: true, reason: "input", estIn, estInCostUsd };
-  const outBudgetUsd = budgetUsd - estInCostUsd;
-  let maxTok = contextCeil;
-  if (Number(reqMax) > 0) maxTok = Math.min(maxTok, Math.floor(Number(reqMax)));
-  if (!Number.isFinite(Number(outPrice)) || Number(outPrice) <= 0) {
-    return { refuse: true, reason: "output_price", estIn, estInCostUsd };
-  }
-  maxTok = Math.min(maxTok, Math.floor(outBudgetUsd / Number(outPrice) * 1e6));
-  if (maxTok < 1) return { refuse: true, reason: "output", estIn, estInCostUsd };
-  return { refuse: false, maxTok, estIn, estInCostUsd };
-}
-
 // src/redemption.mjs
 import fs from "node:fs";
-import crypto2 from "node:crypto";
+import crypto3 from "node:crypto";
 var DEFAULT_RETENTION_MS = 7 * 24 * 60 * 60 * 1e3;
 function createRedemptionStore({ file = null, retentionMs = DEFAULT_RETENTION_MS, now = () => Date.now(), log = console } = {}) {
   const map = /* @__PURE__ */ new Map();
@@ -4881,6 +4862,14 @@ function createRedemptionStore({ file = null, retentionMs = DEFAULT_RETENTION_MS
         fs.rmSync(compact, { force: true });
       }
       fs.mkdirSync(claimsDir, { recursive: true });
+      const markerCutoff = Date.now() - retentionMs;
+      for (const name of fs.readdirSync(claimsDir)) {
+        try {
+          const marker = `${claimsDir}/${name}`;
+          if (fs.statSync(marker).mtimeMs < markerCutoff) fs.unlinkSync(marker);
+        } catch {
+        }
+      }
       durable = true;
       seenVersion = fileVersion();
       log.log?.(`mtok-relay: durable redemption at ${file} (${map.size} entries loaded)`);
@@ -4897,7 +4886,7 @@ function createRedemptionStore({ file = null, retentionMs = DEFAULT_RETENTION_MS
     syncWrite(file, "a", JSON.stringify(recordFor(key, entry)) + "\n");
     seenVersion = fileVersion();
   };
-  const markerFor = (key) => `${claimsDir}/${crypto2.createHash("sha256").update(String(key)).digest("hex")}`;
+  const markerFor = (key) => `${claimsDir}/${crypto3.createHash("sha256").update(String(key)).digest("hex")}`;
   const markClaimed = (key) => {
     if (!durable) throw new Error("durable redemption unavailable");
     const marker = markerFor(key);
@@ -5230,50 +5219,16 @@ function createOnchainVerifier({
   };
 }
 
-// bridge/bridge.mjs
-function httpUpstream({ baseUrl, key }) {
-  const url = String(baseUrl || "").replace(/\/$/, "") + "/chat/completions";
-  return async (payload) => {
-    const res = await fetch(url, {
-      method: "POST",
-      headers: {
-        "content-type": "application/json",
-        ...key ? { authorization: `Bearer ${key}` } : {}
-      },
-      body: JSON.stringify(payload)
-    });
-    const text = await res.text();
-    let json;
-    try {
-      json = JSON.parse(text);
-    } catch {
-      throw new Error(`non-JSON upstream response (${res.status})`);
-    }
-    if (!res.ok) throw new Error(json?.error?.message || `upstream ${res.status}`);
-    return json;
-  };
-}
-
-// src/rpc.mjs
-var BASE_MAINNET_RPCS = [
-  "https://mainnet.base.org",
-  "https://base.llamarpc.com",
-  "https://base-rpc.publicnode.com",
-  "https://base.drpc.org"
-];
-var BASE_SEPOLIA_RPCS = [
-  "https://sepolia.base.org",
-  "https://base-sepolia-rpc.publicnode.com"
-];
-var rpcUrlsFor = (chainId, override) => override ? [override] : Number(chainId) === 8453 ? BASE_MAINNET_RPCS : BASE_SEPOLIA_RPCS;
-
-// src/runtime.mjs
-import crypto3 from "node:crypto";
+// bridge/serve-core.mjs
 var BALANCE_EPSILON = 1e-6;
-var hash32 = (v) => "0x" + crypto3.createHash("sha256").update(typeof v === "string" ? v : JSON.stringify(v ?? null)).digest("hex");
 var REQUEST_NONCE_RE = /^0x[0-9a-fA-F]{32}$/;
 var CHAT_ROLES = /* @__PURE__ */ new Set(["developer", "system", "user", "assistant"]);
 var REQUEST_KEYS = /* @__PURE__ */ new Set(["model", "messages", "max_tokens", "temperature", "response_format", "stream", "n"]);
+async function hash32(v) {
+  const bytes = new TextEncoder().encode(typeof v === "string" ? v : JSON.stringify(v ?? null));
+  const digest = await crypto.subtle.digest("SHA-256", bytes);
+  return "0x" + [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, "0")).join("");
+}
 function legacyContentText(content) {
   const render = (part) => {
     if (typeof part === "string") return part;
@@ -5329,8 +5284,8 @@ function validateRequest(request, model, { legacy = false } = {}) {
   }
   let validResponseFormat = false;
   if (request.response_format != null) {
-    const format = request.response_format;
-    validResponseFormat = !!format && typeof format === "object" && !Array.isArray(format) && Object.keys(format).length === 1 && ["json_object", "text"].includes(format.type);
+    const format2 = request.response_format;
+    validResponseFormat = !!format2 && typeof format2 === "object" && !Array.isArray(format2) && Object.keys(format2).length === 1 && ["json_object", "text"].includes(format2.type);
     if (!legacy && !validResponseFormat) {
       return { error: 'response_format must be exactly { type: "json_object" } or { type: "text" }' };
     }
@@ -5345,6 +5300,222 @@ function validateRequest(request, model, { legacy = false } = {}) {
     }
   };
 }
+function enforceModelEcho(upstreamModel, offerModel) {
+  if (String(upstreamModel) !== String(offerModel))
+    throw new Error(`model mismatch: upstream ${upstreamModel} != offer ${offerModel}`);
+}
+function configuredFeeAtomic({ sellerUsdAtomic, feeAddress, feeBps }) {
+  const bps = BigInt(Math.trunc(Math.max(0, Number(feeBps) || 0)));
+  if (!feeAddress || bps === 0n) return 0n;
+  return (BigInt(sellerUsdAtomic || 0) * bps + 5000n) / 10000n;
+}
+var MESSAGE_OVERHEAD_TOKENS = 4;
+var BYTES_PER_TOKEN_EST = 3.2;
+function estimateInputTokens(messages) {
+  const utf8 = new TextEncoder();
+  let bytes = 0;
+  let envelope = 3;
+  for (const m of messages ?? []) {
+    envelope += MESSAGE_OVERHEAD_TOKENS;
+    bytes += utf8.encode(String(m?.role ?? "")).length;
+    bytes += utf8.encode(typeof m?.content === "string" ? m.content : JSON.stringify(m?.content ?? null)).length;
+  }
+  return envelope + Math.ceil(bytes / BYTES_PER_TOKEN_EST);
+}
+function boundServe({ messages, budgetUsd, inPrice, outPrice, reqMax, contextCeil = 4096 }) {
+  const estIn = estimateInputTokens(messages);
+  const estInCostUsd = estIn * (Number(inPrice) > 0 ? Number(inPrice) : 0) / 1e6;
+  if (estInCostUsd >= budgetUsd) return { refuse: true, reason: "input", estIn, estInCostUsd };
+  const outBudgetUsd = budgetUsd - estInCostUsd;
+  let maxTok = contextCeil;
+  if (Number(reqMax) > 0) maxTok = Math.min(maxTok, Math.floor(Number(reqMax)));
+  if (!Number.isFinite(Number(outPrice)) || Number(outPrice) <= 0) {
+    return { refuse: true, reason: "output_price", estIn, estInCostUsd };
+  }
+  maxTok = Math.min(maxTok, Math.floor(outBudgetUsd / Number(outPrice) * 1e6));
+  if (maxTok < 1) return { refuse: true, reason: "output", estIn, estInCostUsd };
+  return { refuse: false, maxTok, estIn, estInCostUsd };
+}
+function createServeCore({
+  model,
+  inPrice,
+  outPrice,
+  verifier,
+  redemption,
+  upstream,
+  log,
+  offerId,
+  sellerAgentId,
+  sellerWallet,
+  dripContractAddress,
+  feeRecipient,
+  feeBps,
+  screenPayer
+}) {
+  const serve = async (body) => {
+    const { bookingId, n, buyerId, request, requestNonce, drawPaidTxHash } = body;
+    const hasRequestNonce = Object.hasOwn(body, "requestNonce");
+    if (!bookingId) return { status: 400, body: { error: "bad_request", detail: "DRAW needs bookingId" } };
+    if (n == null) return { status: 400, body: { error: "bad_request", detail: "DRAW needs a delivery index n (per-booking idempotency key)" } };
+    if (!Number.isSafeInteger(n) || n < 0 || n > 4294967295) {
+      return { status: 400, body: { error: "bad_request", detail: "DRAW delivery index n must be a nonnegative uint32 integer" } };
+    }
+    if (hasRequestNonce && !REQUEST_NONCE_RE.test(requestNonce)) {
+      return { status: 400, body: { error: "bad_request", detail: "DRAW needs requestNonce as 16 random bytes encoded as 0x-prefixed hex" } };
+    }
+    const checked = validateRequest(request, model, { legacy: !hasRequestNonce });
+    if (checked.error) return { status: 400, body: { error: "bad_request", detail: checked.error } };
+    const requestHashScheme = hasRequestNonce ? "nonce-v1" : "legacy-v0";
+    const requestHash = hasRequestNonce ? await hash32({ request, requestNonce }) : await hash32(request);
+    const cacheKey = `${requestHashScheme}:${bookingId}:${n}:${requestHash}`;
+    const oldLegacyKey = hasRequestNonce ? null : `${bookingId}:${n}:${requestHash}`;
+    if (!dripContractAddress) {
+      return { status: 402, body: { error: "contract_mode_required", detail: "this relay only serves contract-mode draws; the platform is not reporting a dripContractAddress" } };
+    }
+    if (!drawPaidTxHash) return { status: 402, body: { error: "draw_payment_required", detail: "contract mode requires drawPaidTxHash before upstream delivery" } };
+    let paid;
+    try {
+      paid = await verifier.verifyDrawPaid(drawPaidTxHash, {
+        contractAddress: dripContractAddress,
+        buyerAgentId: buyerId,
+        sellerAgentId,
+        // when set, enforces the offer-owner match (#codex review)
+        bookingId,
+        offerId,
+        model,
+        n,
+        requestHash,
+        sellerWallet,
+        feeRecipient,
+        // #580: refuse a payment older than the redemption window. The JSONL
+        // payload cache AND the claim markers are both aged out at boot (#600),
+        // so past retention this age bound is the sole replay defense (its
+        // skip-on-unreadable-block residual is named in redemption.mjs). An
+        // honest retry is seconds-to-minutes old, never days.
+        maxPaidAgeMs: redemption.retentionMs
+      });
+    } catch (e) {
+      return { status: 402, body: { error: "payment_unverified", detail: e.message } };
+    }
+    if (!paid?.ok) return { status: 402, body: { error: "payment_unverified", detail: paid?.reason || "unknown" } };
+    const expectedFee = configuredFeeAtomic({
+      sellerUsdAtomic: paid.event.sellerUsdAtomic,
+      feeAddress: feeRecipient,
+      feeBps
+    });
+    if (BigInt(paid.event.feeUsdAtomic || 0) < expectedFee) {
+      return { status: 402, body: { error: "payment_unverified", detail: "fee_amount_too_low" } };
+    }
+    if (screenPayer) {
+      try {
+        if (await screenPayer(String(paid.from || "").toLowerCase())) {
+          return { status: 403, body: { error: "payer_denied", detail: "the verified payer wallet is denylisted by this relay" } };
+        }
+      } catch (e) {
+        return { status: 403, body: { error: "payer_denied", detail: "payer screening failed: " + e.message } };
+      }
+    }
+    let storedKey = cacheKey;
+    let redemptionState = await redemption.state(storedKey);
+    if (!redemptionState && oldLegacyKey) {
+      const oldLegacyState = await redemption.state(oldLegacyKey);
+      if (oldLegacyState) {
+        storedKey = oldLegacyKey;
+        redemptionState = oldLegacyState;
+      } else {
+        redemptionState = await redemption.state(cacheKey);
+      }
+    }
+    if (redemptionState === "complete") return { status: 200, body: await redemption.get(storedKey) };
+    if (redemptionState === "pending") {
+      return { status: 409, body: { error: "draw_pending", detail: "this paid draw was already claimed; refusing to run upstream again", _bookingId: bookingId } };
+    }
+    const paidEvent = paid.event;
+    const remainingUsd = Number(paid.event.sellerUsdAtomic || 0) / 1e6;
+    if (remainingUsd < BALANCE_EPSILON) {
+      return { status: 402, body: { error: "balance_exhausted", detail: `remainingUsd=${remainingUsd}`, _bookingId: bookingId, remainingUsd } };
+    }
+    const eventInPriceUsd = Number(paidEvent.inputPricePerMTokAtomic || 0) / 1e6;
+    const eventOutPriceUsd = Number(paidEvent.outputPricePerMTokAtomic || 0) / 1e6;
+    const boundInPrice = Math.max(Number(inPrice) || 0, eventInPriceUsd);
+    const boundOutPrice = Math.max(Number(outPrice) || 0, eventOutPriceUsd);
+    const bound = boundServe({ messages: checked.safeRequest.messages, budgetUsd: remainingUsd, inPrice: boundInPrice, outPrice: boundOutPrice, reqMax: checked.safeRequest.max_tokens });
+    if (bound.refuse) {
+      const error = bound.reason === "input" ? "input_too_large" : "output_unfunded";
+      return { status: 402, body: { error, detail: `estimated input (~${bound.estIn} tokens, $${bound.estInCostUsd.toFixed(6)}) leaves no safely funded output in the paid amount ($${remainingUsd})`, _bookingId: bookingId, remainingUsd } };
+    }
+    const safeRequest = { ...checked.safeRequest, model, max_tokens: bound.maxTok };
+    try {
+      if (!await redemption.claim(cacheKey, oldLegacyKey ?? cacheKey)) {
+        return { status: 409, body: { error: "draw_pending", detail: "this paid draw was already claimed; refusing to run upstream again", _bookingId: bookingId } };
+      }
+    } catch (e) {
+      return { status: 503, body: { error: "redemption_unavailable", detail: `could not durably claim the paid draw: ${e.message}`, _bookingId: bookingId } };
+    }
+    let completion;
+    try {
+      completion = await upstream(safeRequest);
+    } catch (e) {
+      return { status: 502, body: { error: "upstream_error", detail: e.message } };
+    }
+    try {
+      enforceModelEcho(completion.model, model);
+    } catch (e) {
+      return { status: 502, body: { error: "model_mismatch", detail: e.message } };
+    }
+    const usage = completion.usage ?? {};
+    const inTok = Number(usage.prompt_tokens ?? usage.input_tokens ?? 0) || 0;
+    const outTok = Number(usage.completion_tokens ?? usage.output_tokens ?? 0) || 0;
+    const usedUsd = (inTok * Number(paidEvent.inputPricePerMTokAtomic || 0) + outTok * Number(paidEvent.outputPricePerMTokAtomic || 0)) / 1e12;
+    const payload = { ...completion, _bookingId: bookingId, remainingUsd: Math.max(0, Math.round((remainingUsd - usedUsd) * 1e6) / 1e6) };
+    try {
+      await redemption.complete(cacheKey, payload);
+    } catch (e) {
+      (log ?? console).error?.(`mtok serve core: completion for ${cacheKey} could not be persisted (${e.message}); retries will remain pending`);
+    }
+    return { status: 200, body: payload };
+  };
+  return { serve };
+}
+
+// bridge/bridge.mjs
+function httpUpstream({ baseUrl, key }) {
+  const url = String(baseUrl || "").replace(/\/$/, "") + "/chat/completions";
+  return async (payload) => {
+    const res = await fetch(url, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        ...key ? { authorization: `Bearer ${key}` } : {}
+      },
+      body: JSON.stringify(payload)
+    });
+    const text = await res.text();
+    let json;
+    try {
+      json = JSON.parse(text);
+    } catch {
+      throw new Error(`non-JSON upstream response (${res.status})`);
+    }
+    if (!res.ok) throw new Error(json?.error?.message || `upstream ${res.status}`);
+    return json;
+  };
+}
+
+// src/rpc.mjs
+var BASE_MAINNET_RPCS = [
+  "https://mainnet.base.org",
+  "https://base.llamarpc.com",
+  "https://base-rpc.publicnode.com",
+  "https://base.drpc.org"
+];
+var BASE_SEPOLIA_RPCS = [
+  "https://sepolia.base.org",
+  "https://base-sepolia-rpc.publicnode.com"
+];
+var rpcUrlsFor = (chainId, override) => override ? [override] : Number(chainId) === 8453 ? BASE_MAINNET_RPCS : BASE_SEPOLIA_RPCS;
+
+// src/runtime.mjs
 async function createRelayRuntime(config) {
   const served = createRedemptionStore({ file: config.redemptionFile, log: config.log });
   const drawLocks = /* @__PURE__ */ new Map();
@@ -5360,6 +5531,22 @@ async function createRelayRuntime(config) {
     if (screenPayer && await screenPayer(payer)) return true;
     return false;
   };
+  const core = createServeCore({
+    model: config.model,
+    inPrice: config.inPrice,
+    outPrice: config.outPrice,
+    verifier,
+    redemption: served,
+    upstream,
+    log: config.log,
+    offerId: config.offerId,
+    sellerAgentId: config.sellerAgentId,
+    sellerWallet: config.settlementAddr,
+    dripContractAddress: platform.dripContractAddress,
+    feeRecipient: platform.feeAddress,
+    feeBps: platform.feeBps,
+    screenPayer: payerDenied
+  });
   const withBookingLock = async (bookingId, fn) => {
     const previous = drawLocks.get(bookingId) || Promise.resolve();
     let release;
@@ -5378,127 +5565,10 @@ async function createRelayRuntime(config) {
       if (drawLocks.get(bookingId) === tail) drawLocks.delete(bookingId);
     }
   };
-  const handleDraw = async (body, res) => {
-    const { bookingId, n, buyerId, request, requestNonce, drawPaidTxHash } = body;
-    const hasRequestNonce = Object.hasOwn(body, "requestNonce");
-    if (!bookingId) return send(res, 400, { error: "bad_request", detail: "DRAW needs bookingId" });
-    if (n == null) return send(res, 400, { error: "bad_request", detail: "DRAW needs a delivery index n (per-booking idempotency key)" });
-    if (!Number.isSafeInteger(n) || n < 0 || n > 4294967295) {
-      return send(res, 400, { error: "bad_request", detail: "DRAW delivery index n must be a nonnegative uint32 integer" });
-    }
-    if (hasRequestNonce && !REQUEST_NONCE_RE.test(requestNonce)) {
-      return send(res, 400, { error: "bad_request", detail: "DRAW needs requestNonce as 16 random bytes encoded as 0x-prefixed hex" });
-    }
-    const checked = validateRequest(request, config.model, { legacy: !hasRequestNonce });
-    if (checked.error) return send(res, 400, { error: "bad_request", detail: checked.error });
-    return withBookingLock(bookingId, async () => {
-      const requestHashScheme = hasRequestNonce ? "nonce-v1" : "legacy-v0";
-      const requestHash = hasRequestNonce ? hash32({ request, requestNonce }) : hash32(request);
-      const cacheKey = `${requestHashScheme}:${bookingId}:${n}:${requestHash}`;
-      const oldLegacyKey = hasRequestNonce ? null : `${bookingId}:${n}:${requestHash}`;
-      if (!platform.dripContractAddress) {
-        return send(res, 402, { error: "contract_mode_required", detail: "this relay only serves contract-mode draws; the platform is not reporting a dripContractAddress" });
-      }
-      if (!drawPaidTxHash) return send(res, 402, { error: "draw_payment_required", detail: "contract mode requires drawPaidTxHash before upstream delivery" });
-      let paid;
-      try {
-        paid = await verifier.verifyDrawPaid(drawPaidTxHash, {
-          contractAddress: platform.dripContractAddress,
-          buyerAgentId: buyerId,
-          sellerAgentId: config.sellerAgentId,
-          // when set, enforces the offer-owner match (#codex review)
-          bookingId,
-          offerId: config.offerId,
-          model: config.model,
-          n,
-          requestHash,
-          sellerWallet: config.settlementAddr,
-          feeRecipient: platform.feeAddress,
-          // #580: refuse a payment older than the redemption window. The JSONL
-          // payload cache is compacted by age (exclusive claim markers remain
-          // fail-closed), and an honest retry is seconds-to-minutes old, never days.
-          maxPaidAgeMs: served.retentionMs
-        });
-      } catch (e) {
-        return send(res, 402, { error: "payment_unverified", detail: e.message });
-      }
-      if (!paid?.ok) return send(res, 402, { error: "payment_unverified", detail: paid?.reason || "unknown" });
-      const expectedFee = configuredFeeAtomic({
-        sellerUsdAtomic: paid.event.sellerUsdAtomic,
-        feeAddress: platform.feeAddress,
-        feeBps: platform.feeBps
-      });
-      if (BigInt(paid.event.feeUsdAtomic || 0) < expectedFee) {
-        return send(res, 402, { error: "payment_unverified", detail: "fee_amount_too_low" });
-      }
-      try {
-        if (await payerDenied(String(paid.from || "").toLowerCase())) {
-          return send(res, 403, { error: "payer_denied", detail: "the verified payer wallet is denylisted by this relay" });
-        }
-      } catch (e) {
-        return send(res, 403, { error: "payer_denied", detail: "payer screening failed: " + e.message });
-      }
-      let storedKey = cacheKey;
-      let redemptionState = served.state(storedKey);
-      if (!redemptionState && oldLegacyKey) {
-        const oldLegacyState = served.state(oldLegacyKey);
-        if (oldLegacyState) {
-          storedKey = oldLegacyKey;
-          redemptionState = oldLegacyState;
-        } else {
-          redemptionState = served.state(cacheKey);
-        }
-      }
-      if (redemptionState === "complete") return send(res, 200, served.get(storedKey));
-      if (redemptionState === "pending") {
-        return send(res, 409, { error: "draw_pending", detail: "this paid draw was already claimed; refusing to run upstream again", _bookingId: bookingId });
-      }
-      const paidEvent = paid.event;
-      const remainingUsd = Number(paid.event.sellerUsdAtomic || 0) / 1e6;
-      if (remainingUsd < BALANCE_EPSILON) {
-        return send(res, 402, { error: "balance_exhausted", detail: `remainingUsd=${remainingUsd}`, _bookingId: bookingId, remainingUsd });
-      }
-      const eventInPriceUsd = Number(paidEvent.inputPricePerMTokAtomic || 0) / 1e6;
-      const eventOutPriceUsd = Number(paidEvent.outputPricePerMTokAtomic || 0) / 1e6;
-      const inPrice = Math.max(Number(config.inPrice) || 0, eventInPriceUsd);
-      const outPrice = Math.max(Number(config.outPrice) || 0, eventOutPriceUsd);
-      const bound = boundServe({ messages: checked.safeRequest.messages, budgetUsd: remainingUsd, inPrice, outPrice, reqMax: checked.safeRequest.max_tokens });
-      if (bound.refuse) {
-        const error = bound.reason === "input" ? "input_too_large" : "output_unfunded";
-        return send(res, 402, { error, detail: `estimated input (~${bound.estIn} tokens, $${bound.estInCostUsd.toFixed(6)}) leaves no safely funded output in the paid amount ($${remainingUsd})`, _bookingId: bookingId, remainingUsd });
-      }
-      const safeRequest = { ...checked.safeRequest, model: config.model, max_tokens: bound.maxTok };
-      try {
-        if (!served.claim(cacheKey, oldLegacyKey ?? cacheKey)) {
-          return send(res, 409, { error: "draw_pending", detail: "this paid draw was already claimed; refusing to run upstream again", _bookingId: bookingId });
-        }
-      } catch (e) {
-        return send(res, 503, { error: "redemption_unavailable", detail: `could not durably claim the paid draw: ${e.message}`, _bookingId: bookingId });
-      }
-      let completion;
-      try {
-        completion = await upstream(safeRequest);
-      } catch (e) {
-        return send(res, 502, { error: "upstream_error", detail: e.message });
-      }
-      try {
-        enforceModelEcho(completion.model, config.model);
-      } catch (e) {
-        return send(res, 502, { error: "model_mismatch", detail: e.message });
-      }
-      const usage = completion.usage ?? {};
-      const inTok = Number(usage.prompt_tokens ?? usage.input_tokens ?? 0) || 0;
-      const outTok = Number(usage.completion_tokens ?? usage.output_tokens ?? 0) || 0;
-      const usedUsd = (inTok * Number(paidEvent.inputPricePerMTokAtomic || 0) + outTok * Number(paidEvent.outputPricePerMTokAtomic || 0)) / 1e12;
-      const payload = { ...completion, _bookingId: bookingId, remainingUsd: Math.max(0, Math.round((remainingUsd - usedUsd) * 1e6) / 1e6) };
-      try {
-        served.complete(cacheKey, payload);
-      } catch (e) {
-        (config.log ?? console).error?.(`mtok-relay: completion for ${cacheKey} could not be persisted (${e.message}); retries will remain pending`);
-      }
-      return send(res, 200, payload);
-    });
-  };
+  const handleDraw = (body, res) => withBookingLock(String(body?.bookingId ?? ""), async () => {
+    const out = await core.serve(body);
+    return send(res, out.status, out.body);
+  });
   return { handleDraw };
 }
 async function fetchPlatformConfig(config) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mtok-relay",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "Reference seller relay for mtok.market — accepts on-chain-prepaid chunk draws and serves inference from an upstream you control.",
   "type": "module",
   "bin": {