mtok-relay 0.2.1 → 0.2.3

package/dist/mtok-relay.mjs

@@ -2016,14 +2016,14 @@ function weierstrass(curveDef) {
     const sg = signature;
     msgHash = ensureBytes("msgHash", msgHash);
     publicKey = ensureBytes("publicKey", publicKey);
-    const { lowS, prehash, format } = opts;
+    const { lowS, prehash, format: format2 } = opts;
     validateSigVerOpts(opts);
     if ("strict" in opts)
       throw new Error("options.strict was renamed to lowS");
-    if (format !== void 0 && format !== "compact" && format !== "der")
+    if (format2 !== void 0 && format2 !== "compact" && format2 !== "der")
       throw new Error("format must be compact or der");
     const isHex2 = typeof sg === "string" || isBytes2(sg);
-    const isObj = !isHex2 && !format && typeof sg === "object" && sg !== null && typeof sg.r === "bigint" && typeof sg.s === "bigint";
+    const isObj = !isHex2 && !format2 && typeof sg === "object" && sg !== null && typeof sg.r === "bigint" && typeof sg.s === "bigint";
     if (!isHex2 && !isObj)
       throw new Error("invalid signature, expected Uint8Array, hex string or Signature instance");
     let _sig = void 0;
@@ -2033,13 +2033,13 @@ function weierstrass(curveDef) {
         _sig = new Signature(sg.r, sg.s);
       if (isHex2) {
         try {
-          if (format !== "compact")
+          if (format2 !== "compact")
             _sig = Signature.fromDER(sg);
         } catch (derError) {
           if (!(derError instanceof DER.Err))
             throw derError;
         }
-        if (!_sig && format !== "der")
+        if (!_sig && format2 !== "der")
           _sig = Signature.fromCompact(sg);
       }
       P = Point.fromHex(publicKey);
@@ -2157,7 +2157,7 @@ var secp256k1 = createCurve({
 }, sha256);
 
 // node_modules/viem/_esm/errors/version.js
-var version = "2.55.1";
+var version = "2.56.0";
 
 // node_modules/viem/_esm/errors/base.js
 var errorConfig = {
@@ -3215,14 +3215,17 @@ async function signMessage({ message, privateKey }) {
   return await sign({ hash: hashMessage(message), privateKey, to: "hex" });
 }
 
-// node_modules/viem/_esm/constants/unit.js
-var gweiUnits = {
-  ether: -9,
-  wei: 9
+// node_modules/viem/_esm/utils/unit/Value.js
+var exponents = {
+  wei: 0,
+  gwei: 9,
+  szabo: 12,
+  finney: 15,
+  ether: 18
 };
-
-// node_modules/viem/_esm/utils/unit/formatUnits.js
-function formatUnits(value, decimals) {
+function format(value, decimals = 0) {
+  if (!Number.isInteger(decimals) || decimals < 0)
+    throw new InvalidDecimalsError({ decimals });
   let display = value.toString();
   const negative = display.startsWith("-");
   if (negative)
@@ -3235,10 +3238,24 @@ function formatUnits(value, decimals) {
   fraction = fraction.replace(/(0+)$/, "");
   return `${negative ? "-" : ""}${integer || "0"}${fraction ? `.${fraction}` : ""}`;
 }
+function formatGwei(wei, unit = "wei") {
+  return format(wei, exponents.gwei - exponents[unit]);
+}
+var InvalidDecimalsError = class extends Error {
+  constructor({ decimals }) {
+    super(`\`decimals\` must be a non-negative integer. Got \`${decimals}\`.`);
+    Object.defineProperty(this, "name", {
+      enumerable: true,
+      configurable: true,
+      writable: true,
+      value: "Value.InvalidDecimalsError"
+    });
+  }
+};
 
 // node_modules/viem/_esm/utils/unit/formatGwei.js
-function formatGwei(wei, unit = "wei") {
-  return formatUnits(wei, gweiUnits[unit]);
+function formatGwei2(wei, unit = "wei") {
+  return formatGwei(wei, unit);
 }
 
 // node_modules/viem/_esm/errors/transaction.js
@@ -3591,7 +3608,7 @@ Object.defineProperty(ExecutionRevertedError, "nodeMessage", {
 });
 var FeeCapTooHighError = class extends BaseError {
   constructor({ cause, maxFeePerGas } = {}) {
-    super(`The fee cap (\`maxFeePerGas\`${maxFeePerGas ? ` = ${formatGwei(maxFeePerGas)} gwei` : ""}) cannot be higher than the maximum allowed value (2^256-1).`, {
+    super(`The fee cap (\`maxFeePerGas\`${maxFeePerGas ? ` = ${formatGwei2(maxFeePerGas)} gwei` : ""}) cannot be higher than the maximum allowed value (2^256-1).`, {
       cause,
       name: "FeeCapTooHighError"
     });
@@ -3605,7 +3622,7 @@ Object.defineProperty(FeeCapTooHighError, "nodeMessage", {
 });
 var FeeCapTooLowError = class extends BaseError {
   constructor({ cause, maxFeePerGas } = {}) {
-    super(`The fee cap (\`maxFeePerGas\`${maxFeePerGas ? ` = ${formatGwei(maxFeePerGas)}` : ""} gwei) cannot be lower than the block base fee.`, {
+    super(`The fee cap (\`maxFeePerGas\`${maxFeePerGas ? ` = ${formatGwei2(maxFeePerGas)}` : ""} gwei) cannot be lower than the block base fee.`, {
       cause,
       name: "FeeCapTooLowError"
     });
@@ -3724,7 +3741,7 @@ Object.defineProperty(TransactionTypeNotSupportedError, "nodeMessage", {
 var TipAboveFeeCapError = class extends BaseError {
   constructor({ cause, maxPriorityFeePerGas, maxFeePerGas } = {}) {
     super([
-      `The provided tip (\`maxPriorityFeePerGas\`${maxPriorityFeePerGas ? ` = ${formatGwei(maxPriorityFeePerGas)} gwei` : ""}) cannot be higher than the fee cap (\`maxFeePerGas\`${maxFeePerGas ? ` = ${formatGwei(maxFeePerGas)} gwei` : ""}).`
+      `The provided tip (\`maxPriorityFeePerGas\`${maxPriorityFeePerGas ? ` = ${formatGwei2(maxPriorityFeePerGas)} gwei` : ""}) cannot be higher than the fee cap (\`maxFeePerGas\`${maxFeePerGas ? ` = ${formatGwei2(maxFeePerGas)} gwei` : ""}).`
     ].join("\n"), {
       cause,
       name: "TipAboveFeeCapError"
@@ -4415,6 +4432,15 @@ var InvalidStructTypeError = class extends BaseError {
     });
   }
 };
+var InvalidTypedDataTypeError = class extends BaseError {
+  constructor({ type }) {
+    const canonicalType = type.replace(/^(u?int)/, "$&256");
+    super(`Type "${type}" is not a valid EIP-712 type.`, {
+      metaMessages: [`Use "${canonicalType}" instead.`],
+      name: "InvalidTypedDataTypeError"
+    });
+  }
+};
 
 // node_modules/viem/_esm/utils/typedData.js
 function validateTypedData(parameters) {
@@ -4423,6 +4449,9 @@ function validateTypedData(parameters) {
     for (const param of struct) {
       const { name, type } = param;
       const value = data[name];
+      const baseType = type.replace(/(\[[0-9]*\])+$/, "");
+      if (baseType === "int" || baseType === "uint")
+        throw new InvalidTypedDataTypeError({ type });
       const integerMatch = type.match(integerRegex);
       if (integerMatch && (typeof value === "number" || typeof value === "bigint")) {
         const [_type, base, size_] = integerMatch;
@@ -4653,6 +4682,11 @@ function readRelayConfig({ argv = process.argv.slice(2), env = process.env } = {
   const redemptionFile = redemptionFlag === void 0 ? "./.mtok-redemption.jsonl" : redemptionFlag;
   const denylistRaw = flag(argv, "--payer-denylist") ?? env.RELAY_PAYER_DENYLIST ?? "";
   const payerDenylist = String(denylistRaw).split(",").map((a) => a.trim().toLowerCase()).filter(Boolean);
+  const maxOutputRaw = flag(argv, "--max-output-tokens") ?? env.RELAY_MAX_OUTPUT_TOKENS;
+  const maxOutputTokens = maxOutputRaw != null ? Number(maxOutputRaw) : void 0;
+  if (maxOutputTokens != null && (!Number.isFinite(maxOutputTokens) || maxOutputTokens < 1)) {
+    throw new Error("--max-output-tokens must be a positive integer");
+  }
   if (!offerId) throw new Error("--offer <id> is required");
   if (!model) throw new Error("--model <id> is required (the offer model you serve)");
   if (!upstream) throw new Error("--upstream <url> is required");
@@ -4691,7 +4725,8 @@ function readRelayConfig({ argv = process.argv.slice(2), env = process.env } = {
     mtokApiKey,
     upstreamKey,
     settlementAddr,
-    payerDenylist
+    payerDenylist,
+    maxOutputTokens
   };
 }
 
@@ -4912,7 +4947,17 @@ function createRedemptionStore({ file = null, retentionMs = DEFAULT_RETENTION_MS
       if (map.has(key)) return false;
       if (!markClaimed(markerKey)) return false;
       const entry = { state: "pending", at: now() };
-      append(key, entry);
+      try {
+        append(key, entry);
+      } catch (e) {
+        if (durable) {
+          try {
+            fs.unlinkSync(markerFor(markerKey));
+          } catch {
+          }
+        }
+        throw e;
+      }
       map.set(key, entry);
       return true;
     },
@@ -5267,8 +5312,8 @@ function validateRequest(request, model, { legacy = false } = {}) {
   }
   let validResponseFormat = false;
   if (request.response_format != null) {
-    const format = request.response_format;
-    validResponseFormat = !!format && typeof format === "object" && !Array.isArray(format) && Object.keys(format).length === 1 && ["json_object", "text"].includes(format.type);
+    const format2 = request.response_format;
+    validResponseFormat = !!format2 && typeof format2 === "object" && !Array.isArray(format2) && Object.keys(format2).length === 1 && ["json_object", "text"].includes(format2.type);
     if (!legacy && !validResponseFormat) {
       return { error: 'response_format must be exactly { type: "json_object" } or { type: "text" }' };
     }
@@ -5283,8 +5328,21 @@ function validateRequest(request, model, { legacy = false } = {}) {
     }
   };
 }
+function normalizeModelId(m) {
+  return String(m ?? "").toLowerCase().split("/").pop().replace(/^@/, "");
+}
+function modelsCompatible(upstreamModel, offerModel) {
+  const a = normalizeModelId(upstreamModel);
+  const b = normalizeModelId(offerModel);
+  if (!a || !b) return false;
+  if (a === b) return true;
+  const [longer, shorter] = a.length >= b.length ? [a, b] : [b, a];
+  if (!longer.startsWith(shorter)) return false;
+  const rest = longer.slice(shorter.length);
+  return /^([-._]\d+)+$/.test(rest);
+}
 function enforceModelEcho(upstreamModel, offerModel) {
-  if (String(upstreamModel) !== String(offerModel))
+  if (!modelsCompatible(upstreamModel, offerModel))
     throw new Error(`model mismatch: upstream ${upstreamModel} != offer ${offerModel}`);
 }
 function configuredFeeAtomic({ sellerUsdAtomic, feeAddress, feeBps }) {
@@ -5293,17 +5351,20 @@ function configuredFeeAtomic({ sellerUsdAtomic, feeAddress, feeBps }) {
   return (BigInt(sellerUsdAtomic || 0) * bps + 5000n) / 10000n;
 }
 var MESSAGE_OVERHEAD_TOKENS = 4;
+var BYTES_PER_TOKEN_EST = 3.2;
 function estimateInputTokens(messages) {
   const utf8 = new TextEncoder();
-  let tokens = 3;
+  let bytes = 0;
+  let envelope = 3;
   for (const m of messages ?? []) {
-    tokens += MESSAGE_OVERHEAD_TOKENS;
-    tokens += utf8.encode(String(m?.role ?? "")).length;
-    tokens += utf8.encode(typeof m?.content === "string" ? m.content : JSON.stringify(m?.content ?? null)).length;
+    envelope += MESSAGE_OVERHEAD_TOKENS;
+    bytes += utf8.encode(String(m?.role ?? "")).length;
+    bytes += utf8.encode(typeof m?.content === "string" ? m.content : JSON.stringify(m?.content ?? null)).length;
   }
-  return tokens;
+  return envelope + Math.ceil(bytes / BYTES_PER_TOKEN_EST);
 }
-function boundServe({ messages, budgetUsd, inPrice, outPrice, reqMax, contextCeil = 4096 }) {
+var DEFAULT_MAX_OUTPUT_TOKENS = 32768;
+function boundServe({ messages, budgetUsd, inPrice, outPrice, reqMax, contextCeil = DEFAULT_MAX_OUTPUT_TOKENS }) {
   const estIn = estimateInputTokens(messages);
   const estInCostUsd = estIn * (Number(inPrice) > 0 ? Number(inPrice) : 0) / 1e6;
   if (estInCostUsd >= budgetUsd) return { refuse: true, reason: "input", estIn, estInCostUsd };
@@ -5331,9 +5392,17 @@ function createServeCore({
   dripContractAddress,
   feeRecipient,
   feeBps,
-  screenPayer
+  screenPayer,
+  // #654: the output-token sanity ceiling for boundServe. The PAID budget already
+  // bounds output (and metering is on real usage), so this is a defensive cap on a
+  // single generation, not a money guard. It is a per-relay knob: the reference host
+  // passes MTOK_MAX_OUTPUT_TOKENS / a config value; operators serving large-context
+  // models raise it. Falls back to boundServe's own generous default when unset.
+  maxOutputTokens
 }) {
   const serve = async (body) => {
+    const currentFeeBps = typeof feeBps === "function" ? feeBps() : feeBps;
+    const currentFeeRecipient = typeof feeRecipient === "function" ? feeRecipient() : feeRecipient;
     const { bookingId, n, buyerId, request, requestNonce, drawPaidTxHash } = body;
     const hasRequestNonce = Object.hasOwn(body, "requestNonce");
     if (!bookingId) return { status: 400, body: { error: "bad_request", detail: "DRAW needs bookingId" } };
@@ -5367,7 +5436,7 @@ function createServeCore({
         n,
         requestHash,
         sellerWallet,
-        feeRecipient,
+        feeRecipient: currentFeeRecipient,
         // #580: refuse a payment older than the redemption window. The JSONL
         // payload cache AND the claim markers are both aged out at boot (#600),
         // so past retention this age bound is the sole replay defense (its
@@ -5381,8 +5450,8 @@ function createServeCore({
     if (!paid?.ok) return { status: 402, body: { error: "payment_unverified", detail: paid?.reason || "unknown" } };
     const expectedFee = configuredFeeAtomic({
       sellerUsdAtomic: paid.event.sellerUsdAtomic,
-      feeAddress: feeRecipient,
-      feeBps
+      feeAddress: currentFeeRecipient,
+      feeBps: currentFeeBps
     });
     if (BigInt(paid.event.feeUsdAtomic || 0) < expectedFee) {
       return { status: 402, body: { error: "payment_unverified", detail: "fee_amount_too_low" } };
@@ -5420,7 +5489,7 @@ function createServeCore({
     const eventOutPriceUsd = Number(paidEvent.outputPricePerMTokAtomic || 0) / 1e6;
     const boundInPrice = Math.max(Number(inPrice) || 0, eventInPriceUsd);
     const boundOutPrice = Math.max(Number(outPrice) || 0, eventOutPriceUsd);
-    const bound = boundServe({ messages: checked.safeRequest.messages, budgetUsd: remainingUsd, inPrice: boundInPrice, outPrice: boundOutPrice, reqMax: checked.safeRequest.max_tokens });
+    const bound = boundServe({ messages: checked.safeRequest.messages, budgetUsd: remainingUsd, inPrice: boundInPrice, outPrice: boundOutPrice, reqMax: checked.safeRequest.max_tokens, ...Number(maxOutputTokens) > 0 ? { contextCeil: Math.floor(Number(maxOutputTokens)) } : {} });
     if (bound.refuse) {
       const error = bound.reason === "input" ? "input_too_large" : "output_unfunded";
       return { status: 402, body: { error, detail: `estimated input (~${bound.estIn} tokens, $${bound.estInCostUsd.toFixed(6)}) leaves no safely funded output in the paid amount ($${remainingUsd})`, _bookingId: bookingId, remainingUsd } };
@@ -5444,6 +5513,7 @@ function createServeCore({
     } catch (e) {
       return { status: 502, body: { error: "model_mismatch", detail: e.message } };
     }
+    if (completion && typeof completion === "object") completion.model = model;
     const usage = completion.usage ?? {};
     const inTok = Number(usage.prompt_tokens ?? usage.input_tokens ?? 0) || 0;
     const outTok = Number(usage.completion_tokens ?? usage.output_tokens ?? 0) || 0;
@@ -5501,6 +5571,24 @@ async function createRelayRuntime(config) {
   const served = createRedemptionStore({ file: config.redemptionFile, log: config.log });
   const drawLocks = /* @__PURE__ */ new Map();
   const platform = await fetchPlatformConfig(config);
+  const bootFeeBps = platform.feeBps;
+  const FEE_REFRESH_MS = 6e4;
+  let lastConfigFetch = Date.now();
+  const refreshPlatformFee = async () => {
+    lastConfigFetch = Date.now();
+    try {
+      const fresh = await fetchPlatformConfig(config);
+      platform.feeBps = fresh.feeBps;
+      return true;
+    } catch (e) {
+      (config.log ?? console).error?.(`mtok relay: platform config refresh failed (${e.message}); keeping last-known fee rate`);
+      return false;
+    }
+  };
+  const refreshPlatformFeeIfStale = async () => {
+    if (Date.now() - lastConfigFetch < FEE_REFRESH_MS) return;
+    await refreshPlatformFee();
+  };
   const verifier = createOnchainVerifier({ rpcUrls: rpcUrlsFor(platform.chainId, config.rpcFlag), usdcAddress: platform.usdcAddress, expectedChainId: platform.chainId });
   if (!verifier.configured) throw new Error("onchain verifier not configured (missing usdcAddress in /api/config)");
   const payerDenylist = new Set((config.payerDenylist ?? []).map((a) => String(a).trim().toLowerCase()).filter(Boolean));
@@ -5524,8 +5612,13 @@ async function createRelayRuntime(config) {
     sellerAgentId: config.sellerAgentId,
     sellerWallet: config.settlementAddr,
     dripContractAddress: platform.dripContractAddress,
+    // #654: the fee floor is min(boot, current) so neither a fee increase nor a
+    // decrease can over-demand and strand an honest already-paid draw; the recipient
+    // stays pinned to the boot address (exact-match verify, see the note above).
     feeRecipient: platform.feeAddress,
-    feeBps: platform.feeBps,
+    feeBps: () => Math.min(bootFeeBps, platform.feeBps),
+    // #654: per-relay output sanity ceiling (unset => the shared generous default).
+    maxOutputTokens: config.maxOutputTokens,
     screenPayer: payerDenied
   });
   const withBookingLock = async (bookingId, fn) => {
@@ -5547,7 +5640,11 @@ async function createRelayRuntime(config) {
     }
   };
   const handleDraw = (body, res) => withBookingLock(String(body?.bookingId ?? ""), async () => {
-    const out = await core.serve(body);
+    await refreshPlatformFeeIfStale();
+    let out = await core.serve(body);
+    if (out.status === 402 && out.body?.detail === "fee_amount_too_low" && await refreshPlatformFee()) {
+      out = await core.serve(body);
+    }
     return send(res, out.status, out.body);
   });
   return { handleDraw };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mtok-relay",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "description": "Reference seller relay for mtok.market — accepts on-chain-prepaid chunk draws and serves inference from an upstream you control.",
   "type": "module",
   "bin": {