mtok-relay 0.2.2 → 0.2.3

package/dist/mtok-relay.mjs

@@ -2157,7 +2157,7 @@ var secp256k1 = createCurve({
 }, sha256);
 
 // node_modules/viem/_esm/errors/version.js
-var version = "2.55.10";
+var version = "2.56.0";
 
 // node_modules/viem/_esm/errors/base.js
 var errorConfig = {
@@ -4432,6 +4432,15 @@ var InvalidStructTypeError = class extends BaseError {
     });
   }
 };
+var InvalidTypedDataTypeError = class extends BaseError {
+  constructor({ type }) {
+    const canonicalType = type.replace(/^(u?int)/, "$&256");
+    super(`Type "${type}" is not a valid EIP-712 type.`, {
+      metaMessages: [`Use "${canonicalType}" instead.`],
+      name: "InvalidTypedDataTypeError"
+    });
+  }
+};
 
 // node_modules/viem/_esm/utils/typedData.js
 function validateTypedData(parameters) {
@@ -4440,6 +4449,9 @@ function validateTypedData(parameters) {
     for (const param of struct) {
       const { name, type } = param;
       const value = data[name];
+      const baseType = type.replace(/(\[[0-9]*\])+$/, "");
+      if (baseType === "int" || baseType === "uint")
+        throw new InvalidTypedDataTypeError({ type });
       const integerMatch = type.match(integerRegex);
       if (integerMatch && (typeof value === "number" || typeof value === "bigint")) {
         const [_type, base, size_] = integerMatch;
@@ -4670,6 +4682,11 @@ function readRelayConfig({ argv = process.argv.slice(2), env = process.env } = {
   const redemptionFile = redemptionFlag === void 0 ? "./.mtok-redemption.jsonl" : redemptionFlag;
   const denylistRaw = flag(argv, "--payer-denylist") ?? env.RELAY_PAYER_DENYLIST ?? "";
   const payerDenylist = String(denylistRaw).split(",").map((a) => a.trim().toLowerCase()).filter(Boolean);
+  const maxOutputRaw = flag(argv, "--max-output-tokens") ?? env.RELAY_MAX_OUTPUT_TOKENS;
+  const maxOutputTokens = maxOutputRaw != null ? Number(maxOutputRaw) : void 0;
+  if (maxOutputTokens != null && (!Number.isFinite(maxOutputTokens) || maxOutputTokens < 1)) {
+    throw new Error("--max-output-tokens must be a positive integer");
+  }
   if (!offerId) throw new Error("--offer <id> is required");
   if (!model) throw new Error("--model <id> is required (the offer model you serve)");
   if (!upstream) throw new Error("--upstream <url> is required");
@@ -4708,7 +4725,8 @@ function readRelayConfig({ argv = process.argv.slice(2), env = process.env } = {
     mtokApiKey,
     upstreamKey,
     settlementAddr,
-    payerDenylist
+    payerDenylist,
+    maxOutputTokens
   };
 }
 
@@ -4929,7 +4947,17 @@ function createRedemptionStore({ file = null, retentionMs = DEFAULT_RETENTION_MS
       if (map.has(key)) return false;
       if (!markClaimed(markerKey)) return false;
       const entry = { state: "pending", at: now() };
-      append(key, entry);
+      try {
+        append(key, entry);
+      } catch (e) {
+        if (durable) {
+          try {
+            fs.unlinkSync(markerFor(markerKey));
+          } catch {
+          }
+        }
+        throw e;
+      }
       map.set(key, entry);
       return true;
     },
@@ -5300,8 +5328,21 @@ function validateRequest(request, model, { legacy = false } = {}) {
     }
   };
 }
+function normalizeModelId(m) {
+  return String(m ?? "").toLowerCase().split("/").pop().replace(/^@/, "");
+}
+function modelsCompatible(upstreamModel, offerModel) {
+  const a = normalizeModelId(upstreamModel);
+  const b = normalizeModelId(offerModel);
+  if (!a || !b) return false;
+  if (a === b) return true;
+  const [longer, shorter] = a.length >= b.length ? [a, b] : [b, a];
+  if (!longer.startsWith(shorter)) return false;
+  const rest = longer.slice(shorter.length);
+  return /^([-._]\d+)+$/.test(rest);
+}
 function enforceModelEcho(upstreamModel, offerModel) {
-  if (String(upstreamModel) !== String(offerModel))
+  if (!modelsCompatible(upstreamModel, offerModel))
     throw new Error(`model mismatch: upstream ${upstreamModel} != offer ${offerModel}`);
 }
 function configuredFeeAtomic({ sellerUsdAtomic, feeAddress, feeBps }) {
@@ -5322,7 +5363,8 @@ function estimateInputTokens(messages) {
   }
   return envelope + Math.ceil(bytes / BYTES_PER_TOKEN_EST);
 }
-function boundServe({ messages, budgetUsd, inPrice, outPrice, reqMax, contextCeil = 4096 }) {
+var DEFAULT_MAX_OUTPUT_TOKENS = 32768;
+function boundServe({ messages, budgetUsd, inPrice, outPrice, reqMax, contextCeil = DEFAULT_MAX_OUTPUT_TOKENS }) {
   const estIn = estimateInputTokens(messages);
   const estInCostUsd = estIn * (Number(inPrice) > 0 ? Number(inPrice) : 0) / 1e6;
   if (estInCostUsd >= budgetUsd) return { refuse: true, reason: "input", estIn, estInCostUsd };
@@ -5350,9 +5392,17 @@ function createServeCore({
   dripContractAddress,
   feeRecipient,
   feeBps,
-  screenPayer
+  screenPayer,
+  // #654: the output-token sanity ceiling for boundServe. The PAID budget already
+  // bounds output (and metering is on real usage), so this is a defensive cap on a
+  // single generation, not a money guard. It is a per-relay knob: the reference host
+  // passes MTOK_MAX_OUTPUT_TOKENS / a config value; operators serving large-context
+  // models raise it. Falls back to boundServe's own generous default when unset.
+  maxOutputTokens
 }) {
   const serve = async (body) => {
+    const currentFeeBps = typeof feeBps === "function" ? feeBps() : feeBps;
+    const currentFeeRecipient = typeof feeRecipient === "function" ? feeRecipient() : feeRecipient;
     const { bookingId, n, buyerId, request, requestNonce, drawPaidTxHash } = body;
     const hasRequestNonce = Object.hasOwn(body, "requestNonce");
     if (!bookingId) return { status: 400, body: { error: "bad_request", detail: "DRAW needs bookingId" } };
@@ -5386,7 +5436,7 @@ function createServeCore({
         n,
         requestHash,
         sellerWallet,
-        feeRecipient,
+        feeRecipient: currentFeeRecipient,
         // #580: refuse a payment older than the redemption window. The JSONL
         // payload cache AND the claim markers are both aged out at boot (#600),
         // so past retention this age bound is the sole replay defense (its
@@ -5400,8 +5450,8 @@ function createServeCore({
     if (!paid?.ok) return { status: 402, body: { error: "payment_unverified", detail: paid?.reason || "unknown" } };
     const expectedFee = configuredFeeAtomic({
       sellerUsdAtomic: paid.event.sellerUsdAtomic,
-      feeAddress: feeRecipient,
-      feeBps
+      feeAddress: currentFeeRecipient,
+      feeBps: currentFeeBps
     });
     if (BigInt(paid.event.feeUsdAtomic || 0) < expectedFee) {
       return { status: 402, body: { error: "payment_unverified", detail: "fee_amount_too_low" } };
@@ -5439,7 +5489,7 @@ function createServeCore({
     const eventOutPriceUsd = Number(paidEvent.outputPricePerMTokAtomic || 0) / 1e6;
     const boundInPrice = Math.max(Number(inPrice) || 0, eventInPriceUsd);
     const boundOutPrice = Math.max(Number(outPrice) || 0, eventOutPriceUsd);
-    const bound = boundServe({ messages: checked.safeRequest.messages, budgetUsd: remainingUsd, inPrice: boundInPrice, outPrice: boundOutPrice, reqMax: checked.safeRequest.max_tokens });
+    const bound = boundServe({ messages: checked.safeRequest.messages, budgetUsd: remainingUsd, inPrice: boundInPrice, outPrice: boundOutPrice, reqMax: checked.safeRequest.max_tokens, ...Number(maxOutputTokens) > 0 ? { contextCeil: Math.floor(Number(maxOutputTokens)) } : {} });
     if (bound.refuse) {
       const error = bound.reason === "input" ? "input_too_large" : "output_unfunded";
       return { status: 402, body: { error, detail: `estimated input (~${bound.estIn} tokens, $${bound.estInCostUsd.toFixed(6)}) leaves no safely funded output in the paid amount ($${remainingUsd})`, _bookingId: bookingId, remainingUsd } };
@@ -5463,6 +5513,7 @@ function createServeCore({
     } catch (e) {
       return { status: 502, body: { error: "model_mismatch", detail: e.message } };
     }
+    if (completion && typeof completion === "object") completion.model = model;
     const usage = completion.usage ?? {};
     const inTok = Number(usage.prompt_tokens ?? usage.input_tokens ?? 0) || 0;
     const outTok = Number(usage.completion_tokens ?? usage.output_tokens ?? 0) || 0;
@@ -5520,6 +5571,24 @@ async function createRelayRuntime(config) {
   const served = createRedemptionStore({ file: config.redemptionFile, log: config.log });
   const drawLocks = /* @__PURE__ */ new Map();
   const platform = await fetchPlatformConfig(config);
+  const bootFeeBps = platform.feeBps;
+  const FEE_REFRESH_MS = 6e4;
+  let lastConfigFetch = Date.now();
+  const refreshPlatformFee = async () => {
+    lastConfigFetch = Date.now();
+    try {
+      const fresh = await fetchPlatformConfig(config);
+      platform.feeBps = fresh.feeBps;
+      return true;
+    } catch (e) {
+      (config.log ?? console).error?.(`mtok relay: platform config refresh failed (${e.message}); keeping last-known fee rate`);
+      return false;
+    }
+  };
+  const refreshPlatformFeeIfStale = async () => {
+    if (Date.now() - lastConfigFetch < FEE_REFRESH_MS) return;
+    await refreshPlatformFee();
+  };
   const verifier = createOnchainVerifier({ rpcUrls: rpcUrlsFor(platform.chainId, config.rpcFlag), usdcAddress: platform.usdcAddress, expectedChainId: platform.chainId });
   if (!verifier.configured) throw new Error("onchain verifier not configured (missing usdcAddress in /api/config)");
   const payerDenylist = new Set((config.payerDenylist ?? []).map((a) => String(a).trim().toLowerCase()).filter(Boolean));
@@ -5543,8 +5612,13 @@ async function createRelayRuntime(config) {
     sellerAgentId: config.sellerAgentId,
     sellerWallet: config.settlementAddr,
     dripContractAddress: platform.dripContractAddress,
+    // #654: the fee floor is min(boot, current) so neither a fee increase nor a
+    // decrease can over-demand and strand an honest already-paid draw; the recipient
+    // stays pinned to the boot address (exact-match verify, see the note above).
     feeRecipient: platform.feeAddress,
-    feeBps: platform.feeBps,
+    feeBps: () => Math.min(bootFeeBps, platform.feeBps),
+    // #654: per-relay output sanity ceiling (unset => the shared generous default).
+    maxOutputTokens: config.maxOutputTokens,
     screenPayer: payerDenied
   });
   const withBookingLock = async (bookingId, fn) => {
@@ -5566,7 +5640,11 @@ async function createRelayRuntime(config) {
     }
   };
   const handleDraw = (body, res) => withBookingLock(String(body?.bookingId ?? ""), async () => {
-    const out = await core.serve(body);
+    await refreshPlatformFeeIfStale();
+    let out = await core.serve(body);
+    if (out.status === 402 && out.body?.detail === "fee_amount_too_low" && await refreshPlatformFee()) {
+      out = await core.serve(body);
+    }
     return send(res, out.status, out.body);
   });
   return { handleDraw };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mtok-relay",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "description": "Reference seller relay for mtok.market — accepts on-chain-prepaid chunk draws and serves inference from an upstream you control.",
   "type": "module",
   "bin": {