mtok-relay 0.2.2 → 0.2.5

package/dist/mtok-relay.mjs

@@ -2157,7 +2157,7 @@ var secp256k1 = createCurve({
 }, sha256);
 
 // node_modules/viem/_esm/errors/version.js
-var version = "2.55.10";
+var version = "2.56.8";
 
 // node_modules/viem/_esm/errors/base.js
 var errorConfig = {
@@ -2423,7 +2423,7 @@ function hexToBigInt(hex, opts = {}) {
   const value = BigInt(hex);
   if (!signed)
     return value;
-  const size2 = (hex.length - 2) / 2;
+  const size2 = Math.ceil((hex.length - 2) / 2);
   const max = (1n << BigInt(size2) * 8n - 1n) - 1n;
   if (value <= max)
     return value;
@@ -4432,6 +4432,15 @@ var InvalidStructTypeError = class extends BaseError {
     });
   }
 };
+var InvalidTypedDataTypeError = class extends BaseError {
+  constructor({ type }) {
+    const canonicalType = type.replace(/^(u?int)/, "$&256");
+    super(`Type "${type}" is not a valid EIP-712 type.`, {
+      metaMessages: [`Use "${canonicalType}" instead.`],
+      name: "InvalidTypedDataTypeError"
+    });
+  }
+};
 
 // node_modules/viem/_esm/utils/typedData.js
 function validateTypedData(parameters) {
@@ -4440,6 +4449,9 @@ function validateTypedData(parameters) {
     for (const param of struct) {
       const { name, type } = param;
       const value = data[name];
+      const baseType = type.replace(/(\[[0-9]*\])+$/, "");
+      if (baseType === "int" || baseType === "uint")
+        throw new InvalidTypedDataTypeError({ type });
       const integerMatch = type.match(integerRegex);
       if (integerMatch && (typeof value === "number" || typeof value === "bigint")) {
         const [_type, base, size_] = integerMatch;
@@ -4650,6 +4662,7 @@ function privateKeyToAccount(privateKey, options = {}) {
 }
 
 // src/config.mjs
+import { isIP } from "node:net";
 var flag = (args, name) => {
   const i = args.indexOf(name);
   return i !== -1 ? args[i + 1] : null;
@@ -4670,6 +4683,20 @@ function readRelayConfig({ argv = process.argv.slice(2), env = process.env } = {
   const redemptionFile = redemptionFlag === void 0 ? "./.mtok-redemption.jsonl" : redemptionFlag;
   const denylistRaw = flag(argv, "--payer-denylist") ?? env.RELAY_PAYER_DENYLIST ?? "";
   const payerDenylist = String(denylistRaw).split(",").map((a) => a.trim().toLowerCase()).filter(Boolean);
+  const maxOutputRaw = flag(argv, "--max-output-tokens") ?? env.RELAY_MAX_OUTPUT_TOKENS;
+  const maxOutputTokens = maxOutputRaw != null ? Number(maxOutputRaw) : void 0;
+  if (maxOutputTokens != null && (!Number.isFinite(maxOutputTokens) || maxOutputTokens < 1)) {
+    throw new Error("--max-output-tokens must be a positive integer");
+  }
+  const trustedProxies = String(env.RELAY_TRUSTED_PROXIES ?? "").split(",").map((value) => value.trim()).filter(Boolean);
+  if (trustedProxies.some((value) => !isIP(value) || value.includes("%"))) throw new Error("RELAY_TRUSTED_PROXIES must contain exact IP addresses");
+  const clientIpHeader = String(env.RELAY_CLIENT_IP_HEADER ?? "cf-connecting-ip").toLowerCase();
+  if (!/^[a-z0-9-]+$/.test(clientIpHeader)) throw new Error("RELAY_CLIENT_IP_HEADER must be a header name");
+  const maxConcurrentRequests = Number(env.RELAY_MAX_CONCURRENT_REQUESTS ?? 64);
+  const upstreamTimeoutMs = Number(env.RELAY_UPSTREAM_TIMEOUT_MS ?? 12e4);
+  for (const [name, value] of Object.entries({ RELAY_MAX_CONCURRENT_REQUESTS: maxConcurrentRequests, RELAY_UPSTREAM_TIMEOUT_MS: upstreamTimeoutMs })) {
+    if (!Number.isSafeInteger(value) || value < 1 || value > 2147483647) throw new Error(`${name} must be a positive finite integer`);
+  }
   if (!offerId) throw new Error("--offer <id> is required");
   if (!model) throw new Error("--model <id> is required (the offer model you serve)");
   if (!upstream) throw new Error("--upstream <url> is required");
@@ -4708,23 +4735,73 @@ function readRelayConfig({ argv = process.argv.slice(2), env = process.env } = {
     mtokApiKey,
     upstreamKey,
     settlementAddr,
-    payerDenylist
+    payerDenylist,
+    maxOutputTokens,
+    trustedProxies,
+    clientIpHeader,
+    maxConcurrentRequests,
+    upstreamTimeoutMs
   };
 }
 
 // src/http.mjs
 import http from "node:http";
+import { isIP as isIP2 } from "node:net";
+
+// core/errors.js
+function apiError(status, code, message, details) {
+  const err = new Error(message);
+  err.status = status;
+  err.code = code;
+  if (details !== void 0) err.details = details;
+  return err;
+}
+
+// core/limiter.js
+function createLimiter({ windowMs = 6e4, max = 120, maxKeys = 1e4, now = () => Date.now() } = {}) {
+  const windows = /* @__PURE__ */ new Map();
+  return {
+    check(key, scope = "api") {
+      const id = `${scope}:${key}`;
+      const t = now();
+      let w = windows.get(id);
+      if (!w || t - w.start >= windowMs) {
+        w = { start: t, count: 0 };
+        windows.delete(id);
+        if (windows.size >= maxKeys) windows.delete(windows.keys().next().value);
+        windows.set(id, w);
+      }
+      w.count += 1;
+      if (w.count > max) {
+        const retryInSeconds = Math.ceil((w.start + windowMs - t) / 1e3);
+        throw apiError(429, "rate_limited", `Rate limit exceeded (${max}/${windowMs / 1e3}s). Retry in ~${retryInSeconds}s.`, { retryAfterSeconds: retryInSeconds });
+      }
+    },
+    get size() {
+      return windows.size;
+    }
+  };
+}
+
+// src/http.mjs
 var MAX_BODY_BYTES = 256e3;
-function readBody(req, { maxBytes = MAX_BODY_BYTES } = {}) {
+function readBody(req, { maxBytes = MAX_BODY_BYTES, timeoutMs = 1e4 } = {}) {
   return new Promise((resolve, reject) => {
     const chunks = [];
     let bytes = 0;
     let settled = false;
+    const fail = (error) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      chunks.length = 0;
+      reject(error);
+    };
+    const timer = setTimeout(() => fail(Object.assign(new Error("body_timeout"), { code: "body_timeout" })), timeoutMs);
     req.on("data", (d) => {
       bytes += d.length;
       if (bytes > maxBytes && !settled) {
-        settled = true;
-        reject(Object.assign(new Error("body_too_large"), { code: "body_too_large" }));
+        fail(Object.assign(new Error("body_too_large"), { code: "body_too_large" }));
         req.resume();
         return;
       }
@@ -4734,6 +4811,7 @@ function readBody(req, { maxBytes = MAX_BODY_BYTES } = {}) {
     req.on("end", () => {
       if (settled) return;
       settled = true;
+      clearTimeout(timer);
       const raw = Buffer.concat(chunks).toString("utf8");
       try {
         resolve(JSON.parse(raw || "{}"));
@@ -4741,54 +4819,82 @@ function readBody(req, { maxBytes = MAX_BODY_BYTES } = {}) {
         resolve({});
       }
     });
-    req.on("error", (e) => {
-      if (settled) return;
-      settled = true;
-      reject(e);
-    });
+    req.on("error", fail);
+    req.on("aborted", () => fail(new Error("body_aborted")));
   });
 }
 function send(res, status, body) {
+  if (res.destroyed || res.writableEnded) return;
   const payload = JSON.stringify(body);
   res.writeHead(status, { "content-type": "application/json", "content-length": Buffer.byteLength(payload) });
   res.end(payload);
 }
+function canonicalIp(value) {
+  if (typeof value !== "string" || value.includes("%") || !isIP2(value)) return null;
+  if (isIP2(value) === 4) return value;
+  const canonical = new URL(`http://[${value}]/`).hostname.slice(1, -1);
+  const mapped = /^::ffff:([\da-f]+):([\da-f]+)$/.exec(canonical);
+  if (mapped) return mapped.slice(1).flatMap((word) => [parseInt(word, 16) >> 8, parseInt(word, 16) & 255]).join(".");
+  return canonical;
+}
+function clientRateKey(req, trustedProxies = /* @__PURE__ */ new Set(), header = "cf-connecting-ip") {
+  const peer = canonicalIp(req.socket.remoteAddress) ?? "unknown";
+  const forwarded = trustedProxies.has(peer) ? canonicalIp(req.headers[header]) : null;
+  const address = forwarded ?? peer;
+  if (!address.includes(":")) return address;
+  const [left, right] = address.split("::");
+  const start = left ? left.split(":") : [];
+  const end = right ? right.split(":") : [];
+  const words = right === void 0 ? start : [...start, ...Array(8 - start.length - end.length).fill("0"), ...end];
+  return words.slice(0, 4).map((word) => word.padStart(4, "0")).join(":") + "::/64";
+}
 function startRelayServer({ config, handleDraw }) {
-  const windows = /* @__PURE__ */ new Map();
-  const windowMs = 6e4;
-  const maxPerMinute = Number(config.maxRequestsPerMinute ?? 120);
-  const checkRate = (req) => {
-    if (!Number.isFinite(maxPerMinute)) return true;
-    const key = req.socket.remoteAddress || "unknown";
-    const now = Date.now();
-    let w = windows.get(key);
-    if (!w || now - w.start >= windowMs) {
-      w = { start: now, count: 0 };
-      windows.set(key, w);
-      if (windows.size > 1e4) {
-        for (const [k, v] of windows) if (now - v.start >= windowMs) windows.delete(k);
-      }
-    }
-    w.count += 1;
-    return w.count <= maxPerMinute;
-  };
-  const server = http.createServer(async (req, res) => {
+  const callers = createLimiter({ max: config.maxRequestsPerMinute ?? 120 });
+  const aggregate = createLimiter({ max: config.maxTotalRequestsPerMinute ?? 1200 });
+  const trustedProxies = new Set((config.trustedProxies ?? []).map(canonicalIp).filter(Boolean));
+  const maxConcurrent = config.maxConcurrentRequests ?? 64;
+  let active = 0;
+  const server = http.createServer({ headersTimeout: 1e4, requestTimeout: 15e3, connectionsCheckingInterval: 1e3 }, async (req, res) => {
+    const refuse = (status, error) => {
+      if (res.headersSent || res.destroyed) return res.destroy();
+      res.setHeader("connection", "close");
+      res.once("finish", () => req.destroy());
+      send(res, status, { error });
+    };
     if (req.method !== "POST" || req.url !== "/chunk") {
-      return send(res, 404, { error: "not found" });
+      return refuse(404, "not found");
     }
-    if (!checkRate(req)) return send(res, 429, { error: "rate_limited" });
-    let body;
     try {
-      body = await readBody(req);
-    } catch (e) {
-      if (e?.code === "body_too_large") return send(res, 413, { error: "body_too_large" });
-      return send(res, 400, { error: "bad body" });
+      callers.check(clientRateKey(req, trustedProxies, config.clientIpHeader ?? "cf-connecting-ip"));
+      aggregate.check("all");
+    } catch {
+      res.setHeader("retry-after", "60");
+      return refuse(429, "rate_limited");
     }
-    if (body.request == null) {
-      return send(res, 400, { error: "bad_request", detail: "need a DRAW (request); the legacy FUND lane is retired, pay per draw on-chain" });
+    if (active >= maxConcurrent) return refuse(503, "relay_busy");
+    active++;
+    try {
+      let body;
+      try {
+        body = await readBody(req, { timeoutMs: config.bodyTimeoutMs ?? 1e4 });
+      } catch (e) {
+        if (e?.code === "body_too_large") return refuse(413, "body_too_large");
+        if (e?.code === "body_timeout") return refuse(408, "relay_timeout");
+        return refuse(400, "bad body");
+      }
+      if (body?.request == null) {
+        return send(res, 400, { error: "bad_request", detail: "need a DRAW (request); the legacy FUND lane is retired, pay per draw on-chain" });
+      }
+      await handleDraw(body, res);
+    } catch (error) {
+      (config.log ?? console).error?.(`mtok relay: request failed (${error.message})`);
+      refuse(503, "relay_unavailable");
+    } finally {
+      active--;
     }
-    return handleDraw(body, res);
   });
+  server.maxConnections = maxConcurrent * 2;
+  server.maxRequestsPerSocket = 100;
   server.listen(config.port, () => {
     console.log(`mtok-relay: listening on port ${config.port}  offer=${config.offerId}  model=${config.model}  upstream=${config.upstream}  api=${config.apiBase}  settlement=${config.settlementAddr}`);
   });
@@ -4929,7 +5035,17 @@ function createRedemptionStore({ file = null, retentionMs = DEFAULT_RETENTION_MS
       if (map.has(key)) return false;
       if (!markClaimed(markerKey)) return false;
       const entry = { state: "pending", at: now() };
-      append(key, entry);
+      try {
+        append(key, entry);
+      } catch (e) {
+        if (durable) {
+          try {
+            fs.unlinkSync(markerFor(markerKey));
+          } catch {
+          }
+        }
+        throw e;
+      }
       map.set(key, entry);
       return true;
     },
@@ -4949,15 +5065,6 @@ function createRedemptionStore({ file = null, retentionMs = DEFAULT_RETENTION_MS
   };
 }
 
-// core/errors.js
-function apiError(status, code, message, details) {
-  const err = new Error(message);
-  err.status = status;
-  err.code = code;
-  if (details !== void 0) err.details = details;
-  return err;
-}
-
 // core/onchain.js
 var TRANSFER_TOPIC = "0xddf252ad1be2c89b69c2b068fc378daa952ba7f163c4a11628f55a4df523b3ef";
 var DRAW_PAID_TOPIC = "0xb0243f80521d0dccd159389597aba96047e60ba5d7a9df12b67e5cb75230ac41";
@@ -5028,8 +5135,9 @@ function createOnchainVerifier({
   receiptRetries = 3,
   receiptRetryMs = 700,
   sleepImpl = (ms) => new Promise((r) => setTimeout(r, ms)),
-  nowMs = () => Date.now()
+  nowMs = () => Date.now(),
   // injectable clock for the optional draw-age guard (verifyDrawPaid maxPaidAgeMs).
+  rpcTimeoutMs = 5e3
 } = {}) {
   const urls = (rpcUrls?.length ? rpcUrls : String(rpcUrl || "").split(",")).map((s) => String(s).trim()).filter(Boolean);
   const configured = Boolean(urls.length && usdcAddress);
@@ -5038,7 +5146,8 @@ function createOnchainVerifier({
     const res = await fetchImpl(url, {
       method: "POST",
       headers: { "content-type": "application/json" },
-      body: JSON.stringify({ jsonrpc: "2.0", id: 1, method, params })
+      body: JSON.stringify({ jsonrpc: "2.0", id: 1, method, params }),
+      signal: AbortSignal.timeout(rpcTimeoutMs)
     });
     if (!res.ok) throw apiError(502, "rpc_error", `chain RPC returned ${res.status}`);
     const body = await res.json();
@@ -5063,13 +5172,16 @@ function createOnchainVerifier({
   async function assertChain() {
     if (!chainPinned) return true;
     if (chainOkUrls.size) return true;
+    let timeout;
     for (const url of urls) {
       try {
         const hex = await rpcOn(url, "eth_chainId", []);
         if (typeof hex === "string" && parseInt(hex, 16) === expChain) chainOkUrls.add(url);
-      } catch {
+      } catch (error) {
+        if (error.name === "TimeoutError") timeout = error;
       }
     }
+    if (!chainOkUrls.size && timeout) throw timeout;
     return chainOkUrls.size > 0;
   }
   async function fetchReceipt(txHash) {
@@ -5184,23 +5296,27 @@ function createOnchainVerifier({
       if (BigInt(event.sellerUsdAtomic) < BigInt(minSellerAtomic)) return { ok: false, reason: "amount_too_low" };
       const maxAge = Number(maxPaidAgeMs);
       if (Number.isFinite(maxAge) && maxAge > 0) {
-        const bn = matchedLog?.blockNumber;
+        const bn = matchedLog?.blockNumber ?? got.receipt.blockNumber;
         let paidAtMs = null;
         if (bn != null) {
-          const blockTag = typeof bn === "string" && bn.startsWith("0x") ? bn : "0x" + BigInt(bn).toString(16);
           for (let i = 0; i <= receiptRetries; i++) {
             try {
+              const blockTag = "0x" + BigInt(bn).toString(16);
               const block = await rpc("eth_getBlockByNumber", [blockTag, false]);
               if (block?.timestamp != null) {
-                paidAtMs = Number(BigInt(block.timestamp)) * 1e3;
-                break;
+                const timestamp = Number(BigInt(block.timestamp)) * 1e3;
+                if (Number.isSafeInteger(timestamp) && timestamp >= 0 && timestamp <= nowMs() + 6e4) {
+                  paidAtMs = timestamp;
+                  break;
+                }
               }
             } catch {
             }
             if (i < receiptRetries) await sleepImpl(receiptRetryMs);
           }
         }
-        if (paidAtMs != null && nowMs() - paidAtMs > maxAge) return { ok: false, reason: "payment_too_old" };
+        if (paidAtMs == null) return { ok: false, reason: "payment_age_unavailable" };
+        if (nowMs() - paidAtMs > maxAge) return { ok: false, reason: "payment_too_old" };
       }
       const consumed = /* @__PURE__ */ new Set();
       let sellerTransfer = null;
@@ -5300,8 +5416,21 @@ function validateRequest(request, model, { legacy = false } = {}) {
     }
   };
 }
+function normalizeModelId(m) {
+  return String(m ?? "").toLowerCase().split("/").pop().replace(/^@/, "");
+}
+function modelsCompatible(upstreamModel, offerModel) {
+  const a = normalizeModelId(upstreamModel);
+  const b = normalizeModelId(offerModel);
+  if (!a || !b) return false;
+  if (a === b) return true;
+  const [longer, shorter] = a.length >= b.length ? [a, b] : [b, a];
+  if (!longer.startsWith(shorter)) return false;
+  const rest = longer.slice(shorter.length);
+  return /^([-._]\d+)+$/.test(rest);
+}
 function enforceModelEcho(upstreamModel, offerModel) {
-  if (String(upstreamModel) !== String(offerModel))
+  if (!modelsCompatible(upstreamModel, offerModel))
     throw new Error(`model mismatch: upstream ${upstreamModel} != offer ${offerModel}`);
 }
 function configuredFeeAtomic({ sellerUsdAtomic, feeAddress, feeBps }) {
@@ -5322,7 +5451,8 @@ function estimateInputTokens(messages) {
   }
   return envelope + Math.ceil(bytes / BYTES_PER_TOKEN_EST);
 }
-function boundServe({ messages, budgetUsd, inPrice, outPrice, reqMax, contextCeil = 4096 }) {
+var DEFAULT_MAX_OUTPUT_TOKENS = 32768;
+function boundServe({ messages, budgetUsd, inPrice, outPrice, reqMax, contextCeil = DEFAULT_MAX_OUTPUT_TOKENS }) {
   const estIn = estimateInputTokens(messages);
   const estInCostUsd = estIn * (Number(inPrice) > 0 ? Number(inPrice) : 0) / 1e6;
   if (estInCostUsd >= budgetUsd) return { refuse: true, reason: "input", estIn, estInCostUsd };
@@ -5350,9 +5480,17 @@ function createServeCore({
   dripContractAddress,
   feeRecipient,
   feeBps,
-  screenPayer
+  screenPayer,
+  // #654: the output-token sanity ceiling for boundServe. The PAID budget already
+  // bounds output (and metering is on real usage), so this is a defensive cap on a
+  // single generation, not a money guard. It is a per-relay knob: the reference host
+  // passes MTOK_MAX_OUTPUT_TOKENS / a config value; operators serving large-context
+  // models raise it. Falls back to boundServe's own generous default when unset.
+  maxOutputTokens
 }) {
   const serve = async (body) => {
+    const currentFeeBps = typeof feeBps === "function" ? feeBps() : feeBps;
+    const currentFeeRecipient = typeof feeRecipient === "function" ? feeRecipient() : feeRecipient;
     const { bookingId, n, buyerId, request, requestNonce, drawPaidTxHash } = body;
     const hasRequestNonce = Object.hasOwn(body, "requestNonce");
     if (!bookingId) return { status: 400, body: { error: "bad_request", detail: "DRAW needs bookingId" } };
@@ -5373,6 +5511,17 @@ function createServeCore({
       return { status: 402, body: { error: "contract_mode_required", detail: "this relay only serves contract-mode draws; the platform is not reporting a dripContractAddress" } };
     }
     if (!drawPaidTxHash) return { status: 402, body: { error: "draw_payment_required", detail: "contract mode requires drawPaidTxHash before upstream delivery" } };
+    let storedKey = cacheKey;
+    let redemptionState = await redemption.state(storedKey);
+    if (!redemptionState && oldLegacyKey) {
+      const oldLegacyState = await redemption.state(oldLegacyKey);
+      if (oldLegacyState) {
+        storedKey = oldLegacyKey;
+        redemptionState = oldLegacyState;
+      } else {
+        redemptionState = await redemption.state(cacheKey);
+      }
+    }
     let paid;
     try {
       paid = await verifier.verifyDrawPaid(drawPaidTxHash, {
@@ -5386,22 +5535,21 @@ function createServeCore({
         n,
         requestHash,
         sellerWallet,
-        feeRecipient,
-        // #580: refuse a payment older than the redemption window. The JSONL
-        // payload cache AND the claim markers are both aged out at boot (#600),
-        // so past retention this age bound is the sole replay defense (its
-        // skip-on-unreadable-block residual is named in redemption.mjs). An
-        // honest retry is seconds-to-minutes old, never days.
-        maxPaidAgeMs: redemption.retentionMs
+        feeRecipient: currentFeeRecipient,
+        // A known completion spends no new inference. New claims need a verified
+        // age because both payload and claim markers expire after retention.
+        maxPaidAgeMs: redemptionState === "complete" ? void 0 : redemption.retentionMs
       });
     } catch (e) {
+      if (e.name === "TimeoutError") return { status: 503, body: { error: "relay_timeout", _bookingId: bookingId } };
       return { status: 402, body: { error: "payment_unverified", detail: e.message } };
     }
+    if (paid?.reason === "payment_age_unavailable") return { status: 503, body: { error: "payment_age_unavailable", detail: "payment age could not be verified; retry this same paid draw", _bookingId: bookingId } };
     if (!paid?.ok) return { status: 402, body: { error: "payment_unverified", detail: paid?.reason || "unknown" } };
     const expectedFee = configuredFeeAtomic({
       sellerUsdAtomic: paid.event.sellerUsdAtomic,
-      feeAddress: feeRecipient,
-      feeBps
+      feeAddress: currentFeeRecipient,
+      feeBps: currentFeeBps
     });
     if (BigInt(paid.event.feeUsdAtomic || 0) < expectedFee) {
       return { status: 402, body: { error: "payment_unverified", detail: "fee_amount_too_low" } };
@@ -5415,17 +5563,6 @@ function createServeCore({
         return { status: 403, body: { error: "payer_denied", detail: "payer screening failed: " + e.message } };
       }
     }
-    let storedKey = cacheKey;
-    let redemptionState = await redemption.state(storedKey);
-    if (!redemptionState && oldLegacyKey) {
-      const oldLegacyState = await redemption.state(oldLegacyKey);
-      if (oldLegacyState) {
-        storedKey = oldLegacyKey;
-        redemptionState = oldLegacyState;
-      } else {
-        redemptionState = await redemption.state(cacheKey);
-      }
-    }
     if (redemptionState === "complete") return { status: 200, body: await redemption.get(storedKey) };
     if (redemptionState === "pending") {
       return { status: 409, body: { error: "draw_pending", detail: "this paid draw was already claimed; refusing to run upstream again", _bookingId: bookingId } };
@@ -5439,7 +5576,7 @@ function createServeCore({
     const eventOutPriceUsd = Number(paidEvent.outputPricePerMTokAtomic || 0) / 1e6;
     const boundInPrice = Math.max(Number(inPrice) || 0, eventInPriceUsd);
     const boundOutPrice = Math.max(Number(outPrice) || 0, eventOutPriceUsd);
-    const bound = boundServe({ messages: checked.safeRequest.messages, budgetUsd: remainingUsd, inPrice: boundInPrice, outPrice: boundOutPrice, reqMax: checked.safeRequest.max_tokens });
+    const bound = boundServe({ messages: checked.safeRequest.messages, budgetUsd: remainingUsd, inPrice: boundInPrice, outPrice: boundOutPrice, reqMax: checked.safeRequest.max_tokens, ...Number(maxOutputTokens) > 0 ? { contextCeil: Math.floor(Number(maxOutputTokens)) } : {} });
     if (bound.refuse) {
       const error = bound.reason === "input" ? "input_too_large" : "output_unfunded";
       return { status: 402, body: { error, detail: `estimated input (~${bound.estIn} tokens, $${bound.estInCostUsd.toFixed(6)}) leaves no safely funded output in the paid amount ($${remainingUsd})`, _bookingId: bookingId, remainingUsd } };
@@ -5456,6 +5593,7 @@ function createServeCore({
     try {
       completion = await upstream(safeRequest);
     } catch (e) {
+      if (e.name === "TimeoutError") return { status: 503, body: { error: "relay_timeout", _bookingId: bookingId } };
       return { status: 502, body: { error: "upstream_error", detail: e.message } };
     }
     try {
@@ -5463,6 +5601,7 @@ function createServeCore({
     } catch (e) {
       return { status: 502, body: { error: "model_mismatch", detail: e.message } };
     }
+    if (completion && typeof completion === "object") completion.model = model;
     const usage = completion.usage ?? {};
     const inTok = Number(usage.prompt_tokens ?? usage.input_tokens ?? 0) || 0;
     const outTok = Number(usage.completion_tokens ?? usage.output_tokens ?? 0) || 0;
@@ -5479,7 +5618,7 @@ function createServeCore({
 }
 
 // bridge/bridge.mjs
-function httpUpstream({ baseUrl, key }) {
+function httpUpstream({ baseUrl, key, timeoutMs }) {
   const url = String(baseUrl || "").replace(/\/$/, "") + "/chat/completions";
   return async (payload) => {
     const res = await fetch(url, {
@@ -5488,7 +5627,8 @@ function httpUpstream({ baseUrl, key }) {
         "content-type": "application/json",
         ...key ? { authorization: `Bearer ${key}` } : {}
       },
-      body: JSON.stringify(payload)
+      body: JSON.stringify(payload),
+      ...timeoutMs == null ? {} : { signal: AbortSignal.timeout(timeoutMs) }
     });
     const text = await res.text();
     let json;
@@ -5520,11 +5660,29 @@ async function createRelayRuntime(config) {
   const served = createRedemptionStore({ file: config.redemptionFile, log: config.log });
   const drawLocks = /* @__PURE__ */ new Map();
   const platform = await fetchPlatformConfig(config);
+  const bootFeeBps = platform.feeBps;
+  const FEE_REFRESH_MS = 6e4;
+  let lastConfigFetch = Date.now();
+  const refreshPlatformFee = async () => {
+    lastConfigFetch = Date.now();
+    try {
+      const fresh = await fetchPlatformConfig(config);
+      platform.feeBps = fresh.feeBps;
+      return true;
+    } catch (e) {
+      (config.log ?? console).error?.(`mtok relay: platform config refresh failed (${e.message}); keeping last-known fee rate`);
+      return false;
+    }
+  };
+  const refreshPlatformFeeIfStale = async () => {
+    if (Date.now() - lastConfigFetch < FEE_REFRESH_MS) return;
+    await refreshPlatformFee();
+  };
   const verifier = createOnchainVerifier({ rpcUrls: rpcUrlsFor(platform.chainId, config.rpcFlag), usdcAddress: platform.usdcAddress, expectedChainId: platform.chainId });
   if (!verifier.configured) throw new Error("onchain verifier not configured (missing usdcAddress in /api/config)");
   const payerDenylist = new Set((config.payerDenylist ?? []).map((a) => String(a).trim().toLowerCase()).filter(Boolean));
   const screenPayer = typeof config.screenPayer === "function" ? config.screenPayer : null;
-  const upstream = httpUpstream({ baseUrl: config.upstream + "/v1", key: config.upstreamKey });
+  const upstream = httpUpstream({ baseUrl: config.upstream + "/v1", key: config.upstreamKey, timeoutMs: config.upstreamTimeoutMs ?? 12e4 });
   const payerDenied = async (payer) => {
     if (!payer) return false;
     if (payerDenylist.has(payer)) return true;
@@ -5543,8 +5701,13 @@ async function createRelayRuntime(config) {
     sellerAgentId: config.sellerAgentId,
     sellerWallet: config.settlementAddr,
     dripContractAddress: platform.dripContractAddress,
+    // #654: the fee floor is min(boot, current) so neither a fee increase nor a
+    // decrease can over-demand and strand an honest already-paid draw; the recipient
+    // stays pinned to the boot address (exact-match verify, see the note above).
     feeRecipient: platform.feeAddress,
-    feeBps: platform.feeBps,
+    feeBps: () => Math.min(bootFeeBps, platform.feeBps),
+    // #654: per-relay output sanity ceiling (unset => the shared generous default).
+    maxOutputTokens: config.maxOutputTokens,
     screenPayer: payerDenied
   });
   const withBookingLock = async (bookingId, fn) => {
@@ -5565,14 +5728,27 @@ async function createRelayRuntime(config) {
       if (drawLocks.get(bookingId) === tail) drawLocks.delete(bookingId);
     }
   };
-  const handleDraw = (body, res) => withBookingLock(String(body?.bookingId ?? ""), async () => {
-    const out = await core.serve(body);
-    return send(res, out.status, out.body);
-  });
+  let active = 0;
+  const handleDraw = async (body, res) => {
+    if (active >= (config.maxConcurrentRequests ?? 64)) return send(res, 503, { error: "relay_busy" });
+    active++;
+    try {
+      return await withBookingLock(String(body?.bookingId ?? ""), async () => {
+        await refreshPlatformFeeIfStale();
+        let out = await core.serve(body);
+        if (out.status === 402 && out.body?.detail === "fee_amount_too_low" && await refreshPlatformFee()) {
+          out = await core.serve(body);
+        }
+        return send(res, out.status, out.body);
+      });
+    } finally {
+      active--;
+    }
+  };
   return { handleDraw };
 }
 async function fetchPlatformConfig(config) {
-  const r = await fetch(config.apiBase + "/api/config");
+  const r = await fetch(config.apiBase + "/api/config", { signal: AbortSignal.timeout(5e3) });
   if (!r.ok) throw new Error("config fetch failed: " + r.status);
   const body = await r.json();
   return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mtok-relay",
-  "version": "0.2.2",
+  "version": "0.2.5",
   "description": "Reference seller relay for mtok.market — accepts on-chain-prepaid chunk draws and serves inference from an upstream you control.",
   "type": "module",
   "bin": {