mtok-relay 0.2.3 → 0.2.6

package/dist/mtok-relay.mjs

@@ -2157,7 +2157,7 @@ var secp256k1 = createCurve({
 }, sha256);
 
 // node_modules/viem/_esm/errors/version.js
-var version = "2.56.0";
+var version = "2.56.8";
 
 // node_modules/viem/_esm/errors/base.js
 var errorConfig = {
@@ -2423,7 +2423,7 @@ function hexToBigInt(hex, opts = {}) {
   const value = BigInt(hex);
   if (!signed)
     return value;
-  const size2 = (hex.length - 2) / 2;
+  const size2 = Math.ceil((hex.length - 2) / 2);
   const max = (1n << BigInt(size2) * 8n - 1n) - 1n;
   if (value <= max)
     return value;
@@ -4662,6 +4662,7 @@ function privateKeyToAccount(privateKey, options = {}) {
 }
 
 // src/config.mjs
+import { isIP } from "node:net";
 var flag = (args, name) => {
   const i = args.indexOf(name);
   return i !== -1 ? args[i + 1] : null;
@@ -4687,6 +4688,15 @@ function readRelayConfig({ argv = process.argv.slice(2), env = process.env } = {
   if (maxOutputTokens != null && (!Number.isFinite(maxOutputTokens) || maxOutputTokens < 1)) {
     throw new Error("--max-output-tokens must be a positive integer");
   }
+  const trustedProxies = String(env.RELAY_TRUSTED_PROXIES ?? "").split(",").map((value) => value.trim()).filter(Boolean);
+  if (trustedProxies.some((value) => !isIP(value) || value.includes("%"))) throw new Error("RELAY_TRUSTED_PROXIES must contain exact IP addresses");
+  const clientIpHeader = String(env.RELAY_CLIENT_IP_HEADER ?? "cf-connecting-ip").toLowerCase();
+  if (!/^[a-z0-9-]+$/.test(clientIpHeader)) throw new Error("RELAY_CLIENT_IP_HEADER must be a header name");
+  const maxConcurrentRequests = Number(env.RELAY_MAX_CONCURRENT_REQUESTS ?? 64);
+  const upstreamTimeoutMs = Number(env.RELAY_UPSTREAM_TIMEOUT_MS ?? 12e4);
+  for (const [name, value] of Object.entries({ RELAY_MAX_CONCURRENT_REQUESTS: maxConcurrentRequests, RELAY_UPSTREAM_TIMEOUT_MS: upstreamTimeoutMs })) {
+    if (!Number.isSafeInteger(value) || value < 1 || value > 2147483647) throw new Error(`${name} must be a positive finite integer`);
+  }
   if (!offerId) throw new Error("--offer <id> is required");
   if (!model) throw new Error("--model <id> is required (the offer model you serve)");
   if (!upstream) throw new Error("--upstream <url> is required");
@@ -4726,23 +4736,72 @@ function readRelayConfig({ argv = process.argv.slice(2), env = process.env } = {
     upstreamKey,
     settlementAddr,
     payerDenylist,
-    maxOutputTokens
+    maxOutputTokens,
+    trustedProxies,
+    clientIpHeader,
+    maxConcurrentRequests,
+    upstreamTimeoutMs
   };
 }
 
 // src/http.mjs
 import http from "node:http";
+import { isIP as isIP2 } from "node:net";
+
+// core/errors.js
+function apiError(status, code, message, details) {
+  const err = new Error(message);
+  err.status = status;
+  err.code = code;
+  if (details !== void 0) err.details = details;
+  return err;
+}
+
+// core/limiter.js
+function createLimiter({ windowMs = 6e4, max = 120, maxKeys = 1e4, now = () => Date.now() } = {}) {
+  const windows = /* @__PURE__ */ new Map();
+  return {
+    check(key, scope = "api") {
+      const id = `${scope}:${key}`;
+      const t = now();
+      let w = windows.get(id);
+      if (!w || t - w.start >= windowMs) {
+        w = { start: t, count: 0 };
+        windows.delete(id);
+        if (windows.size >= maxKeys) windows.delete(windows.keys().next().value);
+        windows.set(id, w);
+      }
+      w.count += 1;
+      if (w.count > max) {
+        const retryInSeconds = Math.ceil((w.start + windowMs - t) / 1e3);
+        throw apiError(429, "rate_limited", `Rate limit exceeded (${max}/${windowMs / 1e3}s). Retry in ~${retryInSeconds}s.`, { retryAfterSeconds: retryInSeconds });
+      }
+    },
+    get size() {
+      return windows.size;
+    }
+  };
+}
+
+// src/http.mjs
 var MAX_BODY_BYTES = 256e3;
-function readBody(req, { maxBytes = MAX_BODY_BYTES } = {}) {
+function readBody(req, { maxBytes = MAX_BODY_BYTES, timeoutMs = 1e4 } = {}) {
   return new Promise((resolve, reject) => {
     const chunks = [];
     let bytes = 0;
     let settled = false;
+    const fail = (error) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      chunks.length = 0;
+      reject(error);
+    };
+    const timer = setTimeout(() => fail(Object.assign(new Error("body_timeout"), { code: "body_timeout" })), timeoutMs);
     req.on("data", (d) => {
       bytes += d.length;
       if (bytes > maxBytes && !settled) {
-        settled = true;
-        reject(Object.assign(new Error("body_too_large"), { code: "body_too_large" }));
+        fail(Object.assign(new Error("body_too_large"), { code: "body_too_large" }));
         req.resume();
         return;
       }
@@ -4752,6 +4811,7 @@ function readBody(req, { maxBytes = MAX_BODY_BYTES } = {}) {
     req.on("end", () => {
       if (settled) return;
       settled = true;
+      clearTimeout(timer);
       const raw = Buffer.concat(chunks).toString("utf8");
       try {
         resolve(JSON.parse(raw || "{}"));
@@ -4759,54 +4819,82 @@ function readBody(req, { maxBytes = MAX_BODY_BYTES } = {}) {
         resolve({});
       }
     });
-    req.on("error", (e) => {
-      if (settled) return;
-      settled = true;
-      reject(e);
-    });
+    req.on("error", fail);
+    req.on("aborted", () => fail(new Error("body_aborted")));
   });
 }
 function send(res, status, body) {
+  if (res.destroyed || res.writableEnded) return;
   const payload = JSON.stringify(body);
   res.writeHead(status, { "content-type": "application/json", "content-length": Buffer.byteLength(payload) });
   res.end(payload);
 }
+function canonicalIp(value) {
+  if (typeof value !== "string" || value.includes("%") || !isIP2(value)) return null;
+  if (isIP2(value) === 4) return value;
+  const canonical = new URL(`http://[${value}]/`).hostname.slice(1, -1);
+  const mapped = /^::ffff:([\da-f]+):([\da-f]+)$/.exec(canonical);
+  if (mapped) return mapped.slice(1).flatMap((word) => [parseInt(word, 16) >> 8, parseInt(word, 16) & 255]).join(".");
+  return canonical;
+}
+function clientRateKey(req, trustedProxies = /* @__PURE__ */ new Set(), header = "cf-connecting-ip") {
+  const peer = canonicalIp(req.socket.remoteAddress) ?? "unknown";
+  const forwarded = trustedProxies.has(peer) ? canonicalIp(req.headers[header]) : null;
+  const address = forwarded ?? peer;
+  if (!address.includes(":")) return address;
+  const [left, right] = address.split("::");
+  const start = left ? left.split(":") : [];
+  const end = right ? right.split(":") : [];
+  const words = right === void 0 ? start : [...start, ...Array(8 - start.length - end.length).fill("0"), ...end];
+  return words.slice(0, 4).map((word) => word.padStart(4, "0")).join(":") + "::/64";
+}
 function startRelayServer({ config, handleDraw }) {
-  const windows = /* @__PURE__ */ new Map();
-  const windowMs = 6e4;
-  const maxPerMinute = Number(config.maxRequestsPerMinute ?? 120);
-  const checkRate = (req) => {
-    if (!Number.isFinite(maxPerMinute)) return true;
-    const key = req.socket.remoteAddress || "unknown";
-    const now = Date.now();
-    let w = windows.get(key);
-    if (!w || now - w.start >= windowMs) {
-      w = { start: now, count: 0 };
-      windows.set(key, w);
-      if (windows.size > 1e4) {
-        for (const [k, v] of windows) if (now - v.start >= windowMs) windows.delete(k);
-      }
-    }
-    w.count += 1;
-    return w.count <= maxPerMinute;
-  };
-  const server = http.createServer(async (req, res) => {
+  const callers = createLimiter({ max: config.maxRequestsPerMinute ?? 120 });
+  const aggregate = createLimiter({ max: config.maxTotalRequestsPerMinute ?? 1200 });
+  const trustedProxies = new Set((config.trustedProxies ?? []).map(canonicalIp).filter(Boolean));
+  const maxConcurrent = config.maxConcurrentRequests ?? 64;
+  let active = 0;
+  const server = http.createServer({ headersTimeout: 1e4, requestTimeout: 15e3, connectionsCheckingInterval: 1e3 }, async (req, res) => {
+    const refuse = (status, error) => {
+      if (res.headersSent || res.destroyed) return res.destroy();
+      res.setHeader("connection", "close");
+      res.once("finish", () => req.destroy());
+      send(res, status, { error });
+    };
     if (req.method !== "POST" || req.url !== "/chunk") {
-      return send(res, 404, { error: "not found" });
+      return refuse(404, "not found");
     }
-    if (!checkRate(req)) return send(res, 429, { error: "rate_limited" });
-    let body;
     try {
-      body = await readBody(req);
-    } catch (e) {
-      if (e?.code === "body_too_large") return send(res, 413, { error: "body_too_large" });
-      return send(res, 400, { error: "bad body" });
+      callers.check(clientRateKey(req, trustedProxies, config.clientIpHeader ?? "cf-connecting-ip"));
+      aggregate.check("all");
+    } catch {
+      res.setHeader("retry-after", "60");
+      return refuse(429, "rate_limited");
     }
-    if (body.request == null) {
-      return send(res, 400, { error: "bad_request", detail: "need a DRAW (request); the legacy FUND lane is retired, pay per draw on-chain" });
+    if (active >= maxConcurrent) return refuse(503, "relay_busy");
+    active++;
+    try {
+      let body;
+      try {
+        body = await readBody(req, { timeoutMs: config.bodyTimeoutMs ?? 1e4 });
+      } catch (e) {
+        if (e?.code === "body_too_large") return refuse(413, "body_too_large");
+        if (e?.code === "body_timeout") return refuse(408, "relay_timeout");
+        return refuse(400, "bad body");
+      }
+      if (body?.request == null) {
+        return send(res, 400, { error: "bad_request", detail: "need a DRAW (request); the legacy FUND lane is retired, pay per draw on-chain" });
+      }
+      await handleDraw(body, res);
+    } catch (error) {
+      (config.log ?? console).error?.(`mtok relay: request failed (${error.message})`);
+      refuse(503, "relay_unavailable");
+    } finally {
+      active--;
     }
-    return handleDraw(body, res);
   });
+  server.maxConnections = maxConcurrent * 2;
+  server.maxRequestsPerSocket = 100;
   server.listen(config.port, () => {
     console.log(`mtok-relay: listening on port ${config.port}  offer=${config.offerId}  model=${config.model}  upstream=${config.upstream}  api=${config.apiBase}  settlement=${config.settlementAddr}`);
   });
@@ -4977,15 +5065,6 @@ function createRedemptionStore({ file = null, retentionMs = DEFAULT_RETENTION_MS
   };
 }
 
-// core/errors.js
-function apiError(status, code, message, details) {
-  const err = new Error(message);
-  err.status = status;
-  err.code = code;
-  if (details !== void 0) err.details = details;
-  return err;
-}
-
 // core/onchain.js
 var TRANSFER_TOPIC = "0xddf252ad1be2c89b69c2b068fc378daa952ba7f163c4a11628f55a4df523b3ef";
 var DRAW_PAID_TOPIC = "0xb0243f80521d0dccd159389597aba96047e60ba5d7a9df12b67e5cb75230ac41";
@@ -5056,8 +5135,9 @@ function createOnchainVerifier({
   receiptRetries = 3,
   receiptRetryMs = 700,
   sleepImpl = (ms) => new Promise((r) => setTimeout(r, ms)),
-  nowMs = () => Date.now()
+  nowMs = () => Date.now(),
   // injectable clock for the optional draw-age guard (verifyDrawPaid maxPaidAgeMs).
+  rpcTimeoutMs = 5e3
 } = {}) {
   const urls = (rpcUrls?.length ? rpcUrls : String(rpcUrl || "").split(",")).map((s) => String(s).trim()).filter(Boolean);
   const configured = Boolean(urls.length && usdcAddress);
@@ -5066,7 +5146,8 @@ function createOnchainVerifier({
     const res = await fetchImpl(url, {
       method: "POST",
       headers: { "content-type": "application/json" },
-      body: JSON.stringify({ jsonrpc: "2.0", id: 1, method, params })
+      body: JSON.stringify({ jsonrpc: "2.0", id: 1, method, params }),
+      signal: AbortSignal.timeout(rpcTimeoutMs)
     });
     if (!res.ok) throw apiError(502, "rpc_error", `chain RPC returned ${res.status}`);
     const body = await res.json();
@@ -5091,13 +5172,16 @@ function createOnchainVerifier({
   async function assertChain() {
     if (!chainPinned) return true;
     if (chainOkUrls.size) return true;
+    let timeout;
     for (const url of urls) {
       try {
         const hex = await rpcOn(url, "eth_chainId", []);
         if (typeof hex === "string" && parseInt(hex, 16) === expChain) chainOkUrls.add(url);
-      } catch {
+      } catch (error) {
+        if (error.name === "TimeoutError") timeout = error;
       }
     }
+    if (!chainOkUrls.size && timeout) throw timeout;
     return chainOkUrls.size > 0;
   }
   async function fetchReceipt(txHash) {
@@ -5211,24 +5295,28 @@ function createOnchainVerifier({
       if (requestHash != null && lc(event.requestHash) !== lc(requestHash)) return { ok: false, reason: "request_hash_mismatch" };
       if (BigInt(event.sellerUsdAtomic) < BigInt(minSellerAtomic)) return { ok: false, reason: "amount_too_low" };
       const maxAge = Number(maxPaidAgeMs);
+      let paidAtMs = null;
       if (Number.isFinite(maxAge) && maxAge > 0) {
-        const bn = matchedLog?.blockNumber;
-        let paidAtMs = null;
+        const bn = matchedLog?.blockNumber ?? got.receipt.blockNumber;
         if (bn != null) {
-          const blockTag = typeof bn === "string" && bn.startsWith("0x") ? bn : "0x" + BigInt(bn).toString(16);
           for (let i = 0; i <= receiptRetries; i++) {
             try {
+              const blockTag = "0x" + BigInt(bn).toString(16);
               const block = await rpc("eth_getBlockByNumber", [blockTag, false]);
               if (block?.timestamp != null) {
-                paidAtMs = Number(BigInt(block.timestamp)) * 1e3;
-                break;
+                const timestamp = Number(BigInt(block.timestamp)) * 1e3;
+                if (Number.isSafeInteger(timestamp) && timestamp >= 0 && timestamp <= nowMs() + 6e4) {
+                  paidAtMs = timestamp;
+                  break;
+                }
               }
             } catch {
             }
             if (i < receiptRetries) await sleepImpl(receiptRetryMs);
           }
         }
-        if (paidAtMs != null && nowMs() - paidAtMs > maxAge) return { ok: false, reason: "payment_too_old" };
+        if (paidAtMs == null) return { ok: false, reason: "payment_age_unavailable" };
+        if (nowMs() - paidAtMs > maxAge) return { ok: false, reason: "payment_too_old" };
       }
       const consumed = /* @__PURE__ */ new Set();
       let sellerTransfer = null;
@@ -5242,11 +5330,37 @@ function createOnchainVerifier({
         feeTransfer = findUsdcTransfer(got.receipt, { to: feeRecipient, minAtomic: BigInt(event.feeUsdAtomic), from: event.buyer, consumed });
         if (!feeTransfer.ok) return { ok: false, reason: "fee_transfer_" + feeTransfer.reason };
       }
-      return { ok: true, event, from: sellerTransfer?.from ?? feeTransfer?.from ?? null };
+      return { ok: true, event, paidAtMs, from: sellerTransfer?.from ?? feeTransfer?.from ?? null };
     }
   };
 }
 
+// core/fee-policy.js
+function normalizeFeeSchedule(schedule) {
+  if (!Array.isArray(schedule) || !schedule.length || schedule.length > 64) throw new TypeError("fee schedule must contain 1..64 activation records");
+  let previous = -1;
+  return schedule.map(({ effectiveAtMs, feeBps }, index) => {
+    if (!Number.isSafeInteger(effectiveAtMs) || effectiveAtMs <= previous || index === 0 && effectiveAtMs !== 0) {
+      throw new TypeError("fee activations must start at 0 and increase in integer milliseconds");
+    }
+    if (!Number.isSafeInteger(feeBps) || feeBps < 0 || feeBps > 1e4) throw new TypeError("feeBps must be an integer from 0 to 10000");
+    previous = effectiveAtMs;
+    return { effectiveAtMs, feeBps };
+  });
+}
+function feeBpsAt(schedule, timeMs) {
+  if (!Number.isSafeInteger(timeMs) || timeMs < 0) throw new TypeError("verified payment time is required for fee policy");
+  return schedule.findLast((entry) => entry.effectiveAtMs <= timeMs).feeBps;
+}
+function paymentFeeBpsAt(schedule, paidAtMs) {
+  const start = Math.max(0, paidAtMs - 6e4);
+  let minimum = Math.min(feeBpsAt(schedule, paidAtMs), feeBpsAt(schedule, start));
+  for (const entry of schedule) {
+    if (entry.effectiveAtMs > start && entry.effectiveAtMs <= paidAtMs) minimum = Math.min(minimum, entry.feeBps);
+  }
+  return minimum;
+}
+
 // bridge/serve-core.mjs
 var BALANCE_EPSILON = 1e-6;
 var REQUEST_NONCE_RE = /^0x[0-9a-fA-F]{32}$/;
@@ -5401,7 +5515,6 @@ function createServeCore({
   maxOutputTokens
 }) {
   const serve = async (body) => {
-    const currentFeeBps = typeof feeBps === "function" ? feeBps() : feeBps;
     const currentFeeRecipient = typeof feeRecipient === "function" ? feeRecipient() : feeRecipient;
     const { bookingId, n, buyerId, request, requestNonce, drawPaidTxHash } = body;
     const hasRequestNonce = Object.hasOwn(body, "requestNonce");
@@ -5423,6 +5536,17 @@ function createServeCore({
       return { status: 402, body: { error: "contract_mode_required", detail: "this relay only serves contract-mode draws; the platform is not reporting a dripContractAddress" } };
     }
     if (!drawPaidTxHash) return { status: 402, body: { error: "draw_payment_required", detail: "contract mode requires drawPaidTxHash before upstream delivery" } };
+    let storedKey = cacheKey;
+    let redemptionState = await redemption.state(storedKey);
+    if (!redemptionState && oldLegacyKey) {
+      const oldLegacyState = await redemption.state(oldLegacyKey);
+      if (oldLegacyState) {
+        storedKey = oldLegacyKey;
+        redemptionState = oldLegacyState;
+      } else {
+        redemptionState = await redemption.state(cacheKey);
+      }
+    }
     let paid;
     try {
       paid = await verifier.verifyDrawPaid(drawPaidTxHash, {
@@ -5437,25 +5561,16 @@ function createServeCore({
         requestHash,
         sellerWallet,
         feeRecipient: currentFeeRecipient,
-        // #580: refuse a payment older than the redemption window. The JSONL
-        // payload cache AND the claim markers are both aged out at boot (#600),
-        // so past retention this age bound is the sole replay defense (its
-        // skip-on-unreadable-block residual is named in redemption.mjs). An
-        // honest retry is seconds-to-minutes old, never days.
-        maxPaidAgeMs: redemption.retentionMs
+        // A known claim spends no new inference. New claims need a verified
+        // age because both payload and claim markers expire after retention.
+        maxPaidAgeMs: redemptionState === "complete" || redemptionState === "pending" ? void 0 : redemption.retentionMs
       });
     } catch (e) {
+      if (e.name === "TimeoutError") return { status: 503, body: { error: "relay_timeout", _bookingId: bookingId } };
       return { status: 402, body: { error: "payment_unverified", detail: e.message } };
     }
+    if (paid?.reason === "payment_age_unavailable") return { status: 503, body: { error: "payment_age_unavailable", detail: "payment age could not be verified; retry this same paid draw", _bookingId: bookingId } };
     if (!paid?.ok) return { status: 402, body: { error: "payment_unverified", detail: paid?.reason || "unknown" } };
-    const expectedFee = configuredFeeAtomic({
-      sellerUsdAtomic: paid.event.sellerUsdAtomic,
-      feeAddress: currentFeeRecipient,
-      feeBps: currentFeeBps
-    });
-    if (BigInt(paid.event.feeUsdAtomic || 0) < expectedFee) {
-      return { status: 402, body: { error: "payment_unverified", detail: "fee_amount_too_low" } };
-    }
     if (screenPayer) {
       try {
         if (await screenPayer(String(paid.from || "").toLowerCase())) {
@@ -5465,21 +5580,21 @@ function createServeCore({
         return { status: 403, body: { error: "payer_denied", detail: "payer screening failed: " + e.message } };
       }
     }
-    let storedKey = cacheKey;
-    let redemptionState = await redemption.state(storedKey);
-    if (!redemptionState && oldLegacyKey) {
-      const oldLegacyState = await redemption.state(oldLegacyKey);
-      if (oldLegacyState) {
-        storedKey = oldLegacyKey;
-        redemptionState = oldLegacyState;
-      } else {
-        redemptionState = await redemption.state(cacheKey);
-      }
-    }
     if (redemptionState === "complete") return { status: 200, body: await redemption.get(storedKey) };
     if (redemptionState === "pending") {
       return { status: 409, body: { error: "draw_pending", detail: "this paid draw was already claimed; refusing to run upstream again", _bookingId: bookingId } };
     }
+    let currentFeeBps;
+    try {
+      currentFeeBps = typeof feeBps === "function" ? await feeBps(paid) : feeBps ?? 0;
+      if (!Number.isSafeInteger(currentFeeBps) || currentFeeBps < 0 || currentFeeBps > 1e4) throw new TypeError("invalid fee rate");
+    } catch {
+      return { status: 503, body: { error: "fee_policy_unavailable", detail: "fee policy could not be verified; retry this same paid draw", _bookingId: bookingId } };
+    }
+    const expectedFee = configuredFeeAtomic({ sellerUsdAtomic: paid.event.sellerUsdAtomic, feeAddress: currentFeeRecipient, feeBps: currentFeeBps });
+    if (BigInt(paid.event.feeUsdAtomic || 0) < expectedFee) {
+      return { status: 402, body: { error: "payment_unverified", detail: "fee_amount_too_low" } };
+    }
     const paidEvent = paid.event;
     const remainingUsd = Number(paid.event.sellerUsdAtomic || 0) / 1e6;
     if (remainingUsd < BALANCE_EPSILON) {
@@ -5506,6 +5621,7 @@ function createServeCore({
     try {
       completion = await upstream(safeRequest);
     } catch (e) {
+      if (e.name === "TimeoutError") return { status: 503, body: { error: "relay_timeout", _bookingId: bookingId } };
       return { status: 502, body: { error: "upstream_error", detail: e.message } };
     }
     try {
@@ -5530,7 +5646,7 @@ function createServeCore({
 }
 
 // bridge/bridge.mjs
-function httpUpstream({ baseUrl, key }) {
+function httpUpstream({ baseUrl, key, timeoutMs }) {
   const url = String(baseUrl || "").replace(/\/$/, "") + "/chat/completions";
   return async (payload) => {
     const res = await fetch(url, {
@@ -5539,7 +5655,8 @@ function httpUpstream({ baseUrl, key }) {
         "content-type": "application/json",
         ...key ? { authorization: `Bearer ${key}` } : {}
       },
-      body: JSON.stringify(payload)
+      body: JSON.stringify(payload),
+      ...timeoutMs == null ? {} : { signal: AbortSignal.timeout(timeoutMs) }
     });
     const text = await res.text();
     let json;
@@ -5571,29 +5688,30 @@ async function createRelayRuntime(config) {
   const served = createRedemptionStore({ file: config.redemptionFile, log: config.log });
   const drawLocks = /* @__PURE__ */ new Map();
   const platform = await fetchPlatformConfig(config);
-  const bootFeeBps = platform.feeBps;
   const FEE_REFRESH_MS = 6e4;
   let lastConfigFetch = Date.now();
-  const refreshPlatformFee = async () => {
-    lastConfigFetch = Date.now();
-    try {
-      const fresh = await fetchPlatformConfig(config);
-      platform.feeBps = fresh.feeBps;
-      return true;
-    } catch (e) {
-      (config.log ?? console).error?.(`mtok relay: platform config refresh failed (${e.message}); keeping last-known fee rate`);
-      return false;
-    }
-  };
-  const refreshPlatformFeeIfStale = async () => {
-    if (Date.now() - lastConfigFetch < FEE_REFRESH_MS) return;
-    await refreshPlatformFee();
+  let refreshing;
+  const refreshPlatformFee = () => {
+    if (!refreshing) refreshing = (async () => {
+      try {
+        const fresh = await fetchPlatformConfig(config);
+        platform.feeSchedule = fresh.feeSchedule;
+        lastConfigFetch = Date.now();
+        return true;
+      } catch (e) {
+        (config.log ?? console).error?.(`mtok relay: platform config refresh failed (${e.message}); new claims require current policy`);
+        return false;
+      }
+    })().finally(() => {
+      refreshing = null;
+    });
+    return refreshing;
   };
   const verifier = createOnchainVerifier({ rpcUrls: rpcUrlsFor(platform.chainId, config.rpcFlag), usdcAddress: platform.usdcAddress, expectedChainId: platform.chainId });
   if (!verifier.configured) throw new Error("onchain verifier not configured (missing usdcAddress in /api/config)");
   const payerDenylist = new Set((config.payerDenylist ?? []).map((a) => String(a).trim().toLowerCase()).filter(Boolean));
   const screenPayer = typeof config.screenPayer === "function" ? config.screenPayer : null;
-  const upstream = httpUpstream({ baseUrl: config.upstream + "/v1", key: config.upstreamKey });
+  const upstream = httpUpstream({ baseUrl: config.upstream + "/v1", key: config.upstreamKey, timeoutMs: config.upstreamTimeoutMs ?? 12e4 });
   const payerDenied = async (payer) => {
     if (!payer) return false;
     if (payerDenylist.has(payer)) return true;
@@ -5612,11 +5730,11 @@ async function createRelayRuntime(config) {
     sellerAgentId: config.sellerAgentId,
     sellerWallet: config.settlementAddr,
     dripContractAddress: platform.dripContractAddress,
-    // #654: the fee floor is min(boot, current) so neither a fee increase nor a
-    // decrease can over-demand and strand an honest already-paid draw; the recipient
-    // stays pinned to the boot address (exact-match verify, see the note above).
     feeRecipient: platform.feeAddress,
-    feeBps: () => Math.min(bootFeeBps, platform.feeBps),
+    feeBps: async ({ paidAtMs }) => {
+      if (Date.now() - lastConfigFetch >= FEE_REFRESH_MS && !await refreshPlatformFee()) throw new Error("fee policy refresh failed");
+      return paymentFeeBpsAt(platform.feeSchedule, paidAtMs);
+    },
     // #654: per-relay output sanity ceiling (unset => the shared generous default).
     maxOutputTokens: config.maxOutputTokens,
     screenPayer: payerDenied
@@ -5639,23 +5757,31 @@ async function createRelayRuntime(config) {
       if (drawLocks.get(bookingId) === tail) drawLocks.delete(bookingId);
     }
   };
-  const handleDraw = (body, res) => withBookingLock(String(body?.bookingId ?? ""), async () => {
-    await refreshPlatformFeeIfStale();
-    let out = await core.serve(body);
-    if (out.status === 402 && out.body?.detail === "fee_amount_too_low" && await refreshPlatformFee()) {
-      out = await core.serve(body);
+  let active = 0;
+  const handleDraw = async (body, res) => {
+    if (active >= (config.maxConcurrentRequests ?? 64)) return send(res, 503, { error: "relay_busy" });
+    active++;
+    try {
+      return await withBookingLock(String(body?.bookingId ?? ""), async () => {
+        let out = await core.serve(body);
+        if (out.status === 402 && out.body?.detail === "fee_amount_too_low") {
+          out = await refreshPlatformFee() ? await core.serve(body) : { status: 503, body: { error: "fee_policy_unavailable", _bookingId: body.bookingId } };
+        }
+        return send(res, out.status, out.body);
+      });
+    } finally {
+      active--;
     }
-    return send(res, out.status, out.body);
-  });
+  };
   return { handleDraw };
 }
 async function fetchPlatformConfig(config) {
-  const r = await fetch(config.apiBase + "/api/config");
+  const r = await fetch(config.apiBase + "/api/config", { signal: AbortSignal.timeout(5e3) });
   if (!r.ok) throw new Error("config fetch failed: " + r.status);
   const body = await r.json();
   return {
     feeAddress: body.feeAddress,
-    feeBps: body.feeBps,
+    feeSchedule: normalizeFeeSchedule(body.feeSchedule ?? [{ effectiveAtMs: 0, feeBps: body.feeBps ?? (body.feeAddress ? void 0 : 0) }]),
     dustThresholdUsd: Number(body.dustThresholdUsd) || 1e-3,
     chainId: Number(body.chainId ?? 8453),
     usdcAddress: body.usdcAddress,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mtok-relay",
-  "version": "0.2.3",
+  "version": "0.2.6",
   "description": "Reference seller relay for mtok.market — accepts on-chain-prepaid chunk draws and serves inference from an upstream you control.",
   "type": "module",
   "bin": {