mtok-relay 0.2.8 → 0.3.1

package/README.md

@@ -9,6 +9,15 @@ event before it spends your upstream key. It caps the serve to the paid amount,
 caches the completion for honest retries, and reports nothing back to the
 platform. The market indexes the draw from Base events.
 
+Before payment, the SDK posts `{ request }` to `/quote` to count the actual provider
+input and reserve output at the offered prices. The reference CLI requires a
+vLLM-compatible `POST {upstream}/tokenize` endpoint using the same model and chat
+template as `{upstream}/v1/chat/completions`. An OpenAI-compatible inference endpoint
+alone is insufficient. If tokenization is missing or fails, quotes and fresh paid
+draws return 503 before inference; completed draws still replay. Other providers need
+a programmatic `countInputTokens(request)` adapter in `createRelayRuntime(config)`.
+Do not list a paid offer until its quote endpoint works with the actual provider.
+
 The relay is dual-stack for rolling upgrades. Offers signed with
 `requestHashScheme: "nonce-v1"` carry a buyer-generated 16-byte `requestNonce`;
 their on-chain `requestHash` commits to
@@ -41,6 +50,9 @@ Common flags:
 - `--out-price <usd/MTok>`: required positive local output cost used to bound the
   serve from the verified paid amount.
 - `--in-price <usd/MTok>`: positive local input cost. Defaults to `--out-price`.
+- `--max-input-tokens <n>` / `RELAY_MAX_INPUT_TOKENS`: hard input ceiling, default 131072.
+- `--max-output-tokens <n>` / `RELAY_MAX_OUTPUT_TOKENS`: output ceiling, default 32768.
+  Both ceilings must be positive safe integers; set them for the model you serve.
 - `--redemption-file <path>`: durable at-most-one-upstream-attempt log for one host. The default is
   `./.mtok-redemption.jsonl`. An empty path is rejected; an unwritable path makes
   paid serves fail closed before upstream inference.

package/dist/mtok-relay.mjs

@@ -4692,8 +4692,13 @@ function readRelayConfig({ argv = process.argv.slice(2), env = process.env } = {
   const payerDenylist = String(denylistRaw).split(",").map((a) => a.trim().toLowerCase()).filter(Boolean);
   const maxOutputRaw = flag(argv, "--max-output-tokens") ?? env.RELAY_MAX_OUTPUT_TOKENS;
   const maxOutputTokens = maxOutputRaw != null ? Number(maxOutputRaw) : void 0;
-  if (maxOutputTokens != null && (!Number.isFinite(maxOutputTokens) || maxOutputTokens < 1)) {
-    throw new Error("--max-output-tokens must be a positive integer");
+  if (maxOutputTokens != null && (!Number.isSafeInteger(maxOutputTokens) || maxOutputTokens < 1)) {
+    throw new Error("--max-output-tokens must be a positive safe integer");
+  }
+  const maxInputRaw = flag(argv, "--max-input-tokens") ?? env.RELAY_MAX_INPUT_TOKENS;
+  const maxInputTokens = maxInputRaw != null ? Number(maxInputRaw) : void 0;
+  if (maxInputTokens != null && (!Number.isSafeInteger(maxInputTokens) || maxInputTokens < 1)) {
+    throw new Error("--max-input-tokens must be a positive safe integer");
   }
   const trustedProxies = String(env.RELAY_TRUSTED_PROXIES ?? "").split(",").map((value) => value.trim()).filter(Boolean);
   if (trustedProxies.some((value) => !isIP(value) || value.includes("%"))) throw new Error("RELAY_TRUSTED_PROXIES must contain exact IP addresses");
@@ -4745,6 +4750,7 @@ function readRelayConfig({ argv = process.argv.slice(2), env = process.env } = {
     settlementAddr,
     payerDenylist,
     maxOutputTokens,
+    maxInputTokens,
     trustedProxies,
     clientIpHeader,
     maxConcurrentRequests,
@@ -4856,7 +4862,7 @@ function clientRateKey(req, trustedProxies = /* @__PURE__ */ new Set(), header =
   const words = right === void 0 ? start : [...start, ...Array(8 - start.length - end.length).fill("0"), ...end];
   return words.slice(0, 4).map((word) => word.padStart(4, "0")).join(":") + "::/64";
 }
-function startRelayServer({ config, handleDraw }) {
+function startRelayServer({ config, handleDraw, handleQuote }) {
   const callers = createLimiter({ max: config.maxRequestsPerMinute ?? 120 });
   const aggregate = createLimiter({ max: config.maxTotalRequestsPerMinute ?? 1200 });
   const trustedProxies = new Set((config.trustedProxies ?? []).map(canonicalIp).filter(Boolean));
@@ -4869,7 +4875,7 @@ function startRelayServer({ config, handleDraw }) {
       res.once("finish", () => req.destroy());
       send(res, status, { error });
     };
-    if (req.method !== "POST" || req.url !== "/chunk") {
+    if (req.method !== "POST" || !["/chunk", "/quote"].includes(req.url)) {
       return refuse(404, "not found");
     }
     try {
@@ -4893,7 +4899,7 @@ function startRelayServer({ config, handleDraw }) {
       if (body?.request == null) {
         return send(res, 400, { error: "bad_request", detail: "need a DRAW (request); the legacy FUND lane is retired, pay per draw on-chain" });
       }
-      await handleDraw(body, res);
+      await (req.url === "/quote" ? handleQuote : handleDraw)(body, res);
     } catch (error) {
       (config.log ?? console).error?.(`mtok relay: request failed (${error.message})`);
       refuse(503, "relay_unavailable");
@@ -7755,33 +7761,33 @@ function configuredFeeAtomic({ sellerUsdAtomic, feeAddress, feeBps }) {
   if (!feeAddress || bps === 0n) return 0n;
   return (BigInt(sellerUsdAtomic || 0) * bps + 5000n) / 10000n;
 }
-var MESSAGE_OVERHEAD_TOKENS = 4;
-var BYTES_PER_TOKEN_EST = 3.2;
-function estimateInputTokens(messages2) {
-  const utf8 = new TextEncoder();
-  let bytes = 0;
-  let envelope = 3;
-  for (const m of messages2 ?? []) {
-    envelope += MESSAGE_OVERHEAD_TOKENS;
-    bytes += utf8.encode(String(m?.role ?? "")).length;
-    bytes += utf8.encode(typeof m?.content === "string" ? m.content : JSON.stringify(m?.content ?? null)).length;
-  }
-  return envelope + Math.ceil(bytes / BYTES_PER_TOKEN_EST);
-}
 var DEFAULT_MAX_OUTPUT_TOKENS = 32768;
-function boundServe({ messages: messages2, budgetUsd, inPrice, outPrice, reqMax, contextCeil = DEFAULT_MAX_OUTPUT_TOKENS }) {
-  const estIn = estimateInputTokens(messages2);
-  const estInCostUsd = estIn * (Number(inPrice) > 0 ? Number(inPrice) : 0) / 1e6;
-  if (estInCostUsd >= budgetUsd) return { refuse: true, reason: "input", estIn, estInCostUsd };
-  const outBudgetUsd = budgetUsd - estInCostUsd;
+var DEFAULT_MAX_INPUT_TOKENS = 131072;
+function withinInputLimit(inputTokens, inputCeil) {
+  if (!Number.isSafeInteger(inputTokens) || inputTokens < 0) throw new TypeError("input token count must be a nonnegative safe integer");
+  if (!Number.isSafeInteger(inputCeil) || inputCeil <= 0) throw new TypeError("input token ceiling must be a positive safe integer");
+  return inputTokens <= inputCeil;
+}
+var offerPriceAtomic = (value) => BigInt(Math.ceil(Number(value) * 1e6));
+function boundServe({ inputTokens, budgetUsdAtomic, inPriceAtomic, outPriceAtomic, reqMax, inputCeil = DEFAULT_MAX_INPUT_TOKENS, contextCeil = DEFAULT_MAX_OUTPUT_TOKENS }) {
+  const inputAllowed = withinInputLimit(inputTokens, inputCeil);
+  if (!Number.isSafeInteger(contextCeil) || contextCeil <= 0) throw new TypeError("output token ceiling must be a positive safe integer");
+  const budget = BigInt(budgetUsdAtomic);
+  const inputPrice = BigInt(inPriceAtomic);
+  const outputPrice = BigInt(outPriceAtomic);
+  if (budget < 0n || inputPrice < 0n || outputPrice < 0n) throw new RangeError("token budget and prices must be nonnegative");
+  const inputCost = BigInt(inputTokens) * inputPrice;
+  const details = { inputTokens, inputCostUsd: Number(inputCost) / 1e12 };
+  if (!inputAllowed) return { refuse: true, reason: "input_limit", ...details };
+  const outputBudget = budget * 1000000n - inputCost;
+  if (outputBudget <= 0n) return { refuse: true, reason: "input", ...details };
+  if (outputPrice === 0n) return { refuse: true, reason: "output_price", ...details };
   let maxTok = contextCeil;
   if (Number(reqMax) > 0) maxTok = Math.min(maxTok, Math.floor(Number(reqMax)));
-  if (!Number.isFinite(Number(outPrice)) || Number(outPrice) <= 0) {
-    return { refuse: true, reason: "output_price", estIn, estInCostUsd };
-  }
-  maxTok = Math.min(maxTok, Math.floor(outBudgetUsd / Number(outPrice) * 1e6));
-  if (maxTok < 1) return { refuse: true, reason: "output", estIn, estInCostUsd };
-  return { refuse: false, maxTok, estIn, estInCostUsd };
+  const fundedOutput = outputBudget / outputPrice;
+  if (fundedOutput < BigInt(maxTok)) maxTok = Number(fundedOutput);
+  if (maxTok < 1) return { refuse: true, reason: "output", ...details };
+  return { refuse: false, maxTok, ...details };
 }
 function createServeCore({
   model,
@@ -7798,13 +7804,44 @@ function createServeCore({
   feeRecipient,
   feeBps,
   screenPayer,
+  // A retired payment domain may honor verified receipts without admitting
+  // quotes or another inference attempt for an unrecorded payment.
+  replayOnly = false,
+  // The host counts its actual sanitized provider input. Missing or failed
+  // accounting refuses a fresh claim; saved completions do not need recounting.
+  countInputTokens,
+  maxInputTokens = DEFAULT_MAX_INPUT_TOKENS,
   // #654: the output-token sanity ceiling for boundServe. The PAID budget already
   // bounds output (and metering is on real usage), so this is a defensive cap on a
   // single generation, not a money guard. It is a per-relay knob: the reference host
   // passes MTOK_MAX_OUTPUT_TOKENS / a config value; operators serving large-context
   // models raise it. Falls back to boundServe's own generous default when unset.
-  maxOutputTokens
+  maxOutputTokens = DEFAULT_MAX_OUTPUT_TOKENS
 }) {
+  const quote = async (request) => {
+    if (replayOnly) return { status: 503, body: { error: "redemption_unavailable", detail: "this relay only replays saved completions" } };
+    const checked = validateRequest(request, model);
+    if (checked.error) return { status: 400, body: { error: "bad_request", detail: checked.error } };
+    try {
+      const inputTokens = await countInputTokens(checked.safeRequest);
+      if (!withinInputLimit(inputTokens, maxInputTokens)) return { status: 413, body: { error: "input_too_large", detail: `input (${inputTokens} tokens) exceeds this relay's input-token limit` } };
+      if (!Number.isSafeInteger(maxOutputTokens) || maxOutputTokens <= 0) throw new TypeError("output token ceiling must be a positive safe integer");
+      const inputPrice = offerPriceAtomic(inPrice);
+      const outputPrice = offerPriceAtomic(outPrice);
+      if (inputPrice < 0n || outputPrice <= 0n) throw new RangeError("invalid offer prices");
+      return { status: 200, body: {
+        model,
+        offerId,
+        inputTokens,
+        maxInputTokens,
+        maxOutputTokens,
+        inputPricePerMTokAtomic: inputPrice.toString(),
+        outputPricePerMTokAtomic: outputPrice.toString()
+      } };
+    } catch (e) {
+      return { status: 503, body: { error: "input_accounting_unavailable", detail: e.message } };
+    }
+  };
   const serve = async (body) => {
     const currentFeeRecipient = typeof feeRecipient === "function" ? feeRecipient() : feeRecipient;
     const { bookingId, n, buyerId, request, requestNonce, drawPaidTxHash } = body;
@@ -7880,6 +7917,9 @@ function createServeCore({
     if (redemptionState === "pending") {
       return { status: 409, body: { error: "draw_pending", detail: "this paid draw was already claimed; refusing to run upstream again", _bookingId: bookingId } };
     }
+    if (replayOnly) {
+      return { status: 503, body: { error: "redemption_unavailable", detail: "this payment has no saved completion; retry this same paid draw after reconciliation", _bookingId: bookingId } };
+    }
     let currentFeeBps;
     try {
       currentFeeBps = typeof feeBps === "function" ? await feeBps(paid) : feeBps ?? 0;
@@ -7896,14 +7936,30 @@ function createServeCore({
     if (remainingUsd < BALANCE_EPSILON) {
       return { status: 402, body: { error: "balance_exhausted", detail: `remainingUsd=${remainingUsd}`, _bookingId: bookingId, remainingUsd } };
     }
-    const eventInPriceUsd = Number(paidEvent.inputPricePerMTokAtomic || 0) / 1e6;
-    const eventOutPriceUsd = Number(paidEvent.outputPricePerMTokAtomic || 0) / 1e6;
-    const boundInPrice = Math.max(Number(inPrice) || 0, eventInPriceUsd);
-    const boundOutPrice = Math.max(Number(outPrice) || 0, eventOutPriceUsd);
-    const bound = boundServe({ messages: checked.safeRequest.messages, budgetUsd: remainingUsd, inPrice: boundInPrice, outPrice: boundOutPrice, reqMax: checked.safeRequest.max_tokens, ...Number(maxOutputTokens) > 0 ? { contextCeil: Math.floor(Number(maxOutputTokens)) } : {} });
+    let bound;
+    try {
+      const inputTokens = await countInputTokens(checked.safeRequest);
+      const price = (offered, committed) => {
+        const local = offerPriceAtomic(offered);
+        const paid2 = BigInt(committed);
+        return local > paid2 ? local : paid2;
+      };
+      bound = boundServe({
+        inputTokens,
+        budgetUsdAtomic: paidEvent.sellerUsdAtomic,
+        inPriceAtomic: price(inPrice, paidEvent.inputPricePerMTokAtomic),
+        outPriceAtomic: price(outPrice, paidEvent.outputPricePerMTokAtomic),
+        reqMax: checked.safeRequest.max_tokens,
+        inputCeil: maxInputTokens,
+        contextCeil: maxOutputTokens
+      });
+    } catch (e) {
+      return { status: 503, body: { error: "input_accounting_unavailable", detail: e.message, _bookingId: bookingId } };
+    }
     if (bound.refuse) {
-      const error = bound.reason === "input" ? "input_too_large" : "output_unfunded";
-      return { status: 402, body: { error, detail: `estimated input (~${bound.estIn} tokens, $${bound.estInCostUsd.toFixed(6)}) leaves no safely funded output in the paid amount ($${remainingUsd})`, _bookingId: bookingId, remainingUsd } };
+      const error = bound.reason === "input" || bound.reason === "input_limit" ? "input_too_large" : "output_unfunded";
+      const detail = bound.reason === "input_limit" ? `input (${bound.inputTokens} tokens) exceeds this relay's input-token limit` : `input (${bound.inputTokens} tokens, $${bound.inputCostUsd.toFixed(6)}) leaves no safely funded output in the paid amount ($${remainingUsd})`;
+      return { status: 402, body: { error, detail, _bookingId: bookingId, remainingUsd } };
     }
     const safeRequest = { ...checked.safeRequest, model, max_tokens: bound.maxTok };
     try {
@@ -7938,7 +7994,7 @@ function createServeCore({
     }
     return { status: 200, body: payload };
   };
-  return { serve };
+  return { serve, quote };
 }
 
 // bridge/bridge.mjs
@@ -7965,6 +8021,27 @@ function httpUpstream({ baseUrl, key, timeoutMs }) {
     return json;
   };
 }
+function httpInputCounter({ url, key, timeoutMs = 5e3 }) {
+  return async ({ model, messages: messages2 }) => {
+    const response = await fetch(url, {
+      method: "POST",
+      headers: { "content-type": "application/json", ...key ? { authorization: `Bearer ${key}` } : {} },
+      body: JSON.stringify({ model, messages: messages2, add_generation_prompt: true, add_special_tokens: false }),
+      signal: AbortSignal.timeout(timeoutMs)
+    });
+    if (!response.ok) throw new Error(`upstream tokenization ${response.status}`);
+    const decoder = new TextDecoder();
+    const chunks = [];
+    let size3 = 0;
+    for await (const chunk of response.body) {
+      size3 += chunk.byteLength;
+      if (size3 > 4 * 1024 * 1024) throw new Error("upstream tokenization response is too large");
+      chunks.push(decoder.decode(chunk, { stream: true }));
+    }
+    chunks.push(decoder.decode());
+    return JSON.parse(chunks.join("")).count;
+  };
+}
 
 // src/rpc.mjs
 var BASE_MAINNET_RPCS = [
@@ -8008,6 +8085,7 @@ async function createRelayRuntime(config) {
   const payerDenylist = new Set((config.payerDenylist ?? []).map((a) => String(a).trim().toLowerCase()).filter(Boolean));
   const screenPayer = typeof config.screenPayer === "function" ? config.screenPayer : null;
   const upstream = httpUpstream({ baseUrl: config.upstream + "/v1", key: config.upstreamKey, timeoutMs: config.upstreamTimeoutMs ?? 12e4 });
+  const countInputTokens = config.countInputTokens ?? httpInputCounter({ url: config.upstream + "/tokenize", key: config.upstreamKey });
   const payerDenied = async (payer) => {
     if (!payer) return false;
     if (payerDenylist.has(payer)) return true;
@@ -8033,6 +8111,8 @@ async function createRelayRuntime(config) {
     },
     // #654: per-relay output sanity ceiling (unset => the shared generous default).
     maxOutputTokens: config.maxOutputTokens,
+    maxInputTokens: config.maxInputTokens,
+    countInputTokens,
     screenPayer: payerDenied
   });
   const withBookingLock = async (bookingId, fn) => {
@@ -8069,7 +8149,17 @@ async function createRelayRuntime(config) {
       active--;
     }
   };
-  return { handleDraw, close: () => served.close?.() };
+  const handleQuote = async (body, res) => {
+    if (active >= (config.maxConcurrentRequests ?? 64)) return send(res, 503, { error: "relay_busy" });
+    active++;
+    try {
+      const out = await core.quote(body.request);
+      return send(res, out.status, out.body);
+    } finally {
+      active--;
+    }
+  };
+  return { handleDraw, handleQuote, close: () => served.close?.() };
 }
 async function fetchPlatformConfig(config) {
   const r = await fetch(config.apiBase + "/api/config", { signal: AbortSignal.timeout(5e3) });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mtok-relay",
-  "version": "0.2.8",
+  "version": "0.3.1",
   "description": "Reference seller relay for mtok.market — accepts on-chain-prepaid chunk draws and serves inference from an upstream you control.",
   "type": "module",
   "bin": {