stellarium-ts 0.15.0 → 0.17.0

package/dist/routes.js

@@ -1,7 +1,8 @@
 import { createHash, timingSafeEqual } from 'node:crypto';
 import rateLimit from '@fastify/rate-limit';
 import { interpretParsed, parseScript } from 'requestscript';
-import { invocationHash, paymentVoucherPayload } from './resource/invoker.js';
+import { inferenceVoucherPayload, invocationHash, isInferenceVoucher, paymentVoucherPayload } from './resource/invoker.js';
+import { inferenceCharge, isInferenceFunction, isInferenceManifest, parseMaxTokens } from './resource/inference.js';
 import { safeVerifyData } from './crypto/utils.js';
 import { InvalidPublicKeyError } from './grant/service.js';
 // Body schemas check only the shape the handlers rely on. Signed payloads (resources) are
@@ -48,35 +49,63 @@ const runRequestSchema = {
     required: ['source'],
     properties: { source: { type: 'string' } },
 };
+const resourceCallProperties = {
+    resourcePath: { type: 'string' },
+    resourceName: { type: 'string' },
+    functionName: { type: 'string' },
+    parameters: {
+        type: 'array',
+        items: { type: 'object', required: ['name'], properties: { name: { type: 'string' } } },
+    },
+    // Shape only: the grants inside are signed, so coercing them would change the signed bytes.
+    authorization: { type: 'object' },
+};
+const fixedVoucherSchema = {
+    type: 'object',
+    required: ['requestId', 'invocationId', 'amount', 'recipientOrganizationId', 'signature', 'expiresAt', 'invocationHash', 'publicKey'],
+    properties: {
+        requestId: { type: 'string' },
+        invocationId: { type: 'string' },
+        amount: { type: 'integer' },
+        recipientOrganizationId: { type: 'string' },
+        signature: { type: 'string' },
+        expiresAt: { type: 'string' },
+        invocationHash: { type: 'string' },
+        publicKey: { type: 'string' },
+    },
+};
+const inferenceVoucherSchema = {
+    type: 'object',
+    required: ['kind', 'requestId', 'invocationId', 'maxAmount', 'inputCostMicroUsdPerMillionTokens', 'outputCostMicroUsdPerMillionTokens', 'maxTokens', 'recipientOrganizationId', 'signature', 'expiresAt', 'invocationHash', 'publicKey'],
+    properties: {
+        kind: { const: 'inference' },
+        requestId: { type: 'string' },
+        invocationId: { type: 'string' },
+        maxAmount: { type: 'integer', minimum: 0 },
+        inputCostMicroUsdPerMillionTokens: { type: 'integer', minimum: 0 },
+        outputCostMicroUsdPerMillionTokens: { type: 'integer', minimum: 0 },
+        maxTokens: { type: 'integer', minimum: 1 },
+        recipientOrganizationId: { type: 'string' },
+        signature: { type: 'string' },
+        expiresAt: { type: 'string' },
+        invocationHash: { type: 'string' },
+        publicKey: { type: 'string' },
+    },
+};
 const resourceRunRequestSchema = {
     type: 'object',
     required: ['resourcePath', 'resourceName', 'functionName', 'parameters'],
     properties: {
-        resourcePath: { type: 'string' },
-        resourceName: { type: 'string' },
-        functionName: { type: 'string' },
-        parameters: {
-            type: 'array',
-            items: { type: 'object', required: ['name'], properties: { name: { type: 'string' } } },
-        },
-        paymentVoucher: {
-            type: 'object',
-            required: ['requestId', 'invocationId', 'amount', 'recipientAddress', 'signature', 'expiresAt', 'invocationHash', 'publicKey'],
-            properties: {
-                requestId: { type: 'string' },
-                invocationId: { type: 'string' },
-                amount: { type: 'integer' },
-                recipientAddress: { type: 'string' },
-                signature: { type: 'string' },
-                expiresAt: { type: 'string' },
-                invocationHash: { type: 'string' },
-                publicKey: { type: 'string' },
-            },
-        },
-        // Shape only: the grants inside are signed, so coercing them would change the signed bytes.
-        authorization: { type: 'object' },
+        ...resourceCallProperties,
+        // An inference voucher has `kind` and no `amount`, so at most one shape matches.
+        paymentVoucher: { oneOf: [fixedVoucherSchema, inferenceVoucherSchema] },
     },
 };
+const resourceEstimateRequestSchema = {
+    type: 'object',
+    required: ['resourcePath', 'resourceName', 'functionName', 'parameters'],
+    properties: resourceCallProperties,
+};
 const grantRenewalRequestSchema = {
     type: 'object',
     required: ['grantId', 'publicKey', 'nonce', 'expiresAt', 'signature'],
@@ -102,25 +131,63 @@ function secretsEqual(a, b) {
 }
 /**
  * A voucher is valid when it is bound to this exact call, signed by its public key, unexpired,
- * and pays at least the function's cost to the function's recipient.
+ * and pays this node's organization. A fixed voucher must pay at least the function's cost. An inference
+ * voucher must be for an inference function, carry its rates, and sign the call's `maxTokens`.
+ * Whether its `maxAmount` covers the call is checked separately, against the function's estimator.
  */
-function isValidPaymentVoucher(voucher, manifest, request) {
+function isValidPaymentVoucher(voucher, resourceFunction, manifest, request, organizationId) {
     const expectedHash = invocationHash(request.resourcePath, request.resourceName, request.functionName, request.parameters);
     if (voucher.invocationHash !== expectedHash) {
         return false;
     }
-    if (voucher.amount < manifest.costMicroUsdc) {
-        return false;
-    }
-    if (voucher.recipientAddress !== manifest.recipientAddress) {
+    if (!organizationId || voucher.recipientOrganizationId !== organizationId) {
         return false;
     }
     const expiresAt = Date.parse(voucher.expiresAt);
     if (!Number.isFinite(expiresAt) || expiresAt <= Date.now()) {
         return false;
     }
+    if (isInferenceVoucher(voucher)) {
+        if (!isInferenceFunction(resourceFunction) || !isInferenceManifest(manifest)) {
+            return false;
+        }
+        if (voucher.inputCostMicroUsdPerMillionTokens !== manifest.inputCostMicroUsdPerMillionTokens
+            || voucher.outputCostMicroUsdPerMillionTokens !== manifest.outputCostMicroUsdPerMillionTokens) {
+            return false;
+        }
+        if (voucher.maxTokens !== parseMaxTokens(request.parameters)) {
+            return false;
+        }
+        return safeVerifyData(inferenceVoucherPayload(voucher), voucher.publicKey, voucher.signature);
+    }
+    if (isInferenceFunction(resourceFunction) || isInferenceManifest(manifest)) {
+        return false;
+    }
+    if (voucher.amount < manifest.costMicroUsd) {
+        return false;
+    }
     return safeVerifyData(paymentVoucherPayload(voucher), voucher.publicKey, voucher.signature);
 }
+/** The function's own input-token estimate, or undefined if its estimator failed or returned something other than a count. */
+async function estimateInputTokens(resourceFunction, request) {
+    try {
+        const inputTokens = await resourceFunction.estimateInputTokens?.(request.parameters);
+        return Number.isSafeInteger(inputTokens) && inputTokens >= 0 ? inputTokens : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** What the operator will capture for `usage`: its charge at the voucher's rates, capped at `maxAmount`. */
+function cappedInferenceCharge(voucher, usage) {
+    try {
+        return Math.min(inferenceCharge(voucher, usage.inputTokens, usage.outputTokens), voucher.maxAmount);
+    }
+    catch {
+        // The charge isn't a safe integer, so it is over any maxAmount.
+        return voucher.maxAmount;
+    }
+}
 /**
  * Encapsulates the routes
  * @param fastify Encapsulated Fastify Instance
@@ -187,11 +254,16 @@ const routes = async (fastify, options) => {
                         type: parameter.type,
                         description: parameter.description,
                     })),
-                    paymentManifest: fn.paymentManifest ? ({
-                        costMicroUsdc: fn.paymentManifest.costMicroUsdc,
-                        recipientAddress: fn.paymentManifest.recipientAddress,
-                    }) : undefined,
+                    paymentManifest: !fn.paymentManifest ? undefined : isInferenceManifest(fn.paymentManifest) ? {
+                        inputCostMicroUsdPerMillionTokens: fn.paymentManifest.inputCostMicroUsdPerMillionTokens,
+                        outputCostMicroUsdPerMillionTokens: fn.paymentManifest.outputCostMicroUsdPerMillionTokens,
+                        recipientOrganizationId: fn.paymentManifest.recipientOrganizationId,
+                    } : {
+                        costMicroUsd: fn.paymentManifest.costMicroUsd,
+                        recipientOrganizationId: fn.paymentManifest.recipientOrganizationId,
+                    },
                     restricted: fn.restricted || undefined,
+                    kind: isInferenceFunction(fn) ? 'inference' : undefined,
                 })),
                 baseUrl: resource.baseUrl,
             })),
@@ -240,19 +312,20 @@ const routes = async (fastify, options) => {
             reply.status(500).send({ error: 'Internal server error' });
         }
     });
-    fastify.post('/run/resource', {
-        schema: { body: resourceRunRequestSchema },
-        config: { rateLimit: options.rateLimit ?? { max: 100, timeWindow: '1 minute' } },
-    }, async (request, reply) => {
-        const resourceRequest = request.body;
-        const paymentVoucher = resourceRequest.paymentVoucher;
+    /**
+     * Finds the local function a call names and checks its parameters and, for a restricted function,
+     * its authorization. Sends the refusal and returns undefined if a check fails.
+     */
+    async function checkCall(resourceRequest, reply) {
         const resource = await options.service.resourceRepository.getInternalResource(resourceRequest.resourcePath, resourceRequest.resourceName);
         if (!resource) {
-            return reply.status(400).send({ error: 'Resource not found' });
+            reply.status(400).send({ error: 'Resource not found' });
+            return undefined;
         }
         const resourceFunction = resource.functions.find(fn => fn.name === resourceRequest.functionName);
         if (!resourceFunction) {
-            return reply.status(400).send({ error: 'Function not found' });
+            reply.status(400).send({ error: 'Function not found' });
+            return undefined;
         }
         // Grant constraints and the function both read parameters by name, so each name must be
         // declared and appear once. Otherwise a duplicate or extra parameter could pass a
@@ -260,7 +333,8 @@ const routes = async (fastify, options) => {
         const declared = new Set(resourceFunction.parameters.map(parameter => parameter.name));
         const names = resourceRequest.parameters.map(parameter => parameter.name);
         if (new Set(names).size !== names.length || !names.every(name => declared.has(name))) {
-            return reply.status(400).send({ error: 'Parameters must be declared by the function and appear once each' });
+            reply.status(400).send({ error: 'Parameters must be declared by the function and appear once each' });
+            return undefined;
         }
         // A restricted function is never run without a grant from this node. Checked before the
         // voucher, so an unauthorized caller never gets near settlement.
@@ -268,36 +342,116 @@ const routes = async (fastify, options) => {
             // Tells a caller without a usable grant where it can ask for one.
             const grantEndpoint = options.service.grantService.acceptsRequests ? `${options.service.config.baseUrl}/v1/grants/request` : undefined;
             if (!resourceRequest.authorization) {
-                return reply.status(403).send({ error: 'Authorization is required', grantEndpoint });
+                reply.status(403).send({ error: 'Authorization is required', grantEndpoint });
+                return undefined;
             }
             if (!await options.service.grantService.verifyInvocation(resourceRequest.authorization, resourceRequest)) {
-                return reply.status(403).send({ error: 'Invalid authorization', grantEndpoint });
+                reply.status(403).send({ error: 'Invalid authorization', grantEndpoint });
+                return undefined;
             }
         }
+        return { resource, resourceFunction };
+    }
+    /**
+     * Prices a call to a paid inference function before the caller signs its voucher: the function's
+     * estimate of the input tokens, and `maxAmount`, the charge for those plus `maxTokens` output tokens.
+     * Runs the provider's estimator, so a restricted function needs authorization here too.
+     */
+    fastify.post('/run/resource/estimate', {
+        schema: { body: resourceEstimateRequestSchema },
+        config: { rateLimit: options.rateLimit ?? { max: 100, timeWindow: '1 minute' } },
+    }, async (request, reply) => {
+        const resourceRequest = request.body;
+        const call = await checkCall(resourceRequest, reply);
+        if (!call) {
+            return reply;
+        }
+        const { resourceFunction } = call;
+        const manifest = resourceFunction.paymentManifest;
+        if (!isInferenceFunction(resourceFunction) || !isInferenceManifest(manifest)) {
+            return reply.status(400).send({ error: 'Function is not a paid inference function' });
+        }
+        const maxTokens = parseMaxTokens(resourceRequest.parameters);
+        if (maxTokens === undefined) {
+            return reply.status(400).send({ error: 'maxTokens must be a positive int32' });
+        }
+        const inputTokens = await estimateInputTokens(resourceFunction, resourceRequest);
+        if (inputTokens === undefined) {
+            return reply.status(500).send({ error: 'Failed to estimate input tokens' });
+        }
+        return { inputTokens, maxAmount: inferenceCharge(manifest, inputTokens, maxTokens) };
+    });
+    fastify.post('/run/resource', {
+        schema: { body: resourceRunRequestSchema },
+        config: { rateLimit: options.rateLimit ?? { max: 100, timeWindow: '1 minute' } },
+    }, async (request, reply) => {
+        const resourceRequest = request.body;
+        const paymentVoucher = resourceRequest.paymentVoucher;
+        const call = await checkCall(resourceRequest, reply);
+        if (!call) {
+            return reply;
+        }
+        const { resource, resourceFunction } = call;
         // Payment manifests are per function. A paid function is never run without a valid voucher.
         const paymentManifest = resourceFunction.paymentManifest;
         if (paymentManifest) {
             if (!paymentVoucher) {
                 return reply.status(402).send({ error: 'Payment voucher is required' });
             }
-            if (!isValidPaymentVoucher(paymentVoucher, paymentManifest, resourceRequest)) {
+            if (!isValidPaymentVoucher(paymentVoucher, resourceFunction, paymentManifest, resourceRequest, options.service.config.organizationId)) {
                 return reply.status(400).send({ error: 'Invalid payment voucher' });
             }
             if (await options.service.grantService.isBlocked(paymentVoucher.publicKey)) {
                 return reply.status(403).send({ error: 'Caller is blocked' });
             }
+            // Re-estimated here, so inference never runs on a voucher that can't cover the expected cost.
+            if (isInferenceVoucher(paymentVoucher)) {
+                const inputTokens = await estimateInputTokens(resourceFunction, resourceRequest);
+                if (inputTokens === undefined) {
+                    return reply.status(500).send({ error: 'Failed to estimate input tokens' });
+                }
+                const requiredMaxAmount = inferenceCharge(paymentVoucher, inputTokens, paymentVoucher.maxTokens);
+                if (paymentVoucher.maxAmount < requiredMaxAmount) {
+                    return reply.status(402).send({ error: `Payment voucher maxAmount ${paymentVoucher.maxAmount} is below the estimated ${requiredMaxAmount} micro-USD`, requiredMaxAmount });
+                }
+            }
+        }
+        // Hold the call's price on the payer's balance before running it, so a paid function never runs unpaid.
+        const paid = paymentManifest && paymentVoucher ? paymentVoucher : undefined;
+        if (paid) {
+            const authorization = await options.service.operatorClient.authorize(paid);
+            if (!authorization.ok) {
+                return reply.status(authorization.status).send({ error: authorization.error });
+            }
         }
         const result = await options.service.resourceInvoker.invoke(resource, resourceRequest.functionName, resourceRequest.parameters);
-        // Settle only verified vouchers, and only after a successful invoke. A voucher sent to a free function is ignored.
-        // Run this on a separate thread to avoid blocking the main thread.
-        if (paymentManifest && paymentVoucher && !result.error) {
+        if (paid) {
+            let capture;
+            if (!result.error && !isInferenceVoucher(paid)) {
+                capture = { voucher: paid };
+            }
+            else if (!result.error && result.usage && isInferenceVoucher(paid)) {
+                // The function may report more output than it was allowed; the caller only signed for maxTokens.
+                const usage = { inputTokens: result.usage.inputTokens, outputTokens: Math.min(result.usage.outputTokens, paid.maxTokens) };
+                result.usage = usage;
+                // A free call has nothing to charge, so its hold is released instead.
+                if (cappedInferenceCharge(paid, usage) > 0) {
+                    capture = { voucher: paid, usage };
+                }
+            }
+            // A failed or free call releases its hold. Nothing awaits this, so it doesn't delay the response,
+            // and an uncaught error here would be an unhandled rejection.
             setTimeout(async () => {
-                // Nothing awaits this callback, so an uncaught error here would be an unhandled rejection.
                 try {
-                    await options.service.operatorClient.settlePayment({ voucher: paymentVoucher });
+                    if (capture) {
+                        await options.service.operatorClient.capture(capture);
+                    }
+                    else {
+                        await options.service.operatorClient.release(paid);
+                    }
                 }
                 catch (error) {
-                    fastify.log.error(error, 'Failed to settle payment');
+                    fastify.log.error(error, capture ? 'Failed to capture payment' : 'Failed to release payment');
                 }
             }, 0);
         }

package/dist/server.d.ts

@@ -6,7 +6,7 @@ import type { ApproveGrant, GrantOptions } from './grant/service.js';
 import { StellariumResource } from './resource/repository.js';
 import { RateLimitConfig } from './routes.js';
 import { type NodeConfig } from './service.js';
-export declare const DEFAULT_COST_LIMIT_MICRO_USDC = 10000;
+export declare const DEFAULT_COST_LIMIT_MICRO_USD = 10000;
 export declare const DEFAULT_GRANT_REFRESH_INTERVAL_MS: number;
 export interface StellariumNodeOptions {
     port?: number;
@@ -24,8 +24,18 @@ export interface StellariumNodeOptions {
     apiKey?: string;
     /** Defaults to `OPERATOR_URL`. */
     operatorUrl?: string;
-    /** Most this node pays for one remote call. Defaults to `COST_LIMIT_MICRO_USDC`, then 10,000 ($0.01). */
-    costLimitMicroUsdc?: number;
+    /**
+     * One-time token from the dashboard that enrolls this node in an organization. Defaults to
+     * `ENROLLMENT_TOKEN`. Only needed on a node's first start; an enrolled node ignores it.
+     */
+    enrollmentToken?: string;
+    /** Most this node pays for one remote call. Defaults to `COST_LIMIT_MICRO_USD`, then 10,000 ($0.01). */
+    costLimitMicroUsd?: number;
+    /**
+     * Most this node signs for in one remote inference call (the voucher's `maxAmount`).
+     * Defaults to `INFERENCE_COST_LIMIT_MICRO_USD`, then to the resolved `costLimitMicroUsd`.
+     */
+    inferenceCostLimitMicroUsd?: number;
     /** SQLite file. Defaults to `./requestscript.db`; use ':memory:' for tests. */
     databasePath?: string;
     /**

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,eAAe,CAAC;AACvB,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAE1C,OAAO,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAe,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAiB,KAAK,UAAU,EAAgB,MAAM,cAAc,CAAC;AAG5E,eAAO,MAAM,6BAA6B,QAAS,CAAC;AACpD,eAAO,MAAM,iCAAiC,QAAgB,CAAC;AAE/D,MAAM,WAAW,qBAAqB;IAClC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,0FAA0F;IAC1F,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,gEAAgE;IAChE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wCAAwC;IACxC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yCAAyC;IACzC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kCAAkC;IAClC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yGAAyG;IACzG,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,+EAA+E;IAC/E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;IACnB,yFAAyF;IACzF,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC;;;OAGG;IACH,YAAY,CAAC,EAAE,YAAY,CAAC;CAC/B;AAaD,wBAAgB,aAAa,CAAC,OAAO,EAAE,qBAAqB,EAAE,SAAS,GAAE,kBAAkB,EAAO,GAAG,UAAU,CAgB9G;AAED,qBAAa,cAAc;IACvB,OAAO,CAAC,SAAS,CAA4B;IAC7C,OAAO,CAAC,OAAO,CAAC,CAAU;IAEpB,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAE1D;IAED;;;OAGG;IACG,KAAK,CAAC,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoDnF;IAED,8FAA8F;IACxF,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,CAEtG;IAED;;;OAGG;IACG,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,CAEvI;IAED,wFAAwF;IAClF,YAAY,CAAC,eAAe,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,CAE3H;IAED,mDAAmD;IAC7C,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAE5C;IAED;;;OAGG;IACG,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAEzD;IAED,4FAA4F;IACtF,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEnE;IAED,yCAAyC;IACnC,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAEvD;IAED,OAAO,CAAC,OAAO;CAMlB"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,eAAe,CAAC;AACvB,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAE1C,OAAO,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAErE,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAe,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAiB,KAAK,UAAU,EAAgB,MAAM,cAAc,CAAC;AAI5E,eAAO,MAAM,4BAA4B,QAAS,CAAC;AACnD,eAAO,MAAM,iCAAiC,QAAgB,CAAC;AAE/D,MAAM,WAAW,qBAAqB;IAClC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,0FAA0F;IAC1F,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,gEAAgE;IAChE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wCAAwC;IACxC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yCAAyC;IACzC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kCAAkC;IAClC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,wGAAwG;IACxG,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,+EAA+E;IAC/E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;IACnB,yFAAyF;IACzF,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC;;;OAGG;IACH,YAAY,CAAC,EAAE,YAAY,CAAC;CAC/B;AAaD,wBAAgB,aAAa,CAAC,OAAO,EAAE,qBAAqB,EAAE,SAAS,GAAE,kBAAkB,EAAO,GAAG,UAAU,CAwB9G;AAED,qBAAa,cAAc;IACvB,OAAO,CAAC,SAAS,CAA4B;IAC7C,OAAO,CAAC,OAAO,CAAC,CAAU;IAEpB,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAE1D;IAED;;;OAGG;IACG,KAAK,CAAC,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CA+DnF;IAED,8FAA8F;IACxF,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,CAEtG;IAED;;;OAGG;IACG,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,CAEvI;IAED,wFAAwF;IAClF,YAAY,CAAC,eAAe,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,CAE3H;IAED,mDAAmD;IAC7C,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAE5C;IAED;;;OAGG;IACG,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAEzD;IAED,4FAA4F;IACtF,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEnE;IAED,yCAAyC;IACnC,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAEvD;IAED,OAAO,CAAC,OAAO;CAMlB"}

package/dist/server.js

@@ -1,9 +1,11 @@
 import 'dotenv/config';
 import { DEFAULT_DATABASE_PATH, openDatabase } from './db/db.js';
+import { validateInferenceFunction } from './resource/inference.js';
 import routes from './routes.js';
 import { createService } from './service.js';
 import { StartupService } from './startup.js';
-export const DEFAULT_COST_LIMIT_MICRO_USDC = 10_000;
+import { OperatorClient } from './client/operatorClient.js';
+export const DEFAULT_COST_LIMIT_MICRO_USD = 10_000;
 export const DEFAULT_GRANT_REFRESH_INTERVAL_MS = 1000 * 60 * 5;
 function required(name, value) {
     if (!value) {
@@ -15,9 +17,16 @@ function hostsPaidFunctions(resources) {
     return resources.some(resource => resource.functions.some(fn => fn.paymentManifest));
 }
 export function resolveConfig(options, resources = []) {
-    const costLimit = options.costLimitMicroUsdc ?? (process.env.COST_LIMIT_MICRO_USDC ? Number(process.env.COST_LIMIT_MICRO_USDC) : DEFAULT_COST_LIMIT_MICRO_USDC);
+    const costLimit = options.costLimitMicroUsd ?? (process.env.COST_LIMIT_MICRO_USD ? Number(process.env.COST_LIMIT_MICRO_USD) : DEFAULT_COST_LIMIT_MICRO_USD);
     if (!Number.isSafeInteger(costLimit) || costLimit < 0) {
-        throw new Error('costLimitMicroUsdc must be a nonnegative integer');
+        throw new Error('costLimitMicroUsd must be a nonnegative integer');
+    }
+    const inferenceCostLimit = options.inferenceCostLimitMicroUsd ?? (process.env.INFERENCE_COST_LIMIT_MICRO_USD ? Number(process.env.INFERENCE_COST_LIMIT_MICRO_USD) : costLimit);
+    if (!Number.isSafeInteger(inferenceCostLimit) || inferenceCostLimit < 0) {
+        throw new Error('inferenceCostLimitMicroUsd must be a nonnegative integer');
+    }
+    for (const resource of resources) {
+        resource.functions.forEach(validateInferenceFunction);
     }
     return {
         baseUrl: required('BASE_URL', options.baseUrl ?? process.env.BASE_URL),
@@ -28,7 +37,8 @@ export function resolveConfig(options, resources = []) {
         operatorUrl: hostsPaidFunctions(resources)
             ? required('OPERATOR_URL', options.operatorUrl ?? process.env.OPERATOR_URL)
             : options.operatorUrl ?? process.env.OPERATOR_URL,
-        costLimitMicroUsdc: costLimit,
+        costLimitMicroUsd: costLimit,
+        inferenceCostLimitMicroUsd: inferenceCostLimit,
     };
 }
 export class StellariumNode {
@@ -43,6 +53,18 @@ export class StellariumNode {
      */
     async start(fastify, options) {
         const config = resolveConfig(options, this.resources);
+        const enrollmentToken = options.enrollmentToken ?? process.env.ENROLLMENT_TOKEN;
+        // Paid functions are paid to the node's organization, so a provider must be enrolled before it serves them.
+        // A node that only calls paid functions enrolls the same way, so its vouchers draw on its organization's balance.
+        if (hostsPaidFunctions(this.resources) || enrollmentToken) {
+            try {
+                ({ organizationId: config.organizationId } = await new OperatorClient(config.operatorUrl, config.publicKey, config.privateKey).session(enrollmentToken));
+            }
+            catch (error) {
+                const hint = enrollmentToken ? '' : '. Create an enrollment token for it at https://platform.stellarium.sh and set ENROLLMENT_TOKEN';
+                throw new Error(`${error instanceof Error ? error.message : String(error)}${hint}`, { cause: error });
+            }
+        }
         const db = await openDatabase(options.databasePath ?? DEFAULT_DATABASE_PATH);
         fastify.addHook('onClose', async () => db.close());
         const service = createService(db, this.resources, config, { approveGrant: options.approveGrant });

package/dist/service.d.ts

@@ -16,8 +16,15 @@ export interface NodeConfig {
     apiKey?: string;
     /** Operator base URL, including `/v1`. Required when the node hosts paid functions. */
     operatorUrl?: string;
+    /**
+     * The operator organization this node is enrolled in, which is paid for its functions.
+     * `StellariumNode.start` asks the operator for it when the node hosts paid functions.
+     */
+    organizationId?: string;
     /** Most this node will pay for one remote call. */
-    costLimitMicroUsdc: number;
+    costLimitMicroUsd: number;
+    /** Most this node will sign for in one remote inference call. */
+    inferenceCostLimitMicroUsd: number;
 }
 export interface Service {
     config: NodeConfig;

package/dist/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAClE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,OAAO,EAAE,kBAAkB,EAAE,KAAK,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAEvF,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE5D,OAAO,EAAE,KAAK,YAAY,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAErE,4GAA4G;AAC5G,MAAM,WAAW,UAAU;IACvB,4DAA4D;IAC5D,OAAO,EAAE,MAAM,CAAC;IAChB,mCAAmC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,qCAAqC;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,oFAAoF;IACpF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,uFAAuF;IACvF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mDAAmD;IACnD,kBAAkB,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,OAAO;IACpB,MAAM,EAAE,UAAU,CAAC;IACnB,cAAc,EAAE,cAAc,CAAC;IAC/B,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,eAAe,EAAE,eAAe,CAAC;IACjC,cAAc,EAAE,cAAc,CAAC;IAC/B,YAAY,EAAE,YAAY,CAAC;CAC9B;AAED,MAAM,WAAW,cAAc;IAC3B,+EAA+E;IAC/E,YAAY,CAAC,EAAE,YAAY,CAAC;CAC/B;AAED,wBAAgB,aAAa,CAAC,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,GAAE,cAAmB,GAAG,OAAO,CAoBtI"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAClE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,OAAO,EAAE,kBAAkB,EAAE,KAAK,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAEvF,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE5D,OAAO,EAAE,KAAK,YAAY,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAErE,4GAA4G;AAC5G,MAAM,WAAW,UAAU;IACvB,4DAA4D;IAC5D,OAAO,EAAE,MAAM,CAAC;IAChB,mCAAmC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,qCAAqC;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,oFAAoF;IACpF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,uFAAuF;IACvF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,mDAAmD;IACnD,iBAAiB,EAAE,MAAM,CAAC;IAC1B,iEAAiE;IACjE,0BAA0B,EAAE,MAAM,CAAC;CACtC;AAED,MAAM,WAAW,OAAO;IACpB,MAAM,EAAE,UAAU,CAAC;IACnB,cAAc,EAAE,cAAc,CAAC;IAC/B,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,eAAe,EAAE,eAAe,CAAC;IACjC,cAAc,EAAE,cAAc,CAAC;IAC/B,YAAY,EAAE,YAAY,CAAC;CAC9B;AAED,MAAM,WAAW,cAAc;IAC3B,+EAA+E;IAC/E,YAAY,CAAC,EAAE,YAAY,CAAC;CAC/B;AAED,wBAAgB,aAAa,CAAC,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,GAAE,cAAmB,GAAG,OAAO,CAoBtI"}

package/dist/service.js

@@ -6,11 +6,11 @@ import { OperatorClient } from "./client/operatorClient.js";
 import { GrantRepository } from "./grant/repository.js";
 import { GrantService } from "./grant/service.js";
 export function createService(db, resources, config, options = {}) {
-    const resourceRepository = new ResourceRepository(db, resources, config.baseUrl);
+    const resourceRepository = new ResourceRepository(db, resources, config.baseUrl, config.organizationId);
     const resourceResolver = new CombinationResourceResolver(resourceRepository);
     const grantService = new GrantService(new GrantRepository(db), config, options.approveGrant);
-    const resourceInvoker = new CombinationResourceInvoker(resourceRepository, config.costLimitMicroUsdc, config.publicKey, config.privateKey, grantService);
-    const operatorClient = new OperatorClient(config.operatorUrl);
+    const resourceInvoker = new CombinationResourceInvoker(resourceRepository, config.costLimitMicroUsd, config.publicKey, config.privateKey, grantService, config.inferenceCostLimitMicroUsd);
+    const operatorClient = new OperatorClient(config.operatorUrl, config.publicKey, config.privateKey);
     return {
         config,
         peerRepository: new PeerRepository(db),