stellarium-ts 0.16.0 → 0.18.0

package/dist/routes.d.ts

@@ -1,4 +1,5 @@
 import type { FastifyPluginAsync } from 'fastify';
+import { type RunTokenClaims } from './client/runTokens.js';
 import type { Service } from './service.js';
 export interface RateLimitConfig {
     max: number;
@@ -9,6 +10,21 @@ interface RouteOptions {
     service: Service;
     rateLimit?: RateLimitConfig;
 }
+/**
+ * Who is calling `POST /v1/run`: the holder of this node's API key, or an API client with a run token.
+ * Set by the route's preValidation hook.
+ */
+type RunCaller = {
+    kind: 'apiKey';
+} | ({
+    kind: 'client';
+    token: string;
+} & RunTokenClaims);
+declare module 'fastify' {
+    interface FastifyRequest {
+        runCaller?: RunCaller;
+    }
+}
 export declare const DEFAULT_PAGE_SIZE = 100;
 export declare const MAX_PAGE_SIZE = 500;
 /**

package/dist/routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../src/routes.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAgC,MAAM,SAAS,CAAC;AAMhF,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAK5C,MAAM,WAAW,eAAe;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,oDAAoD;IACpD,UAAU,EAAE,MAAM,GAAG,MAAM,CAAC;CAC/B;AAED,UAAU,YAAY;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,eAAe,CAAC;CAC/B;AAoDD,eAAO,MAAM,iBAAiB,MAAM,CAAC;AACrC,eAAO,MAAM,aAAa,MAAM,CAAC;AA4LjC;;;;GAIG;AACH,QAAA,MAAM,MAAM,EAAE,kBAAkB,CAAC,YAAY,CAuX5C,CAAC;eAGa,MAAM"}
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../src/routes.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAgC,MAAM,SAAS,CAAC;AAEhF,OAAO,EAAgB,KAAK,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAM1E,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAK5C,MAAM,WAAW,eAAe;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,oDAAoD;IACpD,UAAU,EAAE,MAAM,GAAG,MAAM,CAAC;CAC/B;AAED,UAAU,YAAY;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,eAAe,CAAC;CAC/B;AAoCD;;;GAGG;AACH,KAAK,SAAS,GAAG;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAAG,CAAC;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,cAAc,CAAC,CAAC;AAE3F,OAAO,QAAQ,SAAS,CAAC;IACrB,UAAU,cAAc;QACpB,SAAS,CAAC,EAAE,SAAS,CAAC;KACzB;CACJ;AAkBD,eAAO,MAAM,iBAAiB,MAAM,CAAC;AACrC,eAAO,MAAM,aAAa,MAAM,CAAC;AAwKjC;;;;GAIG;AACH,QAAA,MAAM,MAAM,EAAE,kBAAkB,CAAC,YAAY,CAma5C,CAAC;eAGa,MAAM"}

package/dist/routes.js

@@ -1,8 +1,10 @@
-import { createHash, timingSafeEqual } from 'node:crypto';
+import { createHash, randomUUID, timingSafeEqual } from 'node:crypto';
 import rateLimit from '@fastify/rate-limit';
-import { interpretParsed, parseScript } from 'requestscript';
+import { interpretParsed, parseScript, RequestScriptError, TokenMeter } from 'requestscript';
+import { looksLikeJwt } from './client/runTokens.js';
 import { inferenceVoucherPayload, invocationHash, isInferenceVoucher, paymentVoucherPayload } from './resource/invoker.js';
-import { inferenceCharge, isInferenceFunction, isInferenceManifest, parseMaxTokens } from './resource/inference.js';
+import { estimateInputTokens, inferenceCharge, isInferenceFunction, isInferenceManifest, parseMaxTokens } from './resource/inference.js';
+import { settlePaidCall } from './resource/settlement.js';
 import { safeVerifyData } from './crypto/utils.js';
 import { InvalidPublicKeyError } from './grant/service.js';
 // Body schemas check only the shape the handlers rely on. Signed payloads (resources) are
@@ -62,12 +64,12 @@ const resourceCallProperties = {
 };
 const fixedVoucherSchema = {
     type: 'object',
-    required: ['requestId', 'invocationId', 'amount', 'recipientAddress', 'signature', 'expiresAt', 'invocationHash', 'publicKey'],
+    required: ['requestId', 'invocationId', 'amount', 'recipientOrganizationId', 'signature', 'expiresAt', 'invocationHash', 'publicKey'],
     properties: {
         requestId: { type: 'string' },
         invocationId: { type: 'string' },
         amount: { type: 'integer' },
-        recipientAddress: { type: 'string' },
+        recipientOrganizationId: { type: 'string' },
         signature: { type: 'string' },
         expiresAt: { type: 'string' },
         invocationHash: { type: 'string' },
@@ -76,16 +78,16 @@ const fixedVoucherSchema = {
 };
 const inferenceVoucherSchema = {
     type: 'object',
-    required: ['kind', 'requestId', 'invocationId', 'maxAmount', 'inputCostMicroUsdcPerMillionTokens', 'outputCostMicroUsdcPerMillionTokens', 'maxTokens', 'recipientAddress', 'signature', 'expiresAt', 'invocationHash', 'publicKey'],
+    required: ['kind', 'requestId', 'invocationId', 'maxAmount', 'inputCostMicroUsdPerMillionTokens', 'outputCostMicroUsdPerMillionTokens', 'maxTokens', 'recipientOrganizationId', 'signature', 'expiresAt', 'invocationHash', 'publicKey'],
     properties: {
         kind: { const: 'inference' },
         requestId: { type: 'string' },
         invocationId: { type: 'string' },
         maxAmount: { type: 'integer', minimum: 0 },
-        inputCostMicroUsdcPerMillionTokens: { type: 'integer', minimum: 0 },
-        outputCostMicroUsdcPerMillionTokens: { type: 'integer', minimum: 0 },
+        inputCostMicroUsdPerMillionTokens: { type: 'integer', minimum: 0 },
+        outputCostMicroUsdPerMillionTokens: { type: 'integer', minimum: 0 },
         maxTokens: { type: 'integer', minimum: 1 },
-        recipientAddress: { type: 'string' },
+        recipientOrganizationId: { type: 'string' },
         signature: { type: 'string' },
         expiresAt: { type: 'string' },
         invocationHash: { type: 'string' },
@@ -131,16 +133,16 @@ function secretsEqual(a, b) {
 }
 /**
  * A voucher is valid when it is bound to this exact call, signed by its public key, unexpired,
- * and pays the function's recipient. A fixed voucher must pay at least the function's cost. An inference
+ * and pays this node's organization. A fixed voucher must pay at least the function's cost. An inference
  * voucher must be for an inference function, carry its rates, and sign the call's `maxTokens`.
  * Whether its `maxAmount` covers the call is checked separately, against the function's estimator.
  */
-function isValidPaymentVoucher(voucher, resourceFunction, manifest, request) {
+function isValidPaymentVoucher(voucher, resourceFunction, manifest, request, organizationId) {
     const expectedHash = invocationHash(request.resourcePath, request.resourceName, request.functionName, request.parameters);
     if (voucher.invocationHash !== expectedHash) {
         return false;
     }
-    if (voucher.recipientAddress !== manifest.recipientAddress) {
+    if (!organizationId || voucher.recipientOrganizationId !== organizationId) {
         return false;
     }
     const expiresAt = Date.parse(voucher.expiresAt);
@@ -151,8 +153,8 @@ function isValidPaymentVoucher(voucher, resourceFunction, manifest, request) {
         if (!isInferenceFunction(resourceFunction) || !isInferenceManifest(manifest)) {
             return false;
         }
-        if (voucher.inputCostMicroUsdcPerMillionTokens !== manifest.inputCostMicroUsdcPerMillionTokens
-            || voucher.outputCostMicroUsdcPerMillionTokens !== manifest.outputCostMicroUsdcPerMillionTokens) {
+        if (voucher.inputCostMicroUsdPerMillionTokens !== manifest.inputCostMicroUsdPerMillionTokens
+            || voucher.outputCostMicroUsdPerMillionTokens !== manifest.outputCostMicroUsdPerMillionTokens) {
             return false;
         }
         if (voucher.maxTokens !== parseMaxTokens(request.parameters)) {
@@ -163,31 +165,11 @@ function isValidPaymentVoucher(voucher, resourceFunction, manifest, request) {
     if (isInferenceFunction(resourceFunction) || isInferenceManifest(manifest)) {
         return false;
     }
-    if (voucher.amount < manifest.costMicroUsdc) {
+    if (voucher.amount < manifest.costMicroUsd) {
         return false;
     }
     return safeVerifyData(paymentVoucherPayload(voucher), voucher.publicKey, voucher.signature);
 }
-/** The function's own input-token estimate, or undefined if its estimator failed or returned something other than a count. */
-async function estimateInputTokens(resourceFunction, request) {
-    try {
-        const inputTokens = await resourceFunction.estimateInputTokens?.(request.parameters);
-        return Number.isSafeInteger(inputTokens) && inputTokens >= 0 ? inputTokens : undefined;
-    }
-    catch {
-        return undefined;
-    }
-}
-/** What the operator will accrue for `usage`: its charge at the voucher's rates, capped at `maxAmount`. */
-function cappedInferenceCharge(voucher, usage) {
-    try {
-        return Math.min(inferenceCharge(voucher, usage.inputTokens, usage.outputTokens), voucher.maxAmount);
-    }
-    catch {
-        // The charge isn't a safe integer, so it is over any maxAmount.
-        return voucher.maxAmount;
-    }
-}
 /**
  * Encapsulates the routes
  * @param fastify Encapsulated Fastify Instance
@@ -210,6 +192,32 @@ const routes = async (fastify, options) => {
             return reply.status(401).send({ error: 'Invalid API Key' });
         }
     };
+    /**
+     * Requires `Authorization: Bearer <API_KEY>` or `Bearer <run token>`, a JWT from the operator addressed to
+     * this node. Records the caller on `request.runCaller`.
+     */
+    const requireRunAuthorization = async (request, reply) => {
+        const authorizationHeader = request.headers['authorization'];
+        if (!authorizationHeader) {
+            return reply.status(401).send({ error: 'Authorization header is required' });
+        }
+        const token = authorizationHeader.split(' ')[1];
+        const expectedApiKey = options.service.config.apiKey;
+        if (token && expectedApiKey && secretsEqual(token, expectedApiKey)) {
+            request.runCaller = { kind: 'apiKey' };
+            return;
+        }
+        const verifier = options.service.runTokenVerifier;
+        if (token && verifier && looksLikeJwt(token)) {
+            const claims = await verifier.verify(token);
+            if (!claims) {
+                return reply.status(401).send({ error: 'Invalid run token' });
+            }
+            request.runCaller = { kind: 'client', token, ...claims };
+            return;
+        }
+        return reply.status(401).send({ error: 'Invalid API Key' });
+    };
     // Start Meta Routes
     fastify.get('/', async (request, reply) => {
         return {
@@ -255,12 +263,12 @@ const routes = async (fastify, options) => {
                         description: parameter.description,
                     })),
                     paymentManifest: !fn.paymentManifest ? undefined : isInferenceManifest(fn.paymentManifest) ? {
-                        inputCostMicroUsdcPerMillionTokens: fn.paymentManifest.inputCostMicroUsdcPerMillionTokens,
-                        outputCostMicroUsdcPerMillionTokens: fn.paymentManifest.outputCostMicroUsdcPerMillionTokens,
-                        recipientAddress: fn.paymentManifest.recipientAddress,
+                        inputCostMicroUsdPerMillionTokens: fn.paymentManifest.inputCostMicroUsdPerMillionTokens,
+                        outputCostMicroUsdPerMillionTokens: fn.paymentManifest.outputCostMicroUsdPerMillionTokens,
+                        recipientOrganizationId: fn.paymentManifest.recipientOrganizationId,
                     } : {
-                        costMicroUsdc: fn.paymentManifest.costMicroUsdc,
-                        recipientAddress: fn.paymentManifest.recipientAddress,
+                        costMicroUsd: fn.paymentManifest.costMicroUsd,
+                        recipientOrganizationId: fn.paymentManifest.recipientOrganizationId,
                     },
                     restricted: fn.restricted || undefined,
                     kind: isInferenceFunction(fn) ? 'inference' : undefined,
@@ -286,8 +294,14 @@ const routes = async (fastify, options) => {
     });
     // End Meta Routes
     // Start Run Routes
+    /**
+     * Runs a request script. A run token from another organization's API client is billed: the operator
+     * holds the run's cost first, the script's paid calls draw on that hold, and afterwards the run is
+     * charged for the tokens the script executed at this node's listed price. Runs by the API key holder or
+     * by this node's own organization are free, and their paid calls are paid by this node's organization.
+     */
     // Authenticate before body validation, so unauthenticated callers learn nothing about the schema.
-    fastify.post('/run', { schema: { body: runRequestSchema }, preValidation: requireApiKey }, async (request, reply) => {
+    fastify.post('/run', { schema: { body: runRequestSchema }, preValidation: requireRunAuthorization }, async (request, reply) => {
         const runRequest = request.body;
         let script;
         try {
@@ -300,16 +314,50 @@ const routes = async (fastify, options) => {
         if (script.declaration.kind !== 'request') {
             return reply.status(400).send({ error: 'Invalid script' });
         }
+        const caller = request.runCaller;
+        const billed = caller.kind === 'client' && caller.organizationId !== options.service.config.organizationId;
+        const runId = billed ? randomUUID() : undefined;
+        let resourceInvoker = options.service.resourceInvoker;
+        if (billed) {
+            const authorization = await options.service.operatorClient.authorizeRun({ token: caller.token, runId: runId, source: runRequest.source });
+            if (!authorization.ok) {
+                return reply.status(authorization.status).send({ error: authorization.error });
+            }
+            resourceInvoker = options.service.resourceInvoker.forRun({ runId: runId });
+        }
+        // Nothing waits on settlement, so it doesn't delay the response.
+        const settle = (outcome, tokens) => runId && setTimeout(async () => {
+            try {
+                if (outcome === 'capture') {
+                    await options.service.operatorClient.captureRun({ runId, tokens });
+                }
+                else {
+                    await options.service.operatorClient.releaseRun({ runId });
+                }
+            }
+            catch (error) {
+                fastify.log.error(error, `Failed to ${outcome} run ${runId}`);
+            }
+        }, 0);
+        const meter = new TokenMeter();
         try {
             const result = await interpretParsed(script, {
                 resourceResolver: options.service.resourceResolver,
-                resourceInvoker: options.service.resourceInvoker
+                resourceInvoker,
+                meter,
             });
-            reply.status(200).send({ returnValue: result.returnValue ?? null });
+            settle('capture', meter.tokens);
+            return reply.status(200).send({ returnValue: result.returnValue ?? null, usage: { tokens: meter.tokens } });
         }
         catch (error) {
+            // A script that fails at runtime is the caller's mistake, and is charged for what it executed.
+            if (error instanceof RequestScriptError) {
+                settle('capture', meter.tokens);
+                return reply.status(422).send({ error: 'Script failed', details: error.message, usage: { tokens: meter.tokens } });
+            }
+            settle('release', meter.tokens);
             fastify.log.error(error);
-            reply.status(500).send({ error: 'Internal server error' });
+            return reply.status(500).send({ error: 'Internal server error' });
         }
     });
     /**
@@ -375,7 +423,7 @@ const routes = async (fastify, options) => {
         if (maxTokens === undefined) {
             return reply.status(400).send({ error: 'maxTokens must be a positive int32' });
         }
-        const inputTokens = await estimateInputTokens(resourceFunction, resourceRequest);
+        const inputTokens = await estimateInputTokens(resourceFunction, resourceRequest.parameters);
         if (inputTokens === undefined) {
             return reply.status(500).send({ error: 'Failed to estimate input tokens' });
         }
@@ -398,7 +446,7 @@ const routes = async (fastify, options) => {
             if (!paymentVoucher) {
                 return reply.status(402).send({ error: 'Payment voucher is required' });
             }
-            if (!isValidPaymentVoucher(paymentVoucher, resourceFunction, paymentManifest, resourceRequest)) {
+            if (!isValidPaymentVoucher(paymentVoucher, resourceFunction, paymentManifest, resourceRequest, options.service.config.organizationId)) {
                 return reply.status(400).send({ error: 'Invalid payment voucher' });
             }
             if (await options.service.grantService.isBlocked(paymentVoucher.publicKey)) {
@@ -406,45 +454,24 @@ const routes = async (fastify, options) => {
             }
             // Re-estimated here, so inference never runs on a voucher that can't cover the expected cost.
             if (isInferenceVoucher(paymentVoucher)) {
-                const inputTokens = await estimateInputTokens(resourceFunction, resourceRequest);
+                const inputTokens = await estimateInputTokens(resourceFunction, resourceRequest.parameters);
                 if (inputTokens === undefined) {
                     return reply.status(500).send({ error: 'Failed to estimate input tokens' });
                 }
                 const requiredMaxAmount = inferenceCharge(paymentVoucher, inputTokens, paymentVoucher.maxTokens);
                 if (paymentVoucher.maxAmount < requiredMaxAmount) {
-                    return reply.status(402).send({ error: `Payment voucher maxAmount ${paymentVoucher.maxAmount} is below the estimated ${requiredMaxAmount} micro-USDC`, requiredMaxAmount });
+                    return reply.status(402).send({ error: `Payment voucher maxAmount ${paymentVoucher.maxAmount} is below the estimated ${requiredMaxAmount} micro-USD`, requiredMaxAmount });
                 }
             }
         }
-        const result = await options.service.resourceInvoker.invoke(resource, resourceRequest.functionName, resourceRequest.parameters);
-        let settlement;
-        if (paymentManifest && paymentVoucher && !result.error) {
-            if (!isInferenceVoucher(paymentVoucher)) {
-                settlement = { voucher: paymentVoucher };
-            }
-            else if (result.usage) {
-                // The function may report more output than it was allowed; the caller only signed for maxTokens.
-                const usage = { inputTokens: result.usage.inputTokens, outputTokens: Math.min(result.usage.outputTokens, paymentVoucher.maxTokens) };
-                result.usage = usage;
-                // A free call has nothing to settle, and the operator refuses an empty receipt.
-                if (cappedInferenceCharge(paymentVoucher, usage) > 0) {
-                    settlement = { voucher: paymentVoucher, usage };
-                }
-            }
+        const invoke = () => options.service.resourceInvoker.invoke(resource, resourceRequest.functionName, resourceRequest.parameters);
+        // A free function ignores any voucher sent with it.
+        if (!paymentManifest || !paymentVoucher) {
+            return invoke();
         }
-        // Settle only verified vouchers, and only after a successful invoke. A voucher sent to a free function is ignored.
-        // Run this on a separate thread to avoid blocking the main thread.
-        if (settlement) {
-            const payment = settlement;
-            setTimeout(async () => {
-                // Nothing awaits this callback, so an uncaught error here would be an unhandled rejection.
-                try {
-                    await options.service.operatorClient.settlePayment(payment);
-                }
-                catch (error) {
-                    fastify.log.error(error, 'Failed to settle payment');
-                }
-            }, 0);
+        const result = await settlePaidCall(options.service.operatorClient, paymentVoucher, invoke, (error, message) => fastify.log.error(error, message));
+        if ('refused' in result) {
+            return reply.status(result.refused.status).send({ error: result.refused.error });
         }
         return result;
     });

package/dist/server.d.ts

@@ -6,7 +6,7 @@ import type { ApproveGrant, GrantOptions } from './grant/service.js';
 import { StellariumResource } from './resource/repository.js';
 import { RateLimitConfig } from './routes.js';
 import { type NodeConfig } from './service.js';
-export declare const DEFAULT_COST_LIMIT_MICRO_USDC = 10000;
+export declare const DEFAULT_COST_LIMIT_MICRO_USD = 10000;
 export declare const DEFAULT_GRANT_REFRESH_INTERVAL_MS: number;
 export interface StellariumNodeOptions {
     port?: number;
@@ -20,17 +20,22 @@ export interface StellariumNodeOptions {
     publicKey?: string;
     /** Defaults to `SIGNING_PRIVATE_KEY`. */
     privateKey?: string;
-    /** Bearer token for `POST /v1/run`. Defaults to `API_KEY`. */
+    /** Bearer token for `POST /v1/run` and the admin routes. Defaults to `API_KEY`. */
     apiKey?: string;
     /** Defaults to `OPERATOR_URL`. */
     operatorUrl?: string;
-    /** Most this node pays for one remote call. Defaults to `COST_LIMIT_MICRO_USDC`, then 10,000 ($0.01). */
-    costLimitMicroUsdc?: number;
+    /**
+     * One-time token from the dashboard that enrolls this node in an organization. Defaults to
+     * `ENROLLMENT_TOKEN`. Only needed on a node's first start; an enrolled node ignores it.
+     */
+    enrollmentToken?: string;
+    /** Most this node pays for one remote call. Defaults to `COST_LIMIT_MICRO_USD`, then 10,000 ($0.01). */
+    costLimitMicroUsd?: number;
     /**
      * Most this node signs for in one remote inference call (the voucher's `maxAmount`).
-     * Defaults to `INFERENCE_COST_LIMIT_MICRO_USDC`, then to the resolved `costLimitMicroUsdc`.
+     * Defaults to `INFERENCE_COST_LIMIT_MICRO_USD`, then to the resolved `costLimitMicroUsd`.
      */
-    inferenceCostLimitMicroUsdc?: number;
+    inferenceCostLimitMicroUsd?: number;
     /** SQLite file. Defaults to `./requestscript.db`; use ':memory:' for tests. */
     databasePath?: string;
     /**

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,eAAe,CAAC;AACvB,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAE1C,OAAO,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAErE,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAe,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAiB,KAAK,UAAU,EAAgB,MAAM,cAAc,CAAC;AAG5E,eAAO,MAAM,6BAA6B,QAAS,CAAC;AACpD,eAAO,MAAM,iCAAiC,QAAgB,CAAC;AAE/D,MAAM,WAAW,qBAAqB;IAClC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,0FAA0F;IAC1F,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,gEAAgE;IAChE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wCAAwC;IACxC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yCAAyC;IACzC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kCAAkC;IAClC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yGAAyG;IACzG,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,2BAA2B,CAAC,EAAE,MAAM,CAAC;IACrC,+EAA+E;IAC/E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;IACnB,yFAAyF;IACzF,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC;;;OAGG;IACH,YAAY,CAAC,EAAE,YAAY,CAAC;CAC/B;AAaD,wBAAgB,aAAa,CAAC,OAAO,EAAE,qBAAqB,EAAE,SAAS,GAAE,kBAAkB,EAAO,GAAG,UAAU,CAwB9G;AAED,qBAAa,cAAc;IACvB,OAAO,CAAC,SAAS,CAA4B;IAC7C,OAAO,CAAC,OAAO,CAAC,CAAU;IAEpB,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAE1D;IAED;;;OAGG;IACG,KAAK,CAAC,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoDnF;IAED,8FAA8F;IACxF,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,CAEtG;IAED;;;OAGG;IACG,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,CAEvI;IAED,wFAAwF;IAClF,YAAY,CAAC,eAAe,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,CAE3H;IAED,mDAAmD;IAC7C,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAE5C;IAED;;;OAGG;IACG,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAEzD;IAED,4FAA4F;IACtF,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEnE;IAED,yCAAyC;IACnC,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAEvD;IAED,OAAO,CAAC,OAAO;CAMlB"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,eAAe,CAAC;AACvB,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAE1C,OAAO,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAErE,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAe,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAiB,KAAK,UAAU,EAAgB,MAAM,cAAc,CAAC;AAI5E,eAAO,MAAM,4BAA4B,QAAS,CAAC;AACnD,eAAO,MAAM,iCAAiC,QAAgB,CAAC;AAE/D,MAAM,WAAW,qBAAqB;IAClC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,0FAA0F;IAC1F,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,gEAAgE;IAChE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wCAAwC;IACxC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yCAAyC;IACzC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mFAAmF;IACnF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kCAAkC;IAClC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,wGAAwG;IACxG,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,+EAA+E;IAC/E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;IACnB,yFAAyF;IACzF,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC;;;OAGG;IACH,YAAY,CAAC,EAAE,YAAY,CAAC;CAC/B;AAaD,wBAAgB,aAAa,CAAC,OAAO,EAAE,qBAAqB,EAAE,SAAS,GAAE,kBAAkB,EAAO,GAAG,UAAU,CAwB9G;AAED,qBAAa,cAAc;IACvB,OAAO,CAAC,SAAS,CAA4B;IAC7C,OAAO,CAAC,OAAO,CAAC,CAAU;IAEpB,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAE1D;IAED;;;OAGG;IACG,KAAK,CAAC,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CA0EnF;IAED,8FAA8F;IACxF,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,CAEtG;IAED;;;OAGG;IACG,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,CAEvI;IAED,wFAAwF;IAClF,YAAY,CAAC,eAAe,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,CAE3H;IAED,mDAAmD;IAC7C,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAE5C;IAED;;;OAGG;IACG,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAEzD;IAED,4FAA4F;IACtF,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEnE;IAED,yCAAyC;IACnC,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAEvD;IAED,OAAO,CAAC,OAAO;CAMlB"}

package/dist/server.js

@@ -4,7 +4,8 @@ import { validateInferenceFunction } from './resource/inference.js';
 import routes from './routes.js';
 import { createService } from './service.js';
 import { StartupService } from './startup.js';
-export const DEFAULT_COST_LIMIT_MICRO_USDC = 10_000;
+import { OperatorClient } from './client/operatorClient.js';
+export const DEFAULT_COST_LIMIT_MICRO_USD = 10_000;
 export const DEFAULT_GRANT_REFRESH_INTERVAL_MS = 1000 * 60 * 5;
 function required(name, value) {
     if (!value) {
@@ -16,13 +17,13 @@ function hostsPaidFunctions(resources) {
     return resources.some(resource => resource.functions.some(fn => fn.paymentManifest));
 }
 export function resolveConfig(options, resources = []) {
-    const costLimit = options.costLimitMicroUsdc ?? (process.env.COST_LIMIT_MICRO_USDC ? Number(process.env.COST_LIMIT_MICRO_USDC) : DEFAULT_COST_LIMIT_MICRO_USDC);
+    const costLimit = options.costLimitMicroUsd ?? (process.env.COST_LIMIT_MICRO_USD ? Number(process.env.COST_LIMIT_MICRO_USD) : DEFAULT_COST_LIMIT_MICRO_USD);
     if (!Number.isSafeInteger(costLimit) || costLimit < 0) {
-        throw new Error('costLimitMicroUsdc must be a nonnegative integer');
+        throw new Error('costLimitMicroUsd must be a nonnegative integer');
     }
-    const inferenceCostLimit = options.inferenceCostLimitMicroUsdc ?? (process.env.INFERENCE_COST_LIMIT_MICRO_USDC ? Number(process.env.INFERENCE_COST_LIMIT_MICRO_USDC) : costLimit);
+    const inferenceCostLimit = options.inferenceCostLimitMicroUsd ?? (process.env.INFERENCE_COST_LIMIT_MICRO_USD ? Number(process.env.INFERENCE_COST_LIMIT_MICRO_USD) : costLimit);
     if (!Number.isSafeInteger(inferenceCostLimit) || inferenceCostLimit < 0) {
-        throw new Error('inferenceCostLimitMicroUsdc must be a nonnegative integer');
+        throw new Error('inferenceCostLimitMicroUsd must be a nonnegative integer');
     }
     for (const resource of resources) {
         resource.functions.forEach(validateInferenceFunction);
@@ -36,8 +37,8 @@ export function resolveConfig(options, resources = []) {
         operatorUrl: hostsPaidFunctions(resources)
             ? required('OPERATOR_URL', options.operatorUrl ?? process.env.OPERATOR_URL)
             : options.operatorUrl ?? process.env.OPERATOR_URL,
-        costLimitMicroUsdc: costLimit,
-        inferenceCostLimitMicroUsdc: inferenceCostLimit,
+        costLimitMicroUsd: costLimit,
+        inferenceCostLimitMicroUsd: inferenceCostLimit,
     };
 }
 export class StellariumNode {
@@ -52,6 +53,30 @@ export class StellariumNode {
      */
     async start(fastify, options) {
         const config = resolveConfig(options, this.resources);
+        const enrollmentToken = options.enrollmentToken ?? process.env.ENROLLMENT_TOKEN;
+        // Paid functions are paid to the node's organization, so a provider must be enrolled before it serves them.
+        // A node that only calls paid functions enrolls the same way, so its vouchers draw on its organization's balance.
+        // Any other node with an operator still reports its URL, for listing, and learns its organization, so its
+        // own organization's run tokens run free.
+        const session = () => new OperatorClient(config.operatorUrl, config.publicKey, config.privateKey).session(enrollmentToken, config.baseUrl);
+        if (hostsPaidFunctions(this.resources) || enrollmentToken) {
+            try {
+                ({ organizationId: config.organizationId } = await session());
+            }
+            catch (error) {
+                const hint = enrollmentToken ? '' : '. Create an enrollment token for it at https://platform.stellarium.sh and set ENROLLMENT_TOKEN';
+                throw new Error(`${error instanceof Error ? error.message : String(error)}${hint}`, { cause: error });
+            }
+        }
+        else if (config.operatorUrl) {
+            // Serving doesn't depend on it, so it doesn't hold up the start. Until it answers, run tokens from
+            // this node's own organization are refused as if billed.
+            session().then(({ organizationId }) => {
+                config.organizationId = organizationId;
+            }, (error) => {
+                fastify.log.warn(`No session with the operator, so this node can't be listed: ${error instanceof Error ? error.message : String(error)}`);
+            });
+        }
         const db = await openDatabase(options.databasePath ?? DEFAULT_DATABASE_PATH);
         fastify.addHook('onClose', async () => db.close());
         const service = createService(db, this.resources, config, { approveGrant: options.approveGrant });

package/dist/service.d.ts

@@ -1,8 +1,11 @@
-import { ResourceInvoker, ResourceResolver } from "requestscript";
+import type { JWTVerifyGetKey } from "jose";
+import { ResourceResolver } from "requestscript";
 import type { Database } from "sqlite";
 import { PeerRepository } from "./peer/repository.js";
 import { ResourceRepository, type StellariumResource } from "./resource/repository.js";
+import { CombinationResourceInvoker } from "./resource/invoker.js";
 import { OperatorClient } from "./client/operatorClient.js";
+import { RunTokenVerifier } from "./client/runTokens.js";
 import { type ApproveGrant, GrantService } from "./grant/service.js";
 /** Settings a node runs with. `StellariumNode.start` fills these from its options, then the environment. */
 export interface NodeConfig {
@@ -12,27 +15,36 @@ export interface NodeConfig {
     publicKey: string;
     /** Ed25519 PKCS#8 DER, base64url. */
     privateKey: string;
-    /** Bearer token for `POST /v1/run`. When unset, `/v1/run` rejects every request. */
+    /** Bearer token for `POST /v1/run` and the admin routes. When unset, only run tokens are accepted, and the admin routes reject every request. */
     apiKey?: string;
-    /** Operator base URL, including `/v1`. Required when the node hosts paid functions. */
+    /** Operator base URL, including `/v1`. Required when the node hosts paid functions, and to accept run tokens. */
     operatorUrl?: string;
+    /**
+     * The operator organization this node is enrolled in, which is paid for its functions.
+     * `StellariumNode.start` asks the operator for it when the node hosts paid functions.
+     */
+    organizationId?: string;
     /** Most this node will pay for one remote call. */
-    costLimitMicroUsdc: number;
+    costLimitMicroUsd: number;
     /** Most this node will sign for in one remote inference call. */
-    inferenceCostLimitMicroUsdc: number;
+    inferenceCostLimitMicroUsd: number;
 }
 export interface Service {
     config: NodeConfig;
     peerRepository: PeerRepository;
     resourceRepository: ResourceRepository;
     resourceResolver: ResourceResolver;
-    resourceInvoker: ResourceInvoker;
+    resourceInvoker: CombinationResourceInvoker;
     operatorClient: OperatorClient;
     grantService: GrantService;
+    /** Verifies the run tokens `POST /v1/run` accepts. Set when the node has an operator URL. */
+    runTokenVerifier?: RunTokenVerifier;
 }
 export interface ServiceOptions {
     /** Decides `POST /v1/grants/request`. Without it, every request is refused. */
     approveGrant?: ApproveGrant;
+    /** Replaces the operator's published keys for verifying run tokens, in tests. */
+    runTokenKeys?: JWTVerifyGetKey;
 }
 export declare function createService(db: Database, resources: StellariumResource[], config: NodeConfig, options?: ServiceOptions): Service;
 //# sourceMappingURL=service.d.ts.map

package/dist/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAClE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,OAAO,EAAE,kBAAkB,EAAE,KAAK,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAEvF,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE5D,OAAO,EAAE,KAAK,YAAY,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAErE,4GAA4G;AAC5G,MAAM,WAAW,UAAU;IACvB,4DAA4D;IAC5D,OAAO,EAAE,MAAM,CAAC;IAChB,mCAAmC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,qCAAqC;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,oFAAoF;IACpF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,uFAAuF;IACvF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mDAAmD;IACnD,kBAAkB,EAAE,MAAM,CAAC;IAC3B,iEAAiE;IACjE,2BAA2B,EAAE,MAAM,CAAC;CACvC;AAED,MAAM,WAAW,OAAO;IACpB,MAAM,EAAE,UAAU,CAAC;IACnB,cAAc,EAAE,cAAc,CAAC;IAC/B,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,eAAe,EAAE,eAAe,CAAC;IACjC,cAAc,EAAE,cAAc,CAAC;IAC/B,YAAY,EAAE,YAAY,CAAC;CAC9B;AAED,MAAM,WAAW,cAAc;IAC3B,+EAA+E;IAC/E,YAAY,CAAC,EAAE,YAAY,CAAC;CAC/B;AAED,wBAAgB,aAAa,CAAC,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,GAAE,cAAmB,GAAG,OAAO,CAoBtI"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,MAAM,CAAC;AAC5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,OAAO,EAAE,kBAAkB,EAAE,KAAK,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAEzD,OAAO,EAAE,KAAK,YAAY,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAErE,4GAA4G;AAC5G,MAAM,WAAW,UAAU;IACvB,4DAA4D;IAC5D,OAAO,EAAE,MAAM,CAAC;IAChB,mCAAmC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,qCAAqC;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,iJAAiJ;IACjJ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iHAAiH;IACjH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,mDAAmD;IACnD,iBAAiB,EAAE,MAAM,CAAC;IAC1B,iEAAiE;IACjE,0BAA0B,EAAE,MAAM,CAAC;CACtC;AAED,MAAM,WAAW,OAAO;IACpB,MAAM,EAAE,UAAU,CAAC;IACnB,cAAc,EAAE,cAAc,CAAC;IAC/B,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,eAAe,EAAE,0BAA0B,CAAC;IAC5C,cAAc,EAAE,cAAc,CAAC;IAC/B,YAAY,EAAE,YAAY,CAAC;IAC3B,6FAA6F;IAC7F,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;CACvC;AAED,MAAM,WAAW,cAAc;IAC3B,+EAA+E;IAC/E,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,iFAAiF;IACjF,YAAY,CAAC,EAAE,eAAe,CAAC;CAClC;AAED,wBAAgB,aAAa,CAAC,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,GAAE,cAAmB,GAAG,OAAO,CAwBtI"}

package/dist/service.js

@@ -3,14 +3,18 @@ import { CombinationResourceResolver } from "./resource/resolver.js";
 import { ResourceRepository } from "./resource/repository.js";
 import { CombinationResourceInvoker } from "./resource/invoker.js";
 import { OperatorClient } from "./client/operatorClient.js";
+import { RunTokenVerifier } from "./client/runTokens.js";
 import { GrantRepository } from "./grant/repository.js";
 import { GrantService } from "./grant/service.js";
 export function createService(db, resources, config, options = {}) {
-    const resourceRepository = new ResourceRepository(db, resources, config.baseUrl);
+    const resourceRepository = new ResourceRepository(db, resources, config.baseUrl, config.organizationId);
     const resourceResolver = new CombinationResourceResolver(resourceRepository);
     const grantService = new GrantService(new GrantRepository(db), config, options.approveGrant);
-    const resourceInvoker = new CombinationResourceInvoker(resourceRepository, config.costLimitMicroUsdc, config.publicKey, config.privateKey, grantService, config.inferenceCostLimitMicroUsdc);
-    const operatorClient = new OperatorClient(config.operatorUrl);
+    const operatorClient = new OperatorClient(config.operatorUrl, config.publicKey, config.privateKey);
+    const resourceInvoker = new CombinationResourceInvoker(resourceRepository, config.costLimitMicroUsd, config.publicKey, config.privateKey, grantService, config.inferenceCostLimitMicroUsd, {
+        operatorClient,
+        organizationId: config.organizationId,
+    });
     return {
         config,
         peerRepository: new PeerRepository(db),
@@ -19,5 +23,6 @@ export function createService(db, resources, config, options = {}) {
         resourceInvoker,
         operatorClient,
         grantService,
+        runTokenVerifier: config.operatorUrl ? new RunTokenVerifier(config.operatorUrl, config.publicKey, options.runTokenKeys) : undefined,
     };
 }