stellarium-ts 0.17.0 → 0.19.0

package/dist/resource/settlement.js

@@ -0,0 +1,59 @@
+import { inferenceCharge } from "./inference.js";
+import { isInferenceVoucher } from "./invoker.js";
+/** What the operator will capture for `usage`: its charge at the voucher's rates, capped at `maxAmount`. */
+function cappedInferenceCharge(voucher, usage) {
+    try {
+        return Math.min(inferenceCharge(voucher, usage.inputTokens, usage.outputTokens), voucher.maxAmount);
+    }
+    catch {
+        // The charge isn't a safe integer, so it is over any maxAmount.
+        return voucher.maxAmount;
+    }
+}
+/**
+ * Runs a paid call: holds the voucher's amount with the operator first, so a paid function never runs
+ * unpaid, then runs `call` and captures the voucher, or releases it for a failed or free call. Settlement is
+ * scheduled after returning, so it doesn't delay the caller, and failures go to `onSettleError`.
+ */
+export async function settlePaidCall(operatorClient, voucher, call, onSettleError) {
+    const authorization = await operatorClient.authorize(voucher);
+    if (!authorization.ok) {
+        return { refused: { status: authorization.status, error: authorization.error } };
+    }
+    let capture;
+    const settle = () => setTimeout(async () => {
+        try {
+            if (capture) {
+                await operatorClient.capture(capture);
+            }
+            else {
+                await operatorClient.release(voucher);
+            }
+        }
+        catch (error) {
+            onSettleError(error, capture ? 'Failed to capture payment' : 'Failed to release payment');
+        }
+    }, 0);
+    let result;
+    try {
+        result = await call();
+    }
+    catch (error) {
+        settle();
+        throw error;
+    }
+    if (!result.error && !isInferenceVoucher(voucher)) {
+        capture = { voucher };
+    }
+    else if (!result.error && result.usage && isInferenceVoucher(voucher)) {
+        // The function may report more output than it was allowed; the caller only signed for maxTokens.
+        const usage = { inputTokens: result.usage.inputTokens, outputTokens: Math.min(result.usage.outputTokens, voucher.maxTokens) };
+        result.usage = usage;
+        // A free call has nothing to charge, so its hold is released instead.
+        if (cappedInferenceCharge(voucher, usage) > 0) {
+            capture = { voucher, usage };
+        }
+    }
+    settle();
+    return result;
+}

package/dist/routes.d.ts

@@ -1,4 +1,5 @@
 import type { FastifyPluginAsync } from 'fastify';
+import { type RunTokenClaims } from './client/runTokens.js';
 import type { Service } from './service.js';
 export interface RateLimitConfig {
     max: number;
@@ -9,6 +10,21 @@ interface RouteOptions {
     service: Service;
     rateLimit?: RateLimitConfig;
 }
+/**
+ * Who is calling `POST /v1/run`: the holder of this node's API key, or an API client with a run token.
+ * Set by the route's preValidation hook.
+ */
+type RunCaller = {
+    kind: 'apiKey';
+} | ({
+    kind: 'client';
+    token: string;
+} & RunTokenClaims);
+declare module 'fastify' {
+    interface FastifyRequest {
+        runCaller?: RunCaller;
+    }
+}
 export declare const DEFAULT_PAGE_SIZE = 100;
 export declare const MAX_PAGE_SIZE = 500;
 /**

package/dist/routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../src/routes.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAgC,MAAM,SAAS,CAAC;AAMhF,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAM5C,MAAM,WAAW,eAAe;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,oDAAoD;IACpD,UAAU,EAAE,MAAM,GAAG,MAAM,CAAC;CAC/B;AAED,UAAU,YAAY;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,eAAe,CAAC;CAC/B;AAoDD,eAAO,MAAM,iBAAiB,MAAM,CAAC;AACrC,eAAO,MAAM,aAAa,MAAM,CAAC;AA4LjC;;;;GAIG;AACH,QAAA,MAAM,MAAM,EAAE,kBAAkB,CAAC,YAAY,CAgY5C,CAAC;eAGa,MAAM"}
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../src/routes.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAgC,MAAM,SAAS,CAAC;AAEhF,OAAO,EAAgB,KAAK,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAM1E,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAK5C,MAAM,WAAW,eAAe;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,oDAAoD;IACpD,UAAU,EAAE,MAAM,GAAG,MAAM,CAAC;CAC/B;AAED,UAAU,YAAY;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,eAAe,CAAC;CAC/B;AAoCD;;;GAGG;AACH,KAAK,SAAS,GAAG;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAAG,CAAC;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,cAAc,CAAC,CAAC;AAE3F,OAAO,QAAQ,SAAS,CAAC;IACrB,UAAU,cAAc;QACpB,SAAS,CAAC,EAAE,SAAS,CAAC;KACzB;CACJ;AAkBD,eAAO,MAAM,iBAAiB,MAAM,CAAC;AACrC,eAAO,MAAM,aAAa,MAAM,CAAC;AAwKjC;;;;GAIG;AACH,QAAA,MAAM,MAAM,EAAE,kBAAkB,CAAC,YAAY,CAqa5C,CAAC;eAGa,MAAM"}

package/dist/routes.js

@@ -1,8 +1,10 @@
-import { createHash, timingSafeEqual } from 'node:crypto';
+import { createHash, randomUUID, timingSafeEqual } from 'node:crypto';
 import rateLimit from '@fastify/rate-limit';
-import { interpretParsed, parseScript } from 'requestscript';
+import { interpretParsed, parseScript, RequestScriptError, TokenMeter } from 'requestscript';
+import { looksLikeJwt } from './client/runTokens.js';
 import { inferenceVoucherPayload, invocationHash, isInferenceVoucher, paymentVoucherPayload } from './resource/invoker.js';
-import { inferenceCharge, isInferenceFunction, isInferenceManifest, parseMaxTokens } from './resource/inference.js';
+import { estimateInputTokens, inferenceCharge, isInferenceFunction, isInferenceManifest, parseMaxTokens } from './resource/inference.js';
+import { settlePaidCall } from './resource/settlement.js';
 import { safeVerifyData } from './crypto/utils.js';
 import { InvalidPublicKeyError } from './grant/service.js';
 // Body schemas check only the shape the handlers rely on. Signed payloads (resources) are
@@ -168,26 +170,6 @@ function isValidPaymentVoucher(voucher, resourceFunction, manifest, request, org
     }
     return safeVerifyData(paymentVoucherPayload(voucher), voucher.publicKey, voucher.signature);
 }
-/** The function's own input-token estimate, or undefined if its estimator failed or returned something other than a count. */
-async function estimateInputTokens(resourceFunction, request) {
-    try {
-        const inputTokens = await resourceFunction.estimateInputTokens?.(request.parameters);
-        return Number.isSafeInteger(inputTokens) && inputTokens >= 0 ? inputTokens : undefined;
-    }
-    catch {
-        return undefined;
-    }
-}
-/** What the operator will capture for `usage`: its charge at the voucher's rates, capped at `maxAmount`. */
-function cappedInferenceCharge(voucher, usage) {
-    try {
-        return Math.min(inferenceCharge(voucher, usage.inputTokens, usage.outputTokens), voucher.maxAmount);
-    }
-    catch {
-        // The charge isn't a safe integer, so it is over any maxAmount.
-        return voucher.maxAmount;
-    }
-}
 /**
  * Encapsulates the routes
  * @param fastify Encapsulated Fastify Instance
@@ -210,6 +192,32 @@ const routes = async (fastify, options) => {
             return reply.status(401).send({ error: 'Invalid API Key' });
         }
     };
+    /**
+     * Requires `Authorization: Bearer <API_KEY>` or `Bearer <run token>`, a JWT from the operator addressed to
+     * this node. Records the caller on `request.runCaller`.
+     */
+    const requireRunAuthorization = async (request, reply) => {
+        const authorizationHeader = request.headers['authorization'];
+        if (!authorizationHeader) {
+            return reply.status(401).send({ error: 'Authorization header is required' });
+        }
+        const token = authorizationHeader.split(' ')[1];
+        const expectedApiKey = options.service.config.apiKey;
+        if (token && expectedApiKey && secretsEqual(token, expectedApiKey)) {
+            request.runCaller = { kind: 'apiKey' };
+            return;
+        }
+        const verifier = options.service.runTokenVerifier;
+        if (token && verifier && looksLikeJwt(token)) {
+            const claims = await verifier.verify(token);
+            if (!claims) {
+                return reply.status(401).send({ error: 'Invalid run token' });
+            }
+            request.runCaller = { kind: 'client', token, ...claims };
+            return;
+        }
+        return reply.status(401).send({ error: 'Invalid API Key' });
+    };
     // Start Meta Routes
     fastify.get('/', async (request, reply) => {
         return {
@@ -286,8 +294,14 @@ const routes = async (fastify, options) => {
     });
     // End Meta Routes
     // Start Run Routes
+    /**
+     * Runs a request script. A run token from another organization's API client is billed: the operator
+     * holds the run's cost first, the script's paid calls draw on that hold, and afterwards the run is
+     * charged for the tokens the script executed at this node's listed price. Runs by the API key holder or
+     * by this node's own organization are free, and their paid calls are paid by this node's organization.
+     */
     // Authenticate before body validation, so unauthenticated callers learn nothing about the schema.
-    fastify.post('/run', { schema: { body: runRequestSchema }, preValidation: requireApiKey }, async (request, reply) => {
+    fastify.post('/run', { schema: { body: runRequestSchema }, preValidation: requireRunAuthorization }, async (request, reply) => {
         const runRequest = request.body;
         let script;
         try {
@@ -300,16 +314,52 @@ const routes = async (fastify, options) => {
         if (script.declaration.kind !== 'request') {
             return reply.status(400).send({ error: 'Invalid script' });
         }
+        const caller = request.runCaller;
+        const billed = caller.kind === 'client' && caller.organizationId !== options.service.config.organizationId;
+        const runId = billed ? randomUUID() : undefined;
+        let resourceInvoker = options.service.resourceInvoker;
+        if (billed) {
+            const authorization = await options.service.operatorClient.authorizeRun({ token: caller.token, runId: runId, source: runRequest.source });
+            if (!authorization.ok) {
+                return reply.status(authorization.status).send({ error: authorization.error });
+            }
+            resourceInvoker = options.service.resourceInvoker.forRun({ runId: runId });
+        }
+        // Nothing waits on settlement, so it doesn't delay the response.
+        const settle = (outcome, tokens) => runId && setTimeout(async () => {
+            try {
+                if (outcome === 'capture') {
+                    await options.service.operatorClient.captureRun({ runId, tokens });
+                }
+                else {
+                    await options.service.operatorClient.releaseRun({ runId });
+                }
+            }
+            catch (error) {
+                fastify.log.error(error, `Failed to ${outcome} run ${runId}`);
+            }
+        }, 0);
+        const meter = new TokenMeter();
         try {
             const result = await interpretParsed(script, {
                 resourceResolver: options.service.resourceResolver,
-                resourceInvoker: options.service.resourceInvoker
+                resourceInvoker,
+                meter,
+                // The run token's claims, or null for an API-key run, so the name is always reserved.
+                builtins: { jwt: caller.kind === 'client' ? caller.payload : null },
             });
-            reply.status(200).send({ returnValue: result.returnValue ?? null });
+            settle('capture', meter.tokens);
+            return reply.status(200).send({ returnValue: result.returnValue ?? null, usage: { tokens: meter.tokens } });
         }
         catch (error) {
+            // A script that fails at runtime is the caller's mistake, and is charged for what it executed.
+            if (error instanceof RequestScriptError) {
+                settle('capture', meter.tokens);
+                return reply.status(422).send({ error: 'Script failed', details: error.message, usage: { tokens: meter.tokens } });
+            }
+            settle('release', meter.tokens);
             fastify.log.error(error);
-            reply.status(500).send({ error: 'Internal server error' });
+            return reply.status(500).send({ error: 'Internal server error' });
         }
     });
     /**
@@ -375,7 +425,7 @@ const routes = async (fastify, options) => {
         if (maxTokens === undefined) {
             return reply.status(400).send({ error: 'maxTokens must be a positive int32' });
         }
-        const inputTokens = await estimateInputTokens(resourceFunction, resourceRequest);
+        const inputTokens = await estimateInputTokens(resourceFunction, resourceRequest.parameters);
         if (inputTokens === undefined) {
             return reply.status(500).send({ error: 'Failed to estimate input tokens' });
         }
@@ -406,7 +456,7 @@ const routes = async (fastify, options) => {
             }
             // Re-estimated here, so inference never runs on a voucher that can't cover the expected cost.
             if (isInferenceVoucher(paymentVoucher)) {
-                const inputTokens = await estimateInputTokens(resourceFunction, resourceRequest);
+                const inputTokens = await estimateInputTokens(resourceFunction, resourceRequest.parameters);
                 if (inputTokens === undefined) {
                     return reply.status(500).send({ error: 'Failed to estimate input tokens' });
                 }
@@ -416,44 +466,14 @@ const routes = async (fastify, options) => {
                 }
             }
         }
-        // Hold the call's price on the payer's balance before running it, so a paid function never runs unpaid.
-        const paid = paymentManifest && paymentVoucher ? paymentVoucher : undefined;
-        if (paid) {
-            const authorization = await options.service.operatorClient.authorize(paid);
-            if (!authorization.ok) {
-                return reply.status(authorization.status).send({ error: authorization.error });
-            }
+        const invoke = () => options.service.resourceInvoker.invoke(resource, resourceRequest.functionName, resourceRequest.parameters);
+        // A free function ignores any voucher sent with it.
+        if (!paymentManifest || !paymentVoucher) {
+            return invoke();
         }
-        const result = await options.service.resourceInvoker.invoke(resource, resourceRequest.functionName, resourceRequest.parameters);
-        if (paid) {
-            let capture;
-            if (!result.error && !isInferenceVoucher(paid)) {
-                capture = { voucher: paid };
-            }
-            else if (!result.error && result.usage && isInferenceVoucher(paid)) {
-                // The function may report more output than it was allowed; the caller only signed for maxTokens.
-                const usage = { inputTokens: result.usage.inputTokens, outputTokens: Math.min(result.usage.outputTokens, paid.maxTokens) };
-                result.usage = usage;
-                // A free call has nothing to charge, so its hold is released instead.
-                if (cappedInferenceCharge(paid, usage) > 0) {
-                    capture = { voucher: paid, usage };
-                }
-            }
-            // A failed or free call releases its hold. Nothing awaits this, so it doesn't delay the response,
-            // and an uncaught error here would be an unhandled rejection.
-            setTimeout(async () => {
-                try {
-                    if (capture) {
-                        await options.service.operatorClient.capture(capture);
-                    }
-                    else {
-                        await options.service.operatorClient.release(paid);
-                    }
-                }
-                catch (error) {
-                    fastify.log.error(error, capture ? 'Failed to capture payment' : 'Failed to release payment');
-                }
-            }, 0);
+        const result = await settlePaidCall(options.service.operatorClient, paymentVoucher, invoke, (error, message) => fastify.log.error(error, message));
+        if ('refused' in result) {
+            return reply.status(result.refused.status).send({ error: result.refused.error });
         }
         return result;
     });

package/dist/server.d.ts

@@ -20,7 +20,7 @@ export interface StellariumNodeOptions {
     publicKey?: string;
     /** Defaults to `SIGNING_PRIVATE_KEY`. */
     privateKey?: string;
-    /** Bearer token for `POST /v1/run`. Defaults to `API_KEY`. */
+    /** Bearer token for `POST /v1/run` and the admin routes. Defaults to `API_KEY`. */
     apiKey?: string;
     /** Defaults to `OPERATOR_URL`. */
     operatorUrl?: string;

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,eAAe,CAAC;AACvB,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAE1C,OAAO,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAErE,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAe,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAiB,KAAK,UAAU,EAAgB,MAAM,cAAc,CAAC;AAI5E,eAAO,MAAM,4BAA4B,QAAS,CAAC;AACnD,eAAO,MAAM,iCAAiC,QAAgB,CAAC;AAE/D,MAAM,WAAW,qBAAqB;IAClC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,0FAA0F;IAC1F,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,gEAAgE;IAChE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wCAAwC;IACxC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yCAAyC;IACzC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kCAAkC;IAClC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,wGAAwG;IACxG,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,+EAA+E;IAC/E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;IACnB,yFAAyF;IACzF,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC;;;OAGG;IACH,YAAY,CAAC,EAAE,YAAY,CAAC;CAC/B;AAaD,wBAAgB,aAAa,CAAC,OAAO,EAAE,qBAAqB,EAAE,SAAS,GAAE,kBAAkB,EAAO,GAAG,UAAU,CAwB9G;AAED,qBAAa,cAAc;IACvB,OAAO,CAAC,SAAS,CAA4B;IAC7C,OAAO,CAAC,OAAO,CAAC,CAAU;IAEpB,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAE1D;IAED;;;OAGG;IACG,KAAK,CAAC,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CA+DnF;IAED,8FAA8F;IACxF,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,CAEtG;IAED;;;OAGG;IACG,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,CAEvI;IAED,wFAAwF;IAClF,YAAY,CAAC,eAAe,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,CAE3H;IAED,mDAAmD;IAC7C,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAE5C;IAED;;;OAGG;IACG,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAEzD;IAED,4FAA4F;IACtF,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEnE;IAED,yCAAyC;IACnC,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAEvD;IAED,OAAO,CAAC,OAAO;CAMlB"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,eAAe,CAAC;AACvB,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAE1C,OAAO,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAErE,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAe,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAiB,KAAK,UAAU,EAAgB,MAAM,cAAc,CAAC;AAI5E,eAAO,MAAM,4BAA4B,QAAS,CAAC;AACnD,eAAO,MAAM,iCAAiC,QAAgB,CAAC;AAE/D,MAAM,WAAW,qBAAqB;IAClC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,0FAA0F;IAC1F,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,gEAAgE;IAChE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wCAAwC;IACxC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yCAAyC;IACzC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mFAAmF;IACnF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kCAAkC;IAClC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,wGAAwG;IACxG,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,+EAA+E;IAC/E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;IACnB,yFAAyF;IACzF,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC;;;OAGG;IACH,YAAY,CAAC,EAAE,YAAY,CAAC;CAC/B;AAaD,wBAAgB,aAAa,CAAC,OAAO,EAAE,qBAAqB,EAAE,SAAS,GAAE,kBAAkB,EAAO,GAAG,UAAU,CAwB9G;AAED,qBAAa,cAAc;IACvB,OAAO,CAAC,SAAS,CAA4B;IAC7C,OAAO,CAAC,OAAO,CAAC,CAAU;IAEpB,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAE1D;IAED;;;OAGG;IACG,KAAK,CAAC,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CA0EnF;IAED,8FAA8F;IACxF,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,CAEtG;IAED;;;OAGG;IACG,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,CAEvI;IAED,wFAAwF;IAClF,YAAY,CAAC,eAAe,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,CAE3H;IAED,mDAAmD;IAC7C,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAE5C;IAED;;;OAGG;IACG,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAEzD;IAED,4FAA4F;IACtF,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEnE;IAED,yCAAyC;IACnC,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAEvD;IAED,OAAO,CAAC,OAAO;CAMlB"}

package/dist/server.js

@@ -56,15 +56,27 @@ export class StellariumNode {
         const enrollmentToken = options.enrollmentToken ?? process.env.ENROLLMENT_TOKEN;
         // Paid functions are paid to the node's organization, so a provider must be enrolled before it serves them.
         // A node that only calls paid functions enrolls the same way, so its vouchers draw on its organization's balance.
+        // Any other node with an operator still reports its URL, for listing, and learns its organization, so its
+        // own organization's run tokens run free.
+        const session = () => new OperatorClient(config.operatorUrl, config.publicKey, config.privateKey).session(enrollmentToken, config.baseUrl);
         if (hostsPaidFunctions(this.resources) || enrollmentToken) {
             try {
-                ({ organizationId: config.organizationId } = await new OperatorClient(config.operatorUrl, config.publicKey, config.privateKey).session(enrollmentToken));
+                ({ organizationId: config.organizationId } = await session());
             }
             catch (error) {
                 const hint = enrollmentToken ? '' : '. Create an enrollment token for it at https://platform.stellarium.sh and set ENROLLMENT_TOKEN';
                 throw new Error(`${error instanceof Error ? error.message : String(error)}${hint}`, { cause: error });
             }
         }
+        else if (config.operatorUrl) {
+            // Serving doesn't depend on it, so it doesn't hold up the start. Until it answers, run tokens from
+            // this node's own organization are refused as if billed.
+            session().then(({ organizationId }) => {
+                config.organizationId = organizationId;
+            }, (error) => {
+                fastify.log.warn(`No session with the operator, so this node can't be listed: ${error instanceof Error ? error.message : String(error)}`);
+            });
+        }
         const db = await openDatabase(options.databasePath ?? DEFAULT_DATABASE_PATH);
         fastify.addHook('onClose', async () => db.close());
         const service = createService(db, this.resources, config, { approveGrant: options.approveGrant });

package/dist/service.d.ts

@@ -1,8 +1,11 @@
-import { ResourceInvoker, ResourceResolver } from "requestscript";
+import type { JWTVerifyGetKey } from "jose";
+import { ResourceResolver } from "requestscript";
 import type { Database } from "sqlite";
 import { PeerRepository } from "./peer/repository.js";
 import { ResourceRepository, type StellariumResource } from "./resource/repository.js";
+import { CombinationResourceInvoker } from "./resource/invoker.js";
 import { OperatorClient } from "./client/operatorClient.js";
+import { RunTokenVerifier } from "./client/runTokens.js";
 import { type ApproveGrant, GrantService } from "./grant/service.js";
 /** Settings a node runs with. `StellariumNode.start` fills these from its options, then the environment. */
 export interface NodeConfig {
@@ -12,9 +15,9 @@ export interface NodeConfig {
     publicKey: string;
     /** Ed25519 PKCS#8 DER, base64url. */
     privateKey: string;
-    /** Bearer token for `POST /v1/run`. When unset, `/v1/run` rejects every request. */
+    /** Bearer token for `POST /v1/run` and the admin routes. When unset, only run tokens are accepted, and the admin routes reject every request. */
     apiKey?: string;
-    /** Operator base URL, including `/v1`. Required when the node hosts paid functions. */
+    /** Operator base URL, including `/v1`. Required when the node hosts paid functions, and to accept run tokens. */
     operatorUrl?: string;
     /**
      * The operator organization this node is enrolled in, which is paid for its functions.
@@ -31,13 +34,17 @@ export interface Service {
     peerRepository: PeerRepository;
     resourceRepository: ResourceRepository;
     resourceResolver: ResourceResolver;
-    resourceInvoker: ResourceInvoker;
+    resourceInvoker: CombinationResourceInvoker;
     operatorClient: OperatorClient;
     grantService: GrantService;
+    /** Verifies the run tokens `POST /v1/run` accepts. Set when the node has an operator URL. */
+    runTokenVerifier?: RunTokenVerifier;
 }
 export interface ServiceOptions {
     /** Decides `POST /v1/grants/request`. Without it, every request is refused. */
     approveGrant?: ApproveGrant;
+    /** Replaces the operator's published keys for verifying run tokens, in tests. */
+    runTokenKeys?: JWTVerifyGetKey;
 }
 export declare function createService(db: Database, resources: StellariumResource[], config: NodeConfig, options?: ServiceOptions): Service;
 //# sourceMappingURL=service.d.ts.map

package/dist/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAClE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,OAAO,EAAE,kBAAkB,EAAE,KAAK,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAEvF,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE5D,OAAO,EAAE,KAAK,YAAY,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAErE,4GAA4G;AAC5G,MAAM,WAAW,UAAU;IACvB,4DAA4D;IAC5D,OAAO,EAAE,MAAM,CAAC;IAChB,mCAAmC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,qCAAqC;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,oFAAoF;IACpF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,uFAAuF;IACvF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,mDAAmD;IACnD,iBAAiB,EAAE,MAAM,CAAC;IAC1B,iEAAiE;IACjE,0BAA0B,EAAE,MAAM,CAAC;CACtC;AAED,MAAM,WAAW,OAAO;IACpB,MAAM,EAAE,UAAU,CAAC;IACnB,cAAc,EAAE,cAAc,CAAC;IAC/B,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,eAAe,EAAE,eAAe,CAAC;IACjC,cAAc,EAAE,cAAc,CAAC;IAC/B,YAAY,EAAE,YAAY,CAAC;CAC9B;AAED,MAAM,WAAW,cAAc;IAC3B,+EAA+E;IAC/E,YAAY,CAAC,EAAE,YAAY,CAAC;CAC/B;AAED,wBAAgB,aAAa,CAAC,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,GAAE,cAAmB,GAAG,OAAO,CAoBtI"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,MAAM,CAAC;AAC5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,OAAO,EAAE,kBAAkB,EAAE,KAAK,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAEzD,OAAO,EAAE,KAAK,YAAY,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAErE,4GAA4G;AAC5G,MAAM,WAAW,UAAU;IACvB,4DAA4D;IAC5D,OAAO,EAAE,MAAM,CAAC;IAChB,mCAAmC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,qCAAqC;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,iJAAiJ;IACjJ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iHAAiH;IACjH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,mDAAmD;IACnD,iBAAiB,EAAE,MAAM,CAAC;IAC1B,iEAAiE;IACjE,0BAA0B,EAAE,MAAM,CAAC;CACtC;AAED,MAAM,WAAW,OAAO;IACpB,MAAM,EAAE,UAAU,CAAC;IACnB,cAAc,EAAE,cAAc,CAAC;IAC/B,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,eAAe,EAAE,0BAA0B,CAAC;IAC5C,cAAc,EAAE,cAAc,CAAC;IAC/B,YAAY,EAAE,YAAY,CAAC;IAC3B,6FAA6F;IAC7F,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;CACvC;AAED,MAAM,WAAW,cAAc;IAC3B,+EAA+E;IAC/E,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,iFAAiF;IACjF,YAAY,CAAC,EAAE,eAAe,CAAC;CAClC;AAED,wBAAgB,aAAa,CAAC,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,GAAE,cAAmB,GAAG,OAAO,CAwBtI"}

package/dist/service.js

@@ -3,14 +3,18 @@ import { CombinationResourceResolver } from "./resource/resolver.js";
 import { ResourceRepository } from "./resource/repository.js";
 import { CombinationResourceInvoker } from "./resource/invoker.js";
 import { OperatorClient } from "./client/operatorClient.js";
+import { RunTokenVerifier } from "./client/runTokens.js";
 import { GrantRepository } from "./grant/repository.js";
 import { GrantService } from "./grant/service.js";
 export function createService(db, resources, config, options = {}) {
     const resourceRepository = new ResourceRepository(db, resources, config.baseUrl, config.organizationId);
     const resourceResolver = new CombinationResourceResolver(resourceRepository);
     const grantService = new GrantService(new GrantRepository(db), config, options.approveGrant);
-    const resourceInvoker = new CombinationResourceInvoker(resourceRepository, config.costLimitMicroUsd, config.publicKey, config.privateKey, grantService, config.inferenceCostLimitMicroUsd);
     const operatorClient = new OperatorClient(config.operatorUrl, config.publicKey, config.privateKey);
+    const resourceInvoker = new CombinationResourceInvoker(resourceRepository, config.costLimitMicroUsd, config.publicKey, config.privateKey, grantService, config.inferenceCostLimitMicroUsd, {
+        operatorClient,
+        organizationId: config.organizationId,
+    });
     return {
         config,
         peerRepository: new PeerRepository(db),
@@ -19,5 +23,6 @@ export function createService(db, resources, config, options = {}) {
         resourceInvoker,
         operatorClient,
         grantService,
+        runTokenVerifier: config.operatorUrl ? new RunTokenVerifier(config.operatorUrl, config.publicKey, options.runTokenKeys) : undefined,
     };
 }

package/dist/tests/integration/network.test.js

@@ -141,7 +141,7 @@ describe("two-node network", { timeout: 15_000 }, () => {
             baseUrl: providerUrl,
             functions: expect.arrayContaining([expect.objectContaining({ name: "temperature", paymentManifest: { costMicroUsd: COST, recipientOrganizationId: ORGANIZATION } })]),
         }));
-        expect(await run(caller.url)).toEqual({ returnValue: { value: 12, error: null } });
+        expect(await run(caller.url)).toEqual({ usage: { tokens: expect.any(Number) }, returnValue: { value: 12, error: null } });
         await vi.waitFor(() => expect(settlements).toHaveLength(1));
         const [voucher] = settlements;
         expect(authorizations).toEqual([{ voucher }]);
@@ -152,7 +152,7 @@ describe("two-node network", { timeout: 15_000 }, () => {
         const first = await startCaller();
         await first.fastify.close();
         const second = await startCaller();
-        expect(await run(second.url)).toEqual({ returnValue: { value: 12, error: null } });
+        expect(await run(second.url)).toEqual({ usage: { tokens: expect.any(Number) }, returnValue: { value: 12, error: null } });
     });
     describe("restricted functions", () => {
         test("the caller needs a grant from the provider, then calls with it", async () => {
@@ -160,13 +160,13 @@ describe("two-node network", { timeout: 15_000 }, () => {
             const refused = await run(caller.url, vaultSource);
             expect(refused.returnValue.error.message).toContain(`requires a grant from ${providerUrl}`);
             await caller.node.addGrant(await provider.issueGrant(callerKeys.publicKey, [vault], { lifetimeMs: HOUR }));
-            expect(await run(caller.url, vaultSource)).toEqual({ returnValue: { value: 7, error: null } });
+            expect(await run(caller.url, vaultSource)).toEqual({ usage: { tokens: expect.any(Number) }, returnValue: { value: 7, error: null } });
         });
         test("the caller asks the provider for a grant, then calls with it", async () => {
             const caller = await startCaller();
             await expect(caller.node.requestGrant(providerUrl, [vault], { invite: "wrong" })).rejects.toThrow("Grant request refused");
             await caller.node.requestGrant(providerUrl, [vault], { invite: "letmein" });
-            expect(await run(caller.url, vaultSource)).toEqual({ returnValue: { value: 7, error: null } });
+            expect(await run(caller.url, vaultSource)).toEqual({ usage: { tokens: expect.any(Number) }, returnValue: { value: 7, error: null } });
         });
         test("the provider's admin blocks a caller over HTTP, then unblocks it", async () => {
             const caller = await startCaller();
@@ -182,12 +182,12 @@ describe("two-node network", { timeout: 15_000 }, () => {
             expect(refused.returnValue.error.message).toContain("Invalid authorization");
             await expect(caller.node.requestGrant(providerUrl, [vault], { invite: "letmein" })).rejects.toThrow("refused");
             expect((await adminRequest("DELETE")).status).toBe(200);
-            expect(await run(caller.url, vaultSource)).toEqual({ returnValue: { value: 7, error: null } });
+            expect(await run(caller.url, vaultSource)).toEqual({ usage: { tokens: expect.any(Number) }, returnValue: { value: 7, error: null } });
         });
         test("grants passed at start are loaded, and revocation at the provider cuts them off", async () => {
             const chain = await provider.issueGrant(callerKeys.publicKey, [vault], { lifetimeMs: HOUR });
             const caller = await startCaller({ grants: [chain] });
-            expect(await run(caller.url, vaultSource)).toEqual({ returnValue: { value: 7, error: null } });
+            expect(await run(caller.url, vaultSource)).toEqual({ usage: { tokens: expect.any(Number) }, returnValue: { value: 7, error: null } });
             await provider.revokeGrant(chain[0].id);
             const refused = await run(caller.url, vaultSource);
             expect(refused.returnValue.error.message).toContain("Invalid authorization");
@@ -199,7 +199,7 @@ describe("two-node network", { timeout: 15_000 }, () => {
             const userKeys = generateBase64KeyPair();
             const user = await startCaller({ ...userKeys, databasePath: path.join(dir, "user.db") });
             await user.node.addGrant(await caller.node.delegateGrant(root.id, userKeys.publicKey, [vault], { lifetimeMs: HOUR }));
-            expect(await run(user.url, vaultSource)).toEqual({ returnValue: { value: 7, error: null } });
+            expect(await run(user.url, vaultSource)).toEqual({ usage: { tokens: expect.any(Number) }, returnValue: { value: 7, error: null } });
         });
         test("the refresher renews a grant past half its lifetime", async () => {
             const fetchSpy = vi.spyOn(globalThis, "fetch");
@@ -209,7 +209,7 @@ describe("two-node network", { timeout: 15_000 }, () => {
             fetchSpy.mockRestore();
             // Well past the first copy's expiry, the renewed one still works.
             await new Promise((resolve) => setTimeout(resolve, 500));
-            expect(await run(caller.url, vaultSource)).toEqual({ returnValue: { value: 7, error: null } });
+            expect(await run(caller.url, vaultSource)).toEqual({ usage: { tokens: expect.any(Number) }, returnValue: { value: 7, error: null } });
         });
     });
     test("the caller refuses a call that costs more than its limit", async () => {
@@ -220,13 +220,17 @@ describe("two-node network", { timeout: 15_000 }, () => {
         expect(settlements).toEqual([]);
         expect(authorizations).toEqual([]);
     });
-    test("a caller with an enrollment token enrolls at startup; one without doesn't contact the operator", async () => {
+    test("a caller with an enrollment token enrolls at startup; one without still reports its URL", async () => {
         sessions.length = 0;
-        await startCaller({ operatorUrl, enrollmentToken: "enr_caller" });
-        expect(sessions).toEqual([{ enrollmentToken: "enr_caller" }]);
+        const enrolled = await startCaller({ operatorUrl, enrollmentToken: "enr_caller" });
+        expect(sessions).toEqual([{ enrollmentToken: "enr_caller", baseUrl: enrolled.url }]);
         sessions.length = 0;
-        await startCaller({ operatorUrl, databasePath: path.join(dir, "caller-2.db") });
-        expect(sessions).toEqual([]);
+        const other = await startCaller({ operatorUrl, databasePath: path.join(dir, "caller-2.db") });
+        await vi.waitFor(() => expect(sessions).toEqual([{ baseUrl: other.url }]));
+    });
+    test("a node without paid functions or a token starts without waiting for an unreachable operator", async () => {
+        const caller = await startCaller({ operatorUrl: "http://127.0.0.1:1/v1", databasePath: path.join(dir, "caller-3.db") });
+        expect(await run(caller.url)).toMatchObject({ returnValue: { value: 12, error: null } });
     });
     test("the provider refuses to run a call the operator won't hold, and the caller sees why", async () => {
         const caller = await startCaller();
@@ -242,7 +246,7 @@ describe("two-node network", { timeout: 15_000 }, () => {
         test("the caller prices a call with the provider's estimate, pays for it, and the provider settles its usage", async () => {
             const caller = await startCaller();
             const result = await run(caller.url, completeSource);
-            expect(result).toEqual({ returnValue: { value: "echo: Hello world!", error: null } });
+            expect(result).toEqual({ usage: { tokens: expect.any(Number) }, returnValue: { value: "echo: Hello world!", error: null } });
             await vi.waitFor(() => expect(submissions).toHaveLength(1));
             // 3 input tokens at $3/M plus 10 output tokens at $15/M, rounded up.
             expect(submissions[0]).toMatchObject({

package/dist/tests/resource/invoker.test.js

@@ -23,6 +23,18 @@ describe("payment voucher", () => {
         expect(verifyData(paymentVoucherPayload(voucher), voucher.publicKey, voucher.signature)).toBe(true);
         expect(verifyData(voucher, voucher.publicKey, voucher.signature)).toBe(false);
     });
+    test("signs a run id last, and only when the voucher has one", () => {
+        const { publicKey, privateKey } = generateBase64KeyPair();
+        const invoker = new CombinationResourceInvoker({}, 100_000, publicKey, privateKey);
+        const parameters = [{ name: "city", value: "Oslo" }];
+        const plain = invoker.createPaymentVoucher("org_provider", 10000, "com.example", "Weather", "forecast", parameters);
+        const forRun = invoker.createPaymentVoucher("org_provider", 10000, "com.example", "Weather", "forecast", parameters, "run-1");
+        // Vouchers without a run sign the same bytes as before run ids existed.
+        expect(Object.keys(paymentVoucherPayload(plain))).toEqual(["requestId", "invocationId", "amount", "recipientOrganizationId", "expiresAt", "invocationHash", "publicKey"]);
+        expect(Object.keys(paymentVoucherPayload(forRun)).at(-1)).toBe("runId");
+        expect(verifyData(paymentVoucherPayload(forRun), publicKey, forRun.signature)).toBe(true);
+        expect(verifyData(paymentVoucherPayload({ ...forRun, runId: "run-2" }), publicKey, forRun.signature)).toBe(false);
+    });
     test("invocationHash changes with the function name or parameters", () => {
         const parameters = [{ name: "city", value: "Oslo" }];
         const hash = invocationHash("com.example", "Weather", "forecast", parameters);
@@ -104,6 +116,13 @@ describe("external invoke retries", () => {
         expect(JSON.parse(bodies[0]).paymentVoucher.requestId).toBeDefined();
         expect(JSON.parse(bodies[0]).paymentVoucher.invocationHash).toBe(invocationHash("com.example", "Weather", "forecast", parameters));
     });
+    test("a billed run's calls carry its run id, and its hold replaces the cost limit", async () => {
+        fetchMock.mockResolvedValueOnce(ok());
+        const invoker = createInvoker({ costMicroUsd: 500_000, recipientOrganizationId: "org_provider" });
+        await invoker.forRun({ runId: "run-1" }).invoke(resource, "forecast", parameters);
+        expect(JSON.parse(fetchMock.mock.calls[0][1].body).paymentVoucher).toMatchObject({ amount: 500_000, runId: "run-1" });
+        await expect(invoker.invoke(resource, "forecast", parameters)).rejects.toThrow("exceeds the cost limit");
+    });
     test("refuses a paid function whose manifest names no recipient organization, without signing a voucher", async () => {
         const result = await createInvoker({ costMicroUsd: 10000 }).invoke(resource, "forecast", parameters);
         expect(fetchMock).not.toHaveBeenCalled();