feat(mcp): supply a rotating signer credential to the gateway

lib/mcp/gateway.ts

@@ -1,8 +1,7 @@
 import {
   createGateway,
-  SignerRefreshRequired,
   type InferenceRequest,
-  type InferenceResult
+  type InferenceResult,
 } from "@pymthouse/gateway-web";
 import { pymthouseSignerUrl } from "./env";
 import type { McpPrincipal } from "./jwt";
@@ -12,27 +11,24 @@ export async function runInference(
   principal: McpPrincipal,
   request: InferenceRequest
 ): Promise<InferenceResult> {
-  let session = await resolveSignerSession(principal);
+  const session = await resolveSignerSession(principal);
   const timeoutMs = request.timeoutMs ?? request.timeout ?? 120_000;
+  let seeded: typeof session | null = session;
 
-  const attempt = async (signerJwt: string) => {
-    const gw = createGateway({
-      signerUrl: session.signer_url || pymthouseSignerUrl(),
-      signerHeaders: { Authorization: `Bearer ${signerJwt}` },
-      discoveryUrl: session.discovery_url,
-      insecureTls: true,
-      timeoutMs
-    });
-    return gw.runInference(request);
-  };
-
-  try {
-    return await attempt(session.access_token);
-  } catch (err) {
-    if (err instanceof SignerRefreshRequired) {
-      session = await resolveSignerSession(principal);
-      return attempt(session.access_token);
-    }
-    throw err;
-  }
+  const gw = createGateway({
+    signerUrl: session.signer_url || pymthouseSignerUrl(),
+    discoveryUrl: session.discovery_url,
+    signerHeaders: async () => {
+      const next = seeded ?? (await resolveSignerSession(principal));
+      seeded = null;
+      return {
+        headers: { Authorization: `Bearer ${next.access_token}` },
+        expiresInSeconds: next.expires_in,
+      };
+    },
+    insecureTls: true,
+    timeoutMs,
+    attributionSource: "pymthouse_gateway",
+  });
+  return gw.runInference(request);
 }

lib/mcp/mcp-server.ts

@@ -206,13 +206,15 @@ export function buildRawMcpServer(principal: McpPrincipal): McpServer {
         return text(err instanceof Error ? err.message : String(err), true);
       }
 
+      const gatewayRequestId = newId("job");
       try {
         const result = await runInference(principal, {
           capability,
           params: (inputs as Record<string, unknown> | undefined) ?? {},
           prompt,
           endpoint,
           timeoutMs: 780_000,
+          gatewayRequestId,
         });
         const url = result.url ?? result.imageUrl ?? result.videoUrl ?? result.audioUrl;
         if (url) {
@@ -221,16 +223,26 @@ export function buildRawMcpServer(principal: McpPrincipal): McpServer {
             url,
             capability,
             createdAt: new Date().toISOString(),
+            gatewayRequestId: result.gatewayRequestId,
           });
         }
         return text({
           capability,
           url,
           orchestrator: result.orchestrator,
           elapsed_ms: result.elapsedMs,
+          gateway_request_id: result.gatewayRequestId,
         });
       } catch (err) {
-        return text(err instanceof Error ? err.message : String(err), true);
+        // A call can fail after tickets were already paid, so the id must be
+        // reported here too or that spend is unattributable.
+        return text(
+          {
+            error: err instanceof Error ? err.message : String(err),
+            gateway_request_id: gatewayRequestId,
+          },
+          true
+        );
       }
     },
   );

lib/mcp/store.ts

@@ -3,6 +3,8 @@ export type Asset = {
   url: string;
   capability: string;
   createdAt: string;
+  /** Joins this asset to its ticket rows in PymtHouse metering. */
+  gatewayRequestId: string;
 };
 
 const assets = new Map<string, Asset[]>();

package.json

@@ -16,7 +16,7 @@
     "@auth0/nextjs-auth0": "^4.27.0",
     "@modelcontextprotocol/sdk": "^1.30.0",
     "@pymthouse/builder-sdk": "^0.6.5",
-    "@pymthouse/gateway-web": "^0.2.0",
+    "@pymthouse/gateway-web": "^0.4.0",
     "framer-motion": "^11.15.0",
     "geist": "^1.7.0",
     "jose": "^6.2.10",