tapimo 0.10.2 → 0.12.0

package/src/db/tables/webhookSubscriptions.ts

@@ -1,6 +1,7 @@
 import type { ExpressionBuilder, Selectable } from 'kysely'
 import { sql } from 'kysely'
 
+import * as Scope from '../../Scope.js'
 import type * as Webhooks from '../../internal/Webhooks.js'
 import type * as Db from '../Db.js'
 import type * as db_Schema from '../Schema.js'
@@ -40,6 +41,7 @@ export function toSubscription(row: Record): Webhooks.Subscription {
     ...(row.context === null ? {} : { context: row.context }),
     createdAt: row.createdAt,
     destination: row.destination,
+    ...(row.environment === null ? {} : { environment: row.environment }),
     eventType: row.eventType,
     ...(row.expiresAt === null ? {} : { expiresAt: row.expiresAt }),
     failureCount: row.failureCount,
@@ -50,6 +52,7 @@ export function toSubscription(row: Record): Webhooks.Subscription {
       row.ownerType === 'api_key'
         ? { orgId: row.ownerId, type: 'api_key' }
         : { payer: row.ownerId, type: 'mpp' },
+    ...(row.projectId === null ? {} : { projectId: row.projectId }),
     secret: row.secret,
     status: row.status,
     updatedAt: row.updatedAt,
@@ -75,6 +78,7 @@ export async function insert(
       context: subscription.context ?? null,
       createdAt: subscription.createdAt,
       destination: subscription.destination,
+      environment: subscription.environment ?? null,
       eventType: subscription.eventType,
       expiresAt: subscription.expiresAt ?? null,
       failureCount: subscription.failureCount,
@@ -84,6 +88,7 @@ export async function insert(
       ownerId: ownerId(subscription.owner),
       ownerType: subscription.owner.type,
       pollerCursor: options.pollerCursor ?? null,
+      projectId: subscription.projectId ?? null,
       secret: subscription.secret,
       status: subscription.status,
       updatedAt: subscription.updatedAt,
@@ -94,7 +99,7 @@ export async function insert(
 export declare namespace insert {
   /** Options for {@link insert}. */
   type Options = {
-    /** Initial poller cursor committed with the subscription. */
+    /** Initial cursor committed with the subscription. */
     pollerCursor?: string | undefined
   }
 }
@@ -129,7 +134,7 @@ export declare namespace insertWithinLimit {
     maxPerOwner: number
     /** ISO timestamp used to exclude expired rows from the count. */
     now: string
-    /** Initial poller cursor committed with the subscription. */
+    /** Initial cursor committed with the subscription. */
     pollerCursor?: string | undefined
   }
 }
@@ -149,15 +154,17 @@ export async function get(
   owner: Webhooks.Owner,
   id: string,
   now: string,
+  access?: Webhooks.Access,
 ): Promise<Webhooks.Subscription | null> {
-  const row = await db.kysely
+  let query = db.kysely
     .selectFrom('webhook_subscriptions')
     .selectAll()
     .where('id', '=', id)
     .where('ownerType', '=', owner.type)
     .where('ownerId', '=', ownerId(owner))
     .where(live(now))
-    .executeTakeFirst()
+  if (access) query = query.where(privateResourceAccess(access))
+  const row = await query.executeTakeFirst()
   return row ? toSubscription(row) : null
 }
 
@@ -183,6 +190,7 @@ export async function list(
     .where('ownerId', '=', ownerId(owner))
     .where(live(options.now))
     .orderBy('id', 'desc')
+  if (options.access) query = query.where(privateResourceAccess(options.access))
   if (options.cursor) query = query.where('id', '<', options.cursor)
   if (options.offset) query = query.offset(options.offset)
   if (options.limit !== undefined) query = query.limit(options.limit)
@@ -192,6 +200,8 @@ export async function list(
 export declare namespace list {
   /** Options for {@link list}. */
   type Options = {
+    /** Private-resource visibility scope. */
+    access?: Webhooks.Access | undefined
     /** Return subscriptions older than this id (keyset paging, newest first). */
     cursor?: string | undefined
     /** Maximum subscriptions to return. */
@@ -211,14 +221,20 @@ export declare namespace list {
  * @param now - ISO timestamp expiry is evaluated against.
  * @returns The count.
  */
-export async function count(db: Db.Db, owner: Webhooks.Owner, now: string): Promise<number> {
-  const row = await db.kysely
+export async function count(
+  db: Db.Db,
+  owner: Webhooks.Owner,
+  now: string,
+  access?: Webhooks.Access,
+): Promise<number> {
+  let query = db.kysely
     .selectFrom('webhook_subscriptions')
     .select((eb) => eb.fn.countAll().as('count'))
     .where('ownerType', '=', owner.type)
     .where('ownerId', '=', ownerId(owner))
     .where(live(now))
-    .executeTakeFirstOrThrow()
+  if (access) query = query.where(privateResourceAccess(access))
+  const row = await query.executeTakeFirstOrThrow()
   return Number(row.count)
 }
 
@@ -275,21 +291,42 @@ export async function remove(
   owner: Webhooks.Owner,
   id: string,
   now: string,
+  access?: Webhooks.Access,
 ): Promise<boolean> {
-  const result = await db.kysely
+  let query = db.kysely
     .deleteFrom('webhook_subscriptions')
     .where('id', '=', id)
     .where('ownerType', '=', owner.type)
     .where('ownerId', '=', ownerId(owner))
     .where(live(now))
-    .executeTakeFirst()
+  if (access) query = query.where(privateResourceAccess(access))
+  const result = await query.executeTakeFirst()
   return result.numDeletedRows > 0n
 }
 
+function privateResourceAccess(access: Webhooks.Access) {
+  const fundingRead = access.scopes.some(
+    (scope) => scope === Scope.wildcard || scope === 'funding:read',
+  )
+  return (eb: ExpressionBuilder<Db.Database, 'webhook_subscriptions'>) =>
+    eb.or([
+      eb('eventType', '!=', 'funding:deposit.updated'),
+      ...(fundingRead
+        ? [
+            eb.and([
+              eb('eventType', '=', 'funding:deposit.updated'),
+              eb('environment', '=', access.environment),
+              ...(access.projectId === undefined ? [] : [eb('projectId', '=', access.projectId)]),
+            ]),
+          ]
+        : []),
+    ])
+}
+
 /**
- * Lists live `active` subscriptions for a `(chainId, eventType)` stream — the
- * poller's per-stream lookup, served by the partial status index. Each row
- * carries its poller cursor so the poller avoids a per-subscription read.
+ * Lists live `active` subscriptions for a `(chainId, eventType)` stream,
+ * served by the partial status index. Each row carries its cursor so callers
+ * avoid a per-subscription read.
  *
  * @param db - The database.
  * @param chainId - Chain the stream belongs to.
@@ -316,8 +353,8 @@ export async function listActive(
 }
 
 /**
- * Lists every live `active` subscription on a chain in one read. The poller
- * groups the rows by event type so empty streams cost no extra database reads.
+ * Lists every live `active` subscription on a chain in one read. Callers
+ * group the rows by event type so empty streams cost no extra database reads.
  *
  * @param db - The database.
  * @param options - Chain, configured event types, and expiry time.
@@ -342,43 +379,58 @@ export async function listActiveForChain(
 }
 
 export declare namespace listActiveForChain {
-  /** Filters for the poller's chain-level subscription read. */
+  /** Filters for the chain-level subscription read. */
   type Options = {
     /** Chain whose subscriptions to read. */
     chainId: number
-    /** Event types configured for this poller tick. */
+    /** Event types eligible for the read. */
     eventTypes: readonly Webhooks.EventType[]
     /** ISO timestamp expiry is evaluated against. */
     now: string
   }
 }
 
-/**
- * Reads the poller cursors of every live `active` subscription on a chain,
- * across event types. Feeds the cron's cursor-freshness fallback gate.
- *
- * @param db - The database.
- * @param chainId - Chain whose cursors to read.
- * @param now - ISO timestamp expiry is evaluated against.
- * @returns The non-null cursors, unordered.
- */
-export async function listActiveCursors(
+/** Lists live funding deposit subscriptions visible to one deposit owner. */
+export async function listActiveForFundingDeposit(
   db: Db.Db,
-  chainId: number,
-  now: string,
-): Promise<string[]> {
-  const rows = await db.kysely
+  options: listActiveForFundingDeposit.Options,
+): Promise<Webhooks.Subscription[]> {
+  let query = db.kysely
     .selectFrom('webhook_subscriptions')
-    .select('pollerCursor')
-    .where('chainId', '=', chainId)
+    .selectAll()
+    .where('chainId', '=', options.chainId)
+    .where('environment', '=', options.environment)
+    .where('eventType', '=', 'funding:deposit.updated')
+    .where('ownerId', '=', options.orgId)
+    .where('ownerType', '=', 'api_key')
     .where('status', '=', 'active')
-    .where(live(now))
-    .execute()
-  return rows.flatMap((row) => (row.pollerCursor === null ? [] : [row.pollerCursor]))
+    .where(live(options.now))
+  const projectId = options.projectId
+  query =
+    projectId === undefined
+      ? query.where('projectId', 'is', null)
+      : query.where((eb) => eb.or([eb('projectId', 'is', null), eb('projectId', '=', projectId)]))
+  return (await query.orderBy('id').execute()).map(toSubscription)
+}
+
+export declare namespace listActiveForFundingDeposit {
+  /** Ownership scope and chain for a funding deposit event. */
+  type Options = {
+    /** Destination Tempo chain id. */
+    chainId: number
+    /** Deposit API-key environment. */
+    environment: 'production' | 'sandbox'
+    /** ISO timestamp used to exclude expired subscriptions. */
+    now: string
+    /** Owning organization id. */
+    orgId: string
+    /** Attributed deposit project, when present. */
+    projectId?: string | undefined
+  }
 }
 
 /**
- * Reads a subscription's poller cursor.
+ * Reads a subscription's keyset cursor.
  *
  * @param db - The database.
  * @param id - The subscription id (`wh_…`).
@@ -393,140 +445,59 @@ export async function getCursor(db: Db.Db, id: string): Promise<string | null> {
   return row?.pollerCursor ?? null
 }
 
-/**
- * Writes a subscription's poller cursor. Deliberately does not touch
- * `updatedAt` — the cursor advances every tick and is not a user mutation.
- *
- * @param db - The database.
- * @param id - The subscription id (`wh_…`).
- * @param cursor - The keyset cursor to store.
- */
-export async function setCursor(db: Db.Db, id: string, cursor: string): Promise<void> {
-  await db.kysely
-    .updateTable('webhook_subscriptions')
-    .set({ pollerCursor: cursor })
-    .where('id', '=', id)
-    .execute()
-}
-
-/**
- * Writes a poller cursor only when the stored cursor still matches the caller's
- * observed value.
- *
- * @param db - The database.
- * @param options - Subscription, expected cursor, and next cursor.
- * @returns Whether the cursor was updated.
- */
-export async function compareAndSetCursor(
-  db: Db.Db,
-  options: compareAndSetCursor.Options,
-): Promise<boolean> {
-  let query = db.kysely
-    .updateTable('webhook_subscriptions')
-    .set({ pollerCursor: options.cursor })
-    .where('id', '=', options.subscriptionId)
-  query =
-    options.expectedCursor === null
-      ? query.where('pollerCursor', 'is', null)
-      : query.where('pollerCursor', '=', options.expectedCursor)
-  const result = await query.executeTakeFirst()
-  return result.numUpdatedRows > 0n
-}
-
-export declare namespace compareAndSetCursor {
-  /** Options for {@link compareAndSetCursor}. */
-  type Options = {
-    /** Next keyset cursor. */
-    cursor: string
-    /** Cursor observed before scanning, or null for an uninitialized subscription. */
-    expectedCursor: string | null
-    /** Subscription whose cursor advances. */
-    subscriptionId: string
-  }
-}
-
-/**
- * Writes multiple poller cursors when each stored value still matches the
- * caller's observed value.
- *
- * @param db - The database.
- * @param options - Candidate cursor writes.
- * @returns Subscription ids whose cursors were updated.
- */
-export async function compareAndSetCursors(
-  db: Db.Db,
-  options: compareAndSetCursors.Options,
-): Promise<Set<string>> {
-  if (options.cursors.length === 0) return new Set()
-  const values = JSON.stringify(options.cursors)
-  type Candidate = {
-    cursor: string
-    expectedCursor: string | null
-    subscriptionId: string
-  }
-  const result = await db.kysely
-    .with(
-      'candidates',
-      () => sql<Candidate>`(
-      SELECT
-        candidate."subscriptionId" AS subscription_id,
-        candidate."expectedCursor" AS expected_cursor,
-        candidate.cursor
-      FROM jsonb_to_recordset(${values}::jsonb)
-        AS candidate("subscriptionId" text, "expectedCursor" text, cursor text)
-    )`,
-    )
-    .updateTable('webhook_subscriptions as subscription')
-    .from('candidates as candidate')
-    .set((eb) => ({ pollerCursor: eb.ref('candidate.cursor') }))
-    .whereRef('subscription.id', '=', 'candidate.subscriptionId')
-    .whereRef('subscription.pollerCursor', 'is not distinct from', 'candidate.expectedCursor')
-    .returning('subscription.id as subscriptionId')
-    .execute()
-  return new Set(result.map((row) => row.subscriptionId))
-}
-
-export declare namespace compareAndSetCursors {
-  /** Options for {@link compareAndSetCursors}. */
-  type Options = {
-    /** Candidate cursor writes. */
-    cursors: readonly compareAndSetCursor.Options[]
-  }
-}
-
 /**
  * Records a successful delivery: resets the consecutive-failure counter and
- * stamps `lastDeliveryAt`.
+ * stamps `lastDeliveryAt`. Skipped when neither field would move, so
+ * deliveries stop contending on the row's lock.
  *
  * @param db - The database.
  * @param id - The subscription id (`wh_…`).
- * @param now - Delivery timestamp (ISO).
- * @returns The updated subscription, or `undefined` when the row is absent.
+ * @param options - Delivery timestamp and stamp-staleness bound.
+ * @returns The updated subscription, or `undefined` when nothing was written.
  */
 export async function recordSuccess(
   db: Db.Db,
   id: string,
-  now: string,
+  options: recordSuccess.Options,
 ): Promise<Webhooks.Subscription | undefined> {
+  const { now, staleBefore } = options
   const row = await db.kysely
     .updateTable('webhook_subscriptions')
     .set({ failureCount: 0, lastDeliveryAt: now, updatedAt: now })
     .where('id', '=', id)
+    .where((eb) =>
+      eb.or([
+        eb('failureCount', '>', 0),
+        eb('lastDeliveryAt', 'is', null),
+        eb('lastDeliveryAt', '<', staleBefore),
+      ]),
+    )
     .returningAll()
     .executeTakeFirst()
   return row ? toSubscription(row) : undefined
 }
 
+export declare namespace recordSuccess {
+  /** Clock bounds for one success record. */
+  type Options = {
+    /** Delivery timestamp (ISO). */
+    now: string
+    /** Rewrite the stamp only when it predates this (ISO). */
+    staleBefore: string
+  }
+}
+
 /**
  * Records a failed delivery: atomically increments the consecutive-failure
  * counter and disables the subscription once it reaches `maxFailures` (raw
  * fragments use storage column names — they bypass the camelCase mapping).
+ * Skipped once disabled at the cap, when nothing would move.
  *
  * @param db - The database.
  * @param id - The subscription id (`wh_…`).
  * @param maxFailures - Consecutive failures before auto-disabling.
  * @param now - Failure timestamp (ISO).
- * @returns The updated subscription, or `undefined` when the row is absent.
+ * @returns The updated subscription, or `undefined` when nothing was written.
  */
 export async function recordFailure(
   db: Db.Db,
@@ -542,24 +513,43 @@ export async function recordFailure(
       updatedAt: now,
     })
     .where('id', '=', id)
+    // In-flight failures race the disable and would queue on the row lock. A
+    // re-enabled subscription keeps its capped counter; the status arm lets
+    // its next failure re-disable it.
+    .where((eb) => eb.or([eb('failureCount', '<', maxFailures), eb('status', '!=', 'disabled')]))
     .returningAll()
     .executeTakeFirst()
   return row ? toSubscription(row) : undefined
 }
 
+// Smaller than the ledger-table bounds: each subscription delete cascades
+// into deliveries, queue events, and completions, fanning the statement out.
+const pruneBatchLimit = 1_000
+
 /**
  * Deletes expired subscriptions (their delivery rows cascade). Called
- * best-effort from the poller tick.
+ * best-effort on a schedule.
  *
  * @param db - The database.
  * @param now - ISO timestamp expiry is evaluated against.
  * @returns The number of rows deleted.
  */
 export async function pruneExpired(db: Db.Db, now: string): Promise<number> {
+  // Bounded like the ledger prunes: this delete cascades into deliveries,
+  // queue events, and completions, so it fans out the widest of the four.
   const result = await db.kysely
     .deleteFrom('webhook_subscriptions')
-    .where('expiresAt', 'is not', null)
+    // Repeated on the outer delete: the row recheck under concurrency re-runs
+    // only this predicate, so a subscription renewed mid-statement survives.
     .where('expiresAt', '<=', now)
+    .where('id', 'in', (eb) =>
+      eb
+        .selectFrom('webhook_subscriptions')
+        .select('id')
+        .where('expiresAt', 'is not', null)
+        .where('expiresAt', '<=', now)
+        .limit(pruneBatchLimit),
+    )
     .executeTakeFirst()
   return Number(result.numDeletedRows)
 }

package/src/internal/Auth.ts

@@ -587,11 +587,21 @@ export function middleware<
     const overrides = options.overrides as
       | Record<string, PolicyOverride | false | undefined>
       | undefined
-    const configuredOverride = overrides?.[key]
+    const routePolicies = policies(c)
+    const configuredOverride = (() => {
+      const configured = overrides?.[key]
+      if (configured !== undefined) return configured
+      const inheritedMethod = routePolicies.find(
+        (policy) => policy.inheritOverridesFrom,
+      )?.inheritOverridesFrom
+      if (inheritedMethod === undefined) return undefined
+      const inheritedKey = `${inheritedMethod.toUpperCase()} ${key.slice(key.indexOf(' ') + 1)}`
+      return overrides?.[inheritedKey]
+    })()
     const routeOverride =
       management && configuredOverride ? { mpp: configuredOverride.mpp } : configuredOverride
     const endpointPolicy = bindMppScope(
-      resolvePolicy(base, defaults, [...policies(c), routeOverride], description),
+      resolvePolicy(base, defaults, [...routePolicies, routeOverride], description),
       scope,
     )
     if (!endpointPolicy) return next()
@@ -1000,12 +1010,20 @@ export declare namespace install {
 }
 
 /** Creates route middleware that contributes an auth policy override. */
-export function policy(options: PolicyOverride): MiddlewareHandler {
+export function policy(options: policy.Options): MiddlewareHandler {
   const middleware = createMiddleware((_, next) => next()) as MiddlewareHandler & PolicyHandler
   middleware[policySymbol] = options
   return middleware
 }
 
+export declare namespace policy {
+  /** Route policy plus metadata for compatibility aliases. */
+  type Options = PolicyOverride & {
+    /** HTTP method whose configured override this route inherits when its own is absent. */
+    inheritOverridesFrom?: string | undefined
+  }
+}
+
 /** Adds management POSTs for OpenAPI-registered MPP GET resources. */
 export function installMppManagementRoutes(
   app: Hono<any, any>,
@@ -1106,7 +1124,7 @@ type OpenApiRoute = {
 }
 
 type PolicyHandler = {
-  [policySymbol]?: PolicyOverride | undefined
+  [policySymbol]?: policy.Options | undefined
 }
 
 type MppManagementHandler = {
@@ -1283,7 +1301,7 @@ function policies(c: hono_Context) {
   return matchedRoutes(c)
     .slice(c.req.routeIndex + 1)
     .map(policyFromRoute)
-    .filter((policy): policy is PolicyOverride => policy !== undefined)
+    .filter((routePolicy): routePolicy is policy.Options => routePolicy !== undefined)
 }
 
 function openApiSpec(route: RouterRoute) {

package/src/internal/Cache.ts

@@ -58,10 +58,8 @@ export function response<environment extends Env>(
 ): MiddlewareHandler<environment> {
   const defaultCacheControl = options.cacheControl ?? policies.default
   const vary = options.vary ?? ['Accept-Encoding', 'Authorization', 'Tempo-API-Key', 'X-API-Key']
-  // hono/cache suffixes its key with `::<directive>=<value>` for every
-  // configured vary directive (trimmed, lowercased, deduped). Mirror that
-  // normalization so the `no-cache` purge below deletes exactly the entry the
-  // wrapped middleware reads — drift here would make refreshes silently miss.
+  // Mirror hono/cache's vary normalization so the `no-cache` purge below
+  // deletes exactly the entry the wrapped middleware reads.
   const varyKeyDirectives = [
     ...new Set(vary.map((name) => name.trim().toLowerCase()).filter(Boolean)),
   ]
@@ -95,10 +93,19 @@ export function response<environment extends Env>(
     type Caches = { open(name: string): Promise<{ delete(key: string): Promise<unknown> }> }
     const caches = (globalThis as { caches?: Caches }).caches
     if (noCache && !noStore && caches) {
-      let key = await options.key(c)
+      // hono/cache 4.13 wraps generated keys in a canonical URL containing the
+      // request method and vary values. Keep this in sync with its
+      // `createCacheKey` so refreshes remove the stored GET response.
+      const key = await options.key(c)
+      const url = new URL('/.hono/cache', c.req.url)
+      url.searchParams.append('__hono_cache_key', key.split('#', 1)[0] ?? key)
+      url.searchParams.append('__hono_cache_method', c.req.method)
       for (const name of varyKeyDirectives)
-        key += `::${name}=${encodeURIComponent(c.req.raw.headers.get(name) ?? '')}`
-      await (await caches.open(options.name)).delete(key)
+        url.searchParams.append(
+          '__hono_cache_vary',
+          JSON.stringify([name, c.req.raw.headers.get(name) ?? '']),
+        )
+      await (await caches.open(options.name)).delete(url.href)
     }
 
     // Run ETag inside Hono's cache miss path so fresh responses are hashed

package/src/internal/EarnVaults.capabilities.test.ts

@@ -0,0 +1,33 @@
+import * as EarnVaults from './EarnVaults.js'
+
+describe('addZoneRouteCapabilities', () => {
+  test('adds private routing and router swaps', () => {
+    expect(
+      EarnVaults.addZoneRouteCapabilities({
+        asyncRedeem: false,
+        boundedRedeem: true,
+        deposit: true,
+        exactWithdraw: true,
+        inKindDeposit: true,
+        privateRouting: false,
+        redeem: true,
+        routerSwaps: false,
+      }),
+    ).toMatchObject({ privateRouting: true, routerSwaps: true })
+  })
+})
+
+describe('deriveZoneId', () => {
+  test('derives IDs from mainnet and testnet Zone chain schemes', () => {
+    expect([
+      EarnVaults.deriveZoneId(421_700_006),
+      EarnVaults.deriveZoneId(1_424_310_001),
+    ]).toStrictEqual([6, 1])
+  })
+
+  test('rejects a source chain ID', () => {
+    expect(() => EarnVaults.deriveZoneId(31_318)).toThrowErrorMatchingInlineSnapshot(
+      `[EarnVaults.InvalidRegistryError: Chain 31318 does not use a supported Zone chain-ID scheme.]`,
+    )
+  })
+})