tapimo 0.11.0 → 0.13.0

package/src/apps/data/routes/fee-amm.ts

@@ -62,32 +62,39 @@ export namespace schema {
    */
   export const PoolToken = Schema.describe(
     z.object({
-      address: Schema.TokenAddress.check(
+      address: Schema.tokenAddress(Tokens.tokenExample.address).check(
         z.describe('TIP-20 token contract address used by this fee pool.'),
       ),
       currency: z
         .optional(z.string())
         .check(
           z.describe('Display currency for the token, when available.'),
-          z.meta({ examples: ['USD'] }),
+          z.meta({ examples: [Tokens.tokenExample.currency] }),
         ),
       decimals: z
         .optional(z.number().check(z.int(), z.nonnegative()))
-        .check(z.describe('Number of decimal places the token uses.'), z.meta({ examples: [6] })),
+        .check(
+          z.describe('Number of decimal places the token uses.'),
+          z.meta({ examples: [Tokens.tokenExample.decimals] }),
+        ),
       logoUri: z.optional(z.string()).check(
-        z.describe('URL for the token logo SVG, when available.'),
+        z.describe('URL for the token logo image, when available.'),
         z.meta({
-          examples: [
-            'https://api.tempo.xyz/data/4217/icons/0x20c0000000000000000000008f5425160ebe5525.svg',
-          ],
+          examples: [Tokens.tokenExample.logoUri],
         }),
       ),
       name: z
         .optional(z.string())
-        .check(z.describe('Human-readable token name.'), z.meta({ examples: ['USD Coin'] })),
+        .check(
+          z.describe('Human-readable token name.'),
+          z.meta({ examples: [Tokens.tokenExample.name] }),
+        ),
       symbol: z
         .optional(z.string())
-        .check(z.describe('Short token ticker symbol.'), z.meta({ examples: ['USDC'] })),
+        .check(
+          z.describe('Short token ticker symbol.'),
+          z.meta({ examples: [Tokens.tokenExample.symbol] }),
+        ),
       verified: z
         .optional(z.boolean())
         .check(
@@ -403,7 +410,7 @@ export function feeAmm() {
             200,
           )
         } catch (cause) {
-          return Response.upstream(c, cause)
+          return Response.upstream(c, cause, { page: query.page })
         }
       },
     )
@@ -498,7 +505,7 @@ export function feeAmm() {
             200,
           )
         } catch (cause) {
-          return Response.upstream(c, cause)
+          return Response.upstream(c, cause, { page: query.page })
         }
       },
     )

package/src/apps/data/routes/receipts.ts

@@ -85,6 +85,8 @@ export namespace schema {
     })
     .check(z.describe('One event log emitted by a contract during transaction execution.'))
 
+  const rpcLog = OpenApi.component(Log, 'RpcTransactionLog')
+
   /** The verbatim JSON-RPC payloads, surfaced under each resource's `rpc` field. */
   export namespace Rpc {
     // TODO(ox/zod): replace with the zod schema for `ox/tempo`'s
@@ -145,7 +147,7 @@ export namespace schema {
         ),
         gasUsed: Schema.Quantity.check(z.describe('Gas actually used to execute the transaction.')),
         logs: z
-          .array(Log)
+          .array(rpcLog)
           .check(z.describe('Event logs emitted by contracts while this transaction executed.')),
         logsBloom: z
           .optional(Schema.Hex)
@@ -186,6 +188,8 @@ export namespace schema {
       .check(z.describe('The transaction receipt exactly as returned by JSON-RPC.'))
   }
 
+  const rpcReceipt = OpenApi.component(Rpc.Receipt, 'RpcTransactionReceipt')
+
   /** Receipt metadata containing valuation provenance and the verbatim JSON-RPC receipt. */
   export const ReceiptMeta = z
     .object({
@@ -196,10 +200,12 @@ export namespace schema {
             'Rate provenance for the fee valuation. Present when conversion rates were consulted.',
           ),
         ),
-      rpc: Rpc.Receipt.check(z.describe('The original JSON-RPC receipt payload.')),
+      rpc: rpcReceipt.check(z.describe('The original JSON-RPC receipt payload.')),
     })
     .check(z.describe('Metadata for this receipt, including valuation and the JSON-RPC payload.'))
 
+  const receiptMeta = OpenApi.component(ReceiptMeta, 'TransactionReceiptMeta')
+
   /** The fee charged to the fee payer, carrying its value in the requested denomination. */
   export const FeeAmount = z
     .extend(Schema.TokenAmount, {
@@ -215,6 +221,8 @@ export namespace schema {
       z.describe('The fee charged to the fee payer, with its value in the requested denomination.'),
     )
 
+  const receiptFeeAmount = OpenApi.component(FeeAmount, 'TransactionReceiptFeeAmount')
+
   /**
    * A humanized transaction receipt: decoded `status`/`type`, plain-number gas
    * and block fields, a structured fee amount, and a decimal-string gas price.
@@ -255,7 +263,9 @@ export namespace schema {
       effectiveGasPrice: Schema.DecimalString.check(
         z.describe('Effective gas price paid for this transaction, in attodollars per gas.'),
       ),
-      feeAmount: FeeAmount.check(z.describe('Fee charged to the fee payer, denominated in USD.')),
+      feeAmount: receiptFeeAmount.check(
+        z.describe('Fee charged to the fee payer, denominated in USD.'),
+      ),
       feePayer: z
         .optional(Schema.Address)
         .check(z.describe('The address that paid the transaction fee.')),
@@ -278,11 +288,11 @@ export namespace schema {
         z.describe('Stable resource ID for this API response; it is the transaction hash.'),
       ),
       logs: z
-        .array(Log)
+        .array(rpcLog)
         .check(
           z.describe('Event logs emitted by this transaction, returned in JSON-RPC log format.'),
         ),
-      meta: ReceiptMeta.check(
+      meta: receiptMeta.check(
         z.describe(
           'Receipt metadata containing valuation rate provenance and the JSON-RPC payload.',
         ),
@@ -330,6 +340,9 @@ export namespace schema {
       ),
     )
 
+  /** Humanized transaction receipt shared by detail, list, and transaction includes. */
+  export const TransactionReceipt = OpenApi.component(Receipt, 'TransactionReceipt')
+
   /** Schemas for the getReceipt operation. */
   export namespace getReceipt {
     /** Path parameters for receipt requests. */
@@ -368,7 +381,7 @@ export namespace schema {
       .check(z.describe('Query parameters for looking up a receipt.'))
 
     /** A humanized receipt, with the verbatim JSON-RPC payload under `meta.rpc`. */
-    export const Response = Receipt
+    export const Response = TransactionReceipt
   }
 
   /** Schemas for the getReceipts (list) operation. */
@@ -453,15 +466,22 @@ export namespace schema {
       })
       .check(z.describe('Page-level resources attached to this response.'))
 
-    export const Response = z
-      .object({
-        data: z.array(getReceipt.Response).check(z.describe('Receipts on this page.')),
-        meta: z
-          .optional(Meta)
-          .check(z.describe('Page-level resources: opt-in counts and valuation rate provenance.')),
-        nextCursor: Schema.NextCursor,
-      })
-      .check(z.describe('A page of receipts ordered by block number and transaction position.'))
+    const meta = OpenApi.component(Meta, 'TransactionReceiptListMeta')
+
+    export const Response = OpenApi.component(
+      z
+        .object({
+          data: z.array(getReceipt.Response).check(z.describe('Receipts on this page.')),
+          meta: z
+            .optional(meta)
+            .check(
+              z.describe('Page-level resources: opt-in counts and valuation rate provenance.'),
+            ),
+          nextCursor: Schema.NextCursor,
+        })
+        .check(z.describe('A page of receipts ordered by block number and transaction position.')),
+      'TransactionReceiptList',
+    )
   }
 }
 
@@ -481,7 +501,10 @@ export function receipts(options: receipts.Options = {}) {
           'List transaction receipts across Tempo, with filters for addresses, blocks, timestamps, fees, and status.',
         operationId: 'getReceipts',
         responses: OpenApi.responses({
-          errors: { 502: 'Could not read receipt or token data from an upstream service.' },
+          errors: {
+            400: { codes: ['chain_id_invalid', 'chain_id_unsupported', 'query_invalid'] },
+            502: 'Could not read receipt or token data from an upstream service.',
+          },
           success: {
             description: 'A page of transaction receipts.',
             schema: schema.getReceipts.Response,
@@ -594,7 +617,7 @@ export function receipts(options: receipts.Options = {}) {
         } catch (cause) {
           if (cause instanceof Valuation.UnsupportedDenominationError)
             return Response.error(c, { code: 'query_invalid', message: cause.message, status: 400 })
-          return Response.upstream(c, cause)
+          return Response.upstream(c, cause, { page: query.page })
         }
       },
     )
@@ -614,6 +637,14 @@ export function receipts(options: receipts.Options = {}) {
         operationId: 'getReceipt',
         responses: OpenApi.responses({
           errors: {
+            400: {
+              codes: [
+                'chain_id_invalid',
+                'chain_id_unsupported',
+                'query_invalid',
+                'transaction_invalid',
+              ],
+            },
             404: {
               description: 'No receipt was found for that transaction hash.',
               codes: ['receipt_not_found'],

package/src/apps/data/routes/rpc.test.ts

@@ -286,6 +286,81 @@ describe('POST /rpc', () => {
     },
   )
 
+  test('keeps RPC method-filter responses out of upstream alerts', async () => {
+    const entries: Log.Entry[] = []
+    const body = {
+      error: { code: -32_601, message: 'method not allowed: tempo_sponsor' },
+      id: null,
+      jsonrpc: '2.0',
+    }
+    const server = await Relay.createServer(
+      RequestListener.fromFetchHandler(() => Response.json(body, { status: 403 })),
+    )
+
+    try {
+      const app = TestApp.create({
+        auth: false,
+        logger: (entry) => void entries.push(entry),
+        rpc: { url: server.url },
+      })
+      const response = await app.fetch(
+        new Request('http://tempo-api.test/rpc', {
+          body: JSON.stringify({ id: 1, jsonrpc: '2.0', method: 'tempo_sponsor' }),
+          method: 'POST',
+        }),
+      )
+
+      expect(response.status).toBe(403)
+      expect(await response.json()).toEqual(body)
+      expect(entries[0]?.provider).toBeUndefined()
+    } finally {
+      await server.closeAsync()
+    }
+  })
+
+  test('attributes RPC authorization responses to the upstream', async () => {
+    const entries: Log.Entry[] = []
+    const server = await Relay.createServer(
+      RequestListener.fromFetchHandler(() =>
+        Response.json(
+          {
+            error: { code: -32_001, message: 'unauthorized: invalid credentials' },
+            id: null,
+            jsonrpc: '2.0',
+          },
+          { status: 403 },
+        ),
+      ),
+    )
+
+    try {
+      const app = TestApp.create({
+        auth: false,
+        logger: (entry) => void entries.push(entry),
+        rpc: { url: server.url },
+      })
+      const response = await app.fetch(
+        new Request('http://tempo-api.test/rpc', {
+          body: JSON.stringify({ id: 1, jsonrpc: '2.0', method: 'eth_chainId' }),
+          method: 'POST',
+        }),
+      )
+
+      expect(response.status).toBe(403)
+      expect(entries[0]).toMatchObject({
+        provider: {
+          chainId: runtime.chainId,
+          failure: 'http',
+          id: 'rpc',
+          operation: 'request',
+          status: 403,
+        },
+      })
+    } finally {
+      await server.closeAsync()
+    }
+  })
+
   test('attributes RPC transport failures to the upstream', async () => {
     const entries: Log.Entry[] = []
     const server = await Relay.createServer(

package/src/apps/data/routes/rpc.ts

@@ -411,14 +411,14 @@ async function passthrough(
 
   try {
     const response = await fetch(new Request(upstream, init))
-    let body = response.body
+    // Malformed requests and public Zone authentication failures are caused
+    // by caller input, not by the RPC provider.
+    if (!response.ok && !(await isCallerRpcFailure(response, usePublicZoneUrl)))
+      c.set('providerFailure', rpcProviderFailure(response, alertChainId))
 
-    if (!response.ok) {
-      // Malformed requests and public Zone authentication failures are caused
-      // by caller input, not by the RPC provider.
-      if (!isCallerRpcFailure(response.status, usePublicZoneUrl))
-        c.set('providerFailure', rpcProviderFailure(response, alertChainId))
-    } else if (response.status === 200) {
+    // `Response.clone()` replaces the body stream, so capture it after classifying errors.
+    let body = response.body
+    if (response.status === 200) {
       const inspection = await inspectRpcResponse(response)
       body = inspection.body
       if (inspection.result?.ok === false && !(inspection.result.empty && options.notificationOnly))
@@ -455,14 +455,28 @@ async function passthrough(
   }
 }
 
-function isCallerRpcFailure(status: number, usePublicZoneUrl: boolean) {
-  return (
+async function isCallerRpcFailure(response: globalThis.Response, usePublicZoneUrl: boolean) {
+  const { status } = response
+  if (
     status === 400 ||
     status === 413 ||
     status === 415 ||
     status === 422 ||
     (usePublicZoneUrl && (status === 401 || status === 403))
   )
+    return true
+  if (status !== 403) return false
+
+  // Orchestra returns HTTP 403 with JSON-RPC -32601 when its method filter
+  // rejects caller input. Other 403s, including RPC auth failures, stay upstream failures.
+  const body = await response
+    .clone()
+    .json()
+    .catch(() => undefined)
+  const parsed = schema.ResponseBody.safeParse(body)
+  if (!parsed.success) return false
+  const responses = Array.isArray(parsed.data) ? parsed.data : [parsed.data]
+  return responses.every((response) => response.error?.code === -32_601)
 }
 
 declare namespace passthrough {

package/src/apps/data/routes/tokenlist.ts

@@ -11,7 +11,7 @@ import * as Schema from '../../../internal/Schema.js'
 import * as Timing from '../../../internal/Timing.js'
 import * as VerifiedTokens from '../../../internal/VerifiedTokens.js'
 import * as Viem from '../../../internal/Viem.js'
-import { getTokenLogo } from './tokens.js'
+import * as Tokens from './tokens.js'
 
 /** Zod schemas owned by the tokenlist resource. */
 export namespace schema {
@@ -26,15 +26,20 @@ export namespace schema {
           z.describe('The Tempo chain ID where this token lives.'),
           z.meta({ examples: [4217] }),
         ),
-      address: Schema.Address.check(z.describe('The TIP-20 token contract address on Tempo.')),
+      address: Schema.tokenAddress(Tokens.tokenExample.address).check(
+        z.describe('The TIP-20 token contract address on Tempo.'),
+      ),
       name: z
         .string()
-        .check(z.describe('The token’s human-readable name.'), z.meta({ examples: ['USD Coin'] })),
+        .check(
+          z.describe('The token’s human-readable name.'),
+          z.meta({ examples: [Tokens.tokenExample.name] }),
+        ),
       symbol: z
         .string()
         .check(
           z.describe('The short ticker symbol wallets and apps show for this token.'),
-          z.meta({ examples: ['USDC'] }),
+          z.meta({ examples: [Tokens.tokenExample.symbol] }),
         ),
       decimals: z
         .number()
@@ -45,14 +50,12 @@ export namespace schema {
           z.describe(
             'The number of decimal places the token uses; Tempo stablecoins typically use 6.',
           ),
-          z.meta({ examples: [6] }),
+          z.meta({ examples: [Tokens.tokenExample.decimals] }),
         ),
       logoURI: z.optional(z.string()).check(
         z.describe('The curated HTTPS URL for this token’s logo image, when one is set.'),
         z.meta({
-          examples: [
-            'https://api.tempo.xyz/data/4217/icons/0x20c0000000000000000000008f5425160ebe5525.svg',
-          ],
+          examples: [Tokens.tokenExample.logoUri],
         }),
       ),
     })
@@ -145,13 +148,12 @@ export function tokenlist() {
             version: { major: 1, minor: 0, patch: 2 },
             tokens: [
               {
-                chainId: 4217,
-                address: '0x20c0000000000000000000000000000000000000',
-                name: 'pathUSD',
-                symbol: 'pathUSD',
-                decimals: 6,
-                logoURI:
-                  'https://api.tempo.xyz/assets/4217/tokens/0x20c0000000000000000000000000000000000000/logo',
+                address: Tokens.tokenExample.address,
+                chainId: Tokens.tokenExampleChainId,
+                decimals: Tokens.tokenExample.decimals,
+                logoURI: Tokens.tokenExample.logoUri,
+                name: Tokens.tokenExample.name,
+                symbol: Tokens.tokenExample.symbol,
               },
             ],
           },
@@ -239,9 +241,10 @@ async function getTokenLogos(
           async (token) =>
             [
               token.address,
-              await getTokenLogo(c, { address: token.address, chainId: options.chainId }).catch(
-                () => undefined,
-              ),
+              await Tokens.getTokenLogo(c, {
+                address: token.address,
+                chainId: options.chainId,
+              }).catch(() => undefined),
             ] as const,
         ),
       )