tapimo 0.15.0 → 0.18.0

package/src/apps/relay/App.test.ts

@@ -5,7 +5,7 @@ import { Hash, Hex, Secp256k1 } from 'ox'
 import { ZoneRpcAuthentication } from 'ox/tempo'
 import { createClient, http } from 'viem'
 import { prepareTransactionRequest, sendRawTransactionSync, signTransaction } from 'viem/actions'
-import { Account as TempoAccount, Actions, Transaction, withRelay } from 'viem/tempo'
+import { Account as TempoAccount, Actions, Addresses, Transaction, withRelay } from 'viem/tempo'
 
 import * as TestApp from '../../../test/App.js'
 import * as Containers from '../../../test/containers.js'
@@ -25,6 +25,7 @@ import * as SponsoredTransactions from '../../db/tables/sponsoredTransactions.js
 import * as StripeCustomers from '../../db/tables/stripeCustomers.js'
 import * as core_Billing from '../management/Billing.js'
 import * as RequestListener from '../../handlers/internal/requestListener.js'
+import * as Store from '../../internal/Store.js'
 import * as Tidx from '../../internal/Tidx.js'
 import * as Viem from '../../internal/Viem.js'
 import * as Sponsorships from './Sponsorships.js'
@@ -125,6 +126,36 @@ const keys = [
   },
 ] as const satisfies readonly TestApp.kvStore.Key[]
 
+describe('behavior: multisig coordination', () => {
+  test('uses configured state and reports coordinator failures', async () => {
+    const entries: Log.Entry[] = []
+    const store = Store.memory()
+    const app = TestApp.create({
+      auth: { keys },
+      logger: (entry) => void entries.push(entry),
+      relay: { multisig: { store } },
+    })
+    const hash = Hex.random(32)
+    const request = async () => {
+      const response = await app.request('/rpc/relay', {
+        body: JSON.stringify({
+          id: 1,
+          jsonrpc: '2.0',
+          method: 'multisig_getOperation',
+          params: [hash],
+        }),
+        headers: { 'content-type': 'application/json', 'tempo-api-key': 'secret_unscoped' },
+        method: 'POST',
+      })
+      return response.json()
+    }
+    expect(await request()).toMatchObject({ result: null })
+    await store.put(`multisig:v2:multisig:operation:${hash}`, 'invalid')
+    expect(await request()).toMatchObject({ error: { code: -32603 } })
+    expect(entries.at(-1)?.rpc).toMatchObject({ serverErrors: 1 })
+  })
+})
+
 describe('behavior: Zone chain routing', () => {
   const zoneSelectors = [
     ['relay', 'path'],
@@ -712,6 +743,8 @@ describe.skipIf(runtime.mode !== 'localnet')('behavior: sponsorship', () => {
           "finalizationAttemptedAt": null,
           "finalizedAt": null,
           "id": "<id>",
+          "meterEventFirstAttemptedAt": null,
+          "meterReportAttemptedAt": null,
           "meterReportedAt": null,
           "orgId": "org_1",
           "projectId": "prj_1",
@@ -720,6 +753,7 @@ describe.skipIf(runtime.mode !== 'localnet')('behavior: sponsorship', () => {
           "status": "pending",
           "transaction": "<hex>",
           "transactionHash": "<hash>",
+          "transactionHashReconciled": false,
         }
       `)
   })
@@ -1239,6 +1273,56 @@ describe('behavior: mainnet billing gate', () => {
     await TestApp.verifiedSeed(db, Viem.chainId.mainnet)
   }
 
+  test('behavior: uses the same sponsor fee token for each authenticated organization', async () => {
+    const db = TestApp.database()
+    const ousd = '0x20c0000000000000000000006a37DA5C996874BE'
+    await activate(db, 'org_1')
+    await activate(db, 'org_2')
+    await TestApp.verifiedSeed(db, Viem.chainId.mainnet, {
+      tokens: [Addresses.pathUsd, ousd].map((address) => ({
+        address,
+        currency: 'USD',
+        decimals: 6,
+        name: address === ousd ? 'OUSD' : 'pathUSD',
+        symbol: address === ousd ? 'OUSD' : 'pathUSD',
+      })),
+    })
+    const app = TestApp.create({
+      auth: { keys },
+      db,
+      relay: {
+        feePayer: {
+          account: feePayerAccount,
+          resolveFeeToken: ({ chainId }) => {
+            expect(chainId).toBe(Viem.chainId.mainnet)
+            return ousd
+          },
+        },
+      },
+      supportedChainIds: [Viem.chainId.mainnet],
+    })
+
+    for (const [nonce, { orgId, token }] of [
+      { orgId: 'org_1', token: 'secret_sponsor_prod' },
+      { orgId: 'org_2', token: 'secret_wildcard_prod' },
+      { orgId: 'org_1', token: 'secret_sponsor_prod' },
+    ].entries()) {
+      const body = await relayRequest(app, {
+        method: 'eth_signRawTransaction',
+        params: [await signSponsorable({ chainId: Viem.chainId.mainnet, nonce })],
+        token,
+      })
+      expect(body.error).toBeUndefined()
+      const signed = Transaction.deserialize(body.result as `0x76${string}`)
+      expect(signed.feeToken?.toString().toLowerCase()).toBe(ousd.toLowerCase())
+      const row = (await SponsoredTransactions.listPending(db)).find(
+        (row) => row.transactionHash === Hash.keccak256(body.result!),
+      )
+      expect(row?.orgId).toBe(orgId)
+      expect(row?.feeToken?.toLowerCase()).toBe(ousd.toLowerCase())
+    }
+  })
+
   /** Configures one attributed project for Tempo-funded sponsorship. */
   async function configureSubsidy(db: ReturnType<typeof TestApp.database>) {
     await Organizations.create(db, { id: 'org_1', name: 'Privy' })

package/src/apps/relay/App.ts

@@ -2,6 +2,7 @@ import { Hono } from 'hono'
 import { createMiddleware } from 'hono/factory'
 import { Hash, Hex, RpcResponse } from 'ox'
 import { ZoneRpcAuthentication } from 'ox/tempo'
+import type { Address } from 'viem'
 import { Addresses, TokenId, Transaction } from 'viem/tempo'
 
 import type * as App from '../../App.js'
@@ -75,10 +76,19 @@ export declare namespace relay {
           NonNullable<Handler.relay.Options['feePayer']>,
           'account' | 'feeToken' | 'name' | 'url'
         > & {
+          /** Resolves the sponsor's fee token using the transaction chain. */
+          resolveFeeToken?:
+            | ((options: {
+                /** Transaction chain id. */
+                chainId: number
+              }) => Address | undefined)
+            | undefined
           /** Per-transaction fee cap (decimal USD string); orgs tighten it, never loosen. @default '1.00' */
           txFeeLimit?: string | undefined
         })
       | undefined
+    /** Native multisig coordination backed by authoritative atomic storage. */
+    multisig?: Handler.relay.Options['multisig'] | undefined
   }
 }
 
@@ -151,11 +161,18 @@ function middleware(options: middleware.Options) {
         principal?.type === 'api_key' &&
         (principal.apiKey.scopes.includes('rpc-relay:sponsor') ||
           principal.apiKey.scopes.includes(Scope.wildcard))
-      // Lifted so validation and the sponsored-token default read one value.
-      const feeToken_sponsor = options.feePayer.feeToken ?? Addresses.pathUsd
+      // Resolve against the transaction chain because one app serves mainnet,
+      // testnet, and hosted Zones concurrently.
+      const feeToken_sponsor = (chainId: number) => {
+        return (
+          options.feePayer?.resolveFeeToken?.({ chainId }) ??
+          options.feePayer?.feeToken ??
+          Addresses.pathUsd
+        )
+      }
       return {
         ...options.feePayer,
-        feeToken: feeToken_sponsor,
+        resolveFeeToken: feeToken_sponsor,
         validate: async (transaction) => {
           // Allowlist the chains this deployment serves rather than denylisting
           // only mainnet: the relay resolves chainId from the request body, so
@@ -230,7 +247,7 @@ function middleware(options: middleware.Options) {
           }
           const feeToken = (() => {
             try {
-              return TokenId.toAddress(transaction.feeToken ?? feeToken_sponsor)
+              return TokenId.toAddress(transaction.feeToken ?? feeToken_sponsor(id))
             } catch {
               return undefined
             }
@@ -388,6 +405,12 @@ function middleware(options: middleware.Options) {
               : await SponsoredTransactions.reserve(db, input, billingLimit)
             return { subsidized: !record.billable }
           } catch (error) {
+            if (error instanceof SponsoredTransactions.OrganizationDeletedError)
+              rejectSponsorship({
+                chainId: event.chainId,
+                message: 'Organization no longer exists.',
+                reason: 'billing_required',
+              })
             if (error instanceof SponsoredTransactions.AttributionConflictError)
               rejectSponsorship({
                 chainId: event.chainId,
@@ -466,6 +489,7 @@ function middleware(options: middleware.Options) {
       cache: c.get('store'),
       ...(options.features ? { features: options.features } : {}),
       getClient,
+      ...(options.multisig ? { multisig: options.multisig } : {}),
       onRequest: async (request) => {
         const method = sponsorshipMethod(request.method)
         const params = 'params' in request && Array.isArray(request.params) ? request.params : []

package/src/apps/relay/Sponsorships.test.ts

@@ -339,6 +339,29 @@ describe('reconcile', () => {
     await db.close()
   })
 
+  test('behavior: replaces an unresolved recorded hash by sign payload', async () => {
+    const db = create()
+    await db.migrate()
+    const sponsorship = await SponsoredTransactions.upsert(db, {
+      ...input,
+      signPayload,
+      transactionHash: `0x${'cc'.repeat(32)}`,
+    })
+
+    const result = await Sponsorships.reconcile(db, {
+      feePayer: '0xFee0000000000000000000000000000000000000',
+      getClient: () => rpc,
+      getTidx: () => tidx([{ from: sender, hash: minedHash }]),
+    })
+
+    expect(result).toMatchObject({ matched: 1 })
+    expect(await SponsoredTransactions.get(db, sponsorship.id)).toMatchObject({
+      status: 'pending',
+      transactionHash: minedHash,
+    })
+    await db.close()
+  })
+
   test('behavior: recovers recently failed intents by sign payload', async () => {
     const db = create()
     await db.migrate()
@@ -373,6 +396,44 @@ describe('reconcile', () => {
     await db.close()
   })
 
+  test('behavior: recovers a failed recorded hash by sign payload without duplicating spend', async () => {
+    const db = create()
+    await db.migrate()
+    await Organizations.create(db, { id: 'org_1', name: 'One' })
+    const recordedHash = `0x${'cc'.repeat(32)}`
+    const sponsorship = await SponsoredTransactions.upsert(db, {
+      ...input,
+      signPayload,
+      transactionHash: recordedHash,
+    })
+    await SponsoredTransactions.fail(db, sponsorship.id, '2026-01-01T00:00:00.000Z')
+
+    vi.useFakeTimers({ now: new Date('2026-01-01T00:01:00.000Z') })
+    try {
+      const options = {
+        feePayer: '0xFee0000000000000000000000000000000000000' as const,
+        getClient: () => rpc,
+        getTidx: () => tidx([{ block_num: 1, from: sender, hash: minedHash, idx: 0 }]),
+      }
+      expect(await Sponsorships.reconcile(db, options)).toMatchObject({ matched: 1 })
+      expect(
+        await Sponsorships.finalize(db, {
+          getClient: () => client({ [minedHash]: { effectiveGasPrice: '0x3', gasUsed: '0x5208' } }),
+        }),
+      ).toMatchObject({ finalized: 1 })
+      expect(await Sponsorships.reconcile(db, options)).toMatchObject({ matched: 0 })
+    } finally {
+      vi.useRealTimers()
+    }
+
+    expect(await SponsoredTransactions.get(db, sponsorship.id)).toMatchObject({
+      status: 'finalized',
+      transactionHash: minedHash,
+    })
+    expect(await SponsoredTransactions.list(db, { limit: 10 })).toHaveLength(1)
+    await db.close()
+  })
+
   test('behavior: spend-limit refusals are not operational errors', async () => {
     const db = create()
     await db.migrate()
@@ -460,6 +521,41 @@ describe('reconcile', () => {
     await db.close()
   })
 
+  test('behavior: scans fill intents and submitted hashes from independent windows', async () => {
+    const db = create()
+    await db.migrate()
+    vi.useFakeTimers({ now: new Date('2026-01-01T00:00:00.000Z') })
+    try {
+      await SponsoredTransactions.upsert(db, {
+        ...input,
+        signPayload: `0x${'ee'.repeat(32)}`,
+      })
+      vi.setSystemTime(new Date('2026-01-01T01:00:00.000Z'))
+      const { transactionHash: _, ...intent } = input
+      await SponsoredTransactions.upsert(db, { ...intent, signPayload })
+      const queries: string[] = []
+
+      await Sponsorships.reconcile(db, {
+        feePayer: '0xFee0000000000000000000000000000000000000',
+        getClient: () => rpc,
+        getTidx: () =>
+          ({
+            fetch: async (options: { query: string }) => {
+              queries.push(options.query)
+              return { rows: [] }
+            },
+          }) as never,
+      })
+
+      expect(queries).toHaveLength(2)
+      expect(queries[0]).toContain("block_timestamp >= '2026-01-01 00:58:00'")
+      expect(queries[1]).toContain("block_timestamp >= '2025-12-31 23:58:00'")
+    } finally {
+      vi.useRealTimers()
+      await db.close()
+    }
+  })
+
   test('behavior: an indexer error leaves intents for the next pass', async () => {
     const db = create()
     await db.migrate()
@@ -483,7 +579,7 @@ describe('reconcile', () => {
         "scanned": 0,
       }
     `)
-    expect(await SponsoredTransactions.listIntents(db)).toHaveLength(1)
+    expect(await SponsoredTransactions.listReconciliationCandidates(db)).toHaveLength(1)
     await db.close()
   })
 })

package/src/apps/relay/Sponsorships.ts

@@ -53,7 +53,9 @@ export async function finalize(db: Db.Db, options: finalize.Options): Promise<fi
     // here only the TTL can settle them.
     if (row.transactionHash === null) {
       if (Date.parse(row.createdAt) + pendingTtlMs <= now().getTime()) {
-        await SponsoredTransactions.fail(db, row.id, now().toISOString())
+        await SponsoredTransactions.fail(db, row.id, now().toISOString(), {
+          transactionHash: row.transactionHash,
+        })
         result.failed++
       } else result.pending++
       continue
@@ -70,7 +72,9 @@ export async function finalize(db: Db.Db, options: finalize.Options): Promise<fi
       else {
         result.errors++
         if (Date.parse(row.createdAt) + receiptErrorTtlMs <= now().getTime()) {
-          await SponsoredTransactions.fail(db, row.id, now().toISOString())
+          await SponsoredTransactions.fail(db, row.id, now().toISOString(), {
+            transactionHash: row.transactionHash,
+          })
           result.failed++
         } else result.pending++
         continue
@@ -83,10 +87,13 @@ export async function finalize(db: Db.Db, options: finalize.Options): Promise<fi
       await SponsoredTransactions.finalize(db, row.id, {
         feeAmount: feeAmount.toString(),
         finalizedAt: now().toISOString(),
+        transactionHash: row.transactionHash,
       })
       result.finalized++
     } else if (Date.parse(row.createdAt) + pendingTtlMs <= now().getTime()) {
-      await SponsoredTransactions.fail(db, row.id, now().toISOString())
+      await SponsoredTransactions.fail(db, row.id, now().toISOString(), {
+        transactionHash: row.transactionHash,
+      })
       result.failed++
     } else result.pending++
   }
@@ -123,11 +130,9 @@ export declare namespace finalize {
 }
 
 /**
- * Runs one reconciliation pass over pending fill intents (rows with no
- * transaction hash): fetches the fee payer's recent on-chain transactions
- * from TIDX, recomputes each candidate's fee-payer sign payload, and fills
- * matching intents' hashes so the receipt pass can finalize them. Query or
- * candidate errors leave intents for the next pass.
+ * Reconciles pending fill intents and recently failed sponsorships against
+ * on-chain fee-payer sign payloads. Matches update their transaction hashes;
+ * errors leave sponsorships for the next pass.
  *
  * @param db - The database holding `sponsored_transactions`.
  * @param options - Reconciliation options.
@@ -147,74 +152,80 @@ export async function reconcile(db: Db.Db, options: reconcile.Options): Promise<
   const failedSince = new Date(Date.now() - failedIntentTtlMs).toISOString()
   // Old failed intents must not move the active scan behind its candidate cap.
   const [intents, recoveryWindows] = await Promise.all([
-    SponsoredTransactions.listIntents(db, { limit: batchSize }),
+    SponsoredTransactions.listReconciliationCandidates(db, { limit: batchSize }),
     SponsoredTransactions.listRecoveryWindows(db, { failedSince }),
   ])
   const result = { errors: 0, matched: 0, scanned: 0 }
   if (intents.length === 0 && recoveryWindows.length === 0) return result
 
-  const groups = new Map<number, SponsoredTransactions.Record[]>()
-  for (const intent of intents)
-    groups.set(intent.chainId, [...(groups.get(intent.chainId) ?? []), intent])
+  const groups = [
+    new Map<number, SponsoredTransactions.Record[]>(),
+    new Map<number, SponsoredTransactions.Record[]>(),
+  ]
+  for (const intent of intents) {
+    const group = groups[intent.transactionHash === null ? 0 : 1]!
+    group.set(intent.chainId, [...(group.get(intent.chainId) ?? []), intent])
+  }
 
-  for (const [chainId, rows] of groups) {
-    if (candidateCap <= 0) continue
-    const bySignPayload = new Map(rows.map((row) => [row.signPayload, row]))
-    const since = formatTidxTimestamp(
-      Math.min(...rows.map((row) => Date.parse(row.createdAt))) - skewMs,
-    )
+  for (const group of groups)
+    for (const [chainId, rows] of group) {
+      if (candidateCap <= 0) continue
+      const bySignPayload = new Map(rows.map((row) => [row.signPayload, row]))
+      const since = formatTidxTimestamp(
+        Math.min(...rows.map((row) => Date.parse(row.createdAt))) - skewMs,
+      )
 
-    let candidates: readonly globalThis.Record<string, unknown>[]
-    try {
-      // Dynamic filter values; the tidx client's query type wants literals.
-      const fetched = await getTidx(chainId).fetch({
-        chainId,
-        query:
-          `SELECT hash, "from" FROM txs WHERE fee_payer = '${feePayer.toLowerCase()}' AND block_timestamp >= '${since}' ORDER BY block_timestamp ASC LIMIT ${candidateCap}` as string,
-      })
-      candidates = fetched.rows
-    } catch {
-      // Indexer outage must not fail intents; retry on the next pass.
-      result.errors++
-      continue
-    }
-
-    for (const candidate of candidates) {
-      if (bySignPayload.size === 0) break
-      const hash = candidate['hash'] as Hex.Hex | undefined
-      const sender = candidate['from'] as Address | undefined
-      if (!hash || !sender) continue
-      result.scanned++
+      let candidates: readonly globalThis.Record<string, unknown>[]
       try {
-        const serialized = await getRawTransaction(getClient(chainId), hash)
-        if (!serialized) {
-          result.errors++
-          continue
+        // Dynamic filter values; the tidx client's query type wants literals.
+        const fetched = await getTidx(chainId).fetch({
+          chainId,
+          query:
+            `SELECT hash, "from" FROM txs WHERE fee_payer = '${feePayer.toLowerCase()}' AND block_timestamp >= '${since}' ORDER BY block_timestamp ASC LIMIT ${candidateCap}` as string,
+        })
+        candidates = fetched.rows
+      } catch {
+        // Indexer outage must not fail sponsorships; retry on the next pass.
+        result.errors++
+        continue
+      }
+
+      for (const candidate of candidates) {
+        if (bySignPayload.size === 0) break
+        const hash = candidate['hash'] as Hex.Hex | undefined
+        const sender = candidate['from'] as Address | undefined
+        if (!hash || !sender) continue
+        result.scanned++
+        try {
+          const serialized = await getRawTransaction(getClient(chainId), hash)
+          if (!serialized) {
+            result.errors++
+            continue
+          }
+          if (!serialized.startsWith(TxEnvelopeTempo.serializedType)) continue
+          const signPayload = TxEnvelopeTempo.getFeePayerSignPayload(
+            TxEnvelopeTempo.deserialize(serialized as TxEnvelopeTempo.Serialized),
+            { sender },
+          )
+          const intent = bySignPayload.get(signPayload)
+          if (!intent) continue
+          await SponsoredTransactions.assignTransactionHash(
+            db,
+            intent.id,
+            hash,
+            await options.limitFor?.(intent),
+          )
+          bySignPayload.delete(signPayload)
+          result.matched++
+        } catch (error) {
+          // Spend-limit enforcement is an expected policy refusal; dependency,
+          // lookup, and malformed-envelope failures remain operational errors.
+          if (!(error instanceof SponsoredTransactions.PeriodSpendLimitError)) result.errors++
         }
-        if (!serialized.startsWith(TxEnvelopeTempo.serializedType)) continue
-        const signPayload = TxEnvelopeTempo.getFeePayerSignPayload(
-          TxEnvelopeTempo.deserialize(serialized as TxEnvelopeTempo.Serialized),
-          { sender },
-        )
-        const intent = bySignPayload.get(signPayload)
-        if (!intent) continue
-        await SponsoredTransactions.assignTransactionHash(
-          db,
-          intent.id,
-          hash,
-          await options.limitFor?.(intent),
-        )
-        bySignPayload.delete(signPayload)
-        result.matched++
-      } catch (error) {
-        // Spend-limit enforcement is an expected policy refusal; dependency,
-        // lookup, and malformed-envelope failures remain operational errors.
-        if (!(error instanceof SponsoredTransactions.PeriodSpendLimitError)) result.errors++
       }
+      // A truncated active scan cannot prove that the remaining sponsorships were never mined.
+      if (candidates.length === candidateCap && bySignPayload.size > 0) result.errors++
     }
-    // A truncated active scan cannot prove that the remaining intents were never mined.
-    if (candidates.length === candidateCap && bySignPayload.size > 0) result.errors++
-  }
 
   const feePayer_lower = feePayer.toLowerCase() as Address
   for (const window of recoveryWindows) {
@@ -353,7 +364,7 @@ export async function reconcile(db: Db.Db, options: reconcile.Options): Promise<
 export declare namespace reconcile {
   /** Options for {@link reconcile}. */
   type Options = {
-    /** Maximum active intents considered per pass. @default 100 */
+    /** Maximum pending sponsorships per transaction-hash state considered per pass. @default 100 */
     batchSize?: number | undefined
     /** Maximum candidates per chain in each active or recovery scan. @default 500 */
     candidateCap?: number | undefined