tapimo 0.4.3 → 0.4.4

package/src/apps/data/routes/funding.ts

@@ -8,7 +8,6 @@ import * as FundingRoutes from '../../../internal/FundingRoutes.js'
 import * as OpenApi from '../../../internal/OpenApi.js'
 import * as Response from '../../../internal/Response.js'
 import * as Schema from '../../../internal/Schema.js'
-import * as FundingRouteProviders from '../FundingRouteProviders.js'
 
 /** Zod schemas owned by the funding routes resource. */
 export namespace schema {
@@ -42,7 +41,7 @@ export namespace schema {
         .optional(z.record(z.string(), z.string()))
         .check(
           z.describe('Provider-specific chain ids Tempo uses when querying route providers.'),
-          z.meta({ examples: [{ across: '8453', relay: '8453' }] }),
+          z.meta({ examples: [{ bridge: 'base', relay: '8453' }] }),
         ),
     }),
     'A normalized chain reference for funding routes.',
@@ -123,7 +122,7 @@ export namespace schema {
   /** Provider summary embedded in a route candidate. */
   export const ProviderRef = Schema.describe(
     z.object({
-      id: z.string().check(z.describe('Stable provider id.'), z.meta({ examples: ['across'] })),
+      id: z.string().check(z.describe('Stable provider id.'), z.meta({ examples: ['relay'] })),
       kind: z
         .string()
         .check(
@@ -132,7 +131,7 @@ export namespace schema {
         ),
       name: z
         .string()
-        .check(z.describe('Human-readable provider name.'), z.meta({ examples: ['Across'] })),
+        .check(z.describe('Human-readable provider name.'), z.meta({ examples: ['Relay'] })),
       requiresApiKey: z
         .boolean()
         .check(
@@ -269,111 +268,6 @@ export namespace schema {
     'Provider-derived quote, limit, and freshness data for a route candidate.',
   )
 
-  /** Token reference attached to a normalized quote fee. */
-  export const QuoteFeeToken = Schema.describe(
-    z.object({
-      address: z
-        .string()
-        .check(
-          z.describe('Contract address of the fee token.'),
-          z.meta({ examples: ['0x833589fcd6edb6e08f4c7c32d4f71b54bda02913'] }),
-        ),
-      chainId: z
-        .string()
-        .check(z.describe('CAIP-2 chain id of the fee token.'), z.meta({ examples: ['eip155:8453'] })), // prettier-ignore
-      decimals: z
-        .number()
-        .check(
-          z.int(),
-          z.nonnegative(),
-          z.describe('Number of decimal places used by the fee token.'),
-          z.meta({ examples: [6] }),
-        ),
-      symbol: z
-        .string()
-        .check(z.describe('Ticker symbol of the fee token.'), z.meta({ examples: ['USDC'] })),
-    }),
-    'Token in which a normalized quote fee is denominated.',
-  )
-
-  /** Normalized fee summary for an explicit funding quote. */
-  export const QuoteFee = Schema.describe(
-    z.object({
-      amount: Schema.DecimalString.check(
-        z.describe("Fee amount in the fee token's smallest unit."),
-        z.meta({ examples: ['1200'] }),
-      ),
-      amountUsd: z
-        .nullable(z.string().check(z.regex(/^\d+(\.\d+)?$/)))
-        .check(
-          z.describe('Provider-estimated USD value of the fee.'),
-          z.meta({ examples: ['0.0012'] }),
-        ),
-      bps: z
-        .nullable(z.number().check(z.int(), z.nonnegative()))
-        .check(z.describe('Fee as basis points of the quoted input.'), z.meta({ examples: [12] })),
-      token: QuoteFeeToken,
-    }),
-    'Provider-neutral fee amount and denomination.',
-  )
-
-  /** Explicit depositor-specific quote for one curated funding route. */
-  export const FundingQuote = Schema.describe(
-    z.object({
-      destinationChain: Chain.check(z.describe('Destination chain for the quoted route.')),
-      destinationToken: Token.check(z.describe('Token received on the destination chain.')),
-      estimatedSeconds: z
-        .nullable(z.number().check(z.int(), z.nonnegative()))
-        .check(z.describe('Estimated settlement time in seconds.'), z.meta({ examples: [2] })),
-      expiresAt: z.iso
-        .datetime()
-        .check(
-          z.describe('Timestamp after which the quote must not be used.'),
-          z.meta({ examples: ['2026-01-01T00:01:00Z'] }),
-        ),
-      fees: z
-        .object({
-          total: QuoteFee.check(z.describe('Current estimated total fee.')),
-          totalMax: QuoteFee.check(z.describe('Maximum total fee allowed by the quote.')),
-        })
-        .check(z.describe('Current and maximum provider fee summaries.')),
-      inputAmount: Schema.DecimalString.check(
-        z.describe('Exact source amount quoted in base units.'),
-        z.meta({ examples: ['1000000'] }),
-      ),
-      minimumOutputAmount: Schema.DecimalString.check(
-        z.describe('Slippage-adjusted minimum destination amount in base units.'),
-        z.meta({ examples: ['988000'] }),
-      ),
-      outputAmount: Schema.DecimalString.check(
-        z.describe('Expected destination amount in base units.'),
-        z.meta({ examples: ['990000'] }),
-      ),
-      outputAmountFormatted: z
-        .string()
-        .check(
-          z.describe('Expected destination amount rendered with token decimals.'),
-          z.meta({ examples: ['0.99'] }),
-        ),
-      provider: ProviderRef.check(z.describe('Provider that produced the quote.')),
-      routeId: z
-        .string()
-        .check(
-          z.describe('Stable id of the curated route that was quoted.'),
-          z.meta({ examples: ['base-usdc-tempo-usdce-across'] }),
-        ),
-      sampledAt: z.iso
-        .datetime()
-        .check(
-          z.describe('Timestamp when Tempo sampled the provider quote.'),
-          z.meta({ examples: ['2026-01-01T00:00:00Z'] }),
-        ),
-      sourceChain: Chain.check(z.describe('Source chain for the quoted route.')),
-      sourceToken: Token.check(z.describe('Token spent on the source chain.')),
-    }),
-    'Normalized quote information without provider execution payloads.',
-  )
-
   /** Static or live funding route candidate. */
   export const RouteCandidate = Schema.describe(
     z.object({
@@ -389,7 +283,7 @@ export namespace schema {
         .string()
         .check(
           z.describe('Stable deterministic route candidate id.'),
-          z.meta({ examples: ['base-usdc-tempo-usdce-across'] }),
+          z.meta({ examples: ['base-usdc-tempo-usdce-relay'] }),
         ),
       provider: ProviderRef,
       quality: Quality,
@@ -475,9 +369,9 @@ export namespace schema {
           .optional(z.string())
           .check(
             z.describe(
-              'Only return candidates from this provider id, such as `across`, `relay`, or `bridge`. Planned providers can return an empty list.',
+              'Only return candidates from this provider id, such as `relay`, `bridge`, or `bungee`. Planned providers can return an empty list.',
             ),
-            z.meta({ examples: ['across', 'bridge'] }),
+            z.meta({ examples: ['relay', 'bridge'] }),
           ),
         sourceAmount: z
           .string()
@@ -528,63 +422,6 @@ export namespace schema {
     )
   }
 
-  /** Schemas for the quoteFundingRoute operation. */
-  export namespace quoteFundingRoute {
-    /** JSON body for an explicit funding route quote. */
-    export const Body = z
-      .strictObject({
-        depositor: Schema.Address.check(
-          z.describe('Address that would submit the funding transaction.'),
-        ),
-        destinationToken: z
-          .optional(z.string())
-          .check(
-            z.describe('Tempo destination token symbol, address, or token key.'),
-            z.meta({ examples: ['USDC.e'] }),
-          ),
-        provider: z
-          .literal('across')
-          .check(
-            z.describe('Provider id selected from funding route discovery.'),
-            z.meta({ examples: ['across'] }),
-          ),
-        recipient: z
-          .optional(Schema.Address)
-          .check(z.describe('Optional destination recipient; defaults to the depositor.')),
-        sourceAmount: z
-          .string()
-          .check(
-            z.minLength(1),
-            z.describe('Exact source amount to quote.'),
-            z.meta({ examples: ['1000000'] }),
-          ),
-        sourceAmountUnits: z
-          ._default(z.enum(['baseUnits', 'decimal']), 'baseUnits')
-          .check(
-            z.describe('Whether `sourceAmount` uses base units or decimal notation.'),
-            z.meta({ examples: ['baseUnits'] }),
-          ),
-        sourceChain: z
-          .string()
-          .check(
-            z.minLength(1),
-            z.describe('Source chain alias or CAIP-2 id.'),
-            z.meta({ examples: ['base'] }),
-          ),
-        sourceToken: z
-          .string()
-          .check(
-            z.minLength(1),
-            z.describe('Source token symbol, address, mint, or token key.'),
-            z.meta({ examples: ['USDC'] }),
-          ),
-      })
-      .check(z.describe('Parameters for a depositor-specific exact-input funding quote.'))
-
-    /** Normalized funding quote without provider execution payloads. */
-    export const Response = FundingQuote
-  }
-
   /** Schemas for the listFundingChains operation. */
   export namespace listFundingChains {
     /** Non-paginated source-chain inventory. */
@@ -626,12 +463,12 @@ export namespace schema {
 const fundingRouteResponseExamples = {
   baseUsdc: {
     description:
-      '`GET /v1/funding/routes?sourceChain=base&sourceToken=USDC&sourceAmount=1000000&provider=across`',
+      '`GET /v1/funding/routes?sourceChain=base&sourceToken=USDC&sourceAmount=1000000&provider=relay`',
     summary: 'Base USDC',
     value: {
       data: FundingRoutes.listStaticRoutes({
         limit: 10,
-        provider: 'across',
+        provider: 'relay',
         sourceAmount: '1000000',
         sourceAmountUnits: 'baseUnits',
         sourceChain: 'base',
@@ -681,56 +518,6 @@ const providersResponseExample = {
   data: FundingRoutes.listProviders(),
 } satisfies z.output<typeof schema.listProviders.Response>
 
-const [fundingQuoteRouteExample] = FundingRoutes.listStaticRoutes({
-  destinationToken: 'USDC.e',
-  limit: 1,
-  provider: 'across',
-  sourceAmount: '1000000',
-  sourceAmountUnits: 'baseUnits',
-  sourceChain: 'base',
-  sourceToken: 'USDC',
-})
-
-const fundingQuoteResponseExample = {
-  destinationChain: fundingQuoteRouteExample!.destinationChain,
-  destinationToken: fundingQuoteRouteExample!.destinationToken,
-  estimatedSeconds: 2,
-  expiresAt: '2026-01-01T00:01:00Z',
-  fees: {
-    total: {
-      amount: '1200',
-      amountUsd: '0.0012',
-      bps: 12,
-      token: {
-        address: fundingQuoteRouteExample!.sourceToken.address,
-        chainId: fundingQuoteRouteExample!.sourceChain.id,
-        decimals: fundingQuoteRouteExample!.sourceToken.decimals,
-        symbol: fundingQuoteRouteExample!.sourceToken.symbol,
-      },
-    },
-    totalMax: {
-      amount: '1800',
-      amountUsd: '0.0018',
-      bps: 18,
-      token: {
-        address: fundingQuoteRouteExample!.sourceToken.address,
-        chainId: fundingQuoteRouteExample!.sourceChain.id,
-        decimals: fundingQuoteRouteExample!.sourceToken.decimals,
-        symbol: fundingQuoteRouteExample!.sourceToken.symbol,
-      },
-    },
-  },
-  inputAmount: '1000000',
-  minimumOutputAmount: '988000',
-  outputAmount: '990000',
-  outputAmountFormatted: '0.99',
-  provider: fundingQuoteRouteExample!.provider,
-  routeId: fundingQuoteRouteExample!.id,
-  sampledAt: '2026-01-01T00:00:00Z',
-  sourceChain: fundingQuoteRouteExample!.sourceChain,
-  sourceToken: fundingQuoteRouteExample!.sourceToken,
-} satisfies z.output<typeof schema.quoteFundingRoute.Response>
-
 /** Mounts funding route discovery and generic provider inventory endpoints. */
 export function funding(options: funding.Options = {}) {
   return new Hono<App.Environment>()
@@ -798,103 +585,6 @@ export function funding(options: funding.Options = {}) {
         }
       },
     )
-    .post(
-      '/v1/funding/routes/quote',
-      Auth.policy({ apiKey: { scopes: ['data:read'] }, mpp: true, public: true }),
-      OpenApi.validate('json', schema.quoteFundingRoute.Body, {
-        code: 'body_invalid',
-        message: 'Invalid quote parameters',
-      }),
-      OpenApi.describeRoute({
-        description:
-          'Gets a depositor-specific exact-input quote for one curated funding route. The response excludes provider transaction calldata, approvals, and wallet balance details.',
-        operationId: 'quoteFundingRoute',
-        responses: OpenApi.responses({
-          errors: {
-            400: { codes: ['body_invalid'] },
-            404: { codes: ['route_not_found', 'quote_unavailable'] },
-            501: { codes: ['provider_unconfigured'] },
-            502: { codes: ['provider_error', 'provider_rate_limited', 'provider_timeout'] },
-          },
-          success: {
-            description: 'Normalized route quote without provider execution payloads.',
-            example: fundingQuoteResponseExample,
-            schema: schema.quoteFundingRoute.Response,
-          },
-        }),
-        summary: 'Quote funding route',
-        tags: ['Funding'],
-      }),
-      async (c) => {
-        if (Auth.narrowAccess) return Auth.paidAccessError(c)
-        if (OpenApi.narrowValidation)
-          return OpenApi.validationError(c, {
-            code: 'body_invalid',
-            message: 'Invalid quote parameters',
-          })
-
-        const body = c.req.valid('json')
-        try {
-          const quote = await FundingRoutes.quoteRoute({
-            depositor: body.depositor,
-            destinationToken: body.destinationToken,
-            provider: body.provider,
-            quote: options.acrossQuote,
-            quoteTimeoutMs: options.quoteTimeoutMs,
-            recipient: body.recipient,
-            sourceAmount: body.sourceAmount,
-            sourceAmountUnits: body.sourceAmountUnits,
-            sourceChain: body.sourceChain,
-            sourceToken: body.sourceToken,
-          })
-          c.header('Cache-Control', 'no-store')
-          return c.json(Response.validated(schema.quoteFundingRoute.Response, quote), 200)
-        } catch (cause) {
-          const message = requestErrorMessage(cause)
-          if (message) return Response.error(c, { code: 'body_invalid', message, status: 400 })
-          if (cause instanceof FundingRoutes.FundingRouteNotFoundError)
-            return Response.error(c, {
-              code: 'route_not_found',
-              message: 'No curated funding route matches the request.',
-              status: 404,
-            })
-          if (cause instanceof FundingRoutes.ProviderQuoteUnavailableError)
-            return Response.error(c, {
-              code: 'quote_unavailable',
-              message: 'The provider cannot quote this route.',
-              status: 404,
-            })
-          if (cause instanceof FundingRoutes.ProviderNotConfiguredError)
-            return Response.error(c, {
-              code: 'provider_unconfigured',
-              message: 'The provider quote integration is not configured.',
-              status: 501,
-            })
-          if (cause instanceof FundingRoutes.ProviderRateLimitError)
-            return Response.error(c, {
-              code: 'provider_rate_limited',
-              message: 'The provider temporarily rate-limited this quote.',
-              status: 502,
-            })
-          if (cause instanceof FundingRoutes.ProviderAdapterTimeoutError)
-            return Response.error(c, {
-              code: 'provider_timeout',
-              message: 'The provider quote timed out.',
-              status: 502,
-            })
-          if (cause instanceof Error) {
-            const providerFailure = FundingRouteProviders.acrossQuoteFailure({ cause })
-            if (providerFailure) c.set('providerFailure', providerFailure)
-            return Response.error(c, {
-              code: 'provider_error',
-              message: 'The provider could not complete the quote.',
-              status: 502,
-            })
-          }
-          throw cause
-        }
-      },
-    )
     .get(
       '/v1/funding/chains',
       Auth.policy({ apiKey: { scopes: ['data:read'] }, mpp: true, public: true }),
@@ -968,7 +658,6 @@ export function funding(options: funding.Options = {}) {
             data: FundingRoutes.listProviders({
               adapters: options.adapters,
               capability: query.capability,
-              configuredProviders: options.acrossQuote ? ['across'] : [],
             }),
           }),
           200,
@@ -980,14 +669,10 @@ export function funding(options: funding.Options = {}) {
 export declare namespace funding {
   /** Options for funding route discovery. */
   type Options = {
-    /** Across explicit quote capability. */
-    acrossQuote?: FundingRoutes.ProviderQuote | undefined
     /** Provider adapters used to enrich static inventory with live data. */
     adapters?: FundingRoutes.ProviderAdapters | undefined
     /** Per-provider quote timeout in milliseconds. */
     adapterTimeoutMs?: number | undefined
-    /** Timeout for depositor-specific provider quotes. */
-    quoteTimeoutMs?: number | undefined
   }
 }
 

package/src/apps/data/routes/indexer.test.ts

@@ -131,14 +131,14 @@ describe('GET /indexer/query', () => {
     const app = TestApp.create({
       rateLimit: { store: rateLimitStore },
       mpp: {
-        charge: {
+        secretKey: 'secret_test_key_0123456789abcdef',
+        session: {
           chainId: Tempo.chain.id,
           currency: Tempo.currency,
           decimals: 6,
           getClient: () => Tempo.client,
           recipient: Tempo.accounts[2].address,
         },
-        secretKey: 'secret_test_key_0123456789abcdef',
       },
     })
     await exhaustQuota(RateLimit.memory({ store: rateLimitStore }), 'public:anonymous', {

package/src/apps/data/routes/webhooks.test.ts

@@ -1100,14 +1100,14 @@ describe('MPP access (disabled for now — API-key-only)', () => {
     const app = TestApp.create({
       auth: { keys: [] },
       mpp: {
-        charge: {
+        secretKey: 'secret_test_key_0123456789abcdef',
+        session: {
           chainId: Tempo.chain.id,
           currency: Tempo.currency,
           decimals: 6,
           getClient: () => Tempo.client,
           recipient: Tempo.accounts[2].address,
         },
-        secretKey: 'secret_test_key_0123456789abcdef',
       },
     })
 

package/src/apps/mcp.test.ts

@@ -91,6 +91,46 @@ async function toolsCall(
   }
 }
 
+/** Searches every page of the progressive tool catalog. */
+async function toolsSearch(host: Host) {
+  const tools: { annotations?: { readOnlyHint?: boolean }; name: string }[] = []
+  let offset = 0
+  while (true) {
+    const result = resultJson(await toolsCall(host, 'search_tools', { limit: 20, offset })) as {
+      nextOffset?: number
+      tools: typeof tools
+    }
+    tools.push(...result.tools)
+    if (result.nextOffset === undefined) return tools
+    offset = result.nextOffset
+  }
+}
+
+/** Loads the complete schema and metadata for one catalog tool. */
+async function toolDetails(host: Host, name: string) {
+  return resultJson(await toolsCall(host, 'get_tool_details', { name })) as {
+    annotations?: { readOnlyHint?: boolean }
+    inputSchema: { properties?: Record<string, { description?: string }> }
+    name: string
+  }
+}
+
+/** Inspects and executes a generated tool through its matching read or write gate. */
+async function generatedToolCall(
+  host: Host,
+  name: string,
+  args: Record<string, unknown>,
+  headers: Record<string, string> = {},
+) {
+  const details = await toolDetails(host, name)
+  return toolsCall(
+    host,
+    details.annotations?.readOnlyHint === true ? 'call_read_tool' : 'call_write_tool',
+    { arguments: args, name },
+    headers,
+  )
+}
+
 /** Parses a tool result: structured content when present, else the JSON text item. */
 function resultJson(result: Awaited<ReturnType<typeof toolsCall>>) {
   return result.structuredContent ?? JSON.parse(result.content[0]!.text)
@@ -108,7 +148,13 @@ test('scopes tools to the data domain', async () => {
   expect(Object.keys(spec.paths).some((path) => path.startsWith('/v1/orgs'))).toBe(true)
 
   await initialize(host)
-  const tools = await toolsList(host)
+  expect(await toolsList(host)).toEqual([
+    'search_tools',
+    'get_tool_details',
+    'call_read_tool',
+    'call_write_tool',
+  ])
+  const tools = (await toolsSearch(host)).map((tool) => tool.name)
 
   expect(tools).toContain('v1_tokens_get')
   expect(tools).toContain('docs_search')
@@ -125,13 +171,8 @@ test('keeps tool input schemas compact', async () => {
   const { host } = createHost()
   await initialize(host)
 
-  const body = await request(host, { id: 2, jsonrpc: '2.0', method: 'tools/list', params: {} })
-  const tools = body.result.tools as {
-    name: string
-    inputSchema: { properties?: Record<string, { description?: string }> }
-  }[]
-  const tool = tools.find((entry) => entry.name === 'v1_tokens_get')
-  const properties = tool?.inputSchema.properties ?? {}
+  const tool = await toolDetails(host, 'v1_tokens_get')
+  const properties = tool.inputSchema.properties ?? {}
 
   // Credential inputs stay off the schema; auth rides the forwarded header.
   expect(properties['authorization']).toBeUndefined()
@@ -142,7 +183,7 @@ test('keeps tool input schemas compact', async () => {
     'Keyset cursor from a previous response `nextCursor`; omit for the first page.',
   )
   // `compact` strips examples from generated schemas.
-  expect(JSON.stringify(tool?.inputSchema)).not.toContain('"examples"')
+  expect(JSON.stringify(tool.inputSchema)).not.toContain('"examples"')
 })
 
 test('executes generated tools against the composed app', async () => {
@@ -152,7 +193,7 @@ test('executes generated tools against the composed app', async () => {
   const { host } = createHost({ app: TestApp.create({ db }) })
 
   await initialize(host)
-  const result = await toolsCall(host, 'v1_tokens_get', { verified: true })
+  const result = await generatedToolCall(host, 'v1_tokens_get', { verified: true })
 
   expect(result.isError).toBeFalsy()
   const body = resultJson(result) as { data: { verified: boolean }[]; nextCursor: unknown }
@@ -164,10 +205,10 @@ test('forwards the caller Authorization header to authenticated tools', async ()
   const { host } = createHost({ app: TestApp.create({ auth: { keys: [reader] } }) })
   await initialize(host)
 
-  const denied = await toolsCall(host, 'v1_webhooks_get', {})
+  const denied = await generatedToolCall(host, 'v1_webhooks_get', {})
   expect(denied.isError).toBe(true)
 
-  const allowed = await toolsCall(
+  const allowed = await generatedToolCall(
     host,
     'v1_webhooks_get',
     {},
@@ -181,7 +222,7 @@ test('proxies docs tool calls to the remote MCP source', async () => {
   const { host } = createHost({ docs: docsStub() })
   await initialize(host)
 
-  const result = await toolsCall(host, 'docs_search', { query: 'fees' })
+  const result = await generatedToolCall(host, 'docs_search', { query: 'fees' })
 
   expect(result.isError).toBeFalsy()
   expect(resultJson(result)).toMatchObject({ hits: ['fees'] })
@@ -210,7 +251,7 @@ test('documents POST /mcp and keeps it open under auth enforcement', async () =>
   // Documenting the route makes it auth-enforced; the public lane keeps it
   // anonymously reachable, and the endpoint never surfaces itself as a tool.
   await initialize(app)
-  const tools = await toolsList(app)
+  const tools = (await toolsSearch(app)).map((tool) => tool.name)
   expect(tools.length).toBeGreaterThan(0)
   expect(tools.some((name) => name.startsWith('mcp'))).toBe(false)
 

package/src/apps/mcp.ts

@@ -147,7 +147,9 @@ export function mcp(options: mcp.Options) {
                 example: {
                   jsonrpc: '2.0',
                   id: 1,
-                  result: { tools: [{ name: 'v1_tokens_get', description: 'List tokens' }] },
+                  result: {
+                    tools: [{ name: 'search_tools', description: 'Search available tools' }],
+                  },
                 },
                 schema: OpenApi.resolver(schema.Response),
               },

package/src/cloudflare.ts

@@ -26,6 +26,11 @@ export class DurableObject extends CloudflareDurableObject {
     await this.#store.delete(key)
   }
 
+  /** Deletes a key only when its value matches `expected`. */
+  async deleteIf(key: string, expected: null | string) {
+    return this.#store.deleteIf!(key, expected)
+  }
+
   /** Gets a string value. Returns `null` for missing or expired keys. */
   async get(key: string) {
     return this.#store.get(key)