tapimo 0.4.4 → 0.5.0

package/src/apps/data/routes/indexer.test.ts

@@ -1,12 +1,17 @@
+import { Challenge } from 'mppx'
+import { sessionManager } from 'mppx/client'
 import { RateLimit, Store } from 'tapimo'
+import { Actions } from 'viem/tempo'
 import * as TestApp from '../../../../test/App.js'
 import * as Mppx from '../../../../test/Mppx.js'
 import * as Runtime from '../../../../test/runtime.js'
 import * as Tempo from '../../../../test/Tempo.js'
 import * as Tidx from '../../../internal/Tidx.js'
+import * as Viem from '../../../internal/Viem.js'
 import * as Indexer from './indexer.js'
 
-const chainId = String(Runtime.get().chainId)
+const runtime = Runtime.get()
+const chainId = String(runtime.chainId)
 
 describe('GET /indexer/query', () => {
   test('proxies a query to the upstream indexer', async () => {
@@ -54,6 +59,42 @@ describe('GET /indexer/query', () => {
     expect(body.rows[0]?.[0]).toBe(value)
   })
 
+  test('routes Zone queries to the Zone TIDX with its basic auth', async () => {
+    const zone = runtime.zone.chainId
+    const zoneReader = {
+      id: 'key_zone_indexer',
+      orgId: 'org_test',
+      scopes: ['data:read', 'indexer:query', `zone:${zone}:read`],
+      token: 'secret_zone_indexer',
+    } satisfies TestApp.kvStore.Key
+    const fetch = vi.spyOn(globalThis, 'fetch').mockResolvedValue(
+      new Response(JSON.stringify({ columns: [], ok: true, row_count: 0, rows: [] }), {
+        headers: { 'content-type': 'application/json' },
+      }),
+    )
+    try {
+      const client = TestApp.client({
+        auth: { keys: [zoneReader] },
+        tidx: ({ chainId }) =>
+          chainId === zone
+            ? { baseUrl: 'https://zone.tidx.test', basicAuth: 'zone-secret' }
+            : { baseUrl: 'https://public.tidx.test', basicAuth: 'public-secret' },
+        zones: [{ chainId: zone, forwardRpcUrl: runtime.zone.forwardRpcUrl }],
+      })
+      const response = await client.v1.indexer.query.$get(
+        { query: { chainId: String(zone), sql: 'select 1' } },
+        { headers: { authorization: `Bearer ${zoneReader.token}` } },
+      )
+      const upstream = fetch.mock.calls[0]![0] as Request
+
+      expect(response.status).toBe(200)
+      expect(new URL(upstream.url).origin).toBe('https://zone.tidx.test')
+      expect(upstream.headers.get('authorization')).toBe('Basic em9uZS1zZWNyZXQ=')
+    } finally {
+      fetch.mockRestore()
+    }
+  })
+
   test('bounds and caches buffered queries', async () => {
     // Stub the upstream so the injected execution bounds are observable on the
     // outgoing request; the auth path is in-memory and never touches fetch.
@@ -167,6 +208,61 @@ describe('GET /indexer/query', () => {
     expect(paid.headers.has('payment-receipt')).toMatchInlineSnapshot(`true`)
     expect(body.ok).toMatchInlineSnapshot(`true`)
   })
+
+  test('accepts session management POSTs', { timeout: 120_000 }, async () => {
+    const rateLimitStore = Store.memory()
+    const app = TestApp.create({
+      rateLimit: { store: rateLimitStore },
+      mpp: {
+        secretKey: 'secret_test_key_0123456789abcdef',
+        session: {
+          account: Tempo.accounts[2],
+          chainId: Viem.chainId.mainnet,
+          currency: Tempo.currency,
+          decimals: 6,
+          getClient: () => Tempo.client,
+          suggestedDeposit: '0.01',
+        },
+      },
+    })
+    await exhaustQuota(RateLimit.memory({ store: rateLimitStore }), 'public:anonymous', {
+      perMinute: 60,
+    })
+    await Actions.faucet.fundSync(Tempo.client, {
+      account: Tempo.accounts[2],
+      timeout: 60_000,
+    })
+
+    const url = `http://tempo-api.test/v1/indexer/query?sql=select%201&chainId=${chainId}`
+    const challenged = await app.fetch(new Request(url))
+    expect(challenged.status).toMatchInlineSnapshot(`402`)
+    expect(Challenge.fromHeaders(challenged.headers).request).toMatchObject({
+      amount: '100',
+      suggestedDeposit: '10000',
+    })
+
+    const manager = sessionManager({
+      account: Tempo.accounts[1],
+      client: Tempo.client,
+      fetch: async (input, init) => app.fetch(new Request(input, init)),
+    })
+    const paid = await manager.fetch(url)
+    expect(paid.status).toMatchInlineSnapshot(`200`)
+
+    const toppedUp = await manager.topUp('0.01')
+    if (!toppedUp) throw new Error('expected top-up receipt')
+    expect(toppedUp.status).toMatchInlineSnapshot(`"success"`)
+
+    const closed = await manager.close()
+    if (!closed) throw new Error('expected close receipt')
+    expect(closed.status).toMatchInlineSnapshot(`"success"`)
+    expect(closed.channelId).toBe(toppedUp.channelId)
+
+    const state = await Actions.channel.getStates(Tempo.client, {
+      channel: closed.channelId,
+    })
+    expect(state.deposit).toMatchInlineSnapshot(`0n`)
+  })
 })
 
 async function exhaustQuota(rateLimit: RateLimit.Store, key: string, limit: RateLimit.Limit) {

package/src/apps/data/routes/rpc.test.ts

@@ -1,8 +1,43 @@
+import { Hex, Secp256k1 } from 'ox'
+import { ZoneRpcAuthentication } from 'ox/tempo'
+
 import type * as Viem from '../../../internal/Viem.js'
+import * as RequestListener from '../../../handlers/internal/requestListener.js'
 import * as TestApp from '../../../../test/App.js'
+import * as Relay from '../../../../test/Relay.js'
 import * as Runtime from '../../../../test/runtime.js'
 
 const runtime = Runtime.get()
+const zone = runtime.zone.chainId
+const zoneOptions = {
+  chainId: zone,
+  forwardRpcUrl: runtime.zone.forwardRpcUrl,
+}
+const zoneReader = {
+  id: 'key_zone_reader',
+  orgId: 'org_test',
+  scopes: ['data:read', `zone:${zone}:read`],
+  token: 'secret_zone_reader',
+} satisfies TestApp.kvStore.Key
+
+// Prool's default Zone dev key.
+const zonePrivateKey = '0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80'
+
+function zoneToken() {
+  const issuedAt = Math.floor(Date.now() / 1_000)
+  const authentication = ZoneRpcAuthentication.from({
+    chainId: zone,
+    expiresAt: issuedAt + 300,
+    issuedAt,
+    zoneId: 1,
+  })
+  return ZoneRpcAuthentication.serialize(authentication, {
+    signature: Secp256k1.sign({
+      payload: ZoneRpcAuthentication.getSignPayload(authentication),
+      privateKey: zonePrivateKey,
+    }),
+  })
+}
 
 describe('POST /rpc', () => {
   test('routes by principal: a resolver sees the request principal and routes accordingly', async () => {
@@ -65,6 +100,7 @@ describe('POST /rpc', () => {
             'content-type': 'application/json',
             cookie: 'session=secret',
             'tempo-api-key': 'caller-key',
+            'x-authorization-token': 'zone-secret',
             'x-client-trace': 'trace_test',
           },
           method: 'POST',
@@ -90,6 +126,7 @@ describe('POST /rpc', () => {
       expect(call.headers['authorization']).toMatchInlineSnapshot(`"Basic cnBjLXNlY3JldA=="`)
       expect(call.headers['cookie']).toMatchInlineSnapshot(`null`)
       expect(call.headers['tempo-api-key']).toMatchInlineSnapshot(`null`)
+      expect(call.headers['x-authorization-token']).toBeNull()
       expect(call.headers['x-client-trace']).toMatchInlineSnapshot(`"trace_test"`)
     } finally {
       fetch.restore()
@@ -267,6 +304,187 @@ describe('POST /rpc', () => {
     }
   })
 
+  test('proxies zone chain ids and forwards the caller zone auth token', async () => {
+    const fetch = mockRpc()
+
+    try {
+      const app = TestApp.create({
+        auth: false,
+        zones: [{ chainId: zone, forwardRpcUrl: `https://${zone}.rpc.test` }],
+      })
+
+      const response = await app.fetch(
+        new Request(`http://tempo-api.test/rpc/${zone}`, {
+          body: JSON.stringify({ id: 1, jsonrpc: '2.0', method: 'eth_getBalance' }),
+          headers: {
+            authorization: 'Bearer caller-secret',
+            'x-authorization-token': 'zone-token',
+          },
+          method: 'POST',
+        }),
+      )
+      const call = fetch.calls[0]!
+
+      expect(response.status).toMatchInlineSnapshot(`200`)
+      expect(call.url).toBe(`https://${zone}.rpc.test/`)
+      // Zone RPC auth: the caller's signed token passes through; the API's own
+      // credentials do not leak upstream.
+      expect(call.headers['x-authorization-token']).toMatchInlineSnapshot(`"zone-token"`)
+      expect(call.headers['authorization']).toBeNull()
+      expect(call.headers['tempo-api-key']).toMatchInlineSnapshot(`null`)
+    } finally {
+      fetch.restore()
+    }
+  })
+
+  test('refuses a zone rpc call without a zone scope or auth token', async () => {
+    const fetch = mockRpc()
+
+    try {
+      const app = TestApp.create({
+        auth: false,
+        zones: [{ chainId: zone, forwardRpcUrl: `https://${zone}.rpc.test` }],
+      })
+
+      const response = await app.fetch(
+        new Request(`http://tempo-api.test/rpc/${zone}`, {
+          body: JSON.stringify({ id: 1, jsonrpc: '2.0', method: 'eth_getBalance' }),
+          method: 'POST',
+        }),
+      )
+      const body = (await response.json()) as { error: { code: string; message: string } }
+
+      expect(response.status).toBe(403)
+      expect(body.error.code).toBe('api_key_forbidden')
+      expect(body.error.message).toContain(`zone:${zone}:read`)
+      // Refused before any upstream round-trip.
+      expect(fetch.calls).toHaveLength(0)
+    } finally {
+      fetch.restore()
+    }
+  })
+
+  test('routes Zone-scoped reads to the internal RPC', async () => {
+    const app = TestApp.create({ auth: { keys: [zoneReader] }, zones: [zoneOptions] })
+    const response = await app.fetch(
+      new Request(`http://tempo-api.test/rpc/${zone}`, {
+        body: JSON.stringify({ id: 1, jsonrpc: '2.0', method: 'eth_chainId' }),
+        headers: { 'content-type': 'application/json', 'tempo-api-key': zoneReader.token },
+        method: 'POST',
+      }),
+    )
+
+    expect(response.status).toBe(200)
+    expect(await response.json()).toMatchObject({ result: Hex.fromNumber(zone) })
+  })
+
+  test('allows Zone-scoped eth_fillTransaction calls', async () => {
+    const app = TestApp.create({ auth: { keys: [zoneReader] }, zones: [zoneOptions] })
+    const response = await app.fetch(
+      new Request(`http://tempo-api.test/rpc/${zone}`, {
+        body: JSON.stringify({ id: 1, jsonrpc: '2.0', method: 'eth_fillTransaction' }),
+        headers: { 'content-type': 'application/json', 'tempo-api-key': zoneReader.token },
+        method: 'POST',
+      }),
+    )
+
+    expect(response.status).toBe(200)
+  })
+
+  test('forwards RPC basic auth to the internal Zone RPC', async () => {
+    const authorization: (string | null)[] = []
+    const server = await Relay.createServer(
+      RequestListener.fromFetchHandler(async (request) => {
+        authorization.push(request.headers.get('authorization'))
+        return Response.json({ id: 1, jsonrpc: '2.0', result: Hex.fromNumber(zone) })
+      }),
+    )
+    try {
+      const app = TestApp.create({
+        auth: { keys: [zoneReader] },
+        rpc: ({ chainId }) =>
+          chainId === zone ? { basicAuth: 'rpc-secret', url: server.url } : {},
+        zones: [zoneOptions],
+      })
+      const response = await app.fetch(
+        new Request(`http://tempo-api.test/rpc/${zone}`, {
+          body: JSON.stringify({ id: 1, jsonrpc: '2.0', method: 'eth_chainId' }),
+          headers: { 'content-type': 'application/json', 'tempo-api-key': zoneReader.token },
+          method: 'POST',
+        }),
+      )
+
+      expect(response.status).toBe(200)
+      expect(authorization).toEqual(['Basic cnBjLXNlY3JldA=='])
+    } finally {
+      await server.closeAsync()
+    }
+  })
+
+  test('rejects Zone-scoped writes before the internal RPC', async () => {
+    const app = TestApp.create({ auth: { keys: [zoneReader] }, zones: [zoneOptions] })
+    const response = await app.fetch(
+      new Request(`http://tempo-api.test/rpc/${zone}`, {
+        body: JSON.stringify({ id: 1, jsonrpc: '2.0', method: 'eth_sendRawTransaction' }),
+        headers: { 'content-type': 'application/json', 'tempo-api-key': zoneReader.token },
+        method: 'POST',
+      }),
+    )
+
+    expect(response.status).toBe(403)
+    expect(await response.json()).toMatchObject({ error: { code: 'api_key_forbidden' } })
+  })
+
+  test('rejects a Zone-scoped batch containing a write', async () => {
+    const app = TestApp.create({ auth: { keys: [zoneReader] }, zones: [zoneOptions] })
+    const response = await app.fetch(
+      new Request(`http://tempo-api.test/rpc/${zone}`, {
+        body: JSON.stringify([
+          { id: 1, jsonrpc: '2.0', method: 'eth_chainId' },
+          { id: 2, jsonrpc: '2.0', method: 'eth_sendRawTransaction' },
+        ]),
+        headers: { 'content-type': 'application/json', 'tempo-api-key': zoneReader.token },
+        method: 'POST',
+      }),
+    )
+
+    expect(response.status).toBe(403)
+    expect(await response.json()).toMatchObject({ error: { code: 'api_key_forbidden' } })
+  })
+
+  test('routes caller Zone tokens to the private RPC', async () => {
+    const app = TestApp.create({ auth: false, zones: [zoneOptions] })
+    const response = await app.fetch(
+      new Request(`http://tempo-api.test/rpc/${zone}`, {
+        body: JSON.stringify({ id: 1, jsonrpc: '2.0', method: 'eth_chainId' }),
+        headers: {
+          'content-type': 'application/json',
+          [ZoneRpcAuthentication.headerName]: zoneToken(),
+        },
+        method: 'POST',
+      }),
+    )
+
+    expect(response.status).toBe(200)
+    expect(await response.json()).toMatchObject({ result: Hex.fromNumber(zone) })
+  })
+
+  test('rejects invalid Zone tokens at the private RPC', async () => {
+    const app = TestApp.create({ auth: false, zones: [zoneOptions] })
+    const response = await app.fetch(
+      new Request(`http://tempo-api.test/rpc/${zone}`, {
+        body: JSON.stringify({ id: 1, jsonrpc: '2.0', method: 'eth_chainId' }),
+        headers: {
+          'content-type': 'application/json',
+          [ZoneRpcAuthentication.headerName]: 'invalid',
+        },
+        method: 'POST',
+      }),
+    )
+
+    expect(response.status).toBe(403)
+  })
+
   test('rejects invalid chain ids before proxying upstream', async () => {
     const fetch = mockRpc()
 
@@ -520,6 +738,7 @@ function mockRpc() {
         authorization: request.headers.get('authorization'),
         cookie: request.headers.get('cookie'),
         'tempo-api-key': request.headers.get('tempo-api-key'),
+        'x-authorization-token': request.headers.get('x-authorization-token'),
         'x-client-trace': request.headers.get('x-client-trace'),
       },
       method: request.method,

package/src/apps/data/routes/rpc.ts

@@ -1,4 +1,5 @@
 import { Hono, type Context, type TypedResponse } from 'hono'
+import { ZoneRpcAuthentication } from 'ox/tempo'
 import * as z from 'zod/mini'
 
 import type * as App from '../../../App.js'
@@ -19,10 +20,52 @@ const strippedHeaders = new Set([
   'keep-alive',
   'proxy-authorization',
   'te',
+  'tempo-api-key',
   'trailer',
   'transfer-encoding',
   'upgrade',
-  'tempo-api-key',
+  ZoneRpcAuthentication.headerName.toLowerCase(),
+])
+
+// API-issued Zone read scopes never reach stateful or privileged RPC modules.
+const zoneReadMethods = new Set([
+  'eth_blobBaseFee',
+  'eth_blockNumber',
+  'eth_call',
+  'eth_chainId',
+  'eth_createAccessList',
+  'eth_estimateGas',
+  'eth_feeHistory',
+  'eth_fillTransaction',
+  'eth_gasPrice',
+  'eth_getBalance',
+  'eth_getBlockByHash',
+  'eth_getBlockByNumber',
+  'eth_getBlockReceipts',
+  'eth_getBlockTransactionCountByHash',
+  'eth_getBlockTransactionCountByNumber',
+  'eth_getCode',
+  'eth_getLogs',
+  'eth_getProof',
+  'eth_getRawTransactionByHash',
+  'eth_getStorageAt',
+  'eth_getTransactionByBlockHashAndIndex',
+  'eth_getTransactionByBlockNumberAndIndex',
+  'eth_getTransactionByHash',
+  'eth_getTransactionCount',
+  'eth_getTransactionReceipt',
+  'eth_getUncleByBlockHashAndIndex',
+  'eth_getUncleByBlockNumberAndIndex',
+  'eth_getUncleCountByBlockHash',
+  'eth_getUncleCountByBlockNumber',
+  'eth_maxPriorityFeePerGas',
+  'eth_simulateV1',
+  'eth_syncing',
+  'net_listening',
+  'net_peerCount',
+  'net_version',
+  'web3_clientVersion',
+  'web3_sha3',
 ])
 
 /** Never reached; carries typed passthrough response variants into Hono client inference. */
@@ -105,7 +148,7 @@ export function rpc() {
     Auth.policy({ apiKey: { scopes: ['data:read'] }, public: true }),
     OpenApi.describeRoute({
       description:
-        'Sends a single or batch Ethereum JSON-RPC request directly to Tempo. Use `/rpc/testnet`, `/rpc/mainnet`, or `/rpc/:chain` to choose a chain. This passthrough is not part of the stable API contract and is supported on a best-effort basis only. It has no compatibility, latency, availability, or data-freshness guarantees, and breaking changes may happen with limited notice.',
+        'Sends a single or batch Ethereum JSON-RPC request directly to Tempo. Use `/rpc/testnet`, `/rpc/mainnet`, or `/rpc/:chain` to choose a chain. Zone-scoped API keys may call read-only methods. A Zone token in `X-Authorization-Token` is forwarded to the authenticated Zone RPC. This passthrough is not part of the stable API contract and is supported on a best-effort basis only. It has no compatibility, latency, availability, or data-freshness guarantees, and breaking changes may happen with limited notice.',
       operationId: 'rpcRequest',
       parameters: [
         {
@@ -146,19 +189,6 @@ export function rpc() {
     async (c) => {
       if (Auth.narrowAccess) return Auth.accessError(c)
 
-      if (requiresApiKey(c)) {
-        const body = await c.req.raw
-          .clone()
-          .json()
-          .catch(() => undefined)
-        if (!isPublicRequest(body))
-          return Response.error(c, {
-            code: 'api_key_missing',
-            message: 'Missing API key',
-            status: 401,
-          })
-      }
-
       const chainId = resolveChainId(c)
       if (!chainId)
         return Response.error(c, {
@@ -167,6 +197,31 @@ export function rpc() {
           status: 400,
         })
 
+      const zone = c.get('zones').get(chainId)
+      const zoneToken = getZoneToken(c)
+      const apiKeyRequired = requiresApiKey(c)
+      const inspectBody = apiKeyRequired || Boolean(zone && !zoneToken)
+      const body = inspectBody
+        ? await c.req.raw
+            .clone()
+            .json()
+            .catch(() => undefined)
+        : undefined
+
+      if (apiKeyRequired && !isPublicRequest(body))
+        return Response.error(c, {
+          code: 'api_key_missing',
+          message: 'Missing API key',
+          status: 401,
+        })
+      if (zone && !zoneToken && !isZoneReadRequest(body))
+        return Response.error(c, {
+          code: 'api_key_forbidden',
+          message:
+            'Zone API keys may only call read-only RPC methods. Pass a Zone token via `X-Authorization-Token` for other methods.',
+          status: 403,
+        })
+
       if (narrowPassthrough)
         return c.json(Response.validated(schema.ResponseBody, { jsonrpc: '2.0' }), 200)
       return passthrough(c, chainId)
@@ -180,6 +235,11 @@ function requiresApiKey(c: Context<App.Environment>) {
   return principal?.type !== 'api_key' && principal?.type !== 'super_admin'
 }
 
+function getZoneToken(c: Context<App.Environment>) {
+  const value = c.req.header(ZoneRpcAuthentication.headerName)
+  return value?.trim() ? value : undefined
+}
+
 function isPublicRequest(body: unknown): boolean {
   const requests = Array.isArray(body) ? body : [body]
   return requests.length > 0 && requests.every((request) => isPublicMethod(request))
@@ -191,13 +251,27 @@ function isPublicMethod(request: unknown): boolean {
   return typeof method === 'string' && method.startsWith('eth_')
 }
 
+function isZoneReadRequest(body: unknown): boolean {
+  const requests = Array.isArray(body) ? body : [body]
+  return requests.length > 0 && requests.every((request) => isZoneReadMethod(request))
+}
+
+function isZoneReadMethod(request: unknown): boolean {
+  if (!request || typeof request !== 'object') return false
+  const method = (request as Record<string, unknown>)['method']
+  return typeof method === 'string' && zoneReadMethods.has(method)
+}
+
 async function passthrough(
   c: Context<App.Environment>,
   chainId: z.output<typeof Schema.ChainId>,
 ): Promise<globalThis.Response & TypedResponse<never, never, never>> {
-  const rpc = c.get('rpc')
+  const zone = c.get('zones').get(chainId)
+  const zoneToken = getZoneToken(c)
+  const rpc = zone && zoneToken ? { url: () => zone.forwardRpcUrl } : c.get('rpc')
   const principal = Auth.getPrincipal(c)
-  const upstream_rpc = principal?.type === 'public' && typeof rpc !== 'function' ? undefined : rpc
+  const upstream_rpc =
+    !zone && principal?.type === 'public' && typeof rpc !== 'function' ? undefined : rpc
   // Anonymous callers use the built-in public RPC unless a resolver chooses a
   // different public upstream.
   const { basicAuth, url } = Viem.resolve(upstream_rpc, { chainId, principal })
@@ -215,6 +289,7 @@ async function passthrough(
   for (const [name, value] of c.req.raw.headers)
     if (!strippedHeaders.has(name.toLowerCase())) headers.set(name, value)
   if (basicAuth) headers.set('authorization', `Basic ${btoa(basicAuth)}`)
+  if (zone && zoneToken) headers.set(ZoneRpcAuthentication.headerName, zoneToken)
 
   // `duplex` is required when streaming a request body, but is not yet in
   // the DOM `RequestInit` type.

package/src/apps/data/routes/webhooks.test.ts

@@ -112,6 +112,27 @@ describe('access matrix', () => {
     expect(body.error?.code).toMatchInlineSnapshot(`"api_key_forbidden"`)
   })
 
+  test('rejects Zone webhook subscriptions', async () => {
+    const zone = 421_700_001
+    const app = TestApp.client({
+      auth: { keys: [writer] },
+      zones: [
+        {
+          chainId: zone,
+          forwardRpcUrl: 'https://zone.rpc.test',
+        },
+      ],
+    })
+    const response = await app.v1.webhooks.$post(
+      { json: { ...validBody, chainId: zone } },
+      as(writer),
+    )
+    const body = (await response.json()) as { error?: { code?: string } }
+
+    expect(response.status).toBe(400)
+    expect(body.error?.code).toBe('chain_id_unsupported')
+  })
+
   test('lists event types without authentication (public catalog)', async () => {
     // `GET /webhooks/event-types` is intentionally public: anonymous callers are
     // served within the public quota, no key or scope required.

package/src/apps/data/routes/webhooks.ts

@@ -1294,7 +1294,13 @@ export function webhooks(options: webhooks.Options = {}) {
           hide: hidden,
           operationId: 'createWebhook',
           responses: OpenApi.responses({
-            errors: { 403: 'You have reached the webhook subscription limit.' },
+            errors: {
+              400: {
+                codes: ['chain_id_unsupported'],
+                description: 'Webhook subscriptions do not support Zone chains.',
+              },
+              403: 'You have reached the webhook subscription limit.',
+            },
             success: {
               description:
                 'The created webhook subscription, including the one-time signing secret.',
@@ -1320,6 +1326,12 @@ export function webhooks(options: webhooks.Options = {}) {
 
           const body = c.req.valid('json')
           const chainId = body.chainId ?? c.get('chainId')
+          if (c.get('zones').has(chainId))
+            return Response.error(c, {
+              code: 'chain_id_unsupported',
+              message: 'Webhook subscriptions do not support Zone chains.',
+              status: 400,
+            })
 
           try {
             const subscription = await Webhooks.createSubscription(

package/src/apps/index.ts

@@ -1,4 +1,4 @@
-export { data, FundingRouteProviders } from './data/index.js'
+export { data, FundingQuoteProviders } from './data/index.js'
 export { management } from './management/index.js'
 export { mcp } from './mcp.js'
 export { relay } from './relay/index.js'

package/src/apps/management/App.ts

@@ -7,6 +7,7 @@ import * as Metadata from '../metadata.js'
 import { apiKeys } from './routes/api-keys.js'
 import { billing } from './routes/billing.js'
 import { invitations } from './routes/invitations.js'
+import { inviteLinks } from './routes/invite-links.js'
 import { me } from './routes/me.js'
 import { members } from './routes/members.js'
 import { orgs } from './routes/orgs.js'
@@ -105,6 +106,7 @@ export function management(options: management.Options = {}) {
     .route('/', apiKeys({ enabled: options.apiKeys !== false }))
     .route('/', billing())
     .route('/', invitations())
+    .route('/', inviteLinks())
     .route('/', me())
     .route('/', members())
     .route('/', orgs())
@@ -144,6 +146,7 @@ const openapi = {
     { name: 'API Keys', description: 'Credentials for accessing the Tempo API.' },
     { name: 'Billing', description: 'Organization billing backed by Stripe.' },
     { name: 'Invitations', description: 'Pending organization invitations.' },
+    { name: 'Invite Links', description: 'Reusable organization invite links.' },
     { name: 'Members', description: 'Organization team membership.' },
     { name: 'Organizations', description: 'Teams that own application workspaces and members.' },
     { name: 'Projects', description: 'Application workspaces within an organization.' },
@@ -158,6 +161,7 @@ const openapi = {
         'Authentication',
         'Billing',
         'Invitations',
+        'Invite Links',
         'Members',
         'Organizations',
         'Projects',