tapimo 0.5.0 → 0.5.2

package/src/apps/data/routes/funding.test.ts

@@ -1,6 +1,7 @@
 import { Schema } from 'tapimo'
 
 import type * as FundingQuotes from '../../../internal/FundingQuotes.js'
+import type * as Log from '../../../internal/Log.js'
 import * as TestApp from '../../../../test/App.js'
 import * as Funding from './funding.js'
 
@@ -27,22 +28,59 @@ describe('GET /funding/quotes', () => {
   })
 
   test('queries only the requested provider', async () => {
-    let calls = 0
+    let acrossCalls = 0
+    let relayCalls = 0
     const app = TestApp.create({
       funding: {
         adapters: {
+          across: acrossAdapter(() => {
+            acrossCalls += 1
+          }),
           relay: relayAdapter(() => {
-            calls += 1
+            relayCalls += 1
           }),
         },
       },
     })
-    const response = await app.request(quoteUrl({ ...baseUsdcQuery, provider: 'relay' }), {
+    const response = await app.request(quoteUrl({ ...baseUsdcQuery, provider: 'across' }), {
       headers: TestApp.auth.headers,
     })
 
     expect(response.status).toBe(200)
-    expect(calls).toBe(1)
+    expect(acrossCalls).toBe(1)
+    expect(relayCalls).toBe(0)
+    const body = await TestApp.json(response, Funding.schema.quoteFunding.Response)
+    expect(body.data[0]?.quote.expiresAt).toBe('2026-01-01T00:01:00Z')
+  })
+
+  test('returns non-EVM Rhino quotes with stable chain and token ids', async () => {
+    const app = TestApp.create({ funding: { adapters: { rhino: rhinoAdapter() } } })
+    const response = await app.request(
+      quoteUrl({
+        destinationToken: 'USDC.e',
+        provider: 'rhino',
+        sourceAmount: '1000000',
+        sourceChain: 'solana',
+        sourceToken: 'USDC',
+      }),
+      { headers: TestApp.auth.headers },
+    )
+
+    expect(response.status).toBe(200)
+    const body = await TestApp.json(response, Funding.schema.quoteFunding.Response)
+    expect(body.data[0]).toMatchObject({
+      id: 'solana-usdc-tempo-usdce-rhino',
+      provider: { id: 'rhino' },
+      sourceChain: {
+        addressFormat: 'base58',
+        id: 'solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp',
+        kind: 'solana',
+      },
+      sourceToken: {
+        tokenKey:
+          'solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp/token:EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v',
+      },
+    })
   })
 
   test('returns an empty list when no provider is configured', async () => {
@@ -90,6 +128,72 @@ describe('GET /funding/quotes', () => {
     expect(body.error.code).toBe('upstream_error')
   })
 
+  test('logs provider quote deadlines as timeouts', async () => {
+    const entries: Log.Entry[] = []
+    const app = TestApp.create({
+      funding: {
+        adapterTimeoutMs: 1,
+        adapters: {
+          across: {
+            probeQuote() {
+              return new Promise<FundingQuotes.QuoteProbeResult>(() => {})
+            },
+          },
+        },
+      },
+      logger: (entry) => {
+        entries.push(entry)
+      },
+    })
+
+    const response = await app.request(quoteUrl({ ...baseUsdcQuery, provider: 'across' }), {
+      headers: TestApp.auth.headers,
+    })
+
+    expect(response.status).toBe(502)
+    expect(entries[0]?.provider).toEqual({
+      failure: 'timeout',
+      id: 'across',
+      operation: 'swap/approval',
+    })
+  })
+
+  test('logs every failure when multiple providers fail', async () => {
+    const entries: Log.Entry[] = []
+    const app = TestApp.create({
+      funding: {
+        adapters: {
+          across: {
+            async probeQuote() {
+              throw new TypeError('Across network failure')
+            },
+          },
+          relay: {
+            async probeQuote() {
+              throw new Error('Relay failure')
+            },
+          },
+        },
+      },
+      logger: (entry) => {
+        entries.push(entry)
+      },
+    })
+
+    const response = await app.request(quoteUrl(), { headers: TestApp.auth.headers })
+
+    expect(response.status).toBe(502)
+    expect(entries[0]?.provider).toEqual({
+      failure: 'network',
+      id: 'across',
+      operation: 'swap/approval',
+    })
+    expect(entries[0]?.providerFailures).toEqual([
+      { failure: 'network', id: 'across', operation: 'swap/approval' },
+      { failure: 'unknown', id: 'relay', operation: 'quote/v2' },
+    ])
+  })
+
   test('rejects successful provider results without output amounts', async () => {
     const app = TestApp.create({
       funding: {
@@ -126,9 +230,9 @@ describe('GET /funding/quotes', () => {
     expect(body.error.code).toBe('query_invalid')
   })
 
-  test('rejects source chains without a live quote adapter', async () => {
+  test('rejects unsupported source chains', async () => {
     const response = await TestApp.create().request(
-      quoteUrl({ ...baseUsdcQuery, sourceChain: 'solana' }),
+      quoteUrl({ ...baseUsdcQuery, sourceChain: 'bitcoin' }),
       { headers: TestApp.auth.headers },
     )
     expect(response.status).toBe(400)
@@ -151,7 +255,13 @@ describe('GET /funding/chains', () => {
     expect(response.status).toBe(200)
     const body = await TestApp.json(response, Funding.schema.listFundingChains.Response)
 
-    expect(body.data.map((chain) => chain.id)).toEqual(['eip155:1', 'eip155:8453', 'eip155:56'])
+    expect(body.data.map((chain) => chain.id)).toEqual([
+      'eip155:1',
+      'eip155:8453',
+      'eip155:56',
+      'solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp',
+      'tron:0x2b6653dc',
+    ])
     expect(body.data.flatMap((chain) => chain.tokens.map((token) => token.symbol))).toEqual(
       expect.arrayContaining(['USDC', 'USDT']),
     )
@@ -168,6 +278,13 @@ describe('GET /funding/providers', () => {
     const body = await TestApp.json(response, Funding.schema.listProviders.Response)
 
     expect(body.data).toEqual([
+      {
+        id: 'across',
+        kind: 'intentBridge',
+        name: 'Across',
+        requiresApiKey: true,
+        status: 'unconfigured',
+      },
       {
         id: 'relay',
         kind: 'solverNetwork',
@@ -175,6 +292,20 @@ describe('GET /funding/providers', () => {
         requiresApiKey: false,
         status: 'configured',
       },
+      {
+        id: 'rhino',
+        kind: 'bridge',
+        name: 'Rhino',
+        requiresApiKey: false,
+        status: 'unconfigured',
+      },
+      {
+        id: 'squid',
+        kind: 'solverNetwork',
+        name: 'Squid',
+        requiresApiKey: true,
+        status: 'unconfigured',
+      },
     ])
   })
 
@@ -222,3 +353,46 @@ function relayAdapter(onProbe: () => void = () => {}): FundingQuotes.ProviderAda
     },
   }
 }
+
+function acrossAdapter(onProbe: () => void = () => {}): FundingQuotes.ProviderAdapter {
+  return {
+    async probeQuote(input, signal) {
+      onProbe()
+      expect(signal.aborted).toBe(false)
+      expect(input.candidate.id).toBe('base-usdc-tempo-usdce-across')
+      return {
+        expiresAt: '2026-01-01T00:01:00Z',
+        minimumOutputAmount: '988000',
+        outputAmount: '990000',
+        outputAmountFormatted: '0.99',
+        quality: {
+          estimatedSeconds: 2,
+          liquiditySource: 'providerQuote',
+          sourceDetail: 'across:swap-approval',
+          tier: 'liquid',
+        },
+        sampledAt: '2026-01-01T00:00:00Z',
+        status: 'available',
+      }
+    },
+  }
+}
+
+function rhinoAdapter(): FundingQuotes.ProviderAdapter {
+  return {
+    async probeQuote(input, signal) {
+      expect(signal.aborted).toBe(false)
+      expect(input.candidate.id).toBe('solana-usdc-tempo-usdce-rhino')
+      return {
+        outputAmount: '983000',
+        quality: {
+          liquiditySource: 'providerQuote',
+          sourceDetail: 'rhino:bridge-swap-public',
+          tier: 'liquid',
+        },
+        sampledAt: '2026-01-01T00:00:00Z',
+        status: 'available',
+      }
+    },
+  }
+}

package/src/apps/data/routes/funding.ts

@@ -8,6 +8,7 @@ import * as FundingQuotes from '../../../internal/FundingQuotes.js'
 import * as OpenApi from '../../../internal/OpenApi.js'
 import * as Response from '../../../internal/Response.js'
 import * as Schema from '../../../internal/Schema.js'
+import * as FundingQuoteProviders from '../FundingQuoteProviders.js'
 
 /** Zod schemas owned by funding quote resources. */
 export namespace schema {
@@ -15,7 +16,7 @@ export namespace schema {
   export const Chain = Schema.describe(
     z.object({
       addressFormat: z
-        .literal('evm')
+        .enum(['base58', 'base58check', 'evm'])
         .check(
           z.describe('Address family used by accounts and token identifiers on this chain.'),
           z.meta({ examples: ['evm'] }),
@@ -24,12 +25,12 @@ export namespace schema {
         .string()
         .check(
           z.describe(
-            'Stable CAIP-2 chain id, represented as a string instead of the numeric `chainId` used elsewhere.',
+            'Stable chain id. Uses CAIP-2 where standardized and a Tempo-defined compatible id otherwise.',
           ),
           z.meta({ examples: ['eip155:8453'] }),
         ),
       kind: z
-        .literal('evm')
+        .enum(['evm', 'solana', 'tron'])
         .check(
           z.describe('Chain execution family used for provider routing.'),
           z.meta({ examples: ['evm'] }),
@@ -41,7 +42,7 @@ export namespace schema {
         .optional(z.record(z.string(), z.string()))
         .check(
           z.describe('Provider-specific chain ids Tempo uses when requesting quotes.'),
-          z.meta({ examples: [{ relay: '8453' }] }),
+          z.meta({ examples: [{ across: '8453', relay: '8453', rhino: 'BASE' }] }),
         ),
     }),
     'A normalized chain reference for funding quotes.',
@@ -117,7 +118,7 @@ export namespace schema {
   export const ProviderRef = Schema.describe(
     z.object({
       id: z
-        .literal('relay')
+        .enum(['across', 'relay', 'rhino', 'squid'])
         .check(z.describe('Stable provider id.'), z.meta({ examples: ['relay'] })),
       kind: z
         .string()
@@ -172,6 +173,12 @@ export namespace schema {
   /** Provider-derived output, limits, and freshness data. */
   export const QuoteDetails = Schema.describe(
     z.object({
+      expiresAt: z
+        .optional(z.iso.datetime())
+        .check(
+          z.describe('Timestamp after which the provider quote is no longer valid.'),
+          z.meta({ examples: ['2026-01-01T00:01:00Z'] }),
+        ),
       inputAmount: Schema.DecimalString.check(
         z.describe('Source amount sent to the provider in base units.'),
         z.meta({ examples: ['1000000'] }),
@@ -230,7 +237,7 @@ export namespace schema {
   export const Provider = Schema.describe(
     z.object({
       id: z
-        .literal('relay')
+        .enum(['across', 'relay', 'rhino', 'squid'])
         .check(z.describe('Stable provider id.'), z.meta({ examples: ['relay'] })),
       kind: z
         .string()
@@ -278,10 +285,10 @@ export namespace schema {
             z.meta({ examples: ['USDC.e'] }),
           ),
         provider: z
-          .optional(z.literal('relay'))
+          .optional(z.enum(['across', 'relay', 'rhino', 'squid']))
           .check(
             z.describe(
-              'Only request a quote from this provider. The supported id is `relay`; omit it to query every configured provider.',
+              'Only request a quote from this provider. Supported ids are `across`, `relay`, `rhino`, and `squid`; omit it to query every configured provider.',
             ),
             z.meta({ examples: ['relay'] }),
           ),
@@ -304,7 +311,9 @@ export namespace schema {
           .string()
           .check(
             z.minLength(1),
-            z.describe('Source chain alias or CAIP-2 id, such as `base` or `eip155:8453`.'),
+            z.describe(
+              'Source chain alias or stable id, such as `base`, `solana`, or `eip155:8453`.',
+            ),
             z.meta({ examples: ['base', 'eip155:8453'] }),
           ),
         sourceToken: z
@@ -312,7 +321,7 @@ export namespace schema {
           .check(
             z.minLength(1),
             z.describe(
-              'Source token symbol, contract address, or Tempo token key. Symbol and address lookup is scoped to `sourceChain` and case-insensitive. An unknown token returns an empty list.',
+              'Source token symbol, contract address, or Tempo token key. Lookup is scoped to `sourceChain`; non-EVM addresses are case-sensitive. An unknown token returns an empty list.',
             ),
             z.meta({ examples: ['USDC', '0x833589fcd6edb6e08f4c7c32d4f71b54bda02913'] }),
           ),
@@ -414,7 +423,8 @@ export function funding(options: funding.Options = {}) {
             400: { codes: ['query_invalid'] },
             502: {
               codes: ['upstream_error'],
-              description: 'Every matching quote provider failed unexpectedly.',
+              description:
+                'No quote succeeded and at least one matching provider failed unexpectedly.',
             },
           },
           success: {
@@ -456,12 +466,17 @@ export function funding(options: funding.Options = {}) {
         } catch (cause) {
           const message = requestErrorMessage(cause)
           if (message) return Response.error(c, { code: 'query_invalid', message, status: 400 })
-          if (cause instanceof FundingQuotes.ProviderQuoteError)
+          if (cause instanceof FundingQuotes.ProviderQuoteError) {
+            const failures = cause.failures.map(FundingQuoteProviders.providerFailure)
+            const failure = failures[0]
+            if (failure) c.set('providerFailure', failure)
+            if (failures.length > 1) c.set('providerFailures', failures)
             return Response.error(c, {
               code: 'upstream_error',
               message: 'Quote providers could not complete the request.',
               status: 502,
             })
+          }
           throw cause
         }
       },

package/src/apps/data/routes/indexer.test.ts

@@ -1,11 +1,12 @@
 import { Challenge } from 'mppx'
 import { sessionManager } from 'mppx/client'
-import { RateLimit, Store } from 'tapimo'
+import { ZoneRpcAuthentication } from 'ox/tempo'
 import { Actions } from 'viem/tempo'
 import * as TestApp from '../../../../test/App.js'
 import * as Mppx from '../../../../test/Mppx.js'
 import * as Runtime from '../../../../test/runtime.js'
 import * as Tempo from '../../../../test/Tempo.js'
+import * as Auth from '../../../internal/Auth.js'
 import * as Tidx from '../../../internal/Tidx.js'
 import * as Viem from '../../../internal/Viem.js'
 import * as Indexer from './indexer.js'
@@ -83,13 +84,52 @@ describe('GET /indexer/query', () => {
       })
       const response = await client.v1.indexer.query.$get(
         { query: { chainId: String(zone), sql: 'select 1' } },
-        { headers: { authorization: `Bearer ${zoneReader.token}` } },
+        {
+          headers: {
+            authorization: `Bearer ${zoneReader.token}`,
+            [ZoneRpcAuthentication.headerName]: 'zone-rpc-secret',
+          },
+        },
       )
       const upstream = fetch.mock.calls[0]![0] as Request
 
       expect(response.status).toBe(200)
       expect(new URL(upstream.url).origin).toBe('https://zone.tidx.test')
       expect(upstream.headers.get('authorization')).toBe('Basic em9uZS1zZWNyZXQ=')
+      expect(upstream.headers.get(ZoneRpcAuthentication.headerName)).toBeNull()
+    } finally {
+      fetch.mockRestore()
+    }
+  })
+
+  test('routes Zone queries to the Zone TIDX with its bearer auth', async () => {
+    const zone = runtime.zone.chainId
+    const zoneReader = {
+      id: 'key_zone_bearer_indexer',
+      orgId: 'org_test',
+      scopes: ['data:read', 'indexer:query', `zone:${zone}:read`],
+      token: 'secret_zone_bearer_indexer',
+    } satisfies TestApp.kvStore.Key
+    const fetch = vi.spyOn(globalThis, 'fetch').mockResolvedValue(
+      new Response(JSON.stringify({ columns: [], ok: true, row_count: 0, rows: [] }), {
+        headers: { 'content-type': 'application/json' },
+      }),
+    )
+    try {
+      const client = TestApp.client({
+        auth: { keys: [zoneReader] },
+        tidx: { baseUrl: 'https://zone.tidx.test', bearerAuth: 'zone-secret' },
+        zones: [{ chainId: zone, forwardRpcUrl: runtime.zone.forwardRpcUrl }],
+      })
+      const response = await client.v1.indexer.query.$get(
+        { query: { chainId: String(zone), sql: 'select 1' } },
+        { headers: { authorization: `Bearer ${zoneReader.token}` } },
+      )
+      const upstream = fetch.mock.calls[0]![0] as Request
+
+      expect(response.status).toBe(200)
+      expect(new URL(upstream.url).origin).toBe('https://zone.tidx.test')
+      expect(upstream.headers.get('authorization')).toBe('Bearer zone-secret')
     } finally {
       fetch.mockRestore()
     }
@@ -156,6 +196,20 @@ describe('GET /indexer/query', () => {
     expect(response.status).toMatchInlineSnapshot(`401`)
   })
 
+  test('does not expose anonymous access', () => {
+    expect(Auth.describeAccess(Indexer.indexer())['indexerQuery']).toMatchInlineSnapshot(`
+      {
+        "apiKey": true,
+        "mpp": true,
+        "public": false,
+        "scopes": [
+          "indexer:query",
+        ],
+        "session": false,
+      }
+    `)
+  })
+
   test('proxies without auth middleware', async () => {
     const client = TestApp.client({ auth: false })
     const response = await client.v1.indexer.query.$get({
@@ -167,10 +221,8 @@ describe('GET /indexer/query', () => {
     expect(body.ok).toMatchInlineSnapshot(`true`)
   })
 
-  test('completes the MPP payment lifecycle when public quota is exhausted', async () => {
-    const rateLimitStore = Store.memory()
+  test('challenges anonymous callers for MPP payment', async () => {
     const app = TestApp.create({
-      rateLimit: { store: rateLimitStore },
       mpp: {
         secretKey: 'secret_test_key_0123456789abcdef',
         session: {
@@ -182,13 +234,9 @@ describe('GET /indexer/query', () => {
         },
       },
     })
-    await exhaustQuota(RateLimit.memory({ store: rateLimitStore }), 'public:anonymous', {
-      perMinute: 60,
-    })
 
-    // An unpaid over-quota request is challenged for payment. MPP challenges
-    // and receipts ride on real HTTP headers, so we drive the lifecycle
-    // through `app.fetch` rather than the typed route client.
+    // MPP challenges and receipts ride on real HTTP headers, so drive the
+    // lifecycle through `app.fetch` rather than the typed route client.
     const challenge = await app.fetch(
       new Request('http://tempo-api.test/v1/indexer/query?sql=select%201'),
     )
@@ -209,10 +257,31 @@ describe('GET /indexer/query', () => {
     expect(body.ok).toMatchInlineSnapshot(`true`)
   })
 
+  test('rejects an unsupported chain before issuing an MPP challenge', async () => {
+    const app = TestApp.create({
+      mpp: {
+        secretKey: 'secret_test_key_0123456789abcdef',
+        session: {
+          chainId: Tempo.chain.id,
+          currency: Tempo.currency,
+          decimals: 6,
+          getClient: () => Tempo.client,
+          recipient: Tempo.accounts[2].address,
+        },
+      },
+    })
+    const response = await app.fetch(
+      new Request('http://tempo-api.test/v1/indexer/query?sql=select%201&chainId=31318'),
+    )
+    const body = (await response.json()) as { error: { code: string } }
+
+    expect(response.status).toBe(400)
+    expect(response.headers.has('www-authenticate')).toBe(false)
+    expect(body.error.code).toBe('chain_id_unsupported')
+  })
+
   test('accepts session management POSTs', { timeout: 120_000 }, async () => {
-    const rateLimitStore = Store.memory()
     const app = TestApp.create({
-      rateLimit: { store: rateLimitStore },
       mpp: {
         secretKey: 'secret_test_key_0123456789abcdef',
         session: {
@@ -225,9 +294,6 @@ describe('GET /indexer/query', () => {
         },
       },
     })
-    await exhaustQuota(RateLimit.memory({ store: rateLimitStore }), 'public:anonymous', {
-      perMinute: 60,
-    })
     await Actions.faucet.fundSync(Tempo.client, {
       account: Tempo.accounts[2],
       timeout: 60_000,
@@ -264,7 +330,3 @@ describe('GET /indexer/query', () => {
     expect(state.deposit).toMatchInlineSnapshot(`0n`)
   })
 })
-
-async function exhaustQuota(rateLimit: RateLimit.Store, key: string, limit: RateLimit.Limit) {
-  for (let index = 0; index < limit.perMinute; index++) await rateLimit.consume({ key, limit })
-}

package/src/apps/data/routes/indexer.ts

@@ -1,4 +1,5 @@
 import { Hono, type Context, type TypedResponse } from 'hono'
+import { ZoneRpcAuthentication } from 'ox/tempo'
 import * as z from 'zod/mini'
 
 import type * as App from '../../../App.js'
@@ -25,6 +26,7 @@ const strippedHeaders = new Set([
   'transfer-encoding',
   'upgrade',
   'tempo-api-key',
+  ZoneRpcAuthentication.headerName.toLowerCase(),
 ])
 
 /** Never reached; carries typed passthrough response variants into Hono client inference. */
@@ -99,7 +101,7 @@ export function indexer() {
 
   return new Hono<App.Environment>().get(
     '/v1/indexer/query',
-    Auth.policy({ apiKey: { scopes: ['indexer:query'] }, mpp: true, public: true }),
+    Auth.policy({ apiKey: { scopes: ['indexer:query'] }, mpp: true }),
     OpenApi.describeRoute({
       description:
         'Runs a read-only SQL-style query against Tempo’s indexed chain data, with optional live streaming as new blocks arrive.',
@@ -256,7 +258,10 @@ async function passthrough(
   // Resolve the upstream for this caller. A resolver `tidx` can route by
   // principal (e.g. anonymous `type: 'public'` callers to a public, no-auth
   // indexer); a static config ignores the principal.
-  const { baseUrl, basicAuth } = Tidx.resolve(tidx, { chainId, principal: Auth.getPrincipal(c) })
+  const { baseUrl, basicAuth, bearerAuth } = Tidx.resolve(tidx, {
+    chainId,
+    principal: Auth.getPrincipal(c),
+  })
   // The chain id is syntactically valid but this deployment has no indexer
   // upstream configured for it (no `tidx` config and no built-in default).
   if (!baseUrl)
@@ -290,6 +295,7 @@ async function passthrough(
   for (const [name, value] of c.req.raw.headers)
     if (!strippedHeaders.has(name.toLowerCase())) headers.set(name, value)
   if (basicAuth) headers.set('authorization', `Basic ${btoa(basicAuth)}`)
+  else if (bearerAuth) headers.set('authorization', `Bearer ${bearerAuth}`)
 
   const method = c.req.method
 

package/src/apps/data/routes/tokens.test.ts

@@ -272,6 +272,60 @@ describe('GET /tokens?verified=true', () => {
 })
 
 describe('GET /tokens?addresses=', () => {
+  test('separates repeated addresses in the response cache', async () => {
+    const routed = TestApp.create({ db })
+    const headers = { authorization: `Bearer ${TestApp.key.token}` }
+    const repeated = new URLSearchParams()
+    repeated.append('addresses', TestApp.token)
+    repeated.append('addresses', TestApp.tokenWithHolders)
+    const single = new URLSearchParams({
+      addresses: TestApp.tokenWithHolders,
+    })
+
+    const primed = await routed.request(`/v1/tokens?${repeated}`, { headers })
+    const miss = await routed.request(`/v1/tokens?${single}`, { headers })
+    const hit = await routed.request(`/v1/tokens?${single}`, { headers })
+    const primedBody = await TestApp.json(primed, Tokens.schema.getTokens.Response)
+    const body = await TestApp.json(hit, Tokens.schema.getTokens.Response)
+
+    expect(primed.status).toBe(200)
+    expect(miss.status).toBe(200)
+    expect(hit.status).toBe(200)
+    expect(primedBody.data.map((token) => token.address)).toEqual([
+      TestApp.token,
+      TestApp.tokenWithHolders,
+    ])
+    expect(miss.headers.has('RateLimit-Limit')).toBe(true)
+    expect(hit.headers.has('RateLimit-Limit')).toBe(false)
+    expect(body.data.map((token) => token.address)).toEqual([TestApp.tokenWithHolders])
+  })
+
+  test('separates repeated includes in the response cache', async () => {
+    const routed = TestApp.create({ db })
+    const headers = { authorization: `Bearer ${TestApp.key.token}` }
+    const repeated = new URLSearchParams({ limit: '5' })
+    repeated.append('include', 'createdAt')
+    repeated.append('include', 'holderCount')
+    const single = new URLSearchParams({
+      include: 'holderCount',
+      limit: '5',
+    })
+
+    const primed = await routed.request(`/v1/tokens?${repeated}`, { headers })
+    const miss = await routed.request(`/v1/tokens?${single}`, { headers })
+    const hit = await routed.request(`/v1/tokens?${single}`, { headers })
+    const primedBody = await TestApp.json(primed, Tokens.schema.getTokens.Response)
+    const body = await TestApp.json(hit, Tokens.schema.getTokens.Response)
+
+    expect(primed.status).toBe(200)
+    expect(miss.status).toBe(200)
+    expect(hit.status).toBe(200)
+    expect(primedBody.data.every((token) => typeof token.createdAt === 'string')).toBe(true)
+    expect(miss.headers.has('RateLimit-Limit')).toBe(true)
+    expect(hit.headers.has('RateLimit-Limit')).toBe(false)
+    expect(body.data.every((token) => token.createdAt === undefined)).toBe(true)
+  })
+
   test('returns the requested tokens as a single page in input order', async () => {
     const client = app()
     const response = await client.v1.tokens.$get(