tapimo 0.5.1 → 0.5.3

package/src/cli/Cli.test.ts

@@ -16,6 +16,14 @@ describe('from', () => {
 
       expect(cli.name).toMatchInlineSnapshot(`"tapimo"`)
       expect(cli.description).toMatchInlineSnapshot(`"Tempo API CLI"`)
+      expect((await initialize(cli)).result).toMatchObject({
+        instructions: expect.stringContaining('Tempo MCP provides access'),
+        serverInfo: {
+          name: 'tempo',
+          title: 'Tempo MCP',
+          version: '1.2.3',
+        },
+      })
     } finally {
       fetch.mockRestore()
     }
@@ -91,6 +99,34 @@ function mockHostedApi(app = TestApp.create()) {
   })
 }
 
+async function initialize(cli: ReturnType<typeof Cli.from>) {
+  const response = await cli.fetch(
+    new Request('http://localhost/mcp', {
+      body: JSON.stringify({
+        id: 1,
+        jsonrpc: '2.0',
+        method: 'initialize',
+        params: {
+          capabilities: {},
+          clientInfo: { name: 'test-client', version: '1.0.0' },
+          protocolVersion: '2025-03-26',
+        },
+      }),
+      headers: {
+        accept: 'application/json, text/event-stream',
+        'content-type': 'application/json',
+      },
+      method: 'POST',
+    }),
+  )
+  return (await response.json()) as {
+    result: {
+      instructions: string
+      serverInfo: { name: string; title: string; version: string }
+    }
+  }
+}
+
 async function serve(cli: ReturnType<typeof Cli.from>, argv: string[]) {
   const output: string[] = []
   await cli.serve(argv, {

package/src/cli/Cli.ts

@@ -8,7 +8,7 @@ const excludedTools = ['admin_*', 'gecko_*', 'v1_auth_*']
 
 /** Usage guidance surfaced to MCP clients on initialize (`<cli> --mcp`). */
 const instructions =
-  'Tools mirror the hosted Tempo API. Authenticated tools accept an `authorization` input (`Bearer <api key>`). List endpoints paginate via `cursor`/`nextCursor`. `docs_*` tools search the Tempo documentation.'
+  'Tempo MCP provides access to the hosted Tempo API and documentation. Authenticated tools accept an `authorization` input (`Bearer <api key>`). List endpoints paginate via `cursor`/`nextCursor`. `docs_*` tools search the Tempo documentation.'
 
 /**
  * Creates an incur CLI backed by a hosted Tempo API, plus the super admin
@@ -28,7 +28,12 @@ export function from(url: string | URL, options: from.Options = {}) {
     .create(name, {
       description,
       fetch: Fetch.fromRequest(url, request),
-      mcp: { instructions, tools: { exclude: excludedTools } },
+      mcp: {
+        instructions,
+        name: 'tempo',
+        title: 'Tempo MCP',
+        tools: { exclude: excludedTools },
+      },
       openapi,
       openapiConfig: options.openapiConfig ?? { mode: 'namespace' },
       version,

package/src/db/Db.ts

@@ -641,6 +641,10 @@ export const migrations: readonly Migration[] = [
         .on('inviteLinkRedemptions')
         .columns(['inviteLinkId', 'createdAt']),
   },
+  {
+    name: '0058_request_usage_sequence_bigint',
+    up: (db) => raw(db, sql`ALTER TABLE request_usage_meter_events ALTER COLUMN sequence TYPE bigint`), // prettier-ignore
+  },
 ]
 
 /**

package/src/db/Schema.ts

@@ -272,7 +272,7 @@ export const RequestUsageMeterEvent = z.object({
     .check(z.describe('When Stripe acknowledged the event (ISO 8601), or null.')),
   sequence: z
     .number()
-    .check(z.describe('Delta sequence within the bucket; `0` is the initial seal, `1..n` later deltas.')), // prettier-ignore
+    .check(z.describe('Reported-count watermark observed when this delta was claimed.')),
   state: z
     .enum(['pending', 'reported', 'skipped'])
     .check(z.describe('Exactly-once state: `pending` retries, `reported` is done, `skipped` is audited.')), // prettier-ignore

package/src/db/tables/organizations.test.ts

@@ -4,6 +4,8 @@ import * as Runtime from '../../../test/runtime.js'
 import * as Webhooks from '../../internal/Webhooks.js'
 import * as Db from '../Db.js'
 import * as Organizations from './organizations.js'
+import * as SponsoredTransactions from './sponsoredTransactions.js'
+import * as StripeCustomers from './stripeCustomers.js'
 
 const create = () => Db.postgres({ connectionString: Runtime.postgresUrl, schema: `t_${nanoid()}` })
 
@@ -127,6 +129,34 @@ describe('upsert', () => {
 })
 
 describe('deleteOrganization', () => {
+  test('behavior: preserves an org with unreported billable sponsorships', async () => {
+    const db = create()
+    await db.migrate()
+    await Organizations.create(db, { id: 'org_1', name: 'One' })
+    await StripeCustomers.create(db, {
+      orgId: 'org_1',
+      stripeCustomerId: 'cus_org_1',
+    })
+    await SponsoredTransactions.upsert(db, {
+      apiKeyId: 'key_1',
+      billable: true,
+      chainId: 4217,
+      environment: 'production',
+      orgId: 'org_1',
+      projectId: 'prj_1',
+      signPayload: `0x${'bb'.repeat(32)}`,
+      transaction: `0x76${'cc'.repeat(16)}`,
+      transactionHash: `0x${'aa'.repeat(32)}`,
+    })
+
+    await expect(Organizations.deleteOrganization(db, 'org_1')).rejects.toThrow(
+      Organizations.UnreportedSponsorshipsError,
+    )
+    expect(await Organizations.get(db, 'org_1')).toBeDefined()
+    expect(await StripeCustomers.get(db, 'org_1')).toBeDefined()
+    await db.close()
+  })
+
   test('behavior: deletes api-key-owned webhook subscriptions', async () => {
     const db = create()
     await db.migrate()

package/src/db/tables/organizations.ts

@@ -105,6 +105,16 @@ export declare namespace createOwned {
  */
 export function deleteOrganization(db: Db.Db, id: string): Promise<boolean> {
   return db.kysely.transaction().execute(async (trx) => {
+    const unreported = await trx
+      .selectFrom('sponsored_transactions')
+      .select('id')
+      .where('orgId', '=', id)
+      .where('billable', '=', true)
+      .where('meterReportedAt', 'is', null)
+      .limit(1)
+      .executeTakeFirst()
+    if (unreported) throw new UnreportedSponsorshipsError()
+
     await trx
       .deleteFrom('webhook_subscriptions')
       .where('ownerType', '=', 'api_key')
@@ -124,6 +134,19 @@ export function deleteOrganization(db: Db.Db, id: string): Promise<boolean> {
   })
 }
 
+/** Whether an organization has billable sponsorships awaiting settlement. */
+export async function hasUnreportedSponsorships(db: Db.Db, id: string): Promise<boolean> {
+  const record = await db.kysely
+    .selectFrom('sponsored_transactions')
+    .select('id')
+    .where('orgId', '=', id)
+    .where('billable', '=', true)
+    .where('meterReportedAt', 'is', null)
+    .limit(1)
+    .executeTakeFirst()
+  return record !== undefined
+}
+
 /**
  * Reads an organization by id.
  *
@@ -389,3 +412,8 @@ export declare namespace upsert {
     name?: string | undefined
   }
 }
+
+/** Organization deletion is blocked until billable sponsorships settle. */
+export class UnreportedSponsorshipsError extends Error {
+  override name = 'Organizations.UnreportedSponsorshipsError'
+}

package/src/db/tables/requestUsage.ts

@@ -32,7 +32,7 @@ export type MeterEventTable = {
   orgId: string
   reason: string | null
   reportedAt: string | null
-  sequence: number
+  sequence: Count
   state: State
   stripeCustomerId: string
 }
@@ -91,26 +91,6 @@ export async function listPending(db: Db.Db, environment: Environment): Promise<
   return rows.map(toMeterEvent)
 }
 
-/**
- * Counts the meter events already reported for a bucket — the next delta's
- * `sequence`, so a new seal never collides with a settled one.
- *
- * @param db - The database.
- * @param key - The bucket key.
- * @returns The count of reported events for the bucket.
- */
-export async function countReported(db: Db.Db, key: BucketKey): Promise<number> {
-  const row = await db.kysely
-    .selectFrom('request_usage_meter_events')
-    .select((eb) => eb.fn.countAll<string>().as('count'))
-    .where('orgId', '=', key.orgId)
-    .where('environment', '=', key.environment)
-    .where('bucketStart', '=', key.bucketStart)
-    .where('state', '=', 'reported')
-    .executeTakeFirstOrThrow()
-  return Number(row.count)
-}
-
 /**
  * Inserts a frozen `pending` meter event, claiming a delta. Idempotent on the
  * deterministic `identifier`: a re-seal after a crash resolves to the existing
@@ -157,7 +137,7 @@ export declare namespace insertPending {
     identifier: string
     /** Organization id (`org_…`). */
     orgId: string
-    /** Delta sequence within the bucket. */
+    /** Reported-count watermark observed when this delta was claimed. */
     sequence: number
     /** Stripe customer id the event bills against. */
     stripeCustomerId: string
@@ -227,5 +207,5 @@ function toBucket(row: Selectable<BucketTable>): Bucket {
 
 /** Maps a meter-event row to its domain record. */
 function toMeterEvent(row: Selectable<MeterEventTable>): MeterEvent {
-  return { ...row, deltaCount: Number(row.deltaCount) }
+  return { ...row, deltaCount: Number(row.deltaCount), sequence: Number(row.sequence) }
 }

package/src/db/tables/sponsoredTransactions.test.ts

@@ -189,6 +189,47 @@ describe('assignTransactionHash', () => {
     )
     await db.close()
   })
+
+  test('behavior: keeps an over-limit failed intent retryable across a period rollover', async () => {
+    const db = create()
+    await db.migrate()
+    const { transactionHash: _, ...intent } = input
+    vi.useFakeTimers({ now: new Date('2026-01-31T23:59:00.000Z') })
+    try {
+      const failed = await SponsoredTransactions.upsert(db, { ...intent, feeMax: '100' })
+      await SponsoredTransactions.fail(db, failed.id, new Date().toISOString())
+      vi.setSystemTime(new Date('2026-02-01T00:01:00.000Z'))
+      await SponsoredTransactions.upsert(db, {
+        ...intent,
+        feeMax: '100',
+        signPayload: `0x${'bc'.repeat(32)}`,
+      })
+
+      await expect(
+        SponsoredTransactions.assignTransactionHash(db, failed.id, input.transactionHash, {
+          chainIds: [input.chainId],
+          max: 100n,
+          since: '2026-02-01T00:00:00.000Z',
+        }),
+      ).rejects.toBeInstanceOf(SponsoredTransactions.PeriodSpendLimitError)
+      expect(await SponsoredTransactions.get(db, failed.id)).toMatchObject({
+        createdAt: '2026-01-31T23:59:00.000Z',
+        finalizedAt: '2026-02-01T00:01:00.000Z',
+        status: 'failed',
+        transactionHash: null,
+      })
+      expect(
+        (
+          await SponsoredTransactions.listIntents(db, {
+            failedSince: '2026-02-01T00:00:00.000Z',
+          })
+        ).map((record) => record.id),
+      ).toContain(failed.id)
+    } finally {
+      vi.useRealTimers()
+      await db.close()
+    }
+  })
 })
 
 describe('finalize', () => {

package/src/db/tables/sponsoredTransactions.ts

@@ -182,19 +182,58 @@ export declare namespace listIntents {
  * @param db - The database.
  * @param id - The sponsored-transaction id (`stx_…`).
  * @param transactionHash - The matched on-chain transaction hash.
+ * @param limit - The active period spend limit, when enforced.
  */
 export async function assignTransactionHash(
   db: Db.Db,
   id: string,
   transactionHash: string,
+  limit?: reserve.Limit,
 ): Promise<void> {
-  await db.kysely
-    .updateTable('sponsored_transactions')
-    .set({ finalizedAt: null, status: 'pending', transactionHash })
-    .where('id', '=', id)
-    .where('status', 'in', ['failed', 'pending'])
-    .where('transactionHash', 'is', null)
-    .execute()
+  try {
+    await db.transaction(async (tx) => {
+      const record = await get(tx, id)
+      if (
+        !record ||
+        record.transactionHash !== null ||
+        !['failed', 'pending'].includes(record.status)
+      )
+        return
+      if (record.status === 'failed' && record.billable && limit)
+        await sql`select pg_advisory_xact_lock(${billingLockClass}, hashtext(${record.orgId}))`.execute(tx.kysely) // prettier-ignore
+      await tx.kysely
+        .updateTable('sponsored_transactions')
+        .set({
+          ...(record.status === 'failed' ? { createdAt: new Date().toISOString() } : {}),
+          finalizedAt: null,
+          status: 'pending',
+          transactionHash,
+        })
+        .where('id', '=', id)
+        .where('status', '=', record.status)
+        .where('transactionHash', 'is', null)
+        .execute()
+      if (record.status === 'failed' && record.billable && limit) {
+        const committed = await spend(tx, {
+          chainIds: limit.chainIds,
+          orgId: record.orgId,
+          since: limit.since,
+        })
+        if (committed > limit.max) throw new PeriodSpendLimitError()
+      }
+    })
+  } catch (error) {
+    // Keep the on-chain match eligible until budget becomes available.
+    if (error instanceof PeriodSpendLimitError)
+      await db.kysely
+        .updateTable('sponsored_transactions')
+        .set({ finalizedAt: new Date().toISOString() })
+        .where('id', '=', id)
+        .where('status', '=', 'failed')
+        .where('transactionHash', 'is', null)
+        .execute()
+    throw error
+  }
 }
 
 /**

package/src/internal/Auth.test.ts

@@ -743,7 +743,7 @@ describe('require', () => {
   })
 
   describe('mpp', () => {
-    test('uses a default paid-request limit of 100 per minute', async () => {
+    test('uses a default paid-request limit with a normalized IPv6 identity', async () => {
       const rateLimit = underQuota()
       const consume = vi.spyOn(rateLimit, 'consume')
       const app = createApp({
@@ -757,7 +757,7 @@ describe('require', () => {
       const response = await app.request('/protected', {
         headers: {
           authorization: 'Payment paid',
-          'x-forwarded-for': '203.0.113.10',
+          'cf-connecting-ip': '2001:db8:abcd:12::1',
         },
       })
 
@@ -765,7 +765,60 @@ describe('require', () => {
       expect(response.headers.get('RateLimit-Limit')).toBe('100')
       expect(response.headers.get('RateLimit-Scope')).toBe('mpp')
       expect(consume).toHaveBeenCalledWith({
-        key: 'mpp:public:203.0.113.10',
+        key: 'mpp:public:2001:db8:abcd:12',
+        limit: { perMinute: 100 },
+      })
+    })
+
+    test('ignores untrusted forwarding headers for public identity', async () => {
+      const rateLimit = underQuota()
+      const consume = vi.spyOn(rateLimit, 'consume')
+      const app = createApp({
+        auth: {
+          apiKey: { resolve: TestApp.resolver({ keys: [{ ...key, token }] }) },
+          mpp: createMppHandler(),
+          rateLimit,
+        },
+        policy: { mpp: { session: { amount: '1' } } },
+      })
+      const response = await app.request('/protected', {
+        headers: {
+          authorization: 'Payment paid',
+          'x-forwarded-for': '203.0.113.10',
+          'x-real-ip': '203.0.113.11',
+          'x-test-client-ip': '203.0.113.12',
+        },
+      })
+
+      expect(response.status).toBe(200)
+      expect(consume).toHaveBeenCalledWith({
+        key: 'mpp:public:anonymous',
+        limit: { perMinute: 100 },
+      })
+    })
+
+    test('uses a configured trusted client-IP resolver outside Cloudflare', async () => {
+      const rateLimit = underQuota()
+      const consume = vi.spyOn(rateLimit, 'consume')
+      const app = createApp({
+        auth: {
+          apiKey: { resolve: TestApp.resolver({ keys: [{ ...key, token }] }) },
+          mpp: createMppHandler(),
+          publicClientIp: (request) => request.headers.get('x-real-ip') ?? undefined,
+          rateLimit,
+        },
+        policy: { mpp: { session: { amount: '1' } } },
+      })
+      const response = await app.request('/protected', {
+        headers: {
+          authorization: 'Payment paid',
+          'x-real-ip': '2001:db8:abcd:12::99',
+        },
+      })
+
+      expect(response.status).toBe(200)
+      expect(consume).toHaveBeenCalledWith({
+        key: 'mpp:public:2001:db8:abcd:12',
         limit: { perMinute: 100 },
       })
     })
@@ -788,7 +841,7 @@ describe('require', () => {
         headers: {
           authorization: 'Payment paid',
           'tempo-api-key': token,
-          'x-forwarded-for': '203.0.113.10',
+          'cf-connecting-ip': '203.0.113.10',
         },
       })
 
@@ -1228,7 +1281,7 @@ describe('require', () => {
         policy: { public: { rateLimit: { perMinute: 60 } } },
       })
       const response = await app.request('/protected', {
-        headers: { 'x-forwarded-for': '203.0.113.10' },
+        headers: { 'cf-connecting-ip': '203.0.113.10' },
       })
       const body = await response.json()
 
@@ -1280,7 +1333,7 @@ describe('require', () => {
           policy: { public: { rateLimit: { perMinute: 1 } } },
         })
         const response = await app.request('/protected', {
-          headers: { 'x-forwarded-for': '203.0.113.10' },
+          headers: { 'cf-connecting-ip': '203.0.113.10' },
         })
         const body = await response.json()
 
@@ -1338,7 +1391,7 @@ describe('require', () => {
           policy: { public: { rateLimit: { perMinute: 1 } } },
         })
         const pending = app.request('/protected', {
-          headers: { 'x-forwarded-for': '203.0.113.10' },
+          headers: { 'cf-connecting-ip': '203.0.113.10' },
         })
         // Advance past the 300ms consume timeout so it fails open.
         await vi.advanceTimersByTimeAsync(300)
@@ -1382,7 +1435,7 @@ describe('require', () => {
           policy: { public: { rateLimit: { perMinute: 1 } } },
         })
         const response = await app.request('/protected', {
-          headers: { 'x-forwarded-for': '203.0.113.10' },
+          headers: { 'cf-connecting-ip': '203.0.113.10' },
         })
         const body = await response.json()
 
@@ -1419,7 +1472,7 @@ describe('require', () => {
           policy: { public: { rateLimit: { perMinute: 1 } } },
         })
         const response = await app.request('/protected', {
-          headers: { 'x-forwarded-for': '203.0.113.10' },
+          headers: { 'cf-connecting-ip': '203.0.113.10' },
         })
 
         expect(response.status).toMatchInlineSnapshot(`200`)
@@ -1448,7 +1501,7 @@ describe('require', () => {
           policy: { public: { rateLimit: { perMinute: 1 } } },
         })
         const response = await app.request('/protected', {
-          headers: { 'x-forwarded-for': '203.0.113.10' },
+          headers: { 'cf-connecting-ip': '203.0.113.10' },
         })
 
         expect(response.status).toMatchInlineSnapshot(`200`)

package/src/internal/Auth.ts

@@ -58,6 +58,8 @@ export type Context = {
    * framework default.
    */
   publicRateLimit?: RateLimit.Limit | undefined
+  /** Resolves a trusted client IP for public quota identity. */
+  publicClientIp?: ((request: Request) => string | undefined) | undefined
   /** Rate-limit store used by API handlers. */
   rateLimit?: RateLimit.Store | undefined
   /** Session lane resolution (the session surface's capability), or undefined when sessions are unmounted. */
@@ -523,6 +525,9 @@ export function middleware<
     // API-key-only routes (no per-route `policy.public`) still fall back to the
     // deployment's configured public quota.
     publicRateLimit: defaults.public.rateLimit,
+    ...(options.public && options.public.clientIp
+      ? { publicClientIp: options.public.clientIp }
+      : {}),
     ...(options.mpp === false
       ? {}
       : {
@@ -608,6 +613,8 @@ export declare namespace middleware {
     /** Default public access policy. Pass false to disable anonymous access. */
     public?:
       | {
+          /** Resolves the client IP from trusted runtime or proxy metadata. Defaults to `cf-connecting-ip`. */
+          clientIp?: ((request: Request) => string | undefined) | undefined
           /** Anonymous public quota for protected routes. */
           rateLimit?: RateLimit.Limit | undefined
         }
@@ -1567,7 +1574,7 @@ export function require<environment extends Environment = Environment>(
       }
     }
 
-    const publicPrincipal = principalFromPublic(c)
+    const publicPrincipal = principalFromPublic(c, auth)
     if (hasPayment) {
       c.set('principal', publicPrincipal)
       return requirePayment(c, proceed, {
@@ -1901,15 +1908,10 @@ function principalFromApiKey(apiKey: ApiKey.ApiKey): Principal {
   }
 }
 
-function principalFromPublic(c: hono_Context): Principal {
-  const forwarded = c.req.header('x-forwarded-for')?.split(',')[0]?.trim()
+function principalFromPublic(c: hono_Context, auth: Context): Principal {
+  const ip = auth.publicClientIp ? auth.publicClientIp(c.req.raw) : c.req.header('cf-connecting-ip')
   return {
-    id:
-      c.req.header('cf-connecting-ip') ??
-      c.req.header('x-real-ip') ??
-      forwarded ??
-      c.req.header('x-test-client-ip') ??
-      'anonymous',
+    id: ip ? RateLimit.normalizeIp(ip) : 'anonymous',
     type: 'public',
   }
 }

package/src/internal/Cache.test.ts

@@ -1,6 +1,25 @@
 import { Hono } from 'hono'
+import * as z from 'zod/mini'
 import * as Cache from './Cache.js'
 
+describe('urlKey', () => {
+  test('serializes parsed arrays as repeated query parameters', async () => {
+    const schema = z.object({ include: z.array(z.string()) })
+    const app = new Hono<{ Variables: { chainId: number } }>()
+    app.use('*', async (c, next) => {
+      c.set('chainId', 4217)
+      await next()
+    })
+    app.get('/', (c) => c.text(Cache.urlKey(c, schema)))
+
+    const left = await (await app.request('/?include=a%2Cb&include=c')).text()
+    const right = await (await app.request('/?include=a&include=b%2Cc')).text()
+
+    expect(left).toMatchInlineSnapshot(`"http://localhost/?chainId=4217&include=a%2Cb&include=c"`)
+    expect(right).toMatchInlineSnapshot(`"http://localhost/?chainId=4217&include=a&include=b%2Cc"`)
+  })
+})
+
 describe('response', () => {
   test('preserves rate-limit headers without caching them', async () => {
     await withCaches(async () => {

package/src/internal/Cache.ts

@@ -192,11 +192,23 @@ export function urlKey<
   schema extends z.ZodMiniType,
 >(c: Context<environment>, schema: schema): string {
   const url = new URL(c.req.url)
-  const query = schema.parse(Object.fromEntries(url.searchParams)) as Record<string, unknown>
+  const query = schema.parse(
+    Object.fromEntries(
+      Object.entries(c.req.queries()).map(([key, values]) => [
+        key,
+        values.length === 1 ? values[0] : values,
+      ]),
+    ),
+  ) as Record<string, unknown>
   url.search = ''
   if (query['chainId'] === undefined) url.searchParams.set('chainId', String(c.get('chainId')))
   for (const [key, value] of Object.entries(query)) {
     if (value === undefined) continue
+    if (Array.isArray(value)) {
+      for (const item of value)
+        url.searchParams.append(key, String(item as number | string | boolean))
+      continue
+    }
     url.searchParams.set(key, String(value as number | string | boolean))
   }
   return url.toString()

package/src/internal/EdgeCache.test.ts

@@ -130,6 +130,33 @@ describe('middleware', () => {
     expect(store.size).toMatchInlineSnapshot(`0`)
   })
 
+  test('strips payment headers from private responses before sharing them', async () => {
+    const { app, store, downstreamCalls } = createApp()
+
+    const miss = await app.request('/private')
+    const hit = await app.request('/private')
+
+    expect(downstreamCalls()).toMatchInlineSnapshot(`1`)
+    expect(store.size).toMatchInlineSnapshot(`1`)
+    expect(miss.headers.get('payment-receipt')).toMatchInlineSnapshot(`"payer-specific"`)
+    expect(miss.headers.get('payment-session-snapshot')).toMatchInlineSnapshot(`"session-specific"`)
+    expect(hit.headers.get('payment-receipt')).toMatchInlineSnapshot(`null`)
+    expect(hit.headers.get('payment-session-snapshot')).toMatchInlineSnapshot(`null`)
+    expect(hit.headers.get('cache-control')).toMatchInlineSnapshot(
+      `"public, max-age=30, s-maxage=30"`,
+    )
+  })
+
+  test('does not cache responses marked `no-store`', async () => {
+    const { app, store, downstreamCalls } = createApp()
+
+    await app.request('/no-store')
+    await app.request('/no-store')
+
+    expect(downstreamCalls()).toMatchInlineSnapshot(`2`)
+    expect(store.size).toMatchInlineSnapshot(`0`)
+  })
+
   test('does not cache routes that did not opt in', async () => {
     const { app, store, downstreamCalls } = createApp()
 
@@ -271,6 +298,19 @@ function createApp(
     c.set('edgeCache', { maxAge: 30, staleWhileRevalidate: 300 })
     return c.json({ ok: false }, 500)
   })
+  app.get('/private', cacheable, (c) => {
+    c.set('edgeCache', { maxAge: 30 })
+    c.header('Cache-Control', 'private, max-age=30')
+    c.header('Payment-Receipt', 'payer-specific')
+    c.header('Payment-Session-Snapshot', 'session-specific')
+    return c.json({ ok: true })
+  })
+  app.get('/no-store', cacheable, (c) => {
+    c.set('edgeCache', { maxAge: 30 })
+    c.header('Cache-Control', 'no-store')
+    c.header('Payment-Receipt', 'payer-specific')
+    return c.json({ ok: true })
+  })
   app.get('/binary', cacheable, (c) => {
     c.set('edgeCache', { maxAge: 30, staleWhileRevalidate: 300 })
     // Bytes that are not valid UTF-8 (PNG signature) — corrupted if stored via