tapimo 0.5.2 → 0.6.0

package/src/apps/mcp.ts

@@ -15,7 +15,7 @@ const excludedTags = ['CoinGecko', 'MCP']
 
 /** Usage guidance surfaced to MCP clients on initialize. */
 const instructions =
-  "Tools mirror the Tempo API's data domain. Authenticated tools accept a Tempo API key sent as an `Authorization: Bearer` header on the HTTP request. List endpoints paginate via `cursor`/`nextCursor`. `docs_*` tools search the Tempo documentation."
+  "Tempo MCP provides access to the Tempo API's data domain and documentation. Authenticated tools accept a Tempo API key sent as an `Authorization: Bearer` header on the HTTP request. List endpoints paginate via `cursor`/`nextCursor`. `docs_*` tools search the Tempo documentation."
 
 /** Zod schemas owned by the MCP endpoint's OpenAPI description. */
 export namespace schema {
@@ -61,11 +61,22 @@ export namespace schema {
  * the other route groups:
  *
  * ```ts
- * App.create(options).route('/', mcp({ fetch: (request) => getApp().fetch(request) }))
+ * const app = App.create(options)
+ * const fetch = app.fetch.bind(app)
+ * app.route('/', mcp({ fetch }))
  * ```
+ *
+ * Capture `fetch` before adding request-level wrappers, so nested calls stay
+ * within the outer request's instrumentation lifecycle.
  */
 export function mcp(options: mcp.Options) {
-  const { docs = 'https://mcp.tempo.xyz/mcp', fetch, name = 'tapimo', version = '0.0.0' } = options
+  const {
+    docs = 'https://mcp.tempo.xyz/mcp',
+    fetch,
+    name = 'tempo',
+    title = 'Tempo MCP',
+    version = '0.0.0',
+  } = options
 
   // One incur instance per caller origin: the OpenAPI document is parsed once,
   // and generated commands rebase onto the origin so tool results embed real
@@ -95,7 +106,7 @@ export function mcp(options: mcp.Options) {
         const url = new URL(request.url)
         return fetch(new Request(new URL(url.pathname + url.search, origin), request))
       },
-      mcp: { instructions },
+      mcp: { instructions, title },
       openapi: scope(document),
       // `compact` + `security: false` keep tool schemas lean: no examples,
       // oversized regexes, or per-tool credential inputs (auth rides the
@@ -271,8 +282,10 @@ export declare namespace mcp {
     docs?: Source | false | undefined
     /** In-process fetch handler for the composed app (e.g. `(request) => app.fetch(request)`). */
     fetch: (request: Request) => Response | Promise<Response>
-    /** MCP server name. @default 'tapimo' */
+    /** MCP server name. @default 'tempo' */
     name?: string | undefined
+    /** Human-readable MCP server title. @default 'Tempo MCP' */
+    title?: string | undefined
     /** MCP server version. @default '0.0.0' */
     version?: string | undefined
   }

package/src/cli/Cli.test.ts

@@ -16,6 +16,14 @@ describe('from', () => {
 
       expect(cli.name).toMatchInlineSnapshot(`"tapimo"`)
       expect(cli.description).toMatchInlineSnapshot(`"Tempo API CLI"`)
+      expect((await initialize(cli)).result).toMatchObject({
+        instructions: expect.stringContaining('Tempo MCP provides access'),
+        serverInfo: {
+          name: 'tempo',
+          title: 'Tempo MCP',
+          version: '1.2.3',
+        },
+      })
     } finally {
       fetch.mockRestore()
     }
@@ -91,6 +99,34 @@ function mockHostedApi(app = TestApp.create()) {
   })
 }
 
+async function initialize(cli: ReturnType<typeof Cli.from>) {
+  const response = await cli.fetch(
+    new Request('http://localhost/mcp', {
+      body: JSON.stringify({
+        id: 1,
+        jsonrpc: '2.0',
+        method: 'initialize',
+        params: {
+          capabilities: {},
+          clientInfo: { name: 'test-client', version: '1.0.0' },
+          protocolVersion: '2025-03-26',
+        },
+      }),
+      headers: {
+        accept: 'application/json, text/event-stream',
+        'content-type': 'application/json',
+      },
+      method: 'POST',
+    }),
+  )
+  return (await response.json()) as {
+    result: {
+      instructions: string
+      serverInfo: { name: string; title: string; version: string }
+    }
+  }
+}
+
 async function serve(cli: ReturnType<typeof Cli.from>, argv: string[]) {
   const output: string[] = []
   await cli.serve(argv, {

package/src/cli/Cli.ts

@@ -8,7 +8,7 @@ const excludedTools = ['admin_*', 'gecko_*', 'v1_auth_*']
 
 /** Usage guidance surfaced to MCP clients on initialize (`<cli> --mcp`). */
 const instructions =
-  'Tools mirror the hosted Tempo API. Authenticated tools accept an `authorization` input (`Bearer <api key>`). List endpoints paginate via `cursor`/`nextCursor`. `docs_*` tools search the Tempo documentation.'
+  'Tempo MCP provides access to the hosted Tempo API and documentation. Authenticated tools accept an `authorization` input (`Bearer <api key>`). List endpoints paginate via `cursor`/`nextCursor`. `docs_*` tools search the Tempo documentation.'
 
 /**
  * Creates an incur CLI backed by a hosted Tempo API, plus the super admin
@@ -28,7 +28,12 @@ export function from(url: string | URL, options: from.Options = {}) {
     .create(name, {
       description,
       fetch: Fetch.fromRequest(url, request),
-      mcp: { instructions, tools: { exclude: excludedTools } },
+      mcp: {
+        instructions,
+        name: 'tempo',
+        title: 'Tempo MCP',
+        tools: { exclude: excludedTools },
+      },
       openapi,
       openapiConfig: options.openapiConfig ?? { mode: 'namespace' },
       version,

package/src/db/Db.test.ts

@@ -1,7 +1,9 @@
+import { sql } from 'kysely'
 import { nanoid } from 'nanoid'
 
 import * as Runtime from '../../test/runtime.js'
 import * as Db from './Db.js'
+import * as Invitations from './tables/invitations.js'
 import * as Organizations from './tables/organizations.js'
 
 const create = () => Db.postgres({ connectionString: Runtime.postgresUrl, schema: `t_${nanoid()}` })
@@ -15,6 +17,23 @@ describe('postgres', () => {
     await db.close()
   })
 
+  test('behavior: legacy invitation inserts retain early access during cutover', async () => {
+    const db = create()
+    await db.migrate()
+    await Organizations.create(db, { id: 'org_legacy', name: 'Legacy' })
+    await sql`
+      INSERT INTO invitations (
+        id, org_id, email, role, invited_by, expires_at, accepted_at, revoked_at, created_at
+      ) VALUES (
+        'inv_legacy', 'org_legacy', 'legacy@example.org', 'member', 'usr_legacy',
+        '2027-01-01T00:00:00.000Z', NULL, NULL, '2026-07-20T00:00:00.000Z'
+      )
+    `.execute(db.kysely)
+
+    expect((await Invitations.get(db, 'inv_legacy'))?.grantsEarlyAccess).toBe(true)
+    await db.close()
+  })
+
   test('behavior: creates a Postgres db without schema scoping', async () => {
     const db = Db.postgres({ connectionString: Runtime.postgresUrl })
     await db.close()

package/src/db/Db.ts

@@ -12,6 +12,7 @@ import * as pg from 'pg'
 
 import type * as AdminAuditLogs from './tables/adminAuditLogs.js'
 import type * as BillingSettings from './tables/billingSettings.js'
+import type * as EarlyAccess from './tables/earlyAccess.js'
 import type * as Invitations from './tables/invitations.js'
 import type * as InviteLinks from './tables/inviteLinks.js'
 import type * as Memberships from './tables/memberships.js'
@@ -21,6 +22,7 @@ import type * as RequestUsage from './tables/requestUsage.js'
 import type * as SponsoredTransactions from './tables/sponsoredTransactions.js'
 import type * as StripeCustomers from './tables/stripeCustomers.js'
 import type * as Users from './tables/users.js'
+import type * as VerifiedTokenRequests from './tables/verifiedTokenRequests.js'
 import type * as VerifiedTokens from './tables/verifiedTokens.js'
 import type * as WebhookDeliveries from './tables/webhookDeliveries.js'
 import type * as WebhookSubscriptions from './tables/webhookSubscriptions.js'
@@ -32,6 +34,7 @@ import type * as WebhookSubscriptions from './tables/webhookSubscriptions.js'
 export type Database = {
   admin_audit_logs: AdminAuditLogs.Table
   billing_settings: BillingSettings.Table
+  early_access: EarlyAccess.Table
   invitations: Invitations.Table
   invite_link_redemptions: InviteLinks.RedemptionTable
   invite_links: InviteLinks.Table
@@ -51,6 +54,7 @@ export type Database = {
   stripe_customers: StripeCustomers.Table
   users: Users.Table
   verified_token_lists: VerifiedTokens.ListTable
+  verified_token_requests: VerifiedTokenRequests.Table
   verified_tokens: VerifiedTokens.Table
   webhook_deliveries: WebhookDeliveries.Table
   webhook_subscriptions: WebhookSubscriptions.Table
@@ -645,6 +649,97 @@ export const migrations: readonly Migration[] = [
     name: '0058_request_usage_sequence_bigint',
     up: (db) => raw(db, sql`ALTER TABLE request_usage_meter_events ALTER COLUMN sequence TYPE bigint`), // prettier-ignore
   },
+  {
+    name: '0059_verified_token_requests',
+    up: (db) =>
+      db.schema
+        .createTable('verifiedTokenRequests')
+        .ifNotExists()
+        .addColumn('id', 'text', (c) => c.primaryKey())
+        .addColumn('orgId', 'text', (c) => c.notNull())
+        .addColumn('requestedBy', 'text', (c) => c.notNull())
+        .addColumn('chainId', 'integer', (c) => c.notNull())
+        .addColumn('address', 'text', (c) => c.notNull())
+        .addColumn('symbol', 'text', (c) => c.notNull())
+        .addColumn('name', 'text', (c) => c.notNull())
+        .addColumn('currency', 'text', (c) => c.notNull())
+        .addColumn('decimals', 'integer', (c) => c.notNull())
+        .addColumn('logoUri', 'text')
+        .addColumn('note', 'text')
+        .addColumn('status', 'text', (c) => c.notNull().defaultTo('pending'))
+        .addColumn('reviewNote', 'text')
+        .addColumn('reviewedBy', 'text')
+        .addColumn('reviewedAt', 'text')
+        .addColumn('createdAt', 'text', (c) => c.notNull())
+        .addColumn('updatedAt', 'text', (c) => c.notNull()),
+  },
+  {
+    name: '0060_verified_token_requests_org_index',
+    up: (db) =>
+      db.schema
+        .createIndex('verified_token_requests_org_idx')
+        .ifNotExists()
+        .on('verifiedTokenRequests')
+        .columns(['orgId', 'createdAt']),
+  },
+  {
+    name: '0061_verified_token_requests_pending_unique',
+    // Raw SQL: a partial unique index (snake_case; the CamelCase plugin does
+    // not map raw statements). At most one live pending request per
+    // (chain, address) globally; addresses are stored lowercase.
+    up: (db) =>
+      raw(
+        db,
+        sql`CREATE UNIQUE INDEX IF NOT EXISTS verified_token_requests_pending_unique ON verified_token_requests (chain_id, address) WHERE status = 'pending'`,
+      ),
+  },
+  {
+    name: '0062_verified_token_requests_status_index',
+    up: (db) =>
+      db.schema
+        .createIndex('verified_token_requests_status_idx')
+        .ifNotExists()
+        .on('verifiedTokenRequests')
+        .columns(['status', 'createdAt']),
+  },
+  {
+    name: '0063_verified_token_requests_logo',
+    up: (db) => raw(db, sql`ALTER TABLE verified_token_requests ADD COLUMN IF NOT EXISTS logo text`), // prettier-ignore
+  },
+  {
+    name: '0064_invitations_grants_early_access',
+    up: (db) => raw(db, sql`ALTER TABLE invitations ADD COLUMN IF NOT EXISTS grants_early_access boolean NOT NULL DEFAULT false`), // prettier-ignore
+  },
+  {
+    name: '0065_invitations_grants_early_access_backfill',
+    // Pre-gate invitations came from trusted-era users; the fixed cutoff keeps
+    // re-runs (test DBs replay every migration) from flipping newer rows.
+    up: (db) => raw(db, sql`UPDATE invitations SET grants_early_access = true WHERE created_at < '2026-07-20T00:00:00.000Z'`), // prettier-ignore
+  },
+  {
+    name: '0066_early_access',
+    up: (db) =>
+      db.schema
+        .createTable('earlyAccess')
+        .ifNotExists()
+        .addColumn('entry', 'text', (c) => c.primaryKey())
+        .addColumn('createdAt', 'text', (c) => c.notNull())
+        .addColumn('createdBy', 'text', (c) => c.notNull()),
+  },
+  {
+    name: '0067_invitations_grants_early_access_cutover',
+    // Every invitation present at deployment came from a trusted-era user.
+    up: (db) => raw(db, sql`UPDATE invitations SET grants_early_access = true`),
+  },
+  {
+    name: '0068_invitations_grants_early_access_legacy_default',
+    // Old workers omit this column during deploy; new writes set it explicitly.
+    up: (db) => raw(db, sql`ALTER TABLE invitations ALTER COLUMN grants_early_access SET DEFAULT true`), // prettier-ignore
+  },
+  {
+    name: '0069_invite_links_allowed_email_domains',
+    up: (db) => raw(db, sql`ALTER TABLE invite_links ADD COLUMN IF NOT EXISTS allowed_email_domains jsonb`), // prettier-ignore
+  },
 ]
 
 /**

package/src/db/Schema.ts

@@ -52,6 +52,20 @@ export const BillingSettings = z.object({
 /** Columns of the `billing_settings` table. */
 export type BillingSettings = z.output<typeof BillingSettings>
 
+/** An early-access allowlist entry: a lowercase domain or exact email. */
+export const EarlyAccessEntry = z.object({
+  createdAt: z.string().check(z.describe('When the entry was added (ISO 8601).')),
+  createdBy: z
+    .string()
+    .check(z.describe('Admin email that added the entry, or `migration` for seeded rows.')),
+  entry: z
+    .string()
+    .check(z.describe('Lowercase domain or exact email (contains `@`) granted early access.')),
+})
+
+/** Columns of the `early_access` table. */
+export type EarlyAccessEntry = z.output<typeof EarlyAccessEntry>
+
 /** A pending, expiring offer of organization membership. */
 export const Invitation = z.object({
   acceptedAt: z
@@ -62,6 +76,9 @@ export const Invitation = z.object({
     .string()
     .check(z.describe('Invitee email (stored lowercase); matched against verified emails.')),
   expiresAt: z.string().check(z.describe('When the invitation expires (ISO 8601).')),
+  grantsEarlyAccess: z
+    .boolean()
+    .check(z.describe("Whether the invitation grants early access; stamped from the inviter's own access at creation.")), // prettier-ignore
   id: z
     .string()
     .check(
@@ -83,6 +100,9 @@ export type Invitation = z.output<typeof Invitation>
 
 /** A reusable bearer link granting organization membership. */
 export const InviteLink = z.object({
+  allowedEmailDomains: z
+    .nullable(z.readonly(z.array(z.string())))
+    .check(z.describe('Lowercase email domains allowed to redeem, or null for unrestricted.')),
   createdAt: z.string().check(z.describe('When the link was created (ISO 8601).')),
   createdBy: z.string().check(z.describe('User id that created the link, or `super_admin`.')),
   deletedAt: z.nullable(z.string()).check(z.describe('When the link was soft deleted, or null.')),
@@ -363,6 +383,39 @@ export const VerifiedTokenList = z.object({
 /** Columns of the `verified_token_lists` table. */
 export type VerifiedTokenList = z.output<typeof VerifiedTokenList>
 
+/**
+ * An organization's request to add a token to the curated verified list.
+ * Addresses are stored lowercase; a partial unique index allows at most one
+ * pending request per (chain, address) globally.
+ */
+export const VerifiedTokenRequest = z.object({
+  address: z.string().check(z.describe('Requested TIP-20 token contract address (lowercase).')),
+  chainId: z.number().check(z.int(), z.describe('Chain the token belongs to.')),
+  createdAt: z.string().check(z.describe('When the request was created (ISO 8601).')),
+  currency: z.string().check(z.describe('Display currency, e.g. `USD`.')),
+  decimals: z.number().check(z.int(), z.describe('Decimal precision.')),
+  id: z.string().check(z.describe('Opaque request id (`vtr_…`).')),
+  logo: z
+    .nullable(z.string())
+    .check(z.describe('Inline SVG logo markup uploaded by the requester, or null.')),
+  logoUri: z.nullable(z.string()).check(z.describe('HTTPS logo URL from chain metadata, or null.')),
+  name: z.string().check(z.describe('Display name.')),
+  note: z.nullable(z.string()).check(z.describe('Requester note to reviewers, or null.')),
+  orgId: z.string().check(z.describe('Requesting organization id (`org_…`).')),
+  requestedBy: z
+    .string()
+    .check(z.describe('User id that submitted the request, or `super_admin`.')),
+  reviewNote: z.nullable(z.string()).check(z.describe('Reviewer note shown on denial, or null.')),
+  reviewedAt: z.nullable(z.string()).check(z.describe('When the request was reviewed, or null.')),
+  reviewedBy: z.nullable(z.string()).check(z.describe('Reviewing admin email, or null.')),
+  status: z.enum(['approved', 'denied', 'pending']).check(z.describe('Review status.')),
+  symbol: z.string().check(z.describe('Ticker symbol.'), z.meta({ examples: ['USDC'] })),
+  updatedAt: z.string().check(z.describe('When the request was last changed (ISO 8601).')),
+})
+
+/** Columns of the `verified_token_requests` table. */
+export type VerifiedTokenRequest = z.output<typeof VerifiedTokenRequest>
+
 /**
  * A webhook subscription. The `Webhooks.Owner` union maps to (`ownerType`,
  * `ownerId`); jsonb object columns round-trip as parsed values. `pollerCursor`

package/src/db/tables/earlyAccess.ts

@@ -0,0 +1,86 @@
+import type { Selectable } from 'kysely'
+
+import type * as Db from '../Db.js'
+import type * as db_Schema from '../Schema.js'
+
+/** Columns of the `early_access` table, derived from `Schema.EarlyAccessEntry`. */
+export type Table = db_Schema.EarlyAccessEntry
+
+/** A stored early-access allowlist row. */
+export type Record = Selectable<Table>
+
+/**
+ * Inserts an allowlist entry (a domain or exact email, normalized lowercase).
+ * Returns the stored record, or `undefined` when the entry already exists.
+ *
+ * @param db - The database.
+ * @param input - The entry to insert.
+ * @returns The stored record, or `undefined` when already present.
+ */
+export function add(db: Db.Db, input: add.Input): Promise<Record | undefined> {
+  return db.kysely
+    .insertInto('early_access')
+    .values({
+      createdAt: new Date().toISOString(),
+      createdBy: input.createdBy,
+      entry: input.entry.trim().toLowerCase(),
+    })
+    .onConflict((oc) => oc.column('entry').doNothing())
+    .returningAll()
+    .executeTakeFirst()
+}
+
+export declare namespace add {
+  /** Fields accepted when inserting an allowlist entry. */
+  type Input = {
+    /** Admin email adding the entry, or `migration` for seeded rows. */
+    createdBy: string
+    /** Domain or exact email to grant early access; normalized lowercase. */
+    entry: string
+  }
+}
+
+/**
+ * Lists all allowlist entries, ordered by entry.
+ *
+ * @param db - The database.
+ * @returns The records.
+ */
+export function list(db: Db.Db): Promise<Record[]> {
+  return db.kysely.selectFrom('early_access').selectAll().orderBy('entry', 'asc').execute()
+}
+
+/**
+ * Removes an allowlist entry.
+ *
+ * @param db - The database.
+ * @param entry - The entry to remove (matched lowercase).
+ * @returns The removed record, or `undefined` when absent.
+ */
+export function remove(db: Db.Db, entry: string): Promise<Record | undefined> {
+  return db.kysely
+    .deleteFrom('early_access')
+    .where('entry', '=', entry.trim().toLowerCase())
+    .returningAll()
+    .executeTakeFirst()
+}
+
+/**
+ * Whether an allowlist entry matches `email`: the exact email or its domain.
+ * Two primary-key lookups via `IN`.
+ *
+ * @param db - The database.
+ * @param email - The email to match (case-insensitive).
+ * @returns Whether an entry matches.
+ */
+export async function matches(db: Db.Db, email: string): Promise<boolean> {
+  const normalized = email.trim().toLowerCase()
+  const domain = normalized.slice(normalized.lastIndexOf('@') + 1)
+  const row = await db.kysely
+    .selectFrom('early_access')
+    .select('entry')
+    .where('entry', 'in', [normalized, domain])
+    .limit(1)
+    .executeTakeFirst()
+  return row !== undefined
+}

package/src/db/tables/invitations.ts

@@ -1,4 +1,4 @@
-import type { Selectable } from 'kysely'
+import { type Selectable, sql } from 'kysely'
 
 import * as Id from '../../internal/Id.js'
 import type * as Db from '../Db.js'
@@ -31,6 +31,7 @@ export function create(db: Db.Db, input: create.Input): Promise<Record> {
       createdAt: now,
       email: input.email.toLowerCase(),
       expiresAt: input.expiresAt,
+      grantsEarlyAccess: input.grantsEarlyAccess,
       id: Id.generate('inv'),
       invitedBy: input.invitedBy,
       orgId: input.orgId,
@@ -45,6 +46,8 @@ export function create(db: Db.Db, input: create.Input): Promise<Record> {
         .doUpdateSet({
           createdAt: now,
           expiresAt: input.expiresAt,
+          // Re-invites upgrade the grant, never withdraw it (raw SQL stays snake_case).
+          grantsEarlyAccess: sql<boolean>`invitations.grants_early_access OR excluded.grants_early_access`,
           invitedBy: input.invitedBy,
           role: input.role,
         }),
@@ -60,6 +63,8 @@ export declare namespace create {
     email: string
     /** When the invitation expires (ISO 8601). */
     expiresAt: string
+    /** Whether accepting grants early access; stamped from the inviter's own access. */
+    grantsEarlyAccess: boolean
     /** User or API key id creating the invitation. */
     invitedBy: string
     /** Organization id (`org_…`) the invitation joins. */
@@ -114,6 +119,26 @@ export function listByEmail(db: Db.Db, email: string): Promise<(Record & { orgNa
     .execute()
 }
 
+/**
+ * Whether any unrevoked invitation grants `email` early access. Acceptance and
+ * expiry are deliberately ignored: a trusted invite grants access until revoked.
+ *
+ * @param db - The database.
+ * @param email - The invitee email (matched lowercase).
+ * @returns Whether a grant exists.
+ */
+export async function hasEarlyAccessGrant(db: Db.Db, email: string): Promise<boolean> {
+  const row = await db.kysely
+    .selectFrom('invitations')
+    .select('id')
+    .where('email', '=', email.toLowerCase())
+    .where('grantsEarlyAccess', '=', true)
+    .where('revokedAt', 'is', null)
+    .limit(1)
+    .executeTakeFirst()
+  return row !== undefined
+}
+
 /**
  * Revokes a pending invitation.
  *

package/src/db/tables/inviteLinks.ts

@@ -1,11 +1,18 @@
-import type { Selectable } from 'kysely'
+import type { JSONColumnType, Selectable } from 'kysely'
 
 import * as Id from '../../internal/Id.js'
 import type * as Db from '../Db.js'
 import type * as db_Schema from '../Schema.js'
 
 /** Columns of the `invite_links` table. */
-export type Table = db_Schema.InviteLink
+export type Table = Omit<db_Schema.InviteLink, 'allowedEmailDomains'> & {
+  /** Lowercase email domains allowed to redeem, or null for unrestricted. */
+  allowedEmailDomains: JSONColumnType<
+    db_Schema.InviteLink['allowedEmailDomains'],
+    string | null,
+    string | null
+  >
+}
 /** Columns of the `invite_link_redemptions` table. */
 export type RedemptionTable = db_Schema.InviteLinkRedemption
 /** A stored invite link. */
@@ -28,6 +35,7 @@ export function status(record: Record, now = new Date().toISOString()): Status {
 export function create(
   db: Db.Db,
   input: {
+    allowedEmailDomains: readonly string[] | null
     createdBy: string
     expiresAt: string | null
     maxUses: number | null
@@ -40,6 +48,8 @@ export function create(
   return db.kysely
     .insertInto('invite_links')
     .values({
+      allowedEmailDomains:
+        input.allowedEmailDomains === null ? null : JSON.stringify(input.allowedEmailDomains),
       createdAt: now,
       createdBy: input.createdBy,
       deletedAt: null,
@@ -155,6 +165,10 @@ export function accept(
       .executeTakeFirst()
     if (existing) return { consumed: false, link }
     if (status(link, now) !== 'active') return undefined
+    const normalizedEmail = email.trim().toLowerCase()
+    const domain = normalizedEmail.slice(normalizedEmail.lastIndexOf('@') + 1)
+    if (link.allowedEmailDomains !== null && !link.allowedEmailDomains.includes(domain))
+      throw new EmailDomainForbiddenError()
     const inserted = await trx
       .insertInto('memberships')
       .values({ createdAt: now, orgId: link.orgId, role: 'member', updatedAt: now, userId })
@@ -171,7 +185,7 @@ export function accept(
       .insertInto('invite_link_redemptions')
       .values({
         createdAt: now,
-        email: email.toLowerCase(),
+        email: normalizedEmail,
         id: Id.generate('ilr'),
         inviteLinkId: link.id,
         inviteLinkName: link.name,
@@ -185,3 +199,8 @@ export function accept(
     }
   })
 }
+
+/** The verified email domain is not allowed by the invite link. */
+export class EmailDomainForbiddenError extends Error {
+  override name = 'InviteLinks.EmailDomainForbiddenError'
+}

package/src/db/tables/sponsoredTransactions.ts

@@ -397,6 +397,7 @@ export async function usage(db: Db.Db, options: usage.Options): Promise<usage.Bu
     .select([
       sql<string>`to_char(${bucket}, 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"')`.as('timestamp'),
       sql<string>`count(*)`.as('count'),
+      sql<string>`count(*) filter (where status = 'failed')`.as('failed'),
       sql<string>`coalesce(sum(case when status = 'finalized' then fee_amount::numeric when status = 'pending' then fee_max::numeric else 0 end), 0)`.as('feeTotal'), // prettier-ignore
     ])
     .where('orgId', '=', orgId)
@@ -410,6 +411,7 @@ export async function usage(db: Db.Db, options: usage.Options): Promise<usage.Bu
   const rows = await query.execute()
   return rows.map((row) => ({
     count: Number(row.count),
+    failed: Number(row.failed),
     feeTotal: BigInt(row.feeTotal),
     timestamp: row.timestamp,
   }))
@@ -420,6 +422,8 @@ export declare namespace usage {
   type Bucket = {
     /** Sponsored transactions recorded in the bucket, any status. */
     count: number
+    /** Sponsored transactions in the bucket whose status is `failed`. */
+    failed: number
     /** Committed fees in fee-token base units: finalized fees plus pending caps. */
     feeTotal: bigint
     /** Bucket start (ISO 8601), aligned to UTC calendar boundaries. */