tapimo 0.5.3 → 0.7.0

package/src/handlers/relay.ts

@@ -639,20 +639,30 @@ export function relay(options: relay.Options = {}): Handler {
 
   async function handlePost(c: { req: { raw: Request; param: (key: string) => string } }) {
     const chainId = Utils.resolveChainId(c.req.param('chainId'))
-    const body = await c.req.raw.json()
+    const body = await c.req.raw.json().catch(() => undefined)
+    if (body === undefined) return Response.json(rpcProtocolError('parse'))
+
     const isBatch = Array.isArray(body)
 
     if (!isBatch) {
+      if (!isRpcRequest(body)) return Response.json(rpcProtocolError('invalid_request'))
       const request = RpcRequest.from(body as never) as RpcRequest.RpcRequest<RpcSchema.Ox>
-      return Response.json(await handleRequest(request, { chainId }))
+      const response = await handleRequest(request, { chainId }).catch((error) =>
+        Utils.rpcErrorJson(request, error),
+      )
+      return Response.json(response)
     }
 
+    if (body.length === 0) return Response.json(rpcProtocolError('invalid_request'))
+
     const responses = await Promise.all(
-      (body as unknown[]).map((item) =>
-        handleRequest(RpcRequest.from(item as never) as RpcRequest.RpcRequest<RpcSchema.Ox>, {
-          chainId,
-        }),
-      ),
+      body.map((item) => {
+        if (!isRpcRequest(item)) return Promise.resolve(rpcProtocolError('invalid_request'))
+        return handleRequest(
+          RpcRequest.from(item as never) as RpcRequest.RpcRequest<RpcSchema.Ox>,
+          { chainId },
+        ).catch((error) => Utils.rpcErrorJson(item as RpcRequest.RpcRequest, error))
+      }),
     )
     return Response.json(responses)
   }
@@ -663,6 +673,31 @@ export function relay(options: relay.Options = {}): Handler {
   return router
 }
 
+function isRpcRequest(value: unknown): value is Record<string, unknown> {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return false
+  const request = value as Record<string, unknown>
+  if (request['jsonrpc'] !== '2.0' || typeof request['method'] !== 'string') return false
+
+  const id = request['id']
+  if (id !== undefined && id !== null && typeof id !== 'number' && typeof id !== 'string')
+    return false
+
+  const params = request['params']
+  if (params === undefined || Array.isArray(params)) return true
+  return Boolean(params) && typeof params === 'object'
+}
+
+function rpcProtocolError(type: 'invalid_request' | 'parse') {
+  return {
+    error:
+      type === 'parse'
+        ? { code: RpcResponse.ParseError.code, message: 'Parse error' }
+        : { code: RpcResponse.InvalidRequestError.code, message: 'Invalid Request' },
+    id: null,
+    jsonrpc: '2.0',
+  }
+}
+
 function defaultGetClient(options: { apiKey?: string | undefined }) {
   const clients = new Map<number, Client>()
   for (const chain of defaultChains) {

package/src/internal/Auth.test.ts

@@ -671,7 +671,7 @@ describe('require', () => {
         headers: { 'tempo-api-key': sandboxToken },
       })
       expect(response.status).toBe(200)
-      // The public ceiling (60), not the API-key default (100).
+      // The public ceiling (60), not the API-key default (10,000).
       expect(response.headers.get('RateLimit-Limit')).toMatchInlineSnapshot(`"60"`)
     })
 
@@ -684,8 +684,8 @@ describe('require', () => {
         headers: { 'tempo-api-key': sandboxToken },
       })
       expect(response.status).toBe(200)
-      // The API-key default (100), not the public ceiling (60).
-      expect(response.headers.get('RateLimit-Limit')).toMatchInlineSnapshot(`"100"`)
+      // The API-key default (10,000), not the public ceiling (60).
+      expect(response.headers.get('RateLimit-Limit')).toMatchInlineSnapshot(`"10000"`)
     })
 
     test('throttles a sandbox key to the public quota when billing is unknown', async () => {

package/src/internal/Auth.ts

@@ -6,7 +6,6 @@ import { createMiddleware } from 'hono/factory'
 import { matchedRoutes } from 'hono/route'
 import type { MergePath, RouterRoute, Schema as core_Schema } from 'hono/types'
 import { findTargetHandler } from 'hono/utils/handler'
-import { decodeJwt } from 'jose'
 import { Challenge, Credential, type Method } from 'mppx'
 import { Mppx, tempo } from 'mppx/hono'
 import { Addresses } from 'viem/tempo'
@@ -17,7 +16,6 @@ import * as ApiKey from '../ApiKey.js'
 import * as ApiKeys from '../ApiKeys.js'
 import * as Db from '../db/Db.js'
 import type * as Store from './Store.js'
-import * as Invitations from '../db/tables/invitations.js'
 import * as Memberships from '../db/tables/memberships.js'
 import * as Metadata from '../apps/metadata.js'
 import * as OpenApi from './OpenApi.js'
@@ -32,6 +30,7 @@ import * as Viem from './Viem.js'
 
 const policySymbol = Symbol('tempo-api.auth.policy')
 const mppManagementSymbol = Symbol('tempo-api.auth.mpp-management')
+const defaultApiKeyRateLimit = { perMinute: 10_000 } satisfies RateLimit.Limit
 const defaultMppRateLimit = { perMinute: 100 } satisfies RateLimit.Limit
 
 /** Auth context consumed by Tempo API handlers. */
@@ -346,6 +345,9 @@ export function ensureProject(): MiddlewareHandler {
  */
 export const narrowScope = false as boolean
 
+/** Always false at runtime; lets handlers include organization role errors in inferred response unions. */
+export const narrowOrgRole = false as boolean
+
 /** Typed org-scope error response for Hono client inference. Never reached at runtime. */
 export function ensureOrgError(c: hono_Context) {
   return Response.error(c, {
@@ -355,6 +357,15 @@ export function ensureOrgError(c: hono_Context) {
   })
 }
 
+/** Typed organization-role error response for Hono client inference. Never reached at runtime. */
+export function ensureOrgRoleError(c: hono_Context) {
+  return Response.error(c, {
+    code: 'forbidden',
+    message: 'Insufficient organization role',
+    status: 403,
+  })
+}
+
 /** Typed project-scope error response for Hono client inference. Never reached at runtime. */
 export function ensureProjectError(c: hono_Context) {
   // Nested project routes run the org scope first, so either not-found can surface.
@@ -764,12 +775,6 @@ export function install(options: install.Options) {
     if (!options_session || !kv) return undefined
     const { issuer, origin, requireEmail, ttl } =
       (typeof options_session === 'object' ? options_session.wallet : undefined) ?? {}
-    // Case-insensitive exact-match email-domain allowlist for new-user sign-ups.
-    const emailAllowlist = (
-      typeof options_session === 'object' ? options_session.emailAllowlist : undefined
-    )
-      ?.map((domain) => domain.trim().toLowerCase())
-      .filter(Boolean)
 
     const handler = Accounts.Handler.auth({
       ...(issuer || requireEmail
@@ -834,38 +839,6 @@ export function install(options: install.Options) {
     const policy_session = policy({ public: true, session: true })
     const describe = OpenApi.describeRoute({ hide: true })
 
-    // Sign-up gate: new addresses need an allowlisted identity email domain
-    // or a pending invitation; existing users pass. The claim decodes
-    // unverified; the mounted handler verifies the token before any session
-    // or user is created, so a forged claim never authenticates.
-    const gate_signup = createMiddleware<App.Environment>(async (c, next) => {
-      if (!emailAllowlist?.length) return next()
-      const { address, idToken } = (await c.req.json()) as z.output<typeof schema.verify.Body>
-      const database = Db.get(db)
-      const user = await Users.getByAddress(database, address)
-      if (!user) {
-        const email = (() => {
-          if (!idToken) return undefined
-          try {
-            const { email } = decodeJwt<{ email?: string }>(idToken)
-            return typeof email === 'string' ? email.toLowerCase() : undefined
-          } catch {
-            return undefined
-          }
-        })()
-        const allowed = await (async () => {
-          if (!email) return false
-          const at = email.lastIndexOf('@')
-          if (at > 0 && emailAllowlist.includes(email.slice(at + 1))) return true
-          // A pending invitation admits the email regardless of domain.
-          return (await Invitations.listByEmail(database, email)).length > 0
-        })()
-        if (!allowed)
-          return c.json({ error: 'sign-ups are restricted to approved email domains or invited emails' }, 403) // prettier-ignore
-      }
-      return next()
-    })
-
     const app = new Hono<App.Environment>()
       .use('/v1/auth/siwe', policy_public, describe)
       .use('/v1/auth/siwe/*', policy_public, describe)
@@ -906,7 +879,6 @@ export function install(options: install.Options) {
         code: 'body_invalid',
         message: 'Invalid request body',
       }),
-      gate_signup,
       OpenApi.describeRoute({
         description:
           'Verifies the signed challenge and establishes a session. Sets a session cookie by default; pass `returnToken` to receive a bearer token instead.',
@@ -926,9 +898,6 @@ export function install(options: install.Options) {
           },
           400: handlerError('Invalid, expired, or mismatched challenge message; or a required identity token is missing.'), // prettier-ignore
           401: handlerError('Signature or identity verification failed.'),
-          ...(emailAllowlist?.length
-            ? { 403: handlerError('Sign-up rejected: the identity email is neither on an allowlisted domain nor pending an invitation.') } // prettier-ignore
-            : {}),
           409: handlerError('Challenge nonce already used or unknown.'),
           429: OpenApi.standardError(429, 'Rate limited.'),
           500: OpenApi.standardError(500, 'Internal server error.'),
@@ -997,8 +966,6 @@ export declare namespace install {
   type Session =
     | boolean
     | {
-        /** Restrict new-user sign-ups to verified emails on these domains (case-insensitive exact match); invited emails and existing users sign in unaffected. */
-        emailAllowlist?: readonly string[] | undefined
         /** SIWE wallet sign-in configuration. */
         wallet?: Wallet | undefined
       }
@@ -1754,7 +1721,8 @@ function resolveApiKeyLimit(options: resolveApiKeyLimit.Options): RateLimit.Limi
     policy?.rateLimit ?? // 2. route override (protective cap)
     apiKey.rateLimits?.[Scope.wildcard] ?? // 3. per-key default
     auth.apiKey?.rateLimits?.[scope] ?? // 4. config per-scope
-    auth.apiKey?.rateLimits?.[Scope.wildcard] ?? { perMinute: 100 } // 5. config default // 6. hardcoded fallback
+    auth.apiKey?.rateLimits?.[Scope.wildcard] ?? // 5. config default
+    defaultApiKeyRateLimit // 6. hardcoded fallback
   )
 }
 

package/src/internal/FundingQuotes.test.ts

@@ -10,6 +10,7 @@ const baseUsdcRequest = {
 
 describe('listQuotes', () => {
   test('returns normalized successful provider quotes', async () => {
+    const attempts: FundingQuotes.ProviderAttempt[] = []
     let seen: FundingQuotes.QuoteProbeInput | undefined
     const quotes = await FundingQuotes.listQuotes({
       ...baseUsdcRequest,
@@ -33,30 +34,54 @@ describe('listQuotes', () => {
           },
         },
       },
+      onAttempt: (attempt) => attempts.push(attempt),
     })
 
     expect(seen?.candidate.id).toBe('base-usdc-tempo-usdce-relay')
     expect(quotes).toHaveLength(1)
     expect(quotes[0]).toMatchObject({
+      destinationAmount: {
+        baseUnits: '990000',
+        currency: 'USD',
+        decimals: 6,
+        formatted: '0.99',
+      },
+      destinationAmountMin: {
+        baseUnits: '980000',
+        currency: 'USD',
+        decimals: 6,
+        formatted: '0.98',
+      },
       id: 'base-usdc-tempo-usdce-relay',
       quality: {
         liquiditySource: 'providerQuote',
         tier: 'liquid',
       },
-      quote: {
-        inputAmount: '1000000',
-        minimumOutputAmount: '980000',
-        outputAmount: '990000',
-        outputAmountFormatted: '0.99',
+      quote: { sampledAt: '2026-01-01T00:00:00Z' },
+      sourceAmount: {
+        baseUnits: '1000000',
+        currency: 'USD',
+        decimals: 6,
+        formatted: '1',
       },
     })
+    expect(attempts.map(stableAttempt)).toEqual([{ outcome: 'available', provider: 'relay' }])
+    expect(attempts[0]?.durationMs).toEqual(expect.any(Number))
   })
 
   test('returns no static candidates when no adapter is configured', async () => {
-    await expect(FundingQuotes.listQuotes(baseUsdcRequest)).resolves.toEqual([])
+    const attempts: FundingQuotes.ProviderAttempt[] = []
+    await expect(
+      FundingQuotes.listQuotes({
+        ...baseUsdcRequest,
+        onAttempt: (attempt) => attempts.push(attempt),
+      }),
+    ).resolves.toEqual([])
+    expect(attempts).toEqual([])
   })
 
   test('omits provider-declared unavailable quotes', async () => {
+    const attempts: FundingQuotes.ProviderAttempt[] = []
     const quotes = FundingQuotes.listQuotes({
       ...baseUsdcRequest,
       adapters: {
@@ -66,12 +91,15 @@ describe('listQuotes', () => {
           },
         },
       },
+      onAttempt: (attempt) => attempts.push(attempt),
     })
 
     await expect(quotes).resolves.toEqual([])
+    expect(attempts.map(stableAttempt)).toEqual([{ outcome: 'unavailable', provider: 'relay' }])
   })
 
   test('rejects provider failures when no quote succeeds', async () => {
+    const attempts: FundingQuotes.ProviderAttempt[] = []
     const quotes = FundingQuotes.listQuotes({
       ...baseUsdcRequest,
       adapters: {
@@ -81,6 +109,7 @@ describe('listQuotes', () => {
           },
         },
       },
+      onAttempt: (attempt) => attempts.push(attempt),
     })
 
     const cause = await quotes.catch((error: unknown) => error)
@@ -88,6 +117,31 @@ describe('listQuotes', () => {
       failures: [{ cause: expect.any(Error), provider: 'relay' }],
       name: 'FundingQuotes.ProviderQuoteError',
     })
+    expect(attempts.map(stableAttempt)).toEqual([
+      { cause: expect.any(Error), outcome: 'failed', provider: 'relay' },
+    ])
+  })
+
+  test('records thin quotes separately from available quotes', async () => {
+    const attempts: FundingQuotes.ProviderAttempt[] = []
+    const quotes = await FundingQuotes.listQuotes({
+      ...baseUsdcRequest,
+      adapters: {
+        relay: {
+          async probeQuote() {
+            return {
+              outputAmount: '990000',
+              sampledAt: '2026-01-01T00:00:00Z',
+              status: 'thin',
+            }
+          },
+        },
+      },
+      onAttempt: (attempt) => attempts.push(attempt),
+    })
+
+    expect(quotes).toHaveLength(1)
+    expect(attempts.map(stableAttempt)).toEqual([{ outcome: 'thin', provider: 'relay' }])
   })
 
   test('rejects successful provider responses without output amounts', async () => {
@@ -108,6 +162,7 @@ describe('listQuotes', () => {
   })
 
   test('aborts providers that exceed the quote deadline', async () => {
+    const attempts: FundingQuotes.ProviderAttempt[] = []
     let aborted = false
     const quotes = FundingQuotes.listQuotes({
       ...baseUsdcRequest,
@@ -122,12 +177,20 @@ describe('listQuotes', () => {
           },
         },
       },
+      onAttempt: (attempt) => attempts.push(attempt),
     })
 
     await expect(quotes).rejects.toThrowErrorMatchingInlineSnapshot(
       `[FundingQuotes.ProviderQuoteError]`,
     )
     expect(aborted).toBe(true)
+    expect(attempts.map(stableAttempt)).toEqual([
+      {
+        cause: expect.any(FundingQuotes.ProviderAdapterTimeoutError),
+        outcome: 'failed',
+        provider: 'relay',
+      },
+    ])
   })
 
   test('passes cache policy through to providers', async () => {
@@ -149,6 +212,7 @@ describe('listQuotes', () => {
   })
 
   test('returns successful quotes when another provider fails', async () => {
+    const attempts: FundingQuotes.ProviderAttempt[] = []
     const quotes = await FundingQuotes.listQuotes({
       ...baseUsdcRequest,
       adapters: {
@@ -167,14 +231,63 @@ describe('listQuotes', () => {
           },
         },
       },
+      onAttempt: (attempt) => attempts.push(attempt),
       provider: undefined,
     })
 
     expect(quotes).toHaveLength(1)
     expect(quotes[0]?.provider.id).toBe('relay')
+    expect(attempts.map(stableAttempt)).toEqual([
+      { cause: expect.any(Error), outcome: 'failed', provider: 'across' },
+      { outcome: 'available', provider: 'relay' },
+    ])
+  })
+
+  test('does not let attempt observers change quote outcomes', async () => {
+    const adapters = {
+      relay: {
+        async probeQuote() {
+          return {
+            outputAmount: '990000',
+            sampledAt: '2026-01-01T00:00:00Z',
+            status: 'available' as const,
+          }
+        },
+      },
+    }
+    await expect(
+      FundingQuotes.listQuotes({
+        ...baseUsdcRequest,
+        adapters,
+        onAttempt() {
+          throw new Error('observer failed')
+        },
+      }),
+    ).resolves.toHaveLength(1)
+
+    await expect(
+      FundingQuotes.listQuotes({
+        ...baseUsdcRequest,
+        adapters: {
+          relay: {
+            async probeQuote() {
+              throw new Error('provider failed')
+            },
+          },
+        },
+        onAttempt() {
+          throw new Error('observer failed')
+        },
+      }),
+    ).rejects.toThrowErrorMatchingInlineSnapshot(`[FundingQuotes.ProviderQuoteError]`)
   })
 })
 
+function stableAttempt(attempt: FundingQuotes.ProviderAttempt) {
+  const { durationMs: _durationMs, ...rest } = attempt
+  return rest
+}
+
 describe('listChains', () => {
   test('returns only chain and token inputs with quote inventory', () => {
     expect(FundingQuotes.listChains().map((chain) => chain.id)).toEqual([
@@ -261,6 +374,41 @@ describe('listQuoteCandidates', () => {
       'ethereum-usdt-tempo-usdt0-squid',
     ])
   })
+
+  test('selects proven Symbiosis stablecoin corridors', () => {
+    const candidates = [
+      FundingQuotes.listQuoteCandidates({
+        destinationToken: 'USDC.e',
+        provider: 'symbiosis',
+        sourceAmount: '1000000',
+        sourceAmountUnits: 'baseUnits',
+        sourceChain: 'base',
+        sourceToken: 'USDC',
+      })[0],
+      FundingQuotes.listQuoteCandidates({
+        destinationToken: 'USDT0',
+        provider: 'symbiosis',
+        sourceAmount: '1000000',
+        sourceAmountUnits: 'baseUnits',
+        sourceChain: 'ethereum',
+        sourceToken: 'USDT',
+      })[0],
+      FundingQuotes.listQuoteCandidates({
+        destinationToken: 'USDT0',
+        provider: 'symbiosis',
+        sourceAmount: '1000000',
+        sourceAmountUnits: 'baseUnits',
+        sourceChain: 'tron',
+        sourceToken: 'USDT',
+      })[0],
+    ]
+
+    expect(candidates.map((candidate) => candidate?.id)).toEqual([
+      'base-usdc-tempo-usdce-symbiosis',
+      'ethereum-usdt-tempo-usdt0-symbiosis',
+      'tron-usdt-tempo-usdt0-symbiosis',
+    ])
+  })
 })
 
 describe('listProviders', () => {
@@ -295,6 +443,13 @@ describe('listProviders', () => {
           "requiresApiKey": true,
           "status": "unconfigured",
         },
+        {
+          "id": "symbiosis",
+          "kind": "crossChainDex",
+          "name": "Symbiosis",
+          "requiresApiKey": false,
+          "status": "unconfigured",
+        },
       ]
     `)
   })