tapimo 0.6.0 → 0.7.0

package/src/db/tables/organizations.ts

@@ -3,6 +3,7 @@ import { sql, type Selectable } from 'kysely'
 import * as Id from '../../internal/Id.js'
 import type * as Db from '../Db.js'
 import type * as db_Schema from '../Schema.js'
+import type * as EnabledBillingSources from './enabledBillingSources.js'
 import type * as Memberships from './memberships.js'
 
 /** Columns of the `organizations` table, derived from `Schema.Organization`. */
@@ -50,8 +51,8 @@ export declare namespace create {
 }
 
 /**
- * Inserts an organization owned by `userId` — the org row plus its `owner`
- * membership, atomically.
+ * Inserts an organization, its owner membership, and initial billing sources
+ * atomically.
  *
  * @param db - The database.
  * @param input - The organization to insert.
@@ -82,6 +83,18 @@ export function createOwned(db: Db.Db, input: createOwned.Input): Promise<Record
         userId: input.userId,
       })
       .execute()
+    if (input.enabledBillingSources?.length)
+      await trx
+        .insertInto('enabled_billing_sources')
+        .values(
+          input.enabledBillingSources.map((source) => ({
+            createdAt: now,
+            createdBy: input.userId,
+            orgId: record.id,
+            source,
+          })),
+        )
+        .execute()
     return record
   })
 }
@@ -89,6 +102,8 @@ export function createOwned(db: Db.Db, input: createOwned.Input): Promise<Record
 export declare namespace createOwned {
   /** Fields accepted when inserting a user-owned organization. */
   type Input = {
+    /** Billing sources enabled when the organization is created. */
+    enabledBillingSources?: readonly EnabledBillingSources.Source[] | undefined
     /** Human-readable organization name. */
     name: string
     /** Owning user id (`usr_…`), granted the `owner` membership. */
@@ -121,6 +136,7 @@ export function deleteOrganization(db: Db.Db, id: string): Promise<boolean> {
       .where('ownerId', '=', id)
       .execute()
     await trx.deleteFrom('billing_settings').where('orgId', '=', id).execute()
+    await trx.deleteFrom('enabled_billing_sources').where('orgId', '=', id).execute()
     await trx.deleteFrom('invitations').where('orgId', '=', id).execute()
     await trx.deleteFrom('invite_link_redemptions').where('orgId', '=', id).execute()
     await trx.deleteFrom('invite_links').where('orgId', '=', id).execute()

package/src/handlers/internal/utils.ts

@@ -3,6 +3,8 @@ import { KeyAuthorization, Transaction as core_Transaction, TxEnvelopeTempo } fr
 import { type Client, BaseError } from 'viem'
 import * as z from 'zod/mini'
 
+import * as ApiResponse from '../../internal/Response.js'
+
 export function resolveChainId(value: unknown) {
   if (typeof value === 'number') return value
   if (typeof value === 'bigint') return Number(value)
@@ -97,24 +99,38 @@ export function rpcErrorJson(request: RpcRequest.RpcRequest, error: unknown) {
       { request },
     )
 
-  if ((error as { name?: string | undefined }).name === 'ZodError')
+  if (error instanceof z.core.$ZodError)
     return RpcResponse.from(
       {
         error: {
           code: RpcResponse.InvalidParamsError.code,
-          message: (error as Error).message,
+          data: {
+            code: 'invalid_params',
+            issues: ApiResponse.validationDetails(error.issues.slice(0, 10)),
+          },
+          message: 'Invalid params.',
         },
       },
       { request },
     )
 
   const inner = resolveError(error)
-  const message = inner.message ?? (error as Error).message
-  const code = inner.code ?? -32603
-  const data = inner.data
+  if (inner.code === undefined || inner.message === undefined)
+    return RpcResponse.from(
+      {
+        error: {
+          code: RpcResponse.InternalError.code,
+          data: { code: 'internal_error' },
+          message: 'Internal error',
+        },
+      },
+      { request },
+    )
+
+  const { code, data, message } = inner
   return RpcResponse.from(
     {
-      error: { code, message, ...(data ? { data } : {}) },
+      error: { code, message, ...(data === undefined ? {} : { data }) },
     },
     { request },
   )

package/src/handlers/relay.errors.test.ts

@@ -0,0 +1,153 @@
+import * as z from 'zod/mini'
+
+import * as Relay from '../../test/Relay.js'
+
+describe('request errors', () => {
+  test('returns Parse error for invalid JSON', async () => {
+    const server = await Relay.createServer((await Relay.relay()).listener)
+
+    try {
+      const response = await fetch(server.url, {
+        body: '{',
+        headers: { 'Content-Type': 'application/json' },
+        method: 'POST',
+      })
+
+      expect(await response.json()).toMatchInlineSnapshot(`
+        {
+          "error": {
+            "code": -32700,
+            "message": "Parse error",
+          },
+          "id": null,
+          "jsonrpc": "2.0",
+        }
+      `)
+    } finally {
+      await server.closeAsync()
+    }
+  })
+
+  test.each([
+    ['non-object request', 'null'],
+    ['invalid version', JSON.stringify({ id: 1, jsonrpc: '1.0', method: 'eth_chainId' })],
+    ['empty batch', '[]'],
+  ])('returns Invalid Request for %s', async (_name, body) => {
+    const server = await Relay.createServer((await Relay.relay()).listener)
+
+    try {
+      const response = await fetch(server.url, {
+        body,
+        headers: { 'Content-Type': 'application/json' },
+        method: 'POST',
+      })
+
+      expect(await response.json()).toMatchInlineSnapshot(`
+        {
+          "error": {
+            "code": -32600,
+            "message": "Invalid Request",
+          },
+          "id": null,
+          "jsonrpc": "2.0",
+        }
+      `)
+    } finally {
+      await server.closeAsync()
+    }
+  })
+
+  test('returns one Invalid Request error for a malformed batch member', async () => {
+    const server = await Relay.createServer(
+      (
+        await Relay.relay({
+          getClient: () => {
+            throw new Error('transport credential must not leak')
+          },
+        })
+      ).listener,
+    )
+
+    try {
+      const response = await fetch(server.url, {
+        body: JSON.stringify([
+          { id: 1, jsonrpc: '2.0', method: 'eth_chainId' },
+          { id: 2, jsonrpc: '1.0', method: 'eth_chainId' },
+        ]),
+        headers: { 'Content-Type': 'application/json' },
+        method: 'POST',
+      })
+
+      expect(await response.json()).toMatchInlineSnapshot(`
+        [
+          {
+            "error": {
+              "code": -32603,
+              "data": {
+                "code": "internal_error",
+              },
+              "message": "Internal error",
+            },
+            "id": 1,
+            "jsonrpc": "2.0",
+          },
+          {
+            "error": {
+              "code": -32600,
+              "message": "Invalid Request",
+            },
+            "id": null,
+            "jsonrpc": "2.0",
+          },
+        ]
+      `)
+    } finally {
+      await server.closeAsync()
+    }
+  })
+
+  test('returns bounded structured issues for invalid params', async () => {
+    const schema = z.object({ value: z.string() })
+    const server = await Relay.createServer(
+      (
+        await Relay.relay({
+          onRequest: async () => {
+            schema.parse({ value: 1 })
+          },
+        })
+      ).listener,
+    )
+
+    try {
+      const response = await fetch(server.url, {
+        body: JSON.stringify({ id: 1, jsonrpc: '2.0', method: 'eth_chainId' }),
+        headers: { 'Content-Type': 'application/json' },
+        method: 'POST',
+      })
+
+      expect(await response.json()).toMatchInlineSnapshot(`
+        {
+          "error": {
+            "code": -32602,
+            "data": {
+              "code": "invalid_params",
+              "issues": [
+                {
+                  "message": "Invalid input",
+                  "path": [
+                    "value",
+                  ],
+                },
+              ],
+            },
+            "message": "Invalid params.",
+          },
+          "id": 1,
+          "jsonrpc": "2.0",
+        }
+      `)
+    } finally {
+      await server.closeAsync()
+    }
+  })
+})

package/src/handlers/relay.ts

@@ -639,20 +639,30 @@ export function relay(options: relay.Options = {}): Handler {
 
   async function handlePost(c: { req: { raw: Request; param: (key: string) => string } }) {
     const chainId = Utils.resolveChainId(c.req.param('chainId'))
-    const body = await c.req.raw.json()
+    const body = await c.req.raw.json().catch(() => undefined)
+    if (body === undefined) return Response.json(rpcProtocolError('parse'))
+
     const isBatch = Array.isArray(body)
 
     if (!isBatch) {
+      if (!isRpcRequest(body)) return Response.json(rpcProtocolError('invalid_request'))
       const request = RpcRequest.from(body as never) as RpcRequest.RpcRequest<RpcSchema.Ox>
-      return Response.json(await handleRequest(request, { chainId }))
+      const response = await handleRequest(request, { chainId }).catch((error) =>
+        Utils.rpcErrorJson(request, error),
+      )
+      return Response.json(response)
     }
 
+    if (body.length === 0) return Response.json(rpcProtocolError('invalid_request'))
+
     const responses = await Promise.all(
-      (body as unknown[]).map((item) =>
-        handleRequest(RpcRequest.from(item as never) as RpcRequest.RpcRequest<RpcSchema.Ox>, {
-          chainId,
-        }),
-      ),
+      body.map((item) => {
+        if (!isRpcRequest(item)) return Promise.resolve(rpcProtocolError('invalid_request'))
+        return handleRequest(
+          RpcRequest.from(item as never) as RpcRequest.RpcRequest<RpcSchema.Ox>,
+          { chainId },
+        ).catch((error) => Utils.rpcErrorJson(item as RpcRequest.RpcRequest, error))
+      }),
     )
     return Response.json(responses)
   }
@@ -663,6 +673,31 @@ export function relay(options: relay.Options = {}): Handler {
   return router
 }
 
+function isRpcRequest(value: unknown): value is Record<string, unknown> {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return false
+  const request = value as Record<string, unknown>
+  if (request['jsonrpc'] !== '2.0' || typeof request['method'] !== 'string') return false
+
+  const id = request['id']
+  if (id !== undefined && id !== null && typeof id !== 'number' && typeof id !== 'string')
+    return false
+
+  const params = request['params']
+  if (params === undefined || Array.isArray(params)) return true
+  return Boolean(params) && typeof params === 'object'
+}
+
+function rpcProtocolError(type: 'invalid_request' | 'parse') {
+  return {
+    error:
+      type === 'parse'
+        ? { code: RpcResponse.ParseError.code, message: 'Parse error' }
+        : { code: RpcResponse.InvalidRequestError.code, message: 'Invalid Request' },
+    id: null,
+    jsonrpc: '2.0',
+  }
+}
+
 function defaultGetClient(options: { apiKey?: string | undefined }) {
   const clients = new Map<number, Client>()
   for (const chain of defaultChains) {

package/src/internal/Auth.test.ts

@@ -671,7 +671,7 @@ describe('require', () => {
         headers: { 'tempo-api-key': sandboxToken },
       })
       expect(response.status).toBe(200)
-      // The public ceiling (60), not the API-key default (100).
+      // The public ceiling (60), not the API-key default (10,000).
       expect(response.headers.get('RateLimit-Limit')).toMatchInlineSnapshot(`"60"`)
     })
 
@@ -684,8 +684,8 @@ describe('require', () => {
         headers: { 'tempo-api-key': sandboxToken },
       })
       expect(response.status).toBe(200)
-      // The API-key default (100), not the public ceiling (60).
-      expect(response.headers.get('RateLimit-Limit')).toMatchInlineSnapshot(`"100"`)
+      // The API-key default (10,000), not the public ceiling (60).
+      expect(response.headers.get('RateLimit-Limit')).toMatchInlineSnapshot(`"10000"`)
     })
 
     test('throttles a sandbox key to the public quota when billing is unknown', async () => {

package/src/internal/Auth.ts

@@ -16,8 +16,6 @@ import * as ApiKey from '../ApiKey.js'
 import * as ApiKeys from '../ApiKeys.js'
 import * as Db from '../db/Db.js'
 import type * as Store from './Store.js'
-import * as EarlyAccess from '../db/tables/earlyAccess.js'
-import * as Invitations from '../db/tables/invitations.js'
 import * as Memberships from '../db/tables/memberships.js'
 import * as Metadata from '../apps/metadata.js'
 import * as OpenApi from './OpenApi.js'
@@ -32,6 +30,7 @@ import * as Viem from './Viem.js'
 
 const policySymbol = Symbol('tempo-api.auth.policy')
 const mppManagementSymbol = Symbol('tempo-api.auth.mpp-management')
+const defaultApiKeyRateLimit = { perMinute: 10_000 } satisfies RateLimit.Limit
 const defaultMppRateLimit = { perMinute: 100 } satisfies RateLimit.Limit
 
 /** Auth context consumed by Tempo API handlers. */
@@ -159,8 +158,6 @@ export type PolicyOverride = {
     | undefined
   /** Session lane: `true` allows signed-in wallet sessions, `false` disables. */
   session?: boolean | undefined
-  /** Temporary early-access gate: `true` rejects sessions without early access ({@link tmp_earlyAccess}). TODO: remove after GA. */
-  tmp_earlyAccess?: boolean | undefined
 }
 
 /** Authenticated or anonymous caller. */
@@ -229,8 +226,6 @@ export type Variables = {
   principal?: Principal | undefined
   /** Project resolved by {@link ensureProject} for the current request. */
   project?: Projects.Record | undefined
-  /** Temporary early-access gate toggle; unset or false grants everyone early access. TODO: remove after GA. */
-  tmp_earlyAccess?: boolean | undefined
 }
 
 /** Reads the authenticated principal from a Hono context. */
@@ -385,42 +380,6 @@ export function ensureProjectError(c: hono_Context) {
   })
 }
 
-/** Whether the caller can grant early access, independent of the temporary route gate. TODO: remove after GA. */
-export async function tmp_earlyAccessGrant(c: hono_Context): Promise<boolean> {
-  const principal = getPrincipal(c)
-  // Trust chain: `management:write` keys are only mintable by early-access owners.
-  if (principal?.type === 'api_key' || principal?.type === 'super_admin') return true
-  if (principal?.type !== 'session' || !principal.email) return false
-  const email = principal.email.trim().toLowerCase()
-  const db = Db.get(contextDb(c))
-  if (await EarlyAccess.matches(db, email)) return true
-  return Invitations.hasEarlyAccessGrant(db, email)
-}
-
-/** Whether the caller has effective early access, including a dormant temporary gate. TODO: remove after GA. */
-export async function tmp_earlyAccess(c: hono_Context): Promise<boolean> {
-  const enabled = (c.get as (key: string) => unknown)('tmp_earlyAccess') as boolean | undefined
-  if (!enabled) return true
-  return tmp_earlyAccessGrant(c)
-}
-
-/**
- * Always false at runtime, but typed as `boolean` so handlers can include a
- * never-reached early-access-error branch in Hono's inferred response union
- * (the `tmp_earlyAccess` policy flag produces this `403` before the handler
- * runs). TODO: remove after GA.
- */
-export const tmp_narrowEarlyAccess = false as boolean
-
-/** Typed early-access error response for Hono client inference; also the live gate rejection. TODO: remove after GA. */
-export function tmp_ensureEarlyAccessError(c: hono_Context) {
-  return Response.error(c, {
-    code: 'early_access_required',
-    message: 'Requires early access. Ask a teammate with access to invite you by email, or contact Tempo.', // prettier-ignore
-    status: 403,
-  })
-}
-
 /** Reads the caller's membership resolved by the organization or project guard; `undefined` for API keys and `super_admin`. */
 export function membership<environment extends Environment>(
   c: hono_Context<environment>,
@@ -629,9 +588,6 @@ export function middleware<
     if (management && (!auth.mpp || !endpointPolicy.mpp)) return next()
 
     c.set('auth', auth)
-    // Consumed by `tmp_earlyAccess`; absent (or false) leaves the gate dormant.
-    // TODO: remove after GA.
-    c.set('tmp_earlyAccess', options.tmp_earlyAccess)
     return require<environment>(endpointPolicy)(c, next)
   })
 }
@@ -687,12 +643,6 @@ export declare namespace middleware {
      * checks — before the key lookup runs. Omit to disable the entry entirely.
      */
     superAdmin?: { secret: string } | undefined
-    /**
-     * Temporary invite-only gate for routes flagged via {@link policy}.
-     * Allowlist entries live in the `early_access` table (admin dash); unset
-     * grants everyone early access. TODO: remove after GA.
-     */
-    tmp_earlyAccess?: boolean | undefined
   }
 
   /** Resolve-cache tuning for API-key resolution. */
@@ -1196,7 +1146,6 @@ function resolvePolicy(
   let mpp = base.mpp
   let public_ = base.public
   let session = base.session
-  let tmp_earlyAccess = base.tmp_earlyAccess
 
   for (const override of overrides) {
     if (override === false) return undefined
@@ -1205,7 +1154,6 @@ function resolvePolicy(
     mpp = resolveMppLane(mpp, override.mpp, defaults.mpp)
     public_ = resolvePublicLane(public_, override.public, defaults.public)
     session = resolveSessionLane(session, override.session, defaults.session)
-    tmp_earlyAccess = override.tmp_earlyAccess ?? tmp_earlyAccess
   }
 
   // The OpenAPI summary/description rides along as the payment-challenge
@@ -1221,7 +1169,6 @@ function resolvePolicy(
     ...(mpp ? { mpp } : {}),
     ...(public_ ? { public: public_ } : {}),
     ...(session ? { session } : {}),
-    ...(tmp_earlyAccess ? { tmp_earlyAccess } : {}),
   }
 }
 
@@ -1444,12 +1391,6 @@ export function require<environment extends Environment = Environment>(
     )
       return Response.unsupportedChainId(c, chainId, supportedChainIds)
     const proceed = async () => {
-      // Runs after principal resolution, so api_key and super_admin pass by
-      // type; only gated sessions are rejected. TODO: remove after GA.
-      if (policy.tmp_earlyAccess && !(await tmp_earlyAccess(c))) {
-        c.res = tmp_ensureEarlyAccessError(c)
-        return
-      }
       await next()
       // Query credential responses must not enter shared caches.
       const cacheControl = c.res.headers.get('Cache-Control')?.toLowerCase()
@@ -1685,8 +1626,6 @@ export declare namespace require {
       | undefined
     /** Session access policy: `true` allows signed-in wallet sessions. */
     session?: boolean | undefined
-    /** Temporary early-access gate for this route; see {@link tmp_earlyAccess}. TODO: remove after GA. */
-    tmp_earlyAccess?: boolean | undefined
   }
 }
 
@@ -1782,7 +1721,8 @@ function resolveApiKeyLimit(options: resolveApiKeyLimit.Options): RateLimit.Limi
     policy?.rateLimit ?? // 2. route override (protective cap)
     apiKey.rateLimits?.[Scope.wildcard] ?? // 3. per-key default
     auth.apiKey?.rateLimits?.[scope] ?? // 4. config per-scope
-    auth.apiKey?.rateLimits?.[Scope.wildcard] ?? { perMinute: 100 } // 5. config default // 6. hardcoded fallback
+    auth.apiKey?.rateLimits?.[Scope.wildcard] ?? // 5. config default
+    defaultApiKeyRateLimit // 6. hardcoded fallback
   )
 }
 

package/src/internal/FundingQuotes.test.ts

@@ -40,16 +40,29 @@ describe('listQuotes', () => {
     expect(seen?.candidate.id).toBe('base-usdc-tempo-usdce-relay')
     expect(quotes).toHaveLength(1)
     expect(quotes[0]).toMatchObject({
+      destinationAmount: {
+        baseUnits: '990000',
+        currency: 'USD',
+        decimals: 6,
+        formatted: '0.99',
+      },
+      destinationAmountMin: {
+        baseUnits: '980000',
+        currency: 'USD',
+        decimals: 6,
+        formatted: '0.98',
+      },
       id: 'base-usdc-tempo-usdce-relay',
       quality: {
         liquiditySource: 'providerQuote',
         tier: 'liquid',
       },
-      quote: {
-        inputAmount: '1000000',
-        minimumOutputAmount: '980000',
-        outputAmount: '990000',
-        outputAmountFormatted: '0.99',
+      quote: { sampledAt: '2026-01-01T00:00:00Z' },
+      sourceAmount: {
+        baseUnits: '1000000',
+        currency: 'USD',
+        decimals: 6,
+        formatted: '1',
       },
     })
     expect(attempts.map(stableAttempt)).toEqual([{ outcome: 'available', provider: 'relay' }])