tapimo 0.6.0 → 0.7.1

package/src/apps/relay/App.test.ts

@@ -450,7 +450,7 @@ describe.skipIf(runtime.mode !== 'localnet')('behavior: sponsorship', () => {
       `)
   })
 
-  test('behavior: non-mainnet production keys record billable rows', async () => {
+  test('behavior: non-mainnet production keys record non-billable rows', async () => {
     const db = TestApp.database()
     const app = TestApp.create({
       auth: { keys },
@@ -466,7 +466,7 @@ describe.skipIf(runtime.mode !== 'localnet')('behavior: sponsorship', () => {
     expect(body.error).toBeUndefined()
 
     const [row] = await SponsoredTransactions.listPending(db)
-    expect(row?.billable).toBe(true)
+    expect(row?.billable).toBe(false)
     expect(row?.environment).toMatchInlineSnapshot(`"production"`)
   })
 
@@ -656,6 +656,19 @@ describe.skipIf(runtime.mode !== 'localnet')('behavior: sponsorship', () => {
 // Chain-free (`eth_signRawTransaction` signs locally; the sponsor fee token
 // short-circuits resolution), so the gate matrix runs in every mode.
 describe('behavior: mainnet billing gate', () => {
+  const fill = {
+    calls: [{ to: Tempo.accounts[8]!.address, value: '0x0' }],
+    capabilities: { balanceDiffs: false },
+    chainId: Hex.fromNumber(Viem.chainId.mainnet),
+    feePayer: true,
+    feeToken: '0x20c0000000000000000000000000000000000000',
+    from: senderAccount.address,
+    gas: Hex.fromNumber(100_000),
+    maxFeePerGas: Hex.fromNumber(1_000_000),
+    maxPriorityFeePerGas: '0x0',
+    nonce: '0x0',
+  } as const
+
   function createApp(db: Db.Source = TestApp.database()) {
     return TestApp.create({
       auth: { keys },
@@ -692,6 +705,64 @@ describe('behavior: mainnet billing gate', () => {
     expect(body.error?.data).toStrictEqual({ code: 'billing_required' })
   })
 
+  test('behavior: returns the billing reason for sponsor fills', async () => {
+    const body = await relayRequest(createApp(), {
+      method: 'eth_fillTransaction',
+      params: [fill],
+      token: 'secret_sponsor_prod',
+    })
+    expect(body.error).toStrictEqual({
+      code: -32602,
+      data: { code: 'billing_required' },
+      message: 'Billing required.',
+    })
+  })
+
+  test('behavior: relay fills still fall back to self-payment', async () => {
+    const server = await Relay.createServer(
+      RequestListener.fromFetchHandler(async (request) => {
+        type Rpc = {
+          id: number
+          method: string
+          params: readonly [Record<string, unknown>]
+        }
+        const rpc = (await request.json()) as Rpc
+        if (rpc.method !== 'eth_fillTransaction')
+          return Response.json({ id: rpc.id, jsonrpc: '2.0', result: '0x' })
+        return Response.json({
+          id: rpc.id,
+          jsonrpc: '2.0',
+          result: { capabilities: {}, tx: rpc.params[0] },
+        })
+      }),
+    )
+    try {
+      const body = await relayRequest(
+        TestApp.create({
+          auth: { keys },
+          db: TestApp.database(),
+          relay: { feePayer: { account: feePayerAccount } },
+          rpc: { url: () => server.url },
+          supportedChainIds: [Viem.chainId.mainnet],
+        }),
+        {
+          method: 'eth_fillTransaction',
+          mount: 'relay',
+          params: [fill],
+          token: 'secret_wildcard_prod',
+        },
+      )
+      type Result = {
+        capabilities?: { sponsored?: boolean | undefined } | undefined
+      }
+      const result = body.result as unknown as Result
+      expect(body.error).toBeUndefined()
+      expect(result.capabilities?.sponsored).toBe(false)
+    } finally {
+      await server.closeAsync()
+    }
+  })
+
   test('behavior: refuses mainnet sponsorship while billing is inactive', async () => {
     const db = TestApp.database()
     await StripeCustomers.create(db, { orgId: 'org_1', stripeCustomerId: 'cus_gate' })
@@ -1110,13 +1181,10 @@ async function signSponsorable(
   })
 }
 
-/** Posts one JSON-RPC request to the composed app's sponsor mount. */
-async function relayRequest(
-  app: ReturnType<typeof TestApp.create>,
-  options: { method: string; params: readonly unknown[]; token?: string | undefined },
-) {
+/** Posts one JSON-RPC request to a composed relay mount. */
+async function relayRequest(app: ReturnType<typeof TestApp.create>, options: relayRequest.Options) {
   const response = await app.fetch(
-    new Request('http://tempo-api.test/rpc/sponsor', {
+    new Request(`http://tempo-api.test/rpc/${options.mount ?? 'sponsor'}`, {
       body: JSON.stringify({ id: 1, jsonrpc: '2.0', method: options.method, params: options.params }), // prettier-ignore
       headers: {
         'content-type': 'application/json',
@@ -1131,6 +1199,20 @@ async function relayRequest(
   }
 }
 
+declare namespace relayRequest {
+  /** Options for one composed relay request. */
+  type Options = {
+    /** JSON-RPC method. */
+    method: string
+    /** Relay mount to call. */
+    mount?: 'relay' | 'sponsor' | undefined
+    /** JSON-RPC parameters. */
+    params: readonly unknown[]
+    /** API-key credential. */
+    token?: string | undefined
+  }
+}
+
 // The full billing-to-invoice flow with nothing synthetic: a disposable node
 // runs under mainnet's chain id (dev consensus, funded dev alloc), so a real
 // card attach opens the real gate, a real sponsored transaction mines with a

package/src/apps/relay/App.ts

@@ -8,6 +8,7 @@ import type * as App from '../../App.js'
 import * as BillingSettings from '../../db/tables/billingSettings.js'
 import * as Db from '../../db/Db.js'
 import * as Fees from '../../internal/Fees.js'
+import * as Log from '../../internal/Log.js'
 import * as SponsoredTransactions from '../../db/tables/sponsoredTransactions.js'
 import * as Billing from '../management/Billing.js'
 import * as Handler from '../../Handler.js'
@@ -75,6 +76,9 @@ export declare namespace relay {
 // Builds request-aware RPC middleware. Viem clients are memoized upstream, so
 // constructing `Handler.relay` per request stays cheap.
 function middleware(options: middleware.Options) {
+  // The sponsor mount promises a fee-payer signature. The relay mount may
+  // fall back to self-payment when policy refuses sponsorship.
+  const sponsorshipRequired = options.path === 'rpc/sponsor'
   // Platform-wide per-transaction cap; org settings tighten it, never loosen.
   const txFeeLimit = options.feePayer
     ? Billing.toBaseUnits(options.feePayer.txFeeLimit ?? '1.00')
@@ -111,12 +115,20 @@ function middleware(options: middleware.Options) {
           // only mainnet: the relay resolves chainId from the request body, so
           // the query-string chain guard never sees it.
           const id = Number(transaction.chainId)
-          if (!attribution || !sponsorable || !c.get('supportedChainIds').has(id)) return false
+          if (!attribution || !sponsorable || !c.get('supportedChainIds').has(id)) {
+            if (sponsorshipRequired)
+              throw new RpcResponse.InvalidParamsError({ message: 'Sponsorship rejected.' })
+            return false
+          }
           if (!Viem.isMainnet(id)) return true
           // Mainnet is production-only: a sandbox key resolves chainId from the
           // request body, so the auth-layer sandbox/mainnet guard never sees
           // it. Refuse here, or sandbox spend would sponsor mainnet unbilled.
-          if (attribution.environment !== 'production') return false
+          if (attribution.environment !== 'production') {
+            if (sponsorshipRequired)
+              throw new RpcResponse.InvalidParamsError({ message: 'Sponsorship rejected.' })
+            return false
+          }
 
           // Enforcement reads hit the primary, never the cached replica: a
           // stale `past_due`, a lowered limit, or another isolate's pending
@@ -127,8 +139,22 @@ function middleware(options: middleware.Options) {
           // `past_due` gets its own reason: the caller must settle an invoice,
           // not attach a card.
           const billing = await Billing.status(db, attribution.orgId)
-          if (billing === 'past_due') return 'billing_past_due'
-          if (billing !== 'active') return 'billing_required'
+          if (billing === 'past_due') {
+            if (sponsorshipRequired)
+              throw new RpcResponse.InvalidParamsError({
+                data: { code: 'billing_past_due' },
+                message: 'Billing past due.',
+              })
+            return 'billing_past_due'
+          }
+          if (billing !== 'active') {
+            if (sponsorshipRequired)
+              throw new RpcResponse.InvalidParamsError({
+                data: { code: 'billing_required' },
+                message: 'Billing required.',
+              })
+            return 'billing_required'
+          }
 
           const feeToken = (() => {
             try {
@@ -144,21 +170,40 @@ function middleware(options: middleware.Options) {
             !verified ||
             verified.currency.toLowerCase() !== 'usd' ||
             verified.decimals !== Fees.tokenDecimals
-          )
-            // prettier-ignore
+          ) {
+            if (sponsorshipRequired)
+              throw new RpcResponse.InvalidParamsError({
+                data: { code: 'fee_token_unsupported' },
+                message: 'Fee token unsupported.',
+              })
             return 'fee_token_unsupported'
+          }
 
           // Fail closed: a transaction whose signed cap cannot be computed
           // cannot be bounded, so it never sponsors on mainnet.
           const feeMax = Fees.maxOf(transaction)
-          if (feeMax === undefined) return 'tx_fee_limit_exceeded'
+          if (feeMax === undefined) {
+            if (sponsorshipRequired)
+              throw new RpcResponse.InvalidParamsError({
+                data: { code: 'tx_fee_limit_exceeded' },
+                message: 'Transaction fee limit exceeded.',
+              })
+            return 'tx_fee_limit_exceeded'
+          }
           const settings = await BillingSettings.get(db, attribution.orgId)
           const cap = (() => {
             if (settings?.txFeeLimit == null) return txFeeLimit
             const org = Billing.toBaseUnits(settings.txFeeLimit)
             return org < txFeeLimit ? org : txFeeLimit
           })()
-          if (feeMax > cap) return 'tx_fee_limit_exceeded'
+          if (feeMax > cap) {
+            if (sponsorshipRequired)
+              throw new RpcResponse.InvalidParamsError({
+                data: { code: 'tx_fee_limit_exceeded' },
+                message: 'Transaction fee limit exceeded.',
+              })
+            return 'tx_fee_limit_exceeded'
+          }
           // The period spend limit is enforced atomically at recording time
           // (`onSponsored` → `SponsoredTransactions.reserve`); a check here
           // would be a check-then-act race a burst could slip through.
@@ -193,7 +238,7 @@ function middleware(options: middleware.Options) {
 
           const input = {
             apiKeyId: attribution.apiKeyId,
-            billable: attribution.environment === 'production',
+            billable: mainnet && attribution.environment === 'production',
             chainId: event.chainId,
             environment: attribution.environment,
             orgId: attribution.orgId,
@@ -278,7 +323,14 @@ function middleware(options: middleware.Options) {
           }
         : {}),
     })
-    return handler.fetch(c.req.raw)
+    const response = await handler.fetch(c.req.raw)
+    const body: unknown = await response
+      .clone()
+      .json()
+      .catch(() => undefined)
+    const rpc = Log.rpcErrors(body)
+    if (rpc) c.set('rpcResponse', rpc)
+    return response
   })
 }
 

package/src/apps/relay/Sponsorships.test.ts

@@ -4,6 +4,7 @@ import type { Client } from 'viem'
 
 import * as Runtime from '../../../test/runtime.js'
 import * as Db from '../../db/Db.js'
+import * as Organizations from '../../db/tables/organizations.js'
 import * as SponsoredTransactions from '../../db/tables/sponsoredTransactions.js'
 import * as Sponsorships from './Sponsorships.js'
 
@@ -269,6 +270,7 @@ describe('reconcile', () => {
   test('behavior: recovers recently failed intents by sign payload', async () => {
     const db = create()
     await db.migrate()
+    await Organizations.create(db, { id: 'org_1', name: 'One' })
     const { transactionHash: _, ...rest } = input
     const intent = await SponsoredTransactions.upsert(db, { ...rest, signPayload })
     await SponsoredTransactions.fail(db, intent.id, '2026-01-01T00:00:00.000Z')

package/src/apps/relay/Sponsorships.ts

@@ -126,7 +126,7 @@ export async function reconcile(db: Db.Db, options: reconcile.Options): Promise<
   const {
     batchSize = 100,
     candidateCap = 500,
-    failedIntentTtlMs = 86_400_000,
+    failedIntentTtlMs = SponsoredTransactions.failedIntentRecoveryTtlMs,
     feePayer,
     getClient,
     getTidx,

package/src/db/Db.test.ts

@@ -17,7 +17,7 @@ describe('postgres', () => {
     await db.close()
   })
 
-  test('behavior: legacy invitation inserts retain early access during cutover', async () => {
+  test('behavior: legacy invitation inserts do not grant early access', async () => {
     const db = create()
     await db.migrate()
     await Organizations.create(db, { id: 'org_legacy', name: 'Legacy' })
@@ -30,7 +30,7 @@ describe('postgres', () => {
       )
     `.execute(db.kysely)
 
-    expect((await Invitations.get(db, 'inv_legacy'))?.grantsEarlyAccess).toBe(true)
+    expect((await Invitations.get(db, 'inv_legacy'))?.grantsEarlyAccess).toBe(false)
     await db.close()
   })
 

package/src/db/Db.ts

@@ -13,6 +13,7 @@ import * as pg from 'pg'
 import type * as AdminAuditLogs from './tables/adminAuditLogs.js'
 import type * as BillingSettings from './tables/billingSettings.js'
 import type * as EarlyAccess from './tables/earlyAccess.js'
+import type * as EnabledBillingSources from './tables/enabledBillingSources.js'
 import type * as Invitations from './tables/invitations.js'
 import type * as InviteLinks from './tables/inviteLinks.js'
 import type * as Memberships from './tables/memberships.js'
@@ -35,6 +36,7 @@ export type Database = {
   admin_audit_logs: AdminAuditLogs.Table
   billing_settings: BillingSettings.Table
   early_access: EarlyAccess.Table
+  enabled_billing_sources: EnabledBillingSources.Table
   invitations: Invitations.Table
   invite_link_redemptions: InviteLinks.RedemptionTable
   invite_links: InviteLinks.Table
@@ -740,6 +742,34 @@ export const migrations: readonly Migration[] = [
     name: '0069_invite_links_allowed_email_domains',
     up: (db) => raw(db, sql`ALTER TABLE invite_links ADD COLUMN IF NOT EXISTS allowed_email_domains jsonb`), // prettier-ignore
   },
+  {
+    name: '0070_enabled_billing_sources',
+    up: (db) =>
+      db.schema
+        .createTable('enabledBillingSources')
+        .ifNotExists()
+        .addColumn('createdAt', 'text', (c) => c.notNull())
+        .addColumn('createdBy', 'text', (c) => c.notNull())
+        .addColumn('orgId', 'text', (c) => c.notNull())
+        .addColumn('source', 'text', (c) => c.notNull())
+        .addPrimaryKeyConstraint('enabled_billing_sources_pkey', ['orgId', 'source']),
+  },
+  {
+    name: '0071_enabled_billing_sources_stripe_backfill',
+    up: (db) => raw(db, sql`INSERT INTO enabled_billing_sources (created_at, created_by, org_id, source) SELECT min(created_at), 'migration', org_id, 'stripe' FROM stripe_customers GROUP BY org_id ON CONFLICT DO NOTHING`), // prettier-ignore
+  },
+  {
+    name: '0072_enabled_billing_sources_stripe_catch_up',
+    up: (db) => raw(db, sql`INSERT INTO enabled_billing_sources (created_at, created_by, org_id, source) SELECT min(created_at), 'migration', org_id, 'stripe' FROM stripe_customers GROUP BY org_id ON CONFLICT DO NOTHING`), // prettier-ignore
+  },
+  {
+    name: '0073_enabled_billing_sources_early_access_backfill',
+    up: (db) => raw(db, sql`INSERT INTO enabled_billing_sources (created_at, created_by, org_id, source) SELECT organizations.created_at, 'migration', organizations.id, 'stripe' FROM organizations INNER JOIN users ON users.id = organizations.user_id WHERE users.email IS NOT NULL AND EXISTS (SELECT 1 FROM early_access WHERE early_access.entry IN (lower(btrim(users.email)), regexp_replace(lower(btrim(users.email)), '^.*@', ''))) ON CONFLICT DO NOTHING`), // prettier-ignore
+  },
+  {
+    name: '0074_invitations_early_access_default',
+    up: (db) => raw(db, sql`ALTER TABLE invitations ALTER COLUMN grants_early_access SET DEFAULT false`), // prettier-ignore
+  },
 ]
 
 /**

package/src/db/Schema.ts

@@ -66,6 +66,21 @@ export const EarlyAccessEntry = z.object({
 /** Columns of the `early_access` table. */
 export type EarlyAccessEntry = z.output<typeof EarlyAccessEntry>
 
+/** One billing-source type enabled for an organization. */
+export const EnabledBillingSource = z.object({
+  createdAt: z.string().check(z.describe('When the billing source was enabled (ISO 8601).')),
+  createdBy: z
+    .string()
+    .check(z.describe('Identity that enabled the source, or `migration` for backfilled rows.')),
+  orgId: z.string().check(z.describe('Organization id (`org_…`) this source is enabled for.')),
+  source: z
+    .enum(['stripe', 'tempo'])
+    .check(z.describe('Enabled billing-source type; `stripe` or `tempo`.')),
+})
+
+/** Columns of the `enabled_billing_sources` table. */
+export type EnabledBillingSource = z.output<typeof EnabledBillingSource>
+
 /** A pending, expiring offer of organization membership. */
 export const Invitation = z.object({
   acceptedAt: z