tapimo 0.7.1 → 0.8.0

package/src/internal/Auth.test.ts

@@ -21,6 +21,7 @@ import * as TestStore from '../../test/Store.js'
 import * as Tempo from '../../test/Tempo.js'
 
 const key = {
+  allowedIps: [],
   environment: 'production',
   id: 'key_test',
   name: 'Test key',
@@ -295,6 +296,135 @@ describe('require', () => {
         }
       `)
     })
+
+    test.each([
+      ['tempo-api-key', '/protected', { 'tempo-api-key': token }],
+      ['Bearer', '/protected', { authorization: `Bearer ${token}` }],
+      ['x-api-key', '/protected', { 'x-api-key': token }],
+      ['query key', `/protected?key=${token}`, {}],
+    ] as const)('enforces an allowlist for the %s credential', async (_name, path, credential) => {
+      const app = createApp({
+        auth: {
+          apiKey: {
+            resolve: TestApp.resolver({
+              keys: [{ ...key, allowedIps: ['203.0.113.0/24'], token }],
+            }),
+          },
+          rateLimit: RateLimit.memory(),
+        },
+      })
+      const response = await app.request(path, {
+        headers: { ...credential, 'cf-connecting-ip': '198.51.100.7' },
+      })
+
+      expect(response.status).toBe(403)
+      expect(await response.json()).toMatchObject({ error: { code: 'api_key_ip_forbidden' } })
+    })
+
+    test('rejects a missing client IP', async () => {
+      const app = createApp({
+        auth: {
+          apiKey: {
+            resolve: TestApp.resolver({
+              keys: [{ ...key, allowedIps: ['203.0.113.0/24'], token }],
+            }),
+          },
+          rateLimit: RateLimit.memory(),
+        },
+      })
+      const response = await app.request('/protected', {
+        headers: { 'tempo-api-key': token },
+      })
+
+      expect(response.status).toBe(403)
+      expect(await response.json()).toMatchObject({ error: { code: 'api_key_ip_forbidden' } })
+    })
+
+    test('does not trust a Cloudflare IP header outside Cloudflare', async () => {
+      const app = createApp({
+        auth: {
+          apiKey: {
+            resolve: TestApp.resolver({
+              keys: [{ ...key, allowedIps: ['203.0.113.0/24'], token }],
+            }),
+          },
+          rateLimit: RateLimit.memory(),
+        },
+      })
+      const response = await app.request('/protected', {
+        headers: {
+          'cf-connecting-ip': '203.0.113.7',
+          'tempo-api-key': token,
+        },
+      })
+
+      expect(response.status).toBe(403)
+      expect(await response.json()).toMatchObject({ error: { code: 'api_key_ip_forbidden' } })
+    })
+
+    test('uses the Cloudflare IP header with Cloudflare request metadata', async () => {
+      const app = createApp({
+        auth: {
+          apiKey: {
+            resolve: TestApp.resolver({
+              keys: [{ ...key, allowedIps: ['203.0.113.0/24'], token }],
+            }),
+          },
+          rateLimit: RateLimit.memory(),
+        },
+      })
+      const request = Object.assign(
+        new Request('http://localhost/protected', {
+          headers: {
+            'cf-connecting-ip': '203.0.113.7',
+            'tempo-api-key': token,
+          },
+        }),
+        { cf: {} },
+      )
+      const response = await app.fetch(request)
+
+      expect(response.status).toBe(200)
+    })
+
+    test('uses the configured trusted client-IP resolver', async () => {
+      const app = createApp({
+        auth: {
+          apiKey: {
+            resolve: TestApp.resolver({
+              keys: [{ ...key, allowedIps: ['203.0.113.0/24'], token }],
+            }),
+          },
+          publicClientIp: (request) => request.headers.get('x-real-ip') ?? undefined,
+          rateLimit: RateLimit.memory(),
+        },
+      })
+      const response = await app.request('/protected', {
+        headers: {
+          'cf-connecting-ip': '198.51.100.7',
+          'tempo-api-key': token,
+          'x-real-ip': '203.0.113.7',
+        },
+      })
+
+      expect(response.status).toBe(200)
+    })
+
+    test('treats an empty allowlist as unrestricted', async () => {
+      const app = createApp({
+        auth: {
+          apiKey: {
+            resolve: TestApp.resolver({ keys: [{ ...key, allowedIps: [], token }] }),
+          },
+          rateLimit: RateLimit.memory(),
+        },
+      })
+      const response = await app.request('/protected', {
+        headers: { 'tempo-api-key': token },
+      })
+
+      expect(response.status).toBe(200)
+    })
   })
 
   describe('session', () => {
@@ -383,6 +513,37 @@ describe('require', () => {
       `)
     })
 
+    test('applies the session-only route error before key restrictions', async () => {
+      const app = createApp({
+        auth: {
+          apiKey: {
+            resolve: TestApp.resolver({
+              keys: [{ ...key, allowedIps: ['203.0.113.0/24'], token }],
+            }),
+          },
+          publicClientIp: (request) => request.headers.get('x-real-ip') ?? undefined,
+          rateLimit: RateLimit.memory(),
+        },
+        policy: { session: true },
+      })
+      const response = await app.request('/protected', {
+        headers: {
+          'tempo-api-key': token,
+          'x-real-ip': '198.51.100.7',
+        },
+      })
+
+      expect(response.status).toBe(403)
+      expect(await response.json()).toMatchInlineSnapshot(`
+        {
+          "error": {
+            "code": "forbidden",
+            "message": "API key not permitted for this route",
+          },
+        }
+      `)
+    })
+
     test('is not consulted on lane-less routes', async () => {
       const app = createSessionApp({
         policy: {},
@@ -1228,7 +1389,7 @@ describe('require', () => {
       })
     })
 
-    test('rejects a voucher that exceeds the channel deposit', async () => {
+    test('tops up the channel before signing a voucher that exceeds its deposit', async () => {
       const mpp = createMppServer()
       const app = createApp({
         auth: {
@@ -1243,14 +1404,25 @@ describe('require', () => {
       })
       const client = createMppClient(app)
 
-      // The opening deposit covers one request; the second voucher overruns
-      // it and the low-level client cannot top up, so the server re-challenges.
+      // The opening deposit covers one request. The client tops up the channel
+      // before signing the second voucher.
       const first = await client.fetch('http://tempo-api.test/protected')
       const second = await client.fetch('http://tempo-api.test/protected')
 
       expect(first.status).toBe(200)
-      expect(second.status).toBe(402)
-      expect(second.headers.get('www-authenticate')?.startsWith('Payment ')).toBe(true)
+      expect(second.status).toBe(200)
+
+      const receipt1 = sessionReceipt(first)
+      const receipt2 = sessionReceipt(second)
+      expect(receipt2).toMatchObject({
+        channelId: receipt1.channelId,
+        spent: '2000000',
+      })
+
+      const state = await Actions.channel.getStates(Tempo.client, {
+        channel: receipt1.channelId,
+      })
+      expect(state.deposit).toBe(2_000_000n)
     })
 
     test('rejects a malformed payment credential with a fresh challenge', async () => {
@@ -1889,6 +2061,54 @@ describe('ensureProject', () => {
   })
 })
 
+describe('parseCredential', () => {
+  test('parses credentials keyed by chain id', () => {
+    const credential = Auth.parseCredential(
+      JSON.stringify({ 4217: 'mainnet:secret', 421700001: 'zone:secret' }),
+    )
+
+    expect(credential).toEqual({ 4217: 'mainnet:secret', 421700001: 'zone:secret' })
+  })
+
+  test('supports a shared credential', () => {
+    expect(Auth.parseCredential('shared:secret')).toBe('shared:secret')
+  })
+
+  test('rejects malformed credential maps', () => {
+    expect(() => Auth.parseCredential('{"4217":1}')).toThrowErrorMatchingInlineSnapshot(
+      `[Error: Expected a credential or a chain-id-to-credential JSON object.]`,
+    )
+  })
+})
+
+describe('resolveCredential', () => {
+  test('infers Basic auth from a credential containing a colon', () => {
+    expect(Auth.resolveCredential({ chainId: 4217, value: 'user:password' })).toEqual({
+      basicAuth: 'user:password',
+    })
+  })
+
+  test('infers Bearer auth from a credential without a colon', () => {
+    expect(Auth.resolveCredential({ chainId: 4217, value: 'bearer-token' })).toEqual({
+      basicAuth: undefined,
+      bearerAuth: 'bearer-token',
+    })
+  })
+
+  test('selects a credential by chain id', () => {
+    const value = JSON.stringify({ 4217: 'mainnet:secret', 421700001: 'zone-token' })
+
+    expect(Auth.resolveCredential({ chainId: 4217, value })).toEqual({
+      basicAuth: 'mainnet:secret',
+    })
+    expect(Auth.resolveCredential({ chainId: 421700001, value })).toEqual({
+      basicAuth: undefined,
+      bearerAuth: 'zone-token',
+    })
+    expect(Auth.resolveCredential({ chainId: 42431, value })).toEqual({ basicAuth: undefined })
+  })
+})
+
 function createScopedApp(options: {
   auth?: Auth.Context | undefined
   routes: readonly { path: string; policy: Auth.require.Policy }[]

package/src/internal/Auth.ts

@@ -9,6 +9,7 @@ import { findTargetHandler } from 'hono/utils/handler'
 import { Challenge, Credential, type Method } from 'mppx'
 import { Mppx, tempo } from 'mppx/hono'
 import { Addresses } from 'viem/tempo'
+import { tempoMainnet } from 'viem/tempo/chains'
 import * as z from 'zod/mini'
 
 import type * as App from '../App.js'
@@ -17,6 +18,7 @@ import * as ApiKeys from '../ApiKeys.js'
 import * as Db from '../db/Db.js'
 import type * as Store from './Store.js'
 import * as Memberships from '../db/tables/memberships.js'
+import * as IpAllowlist from './IpAllowlist.js'
 import * as Metadata from '../apps/metadata.js'
 import * as OpenApi from './OpenApi.js'
 import * as Organizations from '../db/tables/organizations.js'
@@ -26,7 +28,6 @@ import * as Response from './Response.js'
 import * as Schema from './Schema.js'
 import * as Scope from '../Scope.js'
 import * as Users from '../db/tables/users.js'
-import * as Viem from './Viem.js'
 
 const policySymbol = Symbol('tempo-api.auth.policy')
 const mppManagementSymbol = Symbol('tempo-api.auth.mpp-management')
@@ -438,12 +439,16 @@ export function accessError(c: hono_Context) {
       status: 401,
     })
   }
-  if (status === 403)
+  if (status === 403) {
+    const ipForbidden = c.req.header('tempo-narrow-access-code') === 'api_key_ip_forbidden'
     return Response.error(c, {
-      code: 'api_key_forbidden',
-      message: 'API key missing required scope',
+      code: ipForbidden ? 'api_key_ip_forbidden' : 'api_key_forbidden',
+      message: ipForbidden
+        ? 'API key not permitted from this IP address'
+        : 'API key missing required scope',
       status: 403,
     })
+  }
   const code =
     c.req.header('tempo-narrow-access-code') === 'rate_limit_exceeded'
       ? 'rate_limit_exceeded'
@@ -511,8 +516,8 @@ export function middleware<
   // store is configured, every token resolves to `null` (closed).
   // Resolution is cached per isolate by default (positive 60s / negative 10s,
   // keyed by token sha256) so hot keys skip the backend read on the auth path
-  // of every request. Pass `apiKey.cache: false` when instant revocation
-  // matters more than the per-request read.
+  // of every request. Pass `apiKey.cache: false` when immediate key updates
+  // matter more than the per-request read.
   const resolve = (() => {
     const uncached = (c: hono_Context, token: string) => {
       const kv = contextKv(c)
@@ -606,8 +611,8 @@ export declare namespace middleware {
           /**
            * Resolve-cache tuning (per-isolate, positive 60s / negative 10s by
            * default), or `false` to resolve uncached on every request — e.g.
-           * when instant revocation matters more than the per-request backend
-           * read.
+           * when immediate key updates matter more than the per-request
+           * backend read.
            */
           cache?: Cache | false | undefined
           /** API-key quotas keyed by quota scope (reserved `'*'` is the config default). */
@@ -624,7 +629,7 @@ export declare namespace middleware {
     /** Default public access policy. Pass false to disable anonymous access. */
     public?:
       | {
-          /** Resolves the client IP from trusted runtime or proxy metadata. Defaults to `cf-connecting-ip`. */
+          /** Resolves the client IP from trusted runtime or proxy metadata. Required outside Cloudflare for API-key allowlists. */
           clientIp?: ((request: Request) => string | undefined) | undefined
           /** Anonymous public quota for protected routes. */
           rateLimit?: RateLimit.Limit | undefined
@@ -1448,10 +1453,32 @@ export function require<environment extends Environment = Environment>(
       const principal = principalFromApiKey(apiKey)
       c.set('principal', principal)
 
+      // Default-deny: routes with no API-key lane allow only the super admin.
+      // A valid key is authenticated but forbidden.
+      if (!policy.apiKey)
+        return jsonError(c, {
+          code: 'forbidden',
+          message: 'API key not permitted for this route',
+          status: 403,
+        })
+
+      if (
+        apiKey.allowedIps.length &&
+        !(await IpAllowlist.allows(c, {
+          address: trustedClientIp(c, auth),
+          rules: apiKey.allowedIps,
+        }))
+      )
+        return jsonError(c, {
+          code: 'api_key_ip_forbidden',
+          message: 'API key not permitted from this IP address',
+          status: 403,
+        })
+
       if (
         apiKey.environment === 'sandbox' &&
         explicitChain !== undefined &&
-        Viem.isMainnet(explicitChain)
+        explicitChain === tempoMainnet.id
       )
         return jsonError(c, {
           code: 'api_key_forbidden',
@@ -1459,14 +1486,6 @@ export function require<environment extends Environment = Environment>(
           status: 403,
         })
 
-      // Default-deny: routes with no API-key lane allow only the super admin.
-      // A valid key is authenticated but forbidden.
-      if (!policy.apiKey)
-        return jsonError(c, {
-          code: 'forbidden',
-          message: 'API key not permitted for this route',
-          status: 403,
-        })
       const missing = apiKey.scopes.includes(Scope.wildcard)
         ? []
         : (policy.apiKey?.scopes.filter((scope) => !apiKey.scopes.includes(scope)) ?? [])
@@ -1644,6 +1663,65 @@ type RateLimitAccess = PaymentAccess & {
   rateLimit: RateLimit.Result
 }
 
+/** Shared or per-chain credentials. */
+export type ChainCredential = string | Record<number, string>
+
+/** Parses shared or per-chain credentials from an environment value. */
+export function parseCredential(value: ChainCredential | undefined): parseCredential.ReturnType {
+  if (!value) return undefined
+  if (typeof value !== 'string') return value
+  const credentials = (() => {
+    try {
+      return JSON.parse(value) as unknown
+    } catch {
+      return value
+    }
+  })()
+  if (typeof credentials === 'string') return credentials
+  if (
+    !credentials ||
+    typeof credentials !== 'object' ||
+    Array.isArray(credentials) ||
+    Object.values(credentials).some((credential) => typeof credential !== 'string')
+  )
+    throw new Error('Expected a credential or a chain-id-to-credential JSON object.')
+  return credentials as Record<number, string>
+}
+
+export declare namespace parseCredential {
+  /** Parsed shared or per-chain credentials. */
+  type ReturnType = ChainCredential | undefined
+}
+
+/** Resolves a chain credential and infers its HTTP authorization scheme. */
+export function resolveCredential(
+  options: resolveCredential.Options,
+): resolveCredential.ReturnType {
+  const credentials = parseCredential(options.value)
+  const credential = typeof credentials === 'string' ? credentials : credentials?.[options.chainId]
+  if (!credential) return { basicAuth: undefined }
+  if (credential.includes(':')) return { basicAuth: credential }
+  return { basicAuth: undefined, bearerAuth: credential }
+}
+
+export declare namespace resolveCredential {
+  /** Options for resolving a chain credential. */
+  type Options = {
+    /** Chain id selecting a per-chain credential. */
+    chainId: number
+    /** Shared or per-chain credentials. */
+    value?: ChainCredential | undefined
+  }
+
+  /** Resolved HTTP authorization credentials. */
+  type ReturnType = {
+    /** Basic credentials inferred from a value containing a colon. */
+    basicAuth: string | undefined
+    /** Bearer credential inferred from a value without a colon. */
+    bearerAuth?: string | undefined
+  }
+}
+
 /**
  * How long to wait for the rate-limit counter before failing open. A hot
  * counter backend (e.g. a single Durable Object serving one busy quota bucket)
@@ -1762,6 +1840,17 @@ function getApiKeyCredential(c: hono_Context): ApiKeyCredential | false | null {
   return null
 }
 
+function clientIp(c: hono_Context, auth: Context): string | undefined {
+  return auth.publicClientIp ? auth.publicClientIp(c.req.raw) : c.req.header('cf-connecting-ip')
+}
+
+function trustedClientIp(c: hono_Context, auth: Context): string | undefined {
+  if (auth.publicClientIp) return auth.publicClientIp(c.req.raw)
+  // Cloudflare supplies both the request metadata and this header.
+  if (!('cf' in c.req.raw)) return undefined
+  return c.req.header('cf-connecting-ip')
+}
+
 /** Removes the reserved auth query parameter before route validation. */
 function stripApiKeyQuery(c: hono_Context) {
   const url = new URL(c.req.url)
@@ -1877,7 +1966,7 @@ function principalFromApiKey(apiKey: ApiKey.ApiKey): Principal {
 }
 
 function principalFromPublic(c: hono_Context, auth: Context): Principal {
-  const ip = auth.publicClientIp ? auth.publicClientIp(c.req.raw) : c.req.header('cf-connecting-ip')
+  const ip = clientIp(c, auth)
   return {
     id: ip ? RateLimit.normalizeIp(ip) : 'anonymous',
     type: 'public',
@@ -1997,7 +2086,7 @@ const cachedMaxEntries = 10_000
  * (default 60s), negative for `negativeTtl` (default 10s) so a freshly minted
  * key is usable quickly; concurrent misses for one token are single-flighted.
  * Entries are keyed by the token's sha256 (`ApiKey.hash`) — never the
- * plaintext. A revoked key may stay resolvable for up to `ttl` — the accepted
+ * plaintext. Key updates may remain stale for up to `ttl`, the accepted
  * trade-off for removing a backend read from the auth path.
  */
 function cachedResolve(

package/src/internal/Cache.test.ts

@@ -52,7 +52,7 @@ describe('response', () => {
       expect(etag(first)).toMatchInlineSnapshot(`"<etag>"`)
       expect(first.headers.get('ratelimit-remaining')).toMatchInlineSnapshot(`"9"`)
       expect(first.headers.get('vary')).toMatchInlineSnapshot(
-        `"Accept-Encoding, Authorization, Tempo-API-Key"`,
+        `"Accept-Encoding, Authorization, Tempo-API-Key, X-API-Key"`,
       )
 
       expect(await second.json()).toMatchInlineSnapshot(`
@@ -66,7 +66,7 @@ describe('response', () => {
       expect(second.headers.get('etag') === first.headers.get('etag')).toMatchInlineSnapshot(`true`)
       expect(second.headers.get('ratelimit-remaining')).toMatchInlineSnapshot(`"8"`)
       expect(second.headers.get('vary')).toMatchInlineSnapshot(
-        `"Accept-Encoding, Authorization, Tempo-API-Key"`,
+        `"Accept-Encoding, Authorization, Tempo-API-Key, X-API-Key"`,
       )
 
       expect(third.status).toMatchInlineSnapshot(`304`)
@@ -77,11 +77,45 @@ describe('response', () => {
       expect(third.headers.get('etag') === first.headers.get('etag')).toMatchInlineSnapshot(`true`)
       expect(third.headers.get('ratelimit-remaining')).toMatchInlineSnapshot(`"8"`)
       expect(third.headers.get('vary')).toMatchInlineSnapshot(
-        `"Accept-Encoding, Authorization, Tempo-API-Key"`,
+        `"Accept-Encoding, Authorization, Tempo-API-Key, X-API-Key"`,
       )
     })
   })
 
+  test('varies cached responses by the legacy API-key header', async () => {
+    await withCaches(async () => {
+      let calls = 0
+      const app = new Hono()
+      app.get('/', Cache.response({ key: (c) => c.req.url, name: 'test' }), (c) =>
+        c.json({ calls: ++calls, token: c.req.header('x-api-key') }),
+      )
+
+      const first = await app.request('/', { headers: { 'x-api-key': 'one' } })
+      const second = await app.request('/', { headers: { 'x-api-key': 'two' } })
+      const hit = await app.request('/', { headers: { 'x-api-key': 'one' } })
+
+      expect(calls).toMatchInlineSnapshot(`2`)
+      expect(await first.json()).toMatchInlineSnapshot(`
+        {
+          "calls": 1,
+          "token": "one",
+        }
+      `)
+      expect(await second.json()).toMatchInlineSnapshot(`
+        {
+          "calls": 2,
+          "token": "two",
+        }
+      `)
+      expect(await hit.json()).toMatchInlineSnapshot(`
+        {
+          "calls": 1,
+          "token": "one",
+        }
+      `)
+    })
+  })
+
   test('stores entries with the shared policy form, not the client form', async () => {
     await withCaches(async (stores) => {
       const app = new Hono()

package/src/internal/Cache.ts

@@ -57,7 +57,7 @@ export function response<environment extends Env>(
   options: response.Options<environment>,
 ): MiddlewareHandler<environment> {
   const defaultCacheControl = options.cacheControl ?? policies.default
-  const vary = options.vary ?? ['Accept-Encoding', 'Authorization', 'Tempo-API-Key']
+  const vary = options.vary ?? ['Accept-Encoding', 'Authorization', 'Tempo-API-Key', 'X-API-Key']
   // hono/cache suffixes its key with `::<directive>=<value>` for every
   // configured vary directive (trimmed, lowercased, deduped). Mirror that
   // normalization so the `no-cache` purge below deletes exactly the entry the
@@ -140,7 +140,7 @@ export function response<environment extends Env>(
     let res = result instanceof Response ? new Response(result.body, result) : c.res
     if (
       result instanceof Response &&
-      etagMatches(res.headers.get('ETag'), c.req.header('If-None-Match'))
+      Etag.matches(res.headers.get('ETag'), c.req.header('If-None-Match'))
     )
       res = notModified(res)
 
@@ -158,7 +158,9 @@ export function response<environment extends Env>(
 
   // `markCacheable` lets the edge layer pay its store lookup only on routes
   // that mount this middleware; everything else skips the read.
-  return EdgeCache.markCacheable(middleware)
+  return EdgeCache.markCacheable(middleware, {
+    key: options.key as (c: Context) => Promise<string> | string,
+  })
 }
 
 export declare namespace response {
@@ -214,9 +216,15 @@ export function urlKey<
   return url.toString()
 }
 
-function etagMatches(etag: string | null, ifNoneMatch: string | undefined) {
-  if (!etag || !ifNoneMatch) return false
-  return ifNoneMatch.split(/,\s*/).some((tag) => stripWeak(tag) === stripWeak(etag))
+namespace Etag {
+  export function matches(etag: string | null, ifNoneMatch: string | undefined) {
+    if (!etag || !ifNoneMatch) return false
+    return ifNoneMatch.split(/,\s*/).some((tag) => stripWeak(tag) === stripWeak(etag))
+  }
+
+  function stripWeak(etag: string) {
+    return etag.replace(/^W\//, '')
+  }
 }
 
 function notModified(response: Response) {
@@ -248,10 +256,6 @@ function setCacheHeaders(
   headers.set('Vary', Array.from(vary.values()).join(', '))
 }
 
-function stripWeak(etag: string) {
-  return etag.replace(/^W\//, '')
-}
-
 // Derive the shared-cache policy from a route's client `Cache-Control`. A
 // positive `s-maxage`/`max-age` (and no `no-store`/`no-cache`) is what makes a
 // route eligible for the anonymous edge cache; the `private` directive only

package/src/internal/Cursor.test.ts

@@ -19,10 +19,10 @@ describe('Cursor', () => {
   })
 
   test('round-trips a timestamp/id tuple', () => {
-    const token = Cursor.encode(['2026-01-01T00:00:00.000Z', 'org_abc123'])
+    const token = Cursor.encode(['2026-01-01T00:00:00.000Z', 'source:transaction-0'])
     expect(Cursor.decode(token, ['timestamp', 'id'])).toEqual([
       '2026-01-01T00:00:00.000Z',
-      'org_abc123',
+      'source:transaction-0',
     ])
   })
 

package/src/internal/Cursor.ts

@@ -138,7 +138,7 @@ function isValid(value: unknown, field: Field): boolean {
     case 'address':
       return typeof value === 'string' && /^0x[0-9a-fA-F]{40}$/.test(value)
     case 'id':
-      return typeof value === 'string' && /^[A-Za-z0-9_-]+$/.test(value)
+      return typeof value === 'string' && /^[A-Za-z0-9:_-]+$/.test(value)
     case 'timestamp':
       return typeof value === 'string' && !Number.isNaN(Date.parse(value))
   }