tapimo 0.7.2 → 0.8.0

package/src/Client.test-d.ts

@@ -11,7 +11,10 @@ import type * as EarnRates from './internal/EarnRates.js'
 import * as Exchanges from './apps/data/routes/exchanges.js'
 import * as Faucet from './apps/management/routes/faucet.js'
 import * as FeeAmm from './apps/data/routes/fee-amm.js'
-import * as Funding from './apps/data/routes/funding.js'
+import * as FundingChains from './apps/funding/routes/chains.js'
+import * as FundingDepositAddresses from './apps/funding/routes/deposit-addresses.js'
+import * as FundingQuotes from './apps/funding/routes/quotes.js'
+import * as FundingTransfers from './apps/funding/routes/transfers.js'
 import type * as FundingDepositAddress from './internal/funding/DepositAddress.js'
 import * as Indexer from './apps/data/routes/indexer.js'
 import * as InviteLinks from './apps/management/routes/invite-links.js'
@@ -141,7 +144,7 @@ describe('narrows responses by status', () => {
       }
       case 403: {
         const json = await res.json()
-        expectTypeOf(json.error.code).toEqualTypeOf<'api_key_forbidden'>()
+        expectTypeOf(json.error.code).toEqualTypeOf<'api_key_forbidden' | 'api_key_ip_forbidden'>()
         expectTypeOf(json.error.message).toEqualTypeOf<string>()
         void json
         return
@@ -357,6 +360,59 @@ describe('narrows responses by status', () => {
     }
   })
 
+  test('GET /v1/earn/vaults/:vaultId/earnings/:address', async () => {
+    const client = Client.create()
+    const res = await client.v1.earn.vaults[':vaultId'].earnings[':address'].$get({
+      param: {
+        address: `0x${'bb'.repeat(20)}`,
+        vaultId: `0x${'aa'.repeat(20)}`,
+      },
+    })
+
+    expectTypeOf(res.status).toEqualTypeOf<200 | 400 | 404 | 502 | PaidAccessStatus>()
+
+    if (res.status === 200) {
+      const json = await res.json()
+      expectTypeOf(json).toEqualTypeOf<z.output<typeof Earn.schema.getEarnVaultEarnings.Response>>()
+      expectTypeOf(json.account).toEqualTypeOf<`0x${string}`>()
+      expectTypeOf(json.assetToken).toEqualTypeOf<`0x${string}`>()
+      expectTypeOf(json.currentValue).toEqualTypeOf<string>()
+      expectTypeOf(json.id).toEqualTypeOf<`0x${string}`>()
+      expectTypeOf(json.period).toEqualTypeOf<'active' | 'lifetime'>()
+      expectTypeOf(json.status).toEqualTypeOf<
+        'complete' | 'incomplete_cost_basis' | 'pending_redemption'
+      >()
+      if (json.status === 'complete' && json.period === 'active')
+        expectTypeOf(json.activeEarnings).toEqualTypeOf<string>()
+      if (json.status === 'complete' && json.period === 'lifetime')
+        expectTypeOf(json.lifetimeEarnings).toEqualTypeOf<string>()
+      void json
+      return
+    }
+    if (res.status === 400) {
+      const json = await res.json()
+      expectTypeOf(json.error.code).toEqualTypeOf<
+        Access400<
+          'chain_id_invalid' | 'chain_id_unsupported' | 'earnings_invalid' | 'query_invalid'
+        >
+      >()
+      void json
+      return
+    }
+    if (res.status === 404) {
+      const json = await res.json()
+      expectTypeOf(json.error.code).toEqualTypeOf<'earn_vault_not_found'>()
+      void json
+      return
+    }
+    if (res.status === 502) {
+      const json = await res.json()
+      expectTypeOf(json.error.code).toEqualTypeOf<'upstream_error'>()
+      void json
+      return
+    }
+  })
+
   test('GET /v1/me', async () => {
     const client = Client.create()
     const res = await client.v1.me.$get()
@@ -580,7 +636,7 @@ describe('narrows responses by status', () => {
       case 403: {
         const json = await res.json()
         expectTypeOf(json.error.code).toEqualTypeOf<
-          'api_key_forbidden' | 'billing_source_disabled' | 'forbidden'
+          'api_key_forbidden' | 'api_key_ip_forbidden' | 'billing_source_disabled' | 'forbidden'
         >()
         void json
         return
@@ -867,7 +923,7 @@ describe('narrows responses by status', () => {
     const res = await client.v1.orgs[':orgId{org_[A-Za-z0-9_-]+}'].projects[
       ':projectId{prj_[A-Za-z0-9_-]+}'
     ]['api-keys'].$post({
-      json: { scopes: ['data:read'] },
+      json: { allowedIps: ['203.0.113.0/24'], scopes: ['data:read'] },
       param: { orgId: 'org_test', projectId: 'prj_test' },
     })
 
@@ -878,6 +934,7 @@ describe('narrows responses by status', () => {
         const json = await res.json()
         expectTypeOf(json.token).toEqualTypeOf<string>()
         expectTypeOf(json.id).toEqualTypeOf<string>()
+        expectTypeOf(json.allowedIps).toEqualTypeOf<readonly string[]>()
         void json
         return
       }
@@ -905,6 +962,7 @@ describe('narrows responses by status', () => {
         const json = await res.json()
         expectTypeOf(json.data[0]!.id).toEqualTypeOf<string>()
         expectTypeOf(json.data[0]!.environment).toEqualTypeOf<'production' | 'sandbox'>()
+        expectTypeOf(json.data[0]!.allowedIps).toEqualTypeOf<readonly string[]>()
         // Absent on org-wide keys minted without project attribution.
         expectTypeOf(json.data[0]!.projectId).toEqualTypeOf<string | undefined>()
         void json
@@ -913,6 +971,24 @@ describe('narrows responses by status', () => {
     }
   })
 
+  test('PATCH /v1/orgs/:orgId/projects/:projectId/api-keys/:keyId', async () => {
+    const client = Client.create()
+    const res = await client.v1.orgs[':orgId{org_[A-Za-z0-9_-]+}'].projects[
+      ':projectId{prj_[A-Za-z0-9_-]+}'
+    ]['api-keys'][':keyId{key_[A-Za-z0-9_-]+}'].$patch({
+      json: { allowedIps: [] },
+      param: { keyId: 'key_test', orgId: 'org_test', projectId: 'prj_test' },
+    })
+
+    expectTypeOf(res.status).toEqualTypeOf<200 | 404 | 502 | PublicAccessStatus>()
+
+    if (res.status === 200) {
+      const json = await res.json()
+      expectTypeOf(json.allowedIps).toEqualTypeOf<readonly string[]>()
+      void json
+    }
+  })
+
   test('DELETE /v1/orgs/:orgId/projects/:projectId/api-keys/:keyId', async () => {
     const client = Client.create()
     const res = await client.v1.orgs[':orgId{org_[A-Za-z0-9_-]+}'].projects[
@@ -1116,7 +1192,7 @@ describe('narrows responses by status', () => {
       }
       case 403: {
         const json = await res.json()
-        expectTypeOf(json.error.code).toEqualTypeOf<'api_key_forbidden'>()
+        expectTypeOf(json.error.code).toEqualTypeOf<'api_key_forbidden' | 'api_key_ip_forbidden'>()
         expectTypeOf(json.error.message).toEqualTypeOf<string>()
         void json
         return
@@ -1810,7 +1886,9 @@ describe('narrows responses by status', () => {
           | undefined
         >()
         expectTypeOf(json.data[0]!.sourceAmount).toEqualTypeOf<
-          z.output<typeof Funding.schema.quoteFunding.Response>['data'][number]['sourceAmount']
+          z.output<
+            typeof FundingQuotes.schema.quoteFunding.Response
+          >['data'][number]['sourceAmount']
         >()
         // @ts-expect-error token references do not contain quantities
         void json.data[0]!.sourceToken.amount
@@ -1855,7 +1933,7 @@ describe('narrows responses by status', () => {
         const json = await res.json()
         expectTypeOf(json.data[0]!.tokens[0]!.symbol).toEqualTypeOf<
           z.output<
-            typeof Funding.schema.getFundingChains.Response
+            typeof FundingChains.schema.getFundingChains.Response
           >['data'][number]['tokens'][number]['symbol']
         >()
         expectTypeOf(json.data[0]!.addressFormat).toEqualTypeOf<'base58' | 'base58check' | 'hex'>()
@@ -1921,7 +1999,9 @@ describe('narrows responses by status', () => {
         const json = await res.json()
         expectTypeOf(json.id).toEqualTypeOf<string>()
         expectTypeOf(json.status).toEqualTypeOf<
-          z.output<typeof Funding.schema.createFundingDepositAddress.Response>['status']
+          z.output<
+            typeof FundingDepositAddresses.schema.createFundingDepositAddress.Response
+          >['status']
         >()
         expectTypeOf(json.subsidize).toEqualTypeOf<boolean>()
         if ('quote' in json) {
@@ -1964,7 +2044,7 @@ describe('narrows responses by status', () => {
       case 200: {
         const json = await res.json()
         expectTypeOf(json.status).toEqualTypeOf<
-          z.output<typeof Funding.schema.DepositAddress>['status']
+          z.output<typeof FundingDepositAddresses.schema.DepositAddress>['status']
         >()
         expectTypeOf(json.sourceChain.kind).toEqualTypeOf<'evm' | 'solana' | 'tron'>()
         expectTypeOf(json.subsidize).toEqualTypeOf<boolean>()
@@ -1982,6 +2062,46 @@ describe('narrows responses by status', () => {
     }
   })
 
+  test('POST /v1/funding/deposit-addresses/:id/reconcile', async () => {
+    const client = Client.create()
+    const res = await client.v1.funding['deposit-addresses'][
+      ':id{fda_[A-Za-z0-9_-]+}'
+    ].reconcile.$post({ param: { id: 'fda_test' } })
+
+    expectTypeOf(res.status).toEqualTypeOf<202 | 400 | 401 | 403 | 404 | 409 | 429 | 501 | 502>()
+
+    switch (res.status) {
+      case 202: {
+        expectTypeOf(await res.text()).toEqualTypeOf<string>()
+        return
+      }
+      case 404: {
+        const json = await res.json()
+        expectTypeOf(json.error.code).toEqualTypeOf<'funding_deposit_address_not_found'>()
+        void json
+        return
+      }
+      case 409: {
+        const json = await res.json()
+        expectTypeOf(json.error.code).toEqualTypeOf<'funding_deposit_address_not_active'>()
+        void json
+        return
+      }
+      case 501: {
+        const json = await res.json()
+        expectTypeOf(json.error.code).toEqualTypeOf<'not_implemented'>()
+        void json
+        return
+      }
+      case 502: {
+        const json = await res.json()
+        expectTypeOf(json.error.code).toEqualTypeOf<'upstream_error'>()
+        void json
+        return
+      }
+    }
+  })
+
   test('GET /v1/funding/deposit-addresses/:id/deposits', async () => {
     const client = Client.create()
     const res = await client.v1.funding['deposit-addresses'][
@@ -1993,8 +2113,11 @@ describe('narrows responses by status', () => {
     switch (res.status) {
       case 200: {
         const json = await res.json()
+        expectTypeOf(json.data[0]!.detectionTrigger).toEqualTypeOf<
+          'chain' | 'manual' | 'poll' | 'webhook' | undefined
+        >()
         expectTypeOf(json.data[0]!.status).toEqualTypeOf<
-          z.output<typeof Funding.schema.Deposit>['status']
+          z.output<typeof FundingDepositAddresses.schema.Deposit>['status']
         >()
         expectTypeOf(json.nextCursor).toEqualTypeOf<string | null>()
         void json
@@ -2009,6 +2132,30 @@ describe('narrows responses by status', () => {
     }
   })
 
+  test('GET /v1/funding/deposits', async () => {
+    const client = Client.create()
+    // @ts-expect-error `recipient` is required for the deposit list.
+    void client.v1.funding.deposits.$get({ query: {} })
+    const res = await client.v1.funding.deposits.$get({
+      query: { recipient: `0x${'11'.repeat(20)}` },
+    })
+
+    expectTypeOf(res.status).toEqualTypeOf<200 | 400 | 502 | PublicAccessStatus>()
+
+    switch (res.status) {
+      case 200: {
+        const json = await res.json()
+        expectTypeOf(json.data[0]!.recipient).toEqualTypeOf<string>()
+        expectTypeOf(json.data[0]!.status).toEqualTypeOf<
+          z.output<typeof FundingDepositAddresses.schema.Deposit>['status']
+        >()
+        expectTypeOf(json.nextCursor).toEqualTypeOf<string | null>()
+        void json
+        return
+      }
+    }
+  })
+
   test('GET /v1/funding/deposits/:id', async () => {
     const client = Client.create()
     const res = await client.v1.funding.deposits[':id{fdp_[A-Za-z0-9_-]+}'].$get({
@@ -2020,12 +2167,15 @@ describe('narrows responses by status', () => {
     switch (res.status) {
       case 200: {
         const json = await res.json()
+        expectTypeOf(json.detectionTrigger).toEqualTypeOf<
+          'chain' | 'manual' | 'poll' | 'webhook' | undefined
+        >()
         expectTypeOf(json.destinationAmountRequired).toEqualTypeOf<
-          z.output<typeof Funding.schema.Deposit>['destinationAmountRequired']
+          z.output<typeof FundingDepositAddresses.schema.Deposit>['destinationAmountRequired']
         >()
         expectTypeOf(json.sourceTransferIndex).toEqualTypeOf<number | undefined>()
         expectTypeOf(json.statusReason).toEqualTypeOf<
-          z.output<typeof Funding.schema.Deposit>['statusReason']
+          z.output<typeof FundingDepositAddresses.schema.Deposit>['statusReason']
         >()
         // @ts-expect-error provider request identifiers remain private
         void json.providerRequestIds
@@ -2052,7 +2202,7 @@ describe('narrows responses by status', () => {
         const json = await res.json()
         expectTypeOf(json.data[0]!.id).toEqualTypeOf<string>()
         expectTypeOf(json.data[0]!.status).toEqualTypeOf<
-          z.output<typeof Funding.schema.Transfer>['status']
+          z.output<typeof FundingTransfers.schema.Transfer>['status']
         >()
         expectTypeOf(json.data[0]!.version).toEqualTypeOf<number>()
         // Transfer reads never expose the executable action.
@@ -2060,7 +2210,7 @@ describe('narrows responses by status', () => {
         void json.data[0]!.action
         // `meta` (opt-in `include=totalCount` count) is optional.
         expectTypeOf(json.meta).toEqualTypeOf<
-          z.output<typeof Funding.schema.listFundingTransfers.Response>['meta']
+          z.output<typeof FundingTransfers.schema.listFundingTransfers.Response>['meta']
         >()
         expectTypeOf(json.nextCursor).toEqualTypeOf<string | null>()
         void json
@@ -2102,7 +2252,7 @@ describe('narrows responses by status', () => {
         expectTypeOf(json.action.type).toEqualTypeOf<'evm:calls'>()
         expectTypeOf(json.id).toEqualTypeOf<string>()
         expectTypeOf(json.status).toEqualTypeOf<
-          z.output<typeof Funding.schema.createFundingTransfer.Response>['status']
+          z.output<typeof FundingTransfers.schema.createFundingTransfer.Response>['status']
         >()
         void json
         return
@@ -2191,10 +2341,10 @@ describe('narrows responses by status', () => {
         const json = await res.json()
         expectTypeOf(json.id).toEqualTypeOf<string>()
         expectTypeOf(json.status).toEqualTypeOf<
-          z.output<typeof Funding.schema.getFundingTransfer.Response>['status']
+          z.output<typeof FundingTransfers.schema.getFundingTransfer.Response>['status']
         >()
         expectTypeOf(json.statusReason).toEqualTypeOf<
-          z.output<typeof Funding.schema.getFundingTransfer.Response>['statusReason']
+          z.output<typeof FundingTransfers.schema.getFundingTransfer.Response>['statusReason']
         >()
         // @ts-expect-error `action` is a creation-only field
         void json.action
@@ -2944,7 +3094,7 @@ describe('narrows responses by status', () => {
       }
       case 403: {
         const json = await res.json()
-        expectTypeOf(json.error.code).toEqualTypeOf<'api_key_forbidden'>()
+        expectTypeOf(json.error.code).toEqualTypeOf<'api_key_forbidden' | 'api_key_ip_forbidden'>()
         void json
         return
       }
@@ -3120,7 +3270,9 @@ describe('narrows responses by status', () => {
     }
     if (res.status === 403) {
       const json = await res.json()
-      expectTypeOf(json.error.code).toEqualTypeOf<'api_key_forbidden' | 'limit_exceeded'>()
+      expectTypeOf(json.error.code).toEqualTypeOf<
+        'api_key_forbidden' | 'api_key_ip_forbidden' | 'limit_exceeded'
+      >()
     }
   })
 

package/src/admin/apps/api-keys.test.ts

@@ -24,6 +24,7 @@ describe('POST /api-keys', () => {
     expect(body.createdBy).toBe(TestAdmin.identity.email)
     expect(TestAdmin.redact(body)).toMatchInlineSnapshot(`
       {
+        "allowedIps": [],
         "createdAt": "<createdAt>",
         "createdBy": "admin@tempo.xyz",
         "environment": "production",
@@ -290,6 +291,23 @@ describe('DELETE /api-keys/:id', () => {
 })
 
 describe('PATCH /api-keys/:id', () => {
+  test('preserves the allowlist when omitted', async () => {
+    const { client, store } = TestAdmin.setup()
+    const { record } = await core_ApiKeys.mint(store, {
+      allowedIps: ['203.0.113.0/24'],
+      name: 'Restricted',
+      scopes: ['data:read'],
+    })
+
+    const response = await client['api-keys'][':id'].$patch({
+      json: { name: 'Renamed' },
+      param: { id: record.id },
+    })
+
+    expect(response.status).toBe(200)
+    expect((await core_ApiKeys.get(store, record.id))?.allowedIps).toEqual(['203.0.113.0/24'])
+  })
+
   test('renames and associates a one-off key without changing its token', async () => {
     const { client, db, store } = TestAdmin.setup()
     const organization = await Organizations.create(db, { name: 'Tempo' })
@@ -299,12 +317,18 @@ describe('PATCH /api-keys/:id', () => {
     })
 
     const response = await client['api-keys'][':id'].$patch({
-      json: { name: 'Explorer', orgId: organization.id, projectId: 'prj_real' },
+      json: {
+        allowedIps: ['203.0.113.0/24'],
+        name: 'Explorer',
+        orgId: organization.id,
+        projectId: 'prj_real',
+      },
       param: { id: record.id },
     })
     expect(response.status).toBe(200)
     const body = await TestApp.json(response, core_ApiKeys.schema.Record)
     expect(body.name).toBe('Explorer')
+    expect(body.allowedIps).toEqual(['203.0.113.0/24'])
     expect(body.orgId).toBe(organization.id)
     expect(body.projectId).toBe('prj_real')
 

package/src/admin/apps/api-keys.ts

@@ -1,6 +1,7 @@
 import { Hono } from 'hono'
 import * as z from 'zod/mini'
 
+import * as core_ApiKey from '../../ApiKey.js'
 import * as ApiKeys from '../../ApiKeys.js'
 import * as Db from '../../db/Db.js'
 import * as Organizations from '../../db/tables/organizations.js'
@@ -111,6 +112,9 @@ export namespace schema {
     /** Request body updating a key; omitted fields keep their value. */
     export const Body = Schema.describe(
       z.object({
+        allowedIps: z
+          .optional(core_ApiKey.schema.AllowedIps)
+          .check(z.describe('Replacement client IP/CIDR allowlist. An empty list clears it.')),
         name: z.optional(Name).check(z.describe('New human-readable key name.')),
         orgId: z
           .optional(z.string())
@@ -163,7 +167,7 @@ export namespace schema {
  *   returning the one-time token.
  * - `GET /` lists key records (metadata only), optionally filtered by `orgId`.
  * - `DELETE /:id` revokes a key by id (`404` if absent).
- * - `PATCH /:id` updates a key's name or project, or assigns its first organization.
+ * - `PATCH /:id` updates a key's allowlist, name, or project, or assigns its first organization.
  * - `POST /backfill` rebuilds the id and org index entries for every record.
  */
 export function apiKeys() {
@@ -307,7 +311,7 @@ export function apiKeys() {
         message: 'Invalid request body',
       }),
       OpenApi.describeRoute({
-        description: 'Update a key name or project, or assign its first organization. The token is unchanged.', // prettier-ignore
+        description: 'Update a key allowlist, name, or project, or assign its first organization. The token is unchanged.', // prettier-ignore
         operationId: 'updateApiKey',
         responses: OpenApi.responses({
           errors: {