tapimo 0.0.0 → 0.0.2

package/dist/admin/App.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"App.d.ts","sourceRoot":"","sources":["../../src/admin/App.ts"],"names":[],"mappings":"AAEA,OAAO,EAAa,KAAK,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AAGpE,OAAO,KAAK,YAAY,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,KAAK,MAAM,MAAM,cAAc,CAAA;AAC3C,OAAO,KAAK,QAAQ,MAAM,yBAAyB,CAAA;AACnD,OAAO,KAAK,KAAK,KAAK,MAAM,sBAAsB,CAAA;AAOlD,iFAAiF;AACjF,MAAM,MAAM,QAAQ,GAAG;IACrB,+EAA+E;IAC/E,KAAK,EAAE,MAAM,CAAA;CACd,CAAA;AAED,0CAA0C;AAC1C,MAAM,MAAM,WAAW,GAAG;IACxB,SAAS,EAAE,kBAAkB,GAAG;QAC9B,sEAAsE;QACtE,MAAM,EAAE,MAAM,CAAC,MAAM,GAAG,SAAS,CAAA;QACjC,gFAAgF;QAChF,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAA;QACzB,iEAAiE;QACjE,MAAM,EAAE,YAAY,CAAC,MAAM,CAAA;QAC3B,8DAA8D;QAC9D,cAAc,EAAE;YAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAA;SAAE,GAAG,SAAS,CAAA;KACnD,CAAA;CACF,CAAA;AAED,+DAA+D;AAC/D,MAAM,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,MAAM,CAAC,CAAA;AAE3C,yCAAyC;AACzC,wBAAgB,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;+BArBrC,MAAM;;;;;;;;;;;wBAkId;AAiBD,MAAM,CAAC,OAAO,WAAW,MAAM,CAAC;IAC9B;;;;OAIG;IACH,KAAK,MAAM,GAAG,MAAM,CAAC,MAAM,CAAA;IAE3B,kCAAkC;IAClC,KAAK,OAAO,GAAG;QACb,2EAA2E;QAC3E,MAAM,EAAE;YACN,sDAAsD;YACtD,MAAM,EAAE,YAAY,CAAC,MAAM,CAAA;SAC5B,CAAA;QACD;;;WAGG;QACH,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAC3B;;;;WAIG;QACH,QAAQ,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,QAAQ,GAAG,IAAI,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAA;QAC1E;;;WAGG;QACH,EAAE,CAAC,EAAE,EAAE,GAAG,KAAK,GAAG,SAAS,CAAA;QAC3B;;;WAGG;QACH,cAAc,CAAC,EACX;YACE,qEAAqE;YACrE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAA;SACnB,GACD,SAAS,CAAA;KACd,CAAA;IAED,mEAAmE;IACnE,KAAK,EAAE,GAAG;QACR,2EAA2E;QAC3E,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAC7B,0EAA0E;QAC1E,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAC/B,CAAA;CACF"}

package/dist/admin/App.js

@@ -0,0 +1,113 @@
+import { Hono } from 'hono';
+import { HTTPException } from 'hono/http-exception';
+import { requestId } from 'hono/request-id';
+import * as ApiKey from '../ApiKey.js';
+import * as ApiKeySource from '../ApiKeySource.js';
+import * as Response from '../internal/Response.js';
+import { apiKeys } from './apps/api-keys.js';
+import { scopes } from './apps/scopes.js';
+import { verifiedTokens } from './apps/verified-tokens.js';
+import * as Ui from './ui.generated.js';
+/** Creates the admin portal Hono app. */
+export function create(options) {
+    const { identify } = options;
+    const { source } = options.apiKey;
+    // `false` (disabled) collapses to `undefined` so only a real config surfaces
+    // `loginUrl`/`logoutUrl` in `/config.json`.
+    const ui = options.ui || undefined;
+    const app = new Hono();
+    app.use('*', requestId({ headerName: 'tempo-request-id' }));
+    // Public hashed assets (no identity needed); before identify so it's skipped.
+    if (options.ui !== false)
+        app.get('/assets/*', serveAsset);
+    // Resolve identity for every request, but don't reject here; the gate does.
+    app.use('*', async (c, next) => {
+        // Admin data is per-principal and mutating: never cache.
+        c.header('Cache-Control', 'no-store');
+        c.set('source', source);
+        c.set('assets', options.assets);
+        c.set('verifiedTokens', options.verifiedTokens);
+        c.set('identity', await identify(c.req.raw));
+        return next();
+    });
+    // Auth contract the UI reads (identity + sign-in/out URLs). Served at
+    // `/config.json` and inlined into the shell, so the UI reads it synchronously.
+    function authConfig(identity) {
+        return {
+            auth: {
+                identity,
+                ...(ui?.loginUrl ? { loginUrl: ui.loginUrl } : {}),
+                ...(ui?.logoutUrl ? { logoutUrl: ui.logoutUrl } : {}),
+            },
+        };
+    }
+    // Renders the public SPA shell: injects a `<base href>` of the mount root (so
+    // relative asset/API URLs resolve) and the auth config (read synchronously,
+    // `identity` is `null` when logged out). `<` is escaped to keep `<script>`.
+    const serveShell = (c) => {
+        const mount = c.req.routePath.replace(/\*$/, '').replace(/\/$/, '');
+        const config = JSON.stringify(authConfig(c.get('identity'))).replaceAll('<', '\\u003c');
+        return c.html(Ui.shell.replace('<head>', `<head><base href="${mount}/"/><script>window.__TEMPO_API_CONFIG__=${config}</script>`));
+    };
+    // Browser navigations (`Accept: text/html`) get the public shell before the
+    // data routes match, so SPA routes that share a path with a data endpoint
+    // (e.g. `/api-keys`) still load on hard reload. `fetch`/RPC (`*/*`) fall
+    // through to the JSON API below.
+    if (options.ui !== false)
+        app.get('*', (c, next) => c.req.header('accept')?.includes('text/html') ? serveShell(c) : next());
+    // Gate config + data API (`identity` → `null` ⇒ 401); shell/assets stay public.
+    const requireAuth = async (c, next) => {
+        if (!c.get('identity'))
+            return Response.error(c, {
+                code: 'unauthorized',
+                message: 'Admin authentication required.',
+                status: 401,
+            });
+        return next();
+    };
+    for (const path of [
+        '/config.json',
+        '/api-keys',
+        '/api-keys/*',
+        '/scopes',
+        '/scopes/*',
+        '/verified-tokens',
+        '/verified-tokens/*',
+    ])
+        app.use(path, requireAuth);
+    const routed = app
+        .get('/config.json', (c) => c.json(authConfig(c.get('identity')), 200))
+        .route('/api-keys', apiKeys())
+        .route('/scopes', scopes())
+        .route('/verified-tokens', verifiedTokens());
+    // Any other non-API GET renders the public SPA shell (catch-all last, so data
+    // routes win); the HTML-navigation handler above covers shared-path reloads.
+    if (options.ui !== false)
+        app.get('*', serveShell);
+    app.notFound((c) => Response.error(c, { code: 'not_found', message: 'Route not found', status: 404 }));
+    app.onError((cause, c) => {
+        if (cause instanceof HTTPException)
+            return cause.getResponse();
+        // Redact any leaked API-key token from the logged error/stack.
+        console.error(ApiKey.redact(cause instanceof Error ? (cause.stack ?? cause.message) : String(cause)));
+        return Response.error(c, {
+            code: 'internal_error',
+            message: 'Internal server error',
+            status: 500,
+        });
+    });
+    return routed;
+}
+// Serves a hashed SPA asset with an immutable cache (override the global
+// `no-store`). Filename comes from the path, so it resolves under any mount.
+function serveAsset(c) {
+    const asset = Ui.assets[`assets/${c.req.path.split('/assets/').at(-1)}`];
+    if (!asset)
+        return Response.error(c, { code: 'not_found', message: 'Route not found', status: 404 });
+    c.header('Cache-Control', 'public, max-age=31536000, immutable');
+    c.header('Content-Type', asset.contentType);
+    return c.body(asset.encoding === 'base64'
+        ? Uint8Array.from(atob(asset.content), (ch) => ch.charCodeAt(0))
+        : asset.content);
+}
+//# sourceMappingURL=App.js.map

package/dist/admin/App.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"App.js","sourceRoot":"","sources":["../../src/admin/App.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,IAAI,EAAa,MAAM,MAAM,CAAA;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,SAAS,EAA2B,MAAM,iBAAiB,CAAA;AAEpE,OAAO,KAAK,MAAM,MAAM,cAAc,CAAA;AACtC,OAAO,KAAK,YAAY,MAAM,oBAAoB,CAAA;AAElD,OAAO,KAAK,QAAQ,MAAM,yBAAyB,CAAA;AAGnD,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAA;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAA;AAC1D,OAAO,KAAK,EAAE,MAAM,mBAAmB,CAAA;AAyBvC,yCAAyC;AACzC,MAAM,UAAU,MAAM,CAAC,OAAuB;IAC5C,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAA;IAC5B,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAA;IACjC,6EAA6E;IAC7E,4CAA4C;IAC5C,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,IAAI,SAAS,CAAA;IAElC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAe,CAAA;IAEnC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,UAAU,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAA;IAE3D,8EAA8E;IAC9E,IAAI,OAAO,CAAC,EAAE,KAAK,KAAK;QAAE,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,CAAA;IAE1D,4EAA4E;IAC5E,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QAC7B,yDAAyD;QACzD,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAA;QACrC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;QACvB,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAA;QAC/B,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,OAAO,CAAC,cAAc,CAAC,CAAA;QAC/C,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;QAC5C,OAAO,IAAI,EAAE,CAAA;IACf,CAAC,CAAC,CAAA;IAEF,sEAAsE;IACtE,+EAA+E;IAC/E,SAAS,UAAU,CAAC,QAAyB;QAC3C,OAAO;YACL,IAAI,EAAE;gBACJ,QAAQ;gBACR,GAAG,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClD,GAAG,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACtD;SACF,CAAA;IACH,CAAC;IAED,8EAA8E;IAC9E,4EAA4E;IAC5E,4EAA4E;IAC5E,MAAM,UAAU,GAAG,CAAC,CAAuB,EAAE,EAAE;QAC7C,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;QACnE,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;QACvF,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,CAAC,KAAK,CAAC,OAAO,CACd,QAAQ,EACR,qBAAqB,KAAK,2CAA2C,MAAM,WAAW,CACvF,CACF,CAAA;IACH,CAAC,CAAA;IAED,4EAA4E;IAC5E,0EAA0E;IAC1E,yEAAyE;IACzE,iCAAiC;IACjC,IAAI,OAAO,CAAC,EAAE,KAAK,KAAK;QACtB,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CACvB,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CACvE,CAAA;IAEH,gFAAgF;IAChF,MAAM,WAAW,GAAG,KAAK,EAAE,CAAuB,EAAE,IAAU,EAAE,EAAE;QAChE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC;YACpB,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE;gBACvB,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,gCAAgC;gBACzC,MAAM,EAAE,GAAG;aACZ,CAAC,CAAA;QACJ,OAAO,IAAI,EAAE,CAAA;IACf,CAAC,CAAA;IACD,KAAK,MAAM,IAAI,IAAI;QACjB,cAAc;QACd,WAAW;QACX,aAAa;QACb,SAAS;QACT,WAAW;QACX,kBAAkB;QAClB,oBAAoB;KACrB;QACC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;IAE5B,MAAM,MAAM,GAAG,GAAG;SACf,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SACtE,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,CAAC;SAC7B,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC;SAC1B,KAAK,CAAC,kBAAkB,EAAE,cAAc,EAAE,CAAC,CAAA;IAE9C,8EAA8E;IAC9E,6EAA6E;IAC7E,IAAI,OAAO,CAAC,EAAE,KAAK,KAAK;QAAE,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;IAElD,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CACjB,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAClF,CAAA;IAED,GAAG,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;QACvB,IAAI,KAAK,YAAY,aAAa;YAAE,OAAO,KAAK,CAAC,WAAW,EAAE,CAAA;QAC9D,+DAA+D;QAC/D,OAAO,CAAC,KAAK,CACX,MAAM,CAAC,MAAM,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CACvF,CAAA;QACD,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE;YACvB,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,uBAAuB;YAChC,MAAM,EAAE,GAAG;SACZ,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,OAAO,MAAM,CAAA;AACf,CAAC;AAED,yEAAyE;AACzE,6EAA6E;AAC7E,SAAS,UAAU,CAAC,CAAuB;IACzC,MAAM,KAAK,GAAG,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IACxE,IAAI,CAAC,KAAK;QACR,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAC1F,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,qCAAqC,CAAC,CAAA;IAChE,CAAC,CAAC,MAAM,CAAC,cAAc,EAAE,KAAK,CAAC,WAAW,CAAC,CAAA;IAC3C,OAAO,CAAC,CAAC,IAAI,CACX,KAAK,CAAC,QAAQ,KAAK,QAAQ;QACzB,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAChE,CAAC,CAAC,KAAK,CAAC,OAAO,CAClB,CAAA;AACH,CAAC"}

package/dist/admin/apps/api-keys.d.ts

@@ -0,0 +1,209 @@
+import * as z from 'zod/mini';
+import * as Response from '../../internal/Response.js';
+import type * as App from '../App.js';
+/** Zod schemas owned by the admin API-keys handler. */
+export declare namespace schema {
+    /** Schemas for the createApiKey operation. */
+    namespace createApiKey {
+        /**
+         * Request body for minting a key (`MintInput` minus `createdBy`, which the
+         * server sets from the verified identity so it can't be spoofed).
+         */
+        const Body: z.ZodMiniObject<{
+            environment: z.ZodMiniDefault<z.ZodMiniEnum<{
+                production: "production";
+                sandbox: "sandbox";
+            }>>;
+            name: z.ZodMiniOptional<z.ZodMiniString<string>>;
+            rateLimits: z.ZodMiniOptional<z.ZodMiniRecord<z.ZodMiniString<string>, z.ZodMiniObject<{
+                perMinute: z.ZodMiniNumber<number>;
+            }, z.core.$strip>>>;
+            scopes: z.ZodMiniReadonly<z.ZodMiniArray<z.ZodMiniEnum<{
+                "*": "*";
+                "data:read": "data:read";
+                "indexer:query": "indexer:query";
+                "webhooks:read": "webhooks:read";
+                "webhooks:write": "webhooks:write";
+            }>>>;
+            expiresAt: z.ZodMiniOptional<z.ZodMiniString<string>>;
+            orgId: z.ZodMiniOptional<z.ZodMiniString<string>>;
+        }, z.core.$strip>;
+        /** Response: the record plus the one-time plaintext token. */
+        const Response: z.ZodMiniObject<{
+            environment: z.ZodMiniDefault<z.ZodMiniEnum<{
+                production: "production";
+                sandbox: "sandbox";
+            }>>;
+            id: z.ZodMiniString<string>;
+            name: z.ZodMiniOptional<z.ZodMiniString<string>>;
+            orgId: z.ZodMiniString<string>;
+            rateLimits: z.ZodMiniOptional<z.ZodMiniRecord<z.ZodMiniString<string>, z.ZodMiniObject<{
+                perMinute: z.ZodMiniNumber<number>;
+            }, z.core.$strip>>>;
+            scopes: z.ZodMiniReadonly<z.ZodMiniArray<z.ZodMiniEnum<{
+                "*": "*";
+                "data:read": "data:read";
+                "indexer:query": "indexer:query";
+                "webhooks:read": "webhooks:read";
+                "webhooks:write": "webhooks:write";
+            }>>>;
+            createdAt: z.ZodMiniString<string>;
+            createdBy: z.ZodMiniOptional<z.ZodMiniString<string>>;
+            expiresAt: z.ZodMiniOptional<z.ZodMiniString<string>>;
+            tokenLast4: z.ZodMiniString<string>;
+            token: z.ZodMiniString<string>;
+        }, z.core.$strip>;
+    }
+    /** Schemas for the listApiKeys operation. */
+    namespace listApiKeys {
+        /** Query parameters for listing keys. */
+        const Query: z.ZodMiniObject<{
+            orgId: z.ZodMiniOptional<z.ZodMiniString<string>>;
+        }, z.core.$strip>;
+        /** Response body: a list of key records (metadata only — never tokens). */
+        const Response: z.ZodMiniObject<{
+            data: z.ZodMiniArray<z.ZodMiniObject<{
+                environment: z.ZodMiniDefault<z.ZodMiniEnum<{
+                    production: "production";
+                    sandbox: "sandbox";
+                }>>;
+                id: z.ZodMiniString<string>;
+                name: z.ZodMiniOptional<z.ZodMiniString<string>>;
+                orgId: z.ZodMiniString<string>;
+                rateLimits: z.ZodMiniOptional<z.ZodMiniRecord<z.ZodMiniString<string>, z.ZodMiniObject<{
+                    perMinute: z.ZodMiniNumber<number>;
+                }, z.core.$strip>>>;
+                scopes: z.ZodMiniReadonly<z.ZodMiniArray<z.ZodMiniEnum<{
+                    "*": "*";
+                    "data:read": "data:read";
+                    "indexer:query": "indexer:query";
+                    "webhooks:read": "webhooks:read";
+                    "webhooks:write": "webhooks:write";
+                }>>>;
+                createdAt: z.ZodMiniString<string>;
+                createdBy: z.ZodMiniOptional<z.ZodMiniString<string>>;
+                expiresAt: z.ZodMiniOptional<z.ZodMiniString<string>>;
+                tokenLast4: z.ZodMiniString<string>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>;
+    }
+    /** Schemas for the revokeApiKey operation. */
+    namespace revokeApiKey {
+        /** Path parameters for revoking a key. */
+        const Params: z.ZodMiniObject<{
+            id: z.ZodMiniString<string>;
+        }, z.core.$strip>;
+        /** Response body for a successful revocation. */
+        const Response: z.ZodMiniObject<{
+            id: z.ZodMiniString<string>;
+        }, z.core.$strip>;
+    }
+}
+/**
+ * Provisioning routes for API keys, backed by the request's
+ * {@link App.Environment} `source`:
+ *
+ * - `POST /` mints a key, recording `createdBy` from the verified identity and
+ *   returning the one-time token.
+ * - `GET /` lists key records (metadata only), optionally filtered by `orgId`.
+ * - `DELETE /:id` revokes a key by id (`404` if absent).
+ */
+export declare function apiKeys(): import("hono/hono-base").HonoBase<App.Environment, {
+    "/": {
+        $post: {
+            output: {
+                environment: "production" | "sandbox";
+                id: string;
+                name?: string | undefined;
+                orgId: string;
+                rateLimits?: {
+                    [x: string]: {
+                        perMinute: number;
+                    };
+                } | undefined;
+                scopes: readonly ("*" | "data:read" | "indexer:query" | "webhooks:read" | "webhooks:write")[];
+                createdAt: string;
+                createdBy?: string | undefined;
+                expiresAt?: string | undefined;
+                tokenLast4: string;
+                token: string;
+            };
+            outputFormat: "json";
+            status: import("hono/utils/http-status").ContentfulStatusCode;
+            input: {
+                json: {
+                    environment?: "production" | "sandbox" | undefined;
+                    name?: string | undefined;
+                    rateLimits?: Record<string, {
+                        perMinute: number;
+                    }> | undefined;
+                    scopes: readonly ("*" | "data:read" | "indexer:query" | "webhooks:read" | "webhooks:write")[];
+                    expiresAt?: string | undefined;
+                    orgId?: string | undefined;
+                };
+            };
+        };
+    };
+} & {
+    "/": {
+        $get: {
+            output: {
+                data: {
+                    environment: "production" | "sandbox";
+                    id: string;
+                    name?: string | undefined;
+                    orgId: string;
+                    rateLimits?: {
+                        [x: string]: {
+                            perMinute: number;
+                        };
+                    } | undefined;
+                    scopes: readonly ("*" | "data:read" | "indexer:query" | "webhooks:read" | "webhooks:write")[];
+                    createdAt: string;
+                    createdBy?: string | undefined;
+                    expiresAt?: string | undefined;
+                    tokenLast4: string;
+                }[];
+            };
+            outputFormat: "json";
+            status: import("hono/utils/http-status").ContentfulStatusCode;
+            input: {
+                query?: {
+                    orgId?: string | string[];
+                } | undefined;
+            };
+        };
+    };
+} & {
+    "/:id": {
+        $delete: {
+            output: {
+                error: {
+                    code: "not_found";
+                    details?: readonly Response.error.Detail[] | undefined;
+                    message: string;
+                };
+                requestId: string;
+            };
+            outputFormat: "json";
+            status: 404;
+            input: {
+                param: {
+                    id: string;
+                };
+            };
+        } | {
+            output: {
+                id: string;
+            };
+            outputFormat: "json";
+            status: import("hono/utils/http-status").ContentfulStatusCode;
+            input: {
+                param: {
+                    id: string;
+                };
+            };
+        };
+    };
+}, "/", "/:id">;
+//# sourceMappingURL=api-keys.d.ts.map

package/dist/admin/apps/api-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-keys.d.ts","sourceRoot":"","sources":["../../../src/admin/apps/api-keys.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,CAAC,MAAM,UAAU,CAAA;AAI7B,OAAO,KAAK,QAAQ,MAAM,4BAA4B,CAAA;AAEtD,OAAO,KAAK,KAAK,GAAG,MAAM,WAAW,CAAA;AAErC,uDAAuD;AACvD,yBAAiB,MAAM,CAAC;IACtB,8CAA8C;IAC9C,UAAiB,YAAY,CAAC;QAC5B;;;WAGG;QACI,MAAM,IAAI;;;;;;;;;;;;;;;;;;yBAGhB,CAAA;QAED,8DAA8D;QACvD,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;yBAOpB,CAAA;KACF;IAED,6CAA6C;IAC7C,UAAiB,WAAW,CAAC;QAC3B,yCAAyC;QAClC,MAAM,KAAK;;yBAM4C,CAAA;QAE9D,2EAA2E;QACpE,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;yBAOpB,CAAA;KACF;IAED,8CAA8C;IAC9C,UAAiB,YAAY,CAAC;QAC5B,0CAA0C;QACnC,MAAM,MAAM;;yBAI6C,CAAA;QAEhE,iDAAiD;QAC1C,MAAM,QAAQ;;yBAE6B,CAAA;KACnD;CACF;AAED;;;;;;;;GAQG;AACH,wBAAgB,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBA4EtB"}

package/dist/admin/apps/api-keys.js

@@ -0,0 +1,129 @@
+import { Hono } from 'hono';
+import * as z from 'zod/mini';
+import * as ApiKeySource from '../../ApiKeySource.js';
+import * as OpenApi from '../../internal/OpenApi.js';
+import * as Response from '../../internal/Response.js';
+import * as Schema from '../../internal/Schema.js';
+/** Zod schemas owned by the admin API-keys handler. */
+export var schema;
+(function (schema) {
+    /** Schemas for the createApiKey operation. */
+    let createApiKey;
+    (function (createApiKey) {
+        /**
+         * Request body for minting a key (`MintInput` minus `createdBy`, which the
+         * server sets from the verified identity so it can't be spoofed).
+         */
+        createApiKey.Body = Schema.describe(z.omit(ApiKeySource.schema.MintInput, { createdBy: true }), 'Fields accepted when minting an API key.');
+        /** Response: the record plus the one-time plaintext token. */
+        createApiKey.Response = Schema.describe(z.extend(ApiKeySource.schema.Record, {
+            token: z
+                .string()
+                .check(z.describe('The plaintext token, shown once and unrecoverable afterward.')),
+        }), 'A minted API key, including its one-time token.');
+    })(createApiKey = schema.createApiKey || (schema.createApiKey = {}));
+    /** Schemas for the listApiKeys operation. */
+    let listApiKeys;
+    (function (listApiKeys) {
+        /** Query parameters for listing keys. */
+        listApiKeys.Query = z
+            .object({
+            orgId: z
+                .optional(z.string())
+                .check(z.describe('Restrict results to keys owned by this organization.')),
+        })
+            .check(z.describe('Query parameters for listing API keys.'));
+        /** Response body: a list of key records (metadata only — never tokens). */
+        listApiKeys.Response = Schema.describe(z.object({
+            data: z
+                .array(ApiKeySource.schema.Record)
+                .check(z.describe('API-key records, newest first (metadata only — never tokens).')),
+        }), 'A list of API-key records.');
+    })(listApiKeys = schema.listApiKeys || (schema.listApiKeys = {}));
+    /** Schemas for the revokeApiKey operation. */
+    let revokeApiKey;
+    (function (revokeApiKey) {
+        /** Path parameters for revoking a key. */
+        revokeApiKey.Params = z
+            .object({
+            id: z.string().check(z.describe('Stable id of the key to revoke.')),
+        })
+            .check(z.describe('Path parameters for revoking an API key.'));
+        /** Response body for a successful revocation. */
+        revokeApiKey.Response = z
+            .object({ id: z.string().check(z.describe('Revoked key id.')) })
+            .check(z.describe('API-key revocation result.'));
+    })(revokeApiKey = schema.revokeApiKey || (schema.revokeApiKey = {}));
+})(schema || (schema = {}));
+/**
+ * Provisioning routes for API keys, backed by the request's
+ * {@link App.Environment} `source`:
+ *
+ * - `POST /` mints a key, recording `createdBy` from the verified identity and
+ *   returning the one-time token.
+ * - `GET /` lists key records (metadata only), optionally filtered by `orgId`.
+ * - `DELETE /:id` revokes a key by id (`404` if absent).
+ */
+export function apiKeys() {
+    return new Hono()
+        .post('/', OpenApi.validate('json', schema.createApiKey.Body, {
+        code: 'body_invalid',
+        message: 'Invalid request body',
+    }), OpenApi.describeRoute({
+        operationId: 'createApiKey',
+        responses: OpenApi.responses({
+            success: {
+                description: 'Minted key (includes the one-time token).',
+                schema: schema.createApiKey.Response,
+            },
+        }),
+        summary: 'Create API key',
+        tags: ['API keys'],
+    }), async (c) => {
+        // `createdBy` is the verified admin email, never client-supplied.
+        // `requireAuth` guarantees identity on this gated route.
+        const { record, token } = await c.get('source').mint({
+            ...c.req.valid('json'),
+            createdBy: c.get('identity').email,
+        });
+        return c.json(Response.validated(schema.createApiKey.Response, { ...record, token }));
+    })
+        .get('/', OpenApi.validate('query', schema.listApiKeys.Query, {
+        code: 'query_invalid',
+        message: 'Invalid query parameters',
+    }), OpenApi.describeRoute({
+        operationId: 'listApiKeys',
+        responses: OpenApi.responses({
+            success: { description: 'API-key records.', schema: schema.listApiKeys.Response },
+        }),
+        summary: 'List API keys',
+        tags: ['API keys'],
+    }), async (c) => {
+        const { orgId } = c.req.valid('query');
+        const data = await c.get('source').list(orgId ? { orgId } : {});
+        return c.json(Response.validated(schema.listApiKeys.Response, { data }));
+    })
+        .delete('/:id', OpenApi.validate('param', schema.revokeApiKey.Params, {
+        code: 'param_invalid',
+        message: 'Invalid path parameters',
+    }), OpenApi.describeRoute({
+        operationId: 'revokeApiKey',
+        responses: OpenApi.responses({
+            errors: { 404: 'API key not found.' },
+            success: { description: 'Key revoked.', schema: schema.revokeApiKey.Response },
+        }),
+        summary: 'Revoke API key',
+        tags: ['API keys'],
+    }), async (c) => {
+        const { id } = c.req.valid('param');
+        const revoked = await c.get('source').revoke(id);
+        if (!revoked)
+            return Response.error(c, {
+                code: 'not_found',
+                message: 'API key not found.',
+                status: 404,
+            });
+        return c.json(Response.validated(schema.revokeApiKey.Response, { id }));
+    });
+}
+//# sourceMappingURL=api-keys.js.map

package/dist/admin/apps/api-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-keys.js","sourceRoot":"","sources":["../../../src/admin/apps/api-keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAC3B,OAAO,KAAK,CAAC,MAAM,UAAU,CAAA;AAE7B,OAAO,KAAK,YAAY,MAAM,uBAAuB,CAAA;AACrD,OAAO,KAAK,OAAO,MAAM,2BAA2B,CAAA;AACpD,OAAO,KAAK,QAAQ,MAAM,4BAA4B,CAAA;AACtD,OAAO,KAAK,MAAM,MAAM,0BAA0B,CAAA;AAGlD,uDAAuD;AACvD,MAAM,KAAW,MAAM,CA2DtB;AA3DD,WAAiB,MAAM;IACrB,8CAA8C;IAC9C,IAAiB,YAAY,CAmB5B;IAnBD,WAAiB,YAAY;QAC3B;;;WAGG;QACU,iBAAI,GAAG,MAAM,CAAC,QAAQ,CACjC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,EAC1D,0CAA0C,CAC3C,CAAA;QAED,8DAA8D;QACjD,qBAAQ,GAAG,MAAM,CAAC,QAAQ,CACrC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE;YACnC,KAAK,EAAE,CAAC;iBACL,MAAM,EAAE;iBACR,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,8DAA8D,CAAC,CAAC;SACrF,CAAC,EACF,iDAAiD,CAClD,CAAA;IACH,CAAC,EAnBgB,YAAY,GAAZ,OAAA,YAAY,KAAZ,OAAA,YAAY,QAmB5B;IAED,6CAA6C;IAC7C,IAAiB,WAAW,CAmB3B;IAnBD,WAAiB,WAAW;QAC1B,yCAAyC;QAC5B,iBAAK,GAAG,CAAC;aACnB,MAAM,CAAC;YACN,KAAK,EAAE,CAAC;iBACL,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;iBACpB,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,sDAAsD,CAAC,CAAC;SAC7E,CAAC;aACD,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,wCAAwC,CAAC,CAAC,CAAA;QAE9D,2EAA2E;QAC9D,oBAAQ,GAAG,MAAM,CAAC,QAAQ,CACrC,CAAC,CAAC,MAAM,CAAC;YACP,IAAI,EAAE,CAAC;iBACJ,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC;iBACjC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,+DAA+D,CAAC,CAAC;SACtF,CAAC,EACF,4BAA4B,CAC7B,CAAA;IACH,CAAC,EAnBgB,WAAW,GAAX,OAAA,WAAW,KAAX,OAAA,WAAW,QAmB3B;IAED,8CAA8C;IAC9C,IAAiB,YAAY,CAY5B;IAZD,WAAiB,YAAY;QAC3B,0CAA0C;QAC7B,mBAAM,GAAG,CAAC;aACpB,MAAM,CAAC;YACN,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,iCAAiC,CAAC,CAAC;SACpE,CAAC;aACD,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,0CAA0C,CAAC,CAAC,CAAA;QAEhE,iDAAiD;QACpC,qBAAQ,GAAG,CAAC;aACtB,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,EAAE,CAAC;aAC/D,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,4BAA4B,CAAC,CAAC,CAAA;IACpD,CAAC,EAZgB,YAAY,GAAZ,OAAA,YAAY,KAAZ,OAAA,YAAY,QAY5B;AACH,CAAC,EA3DgB,MAAM,KAAN,MAAM,QA2DtB;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,OAAO;IACrB,OAAO,IAAI,IAAI,EAAmB;SAC/B,IAAI,CACH,GAAG,EACH,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE;QACjD,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,sBAAsB;KAChC,CAAC,EACF,OAAO,CAAC,aAAa,CAAC;QACpB,WAAW,EAAE,cAAc;QAC3B,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC;YAC3B,OAAO,EAAE;gBACP,WAAW,EAAE,2CAA2C;gBACxD,MAAM,EAAE,MAAM,CAAC,YAAY,CAAC,QAAQ;aACrC;SACF,CAAC;QACF,OAAO,EAAE,gBAAgB;QACzB,IAAI,EAAE,CAAC,UAAU,CAAC;KACnB,CAAC,EACF,KAAK,EAAE,CAAC,EAAE,EAAE;QACV,kEAAkE;QAClE,yDAAyD;QACzD,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC;YACnD,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC;YACtB,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAE,CAAC,KAAK;SACpC,CAAC,CAAA;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;IACvF,CAAC,CACF;SACA,GAAG,CACF,GAAG,EACH,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE;QAClD,IAAI,EAAE,eAAe;QACrB,OAAO,EAAE,0BAA0B;KACpC,CAAC,EACF,OAAO,CAAC,aAAa,CAAC;QACpB,WAAW,EAAE,aAAa;QAC1B,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC;YAC3B,OAAO,EAAE,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE;SAClF,CAAC;QACF,OAAO,EAAE,eAAe;QACxB,IAAI,EAAE,CAAC,UAAU,CAAC;KACnB,CAAC,EACF,KAAK,EAAE,CAAC,EAAE,EAAE;QACV,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QACtC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;QAC/D,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IAC1E,CAAC,CACF;SACA,MAAM,CACL,MAAM,EACN,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE;QACpD,IAAI,EAAE,eAAe;QACrB,OAAO,EAAE,yBAAyB;KACnC,CAAC,EACF,OAAO,CAAC,aAAa,CAAC;QACpB,WAAW,EAAE,cAAc;QAC3B,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC;YAC3B,MAAM,EAAE,EAAE,GAAG,EAAE,oBAAoB,EAAE;YACrC,OAAO,EAAE,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE;SAC/E,CAAC;QACF,OAAO,EAAE,gBAAgB;QACzB,IAAI,EAAE,CAAC,UAAU,CAAC;KACnB,CAAC,EACF,KAAK,EAAE,CAAC,EAAE,EAAE;QACV,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QACnC,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QAChD,IAAI,CAAC,OAAO;YACV,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE;gBACvB,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,oBAAoB;gBAC7B,MAAM,EAAE,GAAG;aACZ,CAAC,CAAA;QACJ,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;IACzE,CAAC,CACF,CAAA;AACL,CAAC"}

package/dist/admin/apps/scopes.d.ts

@@ -0,0 +1,46 @@
+import * as z from 'zod/mini';
+import type * as App from '../App.js';
+/** Zod schemas owned by the admin scope catalog handler. */
+export declare namespace schema {
+    /** Schemas for the getAdminScopes operation. */
+    namespace getScopes {
+        /** A single issuable API-key scope. */
+        const Scope: z.ZodMiniObject<{
+            description: z.ZodMiniString<string>;
+            scope: z.ZodMiniString<string>;
+        }, z.core.$strip>;
+        /** Response body for the scope catalog. */
+        const Response: z.ZodMiniObject<{
+            data: z.ZodMiniArray<z.ZodMiniObject<{
+                description: z.ZodMiniString<string>;
+                scope: z.ZodMiniString<string>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>;
+    }
+}
+/** Catalog of issuable API-key scopes, served from {@link Scope.catalog}. */
+export declare function scopes(): import("hono/hono-base").HonoBase<App.Environment, {
+    "/": {
+        $get: {
+            output: {
+                data: readonly [{
+                    readonly description: 'Read public chain data: tokens, transactions, transfers, blocks, and receipts.';
+                    readonly scope: 'data:read';
+                }, {
+                    readonly description: 'Run ad-hoc queries against the raw indexer passthrough.';
+                    readonly scope: 'indexer:query';
+                }, {
+                    readonly description: 'Read webhook subscriptions.';
+                    readonly scope: 'webhooks:read';
+                }, {
+                    readonly description: 'Create, update, and delete webhook subscriptions.';
+                    readonly scope: 'webhooks:write';
+                }];
+            };
+            outputFormat: "json";
+            status: import("hono/utils/http-status").ContentfulStatusCode;
+            input: {};
+        };
+    };
+}, "/", "/">;
+//# sourceMappingURL=scopes.d.ts.map

package/dist/admin/apps/scopes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scopes.d.ts","sourceRoot":"","sources":["../../../src/admin/apps/scopes.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,CAAC,MAAM,UAAU,CAAA;AAI7B,OAAO,KAAK,KAAK,GAAG,MAAM,WAAW,CAAA;AAErC,4DAA4D;AAC5D,yBAAiB,MAAM,CAAC;IACtB,gDAAgD;IAChD,UAAiB,SAAS,CAAC;QACzB,uCAAuC;QAChC,MAAM,KAAK;;;yBASsC,CAAA;QAExD,2CAA2C;QACpC,MAAM,QAAQ;;;;;yBAIuC,CAAA;KAC7D;CACF;AAED,6EAA6E;AAC7E,wBAAgB,MAAM;;;;;;;;;;;;;;;;;;;;;;;aAarB"}

package/dist/admin/apps/scopes.js

@@ -0,0 +1,41 @@
+import { Hono } from 'hono';
+import * as z from 'zod/mini';
+import * as OpenApi from '../../internal/OpenApi.js';
+import * as Scope from '../../Scope.js';
+/** Zod schemas owned by the admin scope catalog handler. */
+export var schema;
+(function (schema) {
+    /** Schemas for the getAdminScopes operation. */
+    let getScopes;
+    (function (getScopes) {
+        /** A single issuable API-key scope. */
+        getScopes.Scope = z
+            .object({
+            description: z
+                .string()
+                .check(z.describe('Human-readable explanation of what the scope grants.')),
+            scope: z
+                .string()
+                .check(z.describe('Scope identifier used in API-key grants and route policies.')),
+        })
+            .check(z.describe('A single issuable API-key scope.'));
+        /** Response body for the scope catalog. */
+        getScopes.Response = z
+            .object({
+            data: z.array(getScopes.Scope).check(z.describe('Issuable API-key scopes.')),
+        })
+            .check(z.describe('Response body for the scope catalog.'));
+    })(getScopes = schema.getScopes || (schema.getScopes = {}));
+})(schema || (schema = {}));
+/** Catalog of issuable API-key scopes, served from {@link Scope.catalog}. */
+export function scopes() {
+    return new Hono().get('/', OpenApi.describeRoute({
+        operationId: 'getAdminScopes',
+        responses: OpenApi.responses({
+            success: { description: 'Issuable scope catalog.', schema: schema.getScopes.Response },
+        }),
+        summary: 'List scopes',
+        tags: ['Scopes'],
+    }), (c) => c.json({ data: Scope.catalog }));
+}
+//# sourceMappingURL=scopes.js.map

package/dist/admin/apps/scopes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scopes.js","sourceRoot":"","sources":["../../../src/admin/apps/scopes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAC3B,OAAO,KAAK,CAAC,MAAM,UAAU,CAAA;AAE7B,OAAO,KAAK,OAAO,MAAM,2BAA2B,CAAA;AACpD,OAAO,KAAK,KAAK,MAAM,gBAAgB,CAAA;AAGvC,4DAA4D;AAC5D,MAAM,KAAW,MAAM,CAsBtB;AAtBD,WAAiB,MAAM;IACrB,gDAAgD;IAChD,IAAiB,SAAS,CAmBzB;IAnBD,WAAiB,SAAS;QACxB,uCAAuC;QAC1B,eAAK,GAAG,CAAC;aACnB,MAAM,CAAC;YACN,WAAW,EAAE,CAAC;iBACX,MAAM,EAAE;iBACR,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,sDAAsD,CAAC,CAAC;YAC5E,KAAK,EAAE,CAAC;iBACL,MAAM,EAAE;iBACR,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,6DAA6D,CAAC,CAAC;SACpF,CAAC;aACD,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,kCAAkC,CAAC,CAAC,CAAA;QAExD,2CAA2C;QAC9B,kBAAQ,GAAG,CAAC;aACtB,MAAM,CAAC;YACN,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,eAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,0BAA0B,CAAC,CAAC;SACnE,CAAC;aACD,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,sCAAsC,CAAC,CAAC,CAAA;IAC9D,CAAC,EAnBgB,SAAS,GAAT,OAAA,SAAS,KAAT,OAAA,SAAS,QAmBzB;AACH,CAAC,EAtBgB,MAAM,KAAN,MAAM,QAsBtB;AAED,6EAA6E;AAC7E,MAAM,UAAU,MAAM;IACpB,OAAO,IAAI,IAAI,EAAmB,CAAC,GAAG,CACpC,GAAG,EACH,OAAO,CAAC,aAAa,CAAC;QACpB,WAAW,EAAE,gBAAgB;QAC7B,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC;YAC3B,OAAO,EAAE,EAAE,WAAW,EAAE,yBAAyB,EAAE,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE;SACvF,CAAC;QACF,OAAO,EAAE,aAAa;QACtB,IAAI,EAAE,CAAC,QAAQ,CAAC;KACjB,CAAC,EACF,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CACvC,CAAA;AACH,CAAC"}