tapimo 0.0.2 → 0.1.0

package/src/App.ts

@@ -5,13 +5,15 @@ import { cors as hono_cors } from 'hono/cors'
 import { HTTPException } from 'hono/http-exception'
 import { requestId, type RequestIdVariables } from 'hono/request-id'
 import { generateSpecs } from 'hono-openapi'
-import { Handler } from 'vocs/server'
+import { Handler as vocs_Handler } from 'vocs/server'
 import * as z from 'zod/mini'
 
 import * as ApiKey from './ApiKey.js'
 import * as Assets from './Assets.js'
 import * as Auth from './internal/Auth.js'
+import * as Db from './db/Db.js'
 import * as EdgeCache from './internal/EdgeCache.js'
+import * as Handler from './Handler.js'
 import * as Log from './internal/Log.js'
 import * as MetricSink from './internal/MetricSink.js'
 import type * as Metrics from './Metrics.js'
@@ -22,6 +24,7 @@ import * as Response from './internal/Response.js'
 import * as Schema from './internal/Schema.js'
 import * as Tidx from './internal/Tidx.js'
 import * as Timing from './internal/Timing.js'
+import * as VerifiedTokens from './internal/VerifiedTokens.js'
 import * as Viem from './internal/Viem.js'
 
 import openrpcSpec from './openrpc.json' with { type: 'json' }
@@ -50,6 +53,12 @@ export type Environment = {
       basePath: string
       /** Default Tempo chain id for this API app. */
       chainId: Viem.ChainId
+      /** Authoritative Postgres store, or a per-request factory. Resolve at the leaf with `Db.get`. */
+      db: Db.Source
+      /** Store for staleness-tolerant reads (a caching Hyperdrive config when configured); falls back to `db`. */
+      dbCached: Db.Source
+      /** KV state store backing API-key records, or undefined when key auth is closed. */
+      kv: { store: Store.State } | undefined
       /** Gets one static API asset. */
       getAsset: GetAsset
       /** Gets a Tempo RPC client for a chain id. */
@@ -64,10 +73,10 @@ export type Environment = {
       supportedChainIds: ReadonlySet<number>
       /** Configured TIDX client options used by the raw indexer passthrough. */
       tidx: Tidx.getClient.Tidx | undefined
-      /** Verified-token feature configuration (state store + refresh window), or undefined when verified tokens are bundle-backed. */
-      verifiedTokens: { refreshMs?: number | undefined; store: Store.State } | undefined
-      /** Webhook feature configuration (state store, etc.), or undefined when webhooks are disabled. */
-      webhook: { maxPerOwner?: number | undefined; store: Store.State } | undefined
+      /** Verified-token feature configuration (refresh window), or undefined when the feature is disabled. Token rows live in `db`. */
+      verifiedTokens: { refreshMs?: number | undefined } | undefined
+      /** Webhook feature configuration, or undefined when webhooks are disabled. Rows live in `db`. */
+      webhook: { maxPerOwner?: number | undefined } | undefined
     } & EdgeCache.Variables &
     Log.Variables &
     Timing.Variables
@@ -108,7 +117,7 @@ export type GetAsset = (
 const infoDescription = 'REST API for reading and interacting with Tempo'
 
 /** Creates the Tempo API Hono app. */
-export function create<const path extends string = '/'>(options: create.Options<path> = {}) {
+export function create<const path extends string = '/'>(options: create.Options<path>) {
   const { assets, defaultChainId = Viem.defaultChainId, path = '/' as path, rpc } = options
 
   // Capture as the literal generic so `Hono.basePath(...)` preserves the
@@ -123,8 +132,8 @@ export function create<const path extends string = '/'>(options: create.Options<
   // miss simply re-fetches — so it defaults to in-memory. Point it at a
   // colo-local store (`Store.cache(caches.default)`) in production; never the
   // Durable Object, or edge-cache hits re-incur the round-trip they skip.
-  // Authoritative state (webhooks) lives in its own state store, configured
-  // separately via `options.webhook.store` (a Durable Object in production).
+  // Authoritative state lives elsewhere: webhooks + verified tokens in
+  // `options.db`, API-key records in `options.kv`.
   const store = options.cache?.store ?? Store.memory()
 
   // Memoize one viem client per resolved upstream. Clients are stateless HTTP
@@ -197,8 +206,8 @@ export function create<const path extends string = '/'>(options: create.Options<
     base.use(
       '*',
       Log.middleware<Environment>({
-        emit: (entry) => {
-          log?.(entry)
+        emit: async (entry) => {
+          await log?.(entry)
           recordRequest?.(entry)
           // Return the analytics promise so `Log.middleware` extends the
           // response with `waitUntil`; otherwise the async sink's `queue.send`
@@ -219,21 +228,29 @@ export function create<const path extends string = '/'>(options: create.Options<
     ...(options.supportedChainIds ?? []),
   ])
 
+  // Normalize the `db` option: the plain form is `{ source }` with no cached
+  // side; `cached` falls back to `source` so consumers never branch.
+  const db = 'source' in options.db ? options.db : { source: options.db }
+
   base.use('*', Timing.middleware())
   base.use('*', async (c, next) => {
     // Put app-level dependencies on Hono context so mounted handlers only
     // receive request-local state from `c`.
     c.set('basePath', basePath)
     c.set('chainId', defaultChainId)
+    c.set('db', db.source)
+    c.set('dbCached', db.cached ?? db.source)
     c.set('getAsset', createGetAsset({ assets, basePath, origin: new URL(c.req.url).origin }))
     c.set('getClient', (chainId) => getClient(chainId, Auth.getPrincipal(c)))
     c.set('getTidx', (chainId) => getTidx(chainId, Auth.getPrincipal(c)))
+    c.set('kv', options.kv)
     c.set('rpc', rpc)
     c.set('store', store)
     c.set('supportedChainIds', supportedChainIds)
     c.set('tidx', options.tidx)
-    c.set('verifiedTokens', options.verifiedTokens)
-    c.set('webhook', options.webhook)
+    // Feature configs default to enabled empty configs; `false` disables.
+    c.set('verifiedTokens', options.verifiedTokens === false ? undefined : (options.verifiedTokens ?? {})) // prettier-ignore
+    c.set('webhook', options.webhook === false ? undefined : (options.webhook ?? {}))
     await next()
   })
 
@@ -297,8 +314,33 @@ export function create<const path extends string = '/'>(options: create.Options<
     .route('/v1/transactions', transactionActivities())
     .route('/v1/transfers', transfers())
     .route('/v1/verified-tokens', verifiedTokens())
-    .route('/v1/webhooks', webhooks({ enabled: options.webhook !== undefined }))
+    .route('/v1/webhooks', webhooks({ enabled: options.webhook !== false }))
     .route('/rpc', rpcApp())
+    .use(
+      '/rpc/relay',
+      Auth.policy({ apiKey: { scopes: ['rpc-relay'] }, mpp: false, public: false }),
+      OpenApi.describeRoute({ hide: true, summary: 'Relay RPC' }),
+    )
+    .use(
+      '/rpc/relay/*',
+      Auth.policy({ apiKey: { scopes: ['rpc-relay'] }, mpp: false, public: false }),
+      OpenApi.describeRoute({ hide: true, summary: 'Relay RPC' }),
+    )
+    .route(
+      '/rpc/relay',
+      Handler.relay({
+        cache: store,
+        getClient: (chainId) => getClient(chainId as Viem.ChainId | undefined),
+        ...(options.verifiedTokens === false
+          ? {}
+          : {
+              resolveTokens: async (chainId: number) => {
+                const snapshot = await VerifiedTokens.read(Db.get(db.cached ?? db.source), chainId)
+                return snapshot?.list.map((token) => token.address) ?? []
+              },
+            }),
+      }),
+    )
     .route('/gecko', coingecko())
     // Hidden compatibility route for the prior Tempo API's
     // `GET /chains/:chainId/blocks/by-timestamp` (chain id in the path).
@@ -308,7 +350,7 @@ export function create<const path extends string = '/'>(options: create.Options<
     // OAS 3.1 `webhooks`: document the signed envelope Tempo API POSTs to subscriber
     // URLs (an outbound payload, not an endpoint of this API). Only when enabled.
     const webhooksDoc = (() => {
-      if (!options.webhook) return {}
+      if (options.webhook === false) return {}
       // `io: 'output'` documents the delivered (serialized) shape; `unrepresentable: 'any'`
       // tolerates the transaction payload's transforms (e.g. lazy fee-token metadata),
       // which have no JSON-Schema form, by emitting `{}` for those nodes rather than throwing.
@@ -422,7 +464,7 @@ export function create<const path extends string = '/'>(options: create.Options<
             name: 'Verified Tokens',
             description: 'A curated, trusted list of TIP-20 tokens.',
           },
-          ...(options.webhook
+          ...(options.webhook !== false
             ? [
                 {
                   name: 'Webhooks',
@@ -470,7 +512,7 @@ export function create<const path extends string = '/'>(options: create.Options<
   if (options.docs !== false)
     app.route(
       '/',
-      Handler.openApi(
+      vocs_Handler.openApi(
         {
           // Inline the OpenRPC doc so vocs expands it without a self-subrequest
           // (see `inlineOpenrpc`); the public `/openapi.json` keeps the URL ref.
@@ -529,8 +571,12 @@ export declare namespace create {
     compress?: boolean | Compress | undefined
     /** CORS for API handlers. Enabled by default (wildcard origin, no credentials); pass a config object to customize, true for defaults, or false to disable (e.g. when CORS is handled by a fronting gateway/CDN). */
     cors?: boolean | Cors | undefined
+    /** Authoritative Postgres store backing stateful features (webhooks, verified tokens). Pass a long-lived `Db.postgres(...)` singleton on Node, or a factory (`() => Db.postgres(...)`) on Workers so each request builds a fresh Hyperdrive-pooled connection. Pass `{ source, cached }` to route staleness-tolerant reads (verified tokens) through a second, query-caching Hyperdrive config; `source` stays uncached for read-after-write correctness. Apply migrations out of band via `tapimo admin migrate`. */
+    db: Db.Source | { cached?: Db.Source | undefined; source: Db.Source }
     /** Default Tempo chain id for requests that omit `chainId`. */
     defaultChainId?: Viem.ChainId | undefined
+    /** KV state store backing API-key records (e.g. `Store.cloudflareKv(...)`). Omit to leave API-key auth closed — every token resolves to `null`. */
+    kv?: Kv | undefined
     /** Vocs API reference options. Set to false to disable the `/` docs page. */
     docs?: Docs | false | undefined
     /** Request logging. Disabled by default. Pass `true` to emit one canonical structured log entry per request through the level-matched console method (indexed by Workers Logs); a level (e.g. `'warn'`) to emit only that level and above (dropping successful-request info lines); or an emit function for a custom sink. */
@@ -549,10 +595,21 @@ export declare namespace create {
     rpc?: Rpc | undefined
     /** TIDX query client options. */
     tidx?: Tidx.getClient.Tidx | undefined
-    /** Verified-token feature configuration. Omit to serve an empty verified list (nothing is verified). Provide a state `store` (Cloudflare KV or a Durable Object in production; never the cache, which a miss would silently drop) to make the curated list API-managed and durable. */
-    verifiedTokens?: VerifiedTokens | undefined
-    /** Webhook feature configuration. Omit to disable webhooks: the `/webhooks` routes stay mounted (for a stable schema and typed test client) but return `404` and are hidden from the OpenAPI document. Requires a state `store` (a Durable Object in production; never the cache, which a miss would silently drop). */
-    webhook?: Webhook | undefined
+    /** Verified-token feature configuration. Enabled by default (token rows live in `db`; empty until published); pass `false` to always serve an empty verified list. */
+    verifiedTokens?: VerifiedTokens | false | undefined
+    /** Webhook feature configuration. Enabled by default (subscription/delivery rows live in `db`). Pass `false` to disable: the `/webhooks` routes stay mounted (for a stable schema and typed test client) but return `404` and are hidden from the OpenAPI document. */
+    webhook?: Webhook | false | undefined
+  }
+
+  /** KV state-store configuration. */
+  type Kv = {
+    /**
+     * State store backing API-key records. Must be a {@link Store.State}
+     * (e.g. `Store.cloudflareKv(...)` or `Store.memory()`); the Web Cache
+     * adapter (`Store.cache`) is rejected at the type level since a miss there
+     * would silently drop authoritative state.
+     */
+    store: Store.State
   }
 
   /** Caching configuration. */
@@ -568,17 +625,10 @@ export declare namespace create {
     /**
      * Per-isolate soft-refresh window in milliseconds. Within this window
      * verified-token lookups are served from the in-memory snapshot with no
-     * store I/O; after it, the next lookup re-checks the store's `head` version
+     * database I/O; after it, the next lookup re-checks the head version
      * (single-flight) and recompiles only when it changed. Defaults to 10_000.
      */
     refreshMs?: number | undefined
-    /**
-     * State store backing the curated verified-token snapshots. Must be a
-     * {@link Store.State} (e.g. `Store.cloudflareKv(...)`, `Store.durableObject(...)`,
-     * or `Store.memory()`); the Web Cache adapter (`Store.cache`) is rejected at
-     * the type level since a miss there would silently drop authoritative state.
-     */
-    store: Store.State
   }
 
   /** Webhook feature configuration. */
@@ -589,13 +639,6 @@ export declare namespace create {
      * spam/SSRF surface and unbounded downstream delivery cost per owner.
      */
     maxPerOwner?: number | undefined
-    /**
-     * State store backing webhook subscriptions, cursors, and the delivery
-     * log. Must be a {@link Store.State} (e.g. `Store.durableObject(...)` or
-     * `Store.memory()`); the Web Cache adapter (`Store.cache`) is rejected at
-     * the type level since a miss there would silently drop authoritative state.
-     */
-    store: Store.State
   }
 
   /** Binary asset store for static API assets (e.g. `Assets.cloudflareR2(...)`). */
@@ -608,7 +651,7 @@ export declare namespace create {
   type Cors = NonNullable<Parameters<typeof hono_cors>[0]>
 
   /** Vocs API reference options (theme, top navigation, logo, socials, …). */
-  type Docs = NonNullable<Parameters<typeof Handler.openApi>[0]['vocs']>
+  type Docs = NonNullable<Parameters<typeof vocs_Handler.openApi>[0]['vocs']>
 
   /** Custom request-log sink, receiving one canonical entry per request. */
   type Logger = Log.Emit

package/src/Client.test-d.ts

@@ -1,4 +1,4 @@
-import { Client } from 'cadent'
+import { Client } from 'tapimo'
 import type * as z from 'zod/mini'
 
 import * as Activities from './apps/activities.js'

package/src/Handler.ts

@@ -0,0 +1,154 @@
+import { Hono } from 'hono'
+import type { ExtractSchema, MergeSchemaPath, Schema } from 'hono/types'
+
+import type { UnionToIntersection } from './handlers/internal/types.js'
+import * as RequestListener from './handlers/internal/requestListener.js'
+
+export { relay } from './handlers/relay.js'
+export * as Multisig from './handlers/internal/multisig.js'
+
+/**
+ * A request handler. Generic over the underlying Hono app shape so chained
+ * route definitions (`.post`, `.get`, …) can flow their type information
+ * through to consumers — most notably for Hono's typed RPC client
+ * (`hc<typeof handler>`).
+ */
+export type Handler<app extends Hono<any, any, any> = Hono> = app & {
+  listener: (req: any, res: any) => void
+}
+
+/**
+ * Merges the route schemas of every sub-handler into a single Hono schema,
+ * prefixing each route key with `path`. Used by `compose()` to preserve
+ * typed routes for Hono's RPC client (`hc`).
+ */
+export type ComposedSchema<subs extends readonly unknown[], path extends string> =
+  UnionToIntersection<
+    subs[number] extends infer sub
+      ? sub extends unknown
+        ? MergeSchemaPath<Extract<ExtractSchema<sub>, Schema>, path>
+        : never
+      : never
+  > extends infer schema extends Schema
+    ? schema
+    : never
+
+/**
+ * Mounts each sub-handler onto a fresh Hono app at `path` (default `/`) and
+ * returns a single composed handler. Routes are dispatched by Hono's trie
+ * — a deterministic match per path — instead of the older "try each handler
+ * in order until one returns non-404" loop.
+ *
+ * The returned handler preserves each sub-handler's route schema so the
+ * composed app stays usable from Hono's typed RPC client:
+ *
+ * ```ts
+ * import { hc } from 'hono/client'
+ *
+ * const app = Handler.compose(
+ *   [Handler.exchange(), Handler.codeAuth({ store })],
+ *   { path: '/api' },
+ * )
+ * type App = typeof app
+ *
+ * const client = hc<App>('https://wallet.example.com')
+ * await client.api.exchange.quote.$post({ json: { ... } }) // typed
+ * ```
+ */
+export function compose<const subs extends readonly Handler[], const path extends string = '/'>(
+  handlers: subs,
+  options: compose.Options & { path?: path } = {},
+): Handler<Hono<{}, ComposedSchema<subs, path>, '/'>> {
+  const mountPath = (options.path ?? '/') as path
+
+  const app = from(options) as unknown as Hono
+  for (const sub of handlers) app.route(mountPath, sub)
+  app.notFound(() => new Response('Not Found', { status: 404 }))
+
+  return app as never
+}
+
+export declare namespace compose {
+  export type Options = from.Options & {
+    /** The path to use for the handler. */
+    path?: string | undefined
+  }
+}
+
+/**
+ * Instantiates a new request handler.
+ *
+ * @param options - constructor options
+ * @returns Handler instance
+ */
+export function from(options: from.Options = {}): Handler {
+  const corsHeaders = corsToHeaders(options.cors)
+  const mergedHeaders = new Headers(corsHeaders)
+  for (const [key, value] of normalizeHeaders(options.headers).entries())
+    mergedHeaders.set(key, value)
+
+  const app = new Hono()
+
+  app.use(async (c, next) => {
+    if (c.req.method === 'OPTIONS') return new Response(null, { headers: mergedHeaders })
+    await next()
+    for (const [key, value] of mergedHeaders.entries()) c.res.headers.set(key, value)
+    return undefined
+  })
+
+  return Object.assign(app, {
+    listener: RequestListener.fromFetchHandler((request) => app.fetch(request)),
+  }) as never
+}
+
+export declare namespace from {
+  export type Options = {
+    /**
+     * CORS configuration.
+     * - `true` (default): Allow all origins with default methods/headers
+     * - `false`: Disable CORS headers
+     * - Object: Custom CORS configuration
+     */
+    cors?: boolean | Cors | undefined
+    /** Headers to add to the response. */
+    headers?: Headers | Record<string, string> | undefined
+  }
+
+  export type Cors = {
+    /** Allowed origins. Defaults to `'*'`. */
+    origin?: string | string[] | undefined
+    /** Allowed methods. Defaults to `'GET, POST, PUT, DELETE, OPTIONS'`. */
+    methods?: string | undefined
+    /** Allowed headers. Defaults to `'Content-Type'`. */
+    headers?: string | undefined
+    /** Whether to allow credentials. */
+    credentials?: boolean | undefined
+    /** Headers to expose to the browser. */
+    exposeHeaders?: string | undefined
+    /** Max age for preflight cache in seconds. */
+    maxAge?: number | undefined
+  }
+}
+
+function normalizeHeaders(headers?: Headers | Record<string, string>): Headers {
+  if (!headers) return new Headers()
+  if (headers instanceof Headers) return headers
+  return new Headers(headers)
+}
+
+function corsToHeaders(cors?: boolean | from.Cors): Headers {
+  if (cors === false) return new Headers()
+
+  const config = cors === true || cors === undefined ? {} : cors
+
+  const headers = new Headers()
+  const origin = Array.isArray(config.origin) ? config.origin.join(', ') : (config.origin ?? '*')
+  headers.set('Access-Control-Allow-Origin', origin)
+  headers.set('Access-Control-Allow-Methods', config.methods ?? 'GET, POST, PUT, DELETE, OPTIONS')
+  headers.set('Access-Control-Allow-Headers', config.headers ?? 'Content-Type')
+  if (config.credentials) headers.set('Access-Control-Allow-Credentials', 'true')
+  if (config.exposeHeaders) headers.set('Access-Control-Expose-Headers', config.exposeHeaders)
+  if (config.maxAge !== undefined) headers.set('Access-Control-Max-Age', String(config.maxAge))
+
+  return headers
+}

package/src/Scope.ts

@@ -1,6 +1,6 @@
 /**
  * The issuable API-key scope vocabulary: the single source of truth for the
- * `/scopes` catalog, for key minting (`ApiKeySource.Source.mint`), and for the scopes
+ * `/scopes` catalog, for key minting (`ApiKeys.mint`), and for the scopes
  * required by route policies (`Auth.policy`). Exposing it publicly lets operator
  * tooling (e.g. the provisioning CLI) validate scopes against the same list the
  * server enforces.
@@ -36,6 +36,10 @@ export const catalog = [
     description: 'Run ad-hoc queries against the raw indexer passthrough.',
     scope: 'indexer:query',
   },
+  {
+    description: 'Fill and submit transactions through the relay.',
+    scope: 'rpc-relay',
+  },
   {
     description: 'Read webhook subscriptions.',
     scope: 'webhooks:read',

package/src/Webhooks.test.ts

@@ -1,4 +1,5 @@
-import { Store, Webhooks } from 'cadent'
+import { Webhooks } from 'tapimo'
+import * as TestApp from '../test/App.js'
 
 describe('createPoller', () => {
   /** Decodes the opaque `(block, index)` keyset cursor the poller stores. */
@@ -8,9 +9,9 @@ describe('createPoller', () => {
     return JSON.parse(json) as [number, number]
   }
 
-  test('binds a state store and runs a tick at an injected head', async () => {
-    const store = Store.memory()
-    const subscription = await Webhooks.createSubscription(store, {
+  test('binds a database and runs a tick at an injected head', async () => {
+    const db = TestApp.database()
+    const subscription = await Webhooks.createSubscription(db, {
       chainId: 42431,
       destination: { type: 'url', url: 'https://hooks.example.com/x' },
       eventType: 'token:transfer',
@@ -18,12 +19,12 @@ describe('createPoller', () => {
     })
 
     const poller = Webhooks.createPoller({
+      db,
       defaultChainId: 42431,
-      webhook: { store },
     })
 
     // A brand-new subscription anchors at the confirmed head on its first tick
-    // (no backfill), so this exercises the createPoller → poll wiring (store
+    // (no backfill), so this exercises the createPoller → poll wiring (db
     // binding, default chain id, injected head, result shape) without touching
     // TIDX. Detailed poll/getIndexedHead behavior lives in
     // src/apps/webhooks.test.ts.
@@ -39,7 +40,7 @@ describe('createPoller', () => {
         "subscriptions": 1,
       }
     `)
-    expect(decodeCursor(await Webhooks.getCursor(store, subscription.id))).toMatchInlineSnapshot(`
+    expect(decodeCursor(await Webhooks.getCursor(db, subscription.id))).toMatchInlineSnapshot(`
       [
         198,
         2147483647,

package/src/Webhooks.ts

@@ -1,6 +1,7 @@
 import * as AppWebhooks from './apps/webhooks.js'
+import * as Db from './db/Db.js'
 import * as MetricSink from './internal/MetricSink.js'
-import type * as Store from './internal/Store.js'
+import * as Store from './internal/Store.js'
 import type * as Metrics from './Metrics.js'
 import * as Tidx from './internal/Tidx.js'
 import * as Viem from './internal/Viem.js'
@@ -35,7 +36,9 @@ export { eventTypes, schema } from './apps/webhooks.js'
  * request state.
  */
 export function createPoller(options: createPoller.Options): createPoller.Poller {
-  const { store } = options.webhook
+  // Persistent memoize cache for token metadata, shared across ticks (the
+  // webhook state store used to double-duty as this cache).
+  const cache = Store.memory()
   const getTidx = options.tidx
     ? Tidx.createGetClient({ defaultChainId: options.defaultChainId, tidx: options.tidx })
     : undefined
@@ -80,9 +83,13 @@ export function createPoller(options: createPoller.Options): createPoller.Poller
       try {
         const result = await AppWebhooks.poll({
           batchSize: input.batchSize ?? options.batchSize,
+          cache,
           chainId,
           client: getClient(chainId),
           confirmations: input.confirmations ?? options.confirmations,
+          // Resolve per tick so Workers factories build a fresh
+          // Hyperdrive-pooled connection each run.
+          db: Db.get(options.db),
           dispatch,
           eventTypes: input.eventTypes ?? options.eventTypes,
           ...(input.headBlockNumber === undefined
@@ -90,7 +97,6 @@ export function createPoller(options: createPoller.Options): createPoller.Poller
             : { headBlockNumber: input.headBlockNumber }),
           maxBlocks: input.maxBlocks ?? options.maxBlocks,
           now: input.now ?? options.now,
-          store,
           ...(getTidx ? { tidx: getTidx(chainId) } : {}),
         })
         metrics?.record({
@@ -144,6 +150,8 @@ export declare namespace createPoller {
 
   /** Options for {@link createPoller}. */
   type Options = Defaults & {
+    /** Database holding subscriptions + cursors, or a factory resolved per tick (Workers/Hyperdrive). */
+    db: Db.Source
     /** Tempo chain id polled when a tick omits one. */
     defaultChainId?: Viem.ChainId | undefined
     /** Metrics backend; emits `webhook:tick` per tick and `webhook:enqueue` per dispatch. */
@@ -152,8 +160,6 @@ export declare namespace createPoller {
     rpc?: Viem.getClient.Rpc | undefined
     /** TIDX query client options for the legacy `token:transfer` type. */
     tidx?: Tidx.getClient.Tidx | undefined
-    /** Webhook state store (subscriptions + cursors). */
-    webhook: { store: Store.State }
   }
 
   /** Per-tick overrides; falls back to the {@link Options} defaults. */

package/src/admin/Access.ts

@@ -29,10 +29,8 @@ const cookieName = 'CF_Authorization'
  * ```ts
  * import { App, Access } from 'tapimo/admin'
  *
- * const source = {} as App.create.Options['apiKey']['source']
- *
  * App.create({
- *   apiKey: { source },
+ *   // ...
  *   identify: Access.cloudflareAccess({
  *     teamDomain: 'https://tempo.cloudflareaccess.com',
  *   }),

package/src/admin/App.ts

@@ -3,10 +3,10 @@ import { HTTPException } from 'hono/http-exception'
 import { requestId, type RequestIdVariables } from 'hono/request-id'
 
 import * as ApiKey from '../ApiKey.js'
-import * as ApiKeySource from '../ApiKeySource.js'
 import type * as Assets from '../Assets.js'
-import * as Response from '../internal/Response.js'
+import type * as Db from '../db/Db.js'
 import type * as Store from '../internal/Store.js'
+import * as Response from '../internal/Response.js'
 
 import { apiKeys } from './apps/api-keys.js'
 import { scopes } from './apps/scopes.js'
@@ -24,12 +24,12 @@ export type Environment = {
   Variables: RequestIdVariables & {
     /** Static-asset writer (e.g. the R2 icon bucket), when configured. */
     assets: create.Assets | undefined
+    /** Authoritative Postgres store, or a per-request factory. Resolve at the leaf with `Db.get`. */
+    db: Db.Source
+    /** KV state store backing API-key records (mint/list/revoke). */
+    kv: { store: Store.State }
     /** The admin identity, or `null` when unauthenticated (gated routes reject). */
     identity: Identity | null
-    /** The API-key source provisioned against (mint/list/revoke). */
-    source: ApiKeySource.Source
-    /** Verified-token state store, when management is enabled. */
-    verifiedTokens: { store: Store.State } | undefined
   }
 }
 
@@ -39,7 +39,6 @@ export type App = ReturnType<typeof create>
 /** Creates the admin portal Hono app. */
 export function create(options: create.Options) {
   const { identify } = options
-  const { source } = options.apiKey
   // `false` (disabled) collapses to `undefined` so only a real config surfaces
   // `loginUrl`/`logoutUrl` in `/config.json`.
   const ui = options.ui || undefined
@@ -55,9 +54,9 @@ export function create(options: create.Options) {
   app.use('*', async (c, next) => {
     // Admin data is per-principal and mutating: never cache.
     c.header('Cache-Control', 'no-store')
-    c.set('source', source)
     c.set('assets', options.assets)
-    c.set('verifiedTokens', options.verifiedTokens)
+    c.set('db', options.db)
+    c.set('kv', options.kv)
     c.set('identity', await identify(c.req.raw))
     return next()
   })
@@ -173,16 +172,22 @@ export declare namespace create {
 
   /** Options for {@link create}. */
   type Options = {
-    /** API-key provisioning config (mirrors the API app's `apiKey` option). */
-    apiKey: {
-      /** Source to provision against (mint/list/revoke). */
-      source: ApiKeySource.Source
-    }
     /**
      * Static-asset writer for logo uploads (shared with the main API's `assets`
      * loader) to enable `PUT /verified-tokens/:address/logo`; omit for `404`.
      */
     assets?: Assets | undefined
+    /**
+     * Authoritative Postgres store shared with the main API (verified
+     * tokens). Pass a long-lived `Db.postgres(...)` singleton on Node, or a
+     * factory (`() => Db.postgres(...)`) on Workers.
+     */
+    db: Db.Source
+    /**
+     * KV state store backing API-key records (shared with the main API's
+     * `kv` option), provisioned against by the `/api-keys` routes.
+     */
+    kv: { store: Store.State }
     /**
      * Extracts the verified admin identity from a request, or `null` to deny.
      * Must only return an identity for an already-authenticated request (a
@@ -194,16 +199,6 @@ export declare namespace create {
      * `loginUrl`/`logoutUrl` are surfaced in `GET /config.json`.
      */
     ui?: Ui | false | undefined
-    /**
-     * Verified-token management config (store shared with the main API's reads)
-     * to enable the `/verified-tokens` routes; omit to serve them as `404`.
-     */
-    verifiedTokens?:
-      | {
-          /** Verified-token state store (shared with the main API's reads). */
-          store: Store.State
-        }
-      | undefined
   }
 
   /** Admin UI options surfaced to the SPA via `GET /config.json`. */