tapimo 0.1.0 → 0.2.0

package/src/Client.test-d.ts

@@ -1,19 +1,21 @@
 import { Client } from 'tapimo'
 import type * as z from 'zod/mini'
 
-import * as Activities from './apps/activities.js'
-import * as Balances from './apps/balances.js'
-import * as Blocks from './apps/blocks.js'
-import * as Exchanges from './apps/exchanges.js'
-import * as FeeAmm from './apps/fee-amm.js'
-import * as Indexer from './apps/indexer.js'
-import * as Receipts from './apps/receipts.js'
-import * as Rpc from './apps/rpc.js'
-import * as Tokens from './apps/tokens.js'
-import * as Transactions from './apps/transactions.js'
-import * as Transfers from './apps/transfers.js'
-import * as VerifiedTokens from './apps/verified-tokens.js'
-import * as Webhooks from './apps/webhooks.js'
+import * as Activities from './apps/data/routes/activities.js'
+import * as Balances from './apps/data/routes/balances.js'
+import * as Blocks from './apps/data/routes/blocks.js'
+import * as Exchanges from './apps/data/routes/exchanges.js'
+import * as FeeAmm from './apps/data/routes/fee-amm.js'
+import * as Indexer from './apps/data/routes/indexer.js'
+import * as Me from './apps/platform/routes/me.js'
+import * as Orgs from './apps/platform/routes/orgs.js'
+import * as Receipts from './apps/data/routes/receipts.js'
+import * as Rpc from './apps/data/routes/rpc.js'
+import * as Tokens from './apps/data/routes/tokens.js'
+import * as Transactions from './apps/data/routes/transactions.js'
+import * as Transfers from './apps/data/routes/transfers.js'
+import * as VerifiedTokens from './apps/data/routes/verified-tokens.js'
+import * as Webhooks from './apps/data/routes/webhooks.js'
 
 type Access400<code extends string> = code | 'api_key_malformed'
 type PaidAccessStatus = PublicAccessStatus | 402
@@ -97,6 +99,295 @@ describe('narrows responses by status', () => {
     }
   })
 
+  test('GET /v1/me', async () => {
+    const client = Client.create()
+    const res = await client.v1.me.$get()
+
+    expectTypeOf(res.status).toEqualTypeOf<200 | 400 | 401 | 403 | 404 | 502>()
+
+    switch (res.status) {
+      case 200: {
+        const json = await res.json()
+        expectTypeOf(json.id).toEqualTypeOf<z.output<typeof Me.schema.User>['id']>()
+        void json
+        return
+      }
+      case 403: {
+        const json = await res.json()
+        expectTypeOf(json.error.code).toEqualTypeOf<'forbidden'>()
+        void json
+        return
+      }
+      case 404: {
+        const json = await res.json()
+        expectTypeOf(json.error.code).toEqualTypeOf<'user_not_found'>()
+        void json
+        return
+      }
+    }
+  })
+
+  test('POST /v1/orgs', async () => {
+    const client = Client.create()
+    const res = await client.v1.orgs.$post({ json: { name: 'Acme' } })
+
+    expectTypeOf(res.status).toEqualTypeOf<200 | 400 | 401 | 403 | 502>()
+
+    switch (res.status) {
+      case 200: {
+        const json = await res.json()
+        expectTypeOf(json.id).toEqualTypeOf<z.output<typeof Orgs.schema.Organization>['id']>()
+        void json
+        return
+      }
+      case 403: {
+        const json = await res.json()
+        expectTypeOf(json.error.code).toEqualTypeOf<'forbidden'>()
+        void json
+        return
+      }
+    }
+  })
+
+  test('GET /v1/orgs/:orgId', async () => {
+    const client = Client.create()
+    const res = await client.v1.orgs[':orgId{org_[A-Za-z0-9_-]+}'].$get({
+      param: { orgId: 'org_test' },
+    })
+
+    expectTypeOf(res.status).toEqualTypeOf<200 | 400 | 401 | 403 | 404>()
+
+    switch (res.status) {
+      case 200: {
+        const json = await res.json()
+        expectTypeOf(json.name).toEqualTypeOf<string>()
+        void json
+        return
+      }
+      case 404: {
+        const json = await res.json()
+        expectTypeOf(json.error.code).toEqualTypeOf<'organization_not_found'>()
+        void json
+        return
+      }
+    }
+  })
+
+  test('DELETE /v1/orgs/:orgId', async () => {
+    const client = Client.create()
+    const res = await client.v1.orgs[':orgId{org_[A-Za-z0-9_-]+}'].$delete({
+      param: { orgId: 'org_test' },
+    })
+
+    expectTypeOf(res.status).toEqualTypeOf<200 | 400 | 401 | 403 | 404 | 502>()
+
+    switch (res.status) {
+      case 200: {
+        const json = await res.json()
+        expectTypeOf(json.id).toEqualTypeOf<string>()
+        void json
+        return
+      }
+      case 404: {
+        const json = await res.json()
+        expectTypeOf(json.error.code).toEqualTypeOf<'organization_not_found'>()
+        void json
+        return
+      }
+    }
+  })
+
+  test('GET /v1/orgs/:orgId/projects/:projectId', async () => {
+    const client = Client.create()
+    const res = await client.v1.orgs[':orgId{org_[A-Za-z0-9_-]+}'].projects[
+      ':projectId{prj_[A-Za-z0-9_-]+}'
+    ].$get({ param: { orgId: 'org_test', projectId: 'prj_test' } })
+
+    expectTypeOf(res.status).toEqualTypeOf<200 | 400 | 401 | 403 | 404>()
+
+    switch (res.status) {
+      case 200: {
+        const json = await res.json()
+        expectTypeOf(json.environments[0]).toEqualTypeOf<'production' | 'sandbox' | undefined>()
+        void json
+        return
+      }
+      case 404: {
+        const json = await res.json()
+        expectTypeOf(json.error.code).toEqualTypeOf<
+          'organization_not_found' | 'project_not_found'
+        >()
+        void json
+        return
+      }
+    }
+  })
+
+  test('DELETE /v1/orgs/:orgId/projects/:projectId', async () => {
+    const client = Client.create()
+    const res = await client.v1.orgs[':orgId{org_[A-Za-z0-9_-]+}'].projects[
+      ':projectId{prj_[A-Za-z0-9_-]+}'
+    ].$delete({ param: { orgId: 'org_test', projectId: 'prj_test' } })
+
+    expectTypeOf(res.status).toEqualTypeOf<200 | 400 | 401 | 403 | 404 | 502>()
+
+    switch (res.status) {
+      case 200: {
+        const json = await res.json()
+        expectTypeOf(json.id).toEqualTypeOf<string>()
+        void json
+        return
+      }
+      case 404: {
+        const json = await res.json()
+        expectTypeOf(json.error.code).toEqualTypeOf<
+          'organization_not_found' | 'project_not_found'
+        >()
+        void json
+        return
+      }
+    }
+  })
+
+  test('POST /v1/orgs/:orgId/projects/:projectId/api-keys', async () => {
+    const client = Client.create()
+    const res = await client.v1.orgs[':orgId{org_[A-Za-z0-9_-]+}'].projects[
+      ':projectId{prj_[A-Za-z0-9_-]+}'
+    ]['api-keys'].$post({
+      json: { scopes: ['data:read'] },
+      param: { orgId: 'org_test', projectId: 'prj_test' },
+    })
+
+    expectTypeOf(res.status).toEqualTypeOf<200 | 400 | 401 | 403 | 404 | 502>()
+
+    switch (res.status) {
+      case 200: {
+        const json = await res.json()
+        expectTypeOf(json.token).toEqualTypeOf<string>()
+        expectTypeOf(json.id).toEqualTypeOf<string>()
+        void json
+        return
+      }
+    }
+  })
+
+  test('DELETE /v1/orgs/:orgId/projects/:projectId/api-keys/:keyId', async () => {
+    const client = Client.create()
+    const res = await client.v1.orgs[':orgId{org_[A-Za-z0-9_-]+}'].projects[
+      ':projectId{prj_[A-Za-z0-9_-]+}'
+    ]['api-keys'][':keyId{key_[A-Za-z0-9_-]+}'].$delete({
+      param: { keyId: 'key_test', orgId: 'org_test', projectId: 'prj_test' },
+    })
+
+    expectTypeOf(res.status).toEqualTypeOf<200 | 400 | 401 | 403 | 404 | 502>()
+
+    switch (res.status) {
+      case 404: {
+        const json = await res.json()
+        expectTypeOf(json.error.code).toEqualTypeOf<
+          | 'api_key_not_found'
+          | 'api_keys_not_enabled'
+          | 'organization_not_found'
+          | 'project_not_found'
+        >()
+        void json
+        return
+      }
+    }
+  })
+
+  test('GET /v1/orgs/:orgId/members', async () => {
+    const client = Client.create()
+    const res = await client.v1.orgs[':orgId{org_[A-Za-z0-9_-]+}'].members.$get({
+      param: { orgId: 'org_test' },
+    })
+
+    expectTypeOf(res.status).toEqualTypeOf<200 | 400 | 401 | 403 | 404 | 502>()
+
+    switch (res.status) {
+      case 200: {
+        const json = await res.json()
+        expectTypeOf(json.data[0]!.role).toEqualTypeOf<'admin' | 'member' | 'owner'>()
+        void json
+        return
+      }
+    }
+  })
+
+  test('PATCH /v1/orgs/:orgId/members/:userId', async () => {
+    const client = Client.create()
+    const res = await client.v1.orgs[':orgId{org_[A-Za-z0-9_-]+}'].members[
+      ':userId{usr_[A-Za-z0-9_-]+}'
+    ].$patch({ json: { role: 'admin' }, param: { orgId: 'org_test', userId: 'usr_test' } })
+
+    expectTypeOf(res.status).toEqualTypeOf<200 | 400 | 401 | 403 | 404 | 409 | 502>()
+
+    switch (res.status) {
+      case 409: {
+        const json = await res.json()
+        expectTypeOf(json.error.code).toEqualTypeOf<'last_owner'>()
+        void json
+        return
+      }
+    }
+  })
+
+  test('POST /v1/invitations/:invitationId/accept', async () => {
+    const client = Client.create()
+    const res = await client.v1.invitations[':invitationId{inv_[A-Za-z0-9_-]+}'].accept.$post({
+      param: { invitationId: 'inv_test' },
+    })
+
+    expectTypeOf(res.status).toEqualTypeOf<200 | 400 | 401 | 403 | 404 | 502>()
+
+    switch (res.status) {
+      case 200: {
+        const json = await res.json()
+        expectTypeOf(json.role).toEqualTypeOf<'admin' | 'member' | 'owner'>()
+        void json
+        return
+      }
+      case 404: {
+        const json = await res.json()
+        expectTypeOf(json.error.code).toEqualTypeOf<'invitation_not_found'>()
+        void json
+        return
+      }
+    }
+  })
+
+  test('GET /v1/orgs', async () => {
+    const client = Client.create()
+    const res = await client.v1.orgs.$get()
+
+    expectTypeOf(res.status).toEqualTypeOf<200 | 400 | 401 | 403 | 502>()
+
+    switch (res.status) {
+      case 200: {
+        const json = await res.json()
+        expectTypeOf(json.data[0]!.id).toEqualTypeOf<
+          z.output<typeof Orgs.schema.listOrganizations.Response>['data'][number]['id']
+        >()
+        void json
+        return
+      }
+      case 403: {
+        const json = await res.json()
+        expectTypeOf(json.error.code).toEqualTypeOf<'forbidden'>()
+        expectTypeOf(json.error.message).toEqualTypeOf<string>()
+        void json
+        return
+      }
+      case 502: {
+        const json = await res.json()
+        expectTypeOf(json.error.code).toEqualTypeOf<'upstream_error'>()
+        expectTypeOf(json.error.message).toEqualTypeOf<string>()
+        void json
+        return
+      }
+    }
+  })
+
   test('GET /v1/blocks/:block', async () => {
     const client = Client.create()
     const res = await client.v1.blocks[':block'].$get({ param: { block: '1' } })
@@ -1176,7 +1467,7 @@ describe('narrows responses by status', () => {
 
   test('POST /rpc/:chain', async () => {
     const client = Client.create()
-    const res = await client.rpc[':chain{mainnet|testnet|[0-9]+}?'].$post({
+    const res = await client.rpc[':chain{(mainnet|testnet|[0-9]+)}?'].$post({
       param: { chain: undefined },
     })
 
@@ -1208,7 +1499,7 @@ describe('narrows responses by status', () => {
 
   test('POST /rpc/:chain testnet shortcut', async () => {
     const client = Client.create()
-    const res = await client.rpc[':chain{mainnet|testnet|[0-9]+}?'].$post({
+    const res = await client.rpc[':chain{(mainnet|testnet|[0-9]+)}?'].$post({
       param: { chain: 'testnet' },
     })
 

package/src/Scope.ts

@@ -1,9 +1,8 @@
 /**
  * The issuable API-key scope vocabulary: the single source of truth for the
  * `/scopes` catalog, for key minting (`ApiKeys.mint`), and for the scopes
- * required by route policies (`Auth.policy`). Exposing it publicly lets operator
- * tooling (e.g. the provisioning CLI) validate scopes against the same list the
- * server enforces.
+ * required by route policies (`Auth.policy`). Exposing it publicly lets super
+ * admin tooling validate scopes against the same list the server enforces.
  */
 
 /**
@@ -38,7 +37,11 @@ export const catalog = [
   },
   {
     description: 'Fill and submit transactions through the relay.',
-    scope: 'rpc-relay',
+    scope: 'rpc-relay:read',
+  },
+  {
+    description: 'Sponsor transaction fees through the relay as the managed fee payer.',
+    scope: 'rpc-relay:sponsor',
   },
   {
     description: 'Read webhook subscriptions.',
@@ -52,3 +55,9 @@ export const catalog = [
 
 /** Issuable API-key scope identifier — the union of every {@link catalog} entry. */
 export type Id = (typeof catalog)[number]['scope']
+
+/**
+ * Scopes a session may self-mint through the developer platform. Empty: every
+ * scope requires super admin issuance.
+ */
+export const selfServe: readonly Id[] = []

package/src/Webhooks.ts

@@ -1,4 +1,4 @@
-import * as AppWebhooks from './apps/webhooks.js'
+import * as AppWebhooks from './apps/data/routes/webhooks.js'
 import * as Db from './db/Db.js'
 import * as MetricSink from './internal/MetricSink.js'
 import * as Store from './internal/Store.js'
@@ -16,7 +16,7 @@ export * from './internal/Webhooks.js'
 // type delivery bodies: `Webhooks.schema.Envelope` (a discriminated union on
 // `type`), plus the per-event `TransferEvent` / `TransactionEvent` / `PingEvent`
 // payloads. Infer a type with `z.infer<typeof Webhooks.schema.Envelope>`.
-export { eventTypes, schema } from './apps/webhooks.js'
+export { eventTypes, schema } from './apps/data/routes/webhooks.js'
 
 /**
  * Builds a scheduled webhook poller bound to a state store and chain config.

package/src/admin/apps/api-keys.test.ts

@@ -155,3 +155,54 @@ describe('DELETE /api-keys/:id', () => {
     expect(body.error?.code).toMatchInlineSnapshot(`"not_found"`)
   })
 })
+
+describe('PATCH /api-keys/:id', () => {
+  test('re-attributes a key to an org and project', async () => {
+    const { client, store } = TestAdmin.setup()
+    const { record, token } = await core_ApiKeys.mint(store, validBody)
+
+    const response = await client['api-keys'][':id'].$patch({
+      json: { orgId: 'org_real', projectId: 'prj_real' },
+      param: { id: record.id },
+    })
+    expect(response.status).toBe(200)
+    const body = await TestApp.json(response, core_ApiKeys.schema.Record)
+    expect(body.orgId).toBe('org_real')
+    expect(body.projectId).toBe('prj_real')
+
+    // The original token keeps resolving, now carrying the attribution.
+    const resolved = await core_ApiKeys.resolve(store, token)
+    expect(resolved?.projectId).toBe('prj_real')
+  })
+
+  test('unknown id → 404', async () => {
+    const { client } = TestAdmin.setup()
+    const response = await client['api-keys'][':id'].$patch({
+      json: { projectId: 'prj_x' },
+      param: { id: 'key_missing' },
+    })
+    expect(response.status).toMatchInlineSnapshot(`404`)
+  })
+})
+
+describe('POST /api-keys/backfill', () => {
+  test('rebuilds index entries for legacy records', async () => {
+    const { client, store } = TestAdmin.setup()
+    const { record } = await core_ApiKeys.mint(store, validBody)
+
+    // Legacy state: records exist, index entries do not.
+    for (const prefix of ['apikey_id:', 'apikey_org:'])
+      for (const { name } of (await store.list({ prefix })).keys) await store.delete(name)
+    expect(await core_ApiKeys.listByOrg(store, 'org_test')).toEqual([])
+
+    const response = await client['api-keys'].backfill.$post()
+    expect(response.status).toBe(200)
+    expect(await TestApp.json(response, ApiKeys.schema.backfillApiKeys.Response)).toEqual({
+      indexed: 1,
+      scanned: 1,
+    })
+    expect((await core_ApiKeys.listByOrg(store, 'org_test')).map(({ id }) => id)).toEqual([
+      record.id,
+    ])
+  })
+})

package/src/admin/apps/api-keys.ts

@@ -53,6 +53,37 @@ export namespace schema {
     )
   }
 
+  /** Schemas for the attributeApiKey operation. */
+  export namespace attributeApiKey {
+    /** Request body re-attributing a key; omitted fields keep their value. */
+    export const Body = Schema.describe(
+      z.object({
+        orgId: z.optional(z.string()).check(z.describe('New owning organization id (`org_…`).')),
+        projectId: z.optional(z.string()).check(z.describe('New owning project id (`prj_…`).')),
+      }),
+      'Attribution to apply to an API key.',
+    )
+
+    /** Path parameters for attributing a key. */
+    export const Params = z
+      .object({
+        id: z.string().check(z.describe('Stable id of the key to attribute.')),
+      })
+      .check(z.describe('Path parameters for attributing an API key.'))
+  }
+
+  /** Schemas for the backfillApiKeys operation. */
+  export namespace backfillApiKeys {
+    /** Result counts from the index rebuild. */
+    export const Response = Schema.describe(
+      z.object({
+        indexed: z.number().check(z.describe('Records whose index entries were written.')),
+        scanned: z.number().check(z.describe('Stored records scanned.')),
+      }),
+      'Result of rebuilding the API-key indexes.',
+    )
+  }
+
   /** Schemas for the revokeApiKey operation. */
   export namespace revokeApiKey {
     /** Path parameters for revoking a key. */
@@ -76,9 +107,30 @@ export namespace schema {
  *   returning the one-time token.
  * - `GET /` lists key records (metadata only), optionally filtered by `orgId`.
  * - `DELETE /:id` revokes a key by id (`404` if absent).
+ * - `PATCH /:id` re-attributes a key to an org/project (the legacy backfill path).
+ * - `POST /backfill` rebuilds the id and org index entries for every record.
  */
 export function apiKeys() {
   return new Hono<App.Environment>()
+    .post(
+      '/backfill',
+      OpenApi.describeRoute({
+        description: 'Rebuild the id and org index entries for every stored key record. Records are never modified, so existing tokens keep resolving.', // prettier-ignore
+        operationId: 'backfillApiKeys',
+        responses: OpenApi.responses({
+          success: {
+            description: 'Scanned and indexed record counts.',
+            schema: schema.backfillApiKeys.Response,
+          },
+        }),
+        summary: 'Backfill key indexes',
+        tags: ['API keys'],
+      }),
+      async (c) => {
+        const result = await ApiKeys.backfill(c.get('kv').store)
+        return c.json(Response.validated(schema.backfillApiKeys.Response, result))
+      },
+    )
     .post(
       '/',
       OpenApi.validate('json', schema.createApiKey.Body, {
@@ -153,4 +205,36 @@ export function apiKeys() {
         return c.json(Response.validated(schema.revokeApiKey.Response, { id }))
       },
     )
+    .patch(
+      '/:id',
+      OpenApi.validate('param', schema.attributeApiKey.Params, {
+        code: 'param_invalid',
+        message: 'Invalid path parameters',
+      }),
+      OpenApi.validate('json', schema.attributeApiKey.Body, {
+        code: 'body_invalid',
+        message: 'Invalid request body',
+      }),
+      OpenApi.describeRoute({
+        description: 'Re-attribute a key to an organization and/or project. The token is unchanged.', // prettier-ignore
+        operationId: 'attributeApiKey',
+        responses: OpenApi.responses({
+          errors: { 404: 'API key not found.' },
+          success: { description: 'The updated key record.', schema: ApiKeys.schema.Record },
+        }),
+        summary: 'Attribute API key',
+        tags: ['API keys'],
+      }),
+      async (c) => {
+        const { id } = c.req.valid('param')
+        const updated = await ApiKeys.attribute(c.get('kv').store, id, c.req.valid('json'))
+        if (!updated)
+          return Response.error(c, {
+            code: 'not_found',
+            message: 'API key not found.',
+            status: 404,
+          })
+        return c.json(Response.validated(ApiKeys.schema.Record, updated))
+      },
+    )
 }

package/src/admin/apps/scopes.test.ts

@@ -24,7 +24,11 @@ describe('GET /scopes', () => {
           },
           {
             "description": "Fill and submit transactions through the relay.",
-            "scope": "rpc-relay",
+            "scope": "rpc-relay:read",
+          },
+          {
+            "description": "Sponsor transaction fees through the relay as the managed fee payer.",
+            "scope": "rpc-relay:sponsor",
           },
           {
             "description": "Read webhook subscriptions.",

package/src/admin/apps/verified-tokens.ts

@@ -6,7 +6,7 @@ import * as Response from '../../internal/Response.js'
 import * as Schema from '../../internal/Schema.js'
 import * as Db from '../../db/Db.js'
 import * as VerifiedTokens from '../../internal/VerifiedTokens.js'
-import { schema as readSchema } from '../../apps/verified-tokens.js'
+import { schema as readSchema } from '../../apps/data/routes/verified-tokens.js'
 import type * as App from '../App.js'
 
 /** Required `chainId` query: admin mutations always address a chain explicitly. */

package/src/admin/ui.generated.ts

@@ -11,7 +11,7 @@ export type Asset = {
 
 /** The prerendered SPA shell HTML (assets normalized to relative URLs). */
 export const shell =
-  '<!DOCTYPE html><html lang="en" data-theme="dark" data-regen-radius="none"><head><meta charSet="utf-8"/><meta content="width=device-width, initial-scale=1" name="viewport"/><link rel="stylesheet" href="./assets/styles-Cd7Fp5b_.css" data-precedence="default"/><title>Tempo API Admin</title><link rel="modulepreload" href="./assets/index-CPTihwDe.js"/><link rel="icon" type="image/svg+xml" href="data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%20269%20269%22%3E%3Crect%20width%3D%22269%22%20height%3D%22269%22%20fill%3D%22%23000%22%2F%3E%3Cpath%20d%3D%22M123.273%20190.794H93.445L121.09%20105.318H85.7334L93.445%2080.2642H191.95L184.238%20105.318H150.773L123.273%20190.794Z%22%20fill%3D%22%23fff%22%2F%3E%3C%2Fsvg%3E"/></head><body><div id="root"></div><script class="$tsr" id="$tsr-stream-barrier">(self.$R=self.$R||{})["tsr"]=[];self.$_TSR={h(){this.hydrated=!0,this.c()},e(){this.streamEnded=!0,this.c()},c(){this.hydrated&&this.streamEnded&&(delete self.$_TSR,delete self.$R.tsr)},p(e){this.initialized?e():this.buffer.push(e)},buffer:[]};$_TSR.router=($R=>$R[0]={manifest:$R[1]={routes:$R[2]={__root__:$R[3]={preloads:$R[4]=["./assets/index-CPTihwDe.js"],scripts:$R[5]=[$R[6]={attrs:$R[7]={type:"module",async:!0,src:"./assets/index-CPTihwDe.js"}}]}}},matches:$R[8]=[$R[9]={i:"__root__\u0000",u:1783028662119,s:"success",ssr:!0}],lastMatchId:"__root__\u0000"})($R["tsr"]);$_TSR.e();document.currentScript.remove()</script><script type="module" async="" src="./assets/index-CPTihwDe.js"></script></body></html>'
+  '<!DOCTYPE html><html lang="en" data-theme="dark" data-regen-radius="none"><head><meta charSet="utf-8"/><meta content="width=device-width, initial-scale=1" name="viewport"/><link rel="stylesheet" href="./assets/styles-Cd7Fp5b_.css" data-precedence="default"/><title>Tempo API Admin</title><link rel="modulepreload" href="./assets/index-CPTihwDe.js"/><link rel="icon" type="image/svg+xml" href="data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%20269%20269%22%3E%3Crect%20width%3D%22269%22%20height%3D%22269%22%20fill%3D%22%23000%22%2F%3E%3Cpath%20d%3D%22M123.273%20190.794H93.445L121.09%20105.318H85.7334L93.445%2080.2642H191.95L184.238%20105.318H150.773L123.273%20190.794Z%22%20fill%3D%22%23fff%22%2F%3E%3C%2Fsvg%3E"/></head><body><div id="root"></div><script class="$tsr" id="$tsr-stream-barrier">(self.$R=self.$R||{})["tsr"]=[];self.$_TSR={h(){this.hydrated=!0,this.c()},e(){this.streamEnded=!0,this.c()},c(){this.hydrated&&this.streamEnded&&(delete self.$_TSR,delete self.$R.tsr)},p(e){this.initialized?e():this.buffer.push(e)},buffer:[]};$_TSR.router=($R=>$R[0]={manifest:$R[1]={routes:$R[2]={__root__:$R[3]={preloads:$R[4]=["./assets/index-CPTihwDe.js"],scripts:$R[5]=[$R[6]={attrs:$R[7]={type:"module",async:!0,src:"./assets/index-CPTihwDe.js"}}]}}},matches:$R[8]=[$R[9]={i:"__root__\u0000",u:1783292569178,s:"success",ssr:!0}],lastMatchId:"__root__\u0000"})($R["tsr"]);$_TSR.e();document.currentScript.remove()</script><script type="module" async="" src="./assets/index-CPTihwDe.js"></script></body></html>'
 
 /** Content-hashed UI assets, keyed by their path under the mount (e.g. `assets/index-*.js`). */
 export const assets: Record<string, Asset> = {

package/src/apps/composition.test.ts

@@ -0,0 +1,66 @@
+import { App, Store } from 'tapimo'
+import { data, platform, relay } from 'tapimo/apps'
+import * as TestApp from '../../test/App.js'
+
+// Each test mounts one group and asserts its routes exist while the omitted
+// group's are absent (404 and not in the document). Only `paths` are checked;
+// tags/schemes stay a superset (Decision C).
+
+/** Paths (sans method) present in a composed app's OpenAPI document. */
+async function paths(app: { request: (path: string) => Promise<Response> | Response }) {
+  const res = await app.request('/openapi.json')
+  const spec = (await res.json()) as { paths: Record<string, unknown> }
+  return Object.keys(spec.paths)
+}
+
+describe('data()', () => {
+  test('mounts data routes and omits platform routes', async () => {
+    const app = App.create({ db: TestApp.database() }).route('/', data())
+
+    const keys = await paths(app)
+    expect(keys.some((path) => path.startsWith('/v1/tokens'))).toBe(true)
+    expect(keys.some((path) => path.startsWith('/v1/blocks'))).toBe(true)
+    expect(keys.some((path) => path.startsWith('/v1/orgs'))).toBe(false)
+    expect(keys.some((path) => path.startsWith('/v1/me'))).toBe(false)
+
+    // The omitted platform route resolves to a 404 (never mounted), not a 401.
+    const orgs = await app.request('/v1/orgs')
+    expect(orgs.status).toBe(404)
+  })
+})
+
+describe('relay()', () => {
+  test('mounts the relay after data() and stays out of the document', async () => {
+    const composed = App.create({ db: TestApp.database() }).route('/', data()).route('/', relay())
+
+    // Mounted but default-closed and hidden: unauthenticated requests are
+    // refused, and the path never appears in the OpenAPI document.
+    const mounted = await composed.request('/rpc/relay')
+    expect(mounted.status).toBe(401)
+    expect((await paths(composed)).some((path) => path.startsWith('/rpc/relay'))).toBe(false)
+
+    // Without the relay group, the data group no longer serves the path.
+    const dataOnly = App.create({ db: TestApp.database() }).route('/', data())
+    expect((await dataOnly.request('/rpc/relay')).status).toBe(404)
+  })
+})
+
+describe('platform()', () => {
+  test('mounts platform routes and omits data routes', async () => {
+    const app = App.create({
+      auth: { session: { wallet: { origin: 'https://test.example' } } },
+      db: TestApp.database(),
+      kv: { store: Store.memory() },
+    }).route('/', platform())
+
+    const keys = await paths(app)
+    expect(keys.some((path) => path.startsWith('/v1/orgs'))).toBe(true)
+    expect(keys.some((path) => path.startsWith('/v1/me'))).toBe(true)
+    expect(keys.some((path) => path.startsWith('/v1/tokens'))).toBe(false)
+    expect(keys.some((path) => path.startsWith('/v1/blocks'))).toBe(false)
+
+    // The omitted data route resolves to a 404 (never mounted).
+    const token = await app.request('/v1/tokens/0x20c0000000000000000000000000000000000000')
+    expect(token.status).toBe(404)
+  })
+})