tapimo 0.10.2 → 0.12.0

package/src/apps/data/routes/earn.ts

@@ -11,6 +11,7 @@ import {
 import * as z from 'zod/mini'
 
 import type * as App from '../../../App.js'
+import * as Scope from '../../../Scope.js'
 import * as Db from '../../../db/Db.js'
 import * as core_EarnVaults from '../../../db/tables/earnVaults.js'
 import * as Auth from '../../../internal/Auth.js'
@@ -90,6 +91,22 @@ export declare namespace discoveryBatchLimit {
   }
 }
 
+/** Returns whether API-key scopes grant read access to one private Zone. */
+export function hasZoneAccess(options: hasZoneAccess.Options): boolean {
+  const scopes = options.scopes ?? []
+  return scopes.includes(Scope.wildcard) || scopes.includes(`zone:${options.chainId}:read`)
+}
+
+export declare namespace hasZoneAccess {
+  /** Inputs selecting one Zone against an optional API-key scope set. */
+  type Options = {
+    /** Private Zone chain id. */
+    chainId: number
+    /** API-key scopes, absent for every other principal. */
+    scopes?: readonly string[] | undefined
+  }
+}
+
 /** Zod schemas owned by the public Earn-vault resource. */
 export namespace schema {
   const capability = z
@@ -131,7 +148,7 @@ export namespace schema {
   )
 
   const include = z
-    .enum(['access', 'apy', 'capabilities', 'token.logoUri', 'tvl', 'zone'])
+    .enum(['access', 'apy', 'capabilities', 'token.logoUri', 'tvl', 'zone', 'zones'])
     .check(z.describe('Optional vault fields to embed via `include`.'))
 
   const includeQuery = Schema.includeQuery(
@@ -142,7 +159,7 @@ export namespace schema {
   // `apy` and `tvl` need indexer and FX access, so surfaces lacking either
   // select from this reduced set instead.
   const baseInclude = z
-    .enum(['access', 'capabilities', 'token.logoUri', 'zone'])
+    .enum(['access', 'capabilities', 'token.logoUri', 'zone', 'zones'])
     .check(z.describe('Optional vault fields to embed via `include`.'))
 
   const baseIncludeQuery = Schema.includeQuery(
@@ -174,6 +191,42 @@ export namespace schema {
     })
     .check(z.describe('Private Zone route configured for a verified vault.'))
 
+  const zoneRoute = z
+    .strictObject({
+      chainId: Schema.ChainId.check(
+        z.describe('Private Zone chain id.'),
+        z.meta({ examples: [1424310001] }),
+      ),
+      deploymentBlock: z
+        .number()
+        .check(
+          z.int(),
+          z.nonnegative(),
+          z.describe('Parent-chain block that deployed the Earn router.'),
+          z.meta({ examples: [31039238] }),
+        ),
+      earnRouter: Schema.Address.check(
+        z.describe('Parent-chain router for this Zone and Earn vault.'),
+        z.meta({ examples: ['0x9144086a79dea966d8bf1b52125ebed8919fc45c'] }),
+      ),
+      inputTokens: z
+        .array(Schema.Address)
+        .check(
+          z.describe('Tokens accepted by private deposits.'),
+          z.meta({ examples: [['0x20c000000000000000000000ff04042ee92fd449']] }),
+        ),
+      name: z
+        .string()
+        .check(z.describe('Private Zone name.'), z.meta({ examples: ['zone-moderato-internal'] })),
+      outputTokens: z
+        .array(Schema.Address)
+        .check(
+          z.describe('Tokens returned by private redemptions.'),
+          z.meta({ examples: [['0x20c000000000000000000000ff04042ee92fd449']] }),
+        ),
+    })
+    .check(z.describe('Verified Earn route through one private Zone.'))
+
   const value = z.strictObject({
     amount: Schema.DecimalString.check(
       z.describe('Value in base units at `decimals` precision.'),
@@ -268,6 +321,23 @@ export namespace schema {
     zone: z
       .optional(z.nullable(zone))
       .check(z.describe('Curated private Zone route, when requested, or null when absent.')),
+    zones: z.optional(z.array(zoneRoute)).check(
+      z.describe('Curated private Zone routes, when requested.'),
+      z.meta({
+        examples: [
+          [
+            {
+              chainId: 1424310001,
+              deploymentBlock: 31039238,
+              earnRouter: '0x9144086a79dea966d8bf1b52125ebed8919fc45c',
+              inputTokens: ['0x20c000000000000000000000ff04042ee92fd449'],
+              name: 'zone-moderato-internal',
+              outputTokens: ['0x20c000000000000000000000ff04042ee92fd449'],
+            },
+          ],
+        ],
+      }),
+    ),
   })
 
   /** One compatible Earn vault resolved from current chain state. */
@@ -736,8 +806,8 @@ export function earn(options: earn.Options = {}) {
       // as current-state rather than slow-changing metadata.
       Cache.response<App.Environment>({
         cacheControl: Cache.policies.state,
-        key: (c) => Cache.urlKey(c, schema.getEarnVaults.Query),
-        name: 'tempo-api:earn-vaults:v2',
+        key: (c) => vaultCacheKey(c, schema.getEarnVaults.Query),
+        name: 'tempo-api:earn-vaults:v3',
       }),
       async (c) => {
         if (Auth.narrowAccess) return Auth.paidAccessError(c)
@@ -780,8 +850,8 @@ export function earn(options: earn.Options = {}) {
       }),
       Cache.response<App.Environment>({
         cacheControl: Cache.policies.state,
-        key: (c) => Cache.urlKey(c, schema.getVerifiedEarnVaults.Query),
-        name: 'tempo-api:earn-vaults:v2',
+        key: (c) => vaultCacheKey(c, schema.getVerifiedEarnVaults.Query),
+        name: 'tempo-api:earn-vaults:v3',
       }),
       async (c) => {
         if (Auth.narrowAccess) return Auth.paidAccessError(c)
@@ -1114,8 +1184,8 @@ export function earn(options: earn.Options = {}) {
       }),
       Cache.response<App.Environment>({
         cacheControl: Cache.policies.state,
-        key: (c) => Cache.urlKey(c, schema.getEarnVault.Query),
-        name: 'tempo-api:earn-vaults:v2',
+        key: (c) => vaultCacheKey(c, schema.getEarnVault.Query),
+        name: 'tempo-api:earn-vaults:v3',
       }),
       async (c) => {
         if (Auth.narrowAccess) return Auth.paidAccessError(c)
@@ -2080,12 +2150,18 @@ export async function listVaults(c: Context<App.Environment>, options: listVault
         page.items.map(async (item) => {
           const record = registry.get(item.vaultAddress.toLowerCase())
           try {
-            const discovery = await resolveVaultDiscovery(c, {
+            const discovered = await resolveVaultDiscovery(c, {
               chainId: options.chainId,
               include: discoveryInclude(options),
               vaultAddress: item.vaultAddress,
             })
-            return { discovery, position: item.position, record }
+            const { discovery, zoneRoutes } = await resolveVaultRoutes(c, {
+              capability: options.capability,
+              discovery: discovered,
+              include,
+              record,
+            })
+            return { discovery, position: item.position, record, zoneRoutes }
           } catch (cause) {
             if (!record && isIncompatible(cause)) return undefined
             throw cause
@@ -2132,8 +2208,8 @@ export async function listVaults(c: Context<App.Environment>, options: listVault
   ])
   for (const [vault, apy] of missingApy ?? []) apyByVault.set(vault, apy)
   const apy = include.includes('apy') ? apyByVault : undefined
-  const data = page.map((match) =>
-    resolveVault(c, { ...match, apy, include, rates, snapshot, tokens }),
+  const data = await Promise.all(
+    page.map((match) => resolveVault(c, { ...match, apy, include, rates, snapshot, tokens })),
   )
   const last = matches[options.limit - 1]
   const nextPosition =
@@ -2151,6 +2227,7 @@ export declare namespace listVaults {
     discovery: EarnVaults.Discovery
     position: Position
     record?: RegistryRecord | undefined
+    zoneRoutes: readonly EarnVaults.ResolvedZoneRoute[]
   }
 
   /** Options for listing compatible Earn vaults. */
@@ -2179,6 +2256,7 @@ export async function listVerifiedVaults(
   const candidates = records.filter(
     (record) => !cursor || record.vaultAddress.toLowerCase() > cursor,
   )
+  const include = vaultInclude(options)
   const matches: listVerifiedVaults.Match[] = []
 
   let offset = 0
@@ -2192,14 +2270,20 @@ export async function listVerifiedVaults(
     const batch = candidates.slice(offset, offset + batchSize)
     offset += batch.length
     const discovered = await Promise.all(
-      batch.map(async (record) => ({
-        discovery: await resolveVaultDiscovery(c, {
+      batch.map(async (record) => {
+        const discovered = await resolveVaultDiscovery(c, {
           chainId: options.chainId,
           include: discoveryInclude(options),
           vaultAddress: Schema.Address.parse(record.vaultAddress.toLowerCase()),
-        }),
-        record,
-      })),
+        })
+        const { discovery, zoneRoutes } = await resolveVaultRoutes(c, {
+          capability: options.capability,
+          discovery: discovered,
+          include,
+          record,
+        })
+        return { discovery, record, zoneRoutes }
+      }),
     )
     for (const match of discovered) {
       if (!matchesVaultFilters(match.discovery, options)) continue
@@ -2209,7 +2293,6 @@ export async function listVerifiedVaults(
 
   const page = matches.slice(0, options.limit)
   const discoveries = page.map(({ discovery }) => discovery)
-  const include = vaultInclude(options)
   const [apy, rates, tokens] = await Promise.all([
     resolvePageApy(c, {
       chainId: options.chainId,
@@ -2220,10 +2303,12 @@ export async function listVerifiedVaults(
     resolvePageRates(c, { discoveries, include, oracle: options.oracle, snapshot }),
     resolvePageTokens(c, { chainId: options.chainId, discoveries, include, snapshot }),
   ])
-  const data = page.map((match) =>
-    Response.validated(
-      schema.VerifiedVault,
-      resolveVault(c, { ...match, apy, include, rates, snapshot, tokens }),
+  const data = await Promise.all(
+    page.map(async (match) =>
+      Response.validated(
+        schema.VerifiedVault,
+        await resolveVault(c, { ...match, apy, include, rates, snapshot, tokens }),
+      ),
     ),
   )
   const last = matches[options.limit - 1]
@@ -2240,6 +2325,7 @@ export declare namespace listVerifiedVaults {
   type Match = {
     discovery: EarnVaults.Discovery
     record: RegistryRecord
+    zoneRoutes: readonly EarnVaults.ResolvedZoneRoute[]
   }
 
   /** Options for listing verified Earn vaults. */
@@ -2525,13 +2611,19 @@ export async function getVault(c: Context<App.Environment>, options: getVault.Op
     VerifiedTokens.snapshot(c, options.chainId),
   ])
   try {
-    const discovery = await resolveVaultDiscovery(c, {
+    const discovered = await resolveVaultDiscovery(c, {
       chainId: options.chainId,
       include: discoveryInclude({ capability: [], include: options.include }),
       vaultAddress: options.vaultAddress,
     })
-    const discoveries = [discovery]
     const include = vaultInclude(options)
+    const { discovery, zoneRoutes } = await resolveVaultRoutes(c, {
+      capability: [],
+      discovery: discovered,
+      include,
+      record,
+    })
+    const discoveries = [discovery]
     const [apy, rates, tokens] = await Promise.all([
       resolvePageApy(c, {
         chainId: options.chainId,
@@ -2543,7 +2635,7 @@ export async function getVault(c: Context<App.Environment>, options: getVault.Op
       resolvePageTokens(c, { chainId: options.chainId, discoveries, include, snapshot }),
     ])
     return {
-      ...resolveVault(c, {
+      ...(await resolveVault(c, {
         apy,
         discovery,
         include,
@@ -2551,7 +2643,8 @@ export async function getVault(c: Context<App.Environment>, options: getVault.Op
         record,
         snapshot,
         tokens,
-      }),
+        zoneRoutes,
+      })),
       ...(rates ? { meta: { valuation: Valuation.pricing(rates, options.oracle) } } : {}),
     }
   } catch (cause) {
@@ -2586,6 +2679,24 @@ declare namespace vaultInclude {
   type Options = Pick<z.output<typeof schema.getEarnVault.Query>, 'apy.window' | 'include'>
 }
 
+/** Builds an Earn-vault cache key partitioned by Zone-visible API keys. */
+export function vaultCacheKey<const query extends z.ZodMiniType>(
+  c: Context<App.Environment>,
+  query: query,
+): string {
+  const key = Cache.urlKey(c, query)
+  const url = new URL(key)
+  const includesRoutes = url.searchParams
+    .getAll('include')
+    .some((include) => include === 'zone' || include === 'zones')
+  if (!includesRoutes) return key
+
+  const principal = Auth.getPrincipal(c)
+  if (principal?.type !== 'api_key') return key
+  url.searchParams.set('principal', `${principal.type}:${principal.id}`)
+  return url.toString()
+}
+
 function discoveryInclude(
   options: discoveryInclude.Options,
 ): readonly EarnVaults.resolve.Include[] {
@@ -2638,6 +2749,60 @@ declare namespace resolveVaultDiscovery {
   }
 }
 
+async function resolveVaultRoutes(
+  c: Context<App.Environment>,
+  options: resolveVaultRoutes.Options,
+): Promise<resolveVaultRoutes.Result> {
+  const { discovery, record } = options
+  if (!record || record.zones.length === 0) return { discovery, zoneRoutes: [] }
+
+  const principal = Auth.getPrincipal(c)
+  const scopes = principal?.type === 'api_key' ? principal.apiKey.scopes : undefined
+  const includesRoutes = options.include.includes('zone') || options.include.includes('zones')
+  const needsCapabilities =
+    options.include.includes('capabilities') ||
+    options.capability.includes('privateRouting') ||
+    options.capability.includes('routerSwaps')
+  const visibleRoutes = record.zones.filter((route) =>
+    hasZoneAccess({ chainId: route.chainId, scopes }),
+  )
+  // Capabilities describe the vault; API-key scopes limit only the route metadata.
+  const routes = needsCapabilities ? record.zones : includesRoutes ? visibleRoutes : []
+  if (routes.length === 0) return { discovery, zoneRoutes: [] }
+
+  const resolved = await EarnVaults.resolveZoneRoutes({
+    discovery,
+    getClient: c.get('getClient'),
+    routes,
+    zones: [...c.get('zones').values()],
+  })
+  const capabilities = discovery.capabilities
+  if (needsCapabilities && !capabilities)
+    throw new Error('Earn vault capabilities were not resolved.')
+  return {
+    discovery: capabilities
+      ? { ...discovery, capabilities: EarnVaults.addZoneRouteCapabilities(capabilities) }
+      : discovery,
+    zoneRoutes: includesRoutes
+      ? resolved.filter((route) => hasZoneAccess({ chainId: route.chainId, scopes }))
+      : [],
+  }
+}
+
+declare namespace resolveVaultRoutes {
+  type Options = {
+    capability: z.output<typeof schema.getEarnVaults.Query>['capability']
+    discovery: EarnVaults.Discovery
+    include: z.output<typeof schema.getEarnVault.Query>['include']
+    record?: RegistryRecord | undefined
+  }
+
+  type Result = {
+    discovery: EarnVaults.Discovery
+    zoneRoutes: readonly EarnVaults.ResolvedZoneRoute[]
+  }
+}
+
 // Measuring a rate costs indexer boundary queries plus historical quotes against
 // an archive node, so an unrequested rate reaches neither.
 function resolvePageApy(c: Context<App.Environment>, options: resolvePageApy.Options) {
@@ -2718,8 +2883,13 @@ declare namespace resolvePageTokens {
   }
 }
 
-function resolveVault(c: Context<App.Environment>, options: resolveVault.Options) {
+async function resolveVault(c: Context<App.Environment>, options: resolveVault.Options) {
   const { discovery, record } = options
+  const principal = Auth.getPrincipal(c)
+  const scopes = principal?.type === 'api_key' ? principal.apiKey.scopes : undefined
+  const zones = [...c.get('zones').values()].filter((zone) =>
+    hasZoneAccess({ chainId: zone.id, scopes }),
+  )
   const valued = options.include.includes('tvl')
     ? Valuation.valuationFor({
         amount: BigInt(discovery.state.totalAssets),
@@ -2743,7 +2913,8 @@ function resolveVault(c: Context<App.Environment>, options: resolveVault.Options
           formatted: valued.amount,
         }
       : null,
-    zones: [...c.get('zones').values()],
+    zoneRoutes: options.zoneRoutes,
+    zones,
   })
 }
 
@@ -2756,6 +2927,7 @@ declare namespace resolveVault {
     record?: RegistryRecord | undefined
     snapshot: VerifiedTokens.Snapshot
     tokens: Tokens.resolveTokens.ReturnType
+    zoneRoutes: readonly EarnVaults.ResolvedZoneRoute[]
   }
 }
 
@@ -2797,8 +2969,18 @@ export function serializeVault(options: serializeVault.Options): z.output<typeof
     vaultAddress,
     verified: record !== undefined,
     ...(options.include.includes('zone')
-      ? { zone: record ? resolveZone({ discovery, record, zones: options.zones }) : null }
+      ? {
+          zone: record
+            ? resolveZone({
+                discovery,
+                record,
+                zoneRoutes: options.zoneRoutes,
+                zones: options.zones,
+              })
+            : null,
+        }
       : {}),
+    ...(options.include.includes('zones') ? { zones: record ? options.zoneRoutes : [] } : {}),
   })
 }
 
@@ -2819,12 +3001,24 @@ export declare namespace serializeVault {
     shareToken: z.output<typeof Tokens.schema.Token>
     /** USD value of the assets, or null when unpriced; omitted unless `include` carries `tvl`. */
     tvl: z.output<typeof schema.Vault>['tvl']
+    /** Verified Zone routes with immutable router bindings. */
+    zoneRoutes: readonly EarnVaults.ResolvedZoneRoute[]
     /** Private Zones available to the vault. */
     zones: readonly Chain[]
   }
 }
 
 function resolveZone(options: resolveZone.Options): z.output<typeof schema.Vault.shape.zone> {
+  if (options.record.zones.length > 0) {
+    if (options.zoneRoutes.length !== 1) return null
+    const route = options.zoneRoutes[0]!
+    return {
+      chainId: route.chainId,
+      inputTokens: [...route.inputTokens],
+      name: route.name,
+      outputTokens: [...route.outputTokens],
+    }
+  }
   if (!options.discovery.capabilities?.privateRouting) return null
   const hasInputs = options.record.privateInputTokens.length > 0
   const hasOutputs = options.record.privateOutputTokens.length > 0
@@ -2833,6 +3027,7 @@ function resolveZone(options: resolveZone.Options): z.output<typeof schema.Vault
     throw new Error('Private input and output tokens must both be configured.')
 
   const configured = options.zones.filter((zone) => zone.sourceId === options.record.chainId)
+  if (configured.length === 0) return null
   if (configured.length !== 1)
     throw new Error(`Expected one Earn Zone for chain ${options.record.chainId}.`)
   const zone = configured[0]!
@@ -2852,6 +3047,7 @@ declare namespace resolveZone {
   type Options = {
     discovery: EarnVaults.Discovery
     record: RegistryRecord
+    zoneRoutes: readonly EarnVaults.ResolvedZoneRoute[]
     zones: readonly Chain[]
   }
 }

package/src/apps/data/routes/earn.zone-access.test.ts

@@ -0,0 +1,46 @@
+import { Hono } from 'hono'
+
+import * as Earn from './earn.js'
+
+describe('hasZoneAccess', () => {
+  test('matches every Zone granted by read or wildcard scopes', () => {
+    const scopes = ['data:read', 'zone:1424310001:read', 'zone:1424310003:write']
+    const visible = [1424310001, 1424310002, 1424310003].filter((chainId) =>
+      Earn.hasZoneAccess({ chainId, scopes }),
+    )
+
+    expect(visible).toStrictEqual([1424310001])
+    expect(Earn.hasZoneAccess({ chainId: 1424310002, scopes: ['*'] })).toBe(true)
+    expect(Earn.hasZoneAccess({ chainId: 1424310003, scopes })).toBe(false)
+    expect(Earn.hasZoneAccess({ chainId: 1424310001 })).toBe(false)
+  })
+})
+
+describe('vaultCacheKey', () => {
+  test('partitions Zone projections by API key after query credentials are stripped', async () => {
+    const app = new Hono()
+    app.use('*', async (c, next) => {
+      c.set('chainId' as never, 42_431 as never)
+      const principal = c.req.header('x-principal')
+      if (principal) c.set('principal' as never, { id: principal, type: 'api_key' } as never)
+      await next()
+    })
+    app.get('/', (c) => {
+      return c.text(Earn.vaultCacheKey(c as never, Earn.schema.getEarnVault.Query))
+    })
+
+    const [first, second, public_, unscoped] = await Promise.all([
+      app.request('/?include=zones', { headers: { 'x-principal': 'key_1' } }),
+      app.request('/?include=zones', { headers: { 'x-principal': 'key_2' } }),
+      app.request('/?include=zones'),
+      app.request('/', { headers: { 'x-principal': 'key_1' } }),
+    ])
+
+    expect([
+      new URL(await first.text()).searchParams.get('principal'),
+      new URL(await second.text()).searchParams.get('principal'),
+      new URL(await public_.text()).searchParams.get('principal'),
+      new URL(await unscoped.text()).searchParams.get('principal'),
+    ]).toStrictEqual(['api_key:key_1', 'api_key:key_2', null, null])
+  })
+})

package/src/apps/data/routes/exchanges.test.ts

@@ -845,7 +845,37 @@ describe('GET /exchange/swaps', () => {
   }, 60000)
 })
 
-describe('POST /exchange/quotes', () => {
+describe('POST and QUERY /exchange/quotes', () => {
+  test('POST and QUERY accept the same body and return equivalent quote errors', async () => {
+    const client = TestApp.client()
+    const destinationToken = Schema.TokenAddress.parse(Addresses.pathUsd)
+    const request = {
+      json: {
+        account: Relay.accounts[1]!.address,
+        amount: (2n ** 128n).toString(),
+        destinationToken,
+        mode: 'exactSource' as const,
+        slippageBps: 50,
+        sourceToken: '0x20c0000000000000000000008f5425160ebe5525' as const,
+      },
+      query: {},
+    }
+    const [post, query] = await Promise.all([
+      client.v1.exchange.quotes.$post(request, TestApp.auth),
+      client.v1.exchange.quotes.$query(request, TestApp.auth),
+    ])
+
+    expect([post.status, query.status]).toEqual([404, 404])
+    expect([post.headers.get('cache-control'), query.headers.get('cache-control')]).toEqual([
+      'no-store',
+      'no-store',
+    ])
+    expect([await post.json(), await query.json()]).toMatchObject([
+      { error: { code: 'quote_not_available' } },
+      { error: { code: 'quote_not_available' } },
+    ])
+  })
+
   test('validates denominations without verification data', async () => {
     const db = () =>
       Db.postgres({ connectionString: 'postgresql://postgres:postgres@127.0.0.1:1/none' })

package/src/apps/data/routes/exchanges.ts

@@ -191,17 +191,17 @@ export namespace schema {
    */
   export const PairToken = Schema.describe(
     z.object({
-      address: Schema.TokenAddress.check(
+      address: Schema.tokenAddress(Tokens.tokenExample.address).check(
         z.describe(
           'TIP-20 token contract address — the `0x`-prefixed 20-byte identifier for this token.',
         ),
-        z.meta({ examples: ['0x20c0000000000000000000008f5425160ebe5525'] }),
+        z.meta({ examples: [Tokens.tokenExample.address] }),
       ),
       currency: z
         .optional(z.string())
         .check(
           z.describe('Human-readable currency code for the token, when known.'),
-          z.meta({ examples: ['USD'] }),
+          z.meta({ examples: [Tokens.tokenExample.currency] }),
         ),
       decimals: z
         .optional(z.number().check(z.int(), z.nonnegative()))
@@ -209,27 +209,25 @@ export namespace schema {
           z.describe(
             'Number of decimal places the token uses; stablecoins on Tempo typically use 6.',
           ),
-          z.meta({ examples: [6] }),
+          z.meta({ examples: [Tokens.tokenExample.decimals] }),
         ),
       logoUri: z.optional(z.string()).check(
-        z.describe('URL for the token logo SVG, when one is available.'),
+        z.describe('URL for the token logo image, when one is available.'),
         z.meta({
-          examples: [
-            'https://api.tempo.xyz/data/4217/icons/0x20c0000000000000000000008f5425160ebe5525.svg',
-          ],
+          examples: [Tokens.tokenExample.logoUri],
         }),
       ),
       name: z
         .optional(z.string())
         .check(
           z.describe('Human-readable token name, such as `USD Coin`.'),
-          z.meta({ examples: ['USD Coin'] }),
+          z.meta({ examples: [Tokens.tokenExample.name] }),
         ),
       symbol: z
         .optional(z.string())
         .check(
           z.describe('Short token ticker symbol, such as `USDC`.'),
-          z.meta({ examples: ['USDC'] }),
+          z.meta({ examples: [Tokens.tokenExample.symbol] }),
         ),
       verified: z
         .optional(z.boolean())
@@ -1719,9 +1717,15 @@ export namespace schema {
 export function exchanges(options: exchanges.Options = {}) {
   const oracle = options.fx?.oracle ?? FxOracle.ecb()
   return new Hono<App.Environment>()
-    .post(
+    .on(
+      ['POST', 'QUERY'],
       '/v1/exchange/quotes',
-      Auth.policy({ apiKey: { scopes: ['data:read'] }, mpp: true, public: true }),
+      Auth.policy({
+        apiKey: { scopes: ['data:read'] },
+        inheritOverridesFrom: 'POST',
+        mpp: true,
+        public: true,
+      }),
       OpenApi.validate('query', schema.createQuote.Query, {
         code: 'query_invalid',
         message: 'Invalid query parameters',
@@ -2411,7 +2415,7 @@ export function exchanges(options: exchanges.Options = {}) {
             200,
           )
         } catch (cause) {
-          return Response.upstream(c, cause)
+          return Response.upstream(c, cause, { page: options.page })
         }
       },
     )
@@ -2633,7 +2637,7 @@ export function exchanges(options: exchanges.Options = {}) {
             200,
           )
         } catch (cause) {
-          return Response.upstream(c, cause)
+          return Response.upstream(c, cause, { page: options.page })
         }
       },
     )
@@ -2831,7 +2835,7 @@ export function exchanges(options: exchanges.Options = {}) {
             200,
           )
         } catch (cause) {
-          return Response.upstream(c, cause)
+          return Response.upstream(c, cause, { page: options.page })
         }
       },
     )