tapimo 0.12.0 → 0.13.0

package/src/apps/management/routes/api-keys.test.ts

@@ -88,6 +88,7 @@ test('publishes generator-ready OpenAPI contracts', async () => {
   const collection = spec.paths['/v1/orgs/{orgId}/projects/{projectId}/api-keys']
   const detail = spec.paths['/v1/orgs/{orgId}/projects/{projectId}/api-keys/{keyId}']
   const organization = spec.paths['/v1/orgs/{orgId}/api-keys']
+  const rotation = spec.paths['/v1/orgs/{orgId}/projects/{projectId}/api-keys/{keyId}/rotate']
 
   expect({
     components: [
@@ -96,6 +97,7 @@ test('publishes generator-ready OpenAPI contracts', async () => {
       'CreateApiKeyRequest',
       'CreateApiKeyResponse',
       'RevokeApiKeyResponse',
+      'RotateApiKeyResponse',
       'UpdateApiKeyRequest',
     ].filter((name) => spec.components.schemas[name]),
     create: {
@@ -135,6 +137,15 @@ test('publishes generator-ready OpenAPI contracts', async () => {
       operationId: detail.delete.operationId,
       response: detail.delete.responses[200].content['application/json'].schema,
     },
+    rotate: {
+      errors: {
+        400: rotation.post.responses[400].content['application/json'].schema,
+        403: rotation.post.responses[403].content['application/json'].schema,
+        404: rotation.post.responses[404].content['application/json'].schema,
+      },
+      operationId: rotation.post.operationId,
+      response: rotation.post.responses[200].content['application/json'].schema,
+    },
     timestamps: {
       createdAt: spec.components.schemas.ApiKey.properties.createdAt.format,
       expiresAt: spec.components.schemas.ApiKey.properties.expiresAt.format,
@@ -158,6 +169,7 @@ test('publishes generator-ready OpenAPI contracts', async () => {
         "CreateApiKeyRequest",
         "CreateApiKeyResponse",
         "RevokeApiKeyResponse",
+        "RotateApiKeyResponse",
         "UpdateApiKeyRequest",
       ],
       "create": {
@@ -231,6 +243,23 @@ test('publishes generator-ready OpenAPI contracts', async () => {
           "$ref": "#/components/schemas/RevokeApiKeyResponse",
         },
       },
+      "rotate": {
+        "errors": {
+          "400": {
+            "$ref": "#/components/schemas/ApiKeyMalformedOrParamInvalidError",
+          },
+          "403": {
+            "$ref": "#/components/schemas/ApiKeyForbiddenOrApiKeyIpForbiddenOrForbiddenOrScopeNotIssuableError",
+          },
+          "404": {
+            "$ref": "#/components/schemas/ApiKeyNotFoundOrApiKeysNotEnabledOrOrganizationNotFoundOrProjectNotFoundError",
+          },
+        },
+        "operationId": "rotateApiKey",
+        "response": {
+          "$ref": "#/components/schemas/RotateApiKeyResponse",
+        },
+      },
       "timestamps": {
         "createdAt": "date-time",
         "expiresAt": "date-time",
@@ -287,6 +316,54 @@ describe('keys', () => {
 
     const write = await app.request(base, json('POST', owner, { scopes: ['management:write'] }))
     expect(write.status).toBe(200)
+
+    const created = await TestApp.json(write, Keys.schema.createApiKey.Response)
+    const rotateDenied = await app.request(`${base}/${created.id}/rotate`, {
+      headers: { cookie: admin },
+      method: 'POST',
+    })
+    expect(rotateDenied.status).toBe(403)
+    expect(await rotateDenied.json()).toMatchObject({ error: { code: 'scope_not_issuable' } })
+
+    const rotateAllowed = await app.request(`${base}/${created.id}/rotate`, {
+      headers: { cookie: owner },
+      method: 'POST',
+    })
+    expect(rotateAllowed.status).toBe(200)
+  })
+
+  test('requires an owner to rotate wildcard keys and allows the super admin', async () => {
+    const db = TestApp.database()
+    const store = TestApp.kvStore({ keys: [] })
+    const app = createApp({ db, kv: { store } })
+    const owner = await session(app)
+    const { org, project } = await fixture(app, owner)
+    const admin = await session(app)
+    const user = await TestApp.json(
+      await app.request('/v1/me', { headers: { cookie: admin } }),
+      Me.schema.User,
+    )
+    await Memberships.create(db, { orgId: org.id, role: 'admin', userId: user.id })
+    const base = `/v1/orgs/${org.id}/projects/${project.id}/api-keys`
+    const { record: source } = await ApiKeys.mint(store, {
+      environment: 'production',
+      orgId: org.id,
+      projectId: project.id,
+      scopes: [Scope.wildcard],
+    })
+
+    const denied = await app.request(`${base}/${source.id}/rotate`, {
+      headers: { cookie: admin },
+      method: 'POST',
+    })
+    expect(denied.status).toBe(403)
+    expect(await denied.json()).toMatchObject({ error: { code: 'scope_not_issuable' } })
+
+    const allowed = await app.request(`${base}/${source.id}/rotate`, {
+      headers: { 'tempo-api-key': secret },
+      method: 'POST',
+    })
+    expect(allowed.status).toBe(200)
   })
 
   test('zone scopes are never self-serve', async () => {
@@ -304,6 +381,149 @@ describe('keys', () => {
     }
   })
 
+  test('rotates a super-admin-issued zone key without delegating scope issuance', async () => {
+    const store = TestApp.kvStore({ keys: [] })
+    const app = createApp({ kv: { store } })
+    const owner = await session(app)
+    const { org, project } = await fixture(app, owner)
+    const base = `/v1/orgs/${org.id}/projects/${project.id}/api-keys`
+    const source = await TestApp.json(
+      await app.request(
+        base,
+        superAdminJson('POST', {
+          allowedIps: ['203.0.113.0/24'],
+          environment: 'production',
+          name: 'Privy',
+          scopes: ['zone:421700001:read', 'zone:421700001:write'],
+        }),
+      ),
+      Keys.schema.createApiKey.Response,
+    )
+
+    const response = await app.request(`${base}/${source.id}/rotate`, {
+      headers: { cookie: owner },
+      method: 'POST',
+    })
+    expect(response.status).toBe(200)
+    const replacement = await TestApp.json(response, Keys.schema.rotateApiKey.Response)
+    expect(replacement).toMatchObject({
+      allowedIps: ['203.0.113.0/24'],
+      environment: 'production',
+      name: 'Privy',
+      orgId: org.id,
+      projectId: project.id,
+      scopes: ['zone:421700001:read', 'zone:421700001:write'],
+    })
+    expect(replacement.createdBy).not.toBe('super_admin')
+    expect(replacement.id).not.toBe(source.id)
+    expect(replacement.token).not.toBe(source.token)
+    expect(await ApiKeys.resolve(store, source.token)).not.toBeNull()
+    expect(await ApiKeys.resolve(store, replacement.token)).not.toBeNull()
+  })
+
+  test('rotates an organization-level super-admin-issued zone key', async () => {
+    const store = TestApp.kvStore({ keys: [] })
+    const app = createApp({ kv: { store } })
+    const owner = await session(app)
+    const { org, project } = await fixture(app, owner)
+    const { record: projectSource } = await ApiKeys.mint(store, {
+      orgId: org.id,
+      projectId: project.id,
+      scopes: ['data:read'],
+    })
+    const projectResponse = await app.request(
+      `/v1/orgs/${org.id}/api-keys/${projectSource.id}/rotate`,
+      { headers: { cookie: owner }, method: 'POST' },
+    )
+    expect(projectResponse.status).toBe(404)
+    const projectRevoke = await app.request(`/v1/orgs/${org.id}/api-keys/${projectSource.id}`, {
+      headers: { cookie: owner },
+      method: 'DELETE',
+    })
+    expect(projectRevoke.status).toBe(404)
+
+    const { record: source } = await ApiKeys.mint(store, {
+      createdBy: 'super_admin',
+      environment: 'production',
+      name: 'Privy',
+      orgId: org.id,
+      scopes: ['zone:421700001:read', 'zone:421700001:write'],
+    })
+
+    const response = await app.request(`/v1/orgs/${org.id}/api-keys/${source.id}/rotate`, {
+      headers: { cookie: owner },
+      method: 'POST',
+    })
+    expect(response.status).toBe(200)
+    const replacement = await TestApp.json(response, Keys.schema.rotateApiKey.Response)
+    expect(replacement).toMatchObject({
+      environment: 'production',
+      name: 'Privy',
+      orgId: org.id,
+      scopes: ['zone:421700001:read', 'zone:421700001:write'],
+    })
+    expect(replacement.projectId).toBeUndefined()
+    expect(replacement.createdBy).not.toBe('super_admin')
+    expect(replacement.id).not.toBe(source.id)
+
+    const revoked = await app.request(`/v1/orgs/${org.id}/api-keys/${replacement.id}`, {
+      headers: { cookie: owner },
+      method: 'DELETE',
+    })
+    expect(revoked.status).toBe(200)
+    expect(await TestApp.json(revoked, Keys.schema.revokeApiKey.Response)).toEqual({
+      id: replacement.id,
+    })
+    expect(await ApiKeys.resolve(store, replacement.token)).toBeNull()
+  })
+
+  test('refreshes sandbox billing state during rotation', async () => {
+    const db = TestApp.database()
+    const store = TestApp.kvStore({ keys: [] })
+    const app = createApp({ db, kv: { store } })
+    const owner = await session(app)
+    const { org, project } = await fixture(app, owner)
+    const { record: source } = await ApiKeys.mint(store, {
+      billingActive: true,
+      environment: 'sandbox',
+      orgId: org.id,
+      projectId: project.id,
+      scopes: ['data:read'],
+    })
+
+    const response = await app.request(
+      `/v1/orgs/${org.id}/projects/${project.id}/api-keys/${source.id}/rotate`,
+      { headers: { cookie: owner }, method: 'POST' },
+    )
+    expect(response.status).toBe(200)
+    const replacement = await TestApp.json(response, Keys.schema.rotateApiKey.Response)
+    expect((await ApiKeys.get(store, replacement.id))?.billingActive).toBe(false)
+  })
+
+  test('does not rotate a key from another project', async () => {
+    const app = createApp()
+    const owner = await session(app)
+    const { org, project } = await fixture(app, owner)
+    const other = await TestApp.json(
+      await app.request(`/v1/orgs/${org.id}/projects`, json('POST', owner, { name: 'Other' })),
+      Projects.schema.Project,
+    )
+    const source = await TestApp.json(
+      await app.request(
+        `/v1/orgs/${org.id}/projects/${project.id}/api-keys`,
+        superAdminJson('POST', { scopes: ['zone:421700001:read'] }),
+      ),
+      Keys.schema.createApiKey.Response,
+    )
+
+    const response = await app.request(
+      `/v1/orgs/${org.id}/projects/${other.id}/api-keys/${source.id}/rotate`,
+      { headers: { cookie: owner }, method: 'POST' },
+    )
+    expect(response.status).toBe(404)
+    expect(await response.json()).toMatchObject({ error: { code: 'api_key_not_found' } })
+  })
+
   test('restricts project management keys without delegating issuance', async () => {
     const app = createApp()
     const cookie = await session(app)

package/src/apps/management/routes/api-keys.ts

@@ -12,6 +12,7 @@ import * as Billing from '../Billing.js'
 import * as OpenApi from '../../../internal/OpenApi.js'
 import * as Response from '../../../internal/Response.js'
 import * as Schema from '../../../internal/Schema.js'
+import * as Store from '../../../internal/Store.js'
 import * as Scope from '../../../Scope.js'
 import * as ManagementError from '../Error.js'
 
@@ -147,6 +148,24 @@ export namespace schema {
     })
     .check(z.describe('Path parameters for one API key.'))
 
+  /** Path parameters addressing one organization-level API key. */
+  export const OrgKeyParams = z
+    .object({
+      keyId: z
+        .string()
+        .check(
+          z.describe('The key id (`key_…`).'),
+          z.meta({ examples: ['key_1a2b3c4d5e6f7g8h9j0k1m2n'] }),
+        ),
+      orgId: z
+        .string()
+        .check(
+          z.describe('The organization id (`org_…`).'),
+          z.meta({ examples: ['org_1a2b3c4d5e6f7g8h9j0k1m2n'] }),
+        ),
+    })
+    .check(z.describe('Path parameters for one organization-level API key.'))
+
   /** Request body minting a key. The wildcard scope is not issuable here. */
   export const CreateApiKeyRequest = OpenApi.component(
     z
@@ -251,6 +270,25 @@ export namespace schema {
     )
   }
 
+  /** Schemas for the rotateApiKey operation. */
+  export namespace rotateApiKey {
+    /** The replacement key plus its one-time token. */
+    export const Response = OpenApi.component(
+      Schema.describe(
+        z.extend(Key, {
+          token: z
+            .string()
+            .check(
+              z.describe('The plaintext token — shown once, unrecoverable afterward.'),
+              z.meta({ examples: ['tempo_sandbox:sk:…'] }),
+            ),
+        }),
+        'The replacement key, including its one-time token.',
+      ),
+      'RotateApiKeyResponse',
+    )
+  }
+
   /** Schemas for the updateApiKey operation. */
   export namespace updateApiKey {
     /** Request body replacing or clearing a key's IP allowlist. */
@@ -518,6 +556,124 @@ export function apiKeys(options: apiKeys.Options = {}) {
         }
       },
     )
+    .post(
+      '/v1/orgs/:orgId{org_[A-Za-z0-9_-]+}/api-keys/:keyId{key_[A-Za-z0-9_-]+}/rotate',
+      Auth.policy({ session: true }),
+      Auth.ensureOrg({ role: 'admin' }),
+      OpenApi.validate('param', schema.OrgKeyParams, {
+        code: 'param_invalid',
+        message: 'Check the path parameters and try again.',
+      }),
+      OpenApi.describeRoute({
+        description:
+          'Create a replacement organization-level API key with the same access as an existing key. The existing key remains active until revoked.',
+        hide: hidden,
+        operationId: 'rotateOrgApiKey',
+        responses: OpenApi.responses({
+          errors: {
+            400: { codes: ['param_invalid'], description: 'Malformed API key or invalid path.' },
+            403: {
+              codes: ['scope_not_issuable'],
+              description: 'The source key contains scopes the caller cannot rotate.',
+            },
+            404: {
+              codes: ['api_key_not_found', 'api_keys_not_enabled', 'organization_not_found'],
+              description: 'No accessible API key or API key surface was found.',
+            },
+          },
+          success: {
+            description: 'The replacement key, including its one-time token.',
+            schema: schema.rotateApiKey.Response,
+          },
+        }),
+        summary: 'Rotate organization API key',
+        tags: ['API Keys'],
+      }),
+      async (c) => {
+        if (Auth.narrowAccess) return Auth.superAdminAccessError(c)
+        if (Auth.narrowOrgRole) return Auth.ensureOrgRoleError(c)
+        if (OpenApi.narrowValidation)
+          return OpenApi.validationError(c, {
+            code: 'param_invalid',
+            message: 'Check the path parameters and try again.',
+          })
+
+        const kv = c.get('kv')
+        if (!kv) return notEnabled(c)
+        const createdBy = mintedBy(c)
+        if (!createdBy) return ManagementError.sessionRequired(c)
+        const { keyId } = c.req.valid('param')
+        try {
+          const source = await ApiKeys.get(kv.store, keyId, {
+            scopeCatalog: c.get('scopeCatalog'),
+          })
+          if (!source || source.orgId !== Auth.org(c).id || source.projectId !== undefined)
+            return keyNotFound(c)
+          if (!canRotate(c, source.scopes))
+            return Response.error(c, {
+              code: 'scope_not_issuable',
+              message: 'The source key contains scopes the caller cannot rotate.',
+              status: 403,
+            })
+          return rotate(c, kv.store, source, createdBy)
+        } catch (cause) {
+          return Response.upstream(c, cause)
+        }
+      },
+    )
+    .delete(
+      '/v1/orgs/:orgId{org_[A-Za-z0-9_-]+}/api-keys/:keyId{key_[A-Za-z0-9_-]+}',
+      Auth.policy({ apiKey: { scopes: ['management:write'] }, session: true }),
+      Auth.ensureOrg({ role: 'admin' }),
+      OpenApi.validate('param', schema.OrgKeyParams, {
+        code: 'param_invalid',
+        message: 'Check the path parameters and try again.',
+      }),
+      OpenApi.describeRoute({
+        description:
+          'Revoke an organization-level API key. Requests presenting its token stop resolving.',
+        hide: hidden,
+        operationId: 'revokeOrgApiKey',
+        responses: OpenApi.responses({
+          errors: {
+            400: { codes: ['param_invalid'], description: 'Malformed API key or invalid path.' },
+            404: {
+              codes: ['api_key_not_found', 'api_keys_not_enabled', 'organization_not_found'],
+              description: 'No accessible API key or API key surface was found.',
+            },
+          },
+          success: {
+            description: 'Confirmation that the key was revoked.',
+            schema: schema.revokeApiKey.Response,
+          },
+        }),
+        summary: 'Revoke organization API key',
+        tags: ['API Keys'],
+      }),
+      async (c) => {
+        if (Auth.narrowAccess) return Auth.accessError(c)
+        if (Auth.narrowOrgRole) return Auth.ensureOrgRoleError(c)
+        if (OpenApi.narrowValidation)
+          return OpenApi.validationError(c, {
+            code: 'param_invalid',
+            message: 'Check the path parameters and try again.',
+          })
+
+        const kv = c.get('kv')
+        if (!kv) return notEnabled(c)
+        const { keyId } = c.req.valid('param')
+        try {
+          const record = await ApiKeys.get(kv.store, keyId, {
+            scopeCatalog: c.get('scopeCatalog'),
+          })
+          if (!record || record.orgId !== Auth.org(c).id || record.projectId !== undefined)
+            return keyNotFound(c)
+          return revoke(c, kv.store, keyId)
+        } catch (cause) {
+          return Response.upstream(c, cause)
+        }
+      },
+    )
     .patch(
       '/v1/orgs/:orgId{org_[A-Za-z0-9_-]+}/projects/:projectId{prj_[A-Za-z0-9_-]+}/api-keys/:keyId{key_[A-Za-z0-9_-]+}',
       Auth.policy({ apiKey: { scopes: ['management:write'] }, session: true }),
@@ -594,6 +750,78 @@ export function apiKeys(options: apiKeys.Options = {}) {
         }
       },
     )
+    .post(
+      '/v1/orgs/:orgId{org_[A-Za-z0-9_-]+}/projects/:projectId{prj_[A-Za-z0-9_-]+}/api-keys/:keyId{key_[A-Za-z0-9_-]+}/rotate',
+      Auth.policy({ session: true }),
+      Auth.ensureOrg({ role: 'admin' }),
+      Auth.ensureProject(),
+      OpenApi.validate('param', schema.KeyParams, {
+        code: 'param_invalid',
+        message: 'Check the path parameters and try again.',
+      }),
+      OpenApi.describeRoute({
+        description:
+          'Create a replacement API key with the same access as an existing key. The existing key remains active until revoked.',
+        hide: hidden,
+        operationId: 'rotateApiKey',
+        responses: OpenApi.responses({
+          errors: {
+            400: { codes: ['param_invalid'], description: 'Malformed API key or invalid path.' },
+            403: {
+              codes: ['scope_not_issuable'],
+              description: 'The source key contains scopes the caller cannot rotate.',
+            },
+            404: {
+              codes: [
+                'api_key_not_found',
+                'api_keys_not_enabled',
+                'organization_not_found',
+                'project_not_found',
+              ],
+              description: 'No accessible API key or API key surface was found.',
+            },
+          },
+          success: {
+            description: 'The replacement key, including its one-time token.',
+            schema: schema.rotateApiKey.Response,
+          },
+        }),
+        summary: 'Rotate API key',
+        tags: ['API Keys'],
+      }),
+      async (c) => {
+        if (Auth.narrowAccess) return Auth.superAdminAccessError(c)
+        if (Auth.narrowScope) return Auth.ensureProjectError(c)
+        if (Auth.narrowOrgRole) return Auth.ensureOrgRoleError(c)
+        if (OpenApi.narrowValidation)
+          return OpenApi.validationError(c, {
+            code: 'param_invalid',
+            message: 'Check the path parameters and try again.',
+          })
+
+        const kv = c.get('kv')
+        if (!kv) return notEnabled(c)
+        const createdBy = mintedBy(c)
+        if (!createdBy) return ManagementError.sessionRequired(c)
+        const { keyId } = c.req.valid('param')
+        try {
+          const source = await ApiKeys.get(kv.store, keyId, {
+            scopeCatalog: c.get('scopeCatalog'),
+          })
+          if (!source || source.orgId !== Auth.org(c).id || source.projectId !== Auth.project(c).id)
+            return keyNotFound(c)
+          if (!canRotate(c, source.scopes))
+            return Response.error(c, {
+              code: 'scope_not_issuable',
+              message: 'The source key contains scopes the caller cannot rotate.',
+              status: 403,
+            })
+          return rotate(c, kv.store, source, createdBy)
+        } catch (cause) {
+          return Response.upstream(c, cause)
+        }
+      },
+    )
     .delete(
       '/v1/orgs/:orgId{org_[A-Za-z0-9_-]+}/projects/:projectId{prj_[A-Za-z0-9_-]+}/api-keys/:keyId{key_[A-Za-z0-9_-]+}',
       Auth.policy({ apiKey: { scopes: ['management:write'] }, session: true }),
@@ -649,9 +877,7 @@ export function apiKeys(options: apiKeys.Options = {}) {
           })
           if (!record || record.orgId !== Auth.org(c).id || record.projectId !== Auth.project(c).id)
             return keyNotFound(c)
-          const revoked = await ApiKeys.revoke(kv.store, keyId)
-          if (!revoked) return keyNotFound(c)
-          return c.json(Response.validated(schema.revokeApiKey.Response, { id: keyId }), 200)
+          return revoke(c, kv.store, keyId)
         } catch (cause) {
           return Response.upstream(c, cause)
         }
@@ -722,6 +948,57 @@ function canIssue(c: Context<App.Environment>, scopes: readonly Scope.Id[]) {
   return false
 }
 
+/** Checks caller-specific restrictions that still apply when copying existing grants. */
+function canRotate(c: Context<App.Environment>, scopes: readonly Scope.Id[]) {
+  const principal = Auth.getPrincipal(c)
+  if (principal?.type === 'super_admin') return true
+  if (principal?.type !== 'session') return false
+  return (
+    (!scopes.includes('management:write') && !scopes.includes(Scope.wildcard)) ||
+    Auth.membership(c)?.role === 'owner'
+  )
+}
+
+/** Mints a replacement that preserves the source key's access and attribution. */
+async function rotate(
+  c: Context<App.Environment>,
+  store: Store.State,
+  source: ApiKeys.Record,
+  createdBy: string,
+) {
+  const billingActive =
+    source.environment === 'sandbox'
+      ? await Billing.active(Db.get(c.get('db')), source.orgId, 'sandbox')
+      : undefined
+  const { record, token } = await ApiKeys.mint(
+    store,
+    {
+      allowedIps: source.allowedIps,
+      createdBy,
+      environment: source.environment,
+      orgId: source.orgId,
+      ...(source.projectId === undefined ? {} : { projectId: source.projectId }),
+      scopes: source.scopes,
+      ...(billingActive === undefined ? {} : { billingActive }),
+      ...(source.expiresAt === undefined ? {} : { expiresAt: source.expiresAt }),
+      ...(source.name === undefined ? {} : { name: source.name }),
+      ...(source.rateLimits === undefined ? {} : { rateLimits: source.rateLimits }),
+    },
+    { scopeCatalog: c.get('scopeCatalog') },
+  )
+  return c.json(
+    Response.validated(schema.rotateApiKey.Response, { ...serializeKey(record), token }),
+    200,
+  )
+}
+
+/** Revokes an API key after its route has verified ownership. */
+async function revoke(c: Context<App.Environment>, store: Store.State, keyId: string) {
+  const revoked = await ApiKeys.revoke(store, keyId)
+  if (!revoked) return keyNotFound(c)
+  return c.json(Response.validated(schema.revokeApiKey.Response, { id: keyId }), 200)
+}
+
 function keyNotFound(c: Context<App.Environment>) {
   return Response.error(c, {
     code: 'api_key_not_found',

package/src/db/Db.ts

@@ -1483,6 +1483,11 @@ export const migrations: readonly Migration[] = [
         sql`ALTER TABLE earn_vaults ADD COLUMN IF NOT EXISTS zones jsonb NOT NULL DEFAULT '[]'::jsonb`,
       ),
   },
+  {
+    name: '0137_funding_routes_configuration',
+    up: (db) =>
+      raw(db, sql`ALTER TABLE funding_routes ADD COLUMN IF NOT EXISTS configuration jsonb`),
+  },
 ]
 
 /**
@@ -1620,7 +1625,14 @@ declare namespace fromDialect {
  */
 export function postgres(options: postgres.Options): Db {
   const { connectionString, schema } = options
-  const pool = new pg.Pool(schema ? { connectionString, max: 1 } : { connectionString })
+  // Bounded connect and pool-checkout wait: the pg default (0) waits forever,
+  // so an unresponsive origin parks callers and their invocation memory
+  // invisibly instead of failing into the retry paths.
+  const pool = new pg.Pool({
+    connectionString,
+    connectionTimeoutMillis: 30_000,
+    ...(schema ? { max: 1 } : {}),
+  })
   return fromDialect(new PostgresDialect({ pool }), { schema })
 }
 

package/src/db/Schema.ts

@@ -453,11 +453,14 @@ export type FundingChainToken = z.output<typeof FundingChainToken>
 
 /** One source-to-destination route supported by a funding provider. */
 export const FundingRoute = z.object({
-  destinationChainId: z.string().check(z.describe('Destination funding chain identifier.')),
-  destinationTokenId: z.string().check(z.describe('Destination funding token identifier.')),
   capabilities: z
     .nullable(z.custom<funding_Catalog.Capabilities>())
     .check(z.describe('Executable capability (`jsonb`), or null for indicative-only routes.')),
+  configuration: z
+    .nullable(z.custom<funding_Catalog.Configuration>())
+    .check(z.describe('Provider-specific route configuration (`jsonb`), or null.')),
+  destinationChainId: z.string().check(z.describe('Destination funding chain identifier.')),
+  destinationTokenId: z.string().check(z.describe('Destination funding token identifier.')),
   providerId: z.string().check(z.describe('Funding provider identifier.')),
   sourceChainId: z.string().check(z.describe('Source funding chain identifier.')),
   sourceTokenId: z.string().check(z.describe('Source funding token identifier.')),

package/src/db/tables/earnVaults.test.ts

@@ -13,9 +13,9 @@ const input = {
   vaultAddress: '0x2f05f4d3625B2eFFb383eFbEDAFd2D8F04371636',
   zones: [
     {
-      chainId: 1_424_310_001,
-      deploymentBlock: 31_039_238,
-      earnRouter: '0x9144086A79dea966d8bf1B52125eBED8919fC45c',
+      chainId: 1_424_310_003,
+      deploymentBlock: 31_730_087,
+      earnRouter: '0xeBEdC74FFeEAD186ACC6caC05Eb82fB9e093a7c7',
     },
   ],
 } as const satisfies EarnVaults.upsert.Options
@@ -45,9 +45,9 @@ describe('upsert', () => {
           "vaultAddress": "0x2f05f4d3625b2effb383efbedafd2d8f04371636",
           "zones": [
             {
-              "chainId": 1424310001,
-              "deploymentBlock": 31039238,
-              "earnRouter": "0x9144086a79dea966d8bf1b52125ebed8919fc45c",
+              "chainId": 1424310003,
+              "deploymentBlock": 31730087,
+              "earnRouter": "0xebedc74ffeead186acc6cac05eb82fb9e093a7c7",
             },
           ],
         }
@@ -93,9 +93,9 @@ describe('upsert', () => {
           "updatedAt": "2026-01-02T00:00:00.000Z",
           "zones": [
             {
-              "chainId": 1424310001,
-              "deploymentBlock": 31039238,
-              "earnRouter": "0x9144086a79dea966d8bf1b52125ebed8919fc45c",
+              "chainId": 1424310003,
+              "deploymentBlock": 31730087,
+              "earnRouter": "0xebedc74ffeead186acc6cac05eb82fb9e093a7c7",
             },
           ],
         }