tapimo 0.15.0 → 0.18.0

package/src/admin/apps/routes-support.ts

@@ -1,11 +1,11 @@
 import { Hono } from 'hono'
 import * as z from 'zod/mini'
-import { base, mainnet } from 'viem/chains'
 import { tempo } from 'viem/tempo/chains'
 
 import * as Db from '../../db/Db.js'
 import * as OpenApi from '../../internal/OpenApi.js'
 import * as RoutesCatalog from '../../internal/routes/Catalog.js'
+import * as RoutesTransferSubsidy from '../../internal/routes/TransferSubsidy.js'
 import type * as App from '../App.js'
 
 /** Zod schemas owned by the admin route support matrix. */
@@ -159,6 +159,7 @@ function summarize(routes: readonly RoutesCatalog.ProviderRoute[]) {
   const rows = new Map<string, Row>()
   for (const providerRoute of routes) {
     const { capabilities, providerId, route } = providerRoute
+    if (!isPartnerRoute(route)) continue
     const id = `${route.source.chain.id}/${route.source.slug}-${route.destination.chain.id}/${route.destination.slug}`
     const row = rows.get(id) ?? {
       depositAddressProviders: [],
@@ -183,8 +184,11 @@ function summarize(routes: readonly RoutesCatalog.ProviderRoute[]) {
       row.walletTransferProviders.push({ modes: [...capabilities.transfer.modes], providerId })
       row.subsidies.walletTransfer ||=
         capabilities.transfer.modes.includes('exactSource') &&
-        route.source.chain.id === `eip155:${tempo.id}` &&
-        [`eip155:${base.id}`, `eip155:${mainnet.id}`].includes(route.destination.chain.id) &&
+        RoutesTransferSubsidy.supportsRoute({
+          destinationChainId: route.destination.chain.id,
+          sourceChainId: route.source.chain.id,
+          tempoChainId: tempo.id,
+        }) &&
         usdPair
     }
     rows.set(id, row)
@@ -192,6 +196,42 @@ function summarize(routes: readonly RoutesCatalog.ProviderRoute[]) {
   return [...rows.values()]
 }
 
+function isPartnerRoute(route: RoutesCatalog.ProviderRoute['route']) {
+  const { destination, source } = route
+  if (destination.chain.slug === 'tempo') {
+    if (source.chain.slug === 'tempo') return false
+    if (source.slug === 'usdc') {
+      if (['pathusd', 'whishusd'].includes(destination.slug)) return true
+      return (
+        ['base', 'ethereum', 'solana'].includes(source.chain.slug) &&
+        ['ousd', 'usdce', 'usdt0'].includes(destination.slug)
+      )
+    }
+    return (
+      source.chain.slug === 'tron' &&
+      source.slug === 'usdt' &&
+      ['ousd', 'pathusd', 'usdce', 'usdt0', 'whishusd'].includes(destination.slug)
+    )
+  }
+
+  if (source.chain.slug !== 'tempo') return false
+  if (destination.chain.slug === 'tempo') return false
+  if (destination.slug === 'usdc') {
+    if (['pathusd', 'whishusd'].includes(source.slug)) return true
+    if (source.slug === 'usdt0')
+      return ['base', 'ethereum', 'solana'].includes(destination.chain.slug)
+    return (
+      ['ousd', 'usdce'].includes(source.slug) &&
+      ['base', 'ethereum', 'solana'].includes(destination.chain.slug)
+    )
+  }
+  return (
+    destination.chain.slug === 'tron' &&
+    destination.slug === 'usdt' &&
+    ['ousd', 'pathusd', 'usdce', 'usdt0', 'whishusd'].includes(source.slug)
+  )
+}
+
 function pickChain(chain: RoutesCatalog.ProviderRoute['route']['source']['chain']) {
   return { id: chain.id, name: chain.name, slug: chain.slug }
 }

package/src/admin/apps/routes.test.ts

@@ -137,6 +137,127 @@ describe('GET /routes/transfers/:id', () => {
     ])
     expect(body).not.toHaveProperty('providerState')
   })
+
+  test.each([
+    { provider: 'relay', requestId: `0x${'ab'.repeat(32)}`, expected: [`0x${'ab'.repeat(32)}`] },
+    { provider: 'stargate', requestId: `0x${'ab'.repeat(32)}`, expected: [] },
+    { provider: 'relay', requestId: undefined, expected: [] },
+    { provider: 'relay', requestId: 42, expected: [] },
+  ])(
+    'exposes only Relay request identifiers: $provider/$requestId',
+    async ({ provider, requestId, expected }) => {
+      const { client, db } = TestAdmin.setup()
+      const { organization, project } = await seedAttribution(db)
+      const record = await Transfer.create(db, {
+        apiKeyId: 'key_admin_routes',
+        environment: 'production',
+        orgId: organization.id,
+        projectId: project.id,
+        providerState: { checkEndpoint: '/private/check', requestId, secret: 'hidden' },
+        snapshot: TestRoutes.transferSnapshot({ provider: { id: provider, name: provider } }),
+      })
+
+      const response = await client.routes.transfers[':id'].$get({ param: { id: record.id } })
+      const body = await response.json()
+      expect(response.status).toBe(200)
+      expect(body).toHaveProperty('providerRequestIds', expected)
+      expect(body).not.toHaveProperty('providerState')
+      expect(JSON.stringify(body)).not.toContain('/private/check')
+      expect(JSON.stringify(body)).not.toContain('hidden')
+    },
+  )
+})
+
+describe('POST /routes/transfers/:id/retry', () => {
+  test('returns an action-required transfer to processing and records the event', async () => {
+    const { client, db } = TestAdmin.setup()
+    const { organization, project } = await seedAttribution(db)
+    const record = await seedActionRequiredTransfer(db, organization.id, project.id)
+
+    const response = await client.routes.transfers[':id'].retry.$post({
+      json: { version: record.version },
+      param: { id: record.id },
+    })
+    const body = await TestApp.json(response, AdminRoutes.schema.retryRoutesTransfer.Response)
+
+    expect(response.status).toBe(200)
+    expect(body).toMatchObject({ id: record.id, status: 'processing', version: record.version + 1 })
+    expect(body).not.toHaveProperty('statusReason')
+    const detail = await client.routes.transfers[':id'].$get({ param: { id: record.id } })
+    const { events } = await TestApp.json(detail, AdminRoutes.schema.getRoutesTransfer.Response)
+    expect(events.map(({ status }) => status)).toEqual([
+      'awaiting-source',
+      'processing',
+      'action-required',
+      'processing',
+    ])
+  })
+
+  test('rejects a stale version', async () => {
+    const { client, db } = TestAdmin.setup()
+    const { organization, project } = await seedAttribution(db)
+    const record = await seedActionRequiredTransfer(db, organization.id, project.id)
+
+    const response = await client.routes.transfers[':id'].retry.$post({
+      json: { version: record.version - 1 },
+      param: { id: record.id },
+    })
+
+    expect(response.status).toBe(409)
+    expect(await response.json()).toMatchObject({ error: { code: 'version_conflict' } })
+  })
+
+  test('rejects a transfer that is not action-required', async () => {
+    const { client, db } = TestAdmin.setup()
+    const { organization, project } = await seedAttribution(db)
+    const { record } = await seedTransfer(db, organization.id, project.id)
+
+    const response = await client.routes.transfers[':id'].retry.$post({
+      json: { version: record.version + 1 },
+      param: { id: record.id },
+    })
+
+    expect(response.status).toBe(409)
+    expect(await response.json()).toMatchObject({
+      error: { code: 'routes_transfer_not_retryable' },
+    })
+  })
+
+  test.each([
+    { providerState: { transferSubsidy: { hash: `0x${'cd'.repeat(32)}` } } },
+    { providerState: { solanaTransferSubsidyPrepared: '{}' } },
+    { providerState: { tronTransferSubsidyPrepared: '{}' } },
+  ])(
+    'rejects a transfer with a prepared or signed subsidy: $providerState',
+    async ({ providerState }) => {
+      const { client, db } = TestAdmin.setup()
+      const { organization, project } = await seedAttribution(db)
+      const record = await seedActionRequiredTransfer(db, organization.id, project.id, {
+        providerState,
+      })
+
+      const response = await client.routes.transfers[':id'].retry.$post({
+        json: { version: record.version },
+        param: { id: record.id },
+      })
+
+      expect(response.status).toBe(409)
+      expect(await response.json()).toMatchObject({
+        error: { code: 'routes_transfer_subsidy_pending' },
+      })
+    },
+  )
+
+  test('returns 404 for an unknown transfer', async () => {
+    const { client } = TestAdmin.setup()
+
+    const response = await client.routes.transfers[':id'].retry.$post({
+      json: { version: 1 },
+      param: { id: 'rtr_001785792000000_2ZPE2gvateYEQ0dQslgvkhjx' },
+    })
+
+    expect(response.status).toBe(404)
+  })
 })
 
 describe('GET /routes/deposit-addresses', () => {
@@ -371,6 +492,35 @@ async function seedTransfer(db: Db.Db, orgId: string, projectId: string) {
   return { record, transactionRef }
 }
 
+async function seedActionRequiredTransfer(
+  db: Db.Db,
+  orgId: string,
+  projectId: string,
+  options: seedActionRequiredTransfer.Options = {},
+) {
+  const { record } = await seedTransfer(db, orgId, projectId)
+  const result = await Transfer.transition(db, {
+    expectedVersion: record.version + 1,
+    id: record.id,
+    ...(options.providerState ? { providerState: options.providerState } : {}),
+    status: 'action-required',
+    statusReason: {
+      code: 'subsidy_failed',
+      message: 'Destination subsidy settlement is unavailable.',
+    },
+  })
+  if (result.type !== 'applied') throw new Error('Failed to seed action-required transfer.')
+  return result.record
+}
+
+declare namespace seedActionRequiredTransfer {
+  /** Private state attached while entering `action-required`. */
+  type Options = {
+    /** Replacement provider state, such as a persisted subsidy transaction. */
+    providerState?: Transfer.ProviderState | undefined
+  }
+}
+
 async function seedDeposit(
   db: Db.Db,
   orgId: string,

package/src/admin/apps/routes.ts

@@ -13,6 +13,7 @@ import * as Cursor from '../../internal/Cursor.js'
 import * as Deposit from '../../internal/routes/Deposit.js'
 import * as DepositAddress from '../../internal/routes/DepositAddress.js'
 import * as Provider from '../../internal/routes/Provider.js'
+import * as Observability from '../../internal/routes/Observability.js'
 import * as Transfer from '../../internal/routes/Transfer.js'
 import * as OpenApi from '../../internal/OpenApi.js'
 import * as Response from '../../internal/Response.js'
@@ -323,6 +324,7 @@ export namespace schema {
             }),
           )
           .check(z.describe('Material lifecycle events, oldest first.')),
+        providerRequestIds: correlationIds,
         transactions: z
           .array(
             z.object({
@@ -344,6 +346,24 @@ export namespace schema {
     )
   }
 
+  /** Schemas for retrying one stuck route transfer. */
+  export namespace retryRoutesTransfer {
+    /** Transfer path parameters. */
+    export const Params = getRoutesTransfer.Params
+
+    /** Expected transfer version. */
+    export const Body = z
+      .strictObject({
+        version: z
+          .number()
+          .check(z.int(), z.minimum(1), z.describe('Transfer version the operator reviewed.'), z.meta({ examples: [22] })), // prettier-ignore
+      })
+      .check(z.describe('Route transfer retry request.'))
+
+    /** Retried route transfer, back in `processing`. */
+    export const Response = RoutesTransfer
+  }
+
   /** Schemas for listing deposit addresses. */
   export namespace listRoutesDepositAddresses {
     /** Deposit-address filters and pagination. */
@@ -438,7 +458,7 @@ export namespace schema {
   }
 }
 
-/** Read-only routes operations for authenticated administrators. */
+/** Routes operations for authenticated administrators. */
 export function routes() {
   return new Hono<App.Environment>()
     .get(
@@ -601,6 +621,12 @@ export function routes() {
               ...(event.snapshot.statusReason ? { statusReason: event.snapshot.statusReason } : {}),
               version: event.version,
             })),
+            providerRequestIds:
+              record.snapshot.provider.id === 'relay' &&
+              typeof record.providerState?.['requestId'] === 'string' &&
+              record.providerState['requestId'].length > 0
+                ? [record.providerState['requestId']]
+                : [],
             transactions: transactions.map(({ chainId, createdAt, role, transactionRef }) => ({
               chainId,
               createdAt,
@@ -612,6 +638,76 @@ export function routes() {
         )
       },
     )
+    .post(
+      '/transfers/:id/retry',
+      OpenApi.validate('param', schema.retryRoutesTransfer.Params, {
+        code: 'param_invalid',
+        message: 'Invalid path parameters',
+      }),
+      OpenApi.validate('json', schema.retryRoutesTransfer.Body, {
+        code: 'body_invalid',
+        message: 'Invalid request body',
+      }),
+      OpenApi.describeRoute({
+        operationId: 'retryAdminRoutesTransfer',
+        responses: OpenApi.responses({
+          errors: {
+            404: 'Route transfer not found.',
+            409: 'Route transfer changed or cannot be retried.',
+          },
+          success: {
+            description: 'The retried route transfer.',
+            schema: schema.retryRoutesTransfer.Response,
+          },
+        }),
+        summary: 'Retry route transfer',
+        tags: ['Routes'],
+      }),
+      async (c) => {
+        const db = Db.get(c.get('db'))
+        // The worker's reconciliation sweep dispatches every `processing` transfer on its next tick.
+        const result = await Transfer.retry(db, {
+          expectedVersion: c.req.valid('json').version,
+          id: c.req.valid('param').id,
+        })
+        if (result.type === 'not_found')
+          return Response.error(c, {
+            code: 'routes_transfer_not_found',
+            message: 'Route transfer not found.',
+            status: 404,
+          })
+        if (result.type === 'stale')
+          return Response.error(c, {
+            code: 'version_conflict',
+            message: 'Route transfer version is stale.',
+            status: 409,
+          })
+        if (result.type === 'invalid')
+          return Response.error(c, {
+            code: 'routes_transfer_not_retryable',
+            message: 'Only action-required transfers can be retried.',
+            status: 409,
+          })
+        if (result.type === 'subsidy_pending')
+          return Response.error(c, {
+            code: 'routes_transfer_subsidy_pending',
+            message: 'Route transfer has a prepared or signed subsidy; verify it on chain first.',
+            status: 409,
+          })
+        Observability.recordTransfer(c.get('metrics'), {
+          previous: result.previous,
+          record: result.record,
+        })
+        const attribution = await loadAttribution(db, [result.record])
+        return c.json(
+          Response.validated(
+            schema.retryRoutesTransfer.Response,
+            serializeTransfer(result.record, attribution),
+          ),
+          200,
+        )
+      },
+    )
     .get(
       '/deposit-addresses',
       OpenApi.validate('query', schema.listRoutesDepositAddresses.Query, {

package/src/admin/apps/scopes.test.ts

@@ -55,7 +55,7 @@ describe('GET /scopes', () => {
             "selfServe": false,
           },
           {
-            "description": "Legacy reward eligibility write scope retained for existing keys; registration requires wildcard access.",
+            "description": "Register wallet and Earn vault reward eligibility associations.",
             "scope": "rewards:write",
             "selfServe": false,
           },

package/src/admin/apps/verified-tokens.test.ts

@@ -390,6 +390,38 @@ describe('GET /verified-tokens/requests', () => {
     const reviewedBody = await TestApp.json(reviewed, Verified.schema.listVerifiedTokenRequests.Response) // prettier-ignore
     expect(reviewedBody.data.map(({ id }) => id)).toEqual([denied!.id])
   })
+
+  test('paginates maximum-size queue rows five at a time', async () => {
+    const { client, db } = TestAdmin.setup()
+    const logo = `<svg>${'x'.repeat(256 * 1024 - 11)}</svg>`
+    for (let index = 1; index <= 6; index++)
+      await VerifiedTokenRequests.create(db, {
+        ...requestInput,
+        address: `0x${index.toString(16).padStart(40, '0')}`,
+        logo,
+        symbol: `T${index}`,
+      })
+
+    const firstResponse = await client['verified-tokens'].requests.$get({ query: { limit: '50' } })
+    const first = await TestApp.json(
+      firstResponse,
+      Verified.schema.listVerifiedTokenRequests.Response,
+    )
+    expect(first.data).toHaveLength(5)
+    expect(first.data.every((request) => request.logo?.length === 256 * 1024)).toBe(true)
+    expect(first.nextCursor).toEqual(expect.any(String))
+
+    const secondResponse = await client['verified-tokens'].requests.$get({
+      query: { cursor: first.nextCursor!, limit: '50' },
+    })
+    const second = await TestApp.json(
+      secondResponse,
+      Verified.schema.listVerifiedTokenRequests.Response,
+    )
+    expect(second.data).toHaveLength(1)
+    expect(second.nextCursor).toBeNull()
+    expect(new Set([...first.data, ...second.data].map(({ id }) => id)).size).toBe(6)
+  })
 })
 
 describe('POST /verified-tokens/requests/:requestId/approve', () => {

package/src/admin/apps/verified-tokens.ts

@@ -2,6 +2,7 @@ import { type Context, Hono } from 'hono'
 import * as z from 'zod/mini'
 
 import * as AssetResponse from '../../internal/AssetResponse.js'
+import * as Cursor from '../../internal/Cursor.js'
 import * as OpenApi from '../../internal/OpenApi.js'
 import * as Response from '../../internal/Response.js'
 import * as Schema from '../../internal/Schema.js'
@@ -15,6 +16,8 @@ import type * as App from '../App.js'
 
 /** Required `chainId` query: admin mutations always address a chain explicitly. */
 const ChainIdQuery = Schema.ChainId
+/** Maximum rows per review-queue response, bounding inline SVG payloads to 1.25 MiB. */
+const maxRequestPage = 5
 
 /** Zod schemas owned by the admin verified-tokens handler. */
 export namespace schema {
@@ -157,6 +160,16 @@ export namespace schema {
     /** Query parameters for the request queue. */
     export const Query = z
       .strictObject({
+        cursor: Schema.Cursor,
+        limit: z
+          .pipe(
+            Schema.Limit,
+            z.transform((value) => Math.min(value, maxRequestPage)),
+          )
+          .check(
+            z.describe(`How many requests to return (5 maximum, default ${maxRequestPage}).`),
+            z.meta({ examples: [maxRequestPage] }),
+          ),
         status: z
           ._default(z.enum(['approved', 'denied', 'pending']), 'pending')
           .check(z.describe('Review status to filter by.')),
@@ -167,8 +180,9 @@ export namespace schema {
     export const Response = Schema.describe(
       z.object({
         data: z.array(Request).check(z.describe('Requests in the selected status, oldest first.')),
+        nextCursor: Schema.NextCursor,
       }),
-      'Verified-token requests in review-queue order.',
+      'A page of verified-token requests in review-queue order.',
     )
   }
 
@@ -558,14 +572,26 @@ export function verifiedTokens() {
         }),
         async (c) => {
           const db = Db.get(c.get('db'))
-          const { status } = c.req.valid('query')
-          const records = await VerifiedTokenRequests.listByStatus(db, status)
+          const { cursor, limit, status } = c.req.valid('query')
+          const decoded = cursor ? Cursor.decode(cursor, ['timestamp', 'id']) : undefined
+          const records = await VerifiedTokenRequests.listByStatus(db, status, {
+            ...(decoded
+              ? { cursor: { createdAt: String(decoded[0]), id: String(decoded[1]) } }
+              : {}),
+            limit: limit + 1,
+          })
+          const page = Cursor.paginate({
+            key: (record) => [record.createdAt, record.id],
+            limit,
+            rows: records,
+          })
           return c.json(
             Response.validated(schema.listVerifiedTokenRequests.Response, {
-              data: records.map((record) => ({
+              data: page.rows.map((record) => ({
                 ...VerifiedTokenRequests.toRequest(record),
                 orgName: record.orgName,
               })),
+              nextCursor: page.nextCursor,
             }),
           )
         },

package/src/admin/index.ts

@@ -1,2 +1 @@
-export * as Access from './Access.js'
 export * as App from './App.js'

package/src/admin/ui/plugin.ts

@@ -23,7 +23,8 @@ const outFile = path.join(here, '..', 'ui.generated.ts')
 // Total gzipped budget for the whole UI; the React + TanStack + Regen baseline
 // is heavier than a hand-rolled SPA, so fail loudly before it bloats the
 // package. Raise deliberately (and revisit code-splitting) if it trips.
-const maxGzipBytes = 486_000
+// Includes the independently added route-policy and route-support screens.
+const maxGzipBytes = 500_000
 
 const contentTypes: Record<string, string> = {
   '.css': 'text/css; charset=utf-8',

package/src/admin/ui/src/components/Dialog.tsx

@@ -9,7 +9,7 @@ function Popup(props: { children: ReactNode; className?: string | undefined }) {
       <Base.Backdrop className="fixed inset-0 z-40 bg-black/60 transition-opacity duration-150 data-[ending-style]:opacity-0 data-[starting-style]:opacity-0" />
       <Base.Popup
         className={cx(
-          'fixed left-1/2 top-1/2 z-50 w-[calc(100vw-2rem)] max-w-md -translate-x-1/2 -translate-y-1/2 border border-border bg-surface p-6 shadow-lg outline-none transition-opacity duration-150 data-[ending-style]:opacity-0 data-[starting-style]:opacity-0',
+          'fixed left-1/2 top-1/2 z-50 w-[calc(100vw-2rem)] max-w-3xl -translate-x-1/2 -translate-y-1/2 border border-border bg-surface p-6 shadow-lg outline-none transition-opacity duration-150 data-[ending-style]:opacity-0 data-[starting-style]:opacity-0',
           props.className,
         )}
       >

package/src/admin/ui/src/components/EarnVaultForm.tsx

@@ -30,6 +30,51 @@ export function EarnVaultForm(options: EarnVaultForm.Props) {
 }
 
 export namespace EarnVaultForm {
+  /** Per-vault incoming reward counterparties. */
+  export function Earnings(options: Earnings.Props) {
+    return (
+      <fieldset className="group flex min-w-0 flex-col gap-3 border-t border-border pt-5 max-sm:[&_textarea]:text-copy-16">
+        <legend className="text-label-14 text-foreground">Earnings accounting</legend>
+        <label className="flex items-center gap-2 text-label-13 text-foreground">
+          <input
+            className="size-5 shrink-0 sm:size-4"
+            defaultChecked={options.value === null}
+            name="inheritEarnings"
+            type="checkbox"
+          />
+          Use recorded campaign distributors only
+        </label>
+        <p className="text-copy-16 text-foreground-secondary sm:text-copy-14">
+          Recorded campaign distributors are always included. Outgoing shares count as withdrawals
+          for every recipient or spender, with no configuration required.
+        </p>
+        <div className="flex flex-col gap-3 group-has-checked:hidden">
+          <p className="text-copy-16 text-foreground-secondary sm:text-copy-14">
+            Add dedicated reward distributors for this vault. You do not need to copy recorded
+            campaign distributors, including historical ones.
+          </p>
+          <Textarea
+            defaultValue={options.value?.rewardDistributors.join('\n')}
+            label="Additional reward distributors"
+            name="rewardDistributors"
+            placeholder="One address per line"
+            rows={5}
+            spellCheck={false}
+          />
+          <p className="text-copy-16 text-foreground-secondary sm:text-copy-14">
+            Shares received from these addresses count as earnings. Do not add card spenders or
+            refund handlers: returned shares could be incorrectly counted as rewards.
+          </p>
+        </div>
+      </fieldset>
+    )
+  }
+
+  export namespace Earnings {
+    /** Saved settings, or null for campaign defaults. */
+    export type Props = { value: EarnVaults.Vault['earnings'] }
+  }
+
   /** Props for the verified-vault form shell. */
   export type Props = {
     /** Primary form action. */

package/src/admin/ui/src/components/RoutePicker.tsx

@@ -0,0 +1,79 @@
+import { useState } from 'react'
+import { Button, Select, cx } from 'regen-ui'
+
+import * as Policies from '../lib/route-policies.js'
+
+/** Adds complete catalog routes through mutually filtered network, token, and provider choices. */
+export function RoutePicker(options: RoutePicker.Props) {
+  const [selection, setSelection] = useState<Policies.RouteSelection>({})
+  const rule = selection.providerId ? Policies.selectedRoute(selection) : undefined
+  const duplicate =
+    rule &&
+    options.selected.some((selected) =>
+      fields.every(({ field }) => selected[field] === rule[field]),
+    )
+  return (
+    <fieldset
+      aria-label={`Add ${options.label.toLowerCase()} route`}
+      className={cx('@container flex min-w-0 flex-col gap-3', options.className)}
+    >
+      <div className="grid gap-3 @sm:grid-cols-2 @3xl:grid-cols-5">
+        {fields.map(({ field, label, placeholder }) => (
+          <label
+            className="flex min-w-0 flex-col gap-2 text-label-12 text-foreground-secondary"
+            key={field}
+          >
+            {label}
+            <Select
+              aria-label={label}
+              className="w-full min-w-0"
+              items={[
+                { label: placeholder, value: '' },
+                ...Policies.routeOptions(options.routes, selection, field),
+              ]}
+              onChange={(value) =>
+                setSelection((current) => ({ ...current, [field]: value || undefined }))
+              }
+              value={selection[field] ?? ''}
+            />
+          </label>
+        ))}
+      </div>
+      <div className="flex flex-wrap items-center justify-between gap-3">
+        <p className="text-copy-16 text-foreground-secondary sm:text-copy-14">
+          {duplicate
+            ? 'This route is already included.'
+            : 'Choose in any order. Clear a field to broaden the other choices.'}
+        </p>
+        <Button
+          disabled={!rule || duplicate}
+          onClick={() => {
+            if (!rule) return
+            options.onAdd(rule)
+          }}
+          type="button"
+        >
+          Add route
+        </Button>
+      </div>
+    </fieldset>
+  )
+}
+
+declare namespace RoutePicker {
+  type Props = {
+    className?: string | undefined
+    label: string
+    onAdd: (rule: Policies.Rule) => void
+    routes: Policies.Payload['routes']
+    selected: readonly Policies.Rule[]
+  }
+}
+
+const fields = [
+  { field: 'sourceChainId', label: 'Source network', placeholder: 'Choose network' },
+  { field: 'sourceTokenId', label: 'Source token', placeholder: 'Choose token' },
+  { field: 'destinationChainId', label: 'Destination network', placeholder: 'Choose network' },
+  { field: 'destinationTokenId', label: 'Destination token', placeholder: 'Choose token' },
+  { field: 'providerId', label: 'Provider', placeholder: 'Choose provider' },
+] as const

package/src/admin/ui/src/lib/earn-vaults.ts

@@ -18,7 +18,7 @@ export type Vault = DetailResponse &
 type ListResponse = Omit<BaseListResponse, 'data'> & { data: readonly Vault[] }
 
 type InsertRequest = InferRequestType<(typeof client)['earn']['verified-vaults']['$put']>['json']
-const include = 'access,capabilities,zone' as const
+const include = 'access,capabilities,zone,zones' as const
 
 /** A chain id managed by the Earn registry UI. */
 export type ChainId = typeof mainnet.id | typeof testnet.id