tapimo 0.15.1 → 0.18.0

package/dist/cli/commands/admin.d.ts

@@ -4,7 +4,7 @@ import { Cli as incur_Cli } from 'incur';
  * than the hosted API (database migrations, …).
  */
 export declare const admin: incur_Cli.Cli<{
-    [x: `${string} ${string}`]: {
+    "audit-reward-accounts": {
         args: {};
         options: {
             apply: boolean;
@@ -17,7 +17,7 @@ export declare const admin: incur_Cli.Cli<{
         };
     };
 } & {
-    [x: `${string} ${string}`]: {
+    "credit-reward-accounts": {
         args: {};
         options: {
             apply: boolean;
@@ -30,7 +30,7 @@ export declare const admin: incur_Cli.Cli<{
         };
     };
 } & {
-    [x: `${string} ${string}`]: {
+    "import-reward-eligibility": {
         args: {};
         options: {
             apply: boolean;
@@ -40,7 +40,7 @@ export declare const admin: incur_Cli.Cli<{
         };
     };
 } & {
-    [x: `${string} ${string}`]: {
+    migrate: {
         args: {};
         options: {
             clickhouseDatabase?: string | undefined;
@@ -51,5 +51,5 @@ export declare const admin: incur_Cli.Cli<{
             dbSchema?: string | undefined;
         };
     };
-}, undefined, undefined, undefined>;
+}, undefined, undefined, undefined, "admin">;
 //# sourceMappingURL=admin.d.ts.map

package/dist/cli/commands/admin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/admin.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,GAAG,IAAI,SAAS,EAAK,MAAM,OAAO,CAAA;AA6X3C;;;GAGG;AACH,eAAO,MAAM,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mCAOC,CAAA"}
+{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/admin.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,GAAG,IAAI,SAAS,EAAK,MAAM,OAAO,CAAA;AA6X3C;;;GAGG;AACH,eAAO,MAAM,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4CAOC,CAAA"}

package/dist/cli/commands/auth.d.ts

@@ -0,0 +1,73 @@
+import { Cli as incur_Cli } from 'incur';
+import type * as Client from '../../Client.js';
+import type * as Credentials from '../Credentials.js';
+/** Context shared by the session commands. */
+export type Context = {
+    /** Typed Tempo API client. */
+    api: Client.Client;
+    /** Tempo API origin; stored sessions are keyed by it. */
+    apiUrl: URL;
+    /** Stored CLI sessions. */
+    credentials: Credentials.Store;
+    /** Sends a raw request to the Tempo API, for routes outside the typed client. */
+    fetch: (request: Request) => Promise<Response>;
+    /** CLI name and version reported to the approving user (`tempo api 0.1.0`). */
+    name: string;
+};
+/** Signs in by approving this device in the console, then stores the CLI session. */
+export declare function login(context: login.Options): incur_Cli.Cli<{
+    login: {
+        args: {};
+        options: {
+            browser?: boolean | undefined;
+        };
+    };
+}, undefined, undefined, undefined, "login">;
+export declare namespace login {
+    /** Options for {@link login}. */
+    type Options = Context & {
+        /** Opens the approval page. Defaults to the platform browser opener. */
+        open?: ((url: string) => void) | undefined;
+    };
+}
+/** Revokes and forgets the stored CLI session. */
+export declare function logout(context: Context): incur_Cli.Cli<{
+    logout: {
+        args: {};
+        options: {};
+    };
+}, undefined, undefined, undefined, "logout">;
+/** Shows the account the stored CLI session acts as. */
+export declare function whoami(context: Context): incur_Cli.Cli<{
+    whoami: {
+        args: {};
+        options: {};
+    };
+}, undefined, undefined, undefined, "whoami">;
+/** Error returned when no unexpired CLI session is stored. */
+export declare function signedOut(): {
+    code: string;
+    cta: {
+        commands: {
+            command: string;
+            description: string;
+        }[];
+    };
+    message: string;
+};
+/** Request options carrying a CLI session token. */
+export declare function bearer(token: string): {
+    headers: {
+        authorization: string;
+    };
+};
+/** The response surface {@link errorMessage} reads, shared by fetch and typed-client responses. */
+export type ErrorResponse = {
+    /** Parses the body as JSON. */
+    json(): Promise<unknown>;
+    /** HTTP status code. */
+    status: number;
+};
+/** Reads the API error envelope's message, falling back to a status line. */
+export declare function errorMessage(response: ErrorResponse, fallback: string): Promise<string>;
+//# sourceMappingURL=auth.d.ts.map

package/dist/cli/commands/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/auth.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,GAAG,IAAI,SAAS,EAAK,MAAM,OAAO,CAAA;AAG3C,OAAO,KAAK,KAAK,MAAM,MAAM,iBAAiB,CAAA;AAE9C,OAAO,KAAK,KAAK,WAAW,MAAM,mBAAmB,CAAA;AAGrD,8CAA8C;AAC9C,MAAM,MAAM,OAAO,GAAG;IACpB,8BAA8B;IAC9B,GAAG,EAAE,MAAM,CAAC,MAAM,CAAA;IAClB,yDAAyD;IACzD,MAAM,EAAE,GAAG,CAAA;IACX,2BAA2B;IAC3B,WAAW,EAAE,WAAW,CAAC,KAAK,CAAA;IAC9B,iFAAiF;IACjF,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC9C,+EAA+E;IAC/E,IAAI,EAAE,MAAM,CAAA;CACb,CAAA;AAED,qFAAqF;AACrF,wBAAgB,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO;;;;;;;6CA+G3C;AAED,MAAM,CAAC,OAAO,WAAW,KAAK,CAAC;IAC7B,iCAAiC;IACjC,KAAK,OAAO,GAAG,OAAO,GAAG;QACvB,wEAAwE;QACxE,IAAI,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,SAAS,CAAA;KAC3C,CAAA;CACF;AAED,kDAAkD;AAClD,wBAAgB,MAAM,CAAC,OAAO,EAAE,OAAO;;;;;8CAgBtC;AAED,wDAAwD;AACxD,wBAAgB,MAAM,CAAC,OAAO,EAAE,OAAO;;;;;8CA2BtC;AAED,8DAA8D;AAC9D,wBAAgB,SAAS;;;;;;;;;EAMxB;AAED,oDAAoD;AACpD,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM;IACzB,OAAO;QAAI,aAAa;;EAClC;AAED,mGAAmG;AACnG,MAAM,MAAM,aAAa,GAAG;IAC1B,+BAA+B;IAC/B,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;IACxB,wBAAwB;IACxB,MAAM,EAAE,MAAM,CAAA;CACf,CAAA;AAED,6EAA6E;AAC7E,wBAAsB,YAAY,CAAC,QAAQ,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,mBAK3E"}

package/dist/cli/commands/auth.js

@@ -0,0 +1,204 @@
+import * as child_process from 'node:child_process';
+import * as os from 'node:os';
+import { Cli as incur_Cli, z } from 'incur';
+import { Base64, Bytes } from 'ox';
+import * as CliAuth from '../../internal/CliAuth.js';
+import * as ApiKeys from '../ApiKeys.js';
+/** Signs in by approving this device in the console, then stores the CLI session. */
+export function login(context) {
+    const { api, apiUrl, credentials, name, open = openExternal } = context;
+    const authorizations = api.v1.cli.authorizations;
+    return incur_Cli.create('login', {
+        description: 'Sign in by approving this device in the Tempo console.',
+        options: z.object({
+            browser: z
+                .boolean()
+                .optional()
+                .describe('Open the approval page in a browser. Defaults to true in a terminal; pass --no-browser on remote hosts.'),
+        }),
+        async *run(c) {
+            const codeVerifier = Base64.fromBytes(Bytes.random(32), { pad: false, url: true });
+            const started = await authorizations.$post({
+                json: {
+                    codeChallenge: CliAuth.challengeFrom(codeVerifier),
+                    device: os.hostname().slice(0, 100),
+                    name,
+                },
+            });
+            if (started.status !== 200)
+                return c.error({
+                    code: 'login_failed',
+                    message: await errorMessage(started, 'Could not start sign-in'),
+                    retryable: started.status >= 500 || started.status === 429,
+                });
+            const { code, expiresAt, interval, verificationUrl } = await started.json();
+            if (c.agent)
+                yield { code, expiresAt, verificationUrl };
+            else
+                yield `Confirm code ${code} at ${verificationUrl}`;
+            if (c.options.browser ?? !c.agent)
+                open(verificationUrl);
+            if (!c.agent)
+                yield 'Waiting for approval…';
+            const deadline = Date.parse(expiresAt);
+            let delay = interval * 1_000;
+            while (Date.now() < deadline) {
+                await new Promise((resolve) => setTimeout(resolve, delay));
+                const response = await authorizations[':code{[A-Za-z -]+}'].token.$post({
+                    json: { codeVerifier },
+                    param: { code },
+                });
+                // Back off when the shared per-IP limit trips instead of failing the sign-in.
+                if (response.status === 429) {
+                    delay += 5_000;
+                    continue;
+                }
+                if (response.status === 404)
+                    break;
+                if (response.status !== 200)
+                    return c.error({
+                        code: 'login_failed',
+                        message: await errorMessage(response, 'Could not complete sign-in'),
+                        retryable: response.status >= 500,
+                    });
+                const body = await response.json();
+                if (body.status === 'pending')
+                    continue;
+                if (body.status === 'denied')
+                    return c.error({
+                        code: 'login_denied',
+                        message: 'The sign-in was denied in the console.',
+                    });
+                const me = await api.v1.me.$get(undefined, bearer(body.token));
+                if (me.status !== 200) {
+                    const message = await errorMessage(me, 'Could not load your account');
+                    // The new session is live but unsaved, so revoke it rather than leave it behind.
+                    await revoke(context, { token: body.token });
+                    return c.error({ code: 'login_failed', message, retryable: true });
+                }
+                const user = await me.json();
+                const replace = async (store) => {
+                    const previous = await store.get(apiUrl);
+                    await store.set(apiUrl, {
+                        ...(user.email ? { email: user.email } : {}),
+                        expiresAt: body.expiresAt,
+                        scopes: body.scopes,
+                        token: body.token,
+                        userId: user.id,
+                    });
+                    // The replaced session would otherwise stay valid server-side with no local copy to revoke.
+                    if (previous) {
+                        await ApiKeys.revoke(context, previous);
+                        await revoke(context, { token: previous.token });
+                    }
+                };
+                await (credentials.withLock ? credentials.withLock(replace) : replace(credentials));
+                // Streaming commands only emit yielded chunks, so the result is the last chunk.
+                if (c.agent)
+                    yield {
+                        apiUrl: apiUrl.origin,
+                        ...(user.email ? { email: user.email } : {}),
+                        expiresAt: body.expiresAt,
+                    };
+                else
+                    yield `Signed in${user.email ? ` as ${user.email}` : ''}.`;
+                return c.ok(undefined, {
+                    cta: {
+                        commands: [
+                            { command: 'keys create', description: 'Create an API key' },
+                            { command: 'whoami', description: 'Show the signed-in account' },
+                        ],
+                    },
+                });
+            }
+            return c.error({
+                code: 'login_expired',
+                cta: { commands: [{ command: 'login', description: 'Start a new sign-in' }] },
+                message: 'The sign-in expired before it was approved.',
+            });
+        },
+    });
+}
+/** Revokes and forgets the stored CLI session. */
+export function logout(context) {
+    const { apiUrl, credentials } = context;
+    return incur_Cli.create('logout', {
+        description: 'Sign out and revoke the stored CLI session.',
+        async run() {
+            async function remove(store) {
+                const session = await store.get(apiUrl);
+                const keysRevoked = session ? await ApiKeys.revoke(context, session) : true;
+                const revoked = session ? await revoke(context, { token: session.token }) : false;
+                // Forget the token even when revocation fails; it expires server-side on its own.
+                await store.remove(apiUrl);
+                return { apiUrl: apiUrl.origin, keysRevoked, revoked, signedOut: true };
+            }
+            return credentials.withLock ? credentials.withLock(remove) : remove(credentials);
+        },
+    });
+}
+/** Shows the account the stored CLI session acts as. */
+export function whoami(context) {
+    const { api, apiUrl, credentials } = context;
+    return incur_Cli.create('whoami', {
+        description: 'Show the signed-in account.',
+        async run(c) {
+            const session = await credentials.get(apiUrl);
+            if (!session)
+                return c.error(signedOut());
+            const response = await api.v1.me.$get(undefined, bearer(session.token));
+            if (response.status === 401) {
+                await credentials.remove(apiUrl);
+                return c.error(signedOut());
+            }
+            if (response.status !== 200)
+                return c.error({
+                    code: 'request_failed',
+                    message: await errorMessage(response, 'Could not load your account'),
+                    retryable: response.status >= 500,
+                });
+            const user = await response.json();
+            return {
+                apiUrl: apiUrl.origin,
+                ...(user.email ? { email: user.email } : {}),
+                expiresAt: session.expiresAt,
+                userId: user.id,
+            };
+        },
+    });
+}
+/** Error returned when no unexpired CLI session is stored. */
+export function signedOut() {
+    return {
+        code: 'not_signed_in',
+        cta: { commands: [{ command: 'login', description: 'Sign in' }] },
+        message: 'Not signed in, or the session expired.',
+    };
+}
+/** Request options carrying a CLI session token. */
+export function bearer(token) {
+    return { headers: { authorization: `Bearer ${token}` } };
+}
+/** Reads the API error envelope's message, falling back to a status line. */
+export async function errorMessage(response, fallback) {
+    const body = (await response.json().catch(() => undefined));
+    return body?.error?.message ?? `${fallback} (HTTP ${response.status}).`;
+}
+/** Revokes a CLI session server-side, resolving `true` once the API confirms. */
+async function revoke(context, options) {
+    const { apiUrl, fetch } = context;
+    // The sign-out route is outside the typed client surface; keep any API base path.
+    const url = new URL(apiUrl);
+    url.pathname = `${apiUrl.pathname.replace(/\/$/, '')}/v1/auth/logout`;
+    const response = await fetch(new Request(url, { ...bearer(options.token), method: 'POST' })).catch(() => undefined);
+    return response?.status === 204;
+}
+// Best effort: the URL is already printed, so a missing opener (headless boxes) is not an error.
+function openExternal(url) {
+    const command = process.platform === 'darwin' ? 'open' : process.platform === 'win32' ? 'cmd' : 'xdg-open';
+    const args = process.platform === 'win32' ? ['/c', 'start', '', url] : [url];
+    const child = child_process.spawn(command, args, { detached: true, stdio: 'ignore' });
+    child.on('error', () => undefined);
+    child.unref();
+}
+//# sourceMappingURL=auth.js.map

package/dist/cli/commands/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/cli/commands/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAA;AACnD,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,EAAE,GAAG,IAAI,SAAS,EAAE,CAAC,EAAE,MAAM,OAAO,CAAA;AAC3C,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,IAAI,CAAA;AAGlC,OAAO,KAAK,OAAO,MAAM,2BAA2B,CAAA;AAEpD,OAAO,KAAK,OAAO,MAAM,eAAe,CAAA;AAgBxC,qFAAqF;AACrF,MAAM,UAAU,KAAK,CAAC,OAAsB;IAC1C,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,GAAG,YAAY,EAAE,GAAG,OAAO,CAAA;IACvE,MAAM,cAAc,GAAG,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,cAAc,CAAA;IAChD,OAAO,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE;QAC/B,WAAW,EAAE,wDAAwD;QACrE,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;YAChB,OAAO,EAAE,CAAC;iBACP,OAAO,EAAE;iBACT,QAAQ,EAAE;iBACV,QAAQ,CACP,yGAAyG,CAC1G;SACJ,CAAC;QACF,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC;YACV,MAAM,YAAY,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAA;YAClF,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC;gBACzC,IAAI,EAAE;oBACJ,aAAa,EAAE,OAAO,CAAC,aAAa,CAAC,YAAY,CAAC;oBAClD,MAAM,EAAE,EAAE,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBACnC,IAAI;iBACL;aACF,CAAC,CAAA;YACF,IAAI,OAAO,CAAC,MAAM,KAAK,GAAG;gBACxB,OAAO,CAAC,CAAC,KAAK,CAAC;oBACb,IAAI,EAAE,cAAc;oBACpB,OAAO,EAAE,MAAM,YAAY,CAAC,OAAO,EAAE,yBAAyB,CAAC;oBAC/D,SAAS,EAAE,OAAO,CAAC,MAAM,IAAI,GAAG,IAAI,OAAO,CAAC,MAAM,KAAK,GAAG;iBAC3D,CAAC,CAAA;YACJ,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAA;YAE3E,IAAI,CAAC,CAAC,KAAK;gBAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,eAAe,EAAE,CAAA;;gBAClD,MAAM,gBAAgB,IAAI,OAAO,eAAe,EAAE,CAAA;YACvD,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK;gBAAE,IAAI,CAAC,eAAe,CAAC,CAAA;YACxD,IAAI,CAAC,CAAC,CAAC,KAAK;gBAAE,MAAM,uBAAuB,CAAA;YAE3C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;YACtC,IAAI,KAAK,GAAG,QAAQ,GAAG,KAAK,CAAA;YAC5B,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;gBAC7B,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAA;gBAC1D,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,oBAAoB,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC;oBACtE,IAAI,EAAE,EAAE,YAAY,EAAE;oBACtB,KAAK,EAAE,EAAE,IAAI,EAAE;iBAChB,CAAC,CAAA;gBACF,8EAA8E;gBAC9E,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBAC5B,KAAK,IAAI,KAAK,CAAA;oBACd,SAAQ;gBACV,CAAC;gBACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;oBAAE,MAAK;gBAClC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;oBACzB,OAAO,CAAC,CAAC,KAAK,CAAC;wBACb,IAAI,EAAE,cAAc;wBACpB,OAAO,EAAE,MAAM,YAAY,CAAC,QAAQ,EAAE,4BAA4B,CAAC;wBACnE,SAAS,EAAE,QAAQ,CAAC,MAAM,IAAI,GAAG;qBAClC,CAAC,CAAA;gBACJ,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;gBAClC,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;oBAAE,SAAQ;gBACvC,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ;oBAC1B,OAAO,CAAC,CAAC,KAAK,CAAC;wBACb,IAAI,EAAE,cAAc;wBACpB,OAAO,EAAE,wCAAwC;qBAClD,CAAC,CAAA;gBAEJ,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;gBAC9D,IAAI,EAAE,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBACtB,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,EAAE,EAAE,6BAA6B,CAAC,CAAA;oBACrE,iFAAiF;oBACjF,MAAM,MAAM,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAA;oBAC5C,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;gBACpE,CAAC;gBACD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAA;gBAC5B,MAAM,OAAO,GAAG,KAAK,EAAE,KAAwB,EAAE,EAAE;oBACjD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;oBACxC,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE;wBACtB,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBAC5C,SAAS,EAAE,IAAI,CAAC,SAAS;wBACzB,MAAM,EAAE,IAAI,CAAC,MAAM;wBACnB,KAAK,EAAE,IAAI,CAAC,KAAK;wBACjB,MAAM,EAAE,IAAI,CAAC,EAAE;qBAChB,CAAC,CAAA;oBACF,4FAA4F;oBAC5F,IAAI,QAAQ,EAAE,CAAC;wBACb,MAAM,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;wBACvC,MAAM,MAAM,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAA;oBAClD,CAAC;gBACH,CAAC,CAAA;gBACD,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAA;gBACnF,gFAAgF;gBAChF,IAAI,CAAC,CAAC,KAAK;oBACT,MAAM;wBACJ,MAAM,EAAE,MAAM,CAAC,MAAM;wBACrB,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBAC5C,SAAS,EAAE,IAAI,CAAC,SAAS;qBAC1B,CAAA;;oBACE,MAAM,YAAY,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAA;gBAC/D,OAAO,CAAC,CAAC,EAAE,CAAC,SAAS,EAAE;oBACrB,GAAG,EAAE;wBACH,QAAQ,EAAE;4BACR,EAAE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,mBAAmB,EAAE;4BAC5D,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,4BAA4B,EAAE;yBACjE;qBACF;iBACF,CAAC,CAAA;YACJ,CAAC;YACD,OAAO,CAAC,CAAC,KAAK,CAAC;gBACb,IAAI,EAAE,eAAe;gBACrB,GAAG,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,CAAC,EAAE;gBAC7E,OAAO,EAAE,6CAA6C;aACvD,CAAC,CAAA;QACJ,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAUD,kDAAkD;AAClD,MAAM,UAAU,MAAM,CAAC,OAAgB;IACrC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,OAAO,CAAA;IACvC,OAAO,SAAS,CAAC,MAAM,CAAC,QAAQ,EAAE;QAChC,WAAW,EAAE,6CAA6C;QAC1D,KAAK,CAAC,GAAG;YACP,KAAK,UAAU,MAAM,CAAC,KAAwB;gBAC5C,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;gBACvC,MAAM,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;gBAC3E,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;gBACjF,kFAAkF;gBAClF,MAAM,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;gBAC1B,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAA;YACzE,CAAC;YACD,OAAO,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;QAClF,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,MAAM,CAAC,OAAgB;IACrC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,OAAO,CAAA;IAC5C,OAAO,SAAS,CAAC,MAAM,CAAC,QAAQ,EAAE;QAChC,WAAW,EAAE,6BAA6B;QAC1C,KAAK,CAAC,GAAG,CAAC,CAAC;YACT,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YAC7C,IAAI,CAAC,OAAO;gBAAE,OAAO,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAA;YACzC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAA;YACvE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC5B,MAAM,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;gBAChC,OAAO,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAA;YAC7B,CAAC;YACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;gBACzB,OAAO,CAAC,CAAC,KAAK,CAAC;oBACb,IAAI,EAAE,gBAAgB;oBACtB,OAAO,EAAE,MAAM,YAAY,CAAC,QAAQ,EAAE,6BAA6B,CAAC;oBACpE,SAAS,EAAE,QAAQ,CAAC,MAAM,IAAI,GAAG;iBAClC,CAAC,CAAA;YACJ,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;YAClC,OAAO;gBACL,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5C,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,MAAM,EAAE,IAAI,CAAC,EAAE;aAChB,CAAA;QACH,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,SAAS;IACvB,OAAO;QACL,IAAI,EAAE,eAAe;QACrB,GAAG,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,EAAE;QACjE,OAAO,EAAE,wCAAwC;KAClD,CAAA;AACH,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,MAAM,CAAC,KAAa;IAClC,OAAO,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,EAAE,CAAA;AAC1D,CAAC;AAUD,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAuB,EAAE,QAAgB;IAC1E,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAE7C,CAAA;IACb,OAAO,IAAI,EAAE,KAAK,EAAE,OAAO,IAAI,GAAG,QAAQ,UAAU,QAAQ,CAAC,MAAM,IAAI,CAAA;AACzE,CAAC;AAED,iFAAiF;AACjF,KAAK,UAAU,MAAM,CAAC,OAAgB,EAAE,OAAuB;IAC7D,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAA;IACjC,kFAAkF;IAClF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;IAC3B,GAAG,CAAC,QAAQ,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,iBAAiB,CAAA;IACrE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAC/D,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;IACxB,OAAO,QAAQ,EAAE,MAAM,KAAK,GAAG,CAAA;AACjC,CAAC;AAUD,iGAAiG;AACjG,SAAS,YAAY,CAAC,GAAW;IAC/B,MAAM,OAAO,GACX,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAA;IAC5F,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;IAC5E,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAA;IACrF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;IAClC,KAAK,CAAC,KAAK,EAAE,CAAA;AACf,CAAC"}

package/dist/cli/commands/keys.d.ts

@@ -0,0 +1,17 @@
+import { Cli as incur_Cli } from 'incur';
+import * as Auth from './auth.js';
+/** API-key commands that act through the stored CLI session. */
+export declare function keys(context: Auth.Context): incur_Cli.Cli<{
+    create: {
+        args: {};
+        options: {
+            allowedIps?: string[] | undefined;
+            env: "production" | "sandbox";
+            name?: string | undefined;
+            org?: string | undefined;
+            project?: string | undefined;
+            scopes: string[];
+        };
+    };
+}, undefined, undefined, undefined, "keys">;
+//# sourceMappingURL=keys.d.ts.map

package/dist/cli/commands/keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,IAAI,SAAS,EAAK,MAAM,OAAO,CAAA;AAE3C,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AAEjC,gEAAgE;AAChE,wBAAgB,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO;;;;;;;;;;;;4CAmHzC"}

package/dist/cli/commands/keys.js

@@ -0,0 +1,109 @@
+import { Cli as incur_Cli, z } from 'incur';
+import * as Auth from './auth.js';
+/** API-key commands that act through the stored CLI session. */
+export function keys(context) {
+    const { api, apiUrl, credentials } = context;
+    // Maps an API failure to a CLI error; an expired session also forgets the stored token.
+    async function failure(response) {
+        if (response.status === 401) {
+            await credentials.remove(apiUrl);
+            return Auth.signedOut();
+        }
+        return {
+            code: 'request_failed',
+            message: await Auth.errorMessage(response, 'The request failed'),
+            retryable: response.status >= 500 || response.status === 429,
+        };
+    }
+    return incur_Cli.create('keys', { description: 'Manage API keys.' }).command('create', {
+        description: 'Create an API key for a project. The key is shown once.',
+        examples: [
+            { description: 'Read key for your only project', options: {} },
+            {
+                description: 'Testnet-only sandbox key for a specific project',
+                options: { env: 'sandbox', project: 'prj_123', scopes: ['data:read'] },
+            },
+        ],
+        options: z.object({
+            allowedIps: z
+                .array(z.string())
+                .optional()
+                .describe('Client IP address or CIDR range allowed to use the key. Repeat for more.'),
+            env: z
+                .enum(['production', 'sandbox'])
+                .default('production')
+                .describe('Key environment. Production keys work on every chain; sandbox keys only on testnets.'),
+            name: z.string().optional().describe('Human-readable key name.'),
+            org: z
+                .string()
+                .optional()
+                .describe('Organization id (org_…). Defaults to your only organization.'),
+            project: z
+                .string()
+                .optional()
+                .describe('Project id (prj_…). Defaults to the only project in the organization.'),
+            scopes: z
+                .array(z.string())
+                .default(['data:read'])
+                .describe('Scope to grant. Repeat for more.'),
+        }),
+        async run(c) {
+            const session = await credentials.get(apiUrl);
+            if (!session)
+                return c.error(Auth.signedOut());
+            const request = Auth.bearer(session.token);
+            const orgs = c.options.org ? undefined : await api.v1.orgs.$get(undefined, request);
+            if (orgs && orgs.status !== 200)
+                return c.error(await failure(orgs));
+            const orgChoices = orgs ? (await orgs.json()).data : [];
+            const orgId = c.options.org ?? (orgChoices.length === 1 ? orgChoices[0].id : undefined);
+            if (!orgId)
+                return c.error(orgChoices.length === 0
+                    ? { code: 'no_organizations', message: 'Create an organization in the Tempo console first.' } // prettier-ignore
+                    : { code: 'organization_required', message: `Pass --org with one of: ${describe(orgChoices)}.` });
+            const org = api.v1.orgs[':orgId{org_[A-Za-z0-9_-]+}'];
+            const projects = c.options.project
+                ? undefined
+                : await org.projects.$get({ param: { orgId } }, request);
+            if (projects && projects.status !== 200)
+                return c.error(await failure(projects));
+            const projectChoices = projects ? (await projects.json()).data : [];
+            const projectId = c.options.project ?? (projectChoices.length === 1 ? projectChoices[0].id : undefined);
+            if (!projectId)
+                return c.error(projectChoices.length === 0
+                    ? { code: 'no_projects', message: 'Create a project in the Tempo console first.' }
+                    : { code: 'project_required', message: `Pass --project with one of: ${describe(projectChoices)}.` });
+            const { allowedIps, env, name, scopes } = c.options;
+            const response = await org.projects[':projectId{prj_[A-Za-z0-9_-]+}']['api-keys'].$post({
+                json: {
+                    ...(allowedIps ? { allowedIps } : {}),
+                    environment: env,
+                    ...(name ? { name } : {}),
+                    scopes,
+                },
+                param: { orgId, projectId },
+            }, request);
+            if (response.status !== 200)
+                return c.error(await failure(response));
+            const key = await response.json();
+            return c.ok({
+                environment: key.environment,
+                id: key.id,
+                ...(key.name ? { name: key.name } : {}),
+                orgId,
+                projectId,
+                scopes: key.scopes,
+                token: key.token,
+            }, {
+                cta: {
+                    commands: [{ command: 'v1 tokens get', description: 'Call the API with TEMPO_API_KEY set' }], // prettier-ignore
+                    description: 'Store the token now; it is not shown again.',
+                },
+            });
+        },
+    });
+}
+function describe(choices) {
+    return choices.map(({ id, name }) => `${id} (${name})`).join(', ');
+}
+//# sourceMappingURL=keys.js.map

package/dist/cli/commands/keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.js","sourceRoot":"","sources":["../../../src/cli/commands/keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,IAAI,SAAS,EAAE,CAAC,EAAE,MAAM,OAAO,CAAA;AAE3C,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AAEjC,gEAAgE;AAChE,MAAM,UAAU,IAAI,CAAC,OAAqB;IACxC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,OAAO,CAAA;IAE5C,wFAAwF;IACxF,KAAK,UAAU,OAAO,CAAC,QAA4B;QACjD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,MAAM,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;YAChC,OAAO,IAAI,CAAC,SAAS,EAAE,CAAA;QACzB,CAAC;QACD,OAAO;YACL,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,oBAAoB,CAAC;YAChE,SAAS,EAAE,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;SAC7D,CAAA;IACH,CAAC;IAED,OAAO,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE;QACrF,WAAW,EAAE,yDAAyD;QACtE,QAAQ,EAAE;YACR,EAAE,WAAW,EAAE,gCAAgC,EAAE,OAAO,EAAE,EAAE,EAAE;YAC9D;gBACE,WAAW,EAAE,iDAAiD;gBAC9D,OAAO,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,WAAW,CAAC,EAAE;aACvE;SACF;QACD,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;YAChB,UAAU,EAAE,CAAC;iBACV,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;iBACjB,QAAQ,EAAE;iBACV,QAAQ,CAAC,0EAA0E,CAAC;YACvF,GAAG,EAAE,CAAC;iBACH,IAAI,CAAC,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;iBAC/B,OAAO,CAAC,YAAY,CAAC;iBACrB,QAAQ,CACP,sFAAsF,CACvF;YACH,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,0BAA0B,CAAC;YAChE,GAAG,EAAE,CAAC;iBACH,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,8DAA8D,CAAC;YAC3E,OAAO,EAAE,CAAC;iBACP,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,uEAAuE,CAAC;YACpF,MAAM,EAAE,CAAC;iBACN,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;iBACjB,OAAO,CAAC,CAAC,WAAW,CAAC,CAAC;iBACtB,QAAQ,CAAC,kCAAkC,CAAC;SAChD,CAAC;QACF,KAAK,CAAC,GAAG,CAAC,CAAC;YACT,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YAC7C,IAAI,CAAC,OAAO;gBAAE,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAA;YAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;YAE1C,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;YACnF,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,CAAC,CAAC,KAAK,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;YACpE,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;YACvD,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;YACxF,IAAI,CAAC,KAAK;gBACR,OAAO,CAAC,CAAC,KAAK,CACZ,UAAU,CAAC,MAAM,KAAK,CAAC;oBACrB,CAAC,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,oDAAoD,EAAE,CAAC,kBAAkB;oBAChH,CAAC,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,2BAA2B,QAAQ,CAAC,UAAU,CAAC,GAAG,EAAE,CACnG,CAAA;YAEH,MAAM,GAAG,GAAG,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAA;YACrD,MAAM,QAAQ,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO;gBAChC,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,CAAC,CAAA;YAC1D,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,CAAC,CAAC,KAAK,CAAC,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAA;YAChF,MAAM,cAAc,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;YACnE,MAAM,SAAS,GACb,CAAC,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;YACxF,IAAI,CAAC,SAAS;gBACZ,OAAO,CAAC,CAAC,KAAK,CACZ,cAAc,CAAC,MAAM,KAAK,CAAC;oBACzB,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,8CAA8C,EAAE;oBAClF,CAAC,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,+BAA+B,QAAQ,CAAC,cAAc,CAAC,GAAG,EAAE,CACtG,CAAA;YAEH,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CAAA;YACnD,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,gCAAgC,CAAC,CAAC,UAAU,CAAC,CAAC,KAAK,CACrF;gBACE,IAAI,EAAE;oBACJ,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACrC,WAAW,EAAE,GAAG;oBAChB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACzB,MAAM;iBACP;gBACD,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE;aAC5B,EACD,OAAO,CACR,CAAA;YACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,CAAC,CAAC,KAAK,CAAC,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAA;YACpE,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;YACjC,OAAO,CAAC,CAAC,EAAE,CACT;gBACE,WAAW,EAAE,GAAG,CAAC,WAAW;gBAC5B,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvC,KAAK;gBACL,SAAS;gBACT,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,KAAK,EAAE,GAAG,CAAC,KAAK;aACjB,EACD;gBACE,GAAG,EAAE;oBACH,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,qCAAqC,EAAE,CAAC,EAAE,kBAAkB;oBAChH,WAAW,EAAE,6CAA6C;iBAC3D;aACF,CACF,CAAA;QACH,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,OAAgD;IAChE,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,GAAG,EAAE,KAAK,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACpE,CAAC"}

package/dist/cloudflare.d.ts

@@ -1,9 +1,24 @@
 import { DurableObject as CloudflareDurableObject } from 'cloudflare:workers';
+import * as RateLimit from './internal/RateLimit.js';
 import * as Routes from './internal/routes/index.js';
 import * as Metrics from './Metrics.js';
 import * as Store from './internal/Store.js';
 type State = ConstructorParameters<typeof CloudflareDurableObject>[0];
 type Environment = ConstructorParameters<typeof CloudflareDurableObject>[1];
+/**
+ * Durable Object holding one principal's fixed-window counters, one row per
+ * quota. Each row tracks its current window; a newer window replaces it and
+ * an older one is ignored, so rows stay bounded. An idle alarm deletes the
+ * object's storage so one-off callers, such as public IPs, leave nothing behind.
+ */
+export declare class RateLimiter extends CloudflareDurableObject {
+    #private;
+    constructor(ctx: State, env: Environment);
+    /** Counts one request in its window and reports whether this call constructed the object. */
+    consume(options: RateLimit.durableObject.Stub.ConsumeOptions): Promise<RateLimit.durableObject.Outcome>;
+    /** Deletes the storage of an object nothing has consumed for the idle window. */
+    alarm(): Promise<void>;
+}
 /** Durable Object class that exposes a Tempo API store over Cloudflare RPC. */
 export declare class DurableObject extends CloudflareDurableObject {
     #private;
@@ -23,6 +38,12 @@ export declare class DurableObject extends CloudflareDurableObject {
      * other events while the storage operations are in flight.
      */
     increment(key: string, options?: Store.Store.PutOptions): Promise<number>;
+    /** Blocks a Routes provider quota inside this object. */
+    routesQuotaBlock(options: Routes.Quota.block.Options): Promise<void>;
+    /** Checks a Routes provider quota inside this object. */
+    routesQuotaCheck(options: Routes.Quota.check.Options): Promise<boolean>;
+    /** Reserves capacity from a Routes provider quota inside this object. */
+    routesQuotaConsume(options: Routes.Quota.consume.Options): Promise<boolean>;
     /** Lists keys. */
     list(options?: Parameters<Store.Store['list']>[0]): Promise<{
         cursor?: string | undefined;
@@ -51,6 +72,8 @@ type RoutesSourceRegisterOptions = RoutesSourceConfiguration & {
     route: RoutesSourceRoute;
 };
 type RoutesSourceSyncOptions = RoutesSourceConfiguration & {
+    /** Revision read before loading the route snapshot; omitted by older callers during deployment. */
+    revision?: string | undefined;
     routes: readonly RoutesSourceRoute[];
 };
 /** Cloudflare Durable Object that detects EVM route deposits before provider indexing. */
@@ -63,8 +86,10 @@ export declare class RoutesSourceObserver<environment extends RoutesSourceObserv
     constructor(ctx: State, env: environment);
     /** Registers one newly created deposit address and starts source observation. */
     register(options: RoutesSourceRegisterOptions): Promise<void>;
-    /** Replaces the active routes from the database and repairs alarm scheduling. */
-    sync(options: RoutesSourceSyncOptions): Promise<void>;
+    /** Applies changed routes and repairs alarm scheduling; returns false when the snapshot is stale. */
+    sync(options: RoutesSourceSyncOptions): Promise<boolean>;
+    /** Reads the persisted revision used to reject obsolete route snapshots. */
+    getRevision(): string;
     /** Scans confirmed source blocks and persists newly observed deposits. */
     alarm(): Promise<void>;
     /** Reports one source-observer failure. */

package/dist/cloudflare.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cloudflare.d.ts","sourceRoot":"","sources":["../src/cloudflare.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,aAAa,IAAI,uBAAuB,EAAE,MAAM,oBAAoB,CAAA;AAG7E,OAAO,KAAK,MAAM,MAAM,4BAA4B,CAAA;AACpD,OAAO,KAAK,OAAO,MAAM,cAAc,CAAA;AACvC,OAAO,KAAK,KAAK,MAAM,qBAAqB,CAAA;AAE5C,KAAK,KAAK,GAAG,qBAAqB,CAAC,OAAO,uBAAuB,CAAC,CAAC,CAAC,CAAC,CAAA;AACrE,KAAK,WAAW,GAAG,qBAAqB,CAAC,OAAO,uBAAuB,CAAC,CAAC,CAAC,CAAC,CAAA;AAE3E,+EAA+E;AAC/E,qBAAa,aAAc,SAAQ,uBAAuB;;IAGxD,YAAY,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAMvC;IAED,qBAAqB;IACf,MAAM,CAAC,GAAG,EAAE,MAAM,iBAEvB;IAED,4DAA4D;IACtD,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,GAAG,MAAM,oBAElD;IAED,uEAAuE;IACjE,GAAG,CAAC,GAAG,EAAE,MAAM,0BAEpB;IAED;;;;;;;OAOG;IACG,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU,mBAE5D;IAED,kBAAkB;IACZ,IAAI,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;;;;;;OAEtD;IAED,6DAA6D;IACvD,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU,iBAErE;IAED;;;;;OAKG;IACG,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU,oBAE9F;CACF;AAKD,KAAK,yBAAyB,GAAG;IAC/B,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IAC1B,YAAY,EAAE,MAAM,CAAA;CACrB,CAAA;AAED,KAAK,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,CAAC,KAAK,CAAA;AAEvD,KAAK,2BAA2B,GAAG,yBAAyB,GAAG;IAC7D,KAAK,EAAE,iBAAiB,CAAA;CACzB,CAAA;AAED,KAAK,uBAAuB,GAAG,yBAAyB,GAAG;IACzD,MAAM,EAAE,SAAS,iBAAiB,EAAE,CAAA;CACrC,CAAA;AAeD,0FAA0F;AAC1F,qBAAa,oBAAoB,CAC/B,WAAW,SAAS,oBAAoB,CAAC,WAAW,GAAG,oBAAoB,CAAC,WAAW,CACvF,SAAQ,uBAAuB;;IAC/B,gDAAgD;IAChD,SAAS,CAAC,OAAO,EAAE,KAAK,CAAA;IACxB,gDAAgD;IAChD,SAAS,CAAC,WAAW,EAAE,WAAW,CAAA;IAElC,YAAY,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAgBvC;IAED,iFAAiF;IAC3E,QAAQ,CAAC,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAsBlE;IAED,iFAAiF;IAC3E,IAAI,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAgC1D;IAED,0EAA0E;IACpE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAsG3B;IAED,2CAA2C;IAC3C,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAEtC;IAED,wEAAwE;IACxE,SAAS,CAAC,aAAa,IAAI,OAAO,CAAC,OAAO,CAMzC;CAiBF;AAED,MAAM,CAAC,OAAO,WAAW,oBAAoB,CAAC;IAC5C,wEAAwE;IACxE,KAAK,WAAW,GAAG;QACjB,8DAA8D;QAC9D,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAChC,+DAA+D;QAC/D,2BAA2B,EAAE;YAC3B,8DAA8D;YAC9D,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;SAC9E,CAAA;QACD,oEAAoE;QACpE,UAAU,EAAE;YACV,uEAAuE;YACvE,gBAAgB,EAAE,MAAM,CAAA;SACzB,CAAA;KACF,CAAA;CACF"}
+{"version":3,"file":"cloudflare.d.ts","sourceRoot":"","sources":["../src/cloudflare.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,aAAa,IAAI,uBAAuB,EAAE,MAAM,oBAAoB,CAAA;AAG7E,OAAO,KAAK,SAAS,MAAM,yBAAyB,CAAA;AACpD,OAAO,KAAK,MAAM,MAAM,4BAA4B,CAAA;AACpD,OAAO,KAAK,OAAO,MAAM,cAAc,CAAA;AACvC,OAAO,KAAK,KAAK,MAAM,qBAAqB,CAAA;AAE5C,KAAK,KAAK,GAAG,qBAAqB,CAAC,OAAO,uBAAuB,CAAC,CAAC,CAAC,CAAC,CAAA;AACrE,KAAK,WAAW,GAAG,qBAAqB,CAAC,OAAO,uBAAuB,CAAC,CAAC,CAAC,CAAC,CAAA;AAK3E;;;;;GAKG;AACH,qBAAa,WAAY,SAAQ,uBAAuB;;IAOtD,YAAY,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAIvC;IAED,6FAA6F;IACvF,OAAO,CACX,OAAO,EAAE,SAAS,CAAC,aAAa,CAAC,IAAI,CAAC,cAAc,GACnD,OAAO,CAAC,SAAS,CAAC,aAAa,CAAC,OAAO,CAAC,CAuB1C;IAED,iFAAiF;IAC3E,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAM3B;CAuBF;AAED,+EAA+E;AAC/E,qBAAa,aAAc,SAAQ,uBAAuB;;IAGxD,YAAY,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAMvC;IAED,qBAAqB;IACf,MAAM,CAAC,GAAG,EAAE,MAAM,iBAEvB;IAED,4DAA4D;IACtD,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,GAAG,MAAM,oBAElD;IAED,uEAAuE;IACjE,GAAG,CAAC,GAAG,EAAE,MAAM,0BAEpB;IAED;;;;;;;OAOG;IACG,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU,mBAE5D;IAED,yDAAyD;IACnD,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,iBAEzD;IAED,yDAAyD;IACnD,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,oBAQzD;IAED,yEAAyE;IACnE,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,oBAQ7D;IAED,kBAAkB;IACZ,IAAI,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;;;;;;OAEtD;IAED,6DAA6D;IACvD,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU,iBAErE;IAED;;;;;OAKG;IACG,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU,oBAE9F;CACF;AAKD,KAAK,yBAAyB,GAAG;IAC/B,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IAC1B,YAAY,EAAE,MAAM,CAAA;CACrB,CAAA;AAED,KAAK,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,CAAC,KAAK,CAAA;AAEvD,KAAK,2BAA2B,GAAG,yBAAyB,GAAG;IAC7D,KAAK,EAAE,iBAAiB,CAAA;CACzB,CAAA;AAED,KAAK,uBAAuB,GAAG,yBAAyB,GAAG;IACzD,mGAAmG;IACnG,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC7B,MAAM,EAAE,SAAS,iBAAiB,EAAE,CAAA;CACrC,CAAA;AAeD,0FAA0F;AAC1F,qBAAa,oBAAoB,CAC/B,WAAW,SAAS,oBAAoB,CAAC,WAAW,GAAG,oBAAoB,CAAC,WAAW,CACvF,SAAQ,uBAAuB;;IAC/B,gDAAgD;IAChD,SAAS,CAAC,OAAO,EAAE,KAAK,CAAA;IACxB,gDAAgD;IAChD,SAAS,CAAC,WAAW,EAAE,WAAW,CAAA;IAElC,YAAY,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAgBvC;IAED,iFAAiF;IAC3E,QAAQ,CAAC,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CA6BlE;IAED,qGAAqG;IAC/F,IAAI,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,OAAO,CAAC,CA6C7D;IAED,4EAA4E;IAC5E,WAAW,IAAI,MAAM,CAMpB;IAED,0EAA0E;IACpE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAsG3B;IAED,2CAA2C;IAC3C,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAEtC;IAED,wEAAwE;IACxE,SAAS,CAAC,aAAa,IAAI,OAAO,CAAC,OAAO,CAMzC;CAwBF;AAED,MAAM,CAAC,OAAO,WAAW,oBAAoB,CAAC;IAC5C,wEAAwE;IACxE,KAAK,WAAW,GAAG;QACjB,8DAA8D;QAC9D,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAChC,+DAA+D;QAC/D,2BAA2B,EAAE;YAC3B,8DAA8D;YAC9D,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;SAC9E,CAAA;QACD,oEAAoE;QACpE,UAAU,EAAE;YACV,uEAAuE;YACvE,gBAAgB,EAAE,MAAM,CAAA;SACzB,CAAA;KACF,CAAA;CACF"}