tapimo 0.19.0 → 0.20.0

package/src/Client.test-d.ts

@@ -393,6 +393,21 @@ describe('narrows responses by status', () => {
       >()
   })
 
+  test('admin zone key rewrite routes return the plan, the applied plan, or the narrow refusal', async () => {
+    const client = hc<ReturnType<typeof Admin.create>>('https://admin.example')
+    const planned = await client['zone-delegations']['rewrite-keys'].$get()
+    if (planned.status === 200)
+      expectTypeOf(await planned.json()).toEqualTypeOf<
+        z.output<typeof AdminZoneDelegations.schema.RewritePlan>
+      >()
+    const applied = await client['zone-delegations']['rewrite-keys'].$post()
+    if (applied.status === 200)
+      expectTypeOf(await applied.json()).toEqualTypeOf<
+        z.output<typeof AdminZoneDelegations.schema.RewriteApplied>
+      >()
+    else if (applied.status === 400) expectTypeOf((await applied.json()).error.code).toBeString()
+  })
+
   test('POST /v1/earn/rewards/eligibility', async () => {
     const client = Client.create()
     const res = await client.v1.earn.rewards.eligibility.$post({
@@ -579,125 +594,6 @@ describe('narrows responses by status', () => {
     }
   })
 
-  test('GET /v1/earn/vaults', async () => {
-    const client = Client.create()
-    const res = await client.v1.earn.vaults.$get({
-      query: {
-        'apy.window': '24h',
-        capability: 'deposit',
-        'engine.type': 'erc4626',
-        include: 'access,apy,capabilities,token.logoUri,tvl,zone,zones',
-      },
-    })
-
-    expectTypeOf(res.status).toEqualTypeOf<200 | 400 | 502 | PaidAccessStatus>()
-
-    if (res.status === 200) {
-      const json = await res.json()
-      expectTypeOf(json).toEqualTypeOf<z.output<typeof Earn.schema.getEarnVaults.Response>>()
-      expectTypeOf(json.data[0]!.access?.status).toEqualTypeOf<'allowlisted' | 'open' | undefined>()
-      // `apy` and `tvl` are include-gated, so both are absent unless requested.
-      expectTypeOf(json.data[0]!.apy?.methodology).toEqualTypeOf<
-        'share-price-growth-annualized:v1' | undefined
-      >()
-      expectTypeOf(json.data[0]!.apy?.net).toEqualTypeOf<string | undefined>()
-      expectTypeOf(json.data[0]!.apy?.vault).toEqualTypeOf<string | undefined>()
-      expectTypeOf(json.data[0]!.apy?.window).toEqualTypeOf<
-        '1h' | '1d' | '7d' | '30d' | undefined
-      >()
-      expectTypeOf(json.data[0]!.assetToken.address).toEqualTypeOf<`0x${string}`>()
-      expectTypeOf(json.data[0]!.capabilities?.deposit).toEqualTypeOf<boolean | undefined>()
-      expectTypeOf(json.data[0]!.engine.type).toEqualTypeOf<'erc4626' | 'veda' | null>()
-      expectTypeOf(json.data[0]!.instantLiquidity).toEqualTypeOf<string | null>()
-      expectTypeOf(json.data[0]!.instantLiquidityValue).toEqualTypeOf<
-        VaultValue | null | undefined
-      >()
-      expectTypeOf(json.data[0]!.sharePrice?.amount).toEqualTypeOf<string | undefined>()
-      expectTypeOf(json.data[0]!.apy?.rewards?.[0]?.apr).toEqualTypeOf<string | null | undefined>()
-      expectTypeOf(json.data[0]!.apy?.rewards?.[0]?.asset.address).toEqualTypeOf<
-        `0x${string}` | undefined
-      >()
-      expectTypeOf(json.data[0]!.apy?.rewards?.[0]?.calculatedThrough).toEqualTypeOf<
-        number | undefined
-      >()
-      expectTypeOf(json.data[0]!.apy?.rewards?.[0]?.targetTotalApr).toEqualTypeOf<
-        string | undefined
-      >()
-      expectTypeOf(json.data[0]!.slug).toEqualTypeOf<string | null>()
-      expectTypeOf(json.data[0]!.state.openRedeemRequestCount).toEqualTypeOf<number>()
-      expectTypeOf(json.data[0]!.state.totalAssets).toEqualTypeOf<string>()
-      expectTypeOf(json.data[0]!.tvl).toEqualTypeOf<VaultValue | null | undefined>()
-      expectTypeOf(json.data[0]!.tvl?.currency).toEqualTypeOf<string | undefined>()
-      expectTypeOf(json.data[0]!.vaultAddress).toEqualTypeOf<`0x${string}`>()
-      expectTypeOf(json.data[0]!.verified).toEqualTypeOf<boolean>()
-      expectTypeOf(json.data[0]!.zone?.chainId).toEqualTypeOf<number | undefined>()
-      expectTypeOf(json.data[0]!.zones?.[0]?.deploymentBlock).toEqualTypeOf<number | undefined>()
-      expectTypeOf(json.data[0]!.zones?.[0]?.earnRouter).toEqualTypeOf<`0x${string}` | undefined>()
-      expectTypeOf(json.meta?.valuation?.basis).toEqualTypeOf<'nominal' | undefined>()
-      void json
-      return
-    }
-    if (res.status === 400) {
-      const json = await res.json()
-      expectTypeOf(json.error.code).toEqualTypeOf<
-        Access400<'chain_id_invalid' | 'chain_id_unsupported' | 'query_invalid'>
-      >()
-      void json
-      return
-    }
-    if (res.status === 502) {
-      const json = await res.json()
-      expectTypeOf(json.error.code).toEqualTypeOf<'upstream_error'>()
-      void json
-      return
-    }
-  })
-
-  test('GET /v1/earn/vaults/verified', async () => {
-    const client = Client.create()
-    const res = await client.v1.earn.vaults.verified.$get({
-      query: {
-        'apy.window': '7d',
-        include: 'access,apy,capabilities,token.logoUri,tvl,zone,zones',
-      },
-    })
-
-    expectTypeOf(res.status).toEqualTypeOf<200 | 400 | 502 | PaidAccessStatus>()
-
-    if (res.status === 200) {
-      const json = await res.json()
-      expectTypeOf(json).toEqualTypeOf<
-        z.output<typeof Earn.schema.getVerifiedEarnVaults.Response>
-      >()
-      expectTypeOf(json.data[0]!.apy?.vault).toEqualTypeOf<string | undefined>()
-      expectTypeOf(json.data[0]!.engine.type).toEqualTypeOf<'erc4626' | 'veda'>()
-      expectTypeOf(json.data[0]!.instantLiquidity).toEqualTypeOf<string | null>()
-      expectTypeOf(json.data[0]!.slug).toEqualTypeOf<string>()
-      expectTypeOf(json.data[0]!.state.feesActive).toEqualTypeOf<boolean>()
-      expectTypeOf(json.data[0]!.tvl).toEqualTypeOf<VaultValue | null | undefined>()
-      expectTypeOf(json.data[0]!.tvl?.formatted).toEqualTypeOf<string | undefined>()
-      expectTypeOf(json.data[0]!.verified).toEqualTypeOf<true>()
-      expectTypeOf(json.data[0]!.zones?.[0]?.chainId).toEqualTypeOf<number | undefined>()
-      expectTypeOf(json.meta?.valuation?.source).toEqualTypeOf<string | undefined>()
-      void json
-      return
-    }
-    if (res.status === 400) {
-      const json = await res.json()
-      expectTypeOf(json.error.code).toEqualTypeOf<
-        Access400<'chain_id_invalid' | 'chain_id_unsupported' | 'query_invalid'>
-      >()
-      void json
-      return
-    }
-    if (res.status === 502) {
-      const json = await res.json()
-      expectTypeOf(json.error.code).toEqualTypeOf<'upstream_error'>()
-      void json
-      return
-    }
-  })
-
   test('GET /v1/earn/addresses/:address/positions', async () => {
     const client = Client.create()
     const res = await client.v1.earn.addresses[':address'].positions.$get({
@@ -780,7 +676,6 @@ describe('narrows responses by status', () => {
       expectTypeOf(json.label).toEqualTypeOf<string>()
       expectTypeOf(json.meta?.valuation?.asOf).toEqualTypeOf<string | undefined>()
       expectTypeOf(json.sharePrice?.decimals).toEqualTypeOf<number | undefined>()
-      expectTypeOf(json.slug).toEqualTypeOf<string | null>()
       expectTypeOf(json.state.depositsPaused).toEqualTypeOf<boolean>()
       expectTypeOf(json.tvl).toEqualTypeOf<VaultValue | null | undefined>()
       expectTypeOf(json.tvl?.amount).toEqualTypeOf<string | undefined>()
@@ -1753,9 +1648,7 @@ describe('narrows responses by status', () => {
       }
       case 403: {
         const json = await res.json()
-        expectTypeOf(json.error.code).toEqualTypeOf<
-          'forbidden' | 'scope_not_issuable' | 'zone_key_approval_required'
-        >()
+        expectTypeOf(json.error.code).toEqualTypeOf<'forbidden' | 'scope_not_issuable'>()
         void json
         return
       }
@@ -1809,7 +1702,7 @@ describe('narrows responses by status', () => {
       case 403: {
         const json = await res.json()
         expectTypeOf(json.error.code).toEqualTypeOf<
-          'api_key_forbidden' | 'api_key_ip_forbidden' | 'forbidden' | 'zone_key_approval_required'
+          'api_key_forbidden' | 'api_key_ip_forbidden' | 'forbidden'
         >()
         void json
         return
@@ -4842,7 +4735,7 @@ describe('narrows responses by status', () => {
       json: { jsonrpc: '2.0', method: 'eth_chainId', params: [] },
     })
 
-    expectTypeOf(res.status).toEqualTypeOf<200 | 204 | 400 | 413 | 502 | PublicAccessStatus>()
+    expectTypeOf(res.status).toEqualTypeOf<200 | 204 | 400 | 413 | 502 | 503 | PublicAccessStatus>()
 
     switch (res.status) {
       case 200: {
@@ -4881,6 +4774,12 @@ describe('narrows responses by status', () => {
         void json
         return
       }
+      case 503: {
+        const json = await res.json()
+        expectTypeOf(json.error.code).toEqualTypeOf<'zone_access_unavailable'>()
+        void json
+        return
+      }
     }
   })
 
@@ -4891,7 +4790,7 @@ describe('narrows responses by status', () => {
       param: { chain: 'testnet' },
     })
 
-    expectTypeOf(res.status).toEqualTypeOf<200 | 204 | 400 | 413 | 502 | PublicAccessStatus>()
+    expectTypeOf(res.status).toEqualTypeOf<200 | 204 | 400 | 413 | 502 | 503 | PublicAccessStatus>()
 
     switch (res.status) {
       case 200: {
@@ -4930,6 +4829,12 @@ describe('narrows responses by status', () => {
         void json
         return
       }
+      case 503: {
+        const json = await res.json()
+        expectTypeOf(json.error.code).toEqualTypeOf<'zone_access_unavailable'>()
+        void json
+        return
+      }
     }
   })
 
@@ -4942,6 +4847,8 @@ describe('narrows responses by status', () => {
         'amount.to': '2000000',
         chainId: '4217',
         include: 'zones,token.logoUri,token.verified',
+        'timestamp.from': '2026-10-22T00:00:00Z',
+        'timestamp.to': '2026-10-23T00:00:00Z',
         type: 'transfer,swap',
         'valuation.amount.from': '1',
         'valuation.amount.to': '100',

package/src/Scope.test.ts

@@ -30,7 +30,6 @@ describe('extend', () => {
       ]),
     ).toEqual([
       ...Scope.catalog,
-      Scope.zoneEntry,
       Scope.zoneWriteEntry,
       {
         description: 'Read project accounts.',
@@ -53,28 +52,34 @@ describe('extend', () => {
   })
 })
 
-describe('expandAliases', () => {
-  test('adds the generic read scope and the current scope for a legacy Zone read scope', () => {
-    expect(
-      Scope.expandAliases(['data:read', 'zone:1424310001:read', 'zone:1424310001:write']),
-    ).toEqual([
-      'data:read',
-      'zone:1424310001:read',
-      'zone:1424310001:write',
-      'zone:read',
-      'zone:1424310003:read',
-    ])
-  })
-
-  test('does not duplicate scopes the key already holds', () => {
-    expect(
-      Scope.expandAliases(['zone:1424310001:read', 'zone:1424310003:read', 'zone:read']),
-    ).toEqual(['zone:1424310001:read', 'zone:1424310003:read', 'zone:read'])
+describe('issuable', () => {
+  test('refuses retired per-Zone scopes while still recognizing them as stored', () => {
+    expect(Scope.issuable(Scope.catalog, 'zone:421700001:read')).toBe(false)
+    expect(Scope.includes(Scope.catalog, 'zone:421700001:read')).toBe(true)
+    expect(Scope.issuable(Scope.catalog, 'zone:421700001:write')).toBe(false)
+    expect(Scope.includes(Scope.catalog, 'zone:421700001:write')).toBe(true)
+    expect(Scope.issuable(Scope.catalog, 'zone:read')).toBe(true)
+    expect(Scope.issuable(Scope.catalog, 'zone:write')).toBe(true)
   })
+})
 
-  test('leaves keys without legacy Zone read scopes untouched', () => {
-    const scopes = ['data:read', 'zone:read', 'zone:421700001:write', '*']
-    expect(Scope.expandAliases(scopes)).toBe(scopes)
+describe('catalog', () => {
+  test('offers both generic Zone scopes self-serve and keeps the retired template admin-only', () => {
+    expect(Scope.catalog.filter((entry) => entry.scope.startsWith('zone:'))).toMatchInlineSnapshot(`
+      [
+        {
+          "description": "Read RPC and indexed data in Zones the organization is delegated.",
+          "scope": "zone:read",
+          "selfServe": true,
+        },
+        {
+          "description": "Broadcast signed transactions to Zones the key is tagged for.",
+          "scope": "zone:write",
+          "selfServe": true,
+        },
+      ]
+    `)
+    expect(Scope.zoneWriteEntry.selfServe).toBe(false)
   })
 })
 
@@ -93,27 +98,3 @@ describe('parseZone', () => {
     ])
   })
 })
-
-describe('zoneTags', () => {
-  test('collects the chain ids of per-Zone scopes, sorted and deduplicated', () => {
-    expect(
-      Scope.zoneTags([
-        'data:read',
-        'zone:421700002:write',
-        'zone:421700001:read',
-        'zone:421700002:read',
-      ]),
-    ).toEqual([421700001, 421700002])
-  })
-
-  test('covers aliased chain ids once expanded', () => {
-    expect(Scope.zoneTags(Scope.expandAliases(['zone:1424310001:read']))).toEqual([
-      1424310001, 1424310003,
-    ])
-  })
-
-  test('is undefined when no legacy Zone scope narrows the key', () => {
-    expect(Scope.zoneTags(['data:read', 'zone:read'])).toBeUndefined()
-    expect(Scope.zoneTags(['*'])).toBeUndefined()
-  })
-})

package/src/Scope.ts

@@ -97,22 +97,21 @@ export const catalog = [
     scope: 'webhooks:write',
     selfServe: false,
   },
-  // The generic Zone read scope is self-serve: approval attaches to widening the organization's Zone delegations instead.
+  // Generic Zone scopes are self-serve: approval attaches to widening the organization's Zone delegations instead.
   {
     description: 'Read RPC and indexed data in Zones the organization is delegated.',
     scope: 'zone:read',
     selfServe: true,
   },
+  // Broadcasts are account-signed, so the delegation only bounds which Zones a key may be tagged for.
+  {
+    description: 'Broadcast signed transactions to Zones the key is tagged for.',
+    scope: 'zone:write',
+    selfServe: true,
+  },
 ] as const satisfies readonly Entry[]
 
-/** Templated `/v1/scopes` entry for per-zone read scopes. */
-export const zoneEntry = {
-  description: 'Read RPC and indexed data for one zone chain id.',
-  scope: 'zone:<chainId>:read',
-  selfServe: false,
-} as const satisfies Entry
-
-/** Templated `/v1/scopes` entry for per-zone transaction broadcast scopes. */
+/** Templated `/v1/scopes` entry for the retired per-zone broadcast scopes, listed while stored keys still hold them. */
 export const zoneWriteEntry = {
   description: 'Broadcast signed transactions to one zone chain id.',
   scope: 'zone:<chainId>:write',
@@ -124,7 +123,7 @@ const zonePattern = /^zone:([1-9]\d*):(read|write)$/
 
 /** Zod schemas owned by the scope vocabulary. */
 export namespace schema {
-  /** A concrete per-zone read or write scope. */
+  /** A concrete per-zone scope, retired for both verbs but still held by stored keys until the rewrite's cleanup strips it. */
   export const Zone = z
     .union([
       z.templateLiteral(['zone:', z.int(), ':read']),
@@ -132,11 +131,13 @@ export namespace schema {
     ])
     .check(
       z.regex(zonePattern),
-      z.describe('Per-zone read or write scope (`zone:<chainId>:read|write`).'),
+      z.describe(
+        'Retired per-zone scope (`zone:<chainId>:read|write`); keys use `zone:read` or `zone:write` with Zone tags instead.',
+      ),
     )
 }
 
-/** Per-zone read or write scope, granting access to one zone chain id. */
+/** Retired per-zone scope naming one zone chain id; stored records still parse, fresh grants refuse it. */
 export type Zone = z.output<typeof schema.Zone>
 
 /** Issuable API-key scope identifier, including host-defined scopes. */
@@ -162,7 +163,7 @@ export const selfServe: readonly Id[] = catalog
  */
 export function extend(entries: readonly Entry[] = []): Catalog {
   const identifiers = new Set<string>()
-  const result = [...catalog, zoneEntry, zoneWriteEntry, ...entries]
+  const result = [...catalog, zoneWriteEntry, ...entries]
   for (const entry of result) {
     if (!entry.scope.trim()) throw new Error('Scope identifier must not be empty.')
     if (identifiers.has(entry.scope)) throw new Error(`Duplicate scope \`${entry.scope}\`.`)
@@ -171,11 +172,16 @@ export function extend(entries: readonly Entry[] = []): Catalog {
   return result
 }
 
-/** Returns whether a catalog contains a scope identifier. */
+/** Returns whether a catalog contains a scope identifier, including retired per-Zone read scopes stored on older keys. */
 export function includes(catalog: Catalog, scope: string): scope is Id {
   return schema.Zone.safeParse(scope).success || catalog.some((entry) => entry.scope === scope)
 }
 
+/** Returns whether a scope may be granted to a key; per-Zone scopes are retired in favor of `zone:read`/`zone:write` plus tags. */
+export function issuable(catalog: Catalog, scope: string): scope is Id {
+  return includes(catalog, scope) && parseZone(scope) === undefined
+}
+
 /** Parses a concrete per-Zone scope into its chain id and verb; undefined for every other scope. */
 export function parseZone(scope: string): parseZone.Result | undefined {
   const match = zonePattern.exec(scope)
@@ -200,29 +206,10 @@ export function zoneReadChainId(scope: string): number | undefined {
   return zone?.verb === 'read' ? Schema.resolveChainId(zone.chainId) : undefined
 }
 
-/**
- * Adds the scopes a per-Zone read scope implies: the generic `zone:read` and,
- * for an aliased chain id, the current per-Zone read scope. Write scopes stay per Zone.
- */
-export function expandAliases(scopes: readonly string[]): readonly string[] {
-  const aliases = new Set<string>()
-  for (const scope of scopes) {
-    const zone = parseZone(scope)
-    if (zone?.verb !== 'read') continue
-    aliases.add('zone:read')
-    aliases.add(`zone:${Schema.resolveChainId(zone.chainId)}:read`)
-  }
-  for (const scope of scopes) aliases.delete(scope)
-  return aliases.size ? [...scopes, ...aliases] : scopes
-}
-
-/**
- * Zone chain ids named by per-Zone scopes, serving as implicit delegation tags
- * for keys without explicit ones. `undefined` means no Zone.
- */
-export function zoneTags(scopes: readonly string[]): readonly number[] | undefined {
-  const tags = new Set(scopes.flatMap((scope) => parseZone(scope)?.chainId ?? []))
-  return tags.size ? [...tags].sort((a, b) => a - b) : undefined
+/** Zone chain id a write scope names, resolved from any legacy alias; undefined for every other scope. */
+export function zoneWriteChainId(scope: string): number | undefined {
+  const zone = parseZone(scope)
+  return zone?.verb === 'write' ? Schema.resolveChainId(zone.chainId) : undefined
 }
 
 /** Returns the self-issuable identifiers in a scope catalog. */

package/src/admin/App.test.ts

@@ -20,6 +20,16 @@ describe('create', () => {
           method: 'POST',
         }),
         new Request('http://admin/api-keys/key_x', { method: 'DELETE' }),
+        new Request('http://admin/audit-logs'),
+        new Request('http://admin/early-access'),
+        new Request('http://admin/openapi.json'),
+        new Request('http://admin/prop-amms/pools'),
+        new Request('http://admin/route-policies', { method: 'PUT' }),
+        new Request('http://admin/routes'),
+        new Request('http://admin/sentinel'),
+        new Request('http://admin/zone-delegations'),
+        new Request('http://admin/zone-delegation-requests'),
+        new Request('http://admin/zone-delegations/rewrite-keys', { method: 'POST' }),
         new Request('http://admin/earn/verified-vaults', {
           body: JSON.stringify({}),
           headers: { 'content-type': 'application/json' },
@@ -64,7 +74,7 @@ describe('create', () => {
       const html = await shell.text()
       const json = html.match(/window\.__TEMPO_API_CONFIG__=({.*?})<\/script>/)?.[1]
       expect(JSON.parse(json!)).toEqual({
-        auth: { identity: null, loginUrl: '/login', zoneKeyApprover: false },
+        auth: { delegationApprover: false, identity: null, loginUrl: '/login' },
         rewards: { chainId: 4217, operatorAddress: '0x6000000000000000000000000000000000000006' },
       })
       const assetPath = html.match(/\.\/(assets\/[^"]+\.js)/)?.[1]
@@ -210,6 +220,43 @@ describe('create', () => {
       })
       expect(records[0]?.requestId).toBeTruthy()
     })
+
+    test('records one row per request on bare and nested paths', async () => {
+      const { app, db } = TestAdmin.setup({
+        identify: () => ({ email: 'ops@tempo.xyz' }),
+      })
+      await Organizations.create(db, { id: 'org', name: 'Operations' })
+      const statuses = [
+        (await app.request('http://admin/organizations')).status,
+        (await app.request('http://admin/organizations/org')).status,
+      ]
+      const records = await db.kysely
+        .selectFrom('admin_audit_logs')
+        .select(['method', 'path', 'status'])
+        .orderBy('path')
+        .execute()
+
+      expect({ records, statuses }).toMatchInlineSnapshot(`
+        {
+          "records": [
+            {
+              "method": "GET",
+              "path": "/organizations",
+              "status": 200,
+            },
+            {
+              "method": "GET",
+              "path": "/organizations/org",
+              "status": 200,
+            },
+          ],
+          "statuses": [
+            200,
+            200,
+          ],
+        }
+      `)
+    })
   })
 
   describe('GET /config.json', () => {
@@ -224,12 +271,12 @@ describe('create', () => {
       expect(await response.json()).toMatchInlineSnapshot(`
         {
           "auth": {
+            "delegationApprover": false,
             "identity": {
               "email": "ops@tempo.xyz",
             },
             "loginUrl": "/login",
             "logoutUrl": "/logout",
-            "zoneKeyApprover": false,
           },
           "rewards": {
             "chainId": 4217,
@@ -246,10 +293,10 @@ describe('create', () => {
       expect(await response.json()).toMatchInlineSnapshot(`
         {
           "auth": {
+            "delegationApprover": false,
             "identity": {
               "email": "ops@tempo.xyz",
             },
-            "zoneKeyApprover": false,
           },
           "rewards": {
             "chainId": 4217,
@@ -283,10 +330,10 @@ describe('create', () => {
       expect(json).toBeDefined()
       expect(JSON.parse(json!)).toEqual({
         auth: {
+          delegationApprover: false,
           identity: { email: 'admin@tempo.xyz' },
           loginUrl: 'https://sso/login',
           logoutUrl: 'https://sso/logout',
-          zoneKeyApprover: false,
         },
         rewards: { chainId: 4217, operatorAddress: '0x6000000000000000000000000000000000000006' },
       })