npm - tapimo - Versions diffs - 0.4.1 → 0.4.4 - Mend

tapimo 0.4.1 → 0.4.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (263) hide show

package/README.md +1 -1
package/dist/ApiKey.d.ts +1 -9
package/dist/ApiKey.d.ts.map +1 -1
package/dist/ApiKey.js +2 -3
package/dist/ApiKey.js.map +1 -1
package/dist/ApiKeys.d.ts +53 -27
package/dist/ApiKeys.d.ts.map +1 -1
package/dist/ApiKeys.js +32 -17
package/dist/ApiKeys.js.map +1 -1
package/dist/App.d.ts +1990 -1442
package/dist/App.d.ts.map +1 -1
package/dist/App.js +23 -9
package/dist/App.js.map +1 -1
package/dist/Assets.d.ts +10 -0
package/dist/Assets.d.ts.map +1 -1
package/dist/Assets.js +4 -0
package/dist/Assets.js.map +1 -1
package/dist/Auth.d.ts +2 -1
package/dist/Auth.d.ts.map +1 -1
package/dist/Auth.js +2 -1
package/dist/Auth.js.map +1 -1
package/dist/Scope.d.ts +40 -15
package/dist/Scope.d.ts.map +1 -1
package/dist/Scope.js +44 -13
package/dist/Scope.js.map +1 -1
package/dist/admin/App.d.ts +560 -9
package/dist/admin/App.d.ts.map +1 -1
package/dist/admin/App.js +38 -6
package/dist/admin/App.js.map +1 -1
package/dist/admin/apps/api-keys.d.ts +10 -24
package/dist/admin/apps/api-keys.d.ts.map +1 -1
package/dist/admin/apps/api-keys.js +10 -3
package/dist/admin/apps/api-keys.js.map +1 -1
package/dist/admin/apps/organizations.d.ts +833 -0
package/dist/admin/apps/organizations.d.ts.map +1 -0
package/dist/admin/apps/organizations.js +733 -0
package/dist/admin/apps/organizations.js.map +1 -0
package/dist/admin/apps/scopes.d.ts +8 -0
package/dist/admin/apps/scopes.d.ts.map +1 -1
package/dist/admin/apps/verified-tokens.d.ts +57 -57
package/dist/admin/ui.generated.d.ts +1 -1
package/dist/admin/ui.generated.d.ts.map +1 -1
package/dist/admin/ui.generated.js +53 -13
package/dist/admin/ui.generated.js.map +1 -1
package/dist/analytics/Analytics.d.ts +10 -0
package/dist/analytics/Analytics.d.ts.map +1 -1
package/dist/analytics/Analytics.js +8 -0
package/dist/analytics/Analytics.js.map +1 -1
package/dist/analytics/tables/requestEvents.d.ts +9 -0
package/dist/analytics/tables/requestEvents.d.ts.map +1 -1
package/dist/analytics/tables/requestEvents.js +14 -0
package/dist/analytics/tables/requestEvents.js.map +1 -1
package/dist/apps/data/App.d.ts +1304 -1304
package/dist/apps/data/FundingRouteProviders.d.ts +4 -22
package/dist/apps/data/FundingRouteProviders.d.ts.map +1 -1
package/dist/apps/data/FundingRouteProviders.js +10 -120
package/dist/apps/data/FundingRouteProviders.js.map +1 -1
package/dist/apps/data/routes/activities.d.ts +38 -38
package/dist/apps/data/routes/addresses.d.ts +24 -24
package/dist/apps/data/routes/blocks.d.ts +39 -39
package/dist/apps/data/routes/fee-amm.d.ts +20 -20
package/dist/apps/data/routes/funding.js +7 -7
package/dist/apps/data/routes/funding.js.map +1 -1
package/dist/apps/data/routes/indexer.d.ts +5 -5
package/dist/apps/data/routes/tokenlist.d.ts +12 -12
package/dist/apps/data/routes/verified-tokens.d.ts +36 -36
package/dist/apps/management/App.d.ts +808 -267
package/dist/apps/management/App.d.ts.map +1 -1
package/dist/apps/management/App.js +2 -2
package/dist/apps/management/Billing.d.ts +3 -0
package/dist/apps/management/Billing.d.ts.map +1 -1
package/dist/apps/management/Billing.js +7 -2
package/dist/apps/management/Billing.js.map +1 -1
package/dist/apps/management/routes/api-keys.d.ts +116 -100
package/dist/apps/management/routes/api-keys.d.ts.map +1 -1
package/dist/apps/management/routes/api-keys.js +41 -30
package/dist/apps/management/routes/api-keys.js.map +1 -1
package/dist/apps/management/routes/billing.d.ts +182 -50
package/dist/apps/management/routes/billing.d.ts.map +1 -1
package/dist/apps/management/routes/billing.js +14 -14
package/dist/apps/management/routes/billing.js.map +1 -1
package/dist/apps/management/routes/invitations.d.ts +93 -20
package/dist/apps/management/routes/invitations.d.ts.map +1 -1
package/dist/apps/management/routes/invitations.js +12 -15
package/dist/apps/management/routes/invitations.js.map +1 -1
package/dist/apps/management/routes/members.d.ts +89 -18
package/dist/apps/management/routes/members.d.ts.map +1 -1
package/dist/apps/management/routes/members.js +10 -10
package/dist/apps/management/routes/members.js.map +1 -1
package/dist/apps/management/routes/orgs.d.ts +100 -40
package/dist/apps/management/routes/orgs.d.ts.map +1 -1
package/dist/apps/management/routes/orgs.js +19 -19
package/dist/apps/management/routes/orgs.js.map +1 -1
package/dist/apps/management/routes/projects.d.ts +122 -33
package/dist/apps/management/routes/projects.d.ts.map +1 -1
package/dist/apps/management/routes/projects.js +12 -13
package/dist/apps/management/routes/projects.js.map +1 -1
package/dist/apps/management/routes/scopes.d.ts +4 -18
package/dist/apps/management/routes/scopes.d.ts.map +1 -1
package/dist/apps/management/routes/scopes.js +6 -7
package/dist/apps/management/routes/scopes.js.map +1 -1
package/dist/apps/management/routes/usage.d.ts +63 -19
package/dist/apps/management/routes/usage.d.ts.map +1 -1
package/dist/apps/management/routes/usage.js +9 -10
package/dist/apps/management/routes/usage.js.map +1 -1
package/dist/apps/mcp.d.ts.map +1 -1
package/dist/apps/mcp.js +38 -4
package/dist/apps/mcp.js.map +1 -1
package/dist/apps/relay/App.d.ts +26 -4
package/dist/apps/relay/App.d.ts.map +1 -1
package/dist/apps/relay/App.js +17 -14
package/dist/apps/relay/App.js.map +1 -1
package/dist/cloudflare.d.ts +2 -0
package/dist/cloudflare.d.ts.map +1 -1
package/dist/cloudflare.js +4 -0
package/dist/cloudflare.js.map +1 -1
package/dist/db/Db.d.ts +5 -3
package/dist/db/Db.d.ts.map +1 -1
package/dist/db/Db.js +52 -0
package/dist/db/Db.js.map +1 -1
package/dist/db/Schema.d.ts +13 -0
package/dist/db/Schema.d.ts.map +1 -1
package/dist/db/Schema.js +16 -1
package/dist/db/Schema.js.map +1 -1
package/dist/db/tables/adminAuditLogs.d.ts +27 -0
package/dist/db/tables/adminAuditLogs.d.ts.map +1 -0
package/dist/db/tables/adminAuditLogs.js +19 -0
package/dist/db/tables/adminAuditLogs.js.map +1 -0
package/dist/db/tables/invitations.d.ts +1 -1
package/dist/db/tables/invitations.d.ts.map +1 -1
package/dist/db/tables/memberships.d.ts +32 -4
package/dist/db/tables/memberships.d.ts.map +1 -1
package/dist/db/tables/memberships.js +31 -0
package/dist/db/tables/memberships.js.map +1 -1
package/dist/db/tables/organizations.d.ts +43 -1
package/dist/db/tables/organizations.d.ts.map +1 -1
package/dist/db/tables/organizations.js +103 -0
package/dist/db/tables/organizations.js.map +1 -1
package/dist/db/tables/projects.d.ts +25 -0
package/dist/db/tables/projects.d.ts.map +1 -1
package/dist/db/tables/projects.js +22 -0
package/dist/db/tables/projects.js.map +1 -1
package/dist/db/tables/webhookDeliveries.d.ts +26 -0
package/dist/db/tables/webhookDeliveries.d.ts.map +1 -1
package/dist/db/tables/webhookDeliveries.js +37 -0
package/dist/db/tables/webhookDeliveries.js.map +1 -1
package/dist/internal/Auth.d.ts +46 -40
package/dist/internal/Auth.d.ts.map +1 -1
package/dist/internal/Auth.js +118 -69
package/dist/internal/Auth.js.map +1 -1
package/dist/internal/Cursor.d.ts +1 -1
package/dist/internal/Cursor.d.ts.map +1 -1
package/dist/internal/Cursor.js +4 -0
package/dist/internal/Cursor.js.map +1 -1
package/dist/internal/EdgeCache.d.ts.map +1 -1
package/dist/internal/EdgeCache.js +2 -0
package/dist/internal/EdgeCache.js.map +1 -1
package/dist/internal/Errors.d.ts +6 -0
package/dist/internal/Errors.d.ts.map +1 -0
package/dist/internal/Errors.js +16 -0
package/dist/internal/Errors.js.map +1 -0
package/dist/internal/FundingRoutes.d.ts +15 -43
package/dist/internal/FundingRoutes.d.ts.map +1 -1
package/dist/internal/FundingRoutes.js +8 -17
package/dist/internal/FundingRoutes.js.map +1 -1
package/dist/internal/Log.d.ts +16 -1
package/dist/internal/Log.d.ts.map +1 -1
package/dist/internal/Log.js +5 -3
package/dist/internal/Log.js.map +1 -1
package/dist/internal/Store.d.ts +61 -16
package/dist/internal/Store.d.ts.map +1 -1
package/dist/internal/Store.js +72 -17
package/dist/internal/Store.js.map +1 -1
package/dist/internal/Viem.d.ts +1 -1
package/dist/internal/index.d.ts +27 -0
package/dist/internal/index.d.ts.map +1 -0
package/dist/internal/index.js +27 -0
package/dist/internal/index.js.map +1 -0
package/package.json +8 -3
package/src/ApiKey.ts +2 -3
package/src/ApiKeys.ts +95 -17
package/src/App.test.ts +104 -6
package/src/App.ts +29 -9
package/src/Assets.ts +8 -0
package/src/Auth.test-d.ts +36 -0
package/src/Auth.ts +20 -1
package/src/Client.test-d.ts +17 -17
package/src/Scope.test.ts +34 -0
package/src/Scope.ts +53 -17
package/src/admin/App.test.ts +33 -3
package/src/admin/App.ts +49 -14
package/src/admin/apps/api-keys.ts +10 -3
package/src/admin/apps/organizations.test.ts +455 -0
package/src/admin/apps/organizations.ts +953 -0
package/src/admin/apps/scopes.test.ts +10 -0
package/src/admin/ui/plugin.ts +1 -1
package/src/admin/ui/src/components/MobileProfile.tsx +2 -0
package/src/admin/ui/src/components/ThemeToggle.tsx +20 -0
package/src/admin/ui/src/lib/api-keys.ts +36 -19
package/src/admin/ui/src/lib/config.ts +2 -3
package/src/admin/ui/src/lib/organizations.test.ts +89 -0
package/src/admin/ui/src/lib/organizations.ts +262 -0
package/src/admin/ui/src/lib/query-client.ts +3 -1
package/src/admin/ui/src/lib/theme.ts +57 -0
package/src/admin/ui/src/routeTree.gen.ts +47 -4
package/src/admin/ui/src/routes/__root.tsx +18 -3
package/src/admin/ui/src/routes/api-keys.tsx +52 -7
package/src/admin/ui/src/routes/index.tsx +1 -1
package/src/admin/ui/src/routes/organizations.tsx +158 -0
package/src/admin/ui/src/routes/organizations_.$orgId.tsx +710 -0
package/src/admin/ui/src/start.ts +6 -0
package/src/admin/ui.generated.ts +63 -13
package/src/analytics/Analytics.ts +25 -0
package/src/analytics/tables/requestEvents.ts +33 -0
package/src/apps/composition.test.ts +82 -2
package/src/apps/data/FundingRouteProviders.test.ts +37 -93
package/src/apps/data/FundingRouteProviders.ts +14 -161
package/src/apps/data/routes/funding.test.ts +7 -42
package/src/apps/data/routes/funding.ts +8 -8
package/src/apps/data/routes/indexer.test.ts +2 -2
package/src/apps/data/routes/webhooks.test.ts +2 -2
package/src/apps/management/App.ts +2 -2
package/src/apps/management/Billing.ts +10 -2
package/src/apps/management/routes/api-keys.test.ts +137 -1
package/src/apps/management/routes/api-keys.ts +63 -38
package/src/apps/management/routes/billing.ts +14 -14
package/src/apps/management/routes/invitations.test.ts +102 -1
package/src/apps/management/routes/invitations.ts +13 -15
package/src/apps/management/routes/members.ts +10 -10
package/src/apps/management/routes/orgs.test.ts +78 -16
package/src/apps/management/routes/orgs.ts +21 -20
package/src/apps/management/routes/projects.ts +12 -13
package/src/apps/management/routes/scopes.test.ts +16 -0
package/src/apps/management/routes/scopes.ts +6 -7
package/src/apps/management/routes/usage.ts +9 -14
package/src/apps/mcp.test.ts +72 -7
package/src/apps/mcp.ts +46 -4
package/src/apps/relay/App.test.ts +23 -18
package/src/apps/relay/App.ts +35 -14
package/src/cloudflare.ts +5 -0
package/src/db/Db.ts +59 -3
package/src/db/Schema.ts +20 -1
package/src/db/tables/adminAuditLogs.ts +47 -0
package/src/db/tables/invitations.ts +1 -1
package/src/db/tables/memberships.ts +59 -3
package/src/db/tables/organizations.ts +148 -1
package/src/db/tables/projects.ts +47 -0
package/src/db/tables/webhookDeliveries.ts +83 -0
package/src/internal/Auth.test.ts +571 -23
package/src/internal/Auth.ts +166 -94
package/src/internal/Cursor.test.ts +10 -0
package/src/internal/Cursor.ts +5 -1
package/src/internal/EdgeCache.test.ts +11 -0
package/src/internal/EdgeCache.ts +2 -0
package/src/internal/FundingRoutes.test.ts +8 -8
package/src/internal/FundingRoutes.ts +25 -29
package/src/internal/Log.test.ts +41 -3
package/src/internal/Log.ts +23 -4
package/src/internal/Store.test-d.ts +15 -0
package/src/internal/Store.test.ts +153 -2
package/src/internal/Store.ts +157 -41
package/src/internal/index.test.ts +34 -0
package/src/internal/index.ts +26 -0

package/src/admin/App.ts CHANGED Viewed

@@ -4,11 +4,14 @@ import { requestId, type RequestIdVariables } from 'hono/request-id'
 import * as ApiKey from '../ApiKey.js'
 import type * as Assets from '../Assets.js'
-import type * as Db from '../db/Db.js'
+import type * as Analytics from '../analytics/Analytics.js'
+import * as Db from '../db/Db.js'
+import * as AdminAuditLogs from '../db/tables/adminAuditLogs.js'
 import type * as Store from '../internal/Store.js'
 import * as Response from '../internal/Response.js'
 import { apiKeys } from './apps/api-keys.js'
+import { organizations } from './apps/organizations.js'
 import { scopes } from './apps/scopes.js'
 import { verifiedTokens } from './apps/verified-tokens.js'
 import * as Ui from './ui.generated.js'
@@ -22,6 +25,8 @@ export type Identity = {
 /** Hono environment for the admin app. */
 export type Environment = {
   Variables: RequestIdVariables & {
+    /** ClickHouse analytics source used by operational usage reads. */
+    analytics: Analytics.Source
     /** Static-asset writer (e.g. the R2 icon bucket), when configured. */
     assets: create.Assets | undefined
     /** Authoritative Postgres store, or a per-request factory. Resolve at the leaf with `Db.get`. */
@@ -54,6 +59,7 @@ export function create(options: create.Options) {
   app.use('*', async (c, next) => {
     // Admin data is per-principal and mutating: never cache.
     c.header('Cache-Control', 'no-store')
+    c.set('analytics', options.analytics)
     c.set('assets', options.assets)
     c.set('db', options.db)
     c.set('kv', options.kv)
@@ -73,17 +79,18 @@ export function create(options: create.Options) {
     }
   }
-  // Renders the public SPA shell: injects a `<base href>` of the mount root (so
-  // relative asset/API URLs resolve) and the auth config (read synchronously,
-  // `identity` is `null` when logged out). `<` is escaped to keep `<script>`.
+  // Renders the public SPA shell: stamps its hydration-safe base and auth
+  // placeholders with request values. `<` is escaped to keep the config script.
   const serveShell = (c: Context<Environment>) => {
     const mount = c.req.routePath.replace(/\*$/, '').replace(/\/$/, '')
     const config = JSON.stringify(authConfig(c.get('identity'))).replaceAll('<', '\\u003c')
     return c.html(
-      Ui.shell.replace(
-        '<head>',
-        `<head><base href="${mount}/"/><script>window.__TEMPO_API_CONFIG__=${config}</script>`,
-      ),
+      Ui.shell
+        .replace(
+          '<base data-tempo-base="true" href="/"/>',
+          `<base data-tempo-base="true" href="${mount}/"/>`,
+        )
+        .replace('window.__TEMPO_API_CONFIG__=undefined', `window.__TEMPO_API_CONFIG__=${config}`),
     )
   }
@@ -106,20 +113,46 @@ export function create(options: create.Options) {
       })
     return next()
   }
-  for (const path of [
+  const protectedPaths = [
     '/config.json',
     '/api-keys',
     '/api-keys/*',
+    '/organizations',
+    '/organizations/*',
     '/scopes',
     '/scopes/*',
     '/verified-tokens',
     '/verified-tokens/*',
-  ])
-    app.use(path, requireAuth)
+  ] as const
+  for (const path of protectedPaths) app.use(path, requireAuth)
+  for (const path of protectedPaths)
+    app.use(path, async (c, next) => {
+      const identity = c.get('identity')
+      if (!identity) return
+      const search = new URL(c.req.url).searchParams
+      const record = (status: number) =>
+        AdminAuditLogs.insert(Db.get(c.get('db')), {
+          actor: identity.email,
+          method: c.req.method,
+          path: c.req.path,
+          query: search.size ? search.toString() : undefined,
+          requestId: c.get('requestId'),
+          status,
+        })
+      try {
+        await next()
+      } catch (cause) {
+        await record(500)
+        throw cause
+      }
+      await record(c.res.status)
+    })
   const routed = app
     .get('/config.json', (c) => c.json(authConfig(c.get('identity')), 200))
     .route('/api-keys', apiKeys())
+    .route('/organizations', organizations())
     .route('/scopes', scopes())
     .route('/verified-tokens', verifiedTokens())
@@ -172,15 +205,17 @@ export declare namespace create {
   /** Options for {@link create}. */
   type Options = {
+    /** ClickHouse analytics source used by operational usage reads. */
+    analytics: Analytics.Source
     /**
      * Static-asset writer for logo uploads (shared with the main API's `assets`
      * loader) to enable `PUT /verified-tokens/:address/logo`; omit for `404`.
      */
     assets?: Assets | undefined
     /**
-     * Authoritative Postgres store shared with the main API (verified
-     * tokens). Pass a long-lived `Db.postgres(...)` singleton on Node, or a
-     * factory (`() => Db.postgres(...)`) on Workers.
+     * Authoritative Postgres store shared with the main API. Pass a long-lived
+     * `Db.postgres(...)` singleton on Node, or a factory
+     * (`() => Db.postgres(...)`) on Workers.
      */
     db: Db.Source
     /**

package/src/admin/apps/api-keys.ts CHANGED Viewed

@@ -5,6 +5,7 @@ import * as ApiKeys from '../../ApiKeys.js'
 import * as OpenApi from '../../internal/OpenApi.js'
 import * as Response from '../../internal/Response.js'
 import * as Schema from '../../internal/Schema.js'
+import * as Scope from '../../Scope.js'
 import type * as App from '../App.js'
 /** Zod schemas owned by the admin API-keys handler. */
@@ -16,7 +17,11 @@ export namespace schema {
      * server sets from the verified identity so it can't be spoofed).
      */
     export const Body = Schema.describe(
-      z.omit(ApiKeys.schema.MintInput, { createdBy: true }),
+      z.extend(z.omit(ApiKeys.schema.MintInput, { createdBy: true }), {
+        scopes: z
+          .readonly(z.array(z.enum([...Scope.catalog.map((entry) => entry.scope), Scope.wildcard])))
+          .check(z.describe("Granted scopes. '*' grants all scopes.")),
+      }),
       'Fields accepted when minting an API key.',
     )
@@ -59,7 +64,7 @@ export namespace schema {
     export const Body = Schema.describe(
       z.object({
         orgId: z.optional(z.string()).check(z.describe('New owning organization id (`org_…`).')),
-        projectId: z.optional(z.string()).check(z.describe('New owning project id (`prj_…`).')),
+        projectId: z.optional(z.string()).check(z.describe('New attributed project id (`prj_…`).')),
       }),
       'Attribution to apply to an API key.',
     )
@@ -174,7 +179,9 @@ export function apiKeys() {
       }),
       async (c) => {
         const { orgId } = c.req.valid('query')
-        const data = await ApiKeys.list(c.get('kv').store, orgId ? { orgId } : {})
+        const data = orgId
+          ? await ApiKeys.listByOrg(c.get('kv').store, orgId)
+          : await ApiKeys.list(c.get('kv').store)
         return c.json(Response.validated(schema.listApiKeys.Response, { data }))
       },
     )

package/src/admin/apps/organizations.test.ts ADDED Viewed

@@ -0,0 +1,455 @@
+import type * as Analytics from '../../analytics/Analytics.js'
+import * as ApiKeys from '../../ApiKeys.js'
+import * as BillingSettings from '../../db/tables/billingSettings.js'
+import * as Memberships from '../../db/tables/memberships.js'
+import * as Organizations from '../../db/tables/organizations.js'
+import * as Projects from '../../db/tables/projects.js'
+import * as SponsoredTransactions from '../../db/tables/sponsoredTransactions.js'
+import * as StripeCustomers from '../../db/tables/stripeCustomers.js'
+import * as Users from '../../db/tables/users.js'
+import * as WebhookDeliveries from '../../db/tables/webhookDeliveries.js'
+import * as WebhookSubscriptions from '../../db/tables/webhookSubscriptions.js'
+import * as Viem from '../../internal/Viem.js'
+import * as TestAdmin from '../../../test/Admin.js'
+import * as TestApp from '../../../test/App.js'
+import * as AdminOrganizations from './organizations.js'
+describe('GET /organizations', () => {
+  test('lists summaries newest first with member and project counts', async () => {
+    const { client, db } = TestAdmin.setup()
+    const user = await Users.upsertByAddress(db, {
+      address: `0x${'11'.repeat(20)}`,
+    })
+    await Users.setEmail(db, user.id, 'owner@acme.example')
+    const organization = await Organizations.createOwned(db, { name: 'Acme', userId: user.id })
+    await Projects.create(db, { name: 'Checkout', orgId: organization.id })
+    await Projects.create(db, { name: 'Treasury', orgId: organization.id })
+    const response = await client.organizations.$get({ query: {} })
+    const body = await TestApp.json(response, AdminOrganizations.schema.listOrganizations.Response)
+    expect(response.status).toBe(200)
+    expect(body.nextCursor).toBeNull()
+    expect(body.data).toHaveLength(1)
+    expect(body.data[0]).toMatchObject({
+      id: organization.id,
+      memberCount: 1,
+      name: 'Acme',
+      projectCount: 2,
+      userId: user.id,
+    })
+  })
+  test('searches organization and member identity fields case-insensitively', async () => {
+    const { client, db } = TestAdmin.setup()
+    const user = await Users.upsertByAddress(db, {
+      address: `0x${'22'.repeat(20)}`,
+    })
+    await Users.setEmail(db, user.id, 'Owner@Example.com')
+    const organization = await Organizations.createOwned(db, {
+      name: 'Merchant Operations',
+      userId: user.id,
+    })
+    await Organizations.create(db, { id: 'org_unrelated', name: 'Unrelated' })
+    for (const query of ['merchant', organization.id, user.id, 'owner@']) {
+      const response = await client.organizations.$get({ query: { query } })
+      const body = await TestApp.json(
+        response,
+        AdminOrganizations.schema.listOrganizations.Response,
+      )
+      expect(body.data.map(({ id }) => id)).toEqual([organization.id])
+    }
+  })
+  test('treats SQL wildcard characters as literal search text', async () => {
+    const { client, db } = TestAdmin.setup()
+    const organization = await Organizations.create(db, { name: 'A_B Merchant' })
+    await Organizations.create(db, { name: 'AcB Merchant' })
+    const response = await client.organizations.$get({ query: { query: 'a_b' } })
+    const body = await TestApp.json(response, AdminOrganizations.schema.listOrganizations.Response)
+    expect(body.data.map(({ id }) => id)).toEqual([organization.id])
+  })
+  test('orders distinct creation times newest first', async () => {
+    const { client, db } = TestAdmin.setup()
+    vi.useFakeTimers()
+    try {
+      vi.setSystemTime(new Date('2026-01-01T00:00:00.000Z'))
+      const older = await Organizations.create(db, { name: 'Older' })
+      vi.setSystemTime(new Date('2026-01-02T00:00:00.000Z'))
+      const newer = await Organizations.create(db, { name: 'Newer' })
+      const response = await client.organizations.$get({ query: {} })
+      const body = await TestApp.json(
+        response,
+        AdminOrganizations.schema.listOrganizations.Response,
+      )
+      expect(body.data.map(({ id }) => id)).toEqual([newer.id, older.id])
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+  test('rejects broad queries shorter than three characters', async () => {
+    const { client } = TestAdmin.setup()
+    const response = await client.organizations.$get({ query: { query: 'a' } })
+    expect(response.status).toBe(400)
+  })
+  test('walks a stable cursor without duplicate organizations', async () => {
+    const { client, db } = TestAdmin.setup()
+    for (const id of ['org_f', 'org_e', 'org_d', 'org_c', 'org_b', 'org_a'])
+      await Organizations.create(db, { id, name: id })
+    const firstResponse = await client.organizations.$get({ query: { limit: '5' } })
+    const first = await TestApp.json(
+      firstResponse,
+      AdminOrganizations.schema.listOrganizations.Response,
+    )
+    expect(first.data).toHaveLength(5)
+    expect(first.nextCursor).not.toBeNull()
+    const secondResponse = await client.organizations.$get({
+      query: { cursor: first.nextCursor!, limit: '5' },
+    })
+    const second = await TestApp.json(
+      secondResponse,
+      AdminOrganizations.schema.listOrganizations.Response,
+    )
+    expect(second.data).toHaveLength(1)
+    expect(second.nextCursor).toBeNull()
+    expect(new Set([...first.data, ...second.data].map(({ id }) => id)).size).toBe(6)
+  })
+})
+describe('GET /organizations/:orgId', () => {
+  test('returns counts and billing state split by environment', async () => {
+    const { client, db } = TestAdmin.setup()
+    const user = await Users.upsertByAddress(db, {
+      address: `0x${'33'.repeat(20)}`,
+    })
+    await Users.setEmail(db, user.id, 'owner@tempo.xyz')
+    const organization = await Organizations.createOwned(db, { name: 'Tempo', userId: user.id })
+    await Projects.create(db, { name: 'API', orgId: organization.id })
+    await BillingSettings.upsert(db, {
+      environment: 'production',
+      orgId: organization.id,
+      spendLimit: '250',
+      txFeeLimit: '0.50',
+    })
+    await BillingSettings.upsert(db, {
+      environment: 'sandbox',
+      orgId: organization.id,
+      spendLimit: '1000',
+    })
+    await StripeCustomers.create(db, {
+      environment: 'production',
+      orgId: organization.id,
+      stripeCustomerId: 'cus_admin_lookup',
+    })
+    await StripeCustomers.setStatus(db, organization.id, 'active', 'production')
+    const response = await client.organizations[':orgId'].$get({
+      param: { orgId: organization.id },
+    })
+    const body = await TestApp.json(response, AdminOrganizations.schema.getOrganization.Response)
+    expect(response.status).toBe(200)
+    expect(body.memberCount).toBe(1)
+    expect(body.projectCount).toBe(1)
+    expect(body.billing.production).toMatchObject({
+      settings: { spendLimit: '250', txFeeLimit: '0.50' },
+      source: { status: 'active', stripeCustomerId: 'cus_admin_lookup' },
+    })
+    expect(body.billing.sandbox).toMatchObject({
+      settings: { spendLimit: '1000', txFeeLimit: null },
+      source: null,
+    })
+  })
+  test('returns empty counts and billing for a memberless organization', async () => {
+    const { client, db } = TestAdmin.setup()
+    const organization = await Organizations.create(db, { name: 'Support-created' })
+    const response = await client.organizations[':orgId'].$get({
+      param: { orgId: organization.id },
+    })
+    const body = await TestApp.json(response, AdminOrganizations.schema.getOrganization.Response)
+    expect(body).toMatchObject({
+      billing: {
+        production: { settings: null, source: null },
+        sandbox: { settings: null, source: null },
+      },
+      memberCount: 0,
+      projectCount: 0,
+    })
+  })
+  test('returns 404 for an unknown organization', async () => {
+    const { client } = TestAdmin.setup()
+    const response = await client.organizations[':orgId'].$get({
+      param: { orgId: 'org_missing' },
+    })
+    const body = (await response.json()) as { error: { code: string } }
+    expect(response.status).toBe(404)
+    expect(body.error.code).toBe('not_found')
+  })
+})
+describe('GET /organizations/:orgId/members', () => {
+  test('returns a bounded cursor page without duplicates', async () => {
+    const { client, db } = TestAdmin.setup()
+    const organization = await Organizations.create(db, { name: 'Members' })
+    for (let index = 0; index < 6; index++) {
+      const user = await Users.upsertByAddress(db, {
+        address: `0x${String(index + 1).padStart(40, '0')}`,
+      })
+      await Users.setEmail(db, user.id, `member-${index}@example.com`)
+      await Memberships.create(db, { orgId: organization.id, role: 'member', userId: user.id })
+    }
+    const firstResponse = await client.organizations[':orgId'].members.$get({
+      param: { orgId: organization.id },
+      query: { limit: '5' },
+    })
+    const first = await TestApp.json(
+      firstResponse,
+      AdminOrganizations.schema.listOrganizationMembers.Response,
+    )
+    const secondResponse = await client.organizations[':orgId'].members.$get({
+      param: { orgId: organization.id },
+      query: { cursor: first.nextCursor!, limit: '5' },
+    })
+    const second = await TestApp.json(
+      secondResponse,
+      AdminOrganizations.schema.listOrganizationMembers.Response,
+    )
+    expect(first.data).toHaveLength(5)
+    expect(second.data).toHaveLength(1)
+    expect(new Set([...first.data, ...second.data].map(({ userId }) => userId)).size).toBe(6)
+  })
+})
+describe('GET /organizations/:orgId/projects', () => {
+  test('returns a bounded cursor page without duplicates', async () => {
+    const { client, db } = TestAdmin.setup()
+    const organization = await Organizations.create(db, { name: 'Projects' })
+    for (let index = 0; index < 6; index++)
+      await Projects.create(db, { name: `Project ${index}`, orgId: organization.id })
+    const firstResponse = await client.organizations[':orgId'].projects.$get({
+      param: { orgId: organization.id },
+      query: { limit: '5' },
+    })
+    const first = await TestApp.json(
+      firstResponse,
+      AdminOrganizations.schema.listOrganizationProjects.Response,
+    )
+    const secondResponse = await client.organizations[':orgId'].projects.$get({
+      param: { orgId: organization.id },
+      query: { cursor: first.nextCursor!, limit: '5' },
+    })
+    const second = await TestApp.json(
+      secondResponse,
+      AdminOrganizations.schema.listOrganizationProjects.Response,
+    )
+    expect(first.data).toHaveLength(5)
+    expect(second.data).toHaveLength(1)
+    expect(new Set([...first.data, ...second.data].map(({ id }) => id)).size).toBe(6)
+  })
+})
+describe('GET /organizations/:orgId/api-keys', () => {
+  test('returns active key environment, scopes, and creator without tokens', async () => {
+    const { client, db, store } = TestAdmin.setup()
+    const organization = await Organizations.create(db, { name: 'Keys' })
+    await ApiKeys.mint(store, {
+      createdBy: 'ops@tempo.xyz',
+      environment: 'sandbox',
+      orgId: organization.id,
+      scopes: ['data:read'],
+    })
+    const response = await client.organizations[':orgId']['api-keys'].$get({
+      param: { orgId: organization.id },
+    })
+    const body = await TestApp.json(
+      response,
+      AdminOrganizations.schema.listOrganizationApiKeys.Response,
+    )
+    expect(body.data[0]).toMatchObject({
+      createdBy: 'ops@tempo.xyz',
+      environment: 'sandbox',
+      scopes: ['data:read'],
+    })
+    expect(body.data[0]).not.toHaveProperty('status')
+    expect(body.data[0]).not.toHaveProperty('token')
+  })
+})
+describe('GET /organizations/:orgId/usage', () => {
+  test('returns recent totals and error breakdowns from analytics', async () => {
+    const { client, db } = TestAdmin.setup({ analytics: usageAnalytics })
+    const organization = await Organizations.create(db, { name: 'Usage' })
+    const response = await client.organizations[':orgId'].usage.$get({
+      param: { orgId: organization.id },
+      query: { period: '7d' },
+    })
+    const body = await TestApp.json(
+      response,
+      AdminOrganizations.schema.getOrganizationUsage.Response,
+    )
+    expect(body).toMatchObject({
+      byError: [{ code: 'upstream_error', requests: 2 }],
+      byRoute: [{ averageDurationMs: 12.5, errors: 2, requests: 20, route: '/v1/tokens' }],
+      byStatus: [{ requests: 2, status: 500 }],
+      period: '7d',
+      totals: { averageDurationMs: 10.5, errors: 2, requests: 25 },
+    })
+  })
+})
+describe('GET /organizations/:orgId/sponsorship', () => {
+  test('returns current-period committed spend split by environment', async () => {
+    const { client, db } = TestAdmin.setup()
+    const organization = await Organizations.create(db, { name: 'Sponsorship' })
+    await SponsoredTransactions.upsert(db, {
+      apiKeyId: 'key_1',
+      billable: true,
+      chainId: Viem.chainId.mainnet,
+      environment: 'production',
+      feeMax: '1250000',
+      orgId: organization.id,
+      projectId: 'prj_1',
+      signPayload: `0x${'11'.repeat(32)}`,
+      transaction: `0x${'22'.repeat(32)}`,
+    })
+    const response = await client.organizations[':orgId'].sponsorship.$get({
+      param: { orgId: organization.id },
+    })
+    const body = await TestApp.json(
+      response,
+      AdminOrganizations.schema.getOrganizationSponsorship.Response,
+    )
+    expect(body.production).toMatchObject({
+      committedSpend: '1.25',
+      currency: 'usd',
+      period: 'month',
+    })
+    expect(body.sandbox).toMatchObject({
+      committedSpend: '0',
+      currency: 'usd',
+      period: 'month',
+    })
+  })
+})
+describe('GET /organizations/:orgId/webhooks', () => {
+  test('redacts destinations and returns recent delivery failures', async () => {
+    const { client, db } = TestAdmin.setup()
+    const organization = await Organizations.create(db, { name: 'Webhooks' })
+    const createdAt = new Date().toISOString()
+    await WebhookSubscriptions.insert(db, {
+      chainId: 4217,
+      createdAt,
+      destination: { type: 'url', url: 'https://hooks.example.com/private/path' },
+      eventType: 'token:transfer',
+      failureCount: 1,
+      filters: {},
+      id: 'wh_admin_visibility',
+      owner: { orgId: organization.id, type: 'api_key' },
+      secret: 'secret',
+      status: 'active',
+      updatedAt: createdAt,
+    })
+    for (let index = 0; index < 26; index++)
+      await WebhookDeliveries.insert(
+        db,
+        {
+          attempt: 1,
+          createdAt,
+          envelope: {
+            chainId: 4217,
+            createdAt,
+            data: {},
+            id: `evt_admin_visibility_${index}`,
+            subscriptionId: 'wh_admin_visibility',
+            type: 'token:transfer',
+          },
+          error: 'HTTP 500',
+          eventId: `evt_admin_visibility_${index}`,
+          id: `whd_admin_visibility_${index}`,
+          requestUrl: 'https://hooks.example.com/private/path',
+          responseStatus: 500,
+          status: 'failed',
+          subscriptionId: 'wh_admin_visibility',
+        },
+        new Date(Date.now() + 60_000).toISOString(),
+      )
+    const oldCreatedAt = new Date(Date.now() - 8 * 24 * 60 * 60 * 1_000).toISOString()
+    await WebhookDeliveries.insert(
+      db,
+      {
+        attempt: 1,
+        createdAt: oldCreatedAt,
+        envelope: {
+          chainId: 4217,
+          createdAt: oldCreatedAt,
+          data: {},
+          id: 'evt_admin_visibility_old',
+          subscriptionId: 'wh_admin_visibility',
+          type: 'token:transfer',
+        },
+        error: 'HTTP 500',
+        eventId: 'evt_admin_visibility_old',
+        id: 'whd_admin_visibility_old',
+        requestUrl: 'https://hooks.example.com/private/path',
+        responseStatus: 500,
+        status: 'failed',
+        subscriptionId: 'wh_admin_visibility',
+      },
+      new Date(Date.now() + 60_000).toISOString(),
+    )
+    const response = await client.organizations[':orgId'].webhooks.$get({
+      param: { orgId: organization.id },
+    })
+    const body = await TestApp.json(
+      response,
+      AdminOrganizations.schema.getOrganizationWebhooks.Response,
+    )
+    expect(body.subscriptions[0]?.destination).toBe('https://hooks.example.com/…')
+    expect(body.failureCount).toBe(26)
+    expect(body.failures).toHaveLength(25)
+    expect(body.failures[0]).toMatchObject({ error: 'HTTP 500', responseStatus: 500 })
+    expect(body.failuresTruncated).toBe(true)
+  })
+})
+const usageAnalytics: Analytics.Analytics = {
+  async insert() {},
+  async migrate() {},
+  async query(sql) {
+    if (sql.includes('GROUP BY error_code'))
+      return [{ code: 'upstream_error', requests: 2 }] as never[]
+    if (sql.includes('GROUP BY route'))
+      return [{ averageDurationMs: 12.5, errors: 2, requests: 20, route: '/v1/tokens' }] as never[]
+    if (sql.includes('GROUP BY status')) return [{ requests: 2, status: 500 }] as never[]
+    if (sql.includes('GROUP BY key_id') || sql.includes('GROUP BY toStartOf')) return []
+    return [{ averageDurationMs: 10.5, errors: 2, requests: 25 }] as never[]
+  },
+}