tapimo 0.4.1 → 0.4.4

package/src/apps/management/routes/scopes.test.ts

@@ -19,6 +19,8 @@ describe('scopes', () => {
       [
         "data:read",
         "indexer:query",
+        "management:read",
+        "management:write",
         "rpc-relay:read",
         "rpc-relay:sponsor",
         "webhooks:read",
@@ -26,4 +28,18 @@ describe('scopes', () => {
       ]
     `)
   })
+
+  test('includes host scopes configured on the app', async () => {
+    const custom = {
+      description: 'Read project accounts.',
+      scope: 'accounts:read',
+      selfServe: true,
+    } as const satisfies Scope.Entry
+    const app = TestApp.create({ scopes: [custom] })
+    const response = await app.request('/v1/scopes')
+    const body = await TestApp.json(response, Scopes.schema.getScopes.Response)
+
+    expect(response.status).toBe(200)
+    expect(body.data).toEqual([...Scope.catalog, custom])
+  })
 })

package/src/apps/management/routes/scopes.ts

@@ -6,7 +6,6 @@ import * as Auth from '../../../internal/Auth.js'
 import * as Cache from '../../../internal/Cache.js'
 import * as OpenApi from '../../../internal/OpenApi.js'
 import * as Response from '../../../internal/Response.js'
-import * as Scope from '../../../Scope.js'
 
 /** Zod schemas owned by the scope-catalog resource. */
 export namespace schema {
@@ -22,7 +21,7 @@ export namespace schema {
             z.meta({ examples: ['Read webhook subscriptions.'] }),
           ),
         scope: z
-          .enum(Scope.catalog.map((entry) => entry.scope))
+          .string()
           .check(
             z.describe('Scope identifier used in API-key grants and route policies.'),
             z.meta({ examples: ['data:read'] }),
@@ -30,7 +29,7 @@ export namespace schema {
         selfServe: z
           .boolean()
           .check(
-            z.describe('Whether a session may self-mint this scope (else super-admin-only).'),
+            z.describe('Whether an eligible session may self-mint this scope.'),
             z.meta({ examples: [true] }),
           ),
       })
@@ -47,13 +46,13 @@ export namespace schema {
 
 /**
  * Mounts the `/scopes` resource: the issuable API-key scope vocabulary, served
- * from {@link Scope.catalog}. Public catalog data: anonymous callers are served
+ * from the configured catalog. Public catalog data: anonymous callers are served
  * within the public quota; the session lane lets signed-in consoles skip it.
  */
 export function scopes() {
   return new Hono<App.Environment>().get(
     '/v1/scopes',
-    Auth.policy({ public: true, session: true }),
+    Auth.policy({ apiKey: { scopes: [] }, public: true, session: true }),
     OpenApi.describeRoute({
       description: 'See which scopes can be granted to API keys.',
       operationId: 'getScopes',
@@ -65,7 +64,7 @@ export function scopes() {
     }),
     Cache.response<App.Environment>({
       cacheControl: Cache.policies.stable,
-      name: 'tempo-api:scopes:v1',
+      name: 'tempo-api:scopes:v2',
       key: (c) => {
         const url = new URL(c.req.url)
         url.search = ''
@@ -76,7 +75,7 @@ export function scopes() {
       if (Auth.narrowAccess) return Auth.accessError(c)
       return c.json(
         Response.validated(schema.getScopes.Response, {
-          data: Scope.catalog.map((entry) => ({ ...entry })),
+          data: c.get('scopeCatalog').map((entry) => ({ ...entry })),
         }),
         200,
       )

package/src/apps/management/routes/usage.ts

@@ -285,16 +285,12 @@ export namespace schema {
   }
 }
 
-/**
- * Mounts the usage surface: project request usage (read from a host-supplied
- * analytics capability) and an organization's sponsorship volume and fees
- * over time. Session lane; reads for members.
- */
+/** Mounts organization request and sponsorship usage. Reads require membership or a scoped API key. */
 export function usage() {
   return new Hono<Environment>()
     .get(
       '/v1/orgs/:orgId{org_[A-Za-z0-9_-]+}/usage/requests',
-      Auth.policy({ session: true }),
+      Auth.policy({ apiKey: { scopes: ['management:read'] }, session: true }),
       Auth.ensureOrg(),
       OpenApi.validate('param', schema.getRequestUsage.Params, {
         code: 'param_invalid',
@@ -327,7 +323,7 @@ export function usage() {
         tags: ['Usage'],
       }),
       async (c) => {
-        if (Auth.narrowAccess) return Auth.superAdminAccessError(c)
+        if (Auth.narrowAccess) return Auth.accessError(c)
         if (Auth.narrowScope) return Auth.ensureOrgError(c)
         if (OpenApi.narrowValidation)
           return OpenApi.validationError(c, {
@@ -398,7 +394,7 @@ export function usage() {
     )
     .get(
       '/v1/orgs/:orgId{org_[A-Za-z0-9_-]+}/usage/sponsorships',
-      Auth.policy({ session: true }),
+      Auth.policy({ apiKey: { scopes: ['management:read'] }, session: true }),
       Auth.ensureOrg(),
       OpenApi.validate('param', schema.getSponsorshipUsage.Params, {
         code: 'param_invalid',
@@ -423,7 +419,7 @@ export function usage() {
         tags: ['Usage'],
       }),
       async (c) => {
-        if (Auth.narrowAccess) return Auth.superAdminAccessError(c)
+        if (Auth.narrowAccess) return Auth.accessError(c)
         if (Auth.narrowScope) return Auth.ensureOrgError(c)
         if (OpenApi.narrowValidation)
           return OpenApi.validationError(c, {
@@ -498,11 +494,10 @@ async function legacyKeyIds(
 ): Promise<readonly string[]> {
   const kv = c.get('kv')
   if (!kv) return []
-  const records = await ApiKeys.listByOrg(
-    kv.store,
-    Auth.org(c).id,
-    options.projectId === undefined ? {} : { projectId: options.projectId },
-  )
+  const records = await ApiKeys.listByOrg(kv.store, Auth.org(c).id, {
+    ...(options.projectId === undefined ? {} : { projectId: options.projectId }),
+    scopeCatalog: c.get('scopeCatalog'),
+  })
   return records
     .filter(
       (record) => options.environment === undefined || record.environment === options.environment,

package/src/apps/mcp.test.ts

@@ -91,6 +91,46 @@ async function toolsCall(
   }
 }
 
+/** Searches every page of the progressive tool catalog. */
+async function toolsSearch(host: Host) {
+  const tools: { annotations?: { readOnlyHint?: boolean }; name: string }[] = []
+  let offset = 0
+  while (true) {
+    const result = resultJson(await toolsCall(host, 'search_tools', { limit: 20, offset })) as {
+      nextOffset?: number
+      tools: typeof tools
+    }
+    tools.push(...result.tools)
+    if (result.nextOffset === undefined) return tools
+    offset = result.nextOffset
+  }
+}
+
+/** Loads the complete schema and metadata for one catalog tool. */
+async function toolDetails(host: Host, name: string) {
+  return resultJson(await toolsCall(host, 'get_tool_details', { name })) as {
+    annotations?: { readOnlyHint?: boolean }
+    inputSchema: { properties?: Record<string, { description?: string }> }
+    name: string
+  }
+}
+
+/** Inspects and executes a generated tool through its matching read or write gate. */
+async function generatedToolCall(
+  host: Host,
+  name: string,
+  args: Record<string, unknown>,
+  headers: Record<string, string> = {},
+) {
+  const details = await toolDetails(host, name)
+  return toolsCall(
+    host,
+    details.annotations?.readOnlyHint === true ? 'call_read_tool' : 'call_write_tool',
+    { arguments: args, name },
+    headers,
+  )
+}
+
 /** Parses a tool result: structured content when present, else the JSON text item. */
 function resultJson(result: Awaited<ReturnType<typeof toolsCall>>) {
   return result.structuredContent ?? JSON.parse(result.content[0]!.text)
@@ -108,7 +148,13 @@ test('scopes tools to the data domain', async () => {
   expect(Object.keys(spec.paths).some((path) => path.startsWith('/v1/orgs'))).toBe(true)
 
   await initialize(host)
-  const tools = await toolsList(host)
+  expect(await toolsList(host)).toEqual([
+    'search_tools',
+    'get_tool_details',
+    'call_read_tool',
+    'call_write_tool',
+  ])
+  const tools = (await toolsSearch(host)).map((tool) => tool.name)
 
   expect(tools).toContain('v1_tokens_get')
   expect(tools).toContain('docs_search')
@@ -121,6 +167,25 @@ test('scopes tools to the data domain', async () => {
   expect(tools.some((name) => name.startsWith('v1_me'))).toBe(false)
 })
 
+test('keeps tool input schemas compact', async () => {
+  const { host } = createHost()
+  await initialize(host)
+
+  const tool = await toolDetails(host, 'v1_tokens_get')
+  const properties = tool.inputSchema.properties ?? {}
+
+  // Credential inputs stay off the schema; auth rides the forwarded header.
+  expect(properties['authorization']).toBeUndefined()
+  expect(properties['tempo-api-key']).toBeUndefined()
+  // Shared parameters carry the terse tool descriptions.
+  expect(properties['limit']?.description).toBe('Items per page.')
+  expect(properties['cursor']?.description).toBe(
+    'Keyset cursor from a previous response `nextCursor`; omit for the first page.',
+  )
+  // `compact` strips examples from generated schemas.
+  expect(JSON.stringify(tool.inputSchema)).not.toContain('"examples"')
+})
+
 test('executes generated tools against the composed app', async () => {
   // Verified tokens are database-backed, so seed the default chain.
   const db = TestApp.database()
@@ -128,7 +193,7 @@ test('executes generated tools against the composed app', async () => {
   const { host } = createHost({ app: TestApp.create({ db }) })
 
   await initialize(host)
-  const result = await toolsCall(host, 'v1_tokens_get', { verified: true })
+  const result = await generatedToolCall(host, 'v1_tokens_get', { verified: true })
 
   expect(result.isError).toBeFalsy()
   const body = resultJson(result) as { data: { verified: boolean }[]; nextCursor: unknown }
@@ -140,10 +205,10 @@ test('forwards the caller Authorization header to authenticated tools', async ()
   const { host } = createHost({ app: TestApp.create({ auth: { keys: [reader] } }) })
   await initialize(host)
 
-  const denied = await toolsCall(host, 'v1_webhooks_get', {})
+  const denied = await generatedToolCall(host, 'v1_webhooks_get', {})
   expect(denied.isError).toBe(true)
 
-  const allowed = await toolsCall(
+  const allowed = await generatedToolCall(
     host,
     'v1_webhooks_get',
     {},
@@ -157,7 +222,7 @@ test('proxies docs tool calls to the remote MCP source', async () => {
   const { host } = createHost({ docs: docsStub() })
   await initialize(host)
 
-  const result = await toolsCall(host, 'docs_search', { query: 'fees' })
+  const result = await generatedToolCall(host, 'docs_search', { query: 'fees' })
 
   expect(result.isError).toBeFalsy()
   expect(resultJson(result)).toMatchObject({ hits: ['fees'] })
@@ -176,7 +241,7 @@ test('documents POST /mcp and keeps it open under auth enforcement', async () =>
   expect(operation?.operationId).toBe('mcpRequest')
   expect(operation?.tags).toEqual(['MCP'])
   // Anonymous and any-valid-key access; no required scopes.
-  expect(operation?.security).toEqual([{ apiKey: [] }, { bearerAuth: [] }, {}])
+  expect(operation?.security).toEqual([{ apiKey: [] }, { queryApiKey: [] }, { bearerAuth: [] }, {}])
 
   // Surfaces under `Data API` in the reference, but the tool filter excludes the `MCP` tag.
   const groups = Object.fromEntries(spec['x-tagGroups'].map((group) => [group.name, group.tags]))
@@ -186,7 +251,7 @@ test('documents POST /mcp and keeps it open under auth enforcement', async () =>
   // Documenting the route makes it auth-enforced; the public lane keeps it
   // anonymously reachable, and the endpoint never surfaces itself as a tool.
   await initialize(app)
-  const tools = await toolsList(app)
+  const tools = (await toolsSearch(app)).map((tool) => tool.name)
   expect(tools.length).toBeGreaterThan(0)
   expect(tools.some((name) => name.startsWith('mcp'))).toBe(false)
 

package/src/apps/mcp.ts

@@ -15,7 +15,7 @@ const excludedTags = ['CoinGecko', 'MCP']
 
 /** Usage guidance surfaced to MCP clients on initialize. */
 const instructions =
-  "Tools mirror the Tempo API's data domain. Authenticated tools accept a Tempo API key: send it as an `Authorization: Bearer` header on the HTTP request, or pass the `authorization` tool input per call. List endpoints paginate via `cursor`/`nextCursor`. `docs_*` tools search the Tempo documentation."
+  "Tools mirror the Tempo API's data domain. Authenticated tools accept a Tempo API key sent as an `Authorization: Bearer` header on the HTTP request. List endpoints paginate via `cursor`/`nextCursor`. `docs_*` tools search the Tempo documentation."
 
 /** Zod schemas owned by the MCP endpoint's OpenAPI description. */
 export namespace schema {
@@ -97,7 +97,15 @@ export function mcp(options: mcp.Options) {
       },
       mcp: { instructions },
       openapi: scope(document),
-      openapiConfig: { forwardHeaders: ['authorization'], mode: 'namespace' },
+      // `compact` + `security: false` keep tool schemas lean: no examples,
+      // oversized regexes, or per-tool credential inputs (auth rides the
+      // forwarded `Authorization` header).
+      openapiConfig: {
+        compact: true,
+        forwardHeaders: ['authorization'],
+        mode: 'namespace',
+        security: false,
+      },
       version,
     })
     if (docs !== false)
@@ -139,7 +147,9 @@ export function mcp(options: mcp.Options) {
                 example: {
                   jsonrpc: '2.0',
                   id: 1,
-                  result: { tools: [{ name: 'v1_tokens_get', description: 'List tokens' }] },
+                  result: {
+                    tools: [{ name: 'search_tools', description: 'Search available tools' }],
+                  },
                 },
                 schema: OpenApi.resolver(schema.Response),
               },
@@ -217,11 +227,43 @@ function scope(document: Document): Openapi.OpenAPISpec {
       return tags_operation?.some((tag) => tags.has(tag)) ?? false
     })
     if (entries.some(([method]) => methods.includes(method)))
-      paths[path] = Object.fromEntries(entries)
+      paths[path] = Object.fromEntries(
+        entries.map(([method, operation]) =>
+          methods.includes(method) ? [method, condense(operation)] : [method, operation],
+        ),
+      )
   }
   return { ...document, paths }
 }
 
+/** Terse tool descriptions for parameters repeated across most operations; the public document keeps the full prose. */
+const parameterDescriptions: Record<string, string> = {
+  chainId: 'Chain: `mainnet` (default), `testnet`, or a numeric chain id.',
+  cursor: 'Keyset cursor from a previous response `nextCursor`; omit for the first page.',
+  include: 'Comma-separated related resources to include.',
+  limit: 'Items per page.',
+  order: 'Sort order: `asc` or `desc` (default).',
+  page: '1-indexed page number; mutually exclusive with `cursor`.',
+}
+
+/** Swaps shared query-parameter prose for the terse tool descriptions. */
+function condense(operation: unknown) {
+  const { parameters } = operation as {
+    parameters?: readonly { in?: string; name?: string }[] | undefined
+  }
+  if (!parameters) return operation
+  return {
+    ...(operation as object),
+    parameters: parameters.map((parameter) => {
+      const description =
+        parameter.in === 'query' && parameter.name
+          ? parameterDescriptions[parameter.name]
+          : undefined
+      return description ? { ...parameter, description } : parameter
+    }),
+  }
+}
+
 export declare namespace mcp {
   /** Options for the MCP route group. */
   type Options = {

package/src/apps/relay/App.test.ts

@@ -29,14 +29,14 @@ const senderAccount = Tempo.accounts[9]!
 /** Super admin secret configured on the end-to-end billing app. */
 const superAdminSecret = 'tempo:sk:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1'
 
-/** Keys covering the sponsorship policy matrix; all hold the base relay scope. */
+/** Keys covering the sponsorship policy matrix. */
 const keys = [
   {
     id: 'key_sponsor',
     orgId: 'org_1',
     projectId: 'prj_1',
     environment: 'sandbox',
-    scopes: ['rpc-relay:read', 'rpc-relay:sponsor'],
+    scopes: ['rpc-relay:sponsor'],
     token: 'secret_sponsor',
   },
   {
@@ -44,7 +44,7 @@ const keys = [
     orgId: 'org_1',
     projectId: 'prj_1',
     environment: 'production',
-    scopes: ['rpc-relay:read', 'rpc-relay:sponsor'],
+    scopes: ['rpc-relay:sponsor'],
     token: 'secret_sponsor_prod',
   },
   {
@@ -75,7 +75,7 @@ const keys = [
     id: 'key_unattributed',
     orgId: 'org_1',
     environment: 'sandbox',
-    scopes: ['rpc-relay:read', 'rpc-relay:sponsor'],
+    scopes: ['rpc-relay:sponsor'],
     token: 'secret_unattributed',
   },
 ] as const satisfies readonly TestApp.kvStore.Key[]
@@ -169,7 +169,7 @@ describe.skipIf(runtime.mode !== 'localnet')('behavior: sponsorship', () => {
     expect(row?.orgId).toMatchInlineSnapshot(`"org_2"`)
   })
 
-  test('behavior: keys without the sponsor scope are refused', async () => {
+  test('behavior: read-only keys cannot access the sponsor route', async () => {
     const db = TestApp.database()
     const app = TestApp.create({
       auth: { keys },
@@ -177,14 +177,15 @@ describe.skipIf(runtime.mode !== 'localnet')('behavior: sponsorship', () => {
       relay: { feePayer: { account: feePayerAccount } },
     })
 
-    const body = await relayRequest(app, {
-      method: 'eth_signRawTransaction',
-      params: [await signSponsorable()],
-      token: 'secret_unscoped',
-    })
-    // "Sponsorship rejected." surfaces as invalid params (-32602).
-    expect(body.result).toBeUndefined()
-    expect(body.error?.code).toBe(-32602)
+    const response = await app.fetch(
+      new Request('http://tempo-api.test/rpc/sponsor', {
+        body: JSON.stringify({ id: 1, jsonrpc: '2.0', method: 'eth_chainId' }),
+        headers: { 'content-type': 'application/json', 'tempo-api-key': 'secret_unscoped' },
+        method: 'POST',
+      }),
+    )
+    expect(response.status).toBe(403)
+    expect(await response.json()).toMatchObject({ error: { code: 'api_key_forbidden' } })
     expect(await SponsoredTransactions.listPending(db)).toHaveLength(0)
   })
 
@@ -288,12 +289,16 @@ describe.skipIf(runtime.mode !== 'localnet')('behavior: sponsorship', () => {
           nonce: '0x0',
         },
       ],
-      token: 'secret_unscoped',
+      token: 'secret_sponsor',
     })
     const result = body.result as unknown as
-      | { capabilities?: { sponsored?: boolean }; tx?: { feePayerSignature?: string | null } }
+      | {
+          capabilities?: { balanceDiffs?: unknown; sponsored?: boolean }
+          tx?: { feePayerSignature?: string | null }
+        }
       | undefined
     expect(result?.tx?.feePayerSignature ?? null).toBeNull()
+    expect(result?.capabilities?.balanceDiffs).toBeUndefined()
     expect(result?.capabilities?.sponsored).toBe(false)
     expect(await SponsoredTransactions.listPending(db)).toHaveLength(0)
   })
@@ -629,7 +634,7 @@ describe.skipIf(runtime.mode !== 'localnet')('behavior: sponsorship (viem)', ()
       chain: Tempo.chain,
       transport: withRelay(
         Relay.http(),
-        http(`${server.url}/rpc/relay`, {
+        http(`${server.url}/rpc/sponsor`, {
           fetchOptions: { headers: { 'tempo-api-key': 'secret_sponsor' } },
         }),
         policy ? { policy } : {},
@@ -785,13 +790,13 @@ async function signSponsorable(
   })
 }
 
-/** Posts one JSON-RPC request to the composed app's relay mount. */
+/** Posts one JSON-RPC request to the composed app's sponsor mount. */
 async function relayRequest(
   app: ReturnType<typeof TestApp.create>,
   options: { method: string; params: readonly unknown[]; token?: string | undefined },
 ) {
   const response = await app.fetch(
-    new Request('http://tempo-api.test/rpc/relay', {
+    new Request('http://tempo-api.test/rpc/sponsor', {
       body: JSON.stringify({ id: 1, jsonrpc: '2.0', method: options.method, params: options.params }), // prettier-ignore
       headers: {
         'content-type': 'application/json',

package/src/apps/relay/App.ts

@@ -18,16 +18,17 @@ import * as Viem from '../../internal/Viem.js'
 import * as Scope from '../../Scope.js'
 
 /**
- * The relay route group: the wallet relay at `/rpc/relay`. Mount
- * after `data()`, whose published chain clients and supported-chain set the
- * middleware reads from request context.
+ * The relay route group exposes wallet features at `/rpc/relay` and fee
+ * sponsorship at `/rpc/sponsor`. Mount it after `data()`, which publishes
+ * chain clients and supported chains.
  *
  * ```ts
  * App.create(options).route('/', data()).route('/', relay())
  * ```
  */
 export function relay(options: relay.Options = {}) {
-  const handler = middleware(options)
+  const handler_relay = middleware({ ...options, features: 'all', path: 'rpc/relay' })
+  const handler_sponsor = middleware({ ...options, path: 'rpc/sponsor' })
   return new Hono<App.Environment>()
     .use(
       '/rpc/relay',
@@ -39,8 +40,20 @@ export function relay(options: relay.Options = {}) {
       Auth.policy({ apiKey: { scopes: ['rpc-relay:read'] }, mpp: false, public: false }),
       OpenApi.describeRoute({ hide: true, summary: 'Relay RPC' }),
     )
-    .all('/rpc/relay', handler)
-    .all('/rpc/relay/:chainId', handler)
+    .all('/rpc/relay', handler_relay)
+    .all('/rpc/relay/:chainId', handler_relay)
+    .use(
+      '/rpc/sponsor',
+      Auth.policy({ apiKey: { scopes: ['rpc-relay:sponsor'] }, mpp: false, public: false }),
+      OpenApi.describeRoute({ hide: true, summary: 'Sponsor RPC' }),
+    )
+    .use(
+      '/rpc/sponsor/*',
+      Auth.policy({ apiKey: { scopes: ['rpc-relay:sponsor'] }, mpp: false, public: false }),
+      OpenApi.describeRoute({ hide: true, summary: 'Sponsor RPC' }),
+    )
+    .all('/rpc/sponsor', handler_sponsor)
+    .all('/rpc/sponsor/:chainId', handler_sponsor)
 }
 
 export declare namespace relay {
@@ -58,11 +71,9 @@ export declare namespace relay {
   }
 }
 
-// The wallet relay middleware: proxies wallet JSON-RPC (fills, sponsored
-// sends) with wallet-aware enrichment. Built per request from context rather
-// than closed over group locals; relay traffic is low-QPS and the viem
-// clients are memoized upstream, so per-request handler construction is cheap.
-function middleware(options: relay.Options = {}) {
+// Builds request-aware RPC middleware. Viem clients are memoized upstream, so
+// constructing `Handler.relay` per request stays cheap.
+function middleware(options: middleware.Options) {
   // Platform-wide per-transaction cap; org settings tighten it, never loosen.
   const txFeeLimit = options.feePayer
     ? Billing.toBaseUnits(options.feePayer.txFeeLimit ?? '1.00')
@@ -215,12 +226,12 @@ function middleware(options: relay.Options = {}) {
 
     // Dispatching a standalone Hono via `fetch(c.req.raw)` bypasses Hono's
     // mount-path stripping, so its internal routes register at the request's
-    // full external path (`basePath` + `/rpc/relay`).
+    // full external path (`basePath` + the RPC mount).
     const handler = Handler.relay({
       cache: c.get('store'),
-      features: 'all',
+      ...(options.features ? { features: options.features } : {}),
       getClient: (chainId) => c.get('getClient')(chainId as Viem.ChainId | undefined),
-      path: Path.join(c.get('basePath'), 'rpc/relay'),
+      path: Path.join(c.get('basePath'), options.path),
       ...(feePayer ? { feePayer } : {}),
       ...(verifiedTokens
         ? {
@@ -234,3 +245,13 @@ function middleware(options: relay.Options = {}) {
     return handler.fetch(c.req.raw)
   })
 }
+
+declare namespace middleware {
+  /** Internal relay mount configuration. */
+  type Options = relay.Options & {
+    /** Optional wallet feature bundle. */
+    features?: Handler.relay.Options['features']
+    /** RPC mount path. */
+    path: 'rpc/relay' | 'rpc/sponsor'
+  }
+}

package/src/cloudflare.ts

@@ -26,6 +26,11 @@ export class DurableObject extends CloudflareDurableObject {
     await this.#store.delete(key)
   }
 
+  /** Deletes a key only when its value matches `expected`. */
+  async deleteIf(key: string, expected: null | string) {
+    return this.#store.deleteIf!(key, expected)
+  }
+
   /** Gets a string value. Returns `null` for missing or expired keys. */
   async get(key: string) {
     return this.#store.get(key)

package/src/db/Db.ts

@@ -10,6 +10,7 @@ import {
 } from 'kysely'
 import * as pg from 'pg'
 
+import type * as AdminAuditLogs from './tables/adminAuditLogs.js'
 import type * as BillingSettings from './tables/billingSettings.js'
 import type * as Invitations from './tables/invitations.js'
 import type * as Memberships from './tables/memberships.js'
@@ -28,6 +29,10 @@ import type * as WebhookSubscriptions from './tables/webhookSubscriptions.js'
  * records, queries, and {@link migrations} DDL to snake_case storage columns.
  */
 export type Database = {
+  admin_audit_logs: AdminAuditLogs.Table
+  billing_settings: BillingSettings.Table
+  invitations: Invitations.Table
+  memberships: Memberships.Table
   migrations: {
     appliedAt: string
     checksum: string
@@ -35,9 +40,6 @@ export type Database = {
     /** SQL as applied; null on rows written before the column existed. */
     sql: string | null
   }
-  billing_settings: BillingSettings.Table
-  invitations: Invitations.Table
-  memberships: Memberships.Table
   organizations: Organizations.Table
   projects: Projects.Table
   request_usage_buckets: RequestUsage.BucketTable
@@ -520,6 +522,60 @@ export const migrations: readonly Migration[] = [
     // Partial: the reporter scans only unreported (pending) rows.
     up: (db) => raw(db, sql`CREATE INDEX IF NOT EXISTS request_usage_meter_events_pending_idx ON request_usage_meter_events (first_attempted_at, identifier) WHERE state = 'pending'`), // prettier-ignore
   },
+  {
+    // Supports the admin organization's newest-first keyset pagination.
+    name: '0045_organizations_admin_list_index',
+    up: (db) => raw(db, sql`CREATE INDEX IF NOT EXISTS organizations_admin_list_idx ON organizations (created_at DESC, id DESC)`), // prettier-ignore
+  },
+  {
+    // Prefix search keeps organization-name lookup index-backed.
+    name: '0046_organizations_name_prefix_index',
+    up: (db) => raw(db, sql`CREATE INDEX IF NOT EXISTS organizations_name_prefix_idx ON organizations (lower(name) text_pattern_ops)`), // prettier-ignore
+  },
+  {
+    // Prefix search keeps member-email lookup index-backed.
+    name: '0047_users_email_prefix_index',
+    up: (db) => raw(db, sql`CREATE INDEX IF NOT EXISTS users_email_prefix_idx ON users (lower(email) text_pattern_ops) WHERE email IS NOT NULL`), // prettier-ignore
+  },
+  {
+    // Exact owner lookup for organizations created by a user.
+    name: '0048_organizations_user_index',
+    up: (db) => raw(db, sql`CREATE INDEX IF NOT EXISTS organizations_user_idx ON organizations (user_id) WHERE user_id IS NOT NULL`), // prettier-ignore
+  },
+  {
+    // Supports oldest-first admin membership keyset pagination.
+    name: '0049_memberships_admin_list_index',
+    up: (db) => raw(db, sql`CREATE INDEX IF NOT EXISTS memberships_admin_list_idx ON memberships (org_id, created_at, user_id)`), // prettier-ignore
+  },
+  {
+    // Supports newest-first admin project keyset pagination.
+    name: '0050_projects_admin_list_index',
+    up: (db) => raw(db, sql`CREATE INDEX IF NOT EXISTS projects_admin_list_idx ON projects (org_id, created_at DESC, id DESC)`), // prettier-ignore
+  },
+  {
+    name: '0051_admin_audit_logs',
+    up: (db) =>
+      db.schema
+        .createTable('adminAuditLogs')
+        .ifNotExists()
+        .addColumn('id', 'text', (c) => c.primaryKey())
+        .addColumn('actor', 'text', (c) => c.notNull())
+        .addColumn('method', 'text', (c) => c.notNull())
+        .addColumn('path', 'text', (c) => c.notNull())
+        .addColumn('query', 'text')
+        .addColumn('requestId', 'text', (c) => c.notNull())
+        .addColumn('status', 'integer', (c) => c.notNull())
+        .addColumn('createdAt', 'text', (c) => c.notNull()),
+  },
+  {
+    name: '0052_admin_audit_logs_created_index',
+    up: (db) =>
+      db.schema
+        .createIndex('admin_audit_logs_created_idx')
+        .ifNotExists()
+        .on('adminAuditLogs')
+        .columns(['createdAt', 'id']),
+  },
 ]
 
 /**