tapimo 0.5.0 → 0.5.2

package/dist/internal/Viem.js

@@ -31,7 +31,7 @@ export const url = {
  * webhook poller). A missing `url` falls back to the built-in public host map
  * ({@link url}); a missing `basicAuth` means no Basic auth is sent.
  *
- * Memoization is keyed on the resolved output (see `App.create` and
+ * Memoization is keyed on the resolved output (see {@link createGetClient} and
  * {@link Tidx.createGetClient}), not the context, so a resolver may branch on
  * any principal field without unbounded client cardinality: callers that
  * resolve to the same upstream share a client. Pass the result to
@@ -69,4 +69,22 @@ export function getClient(options) {
         .extend(publicActions)
         .extend(tempoActions());
 }
+/** Builds a memoized Tempo client resolver. */
+export function createGetClient(options = {}) {
+    const { defaultChainId: defaultChainId_option = defaultChainId, rpc } = options;
+    const clients = new Map();
+    return (chainId = defaultChainId_option, principal = null) => {
+        const { basicAuth, url } = resolve(rpc, { chainId, principal });
+        const cacheKey = JSON.stringify([url, basicAuth, chainId]);
+        const existing = clients.get(cacheKey);
+        if (existing)
+            return existing;
+        const client = getClient({
+            chainId,
+            rpc: { basicAuth, url: () => url },
+        });
+        clients.set(cacheKey, client);
+        return client;
+    };
+}
 //# sourceMappingURL=Viem.js.map

package/dist/internal/Viem.js.map

@@ -1 +1 @@
-{"version":3,"file":"Viem.js","sourceRoot":"","sources":["../../src/internal/Viem.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAA;AAChD,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,MAAM,CAAA;AAExD,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAEzC,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAM9D,4DAA4D;AAC5D,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,YAAY,EAAE,YAAY,CAAC,CAAA;AAElD,wCAAwC;AACxC,MAAM,CAAC,MAAM,OAAO,GAAG;IACrB,OAAO,EAAE,YAAY,CAAC,EAAE;IACxB,OAAO,EAAE,YAAY,CAAC,EAAE;CAChB,CAAA;AAEV,8BAA8B;AAC9B,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAA;AAE7C,2CAA2C;AAC3C,MAAM,UAAU,SAAS,CAAC,EAAU;IAClC,OAAO,EAAE,KAAK,OAAO,CAAC,OAAO,CAAA;AAC/B,CAAC;AAED,gDAAgD;AAChD,MAAM,CAAC,MAAM,GAAG,GAA2B;IACzC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,uBAAuB;IAC1C,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,+BAA+B;CACnD,CAAA;AAiBD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,OAAO,CACrB,GAA8B,EAC9B,OAAwB;IAExB,MAAM,MAAM,GAAG,OAAO,GAAG,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;IAC7D,OAAO;QACL,SAAS,EAAE,MAAM,EAAE,SAAS;QAC5B,GAAG,EACD,CAAC,OAAO,MAAM,EAAE,GAAG,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC;YAC/E,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC;KACvB,CAAA;AACH,CAAC;AA4BD,MAAM,UAAU,SAAS,CAAC,OAA0B;IAClD,MAAM,EAAE,OAAO,GAAG,cAAc,EAAE,SAAS,GAAG,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,OAAO,CAAA;IAC9E,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAA;IACvE,MAAM,YAAY,GAChB,SAAS,IAAI,SAAS;QACpB,CAAC,CAAC;YACE,OAAO,EAAE;gBACP,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,SAAS,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxE;SACF;QACH,CAAC,CAAC,SAAS,CAAA;IAEf,OAAO,YAAY,CAAC;QAClB,iEAAiE;QACjE,uEAAuE;QACvE,oEAAoE;QACpE,sEAAsE;QACtE,wEAAwE;QACxE,KAAK,EAAE,EAAE,SAAS,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE;QAC1C,KAAK,EAAE,EAAE,GAAG,YAAY,EAAE,EAAE,EAAE,OAAO,EAAE;QACvC,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9D,CAAC;SACC,MAAM,CAAC,aAAa,CAAC;SACrB,MAAM,CAAC,YAAY,EAAE,CAAC,CAAA;AAC3B,CAAC"}
+{"version":3,"file":"Viem.js","sourceRoot":"","sources":["../../src/internal/Viem.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAA;AAChD,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,MAAM,CAAA;AAExD,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAEzC,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAM9D,4DAA4D;AAC5D,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,YAAY,EAAE,YAAY,CAAC,CAAA;AAElD,wCAAwC;AACxC,MAAM,CAAC,MAAM,OAAO,GAAG;IACrB,OAAO,EAAE,YAAY,CAAC,EAAE;IACxB,OAAO,EAAE,YAAY,CAAC,EAAE;CAChB,CAAA;AAEV,8BAA8B;AAC9B,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAA;AAE7C,2CAA2C;AAC3C,MAAM,UAAU,SAAS,CAAC,EAAU;IAClC,OAAO,EAAE,KAAK,OAAO,CAAC,OAAO,CAAA;AAC/B,CAAC;AAED,gDAAgD;AAChD,MAAM,CAAC,MAAM,GAAG,GAA2B;IACzC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,uBAAuB;IAC1C,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,+BAA+B;CACnD,CAAA;AAiBD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,OAAO,CACrB,GAA8B,EAC9B,OAAwB;IAExB,MAAM,MAAM,GAAG,OAAO,GAAG,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;IAC7D,OAAO;QACL,SAAS,EAAE,MAAM,EAAE,SAAS;QAC5B,GAAG,EACD,CAAC,OAAO,MAAM,EAAE,GAAG,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC;YAC/E,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC;KACvB,CAAA;AACH,CAAC;AA4BD,MAAM,UAAU,SAAS,CAAC,OAA0B;IAClD,MAAM,EAAE,OAAO,GAAG,cAAc,EAAE,SAAS,GAAG,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,OAAO,CAAA;IAC9E,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAA;IACvE,MAAM,YAAY,GAChB,SAAS,IAAI,SAAS;QACpB,CAAC,CAAC;YACE,OAAO,EAAE;gBACP,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,SAAS,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxE;SACF;QACH,CAAC,CAAC,SAAS,CAAA;IAEf,OAAO,YAAY,CAAC;QAClB,iEAAiE;QACjE,uEAAuE;QACvE,oEAAoE;QACpE,sEAAsE;QACtE,wEAAwE;QACxE,KAAK,EAAE,EAAE,SAAS,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE;QAC1C,KAAK,EAAE,EAAE,GAAG,YAAY,EAAE,EAAE,EAAE,OAAO,EAAE;QACvC,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9D,CAAC;SACC,MAAM,CAAC,aAAa,CAAC;SACrB,MAAM,CAAC,YAAY,EAAE,CAAC,CAAA;AAC3B,CAAC;AAED,+CAA+C;AAC/C,MAAM,UAAU,eAAe,CAAC,OAAO,GAA4B,EAAE;IACnE,MAAM,EAAE,cAAc,EAAE,qBAAqB,GAAG,cAAc,EAAE,GAAG,EAAE,GAAG,OAAO,CAAA;IAC/E,MAAM,OAAO,GAAG,IAAI,GAAG,EAAgC,CAAA;IAEvD,OAAO,CAAC,OAAO,GAAG,qBAAqB,EAAE,SAAS,GAAG,IAAI,EAAE,EAAE;QAC3D,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAA;QAC/D,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAA;QAC1D,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QACtC,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAA;QAE7B,MAAM,MAAM,GAAG,SAAS,CAAC;YACvB,OAAO;YACP,GAAG,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE;SACnC,CAAC,CAAA;QACF,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;QAC7B,OAAO,MAAM,CAAA;IACf,CAAC,CAAA;AACH,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "tapimo",
   "type": "module",
-  "version": "0.5.0",
+  "version": "0.5.2",
   "main": "./dist/index.js",
   "license": "MIT",
   "bin": {
@@ -26,7 +26,7 @@
     "ox": "0.14.30",
     "pg": "^8.22.0",
     "stripe": "^19.1.0",
-    "tidx.ts": "^0.1.1",
+    "tidx.ts": "^0.1.2",
     "viem": "2.54.6",
     "vocs": "^2.3.3",
     "zod": "^4.4.3"
@@ -50,6 +50,11 @@
       "types": "./dist/admin/index.d.ts",
       "default": "./dist/admin/index.js"
     },
+    "./client": {
+      "src": "./src/Client.ts",
+      "types": "./dist/Client.d.ts",
+      "default": "./dist/Client.js"
+    },
     "./cloudflare": {
       "src": "./src/cloudflare.ts",
       "types": "./dist/cloudflare.d.ts",

package/src/ApiKeys.test.ts

@@ -114,6 +114,8 @@ describe('mint', () => {
       'zone:abc:read',
       'zone:1.5:read',
       'zone:-1:read',
+      'zone:0:read',
+      'zone:000421700001:read',
       'zone:1:write',
     ])
       await expect(

package/src/App.test.ts

@@ -74,6 +74,18 @@ describe('create', () => {
     `)
   })
 
+  test('ignores client-supplied request ids', async () => {
+    const entries: Log.Entry[] = []
+    const app = TestApp.create({ logger: (entry) => void entries.push(entry) })
+    const response = await app.request('/health', {
+      headers: { 'tempo-request-id': 'client-controlled' },
+    })
+    const requestId = response.headers.get('tempo-request-id')
+
+    expect(requestId === 'client-controlled').toMatchInlineSnapshot(`false`)
+    expect(entries[0]?.requestId === requestId).toMatchInlineSnapshot(`true`)
+  })
+
   test('documents supported API key transports', async () => {
     const app = TestApp.create()
     const spec = await (await app.request('/openapi.json')).json()
@@ -222,7 +234,7 @@ describe('create', () => {
     const response = await app.request(`/v1/tokens/${TestApp.token}`, {
       headers: {
         authorization: 'Payment malformed',
-        'x-forwarded-for': '203.0.113.10',
+        'cf-connecting-ip': '203.0.113.10',
       },
     })
 
@@ -248,7 +260,7 @@ describe('create', () => {
     const response = await app.request(`/v1/tokens/${TestApp.token}`, {
       headers: {
         authorization: 'Payment malformed',
-        'x-forwarded-for': '203.0.113.10',
+        'cf-connecting-ip': '203.0.113.10',
       },
     })
 
@@ -473,7 +485,7 @@ describe('create', () => {
     // key matches, so a `:chainId//icons` regression would drop every logo.
     const db = TestApp.database()
     await TestApp.verifiedSeed(db, 42431)
-    const app = App.create({ db }).route(
+    const app = App.create({ db, defaultChainId: 42431 }).route(
       '/',
       App.data({
         assets: {
@@ -485,7 +497,6 @@ describe('create', () => {
                 }
               : undefined,
         },
-        defaultChainId: 42431,
       }),
     )
     const response = await app.request('/v1/tokens?verified=true')

package/src/App.ts

@@ -149,6 +149,13 @@ export function create<const path extends string = '/'>(options: create.Options<
   // `options.db`, API-key records in `options.kv`.
   const store = options.cache?.store ?? Store.memory()
   const scopeCatalog = Scope.extend(options.scopes)
+  const defaultChainId = options.defaultChainId ?? Viem.defaultChainId
+  const getClient = Viem.createGetClient({ defaultChainId, rpc: options.rpc })
+  const supportedChainIds = new Set<number>([
+    ...Object.keys(Viem.url).map(Number),
+    defaultChainId,
+    ...(options.supportedChainIds ?? []),
+  ])
 
   // Build the app in two phases: register middleware imperatively, then chain
   // route mounts so the merged Hono schema flows through the return type. The
@@ -165,7 +172,11 @@ export function create<const path extends string = '/'>(options: create.Options<
       '*',
       hono_compress(typeof options.compress === 'object' ? options.compress : undefined),
     )
-  base.use('*', requestId({ headerName: 'tempo-request-id' }))
+  base.use('*', requestId())
+  base.use('*', async (c, next) => {
+    await next()
+    c.header('tempo-request-id', c.get('requestId'))
+  })
   // One canonical structured log line per request, plus request metrics.
   // Registered after `requestId` (the entry embeds it) and before the timing and
   // edge-cache layers so the entry covers edge-cache hits and includes the
@@ -233,11 +244,15 @@ export function create<const path extends string = '/'>(options: create.Options<
   base.use('*', async (c, next) => {
     c.set('analytics', analytics)
     c.set('basePath', basePath)
+    c.set('chainId', defaultChainId)
     c.set('db', db.source)
     c.set('dbCached', db.cached ?? db.source)
+    c.set('getClient', (chainId) => getClient(chainId, Auth.getPrincipal(c)))
     c.set('kv', options.kv)
+    c.set('rpc', options.rpc)
     c.set('scopeCatalog', scopeCatalog)
     c.set('store', store)
+    c.set('supportedChainIds', supportedChainIds)
     await next()
   })
 
@@ -271,7 +286,10 @@ export function create<const path extends string = '/'>(options: create.Options<
   const route = app.route.bind(app)
   ;(app as unknown as { route: typeof route }).route = ((path, sub) => {
     const entry = Metadata.read(sub)
-    if (entry) metadata.push(entry)
+    if (entry) {
+      metadata.push(entry)
+      for (const chainId of entry.supportedChainIds ?? []) supportedChainIds.add(chainId)
+    }
     return route(path, sub)
   }) as typeof route
 
@@ -442,9 +460,9 @@ export function listener(app: { fetch: NodeFetch }): Listener {
 
 export declare namespace create {
   /**
-   * Options for creating the Tempo API Hono app — the shared core:
-   * db/cache/kv/auth capabilities and cross-cutting middleware. Chain-data
-   * configuration belongs to {@link data}; email to {@link management}.
+   * Options for creating the Tempo API Hono app: shared chain, RPC, database,
+   * cache, authentication, and cross-cutting configuration. Email belongs to
+   * {@link management}.
    */
   type Options<path extends string = '/'> = {
     /** Analytics store for usage reads (e.g. `Analytics.clickhouse(...)`), or a per-request factory. Accepts `{ source }` to mirror `db`. Omit to leave usage analytics unconfigured — usage routes answer 501. Ingest happens outside this app (queue consumer via `Analytics.handleQueue`). */
@@ -459,6 +477,8 @@ export declare namespace create {
     cors?: boolean | Cors | undefined
     /** Authoritative Postgres store backing stateful features (webhooks, verified tokens). Pass a long-lived `Db.postgres(...)` singleton on Node, or a factory (`() => Db.postgres(...)`) on Workers so each request builds a fresh Hyperdrive-pooled connection. Pass `{ source, cached }` to route staleness-tolerant reads (verified tokens) through a second, query-caching Hyperdrive config; `source` stays uncached for read-after-write correctness. Apply migrations out of band via `tapimo admin migrate`. */
     db: Db.Source | { cached?: Db.Source | undefined; source: Db.Source }
+    /** Default Tempo chain id for requests that omit `chainId`. */
+    defaultChainId?: Viem.ChainId | undefined
     /** KV state store backing API-key records (e.g. `Store.cloudflareKv(...)`). Omit to leave API-key auth closed — every token resolves to `null`. */
     kv?: Kv | undefined
     /** Request logging. Disabled by default. Pass `true` to emit one canonical structured log entry per request through the level-matched console method (indexed by Workers Logs); a level (e.g. `'warn'`) to emit only that level and above (dropping successful-request info lines); or an emit function for a custom sink. */
@@ -467,10 +487,14 @@ export declare namespace create {
     metrics?: Metrics.Metrics | undefined
     /** Base path to mount API handlers under. Provided as a literal via the `path` generic so the resulting Hono schema keeps typed route paths for `testClient`. */
     path?: path | undefined
+    /** Tempo RPC options, including per-request routing by request principal. */
+    rpc?: Viem.getClient.Rpc | undefined
     /** OpenAPI `servers` for the generated document. Defaults to a single relative server (the host serving the doc), so the reference targets the deployment it is served from. Set the canonical public URL(s) here, e.g. `[{ url: 'https://api.tempo.xyz' }]`. */
     servers?: readonly Server[] | undefined
     /** Host-defined API-key scopes appended to the built-in {@link Scope.catalog}. */
     scopes?: readonly Scope.Entry[] | undefined
+    /** Extra chain ids served beyond the built-in chains and `defaultChainId`. */
+    supportedChainIds?: readonly number[] | undefined
   }
 
   /** KV state-store configuration. */
@@ -532,6 +556,8 @@ export declare namespace create {
     docs?: Docs | undefined
     /** Security scheme definitions this group's routes reference (e.g. the session cookie). */
     securitySchemes?: Record<string, unknown> | undefined
+    /** Chain ids served by this route group, merged before auth handles the first request. */
+    supportedChainIds?: readonly number[] | undefined
     /** Root-level OpenAPI tag definitions for this group's operations. */
     tags?: readonly Tag[] | undefined
     /** Builds the OAS 3.1 `webhooks` block documenting outbound deliveries, emitted only when the group's webhook routes are mounted. Called during spec generation only, keeping schema conversion off isolate startup. */

package/src/Assets.ts

@@ -26,9 +26,9 @@ export type Assets = {
 export function cloudflareR2(bucket: cloudflareR2.Bucket): Assets {
   return {
     async get(key) {
-      // Exact keys sort first, so expected misses avoid `NoSuchKey` spans.
-      const { objects } = await bucket.list({ limit: 1, prefix: key })
-      if (objects[0]?.key !== key) return undefined
+      // Legacy source-extension aliases may sort before the extensionless key.
+      const { objects } = await bucket.list({ limit: 1_000, prefix: key })
+      if (!objects.some((object) => object.key === key)) return undefined
       const object = await bucket.get(key)
       if (!object) return undefined
       return {

package/src/Client.test-d.ts

@@ -364,7 +364,7 @@ describe('narrows responses by status', () => {
       param: { orgId: 'org_test' },
     })
 
-    expectTypeOf(res.status).toEqualTypeOf<200 | 404 | 502 | PublicAccessStatus>()
+    expectTypeOf(res.status).toEqualTypeOf<200 | 404 | 409 | 502 | PublicAccessStatus>()
 
     switch (res.status) {
       case 200: {
@@ -379,6 +379,12 @@ describe('narrows responses by status', () => {
         void json
         return
       }
+      case 409: {
+        const json = await res.json()
+        expectTypeOf(json.error.code).toEqualTypeOf<'sponsorships_unreported'>()
+        void json
+        return
+      }
     }
   })
 
@@ -1193,7 +1199,7 @@ describe('narrows responses by status', () => {
     const client = Client.create()
     const res = await client.v1.funding.quotes.$get({
       query: {
-        provider: 'relay',
+        provider: 'across',
         sourceAmount: '1000000',
         sourceChain: 'base',
         sourceToken: 'USDC',
@@ -1208,7 +1214,10 @@ describe('narrows responses by status', () => {
         expectTypeOf(json.data[0]!.sourceAmount).toEqualTypeOf<
           z.output<typeof Funding.schema.quoteFunding.Response>['data'][number]['sourceAmount']
         >()
-        expectTypeOf(json.data[0]!.provider.id).toEqualTypeOf<'relay'>()
+        expectTypeOf(json.data[0]!.provider.id).toEqualTypeOf<
+          'across' | 'relay' | 'rhino' | 'squid'
+        >()
+        expectTypeOf(json.data[0]!.quote.expiresAt).toEqualTypeOf<string | undefined>()
         expectTypeOf(json.data[0]!.quote.outputAmount).toEqualTypeOf<string>()
         void json
         return
@@ -1952,6 +1961,11 @@ describe('narrows responses by status', () => {
 
     if (res.status === 200) {
       const json = await res.json()
+      expectTypeOf(json.destination.type).toEqualTypeOf<'betterstack' | 'slack' | 'url'>()
+      if (json.destination.type === 'betterstack')
+        expectTypeOf(json.destination.token).toEqualTypeOf<string>()
+      if (json.destination.type === 'slack')
+        expectTypeOf(json.destination.url).toEqualTypeOf<string>()
       expectTypeOf(json.secret).toEqualTypeOf<
         z.output<typeof Webhooks.schema.createWebhook.Response>['secret']
       >()
@@ -1967,6 +1981,11 @@ describe('narrows responses by status', () => {
 
     if (res.status === 200) {
       const json = await res.json()
+      const destination = json.data[0]!.destination
+      if (destination.type === 'betterstack')
+        expectTypeOf(destination.token).toEqualTypeOf<'[redacted]'>()
+      if (destination.type === 'slack')
+        expectTypeOf(destination.url).toEqualTypeOf<'https://hooks.slack.com/…'>()
       expectTypeOf(json.data[0]!.id).toEqualTypeOf<
         z.output<typeof Webhooks.schema.listWebhooks.Response>['data'][number]['id']
       >()
@@ -1988,6 +2007,10 @@ describe('narrows responses by status', () => {
 
     if (res.status === 200) {
       const json = await res.json()
+      if (json.destination.type === 'betterstack')
+        expectTypeOf(json.destination.token).toEqualTypeOf<'[redacted]'>()
+      if (json.destination.type === 'slack')
+        expectTypeOf(json.destination.url).toEqualTypeOf<'https://hooks.slack.com/…'>()
       expectTypeOf(json.id).toEqualTypeOf<
         z.output<typeof Webhooks.schema.getWebhook.Response>['id']
       >()
@@ -2063,6 +2086,10 @@ describe('narrows responses by status', () => {
 
     if (res.status === 200) {
       const json = await res.json()
+      if (json.destination.type === 'betterstack')
+        expectTypeOf(json.destination.token).toEqualTypeOf<'[redacted]'>()
+      if (json.destination.type === 'slack')
+        expectTypeOf(json.destination.url).toEqualTypeOf<'https://hooks.slack.com/…'>()
       expectTypeOf(json.status).toEqualTypeOf<
         z.output<typeof Webhooks.schema.updateWebhook.Response>['status']
       >()

package/src/Scope.ts

@@ -86,8 +86,10 @@ export namespace schema {
   /** A concrete per-zone read scope (`zone:421700001:read`). */
   export const Zone = z
     .templateLiteral(['zone:', z.int(), ':read'])
-    // `z.int()` also matches a sign; zone chain ids are positive.
-    .check(z.regex(/^zone:\d+:read$/), z.describe('Per-zone read scope (`zone:<chainId>:read`).'))
+    .check(
+      z.regex(/^zone:[1-9]\d*:read$/),
+      z.describe('Per-zone read scope (`zone:<chainId>:read`).'),
+    )
 }
 
 /** Per-zone read scope, granting access to one zone chain id. */

package/src/Webhooks.ts

@@ -28,7 +28,7 @@ export { eventTypes, schema } from './apps/data/routes/webhooks.js'
  *
  * The monitoring event types (`log:emitted`, `block:created`,
  * `transaction:included`) scan a confirmed window directly over JSON-RPC, so the
- * poller builds memoized viem clients (via {@link Viem.getClient}); the legacy
+ * poller builds memoized viem clients (via {@link Viem.createGetClient}); the legacy
  * `token:transfer` type still reads from TIDX, so it
  * also builds memoized TIDX clients (via {@link Tidx.createGetClient}) when a
  * `tidx` config is supplied. The poller keeps `App.create` a pure Hono app: it
@@ -42,15 +42,10 @@ export function createPoller(options: createPoller.Options): createPoller.Poller
   const getTidx = options.tidx
     ? Tidx.createGetClient({ defaultChainId: options.defaultChainId, tidx: options.tidx })
     : undefined
-  const clients = new Map<number, Viem.getClient.ReturnType>()
-  const getClient = (chainId: Viem.ChainId) => {
-    let client = clients.get(chainId)
-    if (!client) {
-      client = Viem.getClient({ chainId, rpc: options.rpc })
-      clients.set(chainId, client)
-    }
-    return client
-  }
+  const getClient = Viem.createGetClient({
+    defaultChainId: options.defaultChainId,
+    rpc: options.rpc,
+  })
 
   const metrics = options.metrics ? MetricSink.webhooks(options.metrics) : undefined
 

package/src/admin/apps/api-keys.test.ts

@@ -68,6 +68,19 @@ describe('POST /api-keys', () => {
     expect(resolved?.environment).toBe('sandbox')
   })
 
+  test('mints a key with a concrete Zone read scope', async () => {
+    const { client, store } = TestAdmin.setup()
+    const scope = 'zone:421700001:read' as const
+    const response = await client['api-keys'].$post({
+      json: { ...validBody, scopes: [scope] },
+    })
+    const body = await TestApp.json(response, ApiKeys.schema.createApiKey.Response)
+
+    expect(response.status).toBe(200)
+    expect(body.scopes).toEqual([scope])
+    expect((await core_ApiKeys.resolve(store, body.token))?.scopes).toEqual([scope])
+  })
+
   test('records the expiry when provided', async () => {
     const { client, store } = TestAdmin.setup()
     const expiresAt = '2100-01-01T00:00:00.000Z'
@@ -91,6 +104,20 @@ describe('POST /api-keys', () => {
     expect(body.error?.code).toMatchInlineSnapshot(`"body_invalid"`)
   })
 
+  test('rejects non-concrete or non-canonical Zone scopes with 400', async () => {
+    for (const scope of ['zone:<chainId>:read', 'zone:0:read', 'zone:000421700001:read']) {
+      const { client } = TestAdmin.setup()
+      const response = await client['api-keys'].$post({
+        // Cast past the typed client to exercise runtime validation.
+        json: { ...validBody, scopes: [scope] } as never,
+      })
+      const body = (await response.json()) as { error?: { code?: string } }
+
+      expect(response.status).toBe(400)
+      expect(body.error?.code).toBe('body_invalid')
+    }
+  })
+
   test('ignores a client-supplied createdBy (audit trail is server-set)', async () => {
     const { client } = TestAdmin.setup()
     const response = await client['api-keys'].$post({

package/src/admin/apps/api-keys.ts

@@ -19,7 +19,14 @@ export namespace schema {
     export const Body = Schema.describe(
       z.extend(z.omit(ApiKeys.schema.MintInput, { createdBy: true }), {
         scopes: z
-          .readonly(z.array(z.enum([...Scope.catalog.map((entry) => entry.scope), Scope.wildcard])))
+          .readonly(
+            z.array(
+              z.union([
+                z.enum([...Scope.catalog.map((entry) => entry.scope), Scope.wildcard]),
+                Scope.schema.Zone,
+              ]),
+            ),
+          )
           .check(z.describe("Granted scopes. '*' grants all scopes.")),
       }),
       'Fields accepted when minting an API key.',

package/src/admin/apps/scopes.test.ts

@@ -54,17 +54,22 @@ describe('GET /scopes', () => {
             "scope": "webhooks:write",
             "selfServe": false,
           },
+          {
+            "description": "Read RPC and indexed data for one zone chain id.",
+            "scope": "zone:<chainId>:read",
+            "selfServe": false,
+          },
         ],
       }
     `)
   })
 
-  test('serves the Scope.catalog source of truth verbatim', async () => {
+  test('serves the extended Scope catalog source of truth verbatim', async () => {
     const { client } = TestAdmin.setup()
     const response = await client.scopes.$get()
     const body = await TestApp.json(response, Scopes.schema.getScopes.Response)
 
-    expect(body.data).toEqual(Scope.catalog)
+    expect(body.data).toEqual(Scope.extend())
   })
 
   test('is never cached (admin responses are per-principal)', async () => {

package/src/admin/apps/scopes.ts

@@ -33,7 +33,7 @@ export namespace schema {
   }
 }
 
-/** Catalog of issuable API-key scopes, served from {@link Scope.catalog}. */
+/** Catalog of API-key scopes, including dynamic scope templates. */
 export function scopes() {
   return new Hono<App.Environment>().get(
     '/',
@@ -45,6 +45,6 @@ export function scopes() {
       summary: 'List scopes',
       tags: ['Scopes'],
     }),
-    (c) => c.json({ data: Scope.catalog }),
+    (c) => c.json({ data: Scope.extend() }),
   )
 }

package/src/admin/ui/src/components/Dialog.tsx

@@ -1,12 +1,18 @@
 import { Dialog as Base } from '@base-ui/react/dialog'
 import type { ComponentProps, ReactNode } from 'react'
+import { cx } from 'regen-ui'
 
 /** Backdrop + centered popup shell. Children render inside; pair with Title/Description. */
-function Popup(props: { children: ReactNode }) {
+function Popup(props: { children: ReactNode; className?: string | undefined }) {
   return (
     <Base.Portal>
       <Base.Backdrop className="fixed inset-0 z-40 bg-black/60 transition-opacity duration-150 data-[ending-style]:opacity-0 data-[starting-style]:opacity-0" />
-      <Base.Popup className="fixed left-1/2 top-1/2 z-50 w-[calc(100vw-2rem)] max-w-md -translate-x-1/2 -translate-y-1/2 border border-border bg-surface p-6 shadow-lg outline-none transition-opacity duration-150 data-[ending-style]:opacity-0 data-[starting-style]:opacity-0">
+      <Base.Popup
+        className={cx(
+          'fixed left-1/2 top-1/2 z-50 w-[calc(100vw-2rem)] max-w-md -translate-x-1/2 -translate-y-1/2 border border-border bg-surface p-6 shadow-lg outline-none transition-opacity duration-150 data-[ending-style]:opacity-0 data-[starting-style]:opacity-0',
+          props.className,
+        )}
+      >
         {props.children}
       </Base.Popup>
     </Base.Portal>

package/src/admin/ui/src/lib/scopes.test.ts

@@ -0,0 +1,19 @@
+import { describe, expect, it } from 'vite-plus/test'
+
+import { fromZoneChainId } from './scopes'
+
+describe('fromZoneChainId', () => {
+  it('builds a canonical Zone read scope', () => {
+    expect(fromZoneChainId(' 000421700001 ')).toBe('zone:421700001:read')
+  })
+
+  it('rejects non-positive and malformed chain ids', () => {
+    expect(['', '0', '-1', '1.5', 'mainnet'].map(fromZoneChainId)).toEqual([
+      undefined,
+      undefined,
+      undefined,
+      undefined,
+      undefined,
+    ])
+  })
+})

package/src/admin/ui/src/lib/scopes.ts

@@ -6,6 +6,18 @@ import { client } from './client'
 /** A single issuable API-key scope from the catalog endpoint. */
 export type Scope = InferResponseType<(typeof client)['scopes']['$get'], 200>['data'][number]
 
+/** Dynamic Zone scope template returned by the scope catalog. */
+export const zoneTemplate = 'zone:<chainId>:read'
+
+/** Builds a canonical Zone read scope from a positive integer chain id. */
+export function fromZoneChainId(value: string): `zone:${string}:read` | undefined {
+  const chainId = value.trim()
+  if (!/^\d+$/.test(chainId)) return undefined
+  const normalized = BigInt(chainId)
+  if (normalized === 0n) return undefined
+  return `zone:${normalized}:read`
+}
+
 /** List the issuable API-key scope catalog. */
 export namespace get {
   export const key = ['scopes'] as const