API

Public reads are JSON with open CORS. Writes need a wallet session (Sign-In-With-Solana style; a message, never a transaction).

Method	Path	What	Access
GET	/api/fields?limit=&before=	The ledger: saved fields, newest first.	public, CORS
GET	/api/fields/{n}	One field with its First light plates and recent queue slots.	public, CORS
GET	/api/wallet/{address}	The field saved by a wallet, if any.	public, CORS
GET	/api/sky	Every saved field's aim and the HEALPix coverage of the sky (nside 16).	public, CORS
GET	/api/queue	Tonight's draw per site: drand round, plan hash, slots.	public, CORS
GET	/api/firstlight	First light plates, newest first.	public, CORS
POST	/api/looks	Look at an address: { address, save?, deep? }. Saving needs a session for that wallet.	rate-limited
PUT	/api/fields/{n}/composition	Save the plate's composition: { band, ap, fv, title }. Owner only.	session
POST	/api/auth/nonce	Start sign-in: { address } → a message to sign.	rate-limited
POST	/api/auth/verify	Finish sign-in: { address, message, signature } → session cookie.	rate-limited
GET	/api/me	Your session, holder status and field.	session
POST	/api/auth/logout	End the session.	session
POST	/api/admin/slots/{id}	Record a slot: { status: exposed\|clouded\|skipped, image_url, fits_url }.	admin token
POST	/api/admin/draw	Run the nightly draw now (idempotent); { force: true } redraws planned slots.	admin token