tapimo 0.13.0 → 0.15.0

package/src/apps/mpp/Mpp.test.ts

@@ -30,6 +30,13 @@ const organizationKey = {
   token: 'secret_mpp_org',
 } satisfies TestApp.kvStore.Key
 
+const otherOrganizationKey = {
+  id: 'key_mpp_other_org',
+  orgId: 'org_other',
+  scopes: ['mpp:write'],
+  token: 'secret_mpp_other_org',
+} satisfies TestApp.kvStore.Key
+
 const sandboxKey = {
   ...key,
   environment: 'sandbox',
@@ -38,6 +45,7 @@ const sandboxKey = {
 } satisfies TestApp.kvStore.Key
 
 const idempotencyKey = 'mpp_broadcast_01j3j1k2l3m4n5p6q7r8s9t0u'
+const superAdminSecret = 'secret_mpp_super_admin'
 
 const modes = ['pull', 'push'] as const
 
@@ -91,6 +99,16 @@ describe('MPP relay', () => {
     expect(await response.json()).toEqual({ success: true })
   })
 
+  test('verifies a valid Tempo credential for the super admin', async () => {
+    const app = TestApp.create({ auth: { keys: [], superAdmin: { secret: superAdminSecret } } })
+    const response = await post(app, '/v1/mpp/validate', await credential(), {
+      apiKey: superAdminSecret,
+    })
+
+    expect(response.status).toBe(200)
+    expect(await response.json()).toEqual({ success: true })
+  })
+
   test('verifies a zero-amount proof credential', async () => {
     const app = TestApp.create({ auth: { keys: [key] } })
     const input = await credential({ amount: '0' })
@@ -224,6 +242,7 @@ describe('MPP relay', () => {
       },
       screeningStore: Store.memory(),
       state: Store.memory(),
+      storeKeyPrefix: 'test:',
     })
 
     await expect(
@@ -254,6 +273,7 @@ describe('MPP relay', () => {
       },
       screeningStore: Store.memory(),
       state: Store.memory(),
+      storeKeyPrefix: 'test:',
     })
 
     await expect(
@@ -278,6 +298,7 @@ describe('MPP relay', () => {
       },
       screeningStore: Store.memory(),
       state: Store.memory(),
+      storeKeyPrefix: 'test:',
     })
 
     await expect(adapter.verify(await credential())).resolves.toEqual({
@@ -316,6 +337,29 @@ describe('MPP relay', () => {
     )
   })
 
+  test('isolates payment replay protection between organizations', async () => {
+    const app = TestApp.create({
+      auth: { keys: [key, organizationKey, otherOrganizationKey] },
+      mpp: { state: Store.memory() },
+    })
+    const input = await credential({ mode: 'push', supportedModes: ['push'] })
+    const first = Mpp.schema.BroadcastResponse.parse(
+      await (await post(app, '/v1/mpp/broadcast', input)).json(),
+    )
+    const sameOrganization = Mpp.schema.BroadcastResponse.parse(
+      await (await post(app, '/v1/mpp/broadcast', input, { apiKey: organizationKey.token })).json(),
+    )
+    const otherOrganization = Mpp.schema.BroadcastResponse.parse(
+      await (
+        await post(app, '/v1/mpp/broadcast', input, { apiKey: otherOrganizationKey.token })
+      ).json(),
+    )
+
+    expect(first.success).toBe(true)
+    expect(sameOrganization.success).toBe(false)
+    expect(otherOrganization.success).toBe(true)
+  })
+
   test('returns a retryable result while the idempotent broadcast is pending', async () => {
     const state = TestApp.kvStore({ keys: [key] })
     const claim = await Idempotency.claim({
@@ -400,13 +444,10 @@ describe('MPP relay', () => {
 
     expect(payloadType(input)).toBe('transaction')
     expect(input.challenge.request['methodDetails']).toMatchObject({ feePayer: true })
-    expect(
-      Mpp.schema.BroadcastResponse.parse(
-        await (
-          await post(app, '/v1/mpp/broadcast', input, { apiKey: organizationKey.token })
-        ).json(),
-      ).success,
-    ).toBe(true)
+    const response = Mpp.schema.BroadcastResponse.parse(
+      await (await post(app, '/v1/mpp/broadcast', input, { apiKey: organizationKey.token })).json(),
+    )
+    expect(response.success, response.success ? undefined : response.error.message).toBe(true)
     expect(await SponsoredTransactions.listPending(db)).toMatchObject([
       {
         apiKeyId: organizationKey.id,
@@ -545,7 +586,7 @@ describe('MPP relay', () => {
     expect(await response.json()).toEqual({
       error: {
         code: Mpp.relayErrorCode.policyDenied,
-        message: 'Mainnet fee sponsorship requires a production API key.',
+        message: 'Sandbox API keys only support testnet. Use a testnet challenge.',
       },
       success: false,
     })

package/src/apps/mpp/Mpp.zone.test.ts

@@ -0,0 +1,219 @@
+import * as Mppx from 'mppx'
+import { Mppx as MppxClient, tempo as tempoClient } from 'mppx/client'
+import { Mppx as MppxServer, tempo as tempoServer } from 'mppx/server'
+
+import * as TestApp from '../../../test/App.js'
+import * as Runtime from '../../../test/runtime.js'
+import * as Tempo from '../../../test/Tempo.js'
+import type * as Log from '../../internal/Log.js'
+import * as Store from '../../internal/Store.js'
+import * as Viem from '../../internal/Viem.js'
+import * as Mpp from './Mpp.js'
+
+const runtime = Runtime.get()
+const zone = TestApp.zone({
+  chainId: runtime.zone.chainId,
+  rpcUrl: runtime.zone.internalRpcUrl,
+})
+const key = {
+  environment: 'production',
+  id: 'key_mpp_zone',
+  orgId: 'org_mpp_zone',
+  scopes: ['mpp:write'],
+  token: 'secret_mpp_zone',
+} satisfies TestApp.kvStore.Key
+const input = {
+  challenge: {
+    expires: new Date(Date.now() + 3_600_000).toISOString(),
+    id: 'ch_01j3j1k2l3m4n5p6q7r8s9t0u',
+    intent: 'charge',
+    method: 'tempo',
+    realm: 'merchant.example',
+    request: {
+      amount: '1',
+      currency: Tempo.currency,
+      methodDetails: { chainId: zone.id, feePayer: true },
+      recipient: Tempo.accounts[0].address,
+    },
+  },
+  payload: { signature: `0x${'aa'.repeat(65)}`, type: 'transaction' },
+} satisfies Mpp.RelayInput
+
+describe('MPP Zone authorization', () => {
+  test.each(['validate', 'broadcast'] as const)(
+    '%s refuses unscoped challenge chains before resolving RPC',
+    async (operation) => {
+      const resolutions: number[] = []
+      const entries: Log.Entry[] = []
+      for (const scopes of [['mpp:write'], ['mpp:write', `zone:${zone.id + 1}:write`]]) {
+        const app = TestApp.create({
+          auth: { keys: [{ ...key, scopes }] },
+          defaultChainId: zone.id,
+          logger: (entry) => void entries.push(entry),
+          mpp: { feePayer: Tempo.accounts[2], state: Store.memory() },
+          rpc: ({ chainId }) => {
+            resolutions.push(chainId)
+            return { url: runtime.zone.internalRpcUrl }
+          },
+          zones: [zone],
+        })
+        for (const request of [
+          input.challenge.request,
+          { ...input.challenge.request, chainId: zone.id, methodDetails: { feePayer: true } },
+          { ...input.challenge.request, methodDetails: { feePayer: true } },
+        ]) {
+          const response = await post(app, operation, {
+            ...input,
+            challenge: { ...input.challenge, request },
+          })
+          expect(response.status).toBe(200)
+          expect(await response.json()).toEqual({
+            error: {
+              code: 'policy_denied',
+              message: `Chain id ${zone.id} is a zone. Use an API key granting \`zone:${zone.id}:read\` or \`zone:${zone.id}:write\`.`,
+            },
+            success: false,
+          })
+        }
+      }
+      expect(resolutions).toMatchInlineSnapshot(`[]`)
+      expect(entries).toHaveLength(6)
+      for (const entry of entries)
+        expect(entry.mpp).toMatchObject({ errorCode: 'policy_denied', outcome: 'failure' })
+    },
+  )
+
+  test.each(['validate', 'broadcast'] as const)(
+    '%s confines wildcard sandbox keys to testnet without requiring sponsorship',
+    async (operation) => {
+      const resolutions: number[] = []
+      const app = TestApp.create({
+        auth: { keys: [{ ...key, environment: 'sandbox', scopes: ['*'] }] },
+        rpc: ({ chainId }) => {
+          resolutions.push(chainId)
+          return { url: runtime.zone.internalRpcUrl }
+        },
+        zones: [{ ...zone, sourceId: Viem.chainId.mainnet }],
+      })
+      for (const chainId of [Viem.chainId.mainnet, zone.id]) {
+        const response = await post(app, operation, {
+          ...input,
+          challenge: {
+            ...input.challenge,
+            request: { ...input.challenge.request, methodDetails: { chainId, feePayer: false } },
+          },
+        })
+        expect(response.status).toBe(200)
+        expect(await response.json()).toMatchInlineSnapshot(`
+          {
+            "error": {
+              "code": "policy_denied",
+              "message": "Sandbox API keys only support testnet. Use a testnet challenge.",
+            },
+            "success": false,
+          }
+        `)
+      }
+      expect(resolutions).toMatchInlineSnapshot(`[]`)
+    },
+  )
+
+  test('requires active billing before mainnet Zone fee-payer access', async () => {
+    const resolutions: number[] = []
+    const app = TestApp.create({
+      auth: { keys: [{ ...key, scopes: ['mpp:write', `zone:${zone.id}:write`] }] },
+      mpp: { feePayer: Tempo.accounts[2], state: Store.memory() },
+      rpc: ({ chainId }) => {
+        resolutions.push(chainId)
+        return { url: runtime.zone.internalRpcUrl }
+      },
+      zones: [{ ...zone, sourceId: Viem.chainId.mainnet }],
+    })
+    expect(await (await post(app, 'broadcast', input)).json()).toMatchInlineSnapshot(`
+      {
+        "error": {
+          "code": "policy_denied",
+          "message": "Active billing is required for mainnet fee sponsorship.",
+        },
+        "success": false,
+      }
+    `)
+    expect(resolutions).toMatchInlineSnapshot(`[]`)
+  })
+
+  test('allows scoped validation but requires write scope to broadcast', async () => {
+    const input = await credential()
+    const app = TestApp.create({
+      auth: { keys: [{ ...key, scopes: ['mpp:write', `zone:${zone.id}:read`] }] },
+      zones: [zone],
+    })
+    expect(await (await post(app, 'validate', input)).json()).toMatchInlineSnapshot(`
+      {
+        "success": true,
+      }
+    `)
+    expect(await (await post(app, 'broadcast', input)).json()).toEqual({
+      error: {
+        code: 'policy_denied',
+        message: `Broadcasting to zone ${zone.id} requires \`zone:${zone.id}:write\`.`,
+      },
+      success: false,
+    })
+  })
+
+  test.each([
+    { environment: 'production', scopes: ['mpp:write', `zone:${zone.id}:write`], sourceId: 4217 },
+    { environment: 'production', scopes: ['*'], sourceId: 4217 },
+    { environment: 'sandbox', scopes: ['mpp:write', `zone:${zone.id}:write`], sourceId: 42431 },
+  ] as const)('allows authorized $environment Zone credentials with $scopes', async (options) => {
+    const input = await credential()
+    const app = TestApp.create({
+      auth: { keys: [{ ...key, environment: options.environment, scopes: [...options.scopes] }] },
+      zones: [{ ...zone, sourceId: options.sourceId }],
+    })
+    for (const operation of ['validate', 'broadcast'] as const)
+      expect(await (await post(app, operation, input)).json()).toMatchObject({ success: true })
+  })
+})
+
+async function credential(): Promise<Mpp.RelayInput> {
+  const client = Viem.getClient({ chainId: zone.id, zone })
+  const issuer = MppxServer.create({
+    methods: [
+      tempoServer.charge({
+        account: Tempo.accounts[0],
+        currency: Tempo.currency,
+        getClient: () => client,
+      }),
+    ],
+    realm: 'merchant.example',
+    secretKey: 'test-mpp-secret-key-for-payment-sessions',
+  })
+  const challenge = await issuer.challenge.tempo.charge({ amount: '0' })
+  const payer = MppxClient.create({
+    methods: [tempoClient({ account: Tempo.accounts[1], getClient: () => client })],
+    polyfill: false,
+  })
+  return Mppx.Credential.deserialize(
+    await payer.createCredential(
+      new Response(null, {
+        headers: { 'www-authenticate': Mppx.Challenge.serialize(challenge) },
+        status: 402,
+      }),
+    ),
+  )
+}
+
+function post(
+  app: ReturnType<typeof TestApp.create>,
+  operation: 'validate' | 'broadcast',
+  input: Mpp.RelayInput,
+) {
+  return app.fetch(
+    new Request(`http://tempo-api.test/v1/mpp/${operation}?chainId=42431`, {
+      body: JSON.stringify(input),
+      headers: { 'content-type': 'application/json', 'tempo-api-key': key.token },
+      method: 'POST',
+    }),
+  )
+}

package/src/apps/mpp/internal/Adapter.ts

@@ -1,12 +1,16 @@
 import * as Mppx from 'mppx'
 import { tempo } from 'mppx/server'
+import * as Hex from 'ox/Hex'
 import { maxUint256 } from 'viem'
+import { getBlock } from 'viem/actions'
 import type { LocalAccount } from 'viem/accounts'
+import { Transaction } from 'viem/tempo'
 
 import * as Store from '../../../internal/Store.js'
 import * as Viem from '../../../internal/Viem.js'
 import * as Mpp from '../Mpp.js'
 import * as MppError from './Error.js'
+import * as Policy from './Policy.js'
 import * as Screening from './Screening.js'
 import * as ScreenManager from './ScreenManager.js'
 import * as Utils from './Utils.js'
@@ -30,6 +34,7 @@ export function create(options: create.Options): Adapter {
     screeningStore,
     screeningTtl = Screening.defaultTtl,
     state,
+    storeKeyPrefix,
     time = (_, fn) => fn(),
   } = options
   const screenManager = ScreenManager.create({
@@ -55,6 +60,7 @@ export function create(options: create.Options): Adapter {
       getClient: ({ chainId: chainId_option }) =>
         getClient(chainId_option as Viem.ChainId | undefined),
       store: Utils.mppxStore(state),
+      storeKeyPrefix,
     }),
   ] as const
 
@@ -66,6 +72,31 @@ export function create(options: create.Options): Adapter {
     await time('mpp_screen', () => screenManager.screen(Utils.addresses(result)))
   }
 
+  async function assertFeeMarketAdmission(input: Mpp.RelayInput) {
+    if (!feePayer || !Policy.requiresFeePayer(input)) return
+    const payload =
+      input.payload && typeof input.payload === 'object' && !Array.isArray(input.payload)
+        ? (input.payload as Record<string, unknown>)
+        : undefined
+    if (
+      payload?.['type'] !== 'transaction' ||
+      typeof payload['signature'] !== 'string' ||
+      !Hex.validate(payload['signature'])
+    )
+      return
+    const transaction = Transaction.deserialize(payload['signature'] as Hex.Hex)
+    if (typeof transaction.maxFeePerGas !== 'bigint') return
+    const block = await getBlock(getClient(transaction.chainId as Viem.ChainId | undefined), {
+      blockTag: 'latest',
+      includeTransactions: false,
+    })
+    if (block.baseFeePerGas !== null)
+      Policy.assertFeeMarketAdmission({
+        baseFeePerGas: block.baseFeePerGas,
+        maxFeePerGas: transaction.maxFeePerGas,
+      })
+  }
+
   function failure(cause: unknown, operation: 'broadcast' | 'verify') {
     const error = MppError.map(cause)
     if (error.code === Mpp.relayErrorCode.unknown) reportUnknown?.({ operation })
@@ -76,6 +107,7 @@ export function create(options: create.Options): Adapter {
     async broadcast(input) {
       try {
         await validateOrThrow(input)
+        await assertFeeMarketAdmission(input)
         const result = await time('mpp_broadcast', () =>
           Mppx.Method.broadcastCredential(methods, credential(input)),
         )
@@ -130,6 +162,8 @@ export declare namespace create {
     screeningTtl?: number | undefined
     /** Durable state used for MPPX replay protection. */
     state: Store.State
+    /** Tenant namespace for MPPX replay-protection records. */
+    storeKeyPrefix: string
     /** Measures a named relay operation. */
     time?: (<value>(name: string, fn: () => Promise<value>) => Promise<value>) | undefined
   }

package/src/apps/mpp/internal/Policy.test.ts

@@ -1,12 +1,13 @@
-import { privateKeyToAccount } from 'viem/accounts'
-
 import * as StripeCustomers from '../../../db/tables/stripeCustomers.js'
 import * as TestApp from '../../../../test/App.js'
+import * as Tempo from '../../../../test/Tempo.js'
+import * as Zones from '../../Zones.js'
 import * as Auth from '../../../internal/Auth.js'
 import * as Mpp from '../Mpp.js'
 import * as Policy from './Policy.js'
 
-const feePayer = privateKeyToAccount(`0x${'11'.repeat(32)}`)
+const feePayer = Tempo.accounts[2]
+const zones = new Map(Zones.chains.map((zone) => [zone.id, zone]))
 
 const input = {
   challenge: {
@@ -56,10 +57,26 @@ describe('requiresFeePayer', () => {
   })
 })
 
-describe('assertSupportedChain', () => {
+describe('assertFeeMarketAdmission', () => {
+  test('rejects a transaction below the current base fee', () => {
+    expect(() =>
+      Policy.assertFeeMarketAdmission({ baseFeePerGas: 2n, maxFeePerGas: 1n }),
+    ).toThrowErrorMatchingInlineSnapshot(
+      `[Mpp.Policy.PolicyDeniedError: Transaction max fee per gas is below the current base fee.]`,
+    )
+  })
+
+  test('accepts a transaction at the current base fee', () => {
+    expect(() =>
+      Policy.assertFeeMarketAdmission({ baseFeePerGas: 1n, maxFeePerGas: 1n }),
+    ).not.toThrow()
+  })
+})
+
+describe('assertChainAccess', () => {
   test('rejects chains outside the deployment allowlist', () => {
     expect(() =>
-      Policy.assertSupportedChain({ chainId: 1, supportedChainIds: new Set([4217]) }),
+      Policy.assertChainAccess({ chainId: 1, supportedChainIds: new Set([4217]), zones }),
     ).toThrowErrorMatchingInlineSnapshot(
       `[Mpp.Policy.UnsupportedChainError: Unsupported chain id 1.]`,
     )
@@ -67,50 +84,87 @@ describe('assertSupportedChain', () => {
 })
 
 describe('authorizeFeePayer', () => {
-  test('allows organization attribution for sponsored credentials', async () => {
+  test.each([4217, Zones.zoneMainnetInternal.id, Zones.zoneDeel.id])(
+    'rejects sandbox sponsorship on chain %s',
+    async (chainId) => {
+      await expect(
+        Policy.authorizeFeePayer({
+          chainId,
+          db: TestApp.database(),
+          feePayer,
+          input,
+          principal: { ...principal, environment: 'sandbox' },
+          zones,
+        }),
+      ).rejects.toThrowErrorMatchingInlineSnapshot(
+        `[Mpp.Policy.PolicyDeniedError: Mainnet fee sponsorship requires a production API key.]`,
+      )
+    },
+  )
+
+  test('allows sandbox sponsorship on a testnet Zone', async () => {
     await expect(
       Policy.authorizeFeePayer({
-        chainId: 42431,
+        chainId: Zones.zoneModeratoInternal.id,
         db: TestApp.database(),
         feePayer,
         input,
-        principal: principal_projectless,
+        principal: { ...principal, environment: 'sandbox' },
+        zones,
       }),
     ).resolves.toBe(feePayer)
   })
 
-  test('bills a projectless mainnet sponsored credential to its organization', async () => {
-    const db = TestApp.database()
-
-    await expect(
-      Policy.authorizeFeePayer({
-        chainId: 4217,
-        db,
-        feePayer,
-        input,
-        principal: principal_projectless,
-      }),
-    ).rejects.toThrowErrorMatchingInlineSnapshot(
-      `[Mpp.Policy.PolicyDeniedError: Active billing is required for mainnet fee sponsorship.]`,
-    )
-
-    await StripeCustomers.create(db, {
-      orgId: principal_projectless.orgId,
-      stripeCustomerId: 'cus_mpp',
-    })
-    await StripeCustomers.setStatus(db, principal_projectless.orgId, 'active')
-
+  test('allows organization attribution for sponsored credentials', async () => {
     await expect(
       Policy.authorizeFeePayer({
-        chainId: 4217,
-        db,
+        chainId: 42431,
+        db: TestApp.database(),
         feePayer,
         input,
         principal: principal_projectless,
+        zones,
       }),
     ).resolves.toBe(feePayer)
   })
 
+  test.each([4217, Zones.zoneMainnetInternal.id, Zones.zoneDeel.id])(
+    'requires active billing for chain %s',
+    async (chainId) => {
+      const db = TestApp.database()
+
+      await expect(
+        Policy.authorizeFeePayer({
+          chainId,
+          db,
+          feePayer,
+          input,
+          principal: principal_projectless,
+          zones,
+        }),
+      ).rejects.toThrowErrorMatchingInlineSnapshot(
+        `[Mpp.Policy.PolicyDeniedError: Active billing is required for mainnet fee sponsorship.]`,
+      )
+
+      await StripeCustomers.create(db, {
+        orgId: principal_projectless.orgId,
+        stripeCustomerId: 'cus_mpp',
+      })
+      await StripeCustomers.setStatus(db, principal_projectless.orgId, 'active')
+
+      await expect(
+        Policy.authorizeFeePayer({
+          chainId,
+          db,
+          feePayer,
+          input,
+          principal: principal_projectless,
+          zones,
+        }),
+      ).resolves.toBe(feePayer)
+    },
+  )
+
   test('does not require billing when the credential pays its own fee', async () => {
     await expect(
       Policy.authorizeFeePayer({
@@ -122,6 +176,7 @@ describe('authorizeFeePayer', () => {
           challenge: { ...input.challenge, request: { methodDetails: { feePayer: false } } },
         },
         principal,
+        zones,
       }),
     ).resolves.toBe(feePayer)
   })

package/src/apps/mpp/internal/Policy.ts

@@ -1,5 +1,7 @@
 import type { LocalAccount } from 'viem/accounts'
 
+import type * as App from '../../../App.js'
+import * as Scope from '../../../Scope.js'
 import type * as Auth from '../../../internal/Auth.js'
 import type * as Db from '../../../db/Db.js'
 import * as Viem from '../../../internal/Viem.js'
@@ -19,19 +21,57 @@ export function requiresFeePayer(input: Mpp.RelayInput) {
   return record(request['methodDetails'])?.['feePayer'] === true && request['feePayer'] !== false
 }
 
-/** Refuses credentials outside the chains served by this API deployment. */
-export function assertSupportedChain(options: assertSupportedChain.Options) {
-  const { chainId, supportedChainIds } = options
+/** Refuses a sponsored transaction that the current fee market cannot admit. */
+export function assertFeeMarketAdmission(options: assertFeeMarketAdmission.Options) {
+  if (options.maxFeePerGas < options.baseFeePerGas)
+    throw new PolicyDeniedError('Transaction max fee per gas is below the current base fee.')
+}
+
+export declare namespace assertFeeMarketAdmission {
+  /** Current fee-market and transaction fee bounds. */
+  type Options = {
+    /** Latest block base fee. */
+    baseFeePerGas: bigint
+    /** Signed transaction fee cap. */
+    maxFeePerGas: bigint
+  }
+}
+
+/** Refuses unsupported chains, unauthorized Zones, and sandbox access to mainnet. */
+export function assertChainAccess(options: assertChainAccess.Options) {
+  const { chainId, principal, supportedChainIds, zones } = options
   if (!supportedChainIds.has(chainId)) throw new UnsupportedChainError(chainId)
+  const zone = zones.get(chainId)
+  if (zone) {
+    const scopes = principal?.type === 'api_key' ? principal.apiKey.scopes : undefined
+    if (
+      !scopes?.includes(Scope.wildcard) &&
+      !scopes?.includes(`zone:${chainId}:read`) &&
+      !scopes?.includes(`zone:${chainId}:write`)
+    )
+      throw new PolicyDeniedError(
+        `Chain id ${chainId} is a zone. Use an API key granting \`zone:${chainId}:read\` or \`zone:${chainId}:write\`.`,
+      )
+  }
+  if (
+    principal?.type === 'api_key' &&
+    principal.environment === 'sandbox' &&
+    Viem.isMainnet(zone?.sourceId ?? chainId)
+  )
+    throw new PolicyDeniedError('Sandbox API keys only support testnet. Use a testnet challenge.')
 }
 
-export declare namespace assertSupportedChain {
+export declare namespace assertChainAccess {
   /** Chain-selection inputs. */
   type Options = {
     /** Resolved credential chain. */
     chainId: number
+    /** Authenticated request principal. */
+    principal?: Auth.Principal | undefined
     /** Chains served by this API deployment. */
     supportedChainIds: ReadonlySet<number>
+    /** Configured Zones and their parent chains. */
+    zones: App.Environment['Variables']['zones']
   }
 }
 
@@ -39,11 +79,11 @@ export declare namespace assertSupportedChain {
 export async function authorizeFeePayer(
   options: authorizeFeePayer.Options,
 ): Promise<LocalAccount | undefined> {
-  const { chainId, db, feePayer, input, principal } = options
+  const { chainId, db, feePayer, input, principal, zones } = options
   if (!feePayer || !requiresFeePayer(input)) return feePayer
   if (principal?.type !== 'api_key')
     throw new PolicyDeniedError('Fee sponsorship requires an API key.')
-  if (!Viem.isMainnet(chainId)) return feePayer
+  if (!Viem.isMainnet(zones.get(chainId)?.sourceId ?? chainId)) return feePayer
   if (principal.environment !== 'production')
     throw new PolicyDeniedError('Mainnet fee sponsorship requires a production API key.')
 
@@ -70,6 +110,8 @@ export declare namespace authorizeFeePayer {
     input: Mpp.RelayInput
     /** Authenticated request principal. */
     principal?: Auth.Principal | undefined
+    /** Configured Zones and their parent chains. */
+    zones: App.Environment['Variables']['zones']
   }
 }
 
@@ -92,7 +134,7 @@ export class UnsupportedChainError extends Error {
   }
 }
 
-/** Raised when a caller is not eligible for managed fee sponsorship. */
+/** Raised when an MPP credential violates chain access or sponsorship policy. */
 export class PolicyDeniedError extends Error {
   override name = 'Mpp.Policy.PolicyDeniedError'
 }