tapimo 0.19.0 → 0.20.0

package/src/apps/management/routes/routes-access-requests.ts

@@ -5,14 +5,19 @@ import * as ApiKeys from '../../../ApiKeys.js'
 import * as Db from '../../../db/Db.js'
 import * as RoutesAccessRequests from '../../../db/tables/routesAccessRequests.js'
 import * as Auth from '../../../internal/Auth.js'
+import * as ExecutionContext from '../../../internal/ExecutionContext.js'
 import * as OpenApi from '../../../internal/OpenApi.js'
 import * as Response from '../../../internal/Response.js'
+import * as RoutesCatalog from '../../../internal/routes/Catalog.js'
 import * as Schema from '../../../internal/Schema.js'
 import type { Environment } from '../App.js'
 
 /** Most keys or routes one request may name. */
 const maxItems = 50
 
+/** Quiet period after an organization's request during which later requests skip the reviewer notice. */
+const noticeCooldownMs = 10 * 60_000
+
 /** OpenAPI schemas owned by Routes access requests. */
 export namespace schema {
   const id = (description: string, example: string) =>
@@ -44,12 +49,10 @@ export namespace schema {
   export const RoutesAccessRequest = OpenApi.component(
     Schema.describe(
       z.object({
-        createdAt: z.iso
-          .datetime()
-          .check(
-            z.describe('When the request was created (ISO 8601).'),
-            z.meta({ examples: ['2026-01-01T00:00:00.000Z'] }),
-          ),
+        createdAt: Schema.dateTime().check(
+          z.describe('When the request was created (ISO 8601).'),
+          z.meta({ examples: ['2026-01-01T00:00:00.000Z'] }),
+        ),
         environment,
         expectedVolume: z
           .nullable(z.string())
@@ -100,7 +103,7 @@ export namespace schema {
             z.meta({ examples: ['Approved for Base USDC only.', null] }),
           ),
         reviewedAt: z
-          .nullable(z.iso.datetime())
+          .nullable(Schema.dateTime())
           .check(
             z.describe('When the request was reviewed (ISO 8601), or null while pending.'),
             z.meta({ examples: ['2026-01-02T00:00:00.000Z', null] }),
@@ -129,12 +132,10 @@ export namespace schema {
             z.describe('Whether 1:1 subsidized delivery was requested.'),
             z.meta({ examples: [true] }),
           ),
-        updatedAt: z.iso
-          .datetime()
-          .check(
-            z.describe('When the request was last changed (ISO 8601).'),
-            z.meta({ examples: ['2026-01-01T00:00:00.000Z'] }),
-          ),
+        updatedAt: Schema.dateTime().check(
+          z.describe('When the request was last changed (ISO 8601).'),
+          z.meta({ examples: ['2026-01-01T00:00:00.000Z'] }),
+        ),
       }),
       "A project's request for Routes transfer access.",
     ),
@@ -286,7 +287,7 @@ const path =
   '/v1/orgs/:orgId{org_[A-Za-z0-9_-]+}/projects/:projectId{prj_[A-Za-z0-9_-]+}/routes-access-requests'
 
 /** Mounts project Routes access request operations. */
-export function routesAccessRequests() {
+export function routesAccessRequests(options: routesAccessRequests.Options = {}) {
   return new Hono<Environment>()
     .post(
       path,
@@ -341,7 +342,8 @@ export function routesAccessRequests() {
               message: `Choose live ${body.environment} keys from this project (${unknown.join(', ')})`,
               status: 400,
             })
-          const record = await RoutesAccessRequests.create(Db.get(c.get('db')), {
+          const db = Db.get(c.get('db'))
+          const record = await RoutesAccessRequests.create(db, {
             environment: body.environment,
             ...(body.expectedVolume ? { expectedVolume: body.expectedVolume } : {}),
             keyIds: [...new Set(body.keyIds)],
@@ -358,6 +360,7 @@ export function routesAccessRequests() {
               message: 'This project already has a pending Routes access request',
               status: 409,
             })
+          dispatchNotice(c, { db, notify: options.notify, record })
           return c.json(
             Response.validated(schema.RoutesAccessRequest, RoutesAccessRequests.toRequest(record)),
             200,
@@ -458,6 +461,87 @@ export function routesAccessRequests() {
     )
 }
 
+export declare namespace routesAccessRequests {
+  /** Options for the Routes access request operations. */
+  type Options = {
+    /** Called in the background for each new request, so reviewers hear about it; failures never affect the response. */
+    notify?: ((notice: Notice) => Promise<void>) | undefined
+  }
+
+  /** A new Routes access request, summarized for reviewers. */
+  type Notice = {
+    /** Environment the requested keys belong to. */
+    environment: RoutesAccessRequests.Record['environment']
+    /** Requester's expected monthly volume, as typed. */
+    expectedVolume?: string | undefined
+    /** Number of keys the request names. */
+    keyCount: number
+    /** Requester's note to reviewers. */
+    note?: string | undefined
+    /** Organization name. */
+    organization: string
+    /** Project name. */
+    project: string
+    /** Requester's verified email, when the session has one. */
+    requester?: string | undefined
+    /** Requested routes as `USDC on Base → OUSD on Tempo`; empty leaves the choice to Tempo. */
+    routes: readonly string[]
+    /** Whether the requester asked for 1:1 subsidized delivery. */
+    subsidy: boolean
+  }
+}
+
+/** Hands a new request to the notifier after the response, labelling routes from the catalog. */
+function dispatchNotice(c: Context<Environment>, options: dispatchNotice.Options) {
+  const { db, notify, record } = options
+  if (!notify) return
+  const principal = Auth.getPrincipal(c)
+  const organization = Auth.org(c).name
+  const project = Auth.project(c).name
+  const task = (async () => {
+    // A cancel-and-recreate loop would otherwise ping the reviewer every time; the queue still lists every request.
+    const since = new Date(Date.parse(record.createdAt) - noticeCooldownMs).toISOString()
+    const recent = await RoutesAccessRequests.hasRecent(db, {
+      excludeId: record.id,
+      orgId: record.orgId,
+      since,
+    }).catch(() => false)
+    if (recent) return
+    // Labels are best effort: a failed catalog read falls back to raw ids instead of dropping the notice.
+    const catalog = await RoutesCatalog.read(db).catch(() => undefined)
+    const label = (chainId: string, tokenId: string) =>
+      `${catalog?.tokensById.get(tokenId)?.symbol ?? tokenId} on ${(catalog && RoutesCatalog.getChain(catalog, chainId)?.name) ?? chainId}`
+    await notify({
+      environment: record.environment,
+      ...(record.expectedVolume ? { expectedVolume: record.expectedVolume } : {}),
+      keyCount: record.keyIds.length,
+      ...(record.note ? { note: record.note } : {}),
+      organization,
+      project,
+      ...(principal?.type === 'session' && principal.email ? { requester: principal.email } : {}),
+      routes: record.routes.map(
+        (route) =>
+          `${label(route.sourceChainId, route.sourceTokenId)} → ${label(route.destinationChainId, route.destinationTokenId)}`,
+      ),
+      subsidy: record.subsidy,
+    })
+  })().catch((error) => console.error('routes access request notice failed', error))
+  const waitUntil = ExecutionContext.waitUntil(c)
+  // Without an execution context (Node, tests) the floating promise settles on its own.
+  if (waitUntil) waitUntil(task)
+}
+
+declare namespace dispatchNotice {
+  type Options = {
+    /** Database the request was written to; labels routes from its catalog. */
+    db: Db.Db
+    /** Reviewer notifier, when configured. */
+    notify: routesAccessRequests.Options['notify']
+    /** The request just created. */
+    record: RoutesAccessRequests.Record
+  }
+}
+
 function keysNotEnabled(c: Context<Environment>) {
   return Response.error(c, {
     code: 'api_keys_not_enabled',

package/src/apps/management/routes/scopes.test.ts

@@ -85,7 +85,7 @@ describe('scopes', () => {
       `"private, max-age=300, stale-while-revalidate=3600"`,
     )
     expect(body.data).toEqual(
-      [...Scope.catalog, Scope.zoneEntry, Scope.zoneWriteEntry].map((entry) => ({ ...entry })),
+      [...Scope.catalog, Scope.zoneWriteEntry].map((entry) => ({ ...entry })),
     )
     expect(body.data.map((entry) => entry.scope)).toMatchInlineSnapshot(`
       [
@@ -103,7 +103,7 @@ describe('scopes', () => {
         "webhooks:read",
         "webhooks:write",
         "zone:read",
-        "zone:<chainId>:read",
+        "zone:write",
         "zone:<chainId>:write",
       ]
     `)
@@ -120,6 +120,6 @@ describe('scopes', () => {
     const body = await TestApp.json(response, Scopes.schema.getScopes.Response)
 
     expect(response.status).toBe(200)
-    expect(body.data).toEqual([...Scope.catalog, Scope.zoneEntry, Scope.zoneWriteEntry, custom])
+    expect(body.data).toEqual([...Scope.catalog, Scope.zoneWriteEntry, custom])
   })
 })

package/src/apps/management/routes/usage.ts

@@ -64,7 +64,7 @@ export namespace schema {
           .optional(z.enum(['production', 'sandbox']))
           .check(z.describe('Only include requests made with this API-key environment.'), z.meta({ examples: ['sandbox'] })), // prettier-ignore
         from: z
-          .optional(z.iso.datetime({ offset: true }))
+          .optional(Schema.dateTime({ offset: true }))
           .check(
             z.describe('Only include requests at or after this ISO 8601 timestamp.'),
             z.meta({ examples: ['2026-01-01T00:00:00Z'] }),
@@ -80,7 +80,7 @@ export namespace schema {
           z.meta({ examples: ['prj_1a2b3c4d5e6f7g8h9j0k1m2n'] }),
         ),
         to: z
-          .optional(z.iso.datetime({ offset: true }))
+          .optional(Schema.dateTime({ offset: true }))
           .check(
             z.describe('Only include requests at or before this ISO 8601 timestamp.'),
             z.meta({ examples: ['2026-01-31T23:59:59Z'] }),
@@ -125,12 +125,10 @@ export namespace schema {
           requests: z
             .number()
             .check(z.int(), z.describe('Total requests.'), z.meta({ examples: [40] })),
-          time: z.iso
-            .datetime()
-            .check(
-              z.describe('Bucket start timestamp (ISO 8601).'),
-              z.meta({ examples: ['2026-01-01T00:00:00.000Z'] }),
-            ),
+          time: Schema.dateTime().check(
+            z.describe('Bucket start timestamp (ISO 8601).'),
+            z.meta({ examples: ['2026-01-01T00:00:00.000Z'] }),
+          ),
         })
         .check(z.describe('One usage series point.')),
       'RequestUsageSeriesPoint',
@@ -179,12 +177,10 @@ export namespace schema {
           byKey: z.array(KeyBreakdown).check(z.describe('Usage grouped by API key.'), z.meta({ examples: [[]] })), // prettier-ignore
           byRoute: z.array(RouteBreakdown).check(z.describe('Usage grouped by route.'), z.meta({ examples: [[]] })), // prettier-ignore
           byStatus: z.array(StatusBreakdown).check(z.describe('Usage grouped by status code.'), z.meta({ examples: [[]] })), // prettier-ignore
-          from: z.iso
-            .datetime()
-            .check(
-              z.describe('Inclusive lower timestamp bound used for the read (ISO 8601).'),
-              z.meta({ examples: ['2026-01-01T00:00:00.000Z'] }),
-            ),
+          from: Schema.dateTime().check(
+            z.describe('Inclusive lower timestamp bound used for the read (ISO 8601).'),
+            z.meta({ examples: ['2026-01-01T00:00:00.000Z'] }),
+          ),
           interval: z
             .enum(['day', 'hour'])
             .check(
@@ -192,12 +188,10 @@ export namespace schema {
               z.meta({ examples: ['day'] }),
             ),
           series: z.array(SeriesPoint).check(z.describe('Usage grouped into time buckets.'), z.meta({ examples: [[]] })), // prettier-ignore
-          to: z.iso
-            .datetime()
-            .check(
-              z.describe('Inclusive upper timestamp bound used for the read (ISO 8601).'),
-              z.meta({ examples: ['2026-01-31T23:59:59.000Z'] }),
-            ),
+          to: Schema.dateTime().check(
+            z.describe('Inclusive upper timestamp bound used for the read (ISO 8601).'),
+            z.meta({ examples: ['2026-01-31T23:59:59.000Z'] }),
+          ),
           totals: Totals,
         }),
         'Request usage.',
@@ -238,12 +232,10 @@ export namespace schema {
               z.describe('Committed fees for the bucket.'),
               z.meta({ examples: [{ amount: '12.34', currency: 'usd' }] }),
             ),
-          timestamp: z.iso
-            .datetime()
-            .check(
-              z.describe('Bucket start (ISO 8601), aligned to UTC calendar boundaries.'),
-              z.meta({ examples: ['2026-01-01T00:00:00.000Z'] }),
-            ),
+          timestamp: Schema.dateTime().check(
+            z.describe('Bucket start (ISO 8601), aligned to UTC calendar boundaries.'),
+            z.meta({ examples: ['2026-01-01T00:00:00.000Z'] }),
+          ),
         }),
         'One time bucket of sponsorship usage.',
       ),
@@ -272,7 +264,7 @@ export namespace schema {
             z.meta({ examples: ['production'] }),
           ),
         from: z
-          .optional(z.iso.datetime({ offset: true }))
+          .optional(Schema.dateTime({ offset: true }))
           .check(
             z.describe('Window start (ISO 8601), inclusive. Defaults to 30 days before `to`.'),
             z.meta({ examples: ['2026-01-01T00:00:00Z'] }),
@@ -290,7 +282,7 @@ export namespace schema {
             z.meta({ examples: ['prj_1a2b3c4d5e6f7g8h9j0k1m2n'] }),
           ),
         to: z
-          .optional(z.iso.datetime({ offset: true }))
+          .optional(Schema.dateTime({ offset: true }))
           .check(
             z.describe('Window end (ISO 8601), exclusive. Defaults to now.'),
             z.meta({ examples: ['2026-01-31T00:00:00Z'] }),

package/src/apps/management/routes/verified-token-requests.ts

@@ -34,12 +34,10 @@ export namespace schema {
     Schema.describe(
       z.extend(tokenSchema.Input, {
         chainId,
-        createdAt: z.iso
-          .datetime()
-          .check(
-            z.describe('When the request was created (ISO 8601).'),
-            z.meta({ examples: ['2026-01-01T00:00:00.000Z'] }),
-          ),
+        createdAt: Schema.dateTime().check(
+          z.describe('When the request was created (ISO 8601).'),
+          z.meta({ examples: ['2026-01-01T00:00:00.000Z'] }),
+        ),
         id: z
           .string()
           .check(
@@ -79,7 +77,7 @@ export namespace schema {
             z.meta({ examples: ['Logo URL is unreachable.', null] }),
           ),
         reviewedAt: z
-          .nullable(z.iso.datetime())
+          .nullable(Schema.dateTime())
           .check(
             z.describe('When the request was reviewed (ISO 8601), or null while pending.'),
             z.meta({ examples: ['2026-01-02T00:00:00.000Z', null] }),
@@ -87,12 +85,10 @@ export namespace schema {
         status: z
           .enum(['approved', 'denied', 'pending'])
           .check(z.describe('Review status of the request.'), z.meta({ examples: ['pending'] })),
-        updatedAt: z.iso
-          .datetime()
-          .check(
-            z.describe('When the request was last changed (ISO 8601).'),
-            z.meta({ examples: ['2026-01-01T00:00:00.000Z'] }),
-          ),
+        updatedAt: Schema.dateTime().check(
+          z.describe('When the request was last changed (ISO 8601).'),
+          z.meta({ examples: ['2026-01-01T00:00:00.000Z'] }),
+        ),
       }),
       "An organization's request to add a token to the curated verified list.",
     ),

package/src/apps/management/routes/zone-delegations.test.ts

@@ -41,11 +41,11 @@ test('publishes the list operation', async () => {
 })
 
 test('lists active delegations per environment for sessions and management keys', async () => {
-  const { app, cookie, db, kv, org, path, project } = await setup()
-  const base = { accountsAll: true, orgId: org.id, projects: 'all', tokensAll: true } as const
+  const { app, cookie, db, kv, org, path } = await setup()
+  const base = { accountsAll: true, orgId: org.id, tokensAll: true } as const
   const revoked = await ZoneDelegations.create(db, { ...base, chainId: 1_424_310_003, environment: 'production' }) // prettier-ignore
   await ZoneDelegations.revoke(db, revoked.id)
-  await ZoneDelegations.create(db, { ...base, accountsAll: false, chainId: 421_700_002, environment: 'production', projects: [project.id] }) // prettier-ignore
+  await ZoneDelegations.create(db, { ...base, accountsAll: false, chainId: 421_700_002, environment: 'production' }) // prettier-ignore
   await ZoneDelegations.create(db, { ...base, chainId: 421_700_001, environment: 'production' })
   await ZoneDelegations.create(db, { ...base, chainId: 421_700_001, environment: 'sandbox' })
 
@@ -60,7 +60,6 @@ test('lists active delegations per environment for sessions and management keys'
       createdAt: expect.any(String),
       environment: 'production',
       name: 'zone-mainnet-internal',
-      projects: 'all',
       tokensAll: true,
     },
     {
@@ -69,7 +68,6 @@ test('lists active delegations per environment for sessions and management keys'
       createdAt: expect.any(String),
       environment: 'production',
       name: 'zone-deel',
-      projects: [project.id],
       tokensAll: true,
     },
   ])

package/src/apps/management/routes/zone-delegations.ts

@@ -42,12 +42,10 @@ export namespace schema {
             z.meta({ examples: [true] }),
           ),
         chainId: z.int().check(z.describe('Zone chain id.'), z.meta({ examples: [421700001] })),
-        createdAt: z.iso
-          .datetime()
-          .check(
-            z.describe('When the delegation was created (ISO 8601).'),
-            z.meta({ examples: ['2026-10-19T00:00:00.000Z'] }),
-          ),
+        createdAt: Schema.dateTime().check(
+          z.describe('When the delegation was created (ISO 8601).'),
+          z.meta({ examples: ['2026-10-19T00:00:00.000Z'] }),
+        ),
         environment: ZoneDelegation.schema.Environment,
         name: z
           .optional(z.string())
@@ -55,7 +53,6 @@ export namespace schema {
             z.describe('Zone name when the Zone is hosted by Tempo.'),
             z.meta({ examples: ['zone-mainnet-internal'] }),
           ),
-        projects: ZoneDelegation.schema.Projects,
         tokensAll: z
           .boolean()
           .check(
@@ -83,7 +80,6 @@ export namespace schema {
                   createdAt: '2026-10-19T00:00:00.000Z',
                   environment: 'production',
                   name: 'zone-mainnet-internal',
-                  projects: 'all',
                   tokensAll: true,
                 },
               ],
@@ -170,7 +166,6 @@ export function zoneDelegations() {
                   createdAt: record.createdAt,
                   environment: record.environment,
                   ...(name === undefined ? {} : { name }),
-                  projects: record.projects,
                   tokensAll: record.tokensAll,
                 }
               }),

package/src/apps/mpp/App.ts

@@ -45,7 +45,7 @@ export function mpp(options: mpp.Options) {
         // Record the Zone decision here; the adapter re-checks without recording.
         const response = await Timing.time(c, 'mpp_verify', async () => {
           try {
-            Policy.assertChainAccess(c, {
+            await Policy.assertChainAccess(c, {
               chainId,
               supportedChainIds: c.get('supportedChainIds'),
               zones: c.get('zones'),
@@ -168,7 +168,7 @@ async function authorizeBroadcast(
   const chainId = Policy.chainId(input) ?? c.get('chainId')
   const principal = Auth.getPrincipal(c) ?? undefined
   try {
-    Policy.assertChainAccess(c, {
+    await Policy.assertChainAccess(c, {
       chainId,
       supportedChainIds: c.get('supportedChainIds'),
       zones: c.get('zones'),
@@ -316,7 +316,7 @@ async function broadcast(c: Context<App.Environment>, options: broadcast.Options
 async function reconcile(c: Context<App.Environment>, options: reconcile.Options) {
   const { options: options_mpp, submission } = options
   try {
-    Policy.assertChainAccess(c, {
+    await Policy.assertChainAccess(c, {
       chainId: submission.chainId,
       supportedChainIds: c.get('supportedChainIds'),
       zones: c.get('zones'),

package/src/apps/mpp/Mpp.zone.test.ts

@@ -70,7 +70,7 @@ describe('MPP Zone authorization', () => {
           expect(await response.json()).toEqual({
             error: {
               code: 'policy_denied',
-              message: `Broadcasting to zone ${zone.id} requires \`zone:${zone.id}:write\`.`,
+              message: `Broadcasting to zone ${zone.id} requires \`zone:write\` with a tag for Zone ${zone.id}, issued to an organization delegated that Zone.`,
             },
             success: false,
           })
@@ -84,11 +84,14 @@ describe('MPP Zone authorization', () => {
   )
 
   test.each(['validate', 'broadcast'] as const)(
-    '%s confines wildcard sandbox keys to testnet without requiring sponsorship',
+    '%s confines tagged sandbox keys to testnet without requiring sponsorship',
     async (operation) => {
       const resolutions: number[] = []
+      const db = TestApp.database()
+      await TestApp.delegateZone(db, { chainIds: [zone.id], environment: 'sandbox', orgId: key.orgId }) // prettier-ignore
       const app = TestApp.create({
-        auth: { keys: [{ ...key, environment: 'sandbox', scopes: ['*'] }] },
+        auth: { keys: [{ ...key, environment: 'sandbox', scopes: ['mpp:write', 'zone:write'], zoneTags: [zone.id] }] }, // prettier-ignore
+        db,
         rpc: ({ chainId }) => {
           resolutions.push(chainId)
           return { url: runtime.zone.internalRpcUrl }
@@ -120,8 +123,11 @@ describe('MPP Zone authorization', () => {
 
   test('requires active billing before mainnet Zone fee-payer access', async () => {
     const resolutions: number[] = []
+    const db = TestApp.database()
+    await TestApp.delegateZone(db, { chainIds: [zone.id], orgId: key.orgId })
     const app = TestApp.create({
-      auth: { keys: [{ ...key, scopes: ['mpp:write', `zone:${zone.id}:write`] }] },
+      auth: { keys: [{ ...key, scopes: ['mpp:write', 'zone:write'], zoneTags: [zone.id] }] },
+      db,
       mpp: { feePayer: Tempo.accounts[2], state: Store.memory() },
       rpc: ({ chainId }) => {
         resolutions.push(chainId)
@@ -143,28 +149,53 @@ describe('MPP Zone authorization', () => {
 
   test('requires write scope to validate or broadcast Zone credentials', async () => {
     const input = await credential()
-    const app = TestApp.create({
-      auth: { keys: [{ ...key, scopes: ['mpp:write', `zone:${zone.id}:read`] }] },
-      zones: [zone],
-    })
-    for (const operation of ['validate', 'broadcast'] as const)
-      expect(await (await post(app, operation, input)).json()).toEqual({
-        error: {
-          code: 'policy_denied',
-          message: `Broadcasting to zone ${zone.id} requires \`zone:${zone.id}:write\`.`,
-        },
-        success: false,
-      })
+    // A read scope never broadcasts, nor does a generic write scope without a tag for the Zone or
+    // without a delegation, nor the wildcard however it is tagged.
+    const db = TestApp.database()
+    await TestApp.delegateZone(db, { chainIds: [zone.id], orgId: key.orgId })
+    for (const reader of [
+      { scopes: ['mpp:write', 'zone:read'], zoneTags: [zone.id] },
+      { scopes: ['mpp:write', 'zone:write'] },
+      { scopes: ['mpp:write', 'zone:write'], zoneTags: [zone.id + 1] },
+      { orgId: 'org_undelegated', scopes: ['mpp:write', 'zone:write'], zoneTags: [zone.id] },
+      { scopes: ['*'] },
+      { scopes: ['*'], zoneTags: [zone.id] },
+    ]) {
+      const app = TestApp.create({ auth: { keys: [{ ...key, ...reader }] }, db, zones: [zone] })
+      for (const operation of ['validate', 'broadcast'] as const)
+        expect(await (await post(app, operation, input)).json()).toEqual({
+          error: {
+            code: 'policy_denied',
+            message: `Broadcasting to zone ${zone.id} requires \`zone:write\` with a tag for Zone ${zone.id}, issued to an organization delegated that Zone.`,
+          },
+          success: false,
+        })
+    }
   })
 
   test.each([
     { environment: 'production', scopes: ['mpp:write', `zone:${zone.id}:write`], sourceId: 4217 },
-    { environment: 'production', scopes: ['*'], sourceId: 4217 },
+    // The wildcard grants no Zone on its own; it may sit beside the explicit write grant.
+    { environment: 'production', scopes: ['*', `zone:${zone.id}:write`], sourceId: 4217 },
     { environment: 'sandbox', scopes: ['mpp:write', `zone:${zone.id}:write`], sourceId: 42431 },
+    { environment: 'production', scopes: ['mpp:write', 'zone:write'], sourceId: 4217, zoneTags: [zone.id] }, // prettier-ignore
+    { environment: 'sandbox', scopes: ['mpp:write', 'zone:write'], sourceId: 42431, zoneTags: [zone.id] }, // prettier-ignore
   ] as const)('allows authorized $environment Zone credentials with $scopes', async (options) => {
     const input = await credential()
+    const db = TestApp.database()
+    await TestApp.delegateZone(db, { chainIds: [zone.id], environment: options.environment, orgId: key.orgId }) // prettier-ignore
     const app = TestApp.create({
-      auth: { keys: [{ ...key, environment: options.environment, scopes: [...options.scopes] }] },
+      db,
+      auth: {
+        keys: [
+          {
+            ...key,
+            environment: options.environment,
+            scopes: [...options.scopes],
+            ...('zoneTags' in options ? { zoneTags: [...options.zoneTags] } : {}),
+          },
+        ],
+      },
       zones: [{ ...zone, sourceId: options.sourceId }],
     })
     for (const operation of ['validate', 'broadcast'] as const)

package/src/apps/mpp/internal/Adapter.ts

@@ -200,7 +200,7 @@ function isCanonical(serialized: Hex.Hex) {
   if (!/^0x7[68]/.test(serialized)) return true
   try {
     const envelope = TxEnvelopeTempo.deserialize(serialized as TxEnvelopeTempo.Serialized)
-    // Fee-payer handoffs encode a sender address or, for multisig senders, the `0x00` marker; parsing recovers `from` either way.
+    // Fee-payer handoffs encode a sender address or, for configurable account senders, the `0x00` marker; parsing recovers `from` either way.
     const slot = (Rlp.toHex(Hex.slice(serialized, 1)) as readonly Hex.Hex[])[11]
     const serialized_parsed = serialized.startsWith(TxEnvelopeTempo.feePayerMagic)
       ? TxEnvelopeTempo.serialize(envelope, {

package/src/apps/mpp/internal/Error.test.ts

@@ -4,6 +4,7 @@ import * as Mpp from '../Mpp.js'
 import * as Confirmation from './Confirmation.js'
 import * as MppError from './Error.js'
 import * as Idempotency from './Idempotency.js'
+import * as Policy from './Policy.js'
 import * as ScreenManager from './ScreenManager.js'
 
 describe('map', () => {
@@ -26,6 +27,8 @@ describe('map', () => {
       Mpp.relayErrorCode.alreadyUsed,
     ],
     [new Idempotency.LeaseLostError(), Mpp.relayErrorCode.temporarilyUnavailable],
+    [new Policy.AccessUnavailableError(), Mpp.relayErrorCode.temporarilyUnavailable],
+    [new Policy.PolicyDeniedError(), Mpp.relayErrorCode.policyDenied],
     [new Confirmation.UnconfirmedError({ status: 502 }), Mpp.relayErrorCode.temporarilyUnavailable],
     [new ScreenManager.RejectedError(), Mpp.relayErrorCode.screenRejected],
     [new Error('Transaction simulation failed.'), Mpp.relayErrorCode.simulationFailed],

package/src/apps/mpp/internal/Error.ts

@@ -12,6 +12,7 @@ export function map(cause: unknown): Mpp.RelayError {
   const message = cause instanceof Error ? cause.message : undefined
 
   switch (true) {
+    case cause instanceof Policy.AccessUnavailableError:
     case cause instanceof Idempotency.LeaseLostError:
     // The transaction may still land; an idempotent retry reconciles it.
     case cause instanceof Confirmation.UnconfirmedError:

package/src/apps/mpp/internal/Policy.test.ts

@@ -87,32 +87,33 @@ describe('assertFeeMarketAdmission', () => {
 })
 
 describe('assertChainAccess', () => {
-  test('rejects chains outside the deployment allowlist', () => {
-    expect(() =>
+  test('rejects chains outside the deployment allowlist', async () => {
+    await expect(
       Policy.assertChainAccess(new Context(new Request('http://tempo-api.test/')), {
         chainId: 1,
         supportedChainIds: new Set([4217]),
         zones,
       }),
-    ).toThrowErrorMatchingInlineSnapshot(
+    ).rejects.toThrowErrorMatchingInlineSnapshot(
       `[Mpp.Policy.UnsupportedChainError: Unsupported chain id 1.]`,
     )
   })
 
-  test('requires a Zone write scope; read scopes never admit', () => {
+  test('requires a Zone write scope; read grants never admit', async () => {
     const chainId = Zones.zoneModeratoInternal.id
     const c = new Context(new Request('http://tempo-api.test/'))
     c.set(
       'principal' as never,
       {
         ...principal,
-        apiKey: { ...principal.apiKey, scopes: ['mpp:write', `zone:${chainId}:read`] },
+        apiKey: { ...principal.apiKey, scopes: ['mpp:write', 'zone:read'] },
+        zoneTags: [chainId],
       } as never,
     )
-    expect(() =>
+    await expect(
       Policy.assertChainAccess(c, { chainId, supportedChainIds: new Set([chainId]), zones }),
-    ).toThrowErrorMatchingInlineSnapshot(
-      `[Mpp.Policy.PolicyDeniedError: Broadcasting to zone 1424310003 requires \`zone:1424310003:write\`.]`,
+    ).rejects.toThrowErrorMatchingInlineSnapshot(
+      `[Mpp.Policy.PolicyDeniedError: Broadcasting to zone 1424310003 requires \`zone:write\` with a tag for Zone 1424310003, issued to an organization delegated that Zone.]`,
     )
     expect(c.get('zoneAccess' as never)).toMatchObject({ chainId, verb: 'write' })
   })