tapimo 0.19.0 → 0.20.0

package/src/apps/relay/App.test.ts

@@ -4,8 +4,8 @@ import * as jose from 'jose'
 import { nanoid } from 'nanoid'
 import { Hash, Hex, Json, Secp256k1 } from 'ox'
 import {
+  AccountOperation,
   KeyAuthorization,
-  MultisigOperation,
   SignatureEnvelope,
   TxEnvelopeTempo,
   ZoneRpcAuthentication,
@@ -58,7 +58,8 @@ const runtime = Runtime.get()
 const feePayerAccount = Tempo.accounts[10]!
 const senderAccount = Tempo.accounts[9]!
 const zone = runtime.zone.chainId
-const zoneScope = `zone:${zone}:read` as const
+/** Generic Zone read scope; keys tag the Zones they read. */
+const zoneScope = 'zone:read' as const
 const zoneOptions = TestApp.zone({
   chainId: zone,
   rpcUrl: runtime.zone.internalRpcUrl,
@@ -106,8 +107,10 @@ const keys = [
     orgId: 'org_2',
     projectId: 'prj_2',
     environment: 'production',
-    scopes: ['*'],
+    // The wildcard grants no Zone; the key carries explicit Zone grants beside it (fee-payer signing counts as a read).
+    scopes: ['*', 'zone:read', 'zone:write'],
     token: 'secret_wildcard_prod',
+    zoneTags: [zone],
   },
   {
     id: 'key_unscoped',
@@ -124,6 +127,7 @@ const keys = [
     environment: 'sandbox',
     scopes: ['rpc-relay:read', zoneScope],
     token: 'secret_zone_relay',
+    zoneTags: [zone],
   },
   {
     id: 'key_zone_sponsor',
@@ -132,6 +136,7 @@ const keys = [
     environment: 'sandbox',
     scopes: ['rpc-relay:sponsor', zoneScope],
     token: 'secret_zone_sponsor',
+    zoneTags: [zone],
   },
   {
     id: 'key_zone_writer',
@@ -141,6 +146,23 @@ const keys = [
     scopes: ['rpc-relay:read', 'rpc-relay:sponsor', `zone:${zone}:write`],
     token: 'secret_zone_writer',
   },
+  {
+    id: 'key_zone_tagged_writer',
+    orgId: 'org_1',
+    projectId: 'prj_1',
+    environment: 'sandbox',
+    scopes: ['rpc-relay:read', 'rpc-relay:sponsor', 'zone:write'],
+    token: 'secret_zone_tagged_writer',
+    zoneTags: [zone],
+  },
+  {
+    id: 'key_zone_untagged_writer',
+    orgId: 'org_1',
+    projectId: 'prj_1',
+    environment: 'sandbox',
+    scopes: ['rpc-relay:read', 'rpc-relay:sponsor', 'zone:write'],
+    token: 'secret_zone_untagged_writer',
+  },
   {
     id: 'key_unattributed',
     orgId: 'org_1',
@@ -157,14 +179,22 @@ const keys = [
   },
 ] as const satisfies readonly TestApp.kvStore.Key[]
 
-describe('behavior: multisig coordination', () => {
+/** Holds every fixture organization's whole-Zone delegation; apps without their own database share it. */
+const zoneDb = TestApp.database()
+await TestApp.delegateZone(zoneDb, { chainIds: [zone], environment: 'sandbox', orgId: 'org_1' })
+await TestApp.delegateZone(zoneDb, { chainIds: [zone], orgId: 'org_2' })
+await TestApp.delegateZone(zoneDb, { chainIds: [zone, zone + 1], orgId: 'org_oidc' })
+await TestApp.delegateZone(zoneDb, { chainIds: [zone], orgId: 'org_other' })
+
+describe('behavior: configurable account coordination', () => {
   test('uses configured state and reports coordinator failures', async () => {
     const entries: Log.Entry[] = []
     const store = Store.memory()
     const app = TestApp.create({
       auth: { keys },
+      db: zoneDb,
       logger: (entry) => void entries.push(entry),
-      relay: { multisig: { store } },
+      relay: { accounts: { store } },
     })
     const hash = Hex.random(32)
     const request = async () => {
@@ -172,7 +202,7 @@ describe('behavior: multisig coordination', () => {
         body: JSON.stringify({
           id: 1,
           jsonrpc: '2.0',
-          method: 'multisig_getOperation',
+          method: 'account_getOperation',
           params: [hash],
         }),
         headers: { 'content-type': 'application/json', 'tempo-api-key': 'secret_unscoped' },
@@ -181,7 +211,7 @@ describe('behavior: multisig coordination', () => {
       return response.json()
     }
     expect(await request()).toMatchObject({ result: null })
-    await store.put(`multisig:v2:multisig:operation:${hash}`, 'invalid')
+    await store.put(`accounts:v1:configurableAccount:operation:${hash}`, 'invalid')
     expect(await request()).toMatchObject({ error: { code: -32603 } })
     expect(entries.at(-1)?.rpc).toMatchObject({ serverErrors: 1 })
   })
@@ -200,6 +230,7 @@ describe('behavior: Zone chain routing', () => {
   function app() {
     return TestApp.create({
       auth: { keys },
+      db: zoneDb,
       zones: [zoneOptions],
     })
   }
@@ -283,27 +314,32 @@ describe('behavior: Zone chain routing', () => {
         error: {
           code: -32602,
           data: { code: 'api_key_forbidden' },
-          message: expect.stringContaining(`zone:${zone}:write`),
+          message: expect.stringContaining('`zone:write` with a tag for Zone'),
         },
       })
-      // A write scope broadcasts but never reads.
+      // A write scope broadcasts but never reads, whether a stored per-Zone scope or generic plus a tag.
+      for (const apiKey of ['secret_zone_writer', 'secret_zone_tagged_writer']) {
+        expect(await request(api, { apiKey, body: read, mount, pathChainId: zone })).toMatchObject({
+          error: {
+            code: -32602,
+            data: { code: 'api_key_forbidden' },
+            message: expect.stringContaining(zoneScope),
+          },
+        })
+        expect(
+          await request(api, { apiKey, body: broadcast, mount, pathChainId: zone }),
+        ).not.toMatchObject({ error: { data: { code: 'api_key_forbidden' } } })
+      }
+      // The generic write scope without a tag for the Zone broadcasts nowhere.
       expect(
-        await request(api, { apiKey: 'secret_zone_writer', body: read, mount, pathChainId: zone }),
+        await request(api, { apiKey: 'secret_zone_untagged_writer', body: broadcast, mount, pathChainId: zone }), // prettier-ignore
       ).toMatchObject({
         error: {
           code: -32602,
           data: { code: 'api_key_forbidden' },
-          message: expect.stringContaining(zoneScope),
+          message: expect.stringContaining('`zone:write` with a tag for Zone'),
         },
       })
-      expect(
-        await request(api, {
-          apiKey: 'secret_zone_writer',
-          body: broadcast,
-          mount,
-          pathChainId: zone,
-        }),
-      ).not.toMatchObject({ error: { data: { code: 'api_key_forbidden' } } })
       // A Zone token admits both.
       for (const body of [read, broadcast])
         expect(
@@ -315,6 +351,7 @@ describe('behavior: Zone chain routing', () => {
   test('sponsors a Zone broadcast for a write-only key', async () => {
     const api = TestApp.create({
       auth: { keys },
+      db: zoneDb,
       relay: { feePayer: { account: Tempo.accounts[1]! } },
       zones: [zoneOptions],
     })
@@ -345,6 +382,7 @@ describe('behavior: Zone chain routing', () => {
     const entries: Log.Entry[] = []
     const api = TestApp.create({
       auth: { keys },
+      db: zoneDb,
       logger: (entry) => void entries.push(entry),
       zones: [zoneOptions],
     })
@@ -393,6 +431,7 @@ describe('behavior: Zone chain routing', () => {
   test('allows a Zone token on the default chain', async () => {
     const api = TestApp.create({
       auth: { keys },
+      db: zoneDb,
       defaultChainId: zone,
       zones: [zoneOptions],
     })
@@ -418,6 +457,7 @@ describe('behavior: Zone chain routing', () => {
       try {
         const api = TestApp.create({
           auth: { keys },
+          db: zoneDb,
           rpc: { auth: 'internal:secret', url: server.url },
           zones: [TestApp.zone({ chainId: zone, rpcUrl: server.url })],
         })
@@ -450,6 +490,7 @@ describe('behavior: Zone chain routing', () => {
         for (const selector of ['path', 'body', 'default'] as const) {
           const api = TestApp.create({
             auth: { keys },
+            db: zoneDb,
             ...(selector === 'default' ? { defaultChainId: zone } : {}),
             rpc: { publicZoneUrl: server.url, url: 'http://internal.zone.test' },
             zones: [TestApp.zone({ chainId: zone, rpcUrl: 'http://internal.zone.test' })],
@@ -501,6 +542,7 @@ describe('behavior: Zone chain routing', () => {
       try {
         const api = TestApp.create({
           auth: { keys },
+          db: zoneDb,
           rpc: { publicZoneUrl: server.url, url: 'http://internal.zone.test' },
           zones: [TestApp.zone({ chainId: zone, rpcUrl: 'http://internal.zone.test' })],
         })
@@ -576,6 +618,7 @@ describe('behavior: Zone chain routing', () => {
     try {
       const api = TestApp.create({
         auth: { keys },
+        db: zoneDb,
         rpc: {
           auth: 'internal:secret',
           publicZoneUrl: publicRpc.url,
@@ -633,6 +676,7 @@ describe('behavior: Zone chain routing', () => {
       try {
         const api = TestApp.create({
           auth: { keys },
+          db: zoneDb,
           rpc: ({ chainId }) => (chainId === zone ? { url: server.url } : {}),
           zones: [zoneOptions],
         })
@@ -690,6 +734,7 @@ describe('behavior: Zone chain routing', () => {
       try {
         const api = TestApp.create({
           auth: { keys },
+          db: zoneDb,
           ...(selector === 'default' ? { defaultChainId: zone } : {}),
           rpc: ({ chainId }) => (chainId === zone ? { url: server.url } : {}),
           zones: [zoneOptions],
@@ -734,16 +779,17 @@ describe('behavior: Zone chain routing', () => {
     },
   )
 
-  test('keeps multisig coordination on an explicit Zone path only when configured', async () => {
+  test('keeps configurable account coordination on an explicit Zone path only when configured', async () => {
     const body = {
       id: 1,
       jsonrpc: '2.0',
-      method: 'multisig_getOperation',
+      method: 'account_getOperation',
       params: [Hex.random(32)],
     }
     const configured = TestApp.create({
       auth: { keys },
-      relay: { multisig: { store: Store.memory() } },
+      db: zoneDb,
+      relay: { accounts: { store: Store.memory() } },
       zones: [zoneOptions],
     })
     expect(
@@ -788,6 +834,7 @@ describe('behavior: Zone chain routing', () => {
       try {
         const api = TestApp.create({
           auth: { keys },
+          db: zoneDb,
           rpc: { publicZoneUrl: publicRpc.url, url: internalRpc.url },
           zones: [TestApp.zone({ chainId: zone, rpcUrl: internalRpc.url })],
         })
@@ -820,6 +867,7 @@ describe('behavior: Zone chain routing', () => {
     try {
       const api = TestApp.create({
         auth: { keys },
+        db: zoneDb,
         rpc: ({ chainId }) => (chainId === zone ? { auth: 'rpc:secret', url: server.url } : {}),
         zones: [zoneOptions],
       })
@@ -857,6 +905,7 @@ describe('behavior: Zone chain routing', () => {
     try {
       const api = TestApp.create({
         auth: { keys },
+        db: zoneDb,
         rpc: { url: () => server.url },
         zones: [zoneOptions],
       })
@@ -904,6 +953,7 @@ describe('behavior: Zone chain routing', () => {
   test('rejects a Zone configured as the default chain', async () => {
     const api = TestApp.create({
       auth: { keys },
+      db: zoneDb,
       defaultChainId: zone,
       zones: [zoneOptions],
     })
@@ -918,6 +968,7 @@ describe('behavior: Zone chain routing', () => {
   test('rejects Zone selectors under a base path', async () => {
     const api = TestApp.create({
       auth: { keys },
+      db: zoneDb,
       path: '/api',
       zones: [zoneOptions],
     })
@@ -953,6 +1004,7 @@ describe('behavior: Zone chain routing', () => {
         })
         const api = TestApp.create({
           auth: { keys },
+          db: zoneDb,
           relay: { feePayer: { account: feePayerAccount } },
           rpc: { publicZoneUrl: server.url, url: 'http://internal.zone.test' },
           zones: [TestApp.zone({ chainId: zone, rpcUrl: 'http://internal.zone.test' })],
@@ -991,6 +1043,7 @@ describe('behavior: Zone chain routing', () => {
     const entries: Log.Entry[] = []
     const api = TestApp.create({
       auth: { keys },
+      db: zoneDb,
       logger: (entry) => void entries.push(entry),
       relay: { feePayer: { account: feePayerAccount } },
       zones: [zoneOptions],
@@ -3696,9 +3749,9 @@ describe('behavior: Zone workload identity', () => {
     expect(resolved).not.toContain(zone)
   })
 
-  test('enforces the chain selected by multisig coordination', async () => {
+  test('enforces the chain selected by configurable account coordination', async () => {
     const { app, entries, resolved } = await Oidc.setup({
-      relay: { multisig: { store: Store.memory() } },
+      relay: { accounts: { store: Store.memory() } },
     })
     const transaction = await Tempo.accounts[0]!.signTransaction({
       calls: [{ to: Tempo.accounts[2]!.address, value: 0n }],
@@ -3785,7 +3838,7 @@ describe('behavior: Zone workload identity', () => {
   )
 
   const storedRequests = [
-    ['multisig_approveKeyAuthorization', 'keyAuthorization', 'success'],
+    ['account_approveKeyAuthorization', 'keyAuthorization', 'success'],
     ['eth_getTransactionByHash', 'transaction', 'submitting'],
     ['eth_getTransactionReceipt', 'transaction', 'submitting'],
   ] as const
@@ -3793,10 +3846,10 @@ describe('behavior: Zone workload identity', () => {
   test.each(storedRequests)('authorizes stored results from %s', async (method, type, status) => {
     const { hash, operation, store } = await Oidc.operation({ status, type })
     const { app, credential, entries, resolved } = await Oidc.setup({
-      relay: { multisig: { store } },
+      relay: { accounts: { store } },
     })
     const params =
-      method === 'multisig_approveKeyAuthorization' ? [{ hash, signature: 'invalid' }] : [hash]
+      method === 'account_approveKeyAuthorization' ? [{ hash, signature: 'invalid' }] : [hash]
     for (const [authorization, code, reason] of [
       [undefined, 'unauthorized', 'missing'],
       ['invalid', 'unauthorized', 'invalid'],
@@ -3809,7 +3862,7 @@ describe('behavior: Zone workload identity', () => {
         headers: {
           ...(authorization ? { authorization: `Bearer ${authorization}` } : {}),
           'content-type': 'application/json',
-          'tempo-api-key': method.startsWith('multisig_approve')
+          'tempo-api-key': method.startsWith('account_approve')
             ? 'secret_oidc_zone_writer'
             : 'secret_oidc_zone',
         },
@@ -3820,7 +3873,7 @@ describe('behavior: Zone workload identity', () => {
       expect(body).not.toHaveProperty('result')
       expect(entries.at(-1)?.vercelOidc).toMatchObject([{ chainId: zone, reason }])
       expect(resolved).toEqual([])
-      expect(await store.get(`multisig:v2:multisig:operation:${hash}`)).toBe(
+      expect(await store.get(`accounts:v1:configurableAccount:operation:${hash}`)).toBe(
         Json.stringify(operation),
       )
     }
@@ -3831,7 +3884,7 @@ describe('behavior: Zone workload identity', () => {
         headers: {
           authorization: `Bearer ${await credential()}`,
           'content-type': 'application/json',
-          'tempo-api-key': method.startsWith('multisig_approve')
+          'tempo-api-key': method.startsWith('account_approve')
             ? 'secret_oidc_zone_writer'
             : 'secret_oidc_zone',
         },
@@ -3841,7 +3894,7 @@ describe('behavior: Zone workload identity', () => {
       expect(body).not.toHaveProperty('error')
       if (method === 'eth_getTransactionReceipt') expect(body.result).toBeNull()
       else if (method === 'eth_getTransactionByHash')
-        expect(body.result).toMatchObject({ hash, multisig: { hash, status } })
+        expect(body.result).toMatchObject({ hash, operation: { hash, status } })
       else expect(body.result).toMatchObject({ hash, status, type })
       expect(entries.at(-1)?.vercelOidc).toMatchObject([{ chainId: zone, outcome: 'authorized' }])
     }
@@ -3849,9 +3902,9 @@ describe('behavior: Zone workload identity', () => {
 
   test.each(storedRequests)('enforces stored chain access on %s', async (method, type, status) => {
     const { hash, store } = await Oidc.operation({ status, type })
-    const { app, credential, resolved } = await Oidc.setup({ relay: { multisig: { store } } })
+    const { app, credential, resolved } = await Oidc.setup({ relay: { accounts: { store } } })
     const params =
-      method === 'multisig_approveKeyAuthorization' ? [{ hash, signature: 'invalid' }] : [hash]
+      method === 'account_approveKeyAuthorization' ? [{ hash, signature: 'invalid' }] : [hash]
     for (const [path, apiKey, error] of [
       [
         `/rpc/relay/${runtime.chainId}`,
@@ -3875,21 +3928,21 @@ describe('behavior: Zone workload identity', () => {
   })
 
   test.each(['transaction', 'keyAuthorization'] as const)(
-    'denies pending multisig %s approvals before writes',
+    'denies pending configurable account %s approvals before writes',
     async (type) => {
       const { hash, operation, store } = await Oidc.operation({ type })
-      const { app, entries, resolved } = await Oidc.setup({ relay: { multisig: { store } } })
+      const { app, entries, resolved } = await Oidc.setup({ relay: { accounts: { store } } })
       const requests = (() => {
         if (operation.type === 'transaction')
           return [
             [
-              MultisigOperation.serializeTransaction(operation, {
+              AccountOperation.serializeTransaction(operation, {
                 approvals: operation.approvals,
               }),
             ],
           ]
         const authorization = KeyAuthorization.deserialize(
-          MultisigOperation.serializeKeyAuthorization(operation.keyAuthorization, {
+          AccountOperation.serializeKeyAuthorization(operation.keyAuthorization, {
             account: operation.account,
             approvals: operation.approvals,
             config: operation.config,
@@ -3915,8 +3968,8 @@ describe('behavior: Zone workload identity', () => {
             jsonrpc: '2.0',
             method:
               type === 'transaction'
-                ? 'multisig_approveRawTransaction'
-                : 'multisig_approveKeyAuthorization',
+                ? 'account_approveRawTransaction'
+                : 'account_approveKeyAuthorization',
             params,
           }),
           headers: {
@@ -3928,7 +3981,7 @@ describe('behavior: Zone workload identity', () => {
         expect(await response.json()).toMatchObject({ error: { data: { code: 'unauthorized' } } })
         expect(entries.at(-1)?.vercelOidc).toMatchObject([{ chainId: zone, reason: 'missing' }])
         expect(resolved).toEqual([])
-        expect(await store.get(`multisig:v2:multisig:operation:${hash}`)).toBe(
+        expect(await store.get(`accounts:v1:configurableAccount:operation:${hash}`)).toBe(
           Json.stringify(operation),
         )
       }
@@ -3936,11 +3989,11 @@ describe('behavior: Zone workload identity', () => {
   )
 
   test.each(['transaction', 'keyAuthorization'] as const)(
-    'enforces workload identity on stored multisig %s operations',
+    'enforces workload identity on stored configurable account %s operations',
     async (type) => {
       const { hash, store } = await Oidc.operation({ type })
       const { app, credential, entries, resolved } = await Oidc.setup({
-        relay: { multisig: { store } },
+        relay: { accounts: { store } },
       })
       for (const apiKey of ['secret_oidc_zone', 'secret_oidc_wildcard']) {
         for (const [authorization, reason, code] of [
@@ -3954,7 +4007,7 @@ describe('behavior: Zone workload identity', () => {
             body: JSON.stringify({
               id: 1,
               jsonrpc: '2.0',
-              method: 'multisig_getOperation',
+              method: 'account_getOperation',
               params: [hash],
             }),
             headers: {
@@ -3979,18 +4032,18 @@ describe('behavior: Zone workload identity', () => {
   )
 
   test.each(['transaction', 'keyAuthorization'] as const)(
-    'returns authorized stored multisig %s operations',
+    'returns authorized stored configurable account %s operations',
     async (type) => {
       const { hash, operation, store } = await Oidc.operation({ type })
       const { app, credential, entries } = await Oidc.setup({
-        relay: { multisig: { store } },
+        relay: { accounts: { store } },
       })
       for (const path of ['/rpc/relay', `/rpc/relay/${zone}`]) {
         const response = await app.request(path, {
           body: JSON.stringify({
             id: 1,
             jsonrpc: '2.0',
-            method: 'multisig_getOperation',
+            method: 'account_getOperation',
             params: [hash],
           }),
           headers: {
@@ -4011,15 +4064,15 @@ describe('behavior: Zone workload identity', () => {
   )
 
   test.each(['transaction', 'keyAuthorization'] as const)(
-    'rejects conflicting chains on stored multisig %s operations',
+    'rejects conflicting chains on stored configurable account %s operations',
     async (type) => {
       const { hash, store } = await Oidc.operation({ type })
-      const { app, credential, resolved } = await Oidc.setup({ relay: { multisig: { store } } })
+      const { app, credential, resolved } = await Oidc.setup({ relay: { accounts: { store } } })
       const response = await app.request(`/rpc/relay/${runtime.chainId}`, {
         body: JSON.stringify({
           id: 1,
           jsonrpc: '2.0',
-          method: 'multisig_getOperation',
+          method: 'account_getOperation',
           params: [hash],
         }),
         headers: {
@@ -4037,15 +4090,15 @@ describe('behavior: Zone workload identity', () => {
   )
 
   test.each(['transaction', 'keyAuthorization'] as const)(
-    'requires Zone scope on stored multisig %s operations',
+    'requires Zone scope on stored configurable account %s operations',
     async (type) => {
       const { hash, store } = await Oidc.operation({ type })
-      const { app, credential, resolved } = await Oidc.setup({ relay: { multisig: { store } } })
+      const { app, credential, resolved } = await Oidc.setup({ relay: { accounts: { store } } })
       const response = await app.request('/rpc/relay', {
         body: JSON.stringify({
           id: 1,
           jsonrpc: '2.0',
-          method: 'multisig_getOperation',
+          method: 'account_getOperation',
           params: [hash],
         }),
         headers: {
@@ -4131,6 +4184,7 @@ describe.skipIf(runtime.mode !== 'localnet')('behavior: Zone withdrawal fees', (
     await TestApp.verifiedSeed(db, zone)
     // A cap the gas alone fits under, which the outbox fee would exceed.
     await BillingSettings.upsert(db, { orgId: 'org_2', txFeeLimit: '0.50' })
+    await TestApp.delegateZone(db, { chainIds: [zone], orgId: 'org_2' })
     const app = TestApp.create({
       auth: { keys },
       db,
@@ -4427,8 +4481,9 @@ namespace Oidc {
       environment: 'production',
       id: 'key_oidc_zone',
       orgId: 'org_oidc',
-      scopes: ['rpc-relay:read', 'rpc-relay:sponsor', `zone:${zone}:read`],
+      scopes: ['rpc-relay:read', 'rpc-relay:sponsor', zoneScope],
       token: 'secret_oidc_zone',
+      zoneTags: [zone],
     },
     {
       environment: 'production',
@@ -4441,8 +4496,10 @@ namespace Oidc {
       environment: 'production',
       id: 'key_oidc_wildcard',
       orgId: 'org_oidc',
-      scopes: ['*'],
+      // The wildcard grants no Zone; the key carries the explicit Zone grants beside it.
+      scopes: ['*', zoneScope, `zone:${zone}:write`, `zone:${zone + 1}:write`],
       token: 'secret_oidc_wildcard',
+      zoneTags: [zone, zone + 1],
     },
     {
       environment: 'production',
@@ -4455,8 +4512,9 @@ namespace Oidc {
       environment: 'production',
       id: 'key_oidc_other_org',
       orgId: 'org_other',
-      scopes: ['rpc-relay:read', 'rpc-relay:sponsor', `zone:${zone}:read`],
+      scopes: ['rpc-relay:read', 'rpc-relay:sponsor', zoneScope],
       token: 'secret_oidc_other_org',
+      zoneTags: [zone],
     },
   ] as const satisfies readonly TestApp.kvStore.Key[]
 
@@ -4465,7 +4523,7 @@ namespace Oidc {
     status?: 'pending' | 'submitting' | 'success' | undefined
     type: 'transaction' | 'keyAuthorization'
   }) {
-    const account = TempoAccount.fromMultisig({
+    const account = TempoAccount.fromConfig({
       owners: [Tempo.accounts[0]!.address, Tempo.accounts[1]!.address],
       salt: Hex.random(32),
       threshold: 2,
@@ -4500,7 +4558,7 @@ namespace Oidc {
             ),
             type: 'keyAuthorization' as const,
           }
-    const hash = MultisigOperation.getHash(payload)
+    const hash = AccountOperation.getHash(payload)
     const approvals = await Promise.all(
       Tempo.accounts
         .slice(0, options.status && options.status !== 'pending' ? 2 : 1)
@@ -4519,7 +4577,7 @@ namespace Oidc {
     }
     const operation = (() => {
       if (payload.type === 'transaction')
-        return MultisigOperation.from({
+        return AccountOperation.from({
           ...payload,
           ...properties,
           ...(options.status === 'submitting'
@@ -4527,12 +4585,12 @@ namespace Oidc {
             : {}),
           status: options.status === 'submitting' ? 'submitting' : 'pending',
         })
-      return MultisigOperation.from({
+      return AccountOperation.from({
         ...payload,
         ...properties,
         keyAuthorization:
           options.status === 'success'
-            ? MultisigOperation.serializeKeyAuthorization(payload.keyAuthorization, {
+            ? AccountOperation.serializeKeyAuthorization(payload.keyAuthorization, {
                 account: account.address,
                 approvals,
                 config: account.config!,
@@ -4542,7 +4600,7 @@ namespace Oidc {
       })
     })()
     const store = Store.memory()
-    await store.put(`multisig:v2:multisig:operation:${hash}`, Json.stringify(operation))
+    await store.put(`accounts:v1:configurableAccount:operation:${hash}`, Json.stringify(operation))
     return { hash, operation, store }
   }
 
@@ -4557,6 +4615,7 @@ namespace Oidc {
     return {
       app: TestApp.create({
         auth: { keys },
+        db: zoneDb,
         logger: (entry) => void entries.push(entry),
         rpc: ({ chainId, zone }) => {
           resolved.push(chainId)