tapimo 0.19.0 → 0.20.0

package/src/apps/relay/App.ts

@@ -26,7 +26,7 @@ import * as Viem from '../../internal/Viem.js'
 import * as ZoneAccess from '../../internal/ZoneAccess.js'
 import * as ZoneRpc from '../../internal/ZoneRpc.js'
 import * as Utils from '../../handlers/internal/utils.js'
-import * as Multisig from '../../handlers/internal/multisig.js'
+import * as Accounts from '../../handlers/internal/accounts.js'
 import * as Sponsorship from '../../handlers/internal/sponsorship.js'
 import * as Scope from '../../Scope.js'
 
@@ -43,7 +43,7 @@ import * as Scope from '../../Scope.js'
  */
 /** Methods that broadcast or approve a Zone transaction, requiring the write scope. */
 function isZoneWriteMethod(method: string): boolean {
-  return ZoneRpc.writeMethods.has(method) || method.startsWith('multisig_approve')
+  return ZoneRpc.writeMethods.has(method) || method.startsWith('account_approve')
 }
 
 export function relay(options: relay.Options = {}) {
@@ -81,6 +81,8 @@ export function relay(options: relay.Options = {}) {
 export declare namespace relay {
   /** Options for the relay route group. */
   type Options = {
+    /** Configurable account coordination backed by authoritative atomic storage. */
+    accounts?: Handler.relay.Options['accounts'] | undefined
     feePayer?:
       | (Pick<
           NonNullable<Handler.relay.Options['feePayer']>,
@@ -97,8 +99,6 @@ export declare namespace relay {
           txFeeLimit?: string | undefined
         })
       | undefined
-    /** Native multisig coordination backed by authoritative atomic storage. */
-    multisig?: Handler.relay.Options['multisig'] | undefined
   }
 }
 
@@ -491,7 +491,15 @@ function middleware(options: middleware.Options) {
     })()
     const chainId_query = query?.success ? query.data : undefined
     const chainId_selected = chainId_path ?? chainId_query
+    // Batch items run concurrently, but their Zone decisions settle in item order, so an
+    // admitted item after a denial is what stays recorded whatever their reads take.
+    let decisions: Promise<unknown> = Promise.resolve()
     const authorizeChainId = (chainId: number | undefined, method?: string) => {
+      const next = decisions.then(() => decideChainId(chainId, method))
+      decisions = next.catch(() => undefined)
+      return next
+    }
+    const decideChainId = async (chainId: number | undefined, method?: string) => {
       // A malformed selector must not silently fall back to the default chain.
       if (query && !query.success)
         throw new RpcResponse.InvalidParamsError({ message: 'Invalid chain id.' })
@@ -521,7 +529,7 @@ function middleware(options: middleware.Options) {
         // A refused mainnet Zone still records the attempt against that Zone,
         // unless another batch item already recorded its decision.
         if (c.get('zones').has(resolved) && c.get('zoneAccess') === undefined) {
-          ZoneAccess.authorize(c, {
+          await ZoneAccess.authorize(c, {
             chainId: resolved,
             verb: 'read',
             zoneToken: zoneToken !== undefined,
@@ -540,7 +548,7 @@ function middleware(options: middleware.Options) {
         })
       }
       if (c.get('zones').has(resolved)) {
-        // Broadcasts and multisig approvals need the write scope, other methods
+        // Broadcasts and configurable account approvals need the write scope, other methods
         // the read scope; a Zone token admits both. Decided on the executing chain.
         const options_access = {
           chainId: resolved,
@@ -548,21 +556,23 @@ function middleware(options: middleware.Options) {
           verb: method !== undefined && isZoneWriteMethod(method) ? 'write' : 'read',
           zoneToken: zoneToken !== undefined,
         } as const
-        const result = ZoneAccess.check(c, options_access)
         // A request keeps one decision: the first, or an admitted item after a denial.
         const recorded = c.get('zoneAccess')
-        if (recorded === undefined || (result.allowed && recorded.grant === undefined))
-          ZoneAccess.authorize(c, options_access)
+        const result =
+          recorded === undefined || recorded.grant === undefined
+            ? await ZoneAccess.authorize(c, options_access)
+            : ZoneAccess.check(c, options_access)
         if (result.allowed) return resolved
-        const { message } = result.error
+        const { code, message } = result.error
         if (sponsorshipRequired)
           rejectSponsorship({
             chainId: resolved,
             message,
-            reason: 'api_key_forbidden',
+            // An unreadable delegation keeps its retriable code instead of reading as a missing grant.
+            reason: code,
           })
         throw new RpcResponse.InvalidParamsError({
-          data: { code: 'api_key_forbidden' },
+          data: { code },
           message,
         })
       }
@@ -574,9 +584,9 @@ function middleware(options: middleware.Options) {
       chainId: number | undefined,
       options: Handler.relay.GetClientOptions = {},
     ) => {
-      const resolved = authorizeChainId(chainId, options.method) as Viem.ChainId
+      const resolved = (await authorizeChainId(chainId, options.method)) as Viem.ChainId
       const zone = c.get('zones').get(resolved)
-      // Verify the resolved client chain, including raw envelopes and stored multisig operations, before any upstream access.
+      // Verify the resolved client chain, including raw envelopes and stored configurable account operations, before any upstream access.
       if (zone?.sourceId !== undefined && Viem.isMainnet(zone.sourceId)) {
         const policy = c.get('vercelOidc')
         if (policy?.applies(principal)) {
@@ -617,7 +627,7 @@ function middleware(options: middleware.Options) {
       cache: c.get('store'),
       ...(options.features ? { features: options.features } : {}),
       getClient,
-      ...(options.multisig ? { multisig: options.multisig } : {}),
+      ...(options.accounts ? { accounts: options.accounts } : {}),
       onRequest: async (request) => {
         const method = sponsorshipMethod(request.method)
         const params = 'params' in request && Array.isArray(request.params) ? request.params : []
@@ -645,19 +655,19 @@ function middleware(options: middleware.Options) {
           })()
         // Zone-scoped keys without a token reach the operator RPC, so the
         // allowlist applies regardless of token; account-scoped reads need one.
-        // Multisig coordination stays local and authorizes its stored chain via `getClient`.
+        // Configurable account coordination stays local and authorizes its stored chain via `getClient`.
         if (
           c.get('zones').has(chainId) &&
           !ZoneRpc.readMethods.has(request.method) &&
           !ZoneRpc.writeMethods.has(request.method) &&
           !(zoneToken && ZoneRpc.tokenMethods.has(request.method)) &&
-          !(options.multisig && Multisig.methods.has(request.method)) &&
+          !(options.accounts && Accounts.methods.has(request.method)) &&
           !rawSponsorship
         ) {
           // The method refusal precedes the chain gate, so record the denied Zone
           // attempt unless an admitted batch item already recorded its decision.
           if (c.get('zoneAccess') === undefined) {
-            ZoneAccess.authorize(c, { chainId, verb: 'read', zoneToken: zoneToken !== undefined })
+            await ZoneAccess.authorize(c, { chainId, verb: 'read', zoneToken: zoneToken !== undefined }) // prettier-ignore
             ZoneAccess.deny(c)
           }
           throw new RpcResponse.MethodNotSupportedError({

package/src/apps/relay/App.zone-billing.test.ts

@@ -128,7 +128,7 @@ describe('Zone sponsorship billing', () => {
   test('counts Zone spend against the shared attribution promotion', async () => {
     const { app, db } = await setup()
     await StripeCustomers.setStatus(db, 'org_zone', 'active')
-    await Organizations.create(db, { id: 'org_zone', name: 'Zone' })
+    // The organization row exists: the delegation fixture created it.
     await Organizations.setSponsorshipSubsidy(db, 'org_zone', {
       attributionSpendLimit: '0.75',
       durationDays: 90,
@@ -209,6 +209,8 @@ async function setup(options: setup.Options = {}) {
   )
   for (const id of chainIds) await VerifiedTokens.replace(db, id, [token])
   await StripeCustomers.create(db, { orgId: 'org_zone', stripeCustomerId: 'cus_zone' })
+  await TestApp.delegateZone(db, { chainIds, orgId: 'org_zone' })
+  await TestApp.delegateZone(db, { chainIds, environment: 'sandbox', orgId: 'org_zone' })
   const app = TestApp.create({
     auth: {
       keys: [
@@ -216,22 +218,25 @@ async function setup(options: setup.Options = {}) {
           environment: 'production',
           id: 'key_production',
           orgId: 'org_zone',
-          scopes: ['rpc-relay:sponsor', ...chainIds.map((id) => `zone:${id}:read` as const)],
+          scopes: ['rpc-relay:sponsor', 'zone:read'],
           token: 'production',
+          zoneTags: chainIds,
         },
         {
           environment: 'sandbox',
           id: 'key_sandbox',
           orgId: 'org_zone',
-          scopes: ['rpc-relay:sponsor', `zone:${chainId}:read`],
+          scopes: ['rpc-relay:sponsor', 'zone:read'],
           token: 'sandbox',
+          zoneTags: [chainId],
         },
         {
           environment: 'sandbox',
           id: 'key_sandbox_wildcard',
           orgId: 'org_zone',
-          scopes: ['*'],
+          scopes: ['*', 'zone:read', 'zone:write'],
           token: 'sandbox_wildcard',
+          zoneTags: chainIds,
         },
       ],
     },

package/src/apps/routes/App.test.ts

@@ -43,13 +43,12 @@ describe('routes access', () => {
 
   test('rejects sandbox keys on a mainnet-backed default Zone', async () => {
     const chainId = 421_700_001
-    const key = {
-      ...sandbox,
-      scopes: [...sandbox.scopes, `zone:${chainId}:read`],
-    } satisfies TestApp.kvStore.Key
+    const key = TestApp.zoneReader(sandbox, [chainId])
+    const db = TestApp.database()
+    await TestApp.delegateZone(db, { chainIds: [chainId], environment: 'sandbox', orgId: key.orgId }) // prettier-ignore
     const app = App.create({
       auth: {},
-      db: TestApp.database(),
+      db,
       defaultChainId: chainId,
       kv: { store: TestApp.kvStore({ keys: [key] }) },
       zones: [
@@ -121,18 +120,18 @@ describe('routes access', () => {
     },
   )
 
-  test('requires a matching Zone scope and bypasses the edge cache', async () => {
+  test('requires a delegated Zone tag and bypasses the edge cache', async () => {
     const chainId = 421_700_001
-    const reader = {
-      id: 'key_zone_routes',
-      orgId: 'org_test',
-      scopes: ['data:read', `zone:${chainId}:read`],
-      token: 'secret_zone_routes',
-    } satisfies TestApp.kvStore.Key
+    const reader = TestApp.zoneReader(
+      { id: 'key_zone_routes', orgId: 'org_test', scopes: ['data:read'], token: 'secret_zone_routes' }, // prettier-ignore
+      [chainId],
+    )
+    const db = TestApp.database()
+    await TestApp.delegateZone(db, { chainIds: [chainId] })
     const app = App.create({
       auth: {},
       cache: { store: Store.memory() },
-      db: TestApp.database(),
+      db,
       defaultChainId: chainId,
       kv: { store: TestApp.kvStore({ keys: [reader] }) },
       zones: [TestApp.zone({ chainId, rpcUrl: `https://${chainId}.rpc.test` })],
@@ -146,18 +145,18 @@ describe('routes access', () => {
     expect(anonymous.status).toBe(403)
   })
 
-  test('a Zone read scope reads but never writes routes', async () => {
+  test('a Zone read grant reads but never writes routes', async () => {
     const chainId = 421_700_001
-    const reader = {
-      id: 'key_zone_reader',
-      orgId: 'org_test',
-      scopes: ['data:read', 'routes:write', `zone:${chainId}:read`],
-      token: 'secret_zone_reader',
-    } satisfies TestApp.kvStore.Key
+    const reader = TestApp.zoneReader(
+      { id: 'key_zone_reader', orgId: 'org_test', scopes: ['data:read', 'routes:write'], token: 'secret_zone_reader' }, // prettier-ignore
+      [chainId],
+    )
+    const db = TestApp.database()
+    await TestApp.delegateZone(db, { chainIds: [chainId] })
     const app = App.create({
       auth: {},
       cache: { store: Store.memory() },
-      db: TestApp.database(),
+      db,
       defaultChainId: chainId,
       kv: { store: TestApp.kvStore({ keys: [reader] }) },
       zones: [TestApp.zone({ chainId, rpcUrl: `https://${chainId}.rpc.test` })],
@@ -171,7 +170,7 @@ describe('routes access', () => {
     expect(await write.json()).toMatchObject({
       error: {
         code: 'api_key_forbidden',
-        message: `Broadcasting to zone ${chainId} requires \`zone:${chainId}:write\`.`,
+        message: `Broadcasting to zone ${chainId} requires \`zone:write\` with a tag for Zone ${chainId}, issued to an organization delegated that Zone.`,
       },
     })
   })

package/src/db/Db.ts

@@ -73,8 +73,8 @@ import type * as WebhookDeliveries from './tables/webhookDeliveries.js'
 import type * as WebhookQueueCompletions from './tables/webhookQueueCompletions.js'
 import type * as WebhookQueueEvents from './tables/webhookQueueEvents.js'
 import type * as WebhookSubscriptions from './tables/webhookSubscriptions.js'
+import type * as ZoneDelegationRequests from './tables/zoneDelegationRequests.js'
 import type * as ZoneDelegations from './tables/zoneDelegations.js'
-import type * as ZoneKeyRequests from './tables/zoneKeyRequests.js'
 
 /**
  * Kysely schema with camelCase columns. {@link CamelCasePlugin} maps table
@@ -155,10 +155,10 @@ export type Database = {
   webhook_queue_completions: WebhookQueueCompletions.Table
   webhook_queue_events: WebhookQueueEvents.Table
   webhook_subscriptions: WebhookSubscriptions.Table
+  zone_delegation_approvals: ZoneDelegationRequests.ApprovalTable
   zone_delegation_members: ZoneDelegations.MemberTable
+  zone_delegation_requests: ZoneDelegationRequests.Table
   zone_delegations: ZoneDelegations.Table
-  zone_key_approvals: ZoneKeyRequests.ApprovalTable
-  zone_key_requests: ZoneKeyRequests.Table
 }
 
 /**
@@ -3928,6 +3928,37 @@ export const migrations: readonly Migration[] = [
     // Accounts and tokens a delegation covers; a removed member keeps its row so re-adding is an update.
     up: (db) => raw(db, sql`CREATE TABLE IF NOT EXISTS zone_delegation_members (delegation_id text NOT NULL REFERENCES zone_delegations(id) ON DELETE CASCADE, kind text NOT NULL CHECK (kind IN ('account', 'token')), address text NOT NULL, added_at text NOT NULL, removed_at text, PRIMARY KEY (delegation_id, kind, address))`), // prettier-ignore
   },
+  {
+    name: '0365_zone_delegation_requests',
+    up: (db) =>
+      db.schema
+        .createTable('zone_delegation_requests')
+        .ifNotExists()
+        .addColumn('id', 'text', (c) => c.primaryKey())
+        .addColumn('createdAt', 'text', (c) => c.notNull())
+        .addColumn('delegationId', 'text')
+        .addColumn('expiresAt', 'text', (c) => c.notNull())
+        .addColumn('groupId', 'text', (c) => c.notNull())
+        .addColumn('input', 'jsonb', (c) => c.notNull())
+        .addColumn('requesterEmail', 'text', (c) => c.notNull())
+        .addColumn('requesterId', 'text', (c) => c.notNull())
+        .addColumn('status', 'text', (c) => c.notNull()),
+  },
+  {
+    name: '0366_zone_delegation_approvals',
+    up: (db) =>
+      db.schema
+        .createTable('zone_delegation_approvals')
+        .ifNotExists()
+        .addColumn('requestId', 'text', (c) =>
+          c.notNull().references('zone_delegation_requests.id'),
+        )
+        .addColumn('approverId', 'text', (c) => c.notNull())
+        .addColumn('approverEmail', 'text', (c) => c.notNull())
+        .addColumn('approvedAt', 'text', (c) => c.notNull())
+        .addColumn('expiresAt', 'text', (c) => c.notNull())
+        .addPrimaryKeyConstraint('zone_delegation_approvals_pkey', ['requestId', 'approverId']),
+  },
 ]
 
 /**

package/src/db/Schema.ts

@@ -16,49 +16,49 @@ import type * as internal_Schema from '../internal/Schema.js'
 import type * as Sentinel from '../internal/Sentinel.js'
 import type * as Webhooks from '../internal/Webhooks.js'
 import type * as internal_ZoneDelegation from '../internal/ZoneDelegation.js'
+import type * as ZoneDelegationRequests from './tables/zoneDelegationRequests.js'
 import type * as Scope from '../Scope.js'
-import type * as ApiKeys from '../ApiKeys.js'
 
-/** Immutable Zone key issuance request and its terminal outcome. */
-export const ZoneKeyRequest = z.object({
+/** Columns of the `zone_delegations` table. */
+export const ZoneDelegation = z.object({
+  accountsAll: z.boolean(),
+  chainId: z.number().check(z.int()),
+  createdAt: z.string(),
+  environment: z.enum(['production', 'sandbox']),
+  id: z.string(),
+  orgId: z.string(),
+  projects: z.custom<internal_ZoneDelegation.Selection>(),
+  revokedAt: z.nullable(z.string()),
+  tokensAll: z.boolean(),
+  updatedAt: z.string(),
+})
+export type ZoneDelegation = z.output<typeof ZoneDelegation>
+
+/** Immutable Zone delegation request and its terminal outcome. */
+export const ZoneDelegationRequest = z.object({
   createdAt: z.string(),
+  delegationId: z.nullable(z.string()),
   expiresAt: z.string(),
   groupId: z.string(),
   id: z.string(),
-  input: z.custom<ApiKeys.MintInput & { orgId: string }>(),
-  keyId: z.nullable(z.string()),
+  input: z.custom<ZoneDelegationRequests.Input>(),
   requesterEmail: z.string(),
   requesterId: z.string(),
-  status: z.enum(['pending', 'issuing', 'issued', 'failed', 'cancelled']),
+  status: z.enum(['pending', 'applying', 'applied', 'failed', 'cancelled']),
 })
-/** Columns of the Zone key request table. */
-export type ZoneKeyRequest = z.output<typeof ZoneKeyRequest>
+/** Columns of the `zone_delegation_requests` table. */
+export type ZoneDelegationRequest = z.output<typeof ZoneDelegationRequest>
 
 /** One approver's immutable, timestamped decision. */
-export const ZoneKeyApproval = z.object({
+export const ZoneDelegationApproval = z.object({
   approvedAt: z.string(),
   approverEmail: z.string(),
   approverId: z.string(),
   expiresAt: z.string(),
   requestId: z.string(),
 })
-/** Columns of the Zone key approval table. */
-export type ZoneKeyApproval = z.output<typeof ZoneKeyApproval>
-
-/** Columns of the `zone_delegations` table. */
-export const ZoneDelegation = z.object({
-  accountsAll: z.boolean(),
-  chainId: z.number().check(z.int()),
-  createdAt: z.string(),
-  environment: z.enum(['production', 'sandbox']),
-  id: z.string(),
-  orgId: z.string(),
-  projects: z.custom<internal_ZoneDelegation.Selection>(),
-  revokedAt: z.nullable(z.string()),
-  tokensAll: z.boolean(),
-  updatedAt: z.string(),
-})
-export type ZoneDelegation = z.output<typeof ZoneDelegation>
+/** Columns of the `zone_delegation_approvals` table. */
+export type ZoneDelegationApproval = z.output<typeof ZoneDelegationApproval>
 
 /** Columns of the `zone_delegation_members` table. */
 export const ZoneDelegationMember = z.object({

package/src/db/tables/rewardRuns.ts

@@ -578,6 +578,45 @@ export declare namespace listDeliveredSince {
   }
 }
 
+/**
+ * Lists runs that paid a treasury in one digest window, oldest first, so each payout reports exactly once.
+ *
+ * A run carrying `deliveredAt` counts when delivered in `[since, until)` shifted back by the settling
+ * margin. A run delivered before `deliveredAt` was recorded keeps the closing-boundary window its
+ * earlier digests used.
+ */
+export async function listTreasuryPayoutsDelivered(
+  db: Db.Db,
+  options: listTreasuryPayoutsDelivered.Options,
+): Promise<Pick<Record, 'evidence' | 'vaultAddress'>[]> {
+  const deliveredAt = sql<number>`(evidence ->> 'deliveredAt')::bigint`
+  return (await db.kysely
+    .selectFrom('reward_runs')
+    .select(['evidence', 'vaultAddress'])
+    .where('chainId', '=', String(options.chainId))
+    .where('phase', '=', 'delivered')
+    .where(sql<boolean>`evidence ->> 'treasuryPayoutTransactionHash' is not null`)
+    .where(
+      sql<boolean>`((${deliveredAt} >= ${options.since - options.settlingSeconds} AND ${deliveredAt} < ${options.until - options.settlingSeconds}) OR (evidence ->> 'deliveredAt' IS NULL AND ends_at::bigint >= ${options.since} AND ends_at::bigint < ${options.until}))`,
+    )
+    .orderBy(sql`coalesce(${deliveredAt}, ends_at::bigint)`, 'asc')
+    .execute()) as Pick<Record, 'evidence' | 'vaultAddress'>[]
+}
+
+export declare namespace listTreasuryPayoutsDelivered {
+  /** Digest window selector. */
+  type Options = {
+    /** Chain containing the campaigns. */
+    chainId: number
+    /** Seconds the delivery window trails the digest window, covering deliveries still committing. */
+    settlingSeconds: number
+    /** Inclusive Unix start of the digest window. */
+    since: number
+    /** Exclusive Unix end of the digest window. */
+    until: number
+  }
+}
+
 /** Reads each vault's latest delivered run closing at or before a boundary. */
 export async function listLatestDeliveredBefore(
   db: Db.Db,

package/src/db/tables/routesAccessRequests.test.ts

@@ -0,0 +1,65 @@
+import * as TestApp from '../../../test/App.js'
+import * as RoutesAccessRequests from './routesAccessRequests.js'
+
+describe('hasRecent', () => {
+  test('counts other requests from the same organization inside the window', async () => {
+    const db = TestApp.database()
+    const orgId = 'org_1a2b3c4d5e6f7g8h9j0k1m2n'
+    vi.useFakeTimers({ toFake: ['Date'] })
+    try {
+      vi.setSystemTime(new Date('2026-10-22T12:00:00Z'))
+      await request(db, { orgId, projectId: 'prj_1a2b3c4d5e6f7g8h9j0k1m2n' })
+      vi.setSystemTime(new Date('2026-10-22T12:05:00Z'))
+      const second = await request(db, { orgId, projectId: 'prj_2b3c4d5e6f7g8h9j0k1m2n3p' })
+      const otherOrgId = 'org_9z8y7x6w5v4u3t2s1r0q9p8n'
+      const other = await request(db, {
+        orgId: otherOrgId,
+        projectId: 'prj_3c4d5e6f7g8h9j0k1m2n3p4q',
+      })
+
+      expect({
+        afterWindow: await RoutesAccessRequests.hasRecent(db, {
+          excludeId: second.id,
+          orgId,
+          since: '2026-10-22T12:01:00.000Z',
+        }),
+        insideWindow: await RoutesAccessRequests.hasRecent(db, {
+          excludeId: second.id,
+          orgId,
+          since: '2026-10-22T11:55:00.000Z',
+        }),
+        otherOrganization: await RoutesAccessRequests.hasRecent(db, {
+          excludeId: other.id,
+          orgId: otherOrgId,
+          since: '2026-10-22T11:50:00.000Z',
+        }),
+      }).toMatchInlineSnapshot(`
+        {
+          "afterWindow": false,
+          "insideWindow": true,
+          "otherOrganization": false,
+        }
+      `)
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+})
+
+async function request(db: ReturnType<typeof TestApp.database>, ids: request.Ids) {
+  const record = await RoutesAccessRequests.create(db, {
+    environment: 'production',
+    keyIds: [],
+    orgId: ids.orgId,
+    projectId: ids.projectId,
+    requestedBy: 'usr_1a2b3c4d5e6f7g8h9j0k1m2n',
+    routes: [],
+    subsidy: false,
+  })
+  if (!record) throw new Error('Request was not created')
+  return record
+}
+
+declare namespace request {
+  type Ids = { orgId: string; projectId: string }
+}

package/src/db/tables/routesAccessRequests.ts

@@ -91,6 +91,31 @@ export function list(db: Db.Db, orgId: string): Promise<Record[]> {
     .execute()
 }
 
+/** Whether the organization created another request at or after `since`. */
+export async function hasRecent(db: Db.Db, options: hasRecent.Options): Promise<boolean> {
+  const row = await db.kysely
+    .selectFrom('routes_access_requests')
+    .select('id')
+    .where('orgId', '=', options.orgId)
+    .where('createdAt', '>=', options.since)
+    .where('id', '!=', options.excludeId)
+    .limit(1)
+    .executeTakeFirst()
+  return row !== undefined
+}
+
+export declare namespace hasRecent {
+  /** Window and request to compare against. */
+  type Options = {
+    /** Request to leave out, usually the one just created. */
+    excludeId: string
+    /** Organization whose requests count. */
+    orgId: string
+    /** ISO timestamp opening the window. */
+    since: string
+  }
+}
+
 /** Joins the organization, project, and requester names that still exist. */
 function detailed(db: Db.Db) {
   return db.kysely