tapimo 0.19.0 → 0.20.0

package/src/db/tables/{zoneKeyRequests.test.ts → zoneDelegationRequests.test.ts}

@@ -1,12 +1,9 @@
-import * as ApiKeys from '../../ApiKeys.js'
-import * as ZoneKeyApproval from '../../internal/ZoneKeyApproval.js'
-import * as Store from '../../internal/Store.js'
+import * as ZoneDelegationApproval from '../../internal/ZoneDelegationApproval.js'
 import * as TestApp from '../../../test/App.js'
-import * as Requests from './zoneKeyRequests.js'
-import * as ApiKeyAdmissions from './apiKeyAdmissions.js'
+import * as Requests from './zoneDelegationRequests.js'
 
 // Sessions outlive the approval lifetime so tests can isolate each bound.
-const expiresAt = new Date(Date.now() + 2 * ZoneKeyApproval.approvalLifetime).toISOString()
+const expiresAt = new Date(Date.now() + 2 * ZoneDelegationApproval.approvalLifetime).toISOString()
 const requester = {
   email: 'requester@tempo.xyz',
   eligible: false,
@@ -17,17 +14,17 @@ const first = { email: 'first@tempo.xyz', eligible: true, expiresAt, id: 'employ
 const second = { email: 'second@tempo.xyz', eligible: true, expiresAt, id: 'employee_second' }
 const groupId = 'app-tempo-api-zone-issuers'
 const input = {
-  allowedIps: ['203.0.113.7'],
+  accountsAll: true,
+  chainId: 421_700_001,
   environment: 'production' as const,
-  name: 'Zone reader',
   orgId: 'org_fixture',
-  scopes: ['zone:421700001:read'],
+  tokensAll: true,
 }
 
 describe('get', () => {
   test('reads only the requested approvals and returns null for a missing request', async () => {
     const db = TestApp.database()
-    expect(await Requests.get(db, 'zkr_missing')).toBeNull()
+    expect(await Requests.get(db, 'zdr_missing')).toBeNull()
     const request = await Requests.create(db, { groupId, input, requester })
     expect((await Requests.get(db, request.id))?.approvals).toEqual([])
     const other = await Requests.create(db, { groupId, input, requester })
@@ -57,7 +54,7 @@ describe('approve', () => {
           lookup: async () => users,
           member: first,
         }),
-      ).rejects.toThrow(ZoneKeyApproval.RequiredError)
+      ).rejects.toThrow(ZoneDelegationApproval.RequiredError)
     await expect(
       Requests.approve(db, {
         groupId,
@@ -83,7 +80,7 @@ describe('approve', () => {
     ])
       await expect(
         Requests.approve(db, { lookup, groupId, id: request.id, member }),
-      ).rejects.toThrow(ZoneKeyApproval.RequiredError)
+      ).rejects.toThrow(ZoneDelegationApproval.RequiredError)
     await Requests.approve(db, { lookup, groupId, id: request.id, member: first })
     await Requests.approve(db, {
       lookup,
@@ -113,7 +110,7 @@ describe('claim', () => {
         lookup: () => lookup([requester.id, first.id, first.id, 'employee_unrecorded']),
         member: requester,
       }),
-    ).rejects.toThrow(ZoneKeyApproval.RequiredError)
+    ).rejects.toThrow(ZoneDelegationApproval.RequiredError)
     expect((await Requests.get(db, request.id))?.status).toBe('pending')
   })
 
@@ -137,7 +134,7 @@ describe('claim', () => {
           lookup: async () => users,
           member: requester,
         }),
-      ).rejects.toThrow(ZoneKeyApproval.RequiredError)
+      ).rejects.toThrow(ZoneDelegationApproval.RequiredError)
       expect((await Requests.get(db, request.id))?.status).toBe('pending')
     }
     await expect(
@@ -150,7 +147,7 @@ describe('claim', () => {
         member: requester,
       }),
     ).rejects.toThrow('Directory unavailable')
-    expect((await Requests.get(db, request.id))?.keyId).toBeNull()
+    expect((await Requests.get(db, request.id))?.status).toBe('pending')
     await expect(
       Requests.claim(db, { groupId, id: request.id, lookup, member: requester }),
     ).resolves.toMatchObject({ input })
@@ -171,11 +168,11 @@ describe('claim', () => {
           id: request.id,
           member: requester,
           lookup: async (ids) => {
-            vi.setSystemTime(now + ZoneKeyApproval.approvalLifetime)
+            vi.setSystemTime(now + ZoneDelegationApproval.approvalLifetime)
             return lookup(ids)
           },
         }),
-      ).rejects.toThrow(ZoneKeyApproval.RequiredError)
+      ).rejects.toThrow(ZoneDelegationApproval.RequiredError)
       expect((await Requests.get(db, request.id))?.status).toBe('pending')
     } finally {
       vi.useRealTimers()
@@ -197,11 +194,11 @@ describe('claim', () => {
         short.expiresAt,
       )
       expect(stored?.approvals.find((a) => a.approverId === second.id)?.expiresAt).toBe(
-        new Date(now + ZoneKeyApproval.approvalLifetime).toISOString(),
+        new Date(now + ZoneDelegationApproval.approvalLifetime).toISOString(),
       )
       vi.setSystemTime(now + 30_000)
       const claim = { lookup, groupId, id: request.id, member: requester }
-      await expect(Requests.claim(db, claim)).rejects.toThrow(ZoneKeyApproval.RequiredError)
+      await expect(Requests.claim(db, claim)).rejects.toThrow(ZoneDelegationApproval.RequiredError)
       await Requests.approve(db, { lookup, groupId, id: request.id, member: first })
       expect((await Requests.get(db, request.id))?.approvals).toHaveLength(2)
       await expect(Requests.claim(db, claim)).resolves.toMatchObject({ input })
@@ -220,13 +217,13 @@ describe('claim', () => {
       for (const member of [first, second])
         await Requests.approve(db, { lookup, groupId, id: request.id, member })
       expect((await Requests.get(db, request.id))?.approvals.map((a) => a.expiresAt)).toEqual([
-        new Date(now + ZoneKeyApproval.approvalLifetime).toISOString(),
-        new Date(now + ZoneKeyApproval.approvalLifetime).toISOString(),
+        new Date(now + ZoneDelegationApproval.approvalLifetime).toISOString(),
+        new Date(now + ZoneDelegationApproval.approvalLifetime).toISOString(),
       ])
-      vi.setSystemTime(now + ZoneKeyApproval.approvalLifetime)
+      vi.setSystemTime(now + ZoneDelegationApproval.approvalLifetime)
       await expect(
         Requests.claim(db, { lookup, groupId, id: request.id, member: requester }),
-      ).rejects.toThrow(ZoneKeyApproval.RequiredError)
+      ).rejects.toThrow(ZoneDelegationApproval.RequiredError)
       expect((await Requests.get(db, request.id))?.status).toBe('pending')
     } finally {
       vi.useRealTimers()
@@ -237,9 +234,9 @@ describe('claim', () => {
     const db = TestApp.database()
     const request = await Requests.create(db, { groupId, input, requester })
     const claim = { lookup, groupId, id: request.id, member: requester }
-    await expect(Requests.claim(db, claim)).rejects.toThrow(ZoneKeyApproval.RequiredError)
+    await expect(Requests.claim(db, claim)).rejects.toThrow(ZoneDelegationApproval.RequiredError)
     await Requests.approve(db, { lookup, groupId, id: request.id, member: first })
-    await expect(Requests.claim(db, claim)).rejects.toThrow(ZoneKeyApproval.RequiredError)
+    await expect(Requests.claim(db, claim)).rejects.toThrow(ZoneDelegationApproval.RequiredError)
     await Requests.approve(db, { lookup, groupId, id: request.id, member: second })
     for (const options of [
       { ...claim, member: { ...requester, id: 'employee_recreated' } },
@@ -248,14 +245,15 @@ describe('claim', () => {
       { ...claim, member: null },
       { ...claim, groupId: 'replacement-group' },
     ])
-      await expect(Requests.claim(db, options)).rejects.toThrow(ZoneKeyApproval.RequiredError)
+      await expect(Requests.claim(db, options)).rejects.toThrow(
+        ZoneDelegationApproval.RequiredError,
+      )
     const claimed = await Requests.claim(db, claim)
     expect(claimed.input).toEqual(input)
-    expect(claimed.keyId.startsWith('key_')).toBe(true)
-    await expect(Requests.claim(db, claim)).rejects.toThrow(ZoneKeyApproval.RequiredError)
+    await expect(Requests.claim(db, claim)).rejects.toThrow(ZoneDelegationApproval.RequiredError)
   })
 
-  test('allows only one concurrent claim and retains the reserved key id', async () => {
+  test('allows only one concurrent claim and never replays a finished one', async () => {
     const factory = TestApp.databaseFactory()
     const db = factory()
     const request = await Requests.create(db, { groupId, input, requester })
@@ -273,19 +271,19 @@ describe('claim', () => {
       ]
     `)
     const stored = await Requests.get(db, request.id)
-    expect(stored?.status).toBe('issuing')
-    expect(stored?.keyId).toBeTruthy()
-    await Requests.finish(db, request.id, 'failed')
-    await expect(Requests.claim(db, options)).rejects.toThrow(ZoneKeyApproval.RequiredError)
+    expect(stored?.status).toBe('applying')
+    await Requests.finish(db, request.id, { status: 'failed' })
+    expect((await Requests.get(db, request.id))?.status).toBe('failed')
+    await expect(Requests.claim(db, options)).rejects.toThrow(ZoneDelegationApproval.RequiredError)
   })
 
-  test('cancellation prevents approval and issuance', async () => {
+  test('cancellation prevents approval and application', async () => {
     const db = TestApp.database()
     const request = await Requests.create(db, { groupId, input, requester })
     await Requests.cancel(db, request.id)
     await expect(
       Requests.approve(db, { lookup, groupId, id: request.id, member: first }),
-    ).rejects.toThrow(ZoneKeyApproval.RequiredError)
+    ).rejects.toThrow(ZoneDelegationApproval.RequiredError)
     await expect(
       Requests.claim(db, {
         lookup,
@@ -293,7 +291,7 @@ describe('claim', () => {
         id: request.id,
         member: requester,
       }),
-    ).rejects.toThrow(ZoneKeyApproval.RequiredError)
+    ).rejects.toThrow(ZoneDelegationApproval.RequiredError)
   })
 
   test('requests expire after 24 hours', async () => {
@@ -304,53 +302,14 @@ describe('claim', () => {
       vi.setSystemTime(new Date(Date.parse(request.expiresAt) + 1))
       await expect(
         Requests.approve(db, { lookup, groupId, id: request.id, member: first }),
-      ).rejects.toThrow(ZoneKeyApproval.RequiredError)
+      ).rejects.toThrow(ZoneDelegationApproval.RequiredError)
     } finally {
       vi.useRealTimers()
     }
   })
 })
 
-describe('direct issuance', () => {
-  test('does not publish a protected scope intent through an ordinary update', async () => {
-    const db = TestApp.database()
-    const store = Store.memory()
-    const { record } = await ApiKeys.mintBounded(db, store, { orgId: 'org_fixture', scopes: [] })
-    await db.transaction(async (tx) => {
-      await ApiKeyAdmissions.lock(tx, record.id)
-      await ApiKeyAdmissions.setPendingScopes(tx, record.id, ['*'])
-    })
-    await expect(ApiKeys.updateBounded(db, store, record.id, { name: 'Changed' })).rejects.toThrow(
-      ZoneKeyApproval.RequiredError,
-    )
-    expect((await ApiKeys.get(store, record.id))?.scopes).toEqual([])
-  })
-  test('blocks Zone read and wildcard minting at the shared admission boundary', async () => {
-    const db = TestApp.database()
-    const store = Store.memory()
-    for (const scopes of [['zone:421700001:read'], ['*']])
-      await expect(ApiKeys.mintBounded(db, store, { scopes })).rejects.toThrow(
-        ZoneKeyApproval.RequiredError,
-      )
-    expect(await ApiKeys.list(store)).toEqual([])
-  })
-
-  test('blocks elevation and edits to existing protected keys while allowing revocation', async () => {
-    const db = TestApp.database()
-    const store = Store.memory()
-    const plain = await ApiKeys.mint(store, { scopes: ['data:read'] })
-    const protectedKey = await ApiKeys.mint(store, { scopes: ['zone:421700001:read'] })
-    await expect(
-      ApiKeys.updateBounded(db, store, plain.record.id, { scopes: ['*'] }),
-    ).rejects.toThrow(ZoneKeyApproval.RequiredError)
-    await expect(
-      ApiKeys.updateBounded(db, store, protectedKey.record.id, { allowedIps: [] }),
-    ).rejects.toThrow(ZoneKeyApproval.RequiredError)
-    expect(await ApiKeys.revokeBounded(db, store, protectedKey.record.id)).toBe(true)
-  })
-})
-
-async function lookup(ids: readonly string[]): Promise<ZoneKeyApproval.Status[]> {
+async function lookup(ids: readonly string[]): Promise<ZoneDelegationApproval.Status[]> {
   return ids.map((id) => ({
     active: true,
     eligible: id !== 'employee_requester' && id !== 'employee_nonmember',

package/src/db/tables/{zoneKeyRequests.ts → zoneDelegationRequests.ts}

@@ -1,34 +1,37 @@
 import type { JSONColumnType } from 'kysely'
 import { jsonArrayFrom } from 'kysely/helpers/postgres'
 
-import * as ApiKey from '../../ApiKey.js'
 import * as Cursor from '../../internal/Cursor.js'
 import * as Id from '../../internal/Id.js'
-import * as ZoneKeyApproval from '../../internal/ZoneKeyApproval.js'
+import * as ZoneDelegationApproval from '../../internal/ZoneDelegationApproval.js'
 import type * as Db from '../Db.js'
 import type * as Schema from '../Schema.js'
+import type * as ZoneDelegations from './zoneDelegations.js'
 
-/** Persisted immutable request, without plaintext credentials. */
-export type Table = Omit<Schema.ZoneKeyRequest, 'input'> & {
-  /** Validated settings persisted as JSON, never a plaintext credential. */
-  input: JSONColumnType<Schema.ZoneKeyRequest['input']>
+/** Settings a request asks approvers to review: the delegation to create. */
+export type Input = ZoneDelegations.create.Input
+
+/** Persisted immutable request for one Zone delegation. */
+export type Table = Omit<Schema.ZoneDelegationRequest, 'input'> & {
+  /** Validated delegation settings persisted as JSON. */
+  input: JSONColumnType<Schema.ZoneDelegationRequest['input']>
 }
 
 /** One unique approver's decision. */
-export type ApprovalTable = Schema.ZoneKeyApproval
+export type ApprovalTable = Schema.ZoneDelegationApproval
 
-/** Stores an immutable issuance request that expires after 24 hours. */
+/** Stores an immutable delegation request that expires after 24 hours. */
 export async function create(db: Db.Db, options: create.Options) {
   const now = new Date()
   return db.kysely
-    .insertInto('zone_key_requests')
+    .insertInto('zone_delegation_requests')
     .values({
       createdAt: now.toISOString(),
+      delegationId: null,
       expiresAt: new Date(now.getTime() + 86_400_000).toISOString(),
       groupId: options.groupId,
-      id: Id.generate('zkr'),
+      id: Id.generate('zdr'),
       input: JSON.stringify(options.input),
-      keyId: null,
       requesterEmail: options.requester.email,
       requesterId: options.requester.id,
       status: 'pending',
@@ -42,10 +45,10 @@ export declare namespace create {
   type Options = {
     /** Approver group pinned for this request. */
     groupId: string
-    /** Exact key settings reviewed by approvers. */
-    input: Schema.ZoneKeyRequest['input']
+    /** Exact delegation settings reviewed by approvers. */
+    input: Schema.ZoneDelegationRequest['input']
     /** Requester from the verified internal identity session. */
-    requester: ZoneKeyApproval.Member
+    requester: ZoneDelegationApproval.Member
   }
 }
 
@@ -53,14 +56,14 @@ export declare namespace create {
 export async function get(db: Db.Db, id: string) {
   return (
     (await db.kysely
-      .selectFrom('zone_key_requests')
+      .selectFrom('zone_delegation_requests')
       .selectAll()
       .select((eb) =>
         jsonArrayFrom(
           eb
-            .selectFrom('zone_key_approvals')
+            .selectFrom('zone_delegation_approvals')
             .selectAll()
-            .whereRef('requestId', '=', 'zone_key_requests.id')
+            .whereRef('requestId', '=', 'zone_delegation_requests.id')
             .orderBy('approvedAt'),
         ).as('approvals'),
       )
@@ -74,7 +77,7 @@ export async function list(db: Db.Db, options: list.Options = {}) {
   const limit = 50
   const cursor = options.cursor ? Cursor.decode(options.cursor, ['timestamp', 'id']) : undefined
   const rows = await db.kysely
-    .selectFrom('zone_key_requests')
+    .selectFrom('zone_delegation_requests')
     .selectAll()
     .$if(Boolean(cursor), (query) =>
       query.where((eb) =>
@@ -99,26 +102,31 @@ export declare namespace list {
   }
 }
 
-/** Records one independent approval while serializing with issuance and cancellation. */
+/** Records one independent approval while serializing with application and cancellation. */
 export async function approve(db: Db.Db, options: approve.Options) {
   return db.transaction(async (tx) => {
     const request = await pending(tx, options.id, options.groupId)
     const member = options.member
-    if (!ZoneKeyApproval.active(member) || !member.eligible || member.id === request.requesterId)
-      throw new ZoneKeyApproval.RequiredError(
+    if (
+      !ZoneDelegationApproval.active(member) ||
+      !member.eligible ||
+      member.id === request.requesterId
+    )
+      // prettier-ignore
+      throw new ZoneDelegationApproval.RequiredError(
         'Approval requires an active group member other than the requester.',
       )
     const users = await options.lookup([member.id])
     if (!users.some((user) => user.id === member.id && user.active && user.eligible))
-      throw new ZoneKeyApproval.RequiredError('Approval requires a current active group member.')
-    if (!ZoneKeyApproval.active(member) || Date.parse(request.expiresAt) <= Date.now())
-      throw new ZoneKeyApproval.RequiredError('Approval request or session expired.')
+      throw new ZoneDelegationApproval.RequiredError('Approval requires a current active group member.') // prettier-ignore
+    if (!ZoneDelegationApproval.active(member) || Date.parse(request.expiresAt) <= Date.now())
+      throw new ZoneDelegationApproval.RequiredError('Approval request or session expired.')
     const now = new Date()
     const expiresAt = new Date(
-      Math.min(Date.parse(member.expiresAt), now.getTime() + ZoneKeyApproval.approvalLifetime),
+      Math.min(Date.parse(member.expiresAt), now.getTime() + ZoneDelegationApproval.approvalLifetime), // prettier-ignore
     ).toISOString()
     await tx.kysely
-      .insertInto('zone_key_approvals')
+      .insertInto('zone_delegation_approvals')
       .values({
         approvedAt: now.toISOString(),
         approverEmail: member.email,
@@ -146,30 +154,30 @@ export declare namespace approve {
     /** Request being approved. */
     id: string
     /** Fetches current account and approval-group status without caching. */
-    lookup: ZoneKeyApproval.Lookup
+    lookup: ZoneDelegationApproval.Lookup
     /** Identity from the current verified session. */
-    member: ZoneKeyApproval.Member | null
+    member: ZoneDelegationApproval.Member | null
   }
 }
 
-/** Consumes approval once, before external KV writes, and reserves the resulting key id. */
+/** Consumes approval once, before the delegation is written, so a failed write cannot be replayed. */
 export async function claim(db: Db.Db, options: claim.Options) {
   return db.transaction(async (tx) => {
     const request = await pending(tx, options.id, options.groupId)
     const requester = options.member
-    if (!ZoneKeyApproval.active(requester) || requester.id !== request.requesterId)
-      throw new ZoneKeyApproval.RequiredError(
-        'Only the original active requester can issue this key.',
+    if (!ZoneDelegationApproval.active(requester) || requester.id !== request.requesterId)
+      throw new ZoneDelegationApproval.RequiredError(
+        'Only the original active requester can apply this delegation.',
       )
     const approvals = await tx.kysely
-      .selectFrom('zone_key_approvals')
+      .selectFrom('zone_delegation_approvals')
       .selectAll()
       .where('requestId', '=', request.id)
       .where('approverId', '!=', requester.id)
       .where('expiresAt', '>', new Date().toISOString())
       .execute()
-    if (approvals.length < ZoneKeyApproval.quorum)
-      throw new ZoneKeyApproval.RequiredError(
+    if (approvals.length < ZoneDelegationApproval.quorum)
+      throw new ZoneDelegationApproval.RequiredError(
         'Two distinct, unexpired group approvals are required.',
       )
     // Keep the request locked while revalidating the requester and recorded approvers.
@@ -178,25 +186,24 @@ export async function claim(db: Db.Db, options: claim.Options) {
       ...approvals.map((approval) => approval.approverId),
     ])
     if (!users.some((user) => user.id === requester.id && user.active))
-      throw new ZoneKeyApproval.RequiredError('The requester is no longer active.')
+      throw new ZoneDelegationApproval.RequiredError('The requester is no longer active.')
     const current = new Set(
       users.filter((user) => user.active && user.eligible).map((user) => user.id),
     )
     const valid = approvals.filter(
       (approval) => current.has(approval.approverId) && Date.parse(approval.expiresAt) > Date.now(),
     )
-    if (valid.length < ZoneKeyApproval.quorum)
-      throw new ZoneKeyApproval.RequiredError('Two current active group approvals are required.')
+    if (valid.length < ZoneDelegationApproval.quorum)
+      throw new ZoneDelegationApproval.RequiredError('Two current active group approvals are required.') // prettier-ignore
     // Lookup latency must not extend the request, session, or approval lifetime.
-    if (!ZoneKeyApproval.active(requester) || Date.parse(request.expiresAt) <= Date.now())
-      throw new ZoneKeyApproval.RequiredError('Approval request expired.')
-    const keyId = ApiKey.generateId()
+    if (!ZoneDelegationApproval.active(requester) || Date.parse(request.expiresAt) <= Date.now())
+      throw new ZoneDelegationApproval.RequiredError('Approval request expired.')
     await tx.kysely
-      .updateTable('zone_key_requests')
-      .set({ keyId, status: 'issuing' })
+      .updateTable('zone_delegation_requests')
+      .set({ status: 'applying' })
       .where('id', '=', request.id)
       .execute()
-    return { ...request, keyId }
+    return request
   })
 }
 
@@ -205,20 +212,30 @@ export declare namespace claim {
   type Options = approve.Options
 }
 
-/** Records the terminal issuance outcome; a failed or interrupted claim cannot be replayed. */
-export async function finish(db: Db.Db, id: string, status: 'issued' | 'failed') {
+/** Records the terminal outcome; a failed or interrupted claim cannot be replayed. */
+export async function finish(db: Db.Db, id: string, outcome: finish.Outcome) {
   await db.kysely
-    .updateTable('zone_key_requests')
-    .set({ status })
+    .updateTable('zone_delegation_requests')
+    .set({ delegationId: outcome.delegationId ?? null, status: outcome.status })
     .where('id', '=', id)
-    .where('status', '=', 'issuing')
+    .where('status', '=', 'applying')
     .execute()
 }
 
+export declare namespace finish {
+  /** How the claimed request ended. */
+  type Outcome = {
+    /** Delegation the request created, when applied. */
+    delegationId?: string | undefined
+    /** Terminal status. */
+    status: 'applied' | 'failed'
+  }
+}
+
 /** Cancels a pending request without needing quorum. */
 export async function cancel(db: Db.Db, id: string) {
   return db.kysely
-    .updateTable('zone_key_requests')
+    .updateTable('zone_delegation_requests')
     .set({ status: 'cancelled' })
     .where('id', '=', id)
     .where('status', '=', 'pending')
@@ -229,7 +246,7 @@ export async function cancel(db: Db.Db, id: string) {
 /** Locks and validates the request before a state transition. */
 async function pending(db: Db.Db, id: string, groupId: string) {
   const request = await db.kysely
-    .selectFrom('zone_key_requests')
+    .selectFrom('zone_delegation_requests')
     .selectAll()
     .where('id', '=', id)
     .forUpdate()
@@ -240,7 +257,7 @@ async function pending(db: Db.Db, id: string, groupId: string) {
     request.groupId !== groupId ||
     Date.parse(request.expiresAt) <= Date.now()
   )
-    throw new ZoneKeyApproval.RequiredError(
+    throw new ZoneDelegationApproval.RequiredError(
       'Request is missing, expired, consumed, cancelled, or belongs to a different approver group.',
     )
   return request

package/src/db/tables/zoneDelegations.test.ts

@@ -26,7 +26,6 @@ describe('create', () => {
         "chainId": 421700001,
         "environment": "production",
         "orgId": "org_zd",
-        "projects": "all",
         "tokensAll": true,
       }
     `)
@@ -58,13 +57,13 @@ describe('create', () => {
 })
 
 describe('update', () => {
-  test('changes flags and projects of an active delegation only', async () => {
+  test('changes flags of an active delegation only', async () => {
     const db = TestApp.database()
     await Organizations.create(db, { id: 'org_up', name: 'Update' })
-    const input = { accountsAll: true, chainId, environment: 'production', orgId: 'org_up', projects: 'all', tokensAll: true } as const // prettier-ignore
+    const input = { accountsAll: true, chainId, environment: 'production', orgId: 'org_up', tokensAll: true } as const // prettier-ignore
     const created = await ZoneDelegations.create(db, input)
-    const updated = await ZoneDelegations.update(db, created.id, { accountsAll: false, projects: ['prj_1'] }) // prettier-ignore
-    expect([updated?.id === created.id, updated?.accountsAll, updated?.projects, updated?.tokensAll]).toEqual([true, false, ['prj_1'], true]) // prettier-ignore
+    const updated = await ZoneDelegations.update(db, created.id, { accountsAll: false })
+    expect([updated?.id === created.id, updated?.accountsAll, updated?.tokensAll]).toEqual([true, false, true]) // prettier-ignore
     await ZoneDelegations.revoke(db, created.id)
     expect(await ZoneDelegations.update(db, created.id, { accountsAll: true })).toBeUndefined()
     expect(await ZoneDelegations.update(db, 'zd_missing', { accountsAll: true })).toBeUndefined()
@@ -119,7 +118,7 @@ describe('Members', () => {
   test('pages by address with a cursor', async () => {
     const db = TestApp.database()
     await Organizations.create(db, { id: 'org_p', name: 'Pages' })
-    const created = await ZoneDelegations.create(db, { accountsAll: false, chainId, environment: 'sandbox', orgId: 'org_p', projects: 'all', tokensAll: true }) // prettier-ignore
+    const created = await ZoneDelegations.create(db, { accountsAll: false, chainId, environment: 'sandbox', orgId: 'org_p', tokensAll: true }) // prettier-ignore
     const addresses = Array.from({ length: 150 }, (_, i) => `0x${i.toString(16).padStart(40, '0')}`)
     await ZoneDelegations.Members.add(db, { addresses, id: created.id, kind: 'account' })
     const first = await ZoneDelegations.Members.list(db, { id: created.id, kind: 'account' }) // prettier-ignore

package/src/db/tables/zoneDelegations.ts

@@ -17,8 +17,8 @@ export type Table = Omit<Schema.ZoneDelegation, 'chainId' | 'projects'> & {
 /** Columns of the `zone_delegation_members` table. */
 export type MemberTable = Schema.ZoneDelegationMember
 
-/** A stored delegation; a `null` revocation reads as absent. */
-export type Record = Omit<Schema.ZoneDelegation, 'revokedAt'> & {
+/** A stored delegation; a `null` revocation reads as absent. The retired `projects` column is not surfaced. */
+export type Record = Omit<Schema.ZoneDelegation, 'projects' | 'revokedAt'> & {
   /** When the delegation was revoked (ISO 8601); absent while active. */
   revokedAt?: string | undefined
 }
@@ -36,7 +36,7 @@ export type Scope = Pick<Record, 'chainId' | 'environment' | 'orgId'>
 export type Owner = Pick<Record, 'environment' | 'orgId'>
 
 /** Coverage settings on the delegation row itself. */
-export type Coverage = Pick<Record, 'accountsAll' | 'projects' | 'tokensAll'>
+export type Coverage = Pick<Record, 'accountsAll' | 'tokensAll'>
 
 /** Creates an active delegation with optional initial members; an active one for the same Zone is a conflict. */
 export function create(db: Db.Db, input: create.Input): Promise<Record> {
@@ -164,7 +164,6 @@ export async function update(
     .updateTable('zone_delegations')
     .set({
       ...(patch.accountsAll === undefined ? {} : { accountsAll: patch.accountsAll }),
-      ...(patch.projects === undefined ? {} : { projects: JSON.stringify(patch.projects) }),
       ...(patch.tokensAll === undefined ? {} : { tokensAll: patch.tokensAll }),
       updatedAt: new Date().toISOString(),
     })
@@ -180,8 +179,6 @@ export declare namespace update {
   type Patch = {
     /** Whether every account is covered. */
     accountsAll?: boolean | undefined
-    /** Covered projects (`all` or a list of ids). */
-    projects?: ZoneDelegation.Selection | undefined
     /** Whether every token is covered. */
     tokensAll?: boolean | undefined
   }
@@ -217,6 +214,25 @@ export namespace Members {
     })
   }
 
+  /**
+   * Adds members only while the list's flag is `all`, so the add changes no live
+   * access; `widens` when the list is enforced. The row stays locked through the
+   * insert, so a concurrent narrowing cannot turn the add into a widening.
+   */
+  export function addInert(
+    db: Db.Db,
+    options: Options,
+  ): Promise<Mutation<readonly Member[]> | { status: 'widens' }> {
+    return db.transaction(async (tx) => {
+      const now = new Date().toISOString()
+      const claimed = await claim(tx, options.id, now)
+      if (claimed.status !== 'ok') return claimed
+      if (!claimed.all[options.kind]) return { status: 'widens' } as const
+      const data = await insertMembers(tx, { ...options, now })
+      return { all: true, data, status: 'ok' }
+    })
+  }
+
   /** Removes active members and returns the addresses removed. */
   export function remove(db: Db.Db, options: Options): Promise<Mutation<readonly string[]>> {
     return db.transaction(async (tx) => {
@@ -370,7 +386,8 @@ function storage(input: ensure.Input, now: string) {
     environment: input.environment,
     id: Id.generate('zd'),
     orgId: input.orgId,
-    projects: JSON.stringify(input.projects),
+    // The column stays NOT NULL until a later cleanup drops it; every row covers every project.
+    projects: JSON.stringify('all'),
     revokedAt: null,
     tokensAll: input.tokensAll,
     updatedAt: now,
@@ -378,7 +395,7 @@ function storage(input: ensure.Input, now: string) {
 }
 
 function domain(row: Selectable<Table>): Record {
-  const { revokedAt, ...rest } = row
+  const { projects: _projects, revokedAt, ...rest } = row
   return {
     ...rest,
     chainId: Number(row.chainId),