tapimo 0.19.0 → 0.20.0

package/dist/db/tables/zoneKeyRequests.d.ts

@@ -1,289 +0,0 @@
-import type { JSONColumnType } from 'kysely';
-import * as ZoneKeyApproval from '../../internal/ZoneKeyApproval.js';
-import type * as Db from '../Db.js';
-import type * as Schema from '../Schema.js';
-/** Persisted immutable request, without plaintext credentials. */
-export type Table = Omit<Schema.ZoneKeyRequest, 'input'> & {
-    /** Validated settings persisted as JSON, never a plaintext credential. */
-    input: JSONColumnType<Schema.ZoneKeyRequest['input']>;
-};
-/** One unique approver's decision. */
-export type ApprovalTable = Schema.ZoneKeyApproval;
-/** Stores an immutable issuance request that expires after 24 hours. */
-export declare function create(db: Db.Db, options: create.Options): Promise<{
-    createdAt: string;
-    expiresAt: string;
-    groupId: string;
-    id: string;
-    input: {
-        allowedIps?: readonly string[] | undefined;
-        billingActive?: boolean | undefined;
-        environment?: "production" | "sandbox" | undefined;
-        name?: string | undefined;
-        projectId?: string | undefined;
-        rateLimits?: Record<string, {
-            limit: number;
-            period: "minute" | "second";
-        }> | undefined;
-        zoneTags?: readonly number[] | undefined;
-        createdBy?: string | undefined;
-        expiresAt?: string | undefined;
-        orgId?: string | undefined;
-        scopes: readonly string[];
-    } & {
-        orgId: string;
-    };
-    keyId: string | null;
-    requesterEmail: string;
-    requesterId: string;
-    status: "cancelled" | "failed" | "issued" | "issuing" | "pending";
-}>;
-export declare namespace create {
-    /** Validated request and authenticated requester. */
-    type Options = {
-        /** Approver group pinned for this request. */
-        groupId: string;
-        /** Exact key settings reviewed by approvers. */
-        input: Schema.ZoneKeyRequest['input'];
-        /** Requester from the verified internal identity session. */
-        requester: ZoneKeyApproval.Member;
-    };
-}
-/** Reads a request and its recorded approvals. */
-export declare function get(db: Db.Db, id: string): Promise<{
-    approvals: {
-        approvedAt: string;
-        approverEmail: string;
-        approverId: string;
-        createdAt: string;
-        expiresAt: string;
-        groupId: string;
-        id: string;
-        input: {
-            allowedIps?: readonly string[] | undefined;
-            billingActive?: boolean | undefined;
-            environment?: "production" | "sandbox" | undefined;
-            name?: string | undefined;
-            projectId?: string | undefined;
-            rateLimits?: Record<string, {
-                limit: number;
-                period: "minute" | "second";
-            }> | undefined;
-            zoneTags?: readonly number[] | undefined;
-            createdBy?: string | undefined;
-            expiresAt?: string | undefined;
-            orgId?: string | undefined;
-            scopes: readonly string[];
-        } & {
-            orgId: string;
-        };
-        keyId: string | null;
-        requestId: string;
-        requesterEmail: string;
-        requesterId: string;
-        status: "cancelled" | "failed" | "issued" | "issuing" | "pending";
-    }[];
-    createdAt: string;
-    expiresAt: string;
-    groupId: string;
-    id: string;
-    input: {
-        allowedIps?: readonly string[] | undefined;
-        billingActive?: boolean | undefined;
-        environment?: "production" | "sandbox" | undefined;
-        name?: string | undefined;
-        projectId?: string | undefined;
-        rateLimits?: Record<string, {
-            limit: number;
-            period: "minute" | "second";
-        }> | undefined;
-        zoneTags?: readonly number[] | undefined;
-        createdBy?: string | undefined;
-        expiresAt?: string | undefined;
-        orgId?: string | undefined;
-        scopes: readonly string[];
-    } & {
-        orgId: string;
-    };
-    keyId: string | null;
-    requesterEmail: string;
-    requesterId: string;
-    status: "cancelled" | "failed" | "issued" | "issuing" | "pending";
-} | null>;
-/** Lists requests newest first, one page at a time, so every request stays reachable. */
-export declare function list(db: Db.Db, options?: list.Options): Promise<{
-    data: {
-        createdAt: string;
-        expiresAt: string;
-        groupId: string;
-        id: string;
-        input: {
-            allowedIps?: readonly string[] | undefined;
-            billingActive?: boolean | undefined;
-            environment?: "production" | "sandbox" | undefined;
-            name?: string | undefined;
-            projectId?: string | undefined;
-            rateLimits?: Record<string, {
-                limit: number;
-                period: "minute" | "second";
-            }> | undefined;
-            zoneTags?: readonly number[] | undefined;
-            createdBy?: string | undefined;
-            expiresAt?: string | undefined;
-            orgId?: string | undefined;
-            scopes: readonly string[];
-        } & {
-            orgId: string;
-        };
-        keyId: string | null;
-        requesterEmail: string;
-        requesterId: string;
-        status: "cancelled" | "failed" | "issued" | "issuing" | "pending";
-    }[];
-    nextCursor: string | null;
-}>;
-export declare namespace list {
-    type Options = {
-        /** Opaque position from the preceding page. */
-        cursor?: string | undefined;
-    };
-}
-/** Records one independent approval while serializing with issuance and cancellation. */
-export declare function approve(db: Db.Db, options: approve.Options): Promise<{
-    approvals: {
-        approvedAt: string;
-        approverEmail: string;
-        approverId: string;
-        createdAt: string;
-        expiresAt: string;
-        groupId: string;
-        id: string;
-        input: {
-            allowedIps?: readonly string[] | undefined;
-            billingActive?: boolean | undefined;
-            environment?: "production" | "sandbox" | undefined;
-            name?: string | undefined;
-            projectId?: string | undefined;
-            rateLimits?: Record<string, {
-                limit: number;
-                period: "minute" | "second";
-            }> | undefined;
-            zoneTags?: readonly number[] | undefined;
-            createdBy?: string | undefined;
-            expiresAt?: string | undefined;
-            orgId?: string | undefined;
-            scopes: readonly string[];
-        } & {
-            orgId: string;
-        };
-        keyId: string | null;
-        requestId: string;
-        requesterEmail: string;
-        requesterId: string;
-        status: "cancelled" | "failed" | "issued" | "issuing" | "pending";
-    }[];
-    createdAt: string;
-    expiresAt: string;
-    groupId: string;
-    id: string;
-    input: {
-        allowedIps?: readonly string[] | undefined;
-        billingActive?: boolean | undefined;
-        environment?: "production" | "sandbox" | undefined;
-        name?: string | undefined;
-        projectId?: string | undefined;
-        rateLimits?: Record<string, {
-            limit: number;
-            period: "minute" | "second";
-        }> | undefined;
-        zoneTags?: readonly number[] | undefined;
-        createdBy?: string | undefined;
-        expiresAt?: string | undefined;
-        orgId?: string | undefined;
-        scopes: readonly string[];
-    } & {
-        orgId: string;
-    };
-    keyId: string | null;
-    requesterEmail: string;
-    requesterId: string;
-    status: "cancelled" | "failed" | "issued" | "issuing" | "pending";
-} | null>;
-export declare namespace approve {
-    /** Authenticated decision context. */
-    type Options = {
-        /** Currently configured approver group. */
-        groupId: string;
-        /** Request being approved. */
-        id: string;
-        /** Fetches current account and approval-group status without caching. */
-        lookup: ZoneKeyApproval.Lookup;
-        /** Identity from the current verified session. */
-        member: ZoneKeyApproval.Member | null;
-    };
-}
-/** Consumes approval once, before external KV writes, and reserves the resulting key id. */
-export declare function claim(db: Db.Db, options: claim.Options): Promise<{
-    keyId: string;
-    createdAt: string;
-    expiresAt: string;
-    groupId: string;
-    id: string;
-    input: {
-        allowedIps?: readonly string[] | undefined;
-        billingActive?: boolean | undefined;
-        environment?: "production" | "sandbox" | undefined;
-        name?: string | undefined;
-        projectId?: string | undefined;
-        rateLimits?: Record<string, {
-            limit: number;
-            period: "minute" | "second";
-        }> | undefined;
-        zoneTags?: readonly number[] | undefined;
-        createdBy?: string | undefined;
-        expiresAt?: string | undefined;
-        orgId?: string | undefined;
-        scopes: readonly string[];
-    } & {
-        orgId: string;
-    };
-    requesterEmail: string;
-    requesterId: string;
-    status: "cancelled" | "failed" | "issued" | "issuing" | "pending";
-}>;
-export declare namespace claim {
-    /** Current requester session accompanying the one-time claim. */
-    type Options = approve.Options;
-}
-/** Records the terminal issuance outcome; a failed or interrupted claim cannot be replayed. */
-export declare function finish(db: Db.Db, id: string, status: 'issued' | 'failed'): Promise<void>;
-/** Cancels a pending request without needing quorum. */
-export declare function cancel(db: Db.Db, id: string): Promise<{
-    createdAt: string;
-    expiresAt: string;
-    groupId: string;
-    id: string;
-    input: {
-        allowedIps?: readonly string[] | undefined;
-        billingActive?: boolean | undefined;
-        environment?: "production" | "sandbox" | undefined;
-        name?: string | undefined;
-        projectId?: string | undefined;
-        rateLimits?: Record<string, {
-            limit: number;
-            period: "minute" | "second";
-        }> | undefined;
-        zoneTags?: readonly number[] | undefined;
-        createdBy?: string | undefined;
-        expiresAt?: string | undefined;
-        orgId?: string | undefined;
-        scopes: readonly string[];
-    } & {
-        orgId: string;
-    };
-    keyId: string | null;
-    requesterEmail: string;
-    requesterId: string;
-    status: "cancelled" | "failed" | "issued" | "issuing" | "pending";
-} | undefined>;
-//# sourceMappingURL=zoneKeyRequests.d.ts.map

package/dist/db/tables/zoneKeyRequests.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"zoneKeyRequests.d.ts","sourceRoot":"","sources":["../../../src/db/tables/zoneKeyRequests.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,QAAQ,CAAA;AAM5C,OAAO,KAAK,eAAe,MAAM,mCAAmC,CAAA;AACpE,OAAO,KAAK,KAAK,EAAE,MAAM,UAAU,CAAA;AACnC,OAAO,KAAK,KAAK,MAAM,MAAM,cAAc,CAAA;AAE3C,kEAAkE;AAClE,MAAM,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,OAAO,CAAC,GAAG;IACzD,0EAA0E;IAC1E,KAAK,EAAE,cAAc,CAAC,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAA;CACtD,CAAA;AAED,sCAAsC;AACtC,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,eAAe,CAAA;AAElD,wEAAwE;AACxE,wBAAsB,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiB9D;AAED,MAAM,CAAC,OAAO,WAAW,MAAM,CAAC;IAC9B,qDAAqD;IACrD,KAAK,OAAO,GAAG;QACb,8CAA8C;QAC9C,OAAO,EAAE,MAAM,CAAA;QACf,gDAAgD;QAChD,KAAK,EAAE,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,CAAA;QACrC,6DAA6D;QAC7D,SAAS,EAAE,eAAe,CAAC,MAAM,CAAA;KAClC,CAAA;CACF;AAED,kDAAkD;AAClD,wBAAsB,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UAiB9C;AAED,yFAAyF;AACzF,wBAAsB,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,OAAO,GAAE,IAAI,CAAC,OAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoB/D;AAED,MAAM,CAAC,OAAO,WAAW,IAAI,CAAC;IAC5B,KAAK,OAAO,GAAG;QACb,+CAA+C;QAC/C,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAC5B,CAAA;CACF;AAED,yFAAyF;AACzF,wBAAsB,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UAoChE;AAED,MAAM,CAAC,OAAO,WAAW,OAAO,CAAC;IAC/B,sCAAsC;IACtC,KAAK,OAAO,GAAG;QACb,2CAA2C;QAC3C,OAAO,EAAE,MAAM,CAAA;QACf,8BAA8B;QAC9B,EAAE,EAAE,MAAM,CAAA;QACV,yEAAyE;QACzE,MAAM,EAAE,eAAe,CAAC,MAAM,CAAA;QAC9B,kDAAkD;QAClD,MAAM,EAAE,eAAe,CAAC,MAAM,GAAG,IAAI,CAAA;KACtC,CAAA;CACF;AAED,4FAA4F;AAC5F,wBAAsB,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6C5D;AAED,MAAM,CAAC,OAAO,WAAW,KAAK,CAAC;IAC7B,iEAAiE;IACjE,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAA;CAC/B;AAED,+FAA+F;AAC/F,wBAAsB,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,GAAG,QAAQ,iBAO9E;AAED,wDAAwD;AACxD,wBAAsB,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;eAQjD"}

package/dist/db/tables/zoneKeyRequests.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"zoneKeyRequests.js","sourceRoot":"","sources":["../../../src/db/tables/zoneKeyRequests.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AAEvD,OAAO,KAAK,MAAM,MAAM,iBAAiB,CAAA;AACzC,OAAO,KAAK,MAAM,MAAM,0BAA0B,CAAA;AAClD,OAAO,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAC1C,OAAO,KAAK,eAAe,MAAM,mCAAmC,CAAA;AAapE,wEAAwE;AACxE,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,EAAS,EAAE,OAAuB;IAC7D,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;IACtB,OAAO,EAAE,CAAC,MAAM;SACb,UAAU,CAAC,mBAAmB,CAAC;SAC/B,MAAM,CAAC;QACN,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;QAC5B,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,UAAU,CAAC,CAAC,WAAW,EAAE;QAC7D,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC;QACtB,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC;QACpC,KAAK,EAAE,IAAI;QACX,cAAc,EAAE,OAAO,CAAC,SAAS,CAAC,KAAK;QACvC,WAAW,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE;QACjC,MAAM,EAAE,SAAS;KAClB,CAAC;SACD,YAAY,EAAE;SACd,uBAAuB,EAAE,CAAA;AAC9B,CAAC;AAcD,kDAAkD;AAClD,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,EAAS,EAAE,EAAU;IAC7C,OAAO,CACL,CAAC,MAAM,EAAE,CAAC,MAAM;SACb,UAAU,CAAC,mBAAmB,CAAC;SAC/B,SAAS,EAAE;SACX,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CACb,aAAa,CACX,EAAE;SACC,UAAU,CAAC,oBAAoB,CAAC;SAChC,SAAS,EAAE;SACX,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE,sBAAsB,CAAC;SAClD,OAAO,CAAC,YAAY,CAAC,CACzB,CAAC,EAAE,CAAC,WAAW,CAAC,CAClB;SACA,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC;SACpB,gBAAgB,EAAE,CAAC,IAAI,IAAI,CAC/B,CAAA;AACH,CAAC;AAED,yFAAyF;AACzF,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,EAAS,EAAE,OAAO,GAAiB,EAAE;IAC9D,MAAM,KAAK,GAAG,EAAE,CAAA;IAChB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAC9F,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,MAAM;SACzB,UAAU,CAAC,mBAAmB,CAAC;SAC/B,SAAS,EAAE;SACX,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,CAC9B,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CACjB,EAAE,CAAC,EAAE,CAAC;QACJ,EAAE,CAAC,WAAW,EAAE,GAAG,EAAE,MAAM,CAAC,MAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QACxC,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,GAAG,EAAE,MAAM,CAAC,MAAO,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,MAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KACtF,CAAC,CACH,CACF;SACA,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC;SAC5B,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC;SAChB,OAAO,EAAE,CAAA;IACZ,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACpF,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAA;AACzD,CAAC;AASD,yFAAyF;AACzF,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,EAAS,EAAE,OAAwB;IAC/D,OAAO,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QACjC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,CAAA;QAC9D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;QAC7B,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,EAAE,KAAK,OAAO,CAAC,WAAW;YAC1F,MAAM,IAAI,eAAe,CAAC,aAAa,CACrC,oEAAoE,CACrE,CAAA;QACH,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAA;QAC/C,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC;YAC9E,MAAM,IAAI,eAAe,CAAC,aAAa,CAAC,kDAAkD,CAAC,CAAA;QAC7F,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE;YAChF,MAAM,IAAI,eAAe,CAAC,aAAa,CAAC,sCAAsC,CAAC,CAAA;QACjF,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;QACtB,MAAM,SAAS,GAAG,IAAI,IAAI,CACxB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,eAAe,CAAC,gBAAgB,CAAC,CACzF,CAAC,WAAW,EAAE,CAAA;QACf,MAAM,EAAE,CAAC,MAAM;aACZ,UAAU,CAAC,oBAAoB,CAAC;aAChC,MAAM,CAAC;YACN,UAAU,EAAE,GAAG,CAAC,WAAW,EAAE;YAC7B,aAAa,EAAE,MAAM,CAAC,KAAK;YAC3B,UAAU,EAAE,MAAM,CAAC,EAAE;YACrB,SAAS;YACT,SAAS,EAAE,OAAO,CAAC,EAAE;SACtB,CAAC;aACD,UAAU,CAAC,CAAC,QAAQ,EAAE,EAAE,CACvB,QAAQ,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC;YACxD,UAAU,EAAE,GAAG,CAAC,WAAW,EAAE;YAC7B,aAAa,EAAE,MAAM,CAAC,KAAK;YAC3B,SAAS;SACV,CAAC,CACH;aACA,OAAO,EAAE,CAAA;QACZ,OAAO,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC,CAAA;IAC5B,CAAC,CAAC,CAAA;AACJ,CAAC;AAgBD,4FAA4F;AAC5F,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,EAAS,EAAE,OAAsB;IAC3D,OAAO,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QACjC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,CAAA;QAC9D,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAA;QAChC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,EAAE,KAAK,OAAO,CAAC,WAAW;YAC5E,MAAM,IAAI,eAAe,CAAC,aAAa,CACrC,wDAAwD,CACzD,CAAA;QACH,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,MAAM;aAC9B,UAAU,CAAC,oBAAoB,CAAC;aAChC,SAAS,EAAE;aACX,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC;aACnC,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC;aACvC,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;aACjD,OAAO,EAAE,CAAA;QACZ,IAAI,SAAS,CAAC,MAAM,GAAG,eAAe,CAAC,MAAM;YAC3C,MAAM,IAAI,eAAe,CAAC,aAAa,CACrC,uDAAuD,CACxD,CAAA;QACH,mFAAmF;QACnF,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC;YACjC,SAAS,CAAC,EAAE;YACZ,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC;SACpD,CAAC,CAAA;QACF,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,SAAS,CAAC,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC;YAChE,MAAM,IAAI,eAAe,CAAC,aAAa,CAAC,oCAAoC,CAAC,CAAA;QAC/E,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAC5E,CAAA;QACD,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAC5B,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAC9F,CAAA;QACD,IAAI,KAAK,CAAC,MAAM,GAAG,eAAe,CAAC,MAAM;YACvC,MAAM,IAAI,eAAe,CAAC,aAAa,CAAC,kDAAkD,CAAC,CAAA;QAC7F,6EAA6E;QAC7E,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE;YACnF,MAAM,IAAI,eAAe,CAAC,aAAa,CAAC,2BAA2B,CAAC,CAAA;QACtE,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,EAAE,CAAA;QACjC,MAAM,EAAE,CAAC,MAAM;aACZ,WAAW,CAAC,mBAAmB,CAAC;aAChC,GAAG,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;aACjC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC;aAC5B,OAAO,EAAE,CAAA;QACZ,OAAO,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,CAAA;IAC9B,CAAC,CAAC,CAAA;AACJ,CAAC;AAOD,+FAA+F;AAC/F,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,EAAS,EAAE,EAAU,EAAE,MAA2B;IAC7E,MAAM,EAAE,CAAC,MAAM;SACZ,WAAW,CAAC,mBAAmB,CAAC;SAChC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;SACf,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC;SACpB,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,SAAS,CAAC;SAC/B,OAAO,EAAE,CAAA;AACd,CAAC;AAED,wDAAwD;AACxD,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,EAAS,EAAE,EAAU;IAChD,OAAO,EAAE,CAAC,MAAM;SACb,WAAW,CAAC,mBAAmB,CAAC;SAChC,GAAG,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;SAC5B,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC;SACpB,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,SAAS,CAAC;SAC/B,YAAY,EAAE;SACd,gBAAgB,EAAE,CAAA;AACvB,CAAC;AAED,iEAAiE;AACjE,KAAK,UAAU,OAAO,CAAC,EAAS,EAAE,EAAU,EAAE,OAAe;IAC3D,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,MAAM;SAC5B,UAAU,CAAC,mBAAmB,CAAC;SAC/B,SAAS,EAAE;SACX,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC;SACpB,SAAS,EAAE;SACX,gBAAgB,EAAE,CAAA;IACrB,IACE,CAAC,OAAO;QACR,OAAO,CAAC,MAAM,KAAK,SAAS;QAC5B,OAAO,CAAC,OAAO,KAAK,OAAO;QAC3B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE;QAE3C,MAAM,IAAI,eAAe,CAAC,aAAa,CACrC,6FAA6F,CAC9F,CAAA;IACH,OAAO,OAAO,CAAA;AAChB,CAAC"}

package/dist/handlers/internal/multisig.d.ts

@@ -1,7 +0,0 @@
-import { Store } from 'viem/tempo';
-import type * as core_Store from '../../internal/Store.js';
-/** Methods the relay answers through stored multisig coordination when a multisig store is configured. */
-export declare const methods: Set<string>;
-/** Adapts Tempo API state to Viem's atomic multisig store. */
-export declare function fromStore(store: core_Store.State): Store.Atomic;
-//# sourceMappingURL=multisig.d.ts.map

package/dist/handlers/internal/multisig.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"multisig.d.ts","sourceRoot":"","sources":["../../../src/handlers/internal/multisig.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAElC,OAAO,KAAK,KAAK,UAAU,MAAM,yBAAyB,CAAA;AAE1D,0GAA0G;AAC1G,eAAO,MAAM,OAAO,aAUlB,CAAA;AAEF,8DAA8D;AAC9D,wBAAgB,SAAS,CAAC,KAAK,EAAE,UAAU,CAAC,KAAK,GAAG,KAAK,CAAC,MAAM,CAiB/D"}

package/dist/internal/ZoneKeyApproval.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"ZoneKeyApproval.d.ts","sourceRoot":"","sources":["../../src/internal/ZoneKeyApproval.ts"],"names":[],"mappings":"AAEA,0EAA0E;AAC1E,eAAO,MAAM,MAAM,IAAI,CAAA;AAEvB,+GAA+G;AAC/G,eAAO,MAAM,gBAAgB,QAAuB,CAAA;AAEpD,yEAAyE;AACzE,wBAAgB,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAE3D;AAED,sFAAsF;AACtF,MAAM,MAAM,MAAM,GAAG;IACnB,0DAA0D;IAC1D,KAAK,EAAE,MAAM,CAAA;IACb,6EAA6E;IAC7E,QAAQ,EAAE,OAAO,CAAA;IACjB,gEAAgE;IAChE,SAAS,EAAE,MAAM,CAAA;IACjB,6EAA6E;IAC7E,EAAE,EAAE,MAAM,CAAA;CACX,CAAA;AAED,0EAA0E;AAC1E,wBAAgB,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,IAAI,MAAM,CAE1E;AAED,4DAA4D;AAC5D,MAAM,MAAM,MAAM,GAAG;IACnB,oDAAoD;IACpD,MAAM,EAAE,OAAO,CAAA;IACf,2DAA2D;IAC3D,QAAQ,EAAE,OAAO,CAAA;IACjB,+BAA+B;IAC/B,EAAE,EAAE,MAAM,CAAA;CACX,CAAA;AAED,8FAA8F;AAC9F,MAAM,MAAM,MAAM,GAAG,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,KAAK,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAA;AAE3E,+EAA+E;AAC/E,qBAAa,aAAc,SAAQ,KAAK;IAC7B,IAAI,SAAkC;IAC/C,YACE,OAAO,SAAmG,EAG3G;CACF"}

package/dist/internal/ZoneKeyApproval.js

@@ -1,21 +0,0 @@
-import * as Scope from '../Scope.js';
-/** Number of independent approvals required for Zone read credentials. */
-export const quorum = 2;
-/** Maximum lifetime of an approval, matching the request lifetime and bounded by its authenticated session. */
-export const approvalLifetime = 24 * 60 * 60 * 1_000;
-/** Returns whether scopes grant access subject to Zone read approval. */
-export function required(scopes) {
-    return scopes.some((scope) => scope === '*' || Scope.parseZone(scope)?.verb === 'read');
-}
-/** Returns whether an authenticated identity's session is still valid. */
-export function active(member) {
-    return Boolean(member?.id && member.email && Date.parse(member.expiresAt) > Date.now());
-}
-/** Expected rejection of a Zone key request or an unapproved issuance path. */
-export class RequiredError extends Error {
-    name = 'ZoneKeyApproval.RequiredError';
-    constructor(message = 'Zone read keys require two independent group approvals through the admin key-request workflow.') {
-        super(message);
-    }
-}
-//# sourceMappingURL=ZoneKeyApproval.js.map

package/dist/internal/ZoneKeyApproval.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"ZoneKeyApproval.js","sourceRoot":"","sources":["../../src/internal/ZoneKeyApproval.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,aAAa,CAAA;AAEpC,0EAA0E;AAC1E,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,CAAA;AAEvB,+GAA+G;AAC/G,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,CAAA;AAEpD,yEAAyE;AACzE,MAAM,UAAU,QAAQ,CAAC,MAAyB;IAChD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,GAAG,IAAI,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,IAAI,KAAK,MAAM,CAAC,CAAA;AACzF,CAAC;AAcD,0EAA0E;AAC1E,MAAM,UAAU,MAAM,CAAC,MAAiC;IACtD,OAAO,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;AACzF,CAAC;AAeD,+EAA+E;AAC/E,MAAM,OAAO,aAAc,SAAQ,KAAK;IAC7B,IAAI,GAAG,+BAA+B,CAAA;IAC/C,YACE,OAAO,GAAG,gGAAgG;QAE1G,KAAK,CAAC,OAAO,CAAC,CAAA;IAChB,CAAC;CACF"}

package/src/admin/apps/zone-key-requests.test.ts

@@ -1,272 +0,0 @@
-import * as ApiKeys from '../../ApiKeys.js'
-import * as Metrics from '../../Metrics.js'
-import * as Organizations from '../../db/tables/organizations.js'
-import * as Requests from '../../db/tables/zoneKeyRequests.js'
-import type * as ZoneKeyApproval from '../../internal/ZoneKeyApproval.js'
-import * as TestAdmin from '../../../test/Admin.js'
-
-describe('zoneKeyRequests', () => {
-  test('a lookup outage blocks issuance, preserves the request, and emits the failure metric', async () => {
-    const member = employee('requester', false)
-    const counts: Parameters<Metrics.Metrics['count']>[] = []
-    const { app, db, store } = TestAdmin.setup({
-      identify: () => member,
-      metrics: Metrics.from({
-        count(...parameters) {
-          counts.push(parameters)
-        },
-        flush() {},
-        gauge() {},
-        histogram() {},
-      }),
-      zoneKeyApproval: {
-        groupId,
-        identify: () => member,
-        lookup: async () => {
-          await fetch('http://127.0.0.1:1/unavailable')
-          return []
-        },
-      },
-    })
-    const org = await Organizations.create(db, { name: 'Zone outage' })
-    const request = await Requests.create(db, {
-      groupId,
-      input: { name: 'Zone read', orgId: org.id, scopes: ['zone:421700001:read'] },
-      requester: member,
-    })
-    for (const id of ['first', 'second'])
-      await Requests.approve(db, { groupId, id: request.id, lookup, member: employee(id, true) })
-    const response = await app.request(`/zone-key-requests/${request.id}/issue`, { method: 'POST' })
-    expect(response.status).toBe(502)
-    expect((await Requests.get(db, request.id))?.status).toBe('pending')
-    expect(await ApiKeys.list(store)).toEqual([])
-    expect(counts.filter(([name]) => name === 'zone_key_approval_failure_count')).toEqual([
-      ['zone_key_approval_failure_count', 1],
-    ])
-    expect((await app.request('/api-keys')).status).toBe(200)
-  })
-
-  test('ordinary staff retain general administration and can request but cannot approve Zone keys', async () => {
-    const member = employee('requester', false)
-    const { app, db, store } = TestAdmin.setup({
-      identify: () => member,
-      zoneKeyApproval: { lookup: (_request, ids) => lookup(ids), groupId, identify: () => member },
-    })
-    for (const path of ['/api-keys', '/organizations', '/audit-logs'])
-      expect((await app.request(path)).status).toBe(200)
-    const ordinary = await app.request('/api-keys', {
-      body: JSON.stringify({ name: 'Ordinary key', scopes: ['data:read'] }),
-      headers: { 'content-type': 'application/json' },
-      method: 'POST',
-    })
-    expect(ordinary.status).toBe(200)
-    const org = await Organizations.create(db, { name: 'Zone requester' })
-    const input = { name: 'Zone read', orgId: org.id, scopes: ['zone:421700001:read'] }
-    const created = await app.request('/zone-key-requests', {
-      body: JSON.stringify(input),
-      headers: { 'content-type': 'application/json' },
-      method: 'POST',
-    })
-    expect(created.status).toBe(201)
-    const request = await created.json()
-    const path = `/zone-key-requests/${request.id}`
-    expect((await app.request(`${path}/approve`, { method: 'POST' })).status).toBe(403)
-    expect((await app.request(`${path}/issue`, { method: 'POST' })).status).toBe(403)
-    const nonmember = employee('nonmember', false)
-    const { app: nonmemberApp } = TestAdmin.setup({
-      db,
-      identify: () => nonmember,
-      zoneKeyApproval: {
-        lookup: (_request, ids) => lookup(ids),
-        groupId,
-        identify: () => nonmember,
-      },
-    })
-    expect((await nonmemberApp.request(`${path}/approve`, { method: 'POST' })).status).toBe(403)
-    for (const id of ['first', 'second']) {
-      const reviewer = employee(id, true)
-      const { app: review } = TestAdmin.setup({
-        db,
-        identify: () => reviewer,
-        zoneKeyApproval: {
-          lookup: (_request, ids) => lookup(ids),
-          groupId,
-          identify: () => reviewer,
-        },
-      })
-      expect((await review.request(path)).status).toBe(200)
-      expect((await review.request(`${path}/approve`, { method: 'POST' })).status).toBe(200)
-      expect((await review.request(`${path}/issue`, { method: 'POST' })).status).toBe(403)
-    }
-    const issued = await app.request(`${path}/issue`, { method: 'POST' })
-    expect(issued.status).toBe(200)
-    const key = await issued.json()
-    expect(key.scopes).toEqual(input.scopes)
-    expect((await ApiKeys.resolve(store, key.token))?.id).toBe(key.id)
-    expect((await app.request(`${path}/issue`, { method: 'POST' })).status).toBe(403)
-    expect((await Requests.get(db, request.id))?.status).toBe('issued')
-    expect((await app.request(`/api-keys/${key.id}`, { method: 'DELETE' })).status).toBe(200)
-    expect(await ApiKeys.resolve(store, key.token)).toBeNull()
-  })
-
-  test('rejects missing, mismatched, and expired workflow identities without blocking other routes', async () => {
-    for (const member of [
-      null,
-      employee('different', true),
-      { ...employee('admin', true), expiresAt: new Date().toISOString() },
-    ]) {
-      const { app } = TestAdmin.setup({
-        zoneKeyApproval: {
-          lookup: (_request, ids) => lookup(ids),
-          groupId,
-          identify: () => member,
-        },
-      })
-      expect((await app.request('/zone-key-requests')).status).toBe(401)
-      expect((await app.request('/api-keys')).status).toBe(200)
-    }
-  })
-
-  test('requires admin authentication and fails closed until configured', async () => {
-    const anonymous = TestAdmin.setup({ identify: () => null })
-    expect((await anonymous.app.request('/zone-key-requests')).status).toBe(401)
-    const { app } = TestAdmin.setup()
-    const response = await app.request('/zone-key-requests')
-    expect(response.status).toBe(503)
-    expect((await response.json()).error.code).toBe('zone_key_approval_unconfigured')
-  })
-
-  test('requires a verified internal session for the approval workflow', async () => {
-    const { app } = TestAdmin.setup({
-      zoneKeyApproval: {
-        lookup: (_request, ids) => lookup(ids),
-        groupId: 'app-tempo-api-zone-issuers',
-        identify: () => null,
-      },
-    })
-    expect((await app.request('/zone-key-requests')).status).toBe(401)
-  })
-
-  test('pages through every request newest first', async () => {
-    const member = employee('requester', false)
-    const { app, db } = TestAdmin.setup({
-      identify: () => member,
-      zoneKeyApproval: { groupId, identify: () => member, lookup: (_request, ids) => lookup(ids) },
-    })
-    const created = []
-    for (let index = 0; index < 51; index++)
-      created.push(
-        await Requests.create(db, {
-          groupId,
-          input: {
-            name: `Zone read ${index}`,
-            orgId: 'org_fixture',
-            scopes: ['zone:421700001:read'],
-          },
-          requester: member,
-        }),
-      )
-    const first = await (await app.request('/zone-key-requests')).json()
-    expect(first.data).toHaveLength(50)
-    expect(first.nextCursor).toEqual(expect.any(String))
-    const second = await (
-      await app.request(`/zone-key-requests?cursor=${encodeURIComponent(first.nextCursor)}`)
-    ).json()
-    expect(second.nextCursor).toBeNull()
-    expect(
-      [...first.data, ...second.data].map((request: { id: string }) => request.id).sort(),
-    ).toEqual(created.map((request) => request.id).sort())
-    expect((await app.request('/zone-key-requests?cursor=invalid')).status).toBe(400)
-  })
-
-  test('reports approver group membership in the bootstrap config', async () => {
-    const counts: Parameters<Metrics.Metrics['count']>[] = []
-    const cases: readonly [ZoneKeyIdentify, boolean | null][] = [
-      [() => employee('approver', true), true],
-      [() => employee('approver', false), false],
-      [() => employee('approver', true, -1), false],
-      [() => ({ ...employee('approver', true), email: 'other@tempo.xyz' }), false],
-      [() => null, false],
-      [
-        () => {
-          throw new Error('not authenticated')
-        },
-        null,
-      ],
-    ]
-    for (const [identify, expected] of cases) {
-      const { app } = TestAdmin.setup({
-        identify: () => ({ email: 'approver@tempo.xyz' }),
-        metrics: Metrics.from({
-          count(...parameters) {
-            counts.push(parameters)
-          },
-          flush() {},
-          gauge() {},
-          histogram() {},
-        }),
-        zoneKeyApproval: { groupId, identify, lookup: (_request, ids) => lookup(ids) },
-      })
-      const config = await (await app.request('/config.json')).json()
-      expect(config.auth.zoneKeyApprover).toBe(expected)
-    }
-    expect(counts.filter(([name]) => name === 'zone_key_approval_failure_count')).toEqual([
-      ['zone_key_approval_failure_count', 1],
-    ])
-  })
-
-  test('rejects cross-origin approval mutations', async () => {
-    const { app } = TestAdmin.setup()
-    const response = await app.request('/zone-key-requests/zkr_fixture/approve', {
-      headers: { origin: 'https://other.example' },
-      method: 'POST',
-    })
-    expect(response.status).toBe(403)
-    expect((await response.json()).error.code).toBe('forbidden')
-  })
-
-  test('direct admin creation, rotation, and elevation cannot grant protected scopes', async () => {
-    const { app, store } = TestAdmin.setup()
-    for (const scopes of [['zone:421700001:read'], ['*']]) {
-      const response = await app.request('/api-keys', {
-        body: JSON.stringify({ name: 'Protected', scopes }),
-        headers: { 'content-type': 'application/json' },
-        method: 'POST',
-      })
-      expect(response.status).toBe(403)
-      expect((await response.json()).error.code).toBe('zone_key_approval_required')
-    }
-    const source = await ApiKeys.mint(store, { scopes: ['zone:421700001:read'] })
-    const rotation = await app.request(`/api-keys/${source.record.id}/rotate`, { method: 'POST' })
-    expect(rotation.status).toBe(403)
-    const unprivileged = await ApiKeys.mint(store, { scopes: ['data:read'] })
-    const update = await app.request(`/api-keys/${unprivileged.record.id}`, {
-      body: JSON.stringify({ scopes: ['zone:421700001:read'] }),
-      headers: { 'content-type': 'application/json' },
-      method: 'PATCH',
-    })
-    expect(update.status).toBe(403)
-    expect((await ApiKeys.get(store, unprivileged.record.id))?.scopes).toEqual(['data:read'])
-  })
-})
-
-const groupId = 'app-tempo-api-zone-issuers'
-
-type ZoneKeyIdentify = () => ZoneKeyApproval.Member | null
-
-function employee(id: string, eligible: boolean, hours = 1): ZoneKeyApproval.Member {
-  return {
-    email: `${id}@tempo.xyz`,
-    eligible,
-    expiresAt: new Date(Date.now() + hours * 3_600_000).toISOString(),
-    id: `employee_${id}`,
-  }
-}
-
-async function lookup(ids: readonly string[]): Promise<ZoneKeyApproval.Status[]> {
-  return ids.map((id) => ({
-    active: true,
-    eligible: id !== 'employee_requester' && id !== 'employee_nonmember',
-    id,
-  }))
-}