tapimo 0.19.0 → 0.20.0

package/src/ApiKeys.ts

@@ -22,10 +22,10 @@ import * as ApiKeyRevocations from './db/tables/apiKeyRevocations.js'
 import * as Organizations from './db/tables/organizations.js'
 import * as RoutesPolicies from './db/tables/routesPolicies.js'
 import * as RoutesSubsidies from './db/tables/routesSubsidies.js'
+import * as ZoneDelegations from './db/tables/zoneDelegations.js'
 import * as Store from './internal/Store.js'
 import * as Scope from './Scope.js'
-import * as ZoneKeyApproval from './internal/ZoneKeyApproval.js'
-import * as ZoneKeyRequests from './db/tables/zoneKeyRequests.js'
+import * as Schema from './internal/Schema.js'
 
 const billingSnapshotSchema = z.object({
   active: z.boolean().check(z.describe('Whether billing is active.')),
@@ -44,7 +44,7 @@ export const minimumExpiryLeadMs = 2 * 60_000
 /** Zod schemas owned by the API-keys module. */
 export namespace schema {
   /** Key expiry requested through an API, far enough ahead that the stored record outlives the request. */
-  export const ExpiresAt = z.iso.datetime({ offset: true }).check(
+  export const ExpiresAt = Schema.dateTime({ offset: true }).check(
     z.refine((value) => Date.parse(value) >= Date.now() + minimumExpiryLeadMs, {
       error: 'Expiry must be at least two minutes in the future.',
     }),
@@ -62,7 +62,7 @@ export namespace schema {
       .optional(z.string())
       .check(z.describe('Identity creating the key (e.g. admin email), recorded for audit.')),
     expiresAt: z
-      .optional(z.iso.datetime({ offset: true }))
+      .optional(Schema.dateTime({ offset: true }))
       .check(z.describe('ISO 8601 expiry timestamp. Omit for a non-expiring key.')),
     // TODO: make required once orgs exist.
     orgId: z.optional(z.string()).check(z.describe('Owning organization id.')),
@@ -175,14 +175,12 @@ export async function mintBounded(
   input: MintInput,
   options: mintBounded.Options = {},
 ): Promise<MintResult> {
-  if (ZoneKeyApproval.required(input.scopes)) throw new ZoneKeyApproval.RequiredError()
   return mintAdmitted(db, state, input, options)
 }
 
 /**
  * Mints a replacement for an existing key on behalf of its owner. The locked source
- * must still hold every requested scope, so rotation never widens access and needs no
- * Zone read approval; admin rotation keeps using {@link mintBounded} and its gate.
+ * must still hold every requested scope, so rotation never widens access.
  */
 export async function rotateBounded(
   db: Db.Db,
@@ -190,7 +188,7 @@ export async function rotateBounded(
   input: MintInput,
   options: rotateBounded.Options,
 ): Promise<MintResult> {
-  return mintAdmitted(db, state, input, { ...options, sourceScopes: input.scopes })
+  return mintAdmitted(db, state, input, { ...options, sourceScopes: withoutRetired(input.scopes) })
 }
 
 export declare namespace rotateBounded {
@@ -198,45 +196,23 @@ export declare namespace rotateBounded {
   type Options = mint.Options & Required<Pick<mint.Options, 'policySourceApiKeyId'>>
 }
 
-/** Issues the exact approved settings once using the requester session and unexpired approvals. */
-export async function mintApproved(
-  db: Db.Db,
-  state: Store.State,
-  options: mintApproved.Options,
-): Promise<MintResult> {
-  const request = await ZoneKeyRequests.claim(db, options)
-  try {
-    const result = await mintAdmitted(db, state, request.input, {}, request.keyId)
-    await ZoneKeyRequests.finish(db, request.id, 'issued')
-    return result
-  } catch (cause) {
-    // An ambiguous write never permits another issuance; fence the reserved id before cleanup.
-    await db.transaction(async (tx) => {
-      await ApiKeyAdmissions.lock(tx, request.keyId)
-      await ApiKeyRevocations.markPending(tx, request.keyId, request.input.orgId)
-    })
-    await ZoneKeyRequests.finish(db, request.id, 'failed')
-    await revokeBounded(db, state, request.keyId).catch(() => undefined)
-    throw cause
-  }
-}
-
-export declare namespace mintApproved {
-  /** Authenticated issuance context. */
-  type Options = ZoneKeyRequests.claim.Options
-}
-
 async function mintAdmitted(
   db: Db.Db,
   state: Store.State,
-  input: MintInput,
+  input_raw: MintInput,
   options: mintBounded.Options = {},
   id = ApiKey.generateId(),
 ): Promise<MintResult> {
   if (options.sourceScopes && !options.policySourceApiKeyId)
     throw new RoutesPolicies.InvalidScopeError()
+  // A copy of an existing key (rotation) drops the retired per-Zone scopes the source still holds.
+  const input = options.policySourceApiKeyId
+    ? { ...input_raw, scopes: withoutRetired(input_raw.scopes) }
+    : input_raw
   if (input.orgId === undefined) {
     if (options.policySourceApiKeyId) throw new RoutesPolicies.InvalidScopeError()
+    // No organization means no delegation, so nothing could bound the key's broadcasts.
+    if (boundByDelegations(input.scopes)) throw new UndelegatedZoneTagsError()
     return mint(state, input, options)
   }
   const orgId = input.orgId
@@ -269,14 +245,26 @@ async function mintAdmitted(
         ...rest
       } = validated
       const expiry = earliestExpiry(expiresAt, source.expiresAt)
+      // A broadcasting copy keeps only the tags still delegated, so a revoked delegation narrows the
+      // replacement instead of blocking the rotation; the gate refuses undelegated Zones anyway.
+      const zoneTags = boundByDelegations(rest.scopes)
+        ? await delegatedTags(tx, {
+            environment: rest.environment,
+            orgId,
+            zoneTags: source.zoneTags,
+          })
+        : source.zoneTags
       return {
         ...rest,
         allowedIps: source.allowedIps,
         ...(expiry === undefined ? {} : { expiresAt: expiry }),
         ...(source.rateLimits === undefined ? {} : { rateLimits: source.rateLimits }),
-        ...(source.zoneTags === undefined ? {} : { zoneTags: source.zoneTags }),
+        ...(zoneTags === undefined ? {} : { zoneTags }),
       }
     })()
+    // Requested tags are what bound a broadcasting key, so they are checked as written; a copy's were narrowed above.
+    if (!options.policySourceApiKeyId && boundByDelegations(data.scopes))
+      await ensureDelegatedTags(tx, { environment: data.environment, orgId, zoneTags: data.zoneTags }) // prettier-ignore
     // Policy copies share deletion's subsidy-before-owner lock order.
     if (options.policySourceApiKeyId) await RoutesSubsidies.lockOrganization(tx, orgId)
     const owner = { orgId, projectId: data.projectId }
@@ -712,6 +700,14 @@ export async function update(
   if (!recordKey) return null
   const record = await read(state, recordKey, Date.now(), options.scopeCatalog ?? Scope.catalog)
   if (!record) return null
+  // Scopes the record already holds republish as they are; only new grants must be issuable.
+  if (
+    input.scopes &&
+    !issuableScopes(input.scopes.filter((scope) => !record.scopes.includes(scope)), options.scopeCatalog ?? Scope.catalog) // prettier-ignore
+  )
+    throw new InvalidInputError(
+      'per-Zone scopes are retired; grant zone:read or zone:write with zoneTags',
+    )
   const owner = {
     orgId: input.orgId ?? record.orgId,
     projectId: input.projectId ?? record.projectId,
@@ -792,15 +788,21 @@ export async function updateBounded(
       )
         return { type: 'missing' } as const
       const pendingScopes = ledger.admitted?.pendingScopes
-      // A reviewed credential accepts only an earlier expiry, or its first organization while it
-      // still owns itself, without a new reviewed issuance.
-      const protectedKey =
-        ZoneKeyApproval.required(record.scopes) || ZoneKeyApproval.required(pendingScopes ?? [])
+      // Scopes still awaiting publication count, so a tag edit in that window is bounded too.
+      const scopes = input.scopes ?? pendingScopes ?? record.scopes
+      // A key that broadcasts through `zone:write` keeps every tag inside its organization's delegations.
       if (
-        ZoneKeyApproval.required(input.scopes ?? []) ||
-        (protectedKey && !shortens(record, input) && !adopts(record, input))
+        boundByDelegations(scopes) &&
+        (attributing || input.scopes !== undefined || input.zoneTags !== undefined)
       )
-        throw new ZoneKeyApproval.RequiredError()
+        await ensureDelegatedTags(tx, {
+          environment: record.environment,
+          orgId: input.orgId ?? record.orgId,
+          zoneTags:
+            input.zoneTags === undefined
+              ? record.zoneTags
+              : (Input.parseNullable(ApiKey.schema.ZoneTags, input.zoneTags) ?? undefined),
+        })
       const expiresAt = normalizeExpiresAt(
         input.expiresAt === undefined ? record.expiresAt : (input.expiresAt ?? undefined),
       )
@@ -848,10 +850,11 @@ export async function updateBounded(
       if (reassigning) {
         // Fail closed across the KV/SQL boundary. The key remains scope-less if
         // clearing, reassignment, or the eventual SQL commit fails.
+        // Retired read scopes are inert once the rewrite ran, so a move to a new organization drops them.
         await ApiKeyAdmissions.setPendingScopes(
           tx,
           id,
-          input.scopes ?? pendingScopes ?? record.scopes,
+          withoutRetired(input.scopes ?? pendingScopes ?? record.scopes),
         )
         const disabled = await update(state, id, { scopes: [] }, options)
         if (!disabled) return { type: 'missing' } as const
@@ -902,22 +905,6 @@ export declare namespace updateBounded {
   }
 }
 
-/** Whether an edit only gives a key minted before organizations existed its organization and changes nothing else. */
-function adopts(record: Record, input: update.Input) {
-  if (record.orgId !== record.id) return false
-  const { orgId, projectId: _projectId, ...rest } = input
-  if (Object.values(rest).some((value) => value !== undefined)) return false
-  return orgId !== undefined
-}
-
-/** Whether an edit only moves a key's expiry earlier and changes nothing else. */
-function shortens(record: Record, input: update.Input) {
-  const { expiresAt, ...rest } = input
-  if (Object.values(rest).some((value) => value !== undefined)) return false
-  if (expiresAt == null) return false
-  return record.expiresAt === undefined || Date.parse(expiresAt) <= Date.parse(record.expiresAt)
-}
-
 /** Returns the earliest of the given ISO timestamps, ignoring absent ones. */
 export function earliestExpiry(...values: readonly (string | undefined)[]) {
   return values
@@ -1115,6 +1102,176 @@ export declare namespace backfill {
   }
 }
 
+/**
+ * Plans the additive rewrite of stored per-Zone read scopes: `zone:read` and
+ * the chain ids as tags are added beside them, merged with existing tags, so
+ * the running Worker and the next both admit the record. Wildcard keys are
+ * listed and left alone; nothing is written. Admission today ignores tags and
+ * already treats a per-Zone read scope as `zone:read`, so the rewrite changes no decision.
+ */
+export async function planZoneReadRewrite(
+  state: Store.State,
+  options: planZoneReadRewrite.Options = {},
+): Promise<planZoneReadRewrite.Result> {
+  const scopeCatalog = options.scopeCatalog ?? Scope.catalog
+  const { keys } = await state.list({ prefix: ApiKey.recordPrefix })
+  const now = Date.now()
+  const changes: planZoneReadRewrite.Change[] = []
+  const expiring: Record[] = []
+  const invalid: Record[] = []
+  const mixed: Record[] = []
+  const tagless: Record[] = []
+  const wildcard: Record[] = []
+  let unreadableRecords = 0
+  let live = 0
+  for (const { name } of keys) {
+    const record = await read(state, name, now, scopeCatalog)
+    if (!record) {
+      unreadableRecords += 1
+      continue
+    }
+    // Revocation and owner-deletion fences live under their own keys; a fenced record is never rewritten.
+    if (await isFenced(state, record)) continue
+    live += 1
+    if (record.scopes.includes(Scope.wildcard)) {
+      wildcard.push(record)
+      continue
+    }
+    // One record the schema refuses (say, past the tag limit) is reported, never a reason to abort the plan.
+    const change = (() => {
+      try {
+        return rewriteZoneRead(record, options.zones)
+      } catch {
+        return 'invalid' as const
+      }
+    })()
+    if (change === 'invalid') invalid.push(record)
+    else if (change === 'mixed') mixed.push(record)
+    // KV refuses TTLs under a minute, and such a record expires on its own before anyone uses it.
+    else if (change && !change.complete && expiresSoon(record, now)) expiring.push(record)
+    else if (change) changes.push({ ...change, record, recordKey: name })
+    else if (['zone:read', 'zone:write'].some((scope) => record.scopes.includes(scope)) && !record.zoneTags?.length) tagless.push(record) // prettier-ignore
+  }
+  return { changes, expiring, invalid, keys: live, mixed, tagless, unreadableRecords, wildcard }
+}
+
+/**
+ * The record with `zone:read` and tags added beside its per-Zone read scopes,
+ * so Workers of either release admit it; undefined when it holds no such scope.
+ * A record already carrying both is `complete`: still planned, so its
+ * delegations are checked, but never written. Zones outside `zones` earn no tag
+ * and lose any they had, since nothing serves them. `mixed` when its write Zones
+ * differ from its read Zones: one tag list cannot express both, so the key is
+ * re-minted by hand instead.
+ */
+function rewriteZoneRead(record: Record, zones: ReadonlySet<number> | undefined) {
+  const named = [...new Set(record.scopes.flatMap((scope) => Scope.zoneReadChainId(scope) ?? []))].sort((a, b) => a - b) // prettier-ignore
+  const written = [...new Set(record.scopes.flatMap((scope) => Scope.zoneWriteChainId(scope) ?? []))].sort((a, b) => a - b) // prettier-ignore
+  if (named.length === 0 && written.length === 0) return undefined
+  // Zones nothing serves earn no tag, so they are dropped from tags and scopes alike before the
+  // read and write sets are compared. Tags serve both verbs: what the key reads (tags plus read
+  // Zones) must equal what it writes (write Zones, plus its tags when it already holds the generic
+  // write scope), or it is `mixed`; otherwise a read Zone or a leftover tag would become a broadcast grant.
+  const served = (chainIds: readonly number[]) => chainIds.filter((chainId) => zones?.has(chainId) ?? true) // prettier-ignore
+  const kept = served(record.zoneTags ?? [])
+  const chainIds = served(named)
+  const writeChainIds = served(written)
+  const read = new Set([...kept, ...chainIds])
+  const writes = new Set(record.scopes.includes('zone:write') ? [...kept, ...writeChainIds] : writeChainIds) // prettier-ignore
+  const bounded = read.size > 0 || record.scopes.includes('zone:read')
+  if (writes.size && bounded && (writes.size !== read.size || [...writes].some((chainId) => !read.has(chainId)))) return 'mixed' as const // prettier-ignore
+  const all = [...new Set([...named, ...written])]
+  const unconfigured = all.filter((chainId) => !(zones?.has(chainId) ?? true)).sort((a, b) => a - b) // prettier-ignore
+  const zoneTags = [...new Set([...kept, ...chainIds, ...writeChainIds])].sort((a, b) => a - b)
+  // A generic scope is added only when a served Zone for that verb survives into the tags.
+  const generic = [
+    ...(chainIds.length && !record.scopes.includes('zone:read') ? ['zone:read'] : []),
+    ...(writeChainIds.length && !record.scopes.includes('zone:write') ? ['zone:write'] : []),
+  ]
+  const complete =
+    generic.length === 0 &&
+    zoneTags.length === (record.zoneTags?.length ?? 0) &&
+    zoneTags.every((chainId, index) => record.zoneTags?.[index] === chainId)
+  const rewritten = complete ? record : schema.Record.parse({ ...record, scopes: [...record.scopes, ...generic], zoneTags }) // prettier-ignore
+  return { chainIds, complete, rewritten, unconfigured, writeChainIds }
+}
+
+export declare namespace planZoneReadRewrite {
+  /** Options for {@link planZoneReadRewrite}. */
+  type Options = {
+    /** Scope catalog accepted while reading keys. */
+    scopeCatalog?: Scope.Catalog | undefined
+    /** Zone chain ids the deployment serves; per-Zone scopes naming any other Zone earn no tag. */
+    zones?: ReadonlySet<number> | undefined
+  }
+
+  /** One stored record and the record replacing it. */
+  type Change = {
+    /** Served Zones the per-Zone read scopes name, alias-resolved; the only Zones the rewrite may delegate. */
+    chainIds: readonly number[]
+    /** Whether the record already holds `zone:read` and every tag; only its delegations are checked, nothing is written. */
+    complete: boolean
+    /** The record as stored. */
+    record: Record
+    /** Storage key of the record. */
+    recordKey: string
+    /** The record with the generic Zone scopes and merged tags added beside its per-Zone scopes. */
+    rewritten: Record
+    /** Zones the per-Zone scopes name that the deployment does not serve; they earn no tag. */
+    unconfigured: readonly number[]
+    /** Served Zones the per-Zone write scopes name, alias-resolved; they need a delegation to bound the tag, never member coverage. */
+    writeChainIds: readonly number[]
+  }
+
+  /** Result of {@link planZoneReadRewrite}. */
+  type Result = {
+    /** Records holding per-Zone read scopes, with their replacements. */
+    changes: readonly Change[]
+    /** Records expiring within a minute; KV refuses their TTL and they lapse on their own, so they are left unchanged. */
+    expiring: readonly Record[]
+    /** Records whose rewritten form the schema refuses; left unchanged for a manual fix. */
+    invalid: readonly Record[]
+    /** Live, unfenced records read. */
+    keys: number
+    /** Records whose per-Zone write Zones differ from their read Zones; one tag list cannot express both, so they are re-minted by hand. */
+    mixed: readonly Record[]
+    /** Records holding `zone:read` with no tags and no per-Zone scope; they read no Zone and are left alone. */
+    tagless: readonly Record[]
+    /** Records the store could not read (expired, or scopes outside the catalog). */
+    unreadableRecords: number
+    /** Live records holding `*`, listed for a decision and left unchanged. */
+    wildcard: readonly Record[]
+  }
+}
+
+/**
+ * Rewrites the records a {@link planZoneReadRewrite} plan names, keeping each
+ * record's TTL. Each record is re-read and transformed at write time so an edit
+ * made since the plan survives; a record already in both formats is skipped.
+ */
+export async function applyZoneReadRewrite(
+  state: Store.State,
+  changes: readonly planZoneReadRewrite.Change[],
+  options: planZoneReadRewrite.Options = {},
+): Promise<number> {
+  let written = 0
+  for (const { recordKey } of changes) {
+    const now = Date.now()
+    const current = await read(state, recordKey, now, options.scopeCatalog ?? Scope.catalog)
+    const change = current && rewriteZoneRead(current, options.zones)
+    if (!change || change === 'mixed' || change.complete || expiresSoon(current, now)) continue
+    await state.put(recordKey, JSON.stringify(change.rewritten), { ttl: ttlFor(change.rewritten.expiresAt, now) }) // prettier-ignore
+    written += 1
+  }
+  return written
+}
+
+/** Whether a record expires within the minute Cloudflare KV needs for a TTL. */
+function expiresSoon(record: Record, now: number): boolean {
+  const ttl = ttlFor(record.expiresAt, now)
+  return ttl !== undefined && ttl < 60_000
+}
+
 /**
  * Reads and validates a stored record by storage key. Invalid, corrupt, or
  * expired records (`expiresAt <= now`) resolve to `null`.
@@ -1228,8 +1385,12 @@ function validateMintInput(
 ): z.output<typeof schema.MintInput> {
   const valid = schema.MintInput.safeParse(input)
   if (!valid.success) throw new InvalidInputError(z.prettifyError(valid.error))
-  if (!validScopes(valid.data.scopes, options.scopeCatalog ?? Scope.catalog))
-    throw new InvalidInputError('unknown scope')
+  const scopeCatalog = options.scopeCatalog ?? Scope.catalog
+  if (!validScopes(valid.data.scopes, scopeCatalog)) throw new InvalidInputError('unknown scope')
+  if (!issuableScopes(valid.data.scopes, scopeCatalog))
+    throw new InvalidInputError(
+      'per-Zone scopes are retired; grant zone:read or zone:write with zoneTags',
+    )
   return {
     ...valid.data,
     ...(valid.data.expiresAt === undefined
@@ -1289,6 +1450,66 @@ function validScopes(scopes: readonly string[], scopeCatalog: Scope.Catalog): bo
   return scopes.every((scope) => scope === Scope.wildcard || Scope.includes(scopeCatalog, scope))
 }
 
+function issuableScopes(scopes: readonly string[], scopeCatalog: Scope.Catalog): boolean {
+  return scopes.every((scope) => scope === Scope.wildcard || Scope.issuable(scopeCatalog, scope))
+}
+
+/** Drops retired per-Zone scopes a copied or republished key still holds; the rewrite has tagged it, so they grant nothing new. */
+function withoutRetired(scopes: readonly Scope.Id[]): readonly Scope.Id[] {
+  return scopes.filter((scope) => Scope.parseZone(scope) === undefined)
+}
+
+/** Whether scopes broadcast through the generic Zone write scope, whose tags delegations bound. */
+function boundByDelegations(scopes: readonly string[]): boolean {
+  return scopes.includes('zone:write')
+}
+
+/**
+ * Refuses tags naming Zones the organization is not delegated in the key's
+ * environment. Broadcasts never check accounts or tokens, so the delegation's
+ * existence is what bounds a `zone:write` key; self-serve read keys are held
+ * to the same bound by the management routes.
+ */
+export async function ensureDelegatedTags(db: Db.Db, options: ensureDelegatedTags.Options) {
+  const { environment = 'production', orgId, zoneTags } = options
+  if (!zoneTags?.length) throw new UndelegatedZoneTagsError()
+  const delegated = await delegatedZones(db, { environment, orgId })
+  const undelegated = zoneTags.filter((chainId) => !delegated.has(chainId))
+  if (undelegated.length) throw new UndelegatedZoneTagsError(undelegated)
+}
+
+/** The tags among `zoneTags` whose Zone the organization is still delegated; undefined when none remain. */
+async function delegatedTags(
+  db: Db.Db,
+  options: ensureDelegatedTags.Options,
+): Promise<readonly number[] | undefined> {
+  const { environment = 'production', orgId, zoneTags } = options
+  if (!zoneTags?.length) return undefined
+  const delegated = await delegatedZones(db, { environment, orgId })
+  const kept = zoneTags.filter((chainId) => delegated.has(chainId))
+  return kept.length ? kept : undefined
+}
+
+/** Chain ids of the organization's active delegations in one environment. */
+async function delegatedZones(
+  db: Db.Db,
+  owner: ZoneDelegations.Owner,
+): Promise<ReadonlySet<number>> {
+  return new Set((await ZoneDelegations.listActive(db, owner)).map(({ chainId }) => chainId))
+}
+
+export declare namespace ensureDelegatedTags {
+  /** Key owner and tags to check. */
+  type Options = {
+    /** Key environment; delegations are per environment. */
+    environment?: ApiKey.ApiKey['environment'] | undefined
+    /** Owning organization id. */
+    orgId: string
+    /** Tags the key would carry. */
+    zoneTags?: readonly number[] | undefined
+  }
+}
+
 /** Storage-key prefix for the `id → recordKey` index. */
 const idPrefix = 'apikey_id:'
 
@@ -1429,6 +1650,18 @@ export class InvalidInputError extends Error {
   }
 }
 
+/** Thrown when a Zone key would carry tags outside its organization's active delegations. */
+export class UndelegatedZoneTagsError extends InvalidInputError {
+  override name = 'ApiKeys.UndelegatedZoneTagsError'
+  constructor(chainIds: readonly number[] = []) {
+    super(
+      chainIds.length
+        ? `\`zoneTags\` name Zones the organization is not delegated: ${chainIds.join(', ')}`
+        : 'Zone scopes require `zoneTags` naming Zones the organization is delegated',
+    )
+  }
+}
+
 /** Thrown when an API key owner is being deleted or is already deleted. */
 export class OwnerDeletedError extends Error {
   override name = 'ApiKeys.OwnerDeletedError'

package/src/App.ts

@@ -362,14 +362,13 @@ export function create<const path extends string = '/'>(options: create.Options<
         }),
       }),
   )
-  // The shadow Zone delegation decision settles once the handler returns, or
-  // once the deadline below gives up on it, so the log entry carries it either
-  // way; it never changes the response.
+  // Every Zone decision is metered once the handler returns, after later
+  // refusals (quota, sandbox, method allowlist) applied to the recorded grant.
   base.use('*', async (c, next) => {
     try {
       await next()
     } finally {
-      await ZoneAccess.settle(c)
+      ZoneAccess.settle(c)
     }
   })
 
@@ -495,7 +494,7 @@ export function create<const path extends string = '/'>(options: create.Options<
       // Reads and writes split by HTTP method; a write scope never reads Zone data.
       // Recorded before workload identity runs so a refusal keeps its Zone attribution.
       const method = c.req.method.toUpperCase()
-      const access = ZoneAccess.authorize(c, {
+      const access = await ZoneAccess.authorize(c, {
         chainId,
         verb: method === 'GET' || method === 'HEAD' ? 'read' : 'write',
       })