tapimo 0.19.0 → 0.20.0

package/src/admin/apps/zone-delegation-requests.ts

@@ -0,0 +1,240 @@
+import { type Context, Hono } from 'hono'
+import * as z from 'zod/mini'
+
+import * as Db from '../../db/Db.js'
+import * as Organizations from '../../db/tables/organizations.js'
+import * as ZoneDelegationRequests from '../../db/tables/zoneDelegationRequests.js'
+import * as ZoneDelegations from '../../db/tables/zoneDelegations.js'
+import * as Cursor from '../../internal/Cursor.js'
+import * as OpenApi from '../../internal/OpenApi.js'
+import * as Response from '../../internal/Response.js'
+import * as ZoneDelegationApproval from '../../internal/ZoneDelegationApproval.js'
+import type * as App from '../App.js'
+import * as Delegations from './zone-delegations.js'
+
+/** Request schemas for the Zone delegation approval workflow. */
+namespace schema {
+  export const Query = z.object({
+    cursor: z
+      .optional(
+        z.string().check(
+          z.maxLength(512),
+          z.refine((value) => Boolean(Cursor.decode(value, ['timestamp', 'id']))),
+        ),
+      )
+      .check(
+        z.describe('Next-page cursor from a prior response.'),
+        z.meta({ examples: [Cursor.encode(['2026-01-01T00:00:00.000Z', 'zdr_example'])] }),
+      ),
+  })
+  export const Params = z.object({
+    id: z
+      .string()
+      .check(z.regex(/^zdr_[A-Za-z0-9_-]+$/), z.describe('Zone delegation request identifier.')),
+  })
+}
+
+/** Mounts authenticated request, review, approval, application, and cancellation operations. */
+export function zoneDelegationRequests() {
+  return new Hono<App.Environment>()
+    .use('*', async (c, next) => {
+      const config = c.get('delegationApproval')
+      if (!config?.groupId || !config.lookup)
+        return Response.error(c, {
+          code: 'zone_delegation_approval_unconfigured',
+          message: 'The internal identity approver group is not configured.',
+          status: 503,
+        })
+      try {
+        const member = await config.identify(c.req.raw, c)
+        if (
+          !ZoneDelegationApproval.active(member) ||
+          member.email.toLowerCase() !== c.get('identity')?.email.toLowerCase()
+        )
+          return Response.error(c, {
+            code: 'unauthorized',
+            message: 'A verified internal identity session is required.',
+            status: 401,
+          })
+        c.set('approver', member)
+        await next()
+        if (c.error) throw c.error
+        return
+      } catch (cause) {
+        if (cause instanceof ZoneDelegationApproval.RequiredError) {
+          c.res = Response.error(c, {
+            code: 'zone_delegation_approval_required',
+            message: cause.message,
+            status: 403,
+          })
+          return c.res
+        }
+        c.get('metrics')?.count('zone_delegation_approval_failure_count', 1)
+        // Downstream errors may already have finalized Hono's response.
+        c.res = Response.upstream(c, cause)
+        return c.res
+      }
+    })
+    .post(
+      '/',
+      OpenApi.validate('json', Delegations.schema.Body, {
+        code: 'body_invalid',
+        // Two member lists of 1,000 addresses.
+        maxBytes: 256 * 1_024,
+        message: 'Invalid delegation request.',
+      }),
+      OpenApi.describeRoute({
+        description: 'File a new delegation for two-approver review. Widening an active delegation is revoking it and filing a new one.', // prettier-ignore
+        operationId: 'createZoneDelegationRequest',
+        responses: {
+          201: { description: 'The pending Zone delegation request.' },
+          404: { description: 'Organization not found.' },
+        },
+        summary: 'Request Zone delegation',
+        tags: ['Zone Delegation Requests'],
+      }),
+      async (c) => {
+        const config = c.get('delegationApproval')!
+        const input = c.req.valid('json')
+        const db = Db.get(c.get('db'))
+        if (!(await Organizations.get(db, input.orgId))) return notFound(c)
+        const request = await ZoneDelegationRequests.create(db, {
+          groupId: config.groupId,
+          input,
+          requester: c.get('approver'),
+        })
+        return c.json(request, 201)
+      },
+    )
+    .get(
+      '/',
+      OpenApi.validate('query', schema.Query, {
+        code: 'query_invalid',
+        message: 'Invalid request cursor.',
+      }),
+      OpenApi.describeRoute({
+        operationId: 'listZoneDelegationRequests',
+        responses: { 200: { description: 'A page of Zone delegation requests, newest first.' } },
+        summary: 'List delegation requests',
+        tags: ['Zone Delegation Requests'],
+      }),
+      async (c) =>
+        c.json(await ZoneDelegationRequests.list(Db.get(c.get('db')), c.req.valid('query')), 200),
+    )
+    .get(
+      '/:id',
+      OpenApi.validate('param', schema.Params, {
+        code: 'param_invalid',
+        message: 'Invalid request id.',
+      }),
+      OpenApi.describeRoute({
+        operationId: 'getZoneDelegationRequest',
+        responses: { 200: { description: 'The Zone delegation request with its approvals.' } },
+        summary: 'Get delegation request',
+        tags: ['Zone Delegation Requests'],
+      }),
+      async (c) => {
+        const request = await ZoneDelegationRequests.get(Db.get(c.get('db')), c.req.valid('param').id) // prettier-ignore
+        if (!request)
+          return Response.error(c, {
+            code: 'not_found',
+            message: 'Request not found.',
+            status: 404,
+          })
+        return c.json(request, 200)
+      },
+    )
+    .post(
+      '/:id/approve',
+      OpenApi.validate('param', schema.Params, {
+        code: 'param_invalid',
+        message: 'Invalid request id.',
+      }),
+      OpenApi.describeRoute({
+        operationId: 'approveZoneDelegationRequest',
+        responses: { 200: { description: 'The request with the recorded approval.' } },
+        summary: 'Approve delegation request',
+        tags: ['Zone Delegation Requests'],
+      }),
+      async (c) => {
+        const request = await ZoneDelegationRequests.approve(Db.get(c.get('db')), {
+          groupId: c.get('delegationApproval')!.groupId,
+          id: c.req.valid('param').id,
+          lookup: (ids) => c.get('delegationApproval')!.lookup(c.req.raw, ids),
+          member: c.get('approver'),
+        })
+        return c.json(request, 200)
+      },
+    )
+    .post(
+      '/:id/apply',
+      OpenApi.validate('param', schema.Params, {
+        code: 'param_invalid',
+        message: 'Invalid request id.',
+      }),
+      OpenApi.describeRoute({
+        operationId: 'applyZoneDelegationRequest',
+        responses: OpenApi.responses({
+          errors: { 409: 'An active delegation already covers this Zone.' },
+          success: { description: 'The created delegation.', schema: Delegations.schema.Response },
+        }),
+        summary: 'Apply delegation request',
+        tags: ['Zone Delegation Requests'],
+      }),
+      async (c) => {
+        const db = Db.get(c.get('db'))
+        const request = await ZoneDelegationRequests.claim(db, {
+          groupId: c.get('delegationApproval')!.groupId,
+          id: c.req.valid('param').id,
+          lookup: (ids) => c.get('delegationApproval')!.lookup(c.req.raw, ids),
+          member: c.get('approver'),
+        })
+        try {
+          const data = await ZoneDelegations.create(db, request.input)
+          await ZoneDelegationRequests.finish(db, request.id, { delegationId: data.id, status: 'applied' }) // prettier-ignore
+          return c.json(Response.validated(Delegations.schema.Response, { data }), 200)
+        } catch (cause) {
+          // A consumed claim is never replayed: the requester files a new request.
+          await ZoneDelegationRequests.finish(db, request.id, { status: 'failed' })
+          if (cause instanceof ZoneDelegations.ConflictError)
+            return Response.error(c, {
+              code: 'zone_delegation_exists',
+              message: 'An active delegation already covers this organization, environment, and Zone.', // prettier-ignore
+              status: 409,
+            })
+          throw cause
+        }
+      },
+    )
+    .delete(
+      '/:id',
+      OpenApi.validate('param', schema.Params, {
+        code: 'param_invalid',
+        message: 'Invalid request id.',
+      }),
+      OpenApi.describeRoute({
+        operationId: 'cancelZoneDelegationRequest',
+        responses: { 200: { description: 'The cancelled Zone delegation request.' } },
+        summary: 'Cancel delegation request',
+        tags: ['Zone Delegation Requests'],
+      }),
+      async (c) => {
+        const request = await ZoneDelegationRequests.cancel(Db.get(c.get('db')), c.req.valid('param').id) // prettier-ignore
+        if (!request)
+          return Response.error(c, {
+            code: 'not_found',
+            message: 'Pending request not found.',
+            status: 404,
+          })
+        return c.json(request, 200)
+      },
+    )
+}
+
+function notFound(c: Context<App.Environment>) {
+  return Response.error(c, {
+    code: 'not_found',
+    message: 'Organization not found.',
+    status: 404,
+  })
+}

package/src/admin/apps/zone-delegations.test.ts

@@ -1,9 +1,11 @@
 import * as TestAdmin from '../../../test/Admin.js'
 import * as TestApp from '../../../test/App.js'
 import * as ApiKey from '../../ApiKey.js'
+import * as ApiKeys from '../../ApiKeys.js'
 import * as AuditLogs from '../../db/tables/adminAuditLogs.js'
 import * as Organizations from '../../db/tables/organizations.js'
 import * as Projects from '../../db/tables/projects.js'
+import * as ZoneDelegationsTable from '../../db/tables/zoneDelegations.js'
 import * as ZoneDelegations from './zone-delegations.js'
 
 const chainId = 421_700_001
@@ -16,31 +18,29 @@ describe('zoneDelegations', () => {
     expect((await client['zone-delegations'].$get({ query: {} })).status).toBe(401)
   })
 
-  test('creates, lists, updates, and revokes a delegation with audit entries', async () => {
+  test('lists, narrows, and revokes a delegation with audit entries; widening needs approval', async () => {
     const { client, db } = TestAdmin.setup()
     const organization = await Organizations.create(db, { name: 'Delegated' })
-    const project = await Projects.create(db, { name: 'Checkout', orgId: organization.id })
     const body = {
       accounts: [`0x${'AB'.repeat(20)}` as const],
       accountsAll: false,
       chainId,
       environment: 'production' as const,
       orgId: organization.id,
-      projects: [project.id],
       tokensAll: true,
     }
 
+    // Creation only lands through an approved request.
     const created = await client['zone-delegations'].$post({ json: body })
-    expect(created.status).toBe(200)
-    const { data } = await TestApp.json(created, ZoneDelegations.schema.Response)
+    expect(created.status).toBe(403)
+    expect(await created.json()).toMatchObject({ error: { code: 'zone_delegation_approval_required' } }) // prettier-ignore
+    const data = await ZoneDelegationsTable.create(db, body)
+    await ZoneDelegationsTable.create(db, { ...body, chainId: chainId + 1 })
     expect(stable(data)).toMatchInlineSnapshot(`
       {
         "accountsAll": false,
         "chainId": 421700001,
         "environment": "production",
-        "projects": [
-          "prj",
-        ],
         "tokensAll": true,
       }
     `)
@@ -51,10 +51,6 @@ describe('zoneDelegations', () => {
     const tokens = await client['zone-delegations'][':id'].tokens.$get({ param: { id: data.id }, query: {} }) // prettier-ignore
     expect((await TestApp.json(tokens, ZoneDelegations.schema.MembersResponse)).all).toBe(true)
 
-    // A second active delegation for the same Zone conflicts; another Zone is free.
-    expect((await client['zone-delegations'].$post({ json: body })).status).toBe(409)
-    expect((await client['zone-delegations'].$post({ json: { ...body, chainId: chainId + 1 } })).status).toBe(200) // prettier-ignore
-
     const listed = await client['zone-delegations'].$get({
       query: { environment: 'production', orgId: organization.id },
     })
@@ -63,12 +59,14 @@ describe('zoneDelegations', () => {
     const filtered = await client['zone-delegations'].$get({ query: { chainId: String(chainId) } })
     expect((await TestApp.json(filtered, ZoneDelegations.schema.ListResponse)).data).toHaveLength(1)
 
+    // Widening edits are refused (revoke and request anew); narrowing ones apply.
+    expect((await client['zone-delegations'][':id'].$patch({ json: { accountsAll: true }, param: { id: data.id } })).status).toBe(403) // prettier-ignore
     const patched = await client['zone-delegations'][':id'].$patch({
-      json: { accountsAll: true, projects: 'all' },
+      json: { tokensAll: false },
       param: { id: data.id },
     })
     expect(patched.status).toBe(200)
-    expect((await TestApp.json(patched, ZoneDelegations.schema.Response)).data).toMatchObject({ accountsAll: true, id: data.id, projects: 'all' }) // prettier-ignore
+    expect((await TestApp.json(patched, ZoneDelegations.schema.Response)).data).toMatchObject({ id: data.id, tokensAll: false }) // prettier-ignore
     expect((await client['zone-delegations'][':id'].$patch({ json: {}, param: { id: data.id } })).status).toBe(400) // prettier-ignore
 
     const revoked = await client['zone-delegations'][':id'].$delete({ param: { id: data.id } })
@@ -79,11 +77,6 @@ describe('zoneDelegations', () => {
     const fetched = await client['zone-delegations'][':id'].$get({ param: { id: data.id } })
     expect((await TestApp.json(fetched, ZoneDelegations.schema.Response)).data.revokedAt).toBeDefined() // prettier-ignore
 
-    // The freed slot accepts a new delegation under a new id.
-    const next = await client['zone-delegations'].$post({ json: { ...body, accounts: undefined, accountsAll: true } }) // prettier-ignore
-    expect(next.status).toBe(200)
-    expect((await TestApp.json(next, ZoneDelegations.schema.Response)).data.id).not.toBe(data.id)
-
     // Both the exact and the wildcard protected path match the collection, so dedupe by request.
     const audit = await AuditLogs.list(db, { path: '/zone-delegations' })
     const seen = new Set<string>()
@@ -93,44 +86,41 @@ describe('zoneDelegations', () => {
         .map(({ method, status }) => `${method} ${status}`),
     ).toMatchInlineSnapshot(`
       [
-        "POST 200",
         "GET 200",
         "PATCH 409",
         "DELETE 404",
         "DELETE 200",
         "PATCH 400",
         "PATCH 200",
+        "PATCH 403",
         "GET 200",
         "GET 200",
-        "POST 200",
-        "POST 409",
         "GET 200",
         "GET 200",
-        "POST 200",
+        "POST 403",
       ]
     `)
   })
 
-  test('adds, lists, and removes account and token members', async () => {
+  test('adds, lists, and removes members under an all flag; listed members only grow through approval', async () => {
     const { client, db } = TestAdmin.setup()
     const organization = await Organizations.create(db, { name: 'Members' })
-    const created = await client['zone-delegations'].$post({
-      json: { accountsAll: false, chainId, environment: 'production', orgId: organization.id, projects: 'all', tokensAll: false }, // prettier-ignore
-    })
-    const { data } = await TestApp.json(created, ZoneDelegations.schema.Response)
+    const data = await ZoneDelegationsTable.create(db, { accountsAll: true, chainId, environment: 'production', orgId: organization.id, tokensAll: false, tokens: [other] }) // prettier-ignore
     const param = { id: data.id }
+    // Members under `all` are inert, so adding them widens nothing.
     const added = await client['zone-delegations'][':id'].accounts.$post({ json: { addresses: [`0x${'AB'.repeat(20)}`, other] }, param }) // prettier-ignore
     expect(added.status).toBe(200)
     const addedBody = await TestApp.json(added, ZoneDelegations.schema.MembersResponse)
-    expect([addedBody.all, addedBody.data.map(({ address }) => address).sort()]).toEqual([false, [account, other]]) // prettier-ignore
+    expect([addedBody.all, addedBody.data.map(({ address }) => address).sort()]).toEqual([true, [account, other]]) // prettier-ignore
     const removed = await client['zone-delegations'][':id'].accounts.$delete({ json: { addresses: [other] }, param }) // prettier-ignore
     expect(await TestApp.json(removed, ZoneDelegations.schema.RemovedResponse)).toEqual({ data: [other] }) // prettier-ignore
     const accounts = await client['zone-delegations'][':id'].accounts.$get({ param, query: {} })
     expect((await TestApp.json(accounts, ZoneDelegations.schema.MembersResponse)).data.map(({ address }) => address)).toEqual([account]) // prettier-ignore
 
-    const tokens = await client['zone-delegations'][':id'].tokens.$post({ json: { addresses: [other] }, param }) // prettier-ignore
-    expect(tokens.status).toBe(200)
-    expect((await TestApp.json(await client['zone-delegations'][':id'].tokens.$get({ param, query: {} }), ZoneDelegations.schema.MembersResponse)).data.map(({ address }) => address)).toEqual([other]) // prettier-ignore
+    // A listed token set grows only through a new approved delegation; removal stays open.
+    expect((await client['zone-delegations'][':id'].tokens.$post({ json: { addresses: [account] }, param })).status).toBe(403) // prettier-ignore
+    expect(await TestApp.json(await client['zone-delegations'][':id'].tokens.$delete({ json: { addresses: [other] }, param }), ZoneDelegations.schema.RemovedResponse)).toEqual({ data: [other] }) // prettier-ignore
+    expect((await TestApp.json(await client['zone-delegations'][':id'].tokens.$get({ param, query: {} }), ZoneDelegations.schema.MembersResponse)).data).toEqual([]) // prettier-ignore
 
     expect((await client['zone-delegations'][':id'].accounts.$post({ json: { addresses: [] }, param })).status).toBe(400) // prettier-ignore
     expect((await client['zone-delegations'][':id'].accounts.$post({ json: { addresses: ['0xnope' as never] }, param })).status).toBe(400) // prettier-ignore
@@ -175,11 +165,7 @@ describe('zoneDelegations', () => {
     const plan = await TestApp.json(planned, ZoneDelegations.schema.BackfillPlan)
     expect({
       ...plan,
-      delegations: plan.delegations.map((d) => ({
-        ...d,
-        orgId: 'org',
-        projects: d.projects === 'all' ? d.projects : d.projects.map((id) => id.split('_')[0]),
-      })),
+      delegations: plan.delegations.map((d) => ({ ...d, orgId: 'org' })),
       wildcard: plan.wildcard.map((k) => ({ ...k, orgId: 'org' })),
     }).toMatchInlineSnapshot(`
       {
@@ -189,7 +175,6 @@ describe('zoneDelegations', () => {
             "chainId": 421700004,
             "environment": "production",
             "orgId": "org",
-            "projects": "all",
             "tokensAll": true,
           },
           {
@@ -197,7 +182,6 @@ describe('zoneDelegations', () => {
             "chainId": 421700001,
             "environment": "production",
             "orgId": "org",
-            "projects": "all",
             "tokensAll": true,
           },
         ],
@@ -233,38 +217,214 @@ describe('zoneDelegations', () => {
     expect(rows.map(({ chainId, orgId }) => ({ chainId, owner: orgId.split('_')[0] })).sort((a, b) => a.chainId - b.chainId)).toEqual([{ chainId, owner: 'org' }, { chainId: chainId + 3, owner: 'key' }]) // prettier-ignore
   })
 
-  test('refuses unknown organizations, foreign projects, and malformed addresses', async () => {
+  test('plans and applies the per-Zone read scope rewrite', async () => {
+    // Three hosted Zones; anything else a scope names is unconfigured.
+    const { client, db, store } = TestAdmin.setup({
+      zones: [0, 1, 2].map((offset) => TestApp.zone({ chainId: chainId + offset, rpcUrl: 'https://zone.rpc.test' })), // prettier-ignore
+    })
+    const organization = await Organizations.create(db, { name: 'Rewritten' })
+    const whole = { accountsAll: true, environment: 'production', orgId: organization.id, tokensAll: true } as const // prettier-ignore
+    await ZoneDelegationsTable.create(db, { ...whole, chainId })
+    const record = (id: string, token: string, extra: Record<string, unknown>) =>
+      store.put(
+        ApiKey.keyFor(token),
+        JSON.stringify({ createdAt: '2026-01-01T00:00:00.000Z', environment: 'production', id, orgId: organization.id, tokenLast4: token.slice(-4), ...extra }), // prettier-ignore
+      )
+    await record('key_reader', 'secret_reader', { scopes: ['data:read', `zone:${chainId}:read`, `zone:${chainId + 1}:read`] }) // prettier-ignore
+    // Hand-added tags never earn a delegation; sibling project keys share one Zone slot.
+    const project = await Projects.create(db, { name: 'Checkout', orgId: organization.id })
+    await record('key_tagged', 'secret_tagged', { projectId: project.id, scopes: [`zone:${chainId + 1}:read`], zoneTags: [chainId + 2] }) // prettier-ignore
+    await record('key_wild', 'secret_wild', { name: 'Integration', scopes: ['*'] })
+    await record('key_orphan', 'secret_orphan', { orgId: 'key_orphan', scopes: [`zone:${chainId}:read`] }) // prettier-ignore
+    await record('key_plain', 'secret_plain', { scopes: ['data:read'] })
+    await record('key_mixed', 'secret_mixed', { scopes: [`zone:${chainId}:read`, `zone:${chainId + 1}:write`] }) // prettier-ignore
+    // Already in both formats: its missing delegation is still ensured, the record is left alone.
+    await record('key_done', 'secret_done', { scopes: [`zone:${chainId + 2}:read`, 'zone:read'], zoneTags: [chainId + 2] }) // prettier-ignore
+    // A scope naming a Zone nothing serves earns no tag, and its delegation goes with it.
+    await record('key_stale', 'secret_stale', { scopes: [`zone:${chainId}:read`, `zone:${chainId + 9}:read`] }) // prettier-ignore
+    const stale = await ZoneDelegationsTable.create(db, { ...whole, chainId: chainId + 9 })
+    await record('key_tagless', 'secret_tagless', { scopes: ['data:read', 'zone:read'] })
+
+    const planned = await client['zone-delegations']['rewrite-keys'].$get()
+    expect(planned.status).toBe(200)
+    const plan = await TestApp.json(planned, ZoneDelegations.schema.RewritePlan)
+    const anonymize = (key: { orgId: string; projectId?: string | undefined }) => ({ ...key, orgId: key.orgId.split('_')[0], ...(key.projectId ? { projectId: 'prj' } : {}) }) // prettier-ignore
+    expect({
+      ...plan,
+      changes: plan.changes.map(anonymize),
+      mixed: plan.mixed.map(anonymize),
+      orgless: plan.orgless.map(anonymize),
+      tagless: plan.tagless.map(anonymize),
+      wildcard: plan.wildcard.map(anonymize),
+    }).toMatchInlineSnapshot(`
+      {
+        "changes": [
+          {
+            "complete": true,
+            "environment": "production",
+            "id": "key_done",
+            "orgId": "org",
+            "revoked": [],
+            "scopes": [
+              "zone:421700003:read",
+              "zone:read",
+            ],
+            "undelegated": [
+              421700003,
+            ],
+            "zoneTags": [
+              421700003,
+            ],
+          },
+          {
+            "complete": false,
+            "environment": "production",
+            "id": "key_reader",
+            "orgId": "org",
+            "revoked": [],
+            "scopes": [
+              "data:read",
+              "zone:421700001:read",
+              "zone:421700002:read",
+              "zone:read",
+            ],
+            "undelegated": [
+              421700002,
+            ],
+            "zoneTags": [
+              421700001,
+              421700002,
+            ],
+          },
+          {
+            "complete": false,
+            "environment": "production",
+            "id": "key_tagged",
+            "orgId": "org",
+            "projectId": "prj",
+            "revoked": [],
+            "scopes": [
+              "zone:421700002:read",
+              "zone:read",
+            ],
+            "undelegated": [
+              421700002,
+            ],
+            "zoneTags": [
+              421700002,
+              421700003,
+            ],
+          },
+          {
+            "complete": false,
+            "environment": "production",
+            "id": "key_stale",
+            "orgId": "org",
+            "revoked": [],
+            "scopes": [
+              "zone:421700001:read",
+              "zone:421700010:read",
+              "zone:read",
+            ],
+            "undelegated": [],
+            "zoneTags": [
+              421700001,
+            ],
+          },
+        ],
+        "expiring": [],
+        "invalid": [],
+        "keys": 9,
+        "mixed": [
+          {
+            "environment": "production",
+            "id": "key_mixed",
+            "orgId": "org",
+          },
+        ],
+        "narrow": [],
+        "orgless": [
+          {
+            "environment": "production",
+            "id": "key_orphan",
+            "orgId": "key",
+          },
+        ],
+        "revoked": [],
+        "tagless": [
+          {
+            "environment": "production",
+            "id": "key_tagless",
+            "orgId": "org",
+          },
+        ],
+        "unconfigured": [
+          421700010,
+        ],
+        "unreadableRecords": 0,
+        "wildcard": [
+          {
+            "environment": "production",
+            "id": "key_wild",
+            "name": "Integration",
+            "orgId": "org",
+          },
+        ],
+      }
+    `)
+    expect((await ApiKeys.resolve(store, 'secret_reader'))?.scopes).toEqual(['data:read', `zone:${chainId}:read`, `zone:${chainId + 1}:read`]) // prettier-ignore
+
+    // A delegation listing members would narrow a whole-Zone reader, so apply refuses before writing.
+    const listed = await ZoneDelegationsTable.create(db, { ...whole, accountsAll: false, chainId: chainId + 1 }) // prettier-ignore
+    const refused = await client['zone-delegations']['rewrite-keys'].$post()
+    expect(refused.status).toBe(400)
+    expect(await refused.json()).toMatchObject({ error: { code: 'zone_delegations_narrow' } })
+    expect((await ApiKeys.resolve(store, 'secret_reader'))?.zoneTags).toBeUndefined()
+    expect((await TestApp.json(await client['zone-delegations']['rewrite-keys'].$get(), ZoneDelegations.schema.RewritePlan)).narrow.map(({ id }) => id)).toEqual([listed.id]) // prettier-ignore
+    // Revoking it is an admin decision the rewrite must not undo: keys reading that Zone are reported and left alone.
+    await ZoneDelegationsTable.revoke(db, listed.id)
+
+    const applied = await client['zone-delegations']['rewrite-keys'].$post()
+    expect(applied.status).toBe(200)
+    const result = await TestApp.json(applied, ZoneDelegations.schema.RewriteApplied)
+    // The complete key's missing slot is ensured without writing its record; the two keys reading the revoked slot are reported and left unwritten.
+    expect([result.createdDelegations, result.revokedDelegations, result.rewritten]).toEqual([1, 1, 1]) // prettier-ignore
+    expect(result.changes.map(({ id, revoked, undelegated }) => [id, undelegated, revoked] as const).sort(([a], [b]) => a.localeCompare(b))).toEqual([['key_done', [], []], ['key_reader', [chainId + 1], [chainId + 1]], ['key_stale', [], []], ['key_tagged', [chainId + 1], [chainId + 1]]]) // prettier-ignore
+    expect(result.revoked.map(({ id }) => id)).toEqual([listed.id])
+    expect(await ApiKeys.resolve(store, 'secret_done')).toMatchObject({ scopes: [`zone:${chainId + 2}:read`, 'zone:read'], zoneTags: [chainId + 2] }) // prettier-ignore
+    expect((await ZoneDelegationsTable.get(db, stale.id))?.revokedAt).toBeDefined()
+    expect(await ApiKeys.resolve(store, 'secret_stale')).toMatchObject({ scopes: [`zone:${chainId}:read`, `zone:${chainId + 9}:read`, 'zone:read'], zoneTags: [chainId] }) // prettier-ignore
+    expect((await ApiKeys.resolve(store, 'secret_tagless'))?.scopes).toEqual(['data:read', 'zone:read']) // prettier-ignore
+    expect(await ApiKeys.resolve(store, 'secret_tagged')).toMatchObject({ scopes: [`zone:${chainId + 1}:read`], zoneTags: [chainId + 2] }) // prettier-ignore
+    expect(result.orgless.map(({ id }) => id)).toEqual(['key_orphan'])
+    expect((await ApiKeys.resolve(store, 'secret_orphan'))?.scopes).toEqual([`zone:${chainId}:read`]) // prettier-ignore
+    expect((await ApiKeys.resolve(store, 'secret_mixed'))?.zoneTags).toBeUndefined()
+    expect((await ApiKeys.resolve(store, 'secret_reader'))?.zoneTags).toBeUndefined()
+    const again = await TestApp.json(await client['zone-delegations']['rewrite-keys'].$post(), ZoneDelegations.schema.RewriteApplied) // prettier-ignore
+    // The rerun keeps showing the two blocked keys until an admin delegates the Zone again.
+    expect([again.rewritten, again.createdDelegations, again.revokedDelegations, again.changes.filter(({ complete }) => !complete).map(({ id }) => id).sort(), again.revoked.length]).toEqual([0, 0, 0, ['key_reader', 'key_tagged'], 1]) // prettier-ignore
+  })
+
+  test('refuses unknown organizations and malformed addresses', async () => {
     const { client, db } = TestAdmin.setup()
     const organization = await Organizations.create(db, { name: 'Owner' })
-    const otherOrganization = await Organizations.create(db, { name: 'Other' })
-    const foreign = await Projects.create(db, { name: 'Foreign', orgId: otherOrganization.id })
     const body = {
       accountsAll: true,
       chainId,
       environment: 'sandbox',
       orgId: organization.id,
-      projects: 'all',
       tokensAll: true,
     } as const
     expect((await client['zone-delegations'].$post({ json: { ...body, orgId: 'org_missing' } })).status).toBe(404) // prettier-ignore
-    expect((await client['zone-delegations'].$post({ json: { ...body, projects: [foreign.id] } })).status).toBe(404) // prettier-ignore
     expect((await client['zone-delegations'].$post({ json: { ...body, accounts: ['0xnope'] as never } })).status).toBe(400) // prettier-ignore
     expect((await client['zone-delegations'][':id'].$get({ param: { id: 'zd_missing' } })).status).toBe(404) // prettier-ignore
-    const created = await client['zone-delegations'].$post({ json: body })
-    const { data } = await TestApp.json(created, ZoneDelegations.schema.Response)
-    expect((await client['zone-delegations'][':id'].$patch({ json: { projects: [foreign.id] }, param: { id: data.id } })).status).toBe(404) // prettier-ignore
+    // The retired `projects` field is no longer part of the contract.
+    expect((await client['zone-delegations'].$post({ json: { ...body, projects: 'all' } as never })).status).toBe(400) // prettier-ignore
   })
 })
 
-/** Drops generated ids and timestamps; project ids keep their prefix only. */
-function stable(record: {
-  createdAt: string
-  id: string
-  updatedAt: string
-  orgId: string
-  projects: 'all' | readonly string[]
-}) {
-  // prettier-ignore
-  const { createdAt: _c, id: _i, orgId: _o, projects, updatedAt: _u, ...rest } = record
-  return { ...rest, projects: projects === 'all' ? projects : projects.map((id) => id.split('_')[0]) } // prettier-ignore
+/** Drops generated ids and timestamps. */
+function stable(record: { createdAt: string; id: string; updatedAt: string; orgId: string }) {
+  const { createdAt: _c, id: _i, orgId: _o, updatedAt: _u, ...rest } = record
+  return rest
 }