tapimo 0.19.0 → 0.20.0

package/src/admin/apps/zone-delegations.ts

@@ -3,13 +3,14 @@ import * as z from 'zod/mini'
 
 import * as Db from '../../db/Db.js'
 import * as Organizations from '../../db/tables/organizations.js'
-import * as Projects from '../../db/tables/projects.js'
 import * as ZoneDelegations from '../../db/tables/zoneDelegations.js'
 import * as OpenApi from '../../internal/OpenApi.js'
 import * as Response from '../../internal/Response.js'
 import * as Schema from '../../internal/Schema.js'
 import * as ZoneDelegation from '../../internal/ZoneDelegation.js'
+import * as ZoneDelegationApproval from '../../internal/ZoneDelegationApproval.js'
 import * as ZoneDelegationBackfill from '../../internal/ZoneDelegationBackfill.js'
+import * as ZoneKeyRewrite from '../../internal/ZoneKeyRewrite.js'
 import type * as App from '../App.js'
 
 /** Request and response schemas for organization Zone delegations and their members. */
@@ -60,14 +61,12 @@ export namespace schema {
     chainId: Schema.ChainId,
     environment: ZoneDelegation.schema.Environment,
     orgId: OrgId,
-    projects: ZoneDelegation.schema.Projects,
     tokens: z.optional(ZoneDelegation.schema.AddressList),
     tokensAll: TokensAll,
   })
   export const Patch = z
     .strictObject({
       accountsAll: z.optional(AccountsAll),
-      projects: z.optional(ZoneDelegation.schema.Projects),
       tokensAll: z.optional(TokensAll),
     })
     .check(z.refine((patch) => Object.keys(patch).length > 0, 'At least one field is required.'))
@@ -83,7 +82,6 @@ export namespace schema {
     environment: ZoneDelegation.schema.Environment,
     id: Params.shape.id,
     orgId: OwnerId,
-    projects: ZoneDelegation.schema.Projects,
     revokedAt: z
       .optional(z.string())
       .check(
@@ -107,7 +105,6 @@ export namespace schema {
           chainId: Schema.ChainId,
           environment: ZoneDelegation.schema.Environment,
           orgId: OwnerId,
-          projects: ZoneDelegation.schema.Projects,
           tokensAll: z.literal(true),
         }),
       )
@@ -145,6 +142,73 @@ export namespace schema {
       .number()
       .check(z.describe('Slots already holding a delegation, left untouched.'), z.meta({ examples: [0] })), // prettier-ignore
   })
+  const RewriteKey = z.object({
+    environment: ZoneDelegation.schema.Environment,
+    id: z.string().check(z.describe('Key id.'), z.meta({ examples: ['key_1a2b3c4d5e6f7g8h9j0k1m2n'] })), // prettier-ignore
+    name: z.optional(z.string()).check(z.describe('Key name, when set.'), z.meta({ examples: ['Integration'] })), // prettier-ignore
+    orgId: OwnerId,
+    projectId: z.optional(z.string()).check(z.describe('Attributed project id, when any.'), z.meta({ examples: ['prj_1a2b3c4d5e6f7g8h9j0k1m2n'] })), // prettier-ignore
+  })
+  export const RewritePlan = z.object({
+    changes: z
+      .array(
+        z.extend(RewriteKey, {
+          complete: z.boolean().check(z.describe('Whether the record already holds `zone:read` and every tag; only its delegations are ensured.'), z.meta({ examples: [false] })), // prettier-ignore
+          revoked: z.array(Schema.ChainId).check(z.describe('Zones whose delegation an admin revoked; the key is left unwritten while any remain.'), z.meta({ examples: [[]] })), // prettier-ignore
+          scopes: z.array(z.string()).check(z.describe('Scopes after the rewrite.'), z.meta({ examples: [['data:read', 'zone:421700001:read', 'zone:read']] })), // prettier-ignore
+          undelegated: z.array(Schema.ChainId).check(z.describe('Zones the per-Zone scopes grant without an active delegation for the organization; applying ensures one unless the slot was revoked.'), z.meta({ examples: [[421700002]] })), // prettier-ignore
+          zoneTags: z.array(Schema.ChainId).check(z.describe('Zone chain ids the key reads after the rewrite.'), z.meta({ examples: [[421700001, 421700002]] })), // prettier-ignore
+        }),
+      )
+      .check(z.describe('Keys holding per-Zone read scopes, with the scopes and tags they will carry.'), z.meta({ examples: [[{ complete: false, environment: 'production', id: 'key_1a2b3c4d5e6f7g8h9j0k1m2n', orgId: 'org_1a2b3c4d5e6f7g8h9j0k1m2n', revoked: [], scopes: ['data:read', 'zone:421700001:read', 'zone:read'], undelegated: [], zoneTags: [421700001] }]] })), // prettier-ignore
+    expiring: z
+      .array(RewriteKey)
+      .check(z.describe('Keys expiring within a minute; they lapse on their own and are left unchanged.'), z.meta({ examples: [[]] })), // prettier-ignore
+    invalid: z
+      .array(RewriteKey)
+      .check(z.describe('Keys whose rewritten record the schema refuses; left unchanged for a manual fix.'), z.meta({ examples: [[]] })), // prettier-ignore
+    keys: z
+      .number()
+      .check(z.describe('Live, unfenced key records read.'), z.meta({ examples: [338] })),
+    mixed: z
+      .array(RewriteKey)
+      .check(z.describe('Keys whose per-Zone write Zones differ from their read Zones; one tag list cannot express both, so re-mint them by hand.'), z.meta({ examples: [[]] })), // prettier-ignore
+    narrow: z
+      .array(Delegation)
+      .check(z.describe('Active delegations for a planned Zone that list members; apply refuses until they cover the whole Zone.'), z.meta({ examples: [[]] })), // prettier-ignore
+    orgless: z
+      .array(RewriteKey)
+      .check(z.describe('Self-owned keys left unchanged; assign them an organization with `PUT /api-keys/{id}/organization` first.'), z.meta({ examples: [[]] })), // prettier-ignore
+    revoked: z
+      .array(Delegation)
+      .check(z.describe('Zone slots an admin revoked that a planned key still reads through its scope; those keys stay unwritten until an admin delegates the Zone again.'), z.meta({ examples: [[]] })), // prettier-ignore
+    tagless: z
+      .array(RewriteKey)
+      .check(z.describe('Keys holding `zone:read` without tags; they read no Zone and are listed, not changed.'), z.meta({ examples: [[]] })), // prettier-ignore
+    unconfigured: z
+      .array(Schema.ChainId)
+      .check(z.describe('Zone chain ids named by per-Zone scopes that this deployment does not serve; no tag, delegations revoked on apply.'), z.meta({ examples: [[421700005]] })), // prettier-ignore
+    unreadableRecords: z
+      .number()
+      .check(z.describe('Key records the store could not read; left unchanged.'), z.meta({ examples: [0] })), // prettier-ignore
+    wildcard: z
+      .array(RewriteKey)
+      .check(
+        z.describe('Wildcard keys, listed for an explicit decision and left unchanged.'),
+        z.meta({ examples: [[]] }),
+      ),
+  })
+  export const RewriteApplied = z.extend(RewritePlan, {
+    createdDelegations: z
+      .number()
+      .check(z.describe('Whole-Zone delegations this run created.'), z.meta({ examples: [3] })),
+    revokedDelegations: z
+      .number()
+      .check(z.describe('Active delegations for unconfigured Zones this run revoked.'), z.meta({ examples: [0] })), // prettier-ignore
+    rewritten: z
+      .number()
+      .check(z.describe('Records this run rewrote.'), z.meta({ examples: [12] })),
+  })
   export const ListResponse = z.object({
     data: z.array(Delegation).check(z.describe('Delegations, newest first.')),
   })
@@ -174,7 +238,7 @@ export namespace schema {
   })
 }
 
-/** Admin CRUD for organization-level Zone read delegations and their members; the gate only logs their decisions. */
+/** Admin CRUD for organization-level Zone read delegations and their members, which decide Zone read admission. */
 export function zoneDelegations() {
   return new Hono<App.Environment>()
     .get(
@@ -208,31 +272,18 @@ export function zoneDelegations() {
         operationId: 'createZoneDelegation',
         responses: OpenApi.responses({
           errors: {
-            404: 'Organization or project not found.',
-            409: 'An active delegation already covers this Zone.',
+            403: 'Delegations are created through the two-approver request workflow.',
+            404: 'Organization not found.',
           },
-          success: { description: 'The created delegation.', schema: schema.Response },
+          success: { description: 'Never returned; kept for the typed client.', schema: schema.Response }, // prettier-ignore
         }),
         summary: 'Create Zone delegation',
         tags: ['Zone Delegations'],
       }),
       async (c) => {
-        const input = c.req.valid('json')
-        const db = Db.get(c.get('db'))
-        if (!(await validOwner(db, input))) return notFound(c)
-        try {
-          const data = await ZoneDelegations.create(db, input)
-          return c.json(Response.validated(schema.Response, { data }), 200)
-        } catch (cause) {
-          if (cause instanceof ZoneDelegations.ConflictError)
-            return Response.error(c, {
-              code: 'zone_delegation_exists',
-              message:
-                'An active delegation already covers this organization, environment, and Zone; update or revoke it instead.',
-              status: 409,
-            })
-          throw cause
-        }
+        if (!(await Organizations.get(Db.get(c.get('db')), c.req.valid('json').orgId))) return notFound(c) // prettier-ignore
+        // Granting an organization a Zone widens access, so it only lands through an approved request.
+        return approvalRequired(c)
       },
     )
     .get(
@@ -271,6 +322,54 @@ export function zoneDelegations() {
         return c.json(Response.validated(schema.BackfillApplied, applied), 200)
       },
     )
+    .get(
+      '/rewrite-keys',
+      OpenApi.describeRoute({
+        operationId: 'planZoneKeyRewrite',
+        responses: OpenApi.responses({
+          success: {
+            description:
+              'Keys whose per-Zone read scopes would gain `zone:read` plus tags beside them.',
+            schema: schema.RewritePlan,
+          },
+        }),
+        summary: 'Plan Zone key rewrite',
+        tags: ['Zone Delegations'],
+      }),
+      async (c) => {
+        const plan = await ZoneKeyRewrite.plan({ db: Db.get(c.get('db')), store: c.get('kv').store, zones: hostedZones(c) }) // prettier-ignore
+        return c.json(Response.validated(schema.RewritePlan, plan), 200)
+      },
+    )
+    .post(
+      '/rewrite-keys',
+      OpenApi.describeRoute({
+        operationId: 'applyZoneKeyRewrite',
+        responses: OpenApi.responses({
+          errors: { 400: 'An active delegation for a planned Zone lists members; nothing was written.' }, // prettier-ignore
+          success: {
+            description:
+              'The plan after ensuring delegations and writing its keys; reruns change nothing.',
+            schema: schema.RewriteApplied,
+          },
+        }),
+        summary: 'Apply Zone key rewrite',
+        tags: ['Zone Delegations'],
+      }),
+      async (c) => {
+        const options = { db: Db.get(c.get('db')), store: c.get('kv').store, zones: hostedZones(c) }
+        try {
+          return c.json(Response.validated(schema.RewriteApplied, await ZoneKeyRewrite.apply(options)), 200) // prettier-ignore
+        } catch (error) {
+          if (!(error instanceof ZoneKeyRewrite.NarrowDelegationsError)) throw error
+          return Response.error(c, {
+            code: 'zone_delegations_narrow',
+            message: `${error.message} Delegations: ${error.rows.map(({ id }) => id).join(', ')}.`,
+            status: 400,
+          })
+        }
+      },
+    )
     .get(
       '/:id',
       OpenApi.validate('param', schema.Params, { code: 'param_invalid', message: 'Invalid id' }),
@@ -308,13 +407,8 @@ export function zoneDelegations() {
         const existing = await ZoneDelegations.get(db, c.req.valid('param').id)
         if (!existing) return notFound(c)
         if (existing.revokedAt !== undefined) return revoked(c)
-        // Only new projects are checked, so a deleted project never blocks unrelated changes.
-        if (
-          patch.projects &&
-          !(await validOwner(db, { orgId: existing.orgId, projects: patch.projects }))
-        )
-          // prettier-ignore
-          return notFound(c)
+        // Narrowing is a single-admin edit; widening is revoke plus a new delegation through the request workflow.
+        if (widens(patch)) return approvalRequired(c)
         const data = await ZoneDelegations.update(db, existing.id, patch)
         if (!data) return notFound(c)
         return c.json(Response.validated(schema.Response, { data }), 200)
@@ -388,7 +482,9 @@ function memberRoutes(kind: ZoneDelegations.Kind) {
         tags: ['Zone Delegations'],
       }),
       async (c) => {
-        const result = await ZoneDelegations.Members.add(Db.get(c.get('db')), { ...c.req.valid('json'), id: c.req.valid('param').id, kind }) // prettier-ignore
+        // A member added under a listed selection widens coverage; under `all` it stays inert.
+        const result = await ZoneDelegations.Members.addInert(Db.get(c.get('db')), { ...c.req.valid('json'), id: c.req.valid('param').id, kind }) // prettier-ignore
+        if (result.status === 'widens') return approvalRequired(c)
         if (result.status !== 'ok') return refused(c, result.status)
         return c.json(Response.validated(schema.MembersResponse, { all: result.all, data: result.data, nextCursor: null }), 200) // prettier-ignore
       },
@@ -414,19 +510,23 @@ function memberRoutes(kind: ZoneDelegations.Kind) {
     )
 }
 
-/** Whether the organization exists and every listed project belongs to it, in two concurrent statements. */
-async function validOwner(
-  db: Db.Db,
-  input: Pick<ZoneDelegations.Record, 'orgId' | 'projects'>,
-): Promise<boolean> {
-  const [organization, projects] = await Promise.all([
-    Organizations.get(db, input.orgId),
-    input.projects === 'all' ? [] : Projects.listByIds(db, input.projects),
-  ])
-  if (!organization) return false
-  if (input.projects === 'all') return true
-  const owned = new Set(projects.flatMap((project) => (project.orgId === input.orgId ? [project.id] : []))) // prettier-ignore
-  return input.projects.every((id) => owned.has(id))
+/** Chain ids of the Zones this admin deployment serves. */
+function hostedZones(c: Context<App.Environment>): ReadonlySet<number> {
+  return new Set(c.get('zones').map((zone) => zone.id))
+}
+
+/** Whether a patch could grant more than the delegation covers: a member flag set on. Decided without reading the row, so a concurrent narrowing cannot be undone. */
+function widens(patch: ZoneDelegations.update.Patch): boolean {
+  return patch.accountsAll === true || patch.tokensAll === true
+}
+
+/** The 403 every direct write that widens Zone access reports. */
+function approvalRequired(c: Context<App.Environment>) {
+  return Response.error(c, {
+    code: 'zone_delegation_approval_required',
+    message: new ZoneDelegationApproval.RequiredError().message,
+    status: 403,
+  })
 }
 
 /** The 404 or 409 a member write reports for a missing or revoked delegation. */

package/src/admin/index.ts

@@ -1,3 +1,3 @@
 export * as App from './App.js'
 export * as Mcp from './Mcp.js'
-export * as ZoneKeyApproval from '../internal/ZoneKeyApproval.js'
+export * as ZoneDelegationApproval from '../internal/ZoneDelegationApproval.js'

package/src/admin/ui/src/components/ApiKeyForm.tsx

@@ -186,7 +186,7 @@ export function readScopes(form: FormData, options: readScopes.Options = {}) {
     const value = form.get(key)
     return typeof value === 'string' ? value.trim() : ''
   }
-  const pendingZoneScopes = (['read', 'write'] as const).map((access) => {
+  const pendingZoneScopes = (['write'] as const).map((access) => {
     const chainId = field(`zoneChainId_${access}`)
     return {
       chainId,
@@ -242,8 +242,9 @@ export function ScopeFields(options: ScopeFields.Props) {
               return zoneAccess ? (
                 <ZoneScopeRow
                   access={zoneAccess}
-                  defaultScopes={options.defaultScopes.filter(
-                    (scope) => scope.startsWith('zone:') && scope.endsWith(`:${zoneAccess}`),
+                  // Only concrete per-Zone scopes belong to the template row; the generic `zone:write` is a plain checkbox.
+                  defaultScopes={options.defaultScopes.filter((scope) =>
+                    new RegExp(`^zone:\\d+:${zoneAccess}$`).test(scope),
                   )}
                   description={entry.description}
                   key={entry.scope}

package/src/admin/ui/src/lib/config.ts

@@ -6,14 +6,14 @@ import { client } from './client.js'
 /** The bootstrap contract the SPA reads from `GET config.json` once loaded. */
 export type Config = {
   auth: {
+    /** Whether the signed-in identity belongs to the delegation approver group; `null` when unknown. */
+    delegationApprover: boolean | null
     /** The signed-in admin identity, or `null` when logged out (shell is public). */
     identity: { email: string } | null
     /** Where the deployer's sign-in page lives; shown when logged out. */
     loginUrl?: string
     /** Where to send the user to sign out (e.g. Cloudflare Access logout). */
     logoutUrl?: string
-    /** Whether the signed-in identity belongs to the Zone key approver group; `null` when unknown. */
-    zoneKeyApprover: boolean | null
   }
   rewards: {
     /** Tempo chain served by the reward runner, or `null` when unavailable. */
@@ -45,7 +45,7 @@ export async function getConfig(): Promise<Config> {
   const response = await client['config.json'].$get()
   if (!response.ok)
     return {
-      auth: { identity: null, zoneKeyApprover: false },
+      auth: { delegationApprover: false, identity: null },
       rewards: { chainId: null, operatorAddress: null },
     }
   return response.json() as Promise<Config>

package/src/admin/ui/src/lib/query-client.ts

@@ -24,7 +24,7 @@ export const persistOptions: Omit<PersistQueryClientOptions, 'queryClient'> = {
       query.queryKey[0] !== 'organizations' &&
       query.queryKey[0] !== 'audit-logs' &&
       query.queryKey[0] !== 'sentinel' &&
-      query.queryKey[0] !== 'zone-key-requests' &&
+      query.queryKey[0] !== 'zone-delegation-requests' &&
       query.queryKey[0] !== 'routes-access-requests' &&
       defaultShouldDehydrateQuery(query),
   },

package/src/admin/ui/src/lib/review-queues.ts

@@ -2,10 +2,10 @@ import * as ReactQuery from '@tanstack/react-query'
 
 import * as AccessRequests from './routes-access-requests.js'
 import * as Sentinel from './sentinel.js'
-import * as ZoneKeyRequests from './zone-key-requests.js'
+import * as DelegationRequests from './zone-delegation-requests.js'
 
 /** Path of a page that holds a review queue. */
-export type Queue = '/routes/access-requests' | '/sentinel' | '/zone-key-requests'
+export type Queue = '/routes/access-requests' | '/sentinel' | '/zone-delegation-requests'
 
 /** Items waiting in one review queue; `more` marks a full first page with further pages. */
 export type Waiting =
@@ -15,12 +15,12 @@ export type Waiting =
 
 /** Waiting items in each review queue, keyed by queue path. */
 export function useWaiting(): Record<Queue, Waiting> {
-  const zone = ReactQuery.useQuery(ZoneKeyRequests.list.options())
   const sentinel = Sentinel.list.useQuery()
+  const delegations = ReactQuery.useQuery(DelegationRequests.list.options())
   const access = ReactQuery.useInfiniteQuery(AccessRequests.list.options('pending'))
   const accessPage = access.data?.pages[0]
-  const zonePending = zone.data?.data.filter(
-    (request) => ZoneKeyRequests.status(request) === 'pending',
+  const delegationsPending = delegations.data?.data.filter(
+    (request) => DelegationRequests.status(request) === 'pending',
   )
   return {
     '/routes/access-requests': accessPage
@@ -30,14 +30,14 @@ export function useWaiting(): Record<Queue, Waiting> {
       ? { count: sentinel.data.data.length, more: false, status: 'success' }
       : { status: sentinel.isError ? 'error' : 'pending' },
     // Newest-first pages mix statuses, so only an all-pending full page implies more waiting.
-    '/zone-key-requests':
-      zone.data && zonePending
+    '/zone-delegation-requests':
+      delegations.data && delegationsPending
         ? {
-            count: zonePending.length,
-            more: Boolean(zone.data.nextCursor) && zonePending.length === zone.data.data.length,
+            count: delegationsPending.length,
+            more: Boolean(delegations.data.nextCursor) && delegationsPending.length === delegations.data.data.length, // prettier-ignore
             status: 'success',
           }
-        : { status: zone.isError ? 'error' : 'pending' },
+        : { status: delegations.isError ? 'error' : 'pending' },
   }
 }
 

package/src/admin/ui/src/lib/routes-setup.test.ts

@@ -69,11 +69,10 @@ const subsidy = {
 } as const
 
 describe('keyAccess', () => {
-  it('separates keys that can be granted from ones that cannot or need nothing', () => {
+  it('separates keys that can be granted from ones that need nothing', () => {
     expect(Setup.keyAccess({ scopes: ['data:read'] })).toBe('grantable')
     expect(Setup.keyAccess({ scopes: ['data:read', 'routes:write'] })).toBe('granted')
     expect(Setup.keyAccess({ scopes: ['*'] })).toBe('granted')
-    expect(Setup.keyAccess({ scopes: ['zone:7:read'] })).toBe('locked')
   })
 })
 

package/src/admin/ui/src/lib/routes-setup.ts

@@ -2,7 +2,6 @@ import type * as Organizations from './organizations.js'
 import * as ApiKeys from './api-keys.js'
 import * as Policy from '../../../../internal/routes/Policy.js'
 import * as Policies from './route-policies.js'
-import * as ZoneKeyRequests from './zone-key-requests.js'
 
 /** Scope that lets an API key create route transfers and deposit addresses. */
 export const writeScope = 'routes:write'
@@ -47,11 +46,10 @@ export type Input = {
   }
 }
 
-/** Whether a key can receive the write scope here. */
-export function keyAccess(key: Pick<Key, 'scopes'>): 'granted' | 'grantable' | 'locked' {
+/** Whether a key already holds the write scope or can receive it here. */
+export function keyAccess(key: Pick<Key, 'scopes'>): 'granted' | 'grantable' {
   if (key.scopes.includes(writeScope) || key.scopes.includes('*')) return 'granted'
-  // Zone read keys change only through a reviewed reissue.
-  return ZoneKeyRequests.required(key.scopes) ? 'locked' : 'grantable'
+  return 'grantable'
 }
 
 /** Active keys of one environment. */

package/src/admin/ui/src/lib/scopes.test.ts

@@ -4,19 +4,16 @@ import * as Scopes from './scopes.js'
 
 describe('fromZoneChainId', () => {
   it('builds canonical Zone scopes', () => {
-    const read = Scopes.fromZoneChainId(' 000421700001 ')
     const write = Scopes.fromZoneChainId(' 000421700001 ', 'write')
 
-    expect(read).toBe('zone:421700001:read')
     expect(write).toBe('zone:421700001:write')
-    expectTypeOf(read).toEqualTypeOf<`zone:${string}:read` | undefined>()
     expectTypeOf(write).toEqualTypeOf<`zone:${string}:write` | undefined>()
   })
 
   it('rejects non-positive and malformed chain ids', () => {
-    expect(['', '0', '-1', '1.5', 'mainnet'].map((value) => Scopes.fromZoneChainId(value))).toEqual(
-      [undefined, undefined, undefined, undefined, undefined],
-    )
+    expect(
+      ['', '0', '-1', '1.5', 'mainnet'].map((value) => Scopes.fromZoneChainId(value, 'write')),
+    ).toEqual([undefined, undefined, undefined, undefined, undefined])
   })
 })
 

package/src/admin/ui/src/lib/scopes.ts

@@ -6,9 +6,8 @@ import { client } from './client.js'
 /** A single issuable API-key scope from the catalog endpoint. */
 export type Scope = InferResponseType<(typeof client)['scopes']['$get'], 200>['data'][number]
 
-/** Dynamic Zone scope templates returned by the scope catalog. */
+/** Dynamic Zone scope templates returned by the scope catalog; reads use `zone:read` plus tags instead. */
 export const zoneTemplates = {
-  read: 'zone:<chainId>:read',
   write: 'zone:<chainId>:write',
 } as const
 
@@ -17,21 +16,15 @@ export type ZoneAccess = keyof typeof zoneTemplates
 
 /** Returns the access level represented by a dynamic Zone scope template. */
 export function accessFromTemplate(value: string): ZoneAccess | undefined {
-  if (value === zoneTemplates.read) return 'read'
   if (value === zoneTemplates.write) return 'write'
   return undefined
 }
 
 /** Builds a canonical Zone scope from a positive integer chain id. */
-export function fromZoneChainId(value: string): `zone:${string}:read` | undefined
 export function fromZoneChainId<const access extends ZoneAccess>(
   value: string,
   access: access,
-): `zone:${string}:${access}` | undefined
-export function fromZoneChainId(
-  value: string,
-  access: ZoneAccess = 'read',
-): `zone:${string}:${ZoneAccess}` | undefined {
+): `zone:${string}:${access}` | undefined {
   const chainId = value.trim()
   if (!/^\d+$/.test(chainId)) return undefined
   const normalized = BigInt(chainId)

package/src/admin/ui/src/lib/{zone-key-requests.ts → zone-delegation-requests.ts}

@@ -1,24 +1,24 @@
 import * as ReactQuery from '@tanstack/react-query'
 import type { InferRequestType, InferResponseType } from 'hono/client'
 
-import * as ZoneKeyApproval from '../../../../internal/ZoneKeyApproval.js'
+import * as ZoneDelegationApproval from '../../../../internal/ZoneDelegationApproval.js'
 import { client } from './client.js'
 import * as Response from './response.js'
 
-/** A Zone key request row from the list endpoint. */
+/** A Zone delegation request row from the list endpoint. */
 export type Request = InferResponseType<
-  (typeof client)['zone-key-requests']['$get'],
+  (typeof client)['zone-delegation-requests']['$get'],
   200
 >['data'][number]
 
-/** A Zone key request with its recorded approvals. */
-export type Detail = InferResponseType<(typeof client)['zone-key-requests'][':id']['$get'], 200>
-
-/** Approvals required before the requester can issue the key. */
-export const quorum = ZoneKeyApproval.quorum
+/** A Zone delegation request with its recorded approvals. */
+export type Detail = InferResponseType<
+  (typeof client)['zone-delegation-requests'][':id']['$get'],
+  200
+>
 
-/** Returns whether scopes need the approval workflow (Zone read or wildcard). */
-export const required = ZoneKeyApproval.required
+/** Approvals required before the requester can apply the delegation. */
+export const quorum = ZoneDelegationApproval.quorum
 
 /** Returns the request status, reporting lapsed pending requests as `expired`. */
 export function status(request: Request) {
@@ -34,16 +34,16 @@ export function validApprovals(detail: Detail) {
   )
 }
 
-const baseKey = ['zone-key-requests'] as const
+const baseKey = ['zone-delegation-requests'] as const
 
-/** Lists one page of Zone key requests, newest first. */
+/** Lists one page of delegation requests, newest first. */
 export namespace list {
   export const key = [...baseKey, 'list'] as const
   export async function fn(cursor?: string) {
-    const response = await client['zone-key-requests'].$get({ query: cursor ? { cursor } : {} })
+    const response = await client['zone-delegation-requests'].$get({ query: cursor ? { cursor } : {} }) // prettier-ignore
     if (!response.ok)
       throw new Error(
-        await Response.errorMessage(response, { fallback: 'Failed to load Zone key requests.' }),
+        await Response.errorMessage(response, { fallback: 'Failed to load delegation requests.' }),
       )
     return response.json()
   }
@@ -56,10 +56,10 @@ export namespace list {
   }
 }
 
-/** Reads one Zone key request with its approvals. */
+/** Reads one delegation request with its approvals. */
 export namespace get {
   export async function fn(id: string) {
-    const response = await client['zone-key-requests'][':id'].$get({ param: { id } })
+    const response = await client['zone-delegation-requests'][':id'].$get({ param: { id } })
     if (!response.ok)
       throw new Error(
         await Response.errorMessage(response, { fallback: 'Failed to load the request.' }),
@@ -76,11 +76,11 @@ export namespace get {
   }
 }
 
-/** Submits immutable key settings for review. */
+/** Submits immutable delegation settings for review. */
 export namespace create {
-  export type Input = InferRequestType<(typeof client)['zone-key-requests']['$post']>['json']
+  export type Input = InferRequestType<(typeof client)['zone-delegation-requests']['$post']>['json'] // prettier-ignore
   export async function fn(json: Input) {
-    const response = await client['zone-key-requests'].$post({ json })
+    const response = await client['zone-delegation-requests'].$post({ json })
     if (!response.ok)
       throw new Error(
         await Response.errorMessage(response, { fallback: 'Failed to submit the request.' }),
@@ -99,7 +99,7 @@ export namespace create {
 /** Records the current member's approval. */
 export namespace approve {
   export async function fn(id: string) {
-    const response = await client['zone-key-requests'][':id'].approve.$post({ param: { id } })
+    const response = await client['zone-delegation-requests'][':id'].approve.$post({ param: { id } }) // prettier-ignore
     if (!response.ok)
       throw new Error(
         await Response.errorMessage(response, { fallback: 'Failed to approve the request.' }),
@@ -115,13 +115,13 @@ export namespace approve {
   }
 }
 
-/** Issues the approved key once, returning its plaintext token. */
-export namespace issue {
+/** Applies the approved request once, creating the delegation. */
+export namespace apply {
   export async function fn(id: string) {
-    const response = await client['zone-key-requests'][':id'].issue.$post({ param: { id } })
+    const response = await client['zone-delegation-requests'][':id'].apply.$post({ param: { id } }) // prettier-ignore
     if (!response.ok)
       throw new Error(
-        await Response.errorMessage(response, { fallback: 'Failed to issue the key.' }),
+        await Response.errorMessage(response, { fallback: 'Failed to apply the delegation.' }),
       )
     return response.json()
   }
@@ -129,12 +129,8 @@ export namespace issue {
     const queryClient = ReactQuery.useQueryClient()
     return ReactQuery.useMutation({
       mutationFn: fn,
-      // Issuance may consume the request even when the response fails.
-      onSettled: () =>
-        Promise.all([
-          queryClient.invalidateQueries({ queryKey: baseKey }),
-          queryClient.invalidateQueries({ queryKey: ['api-keys'] }),
-        ]),
+      // Applying consumes the request even when the response fails.
+      onSettled: () => queryClient.invalidateQueries({ queryKey: baseKey }),
     })
   }
 }
@@ -142,7 +138,7 @@ export namespace issue {
 /** Cancels a pending request. */
 export namespace cancel {
   export async function fn(id: string) {
-    const response = await client['zone-key-requests'][':id'].$delete({ param: { id } })
+    const response = await client['zone-delegation-requests'][':id'].$delete({ param: { id } })
     if (!response.ok)
       throw new Error(
         await Response.errorMessage(response, { fallback: 'Failed to cancel the request.' }),