tapimo 0.13.0 → 0.15.0

package/src/apps/management/routes/orgs.test.ts

@@ -1,12 +1,20 @@
+import { Hono } from 'hono'
 import { generatePrivateKey, privateKeyToAccount } from 'viem/accounts'
 
 import * as TestApp from '../../../../test/App.js'
+import * as TestRoutes from '../../../../test/Routes.js'
+import * as ApiKeys from '../../../ApiKeys.js'
+import type * as App from '../../../App.js'
+import * as Metrics from '../../../Metrics.js'
+import * as AuthAccounts from '../../../db/tables/authAccounts.js'
 import * as EarlyAccess from '../../../db/tables/earlyAccess.js'
 import * as EnabledBillingSources from '../../../db/tables/enabledBillingSources.js'
 import * as Organizations from '../../../db/tables/organizations.js'
 import * as Projects from '../../../db/tables/projects.js'
 import * as Users from '../../../db/tables/users.js'
 import type * as Log from '../../../internal/Log.js'
+import * as RoutesDepositAddress from '../../../internal/routes/DepositAddress.js'
+import * as Store from '../../../internal/Store.js'
 import * as Orgs from './orgs.js'
 
 /** Origin pinned for SIWE domain binding; Hono test requests use this host. */
@@ -53,17 +61,29 @@ function json(method: 'PATCH' | 'POST', cookie: string, body: unknown) {
   }
 }
 
-function createApp(db = TestApp.database()) {
+function createApp(db = TestApp.database(), options: createApp.Options = {}) {
   return TestApp.create({
     auth: {
       keys: [TestApp.key, managementRead, managementWrite, wildcard],
       superAdmin: { secret },
     },
     db,
+    ...(options.kv ? { kv: options.kv } : {}),
+    ...(options.metrics ? { metrics: options.metrics } : {}),
     session: { wallet: { origin } },
   })
 }
 
+declare namespace createApp {
+  /** Test app options. */
+  type Options = {
+    /** API-key state used by the app. */
+    kv?: { store: Store.State } | undefined
+    /** Metrics sink for route lifecycle assertions. */
+    metrics?: Metrics.Metrics | undefined
+  }
+}
+
 /** App over a database seeded with two organizations created by the super admin. */
 async function seeded() {
   const db = TestApp.database()
@@ -180,7 +200,7 @@ test('publishes generator-ready OpenAPI contracts', async () => {
             "$ref": "#/components/schemas/OrganizationNotFoundError",
           },
           "409": {
-            "$ref": "#/components/schemas/SponsorshipsUnreportedError",
+            "$ref": "#/components/schemas/RoutesDepositAddressesActiveOrSponsorshipsUnreportedError",
           },
         },
         "operationId": "deleteOrganization",
@@ -387,6 +407,37 @@ describe('POST /orgs', () => {
     expect(await EnabledBillingSources.listByOrg(db, body.id)).toEqual([])
   })
 
+  test('does not treat another identity provider subject as a wallet', async () => {
+    const db = TestApp.database()
+    const walletAddress = `0x${'22'.repeat(20)}`
+    const walletUser = await Users.upsertByAddress(db, { address: walletAddress })
+    const oidcUser = await Users.upsertByAddress(db, { address: `0x${'33'.repeat(20)}` })
+    await AuthAccounts.setWalletUser(db, { address: walletAddress, userId: walletUser.id })
+    const app = new Hono<App.Environment>()
+      .use('*', async (c, next) => {
+        c.set('db', db)
+        c.set('principal', {
+          id: oidcUser.id,
+          identity: { provider: 'https://issuer.example', subject: walletAddress },
+          type: 'session',
+        })
+        await next()
+      })
+      .route('/', Orgs.orgs())
+
+    const response = await app.request('/v1/orgs', {
+      body: JSON.stringify({ name: 'OIDC-owned' }),
+      headers: { 'content-type': 'application/json' },
+      method: 'POST',
+    })
+    const body = await TestApp.json(response, Orgs.schema.Organization)
+    const record = await Organizations.get(db, body.id)
+
+    expect(response.status).toBe(200)
+    expect(record?.userId).toBe(oidcUser.id)
+    await db.close()
+  })
+
   test.each([
     { email: 'Dev@Example.NET', entry: 'dev@example.net', kind: 'email' },
     { email: 'Dev@Example.ORG', entry: 'example.org', kind: 'domain' },
@@ -517,9 +568,46 @@ describe('PATCH /orgs/:orgId', () => {
 })
 
 describe('DELETE /orgs/:orgId', () => {
+  test('rejects a legacy key after deletion when KV cleanup fails', async () => {
+    const db = TestApp.database()
+    const org = await Organizations.create(db, { name: 'Legacy owner' })
+    const legacy = {
+      id: org.id,
+      orgId: org.id,
+      scopes: ['management:read'],
+      token: 'secret_legacy_deleted_owner',
+    } satisfies TestApp.kvStore.Key
+    const backing = TestApp.kvStore({ keys: [legacy] })
+    let failWrites = false
+    const store = Store.from({
+      ...backing,
+      async delete(key) {
+        if (failWrites) throw new Error('KV cleanup unavailable')
+        await backing.delete(key)
+      },
+      async put(key, value, options) {
+        if (failWrites) throw new Error('KV cleanup unavailable')
+        await backing.put(key, value, options)
+      },
+    })
+    const app = createApp(db, { kv: { store } })
+    failWrites = true
+
+    const deleted = await app.request(`/v1/orgs/${legacy.id}`, {
+      ...as(secret),
+      method: 'DELETE',
+    })
+    expect(deleted.status).toBe(200)
+    expect(await Organizations.get(db, legacy.id)).toBeUndefined()
+
+    const rejected = await app.request(`/v1/orgs/${legacy.id}`, as(legacy.token))
+    expect(rejected.status).toBe(401)
+  })
+
   test('deletes an owned organization and cascades its projects', async () => {
     const db = TestApp.database()
-    const app = createApp(db)
+    const store = TestApp.kvStore()
+    const app = createApp(db, { kv: { store } })
     const cookie = await session(app)
     const created = await app.request('/v1/orgs', json('POST', cookie, { name: 'Acme' }))
     const org = await TestApp.json(created, Orgs.schema.Organization)
@@ -529,6 +617,11 @@ describe('DELETE /orgs/:orgId', () => {
     )
     expect(createdProject.status).toBe(200)
     const project = (await createdProject.json()) as { id: string }
+    const key = await ApiKeys.mint(store, {
+      orgId: org.id,
+      projectId: project.id,
+      scopes: ['data:read'],
+    })
 
     const deleted = await app.request(`/v1/orgs/${org.id}`, {
       headers: { cookie },
@@ -543,6 +636,58 @@ describe('DELETE /orgs/:orgId', () => {
     expect(gone.status).toBe(404)
     // Cascade: the org's project rows are deleted, not orphaned.
     expect(await Projects.get(db, project.id)).toBeUndefined()
+    expect(await ApiKeys.resolve(store, key.token)).toBeNull()
+    await expect(
+      ApiKeys.mint(store, { orgId: org.id, projectId: project.id, scopes: ['data:read'] }),
+    ).rejects.toThrow(ApiKeys.OwnerDeletedError)
+  })
+
+  test('records address deactivation after organization deletion commits', async () => {
+    const db = TestApp.database()
+    const counts: Parameters<Metrics.Metrics['count']>[] = []
+    const metrics = Metrics.from({
+      count(name, value, tags) {
+        counts.push([name, value, tags])
+      },
+      flush() {},
+      gauge() {},
+      histogram() {},
+    })
+    const app = createApp(db, { metrics })
+    const cookie = await session(app)
+    const created = await app.request('/v1/orgs', json('POST', cookie, { name: 'Acme' }))
+    const org = await TestApp.json(created, Orgs.schema.Organization)
+    const snapshot = TestRoutes.depositAddressSnapshot({ subsidize: false })
+    await RoutesDepositAddress.create(db, {
+      deliveryStrategy: 'provider',
+      environment: 'production',
+      orgId: org.id,
+      providerOutputToken: snapshot.destinationToken,
+      snapshot,
+    })
+
+    const response = await app.request(`/v1/orgs/${org.id}`, {
+      headers: { cookie },
+      method: 'DELETE',
+    })
+
+    expect(response.status).toBe(200)
+    expect(counts.find(([name]) => name === 'routes_resource_transition_count'))
+      .toMatchInlineSnapshot(`
+        [
+          "routes_resource_transition_count",
+          1,
+          {
+            "from_status": "active",
+            "method": "deposit_address",
+            "provider": "relay",
+            "reason": "none",
+            "resource": "deposit_address",
+            "routes_environment": "production",
+            "to_status": "deactivated",
+          },
+        ]
+      `)
   })
 
   test('hides foreign organizations behind 404', async () => {
@@ -570,6 +715,49 @@ describe('DELETE /orgs/:orgId', () => {
     const gone = await app.request('/v1/orgs/org_a', as(secret))
     expect(gone.status).toBe(404)
   })
+
+  test('blocks deletion while a subsidized Relay address remains irrevocable', async () => {
+    const db = TestApp.database()
+    const store = TestApp.kvStore()
+    const app = createApp(db, { kv: { store } })
+    const cookie = await session(app)
+    const created = await app.request('/v1/orgs', json('POST', cookie, { name: 'Acme' }))
+    const org = await TestApp.json(created, Orgs.schema.Organization)
+    const key = await ApiKeys.mintBounded(db, store, {
+      orgId: org.id,
+      scopes: ['management:read'],
+    })
+    const snapshot = TestRoutes.depositAddressSnapshot({ subsidize: true })
+    await RoutesDepositAddress.create(db, {
+      deliveryStrategy: 'provider',
+      environment: 'production',
+      orgId: org.id,
+      providerOutputToken: snapshot.destinationToken,
+      snapshot,
+    })
+
+    const response = await app.request(`/v1/orgs/${org.id}`, {
+      headers: { cookie },
+      method: 'DELETE',
+    })
+    expect({ body: await response.json(), status: response.status }).toMatchInlineSnapshot(
+      { body: { requestId: expect.any(String) } },
+      `
+      {
+        "body": {
+          "error": {
+            "code": "routes_deposit_addresses_active",
+            "message": "Delete is blocked while address provisioning is active or an irrevocable subsidized Relay address exists.",
+          },
+          "requestId": Any<String>,
+        },
+        "status": 409,
+      }
+    `,
+    )
+    expect(await Organizations.get(db, org.id)).toBeDefined()
+    expect((await app.request(`/v1/orgs/${org.id}`, as(key.token))).status).toBe(200)
+  })
 })
 
 describe('ownership', () => {

package/src/apps/management/routes/orgs.ts

@@ -1,4 +1,5 @@
 import { type Context, Hono } from 'hono'
+import * as pg from 'pg'
 import * as z from 'zod/mini'
 
 import * as ApiKeys from '../../../ApiKeys.js'
@@ -7,9 +8,12 @@ import * as Auth from '../../../internal/Auth.js'
 import * as Db from '../../../db/Db.js'
 import * as EarlyAccess from '../../../db/tables/earlyAccess.js'
 import * as Memberships from '../../../db/tables/memberships.js'
+import * as RoutesDepositAddresses from '../../../db/tables/routesDepositAddresses.js'
+import * as RoutesIdempotency from '../../../db/tables/routesIdempotency.js'
 import * as OpenApi from '../../../internal/OpenApi.js'
 import * as Organizations from '../../../db/tables/organizations.js'
 import * as Response from '../../../internal/Response.js'
+import * as RoutesObservability from '../../../internal/routes/Observability.js'
 import * as Schema from '../../../internal/Schema.js'
 import * as ManagementError from '../Error.js'
 
@@ -218,6 +222,9 @@ export function orgs() {
                         : [],
                     name: body.name,
                     userId: principal.id,
+                    ...(principal.identity.provider === 'wallet'
+                      ? { walletAddress: principal.identity.subject }
+                      : {}),
                   })),
                   role: 'owner' as const,
                 }
@@ -349,8 +356,9 @@ export function orgs() {
               description: 'No accessible organization was found for this id.',
             },
             409: {
-              codes: ['sponsorships_unreported'],
-              description: 'Billable sponsorships are still awaiting settlement.',
+              codes: ['routes_deposit_addresses_active', 'sponsorships_unreported'],
+              description:
+                'Billable usage is awaiting settlement, address provisioning is active, or an irrevocable subsidized address remains at its provider.',
             },
           },
           success: {
@@ -373,23 +381,53 @@ export function orgs() {
 
         const db = Db.get(c.get('db'))
         try {
-          if (await Organizations.hasUnreportedSponsorships(db, Auth.org(c).id))
+          if (await Organizations.hasUnreportedMeteredUsage(db, Auth.org(c).id))
             return sponsorshipsUnreported(c)
+          if (await RoutesIdempotency.hasUnattributedInFlightClaim(db))
+            return subsidizedDepositAddressesActive(c)
+          if (await RoutesIdempotency.hasInFlightDepositAddress(db, Auth.org(c).id))
+            return subsidizedDepositAddressesActive(c)
+          if (await RoutesDepositAddresses.hasSubsidizedRelayAddress(db, Auth.org(c).id))
+            return subsidizedDepositAddressesActive(c)
+          const deleted = await Organizations.deleteOrganization(db, Auth.org(c).id, {
+            onDepositAddressesDeactivated(transitions) {
+              for (const transition of transitions)
+                RoutesObservability.recordDepositAddress(c.get('metrics'), transition)
+            },
+          })
+          if (!deleted) return organizationNotFound(c)
           const kv = c.get('kv')
           if (kv)
-            for (const record of await ApiKeys.listByOrg(kv.store, Auth.org(c).id, {
-              scopeCatalog: c.get('scopeCatalog'),
-            }))
-              await ApiKeys.revoke(kv.store, record.id)
-          const deleted = await Organizations.deleteOrganization(db, Auth.org(c).id)
-          if (!deleted) return organizationNotFound(c)
+            try {
+              await ApiKeys.markOwnerDeleting(kv.store, { orgId: Auth.org(c).id })
+              for (const record of await ApiKeys.listByOrg(kv.store, Auth.org(c).id, {
+                scopeCatalog: c.get('scopeCatalog'),
+              }))
+                await ApiKeys.revoke(kv.store, record.id)
+            } catch (cause) {
+              console.error(
+                'Organization API-key KV cleanup failed after deletion committed.',
+                cause,
+              )
+            }
           return c.json(
             Response.validated(schema.deleteOrganization.Response, { id: Auth.org(c).id }),
             200,
           )
         } catch (cause) {
-          if (cause instanceof Organizations.UnreportedSponsorshipsError)
+          if (cause instanceof Organizations.UnreportedMeteredUsageError)
             return sponsorshipsUnreported(c)
+          if (cause instanceof Organizations.IrrevocableDepositAddressError)
+            return subsidizedDepositAddressesActive(c)
+          if (
+            cause instanceof pg.DatabaseError &&
+            cause.code === '23503' &&
+            [
+              'organization has active route deposit address work',
+              'route lifecycle rollout drain is active',
+            ].includes(cause.message)
+          )
+            return subsidizedDepositAddressesActive(c)
           return Response.upstream(c, cause)
         }
       },
@@ -399,7 +437,16 @@ export function orgs() {
 function sponsorshipsUnreported(c: Context<App.Environment>) {
   return Response.error(c, {
     code: 'sponsorships_unreported',
-    message: 'Billable sponsorships are still awaiting settlement',
+    message: 'Billable metered usage is still awaiting settlement',
+    status: 409,
+  })
+}
+
+function subsidizedDepositAddressesActive(c: Context<App.Environment>) {
+  return Response.error(c, {
+    code: 'routes_deposit_addresses_active',
+    message:
+      'Delete is blocked while address provisioning is active or an irrevocable subsidized Relay address exists.',
     status: 409,
   })
 }

package/src/apps/management/routes/projects.test.ts

@@ -1,6 +1,8 @@
 import { generatePrivateKey, privateKeyToAccount } from 'viem/accounts'
 
 import * as TestApp from '../../../../test/App.js'
+import * as ApiKeys from '../../../ApiKeys.js'
+import type * as Store from '../../../internal/Store.js'
 import * as Orgs from './orgs.js'
 import * as Projects from './projects.js'
 
@@ -16,8 +18,19 @@ function json(method: 'PATCH' | 'POST', cookie: string, body: unknown) {
   }
 }
 
-function createApp() {
-  return TestApp.create({ session: { wallet: { origin } } })
+function createApp(options: createApp.Options = {}) {
+  return TestApp.create({
+    ...(options.kv ? { kv: options.kv } : {}),
+    session: { wallet: { origin } },
+  })
+}
+
+declare namespace createApp {
+  /** Test app options. */
+  type Options = {
+    /** API-key state used by the app. */
+    kv?: { store: Store.State } | undefined
+  }
 }
 
 test('publishes generator-ready OpenAPI contracts', async () => {
@@ -250,7 +263,8 @@ describe('projects', () => {
   })
 
   test('deletes a project, leaving the organization and siblings intact', async () => {
-    const app = createApp()
+    const store = TestApp.kvStore()
+    const app = createApp({ kv: { store } })
     const cookie = await session(app)
     const created = await app.request('/v1/orgs', json('POST', cookie, { name: 'Acme' }))
     const org = await TestApp.json(created, Orgs.schema.Organization)
@@ -264,6 +278,17 @@ describe('projects', () => {
       json('POST', cookie, { name: 'Payments' }),
     )
     expect(keeper.status).toBe(200)
+    const sibling = await TestApp.json(keeper, Projects.schema.Project)
+    const deletedKey = await ApiKeys.mint(store, {
+      orgId: org.id,
+      projectId: project.id,
+      scopes: ['data:read'],
+    })
+    const siblingKey = await ApiKeys.mint(store, {
+      orgId: org.id,
+      projectId: sibling.id,
+      scopes: ['data:read'],
+    })
 
     const stranger = await session(app)
     const foreign = await app.request(`/v1/orgs/${org.id}/projects/${project.id}`, {
@@ -292,6 +317,11 @@ describe('projects', () => {
 
     const orgStill = await app.request(`/v1/orgs/${org.id}`, { headers: { cookie } })
     expect(orgStill.status).toBe(200)
+    expect(await ApiKeys.resolve(store, deletedKey.token)).toBeNull()
+    expect(await ApiKeys.resolve(store, siblingKey.token)).not.toBeNull()
+    await expect(
+      ApiKeys.mint(store, { orgId: org.id, projectId: project.id, scopes: ['data:read'] }),
+    ).rejects.toThrow(ApiKeys.OwnerDeletedError)
   })
 
   test('hides projects behind foreign organizations', async () => {

package/src/apps/management/routes/projects.ts

@@ -391,12 +391,17 @@ export function projects() {
         const db = Db.get(c.get('db'))
         try {
           const kv = c.get('kv')
+          if (kv)
+            await ApiKeys.markOwnerDeleting(kv.store, {
+              orgId: Auth.org(c).id,
+              projectId: Auth.project(c).id,
+            })
           if (kv)
             for (const record of await ApiKeys.listByOrg(kv.store, Auth.org(c).id, {
               projectId: Auth.project(c).id,
               scopeCatalog: c.get('scopeCatalog'),
             }))
-              await ApiKeys.revoke(kv.store, record.id)
+              await ApiKeys.revokeBounded(db, kv.store, record.id)
           const deleted = await Projects.deleteProject(db, Auth.project(c).id)
           if (!deleted) return projectNotFound(c)
           return c.json(

package/src/apps/management/routes/scopes.test.ts

@@ -1,4 +1,5 @@
 import * as Scope from '../../../Scope.js'
+import * as Store from '../../../internal/Store.js'
 import * as TestApp from '../../../../test/App.js'
 import * as Scopes from './scopes.js'
 
@@ -39,6 +40,31 @@ test('publishes a generator-ready OpenAPI contract', async () => {
 })
 
 describe('scopes', () => {
+  test('does not reuse the cached self-serve Routes write catalog', async () => {
+    const store = Store.memory()
+    await store.put(
+      'edge:v2:http://localhost/v1/scopes',
+      JSON.stringify({
+        body: JSON.stringify({
+          data: [
+            { description: 'Create route transfers.', scope: 'routes:write', selfServe: true },
+          ],
+        }),
+        headers: [['content-type', 'application/json']],
+        status: 200,
+      }),
+      { ttl: 300_000 },
+    )
+    const app = TestApp.create({ cache: { store } })
+
+    const response = await app.request('/v1/scopes')
+    expect(response.status).toBe(200)
+    const body = await TestApp.json(response, Scopes.schema.getScopes.Response)
+    expect(
+      body.data.find((entry) => entry.scope === 'routes:write')?.selfServe,
+    ).toMatchInlineSnapshot(`false`)
+  })
+
   test('rejects malformed API key credentials', async () => {
     const response = await TestApp.create().request('/v1/scopes', {
       headers: { authorization: 'Basic wrong' },
@@ -64,12 +90,14 @@ describe('scopes', () => {
     expect(body.data.map((entry) => entry.scope)).toMatchInlineSnapshot(`
       [
         "data:read",
-        "funding:read",
-        "funding:write",
+        "routes:read",
+        "routes:write",
         "indexer:query",
         "management:read",
         "management:write",
         "mpp:write",
+        "rewards:read",
+        "rewards:write",
         "rpc-relay:read",
         "rpc-relay:sponsor",
         "webhooks:read",

package/src/apps/management/routes/scopes.ts

@@ -60,6 +60,7 @@ export namespace schema {
  * within the public quota; the session lane lets signed-in consoles skip it.
  */
 export function scopes() {
+  const cacheName = 'tempo-api:scopes:v6'
   return new Hono<App.Environment>().get(
     '/v1/scopes',
     Auth.policy({ apiKey: { scopes: [] }, public: true, session: true }),
@@ -75,10 +76,12 @@ export function scopes() {
     }),
     Cache.response<App.Environment>({
       cacheControl: Cache.policies.stable,
-      name: 'tempo-api:scopes:v5',
+      name: cacheName,
       key: (c) => {
         const url = new URL(c.req.url)
         url.search = ''
+        // The outer edge cache uses this URL, not the inner cache namespace.
+        url.searchParams.set('cache', cacheName)
         return url.toString()
       },
     }),

package/src/apps/management/routes/usage.test.ts

@@ -1,9 +1,11 @@
 import { nanoid } from 'nanoid'
 import { generatePrivateKey, privateKeyToAccount } from 'viem/accounts'
 
+import * as ApiKeys from '../../../ApiKeys.js'
 import type * as Analytics from '../../../analytics/Analytics.js'
 import * as TestApp from '../../../../test/App.js'
 import * as SponsoredTransactions from '../../../db/tables/sponsoredTransactions.js'
+import * as Store from '../../../internal/Store.js'
 import * as Viem from '../../../internal/Viem.js'
 import * as Keys from './api-keys.js'
 import * as Orgs from './orgs.js'
@@ -20,12 +22,14 @@ function createApp(
   options: {
     analytics?: Analytics.Analytics | undefined
     db?: TestApp.create.Options['db'] | undefined
+    kv?: TestApp.create.Options['kv'] | undefined
   } = {},
 ) {
   return TestApp.create({
     ...(options.analytics === undefined ? {} : { analytics: options.analytics }),
     auth: { superAdmin: { secret } },
     db: options.db ?? TestApp.database(),
+    ...(options.kv === undefined ? {} : { kv: options.kv }),
     session: { wallet: { origin } },
   })
 }
@@ -217,6 +221,34 @@ test('publishes generator-ready OpenAPI contracts', async () => {
 })
 
 describe('GET /orgs/:orgId/usage/requests', () => {
+  test('includes project legacy keys beyond the first organization-index page', async () => {
+    vi.useFakeTimers({ now: new Date('2026-02-01T00:00:00.000Z') })
+    const { query, store: analytics } = analyticsStore()
+    const store = Store.memory()
+    const app = createApp({ analytics, kv: { store } })
+    const cookie = await session(app)
+    const { org, project } = await fixture(app, cookie)
+    const keys = await Promise.all(
+      Array.from({ length: ApiKeys.maxLiveKeysPerOrganization + 1 }, () =>
+        ApiKeys.mint(store, {
+          environment: 'sandbox',
+          orgId: org.id,
+          projectId: project.id,
+          scopes: ['data:read'],
+        }),
+      ),
+    )
+
+    const response = await app.request(
+      `/v1/orgs/${org.id}/usage/requests?environment=sandbox&projectId=${project.id}`,
+      { headers: { cookie } },
+    )
+
+    expect(response.status).toBe(200)
+    const sql = query.mock.calls[0]![0]
+    expect(keys.every(({ record }) => sql.includes(`'${record.id}'`))).toBe(true)
+  })
+
   test('scopes to one project with environment-filtered attribution and legacy key ids', async () => {
     vi.useFakeTimers({ now: new Date('2026-02-01T00:00:00.000Z') })
     const { query, store } = analyticsStore()

package/src/apps/management/routes/usage.ts

@@ -536,10 +536,28 @@ async function legacyKeyIds(
 ): Promise<readonly string[]> {
   const kv = c.get('kv')
   if (!kv) return []
-  const records = await ApiKeys.listByOrg(kv.store, Auth.org(c).id, {
-    ...(options.projectId === undefined ? {} : { projectId: options.projectId }),
-    scopeCatalog: c.get('scopeCatalog'),
-  })
+  const records: ApiKeys.Record[] = []
+  let indexes = 0
+  let cursor: string | undefined
+  for (;;) {
+    const limit = Math.min(
+      ApiKeys.maxLiveKeysPerOrganization,
+      ApiKeys.maxLegacyAdmissionIndexes - indexes,
+    )
+    const page = await ApiKeys.listByOrgPage(kv.store, Auth.org(c).id, {
+      ...(cursor === undefined ? {} : { cursor }),
+      ...(options.projectId === undefined ? {} : { projectId: options.projectId }),
+      limit,
+      scopeCatalog: c.get('scopeCatalog'),
+    })
+    indexes += page.indexCount
+    records.push(...page.records)
+    if (page.listComplete) break
+    if (indexes >= ApiKeys.maxLegacyAdmissionIndexes)
+      throw new Error('API-key index exceeds the request-usage scan limit.')
+    if (page.cursor === undefined) throw new Error('API-key list page is missing a cursor.')
+    cursor = page.cursor
+  }
   return records
     .filter(
       (record) => options.environment === undefined || record.environment === options.environment,