tapimo 0.15.0 → 0.15.1

package/src/db/Db.ts

@@ -2971,6 +2971,15 @@ export const migrations: readonly Migration[] = [
         sql`INSERT INTO reward_campaign_distributors (chain_id, vault_address, distributor_address, created_at) SELECT chain_id, vault_address, '0x6c857bf1fe7de1bc1d5c639c721b2633f8fe34f3', created_at FROM reward_campaigns WHERE chain_id = 4217 AND vault_address = '0xd730394f3bb85a4828e35fc5e361dcc9f894fa4f' ON CONFLICT DO NOTHING`,
       ),
   },
+  {
+    // Provider subsidy billing first became active with this production Worker deployment.
+    name: '0270_routes_deposits_legacy_provider_subsidies_reported',
+    up: (db) =>
+      raw(
+        db,
+        sql`UPDATE routes_deposits SET subsidy_meter_reported_at = coalesce(status_updated_at, updated_at) WHERE environment = 'production' AND subsidy_meter_reported_at IS NULL AND (provider_subsidy->'amount'->>'baseUnits')::numeric > 0 AND (status = 'completed' OR (status IN ('action-required', 'settling') AND tempo_gas_paid IS NOT NULL)) AND coalesce(status_updated_at, updated_at) < '2026-09-03T06:10:21.000Z'`,
+      ),
+  },
 ]
 
 /**

package/src/db/tables/routesDeposits.test.ts

@@ -849,4 +849,76 @@ describe('subsidy reporting', () => {
       completed.record.statusUpdatedAt,
     )
   })
+
+  test('migration: excludes provider subsidies finalized before provider billing activation', async () => {
+    const before = new Date('2026-09-03T06:10:20.999Z')
+    const after = new Date('2026-09-03T06:10:21.001Z')
+    const address = await seedAddress({ orgId: 'org_legacy_provider_subsidy' })
+    const subsidy = {
+      amount: {
+        baseUnits: '23838',
+        currency: 'USD',
+        decimals: 6,
+        formatted: '0.023838',
+      },
+      provider: 'relay',
+      token: address.snapshot.sourceToken,
+    } as const
+    const legacy = await seedDeposit(address, { providerSubsidy: subsidy })
+    const current = await seedDeposit(address, { providerSubsidy: subsidy })
+    const inFlight = await seedDeposit(address, { providerSubsidy: subsidy })
+    vi.useFakeTimers({ now: before, toFake: ['Date'] })
+    try {
+      const completedLegacy = await Deposit.transition(db, {
+        expectedVersion: legacy.version,
+        id: legacy.id,
+        status: 'completed',
+      })
+      if (completedLegacy.type !== 'applied') throw new Error('Expected completed legacy subsidy.')
+      vi.setSystemTime(after)
+      const completedCurrent = await Deposit.transition(db, {
+        expectedVersion: current.version,
+        id: current.id,
+        status: 'completed',
+      })
+      if (completedCurrent.type !== 'applied')
+        throw new Error('Expected completed current subsidy.')
+    } finally {
+      vi.useRealTimers()
+    }
+
+    expect(
+      (await RoutesDeposits.listUnreportedSubsidies(db)).map(({ id }) => id).toSorted(),
+    ).toEqual([current.id, legacy.id].toSorted())
+
+    const migration = Db.migrations.find(
+      (candidate) => candidate.name === '0270_routes_deposits_legacy_provider_subsidies_reported',
+    )
+    if (!migration) throw new Error('Expected the legacy provider subsidy migration.')
+    await migration.up(db.kysely).execute()
+
+    expect((await RoutesDeposits.listUnreportedSubsidies(db)).map(({ id }) => id)).toEqual([
+      current.id,
+    ])
+    expect((await RoutesDeposits.get(db, legacy.id))?.subsidyMeterReportedAt).toBe(
+      before.toISOString(),
+    )
+    expect((await RoutesDeposits.get(db, current.id))?.subsidyMeterReportedAt).toBeNull()
+
+    vi.useFakeTimers({ now: after, toFake: ['Date'] })
+    try {
+      const completedInFlight = await Deposit.transition(db, {
+        expectedVersion: inFlight.version,
+        id: inFlight.id,
+        status: 'completed',
+      })
+      if (completedInFlight.type !== 'applied')
+        throw new Error('Expected completed in-flight subsidy.')
+    } finally {
+      vi.useRealTimers()
+    }
+    expect(
+      (await RoutesDeposits.listUnreportedSubsidies(db)).map(({ id }) => id).toSorted(),
+    ).toEqual([current.id, inFlight.id].toSorted())
+  })
 })

package/src/db/tables/verifiedTokenRequests.test.ts

@@ -70,6 +70,26 @@ describe('create', () => {
     const other = await VerifiedTokenRequests.create(db, { ...input, chainId: 4217 })
     expect(other).toBeDefined()
   })
+
+  test("atomically caps pending requests across a requester's organizations", async () => {
+    const db = TestApp.database()
+    const attempts = await Promise.allSettled(
+      Array.from({ length: VerifiedTokenRequests.maxPendingPerRequester + 1 }, (_, index) =>
+        VerifiedTokenRequests.create(db, {
+          ...input,
+          address: `0x${(index + 1).toString(16).padStart(40, '0')}`,
+          orgId: `org_${index}`,
+          symbol: `T${index}`,
+        }),
+      ),
+    )
+    expect(attempts.filter((attempt) => attempt.status === 'fulfilled')).toHaveLength(
+      VerifiedTokenRequests.maxPendingPerRequester,
+    )
+    expect(attempts.filter((attempt) => attempt.status === 'rejected')).toMatchObject([
+      { reason: { name: 'VerifiedTokenRequests.PendingLimitError' } },
+    ])
+  })
 })
 
 describe('list', () => {
@@ -108,38 +128,37 @@ describe('listByStatus', () => {
       status: 'denied',
     })
 
-    const queue = await VerifiedTokenRequests.listByStatus(db, 'pending')
+    const queue = await VerifiedTokenRequests.listByStatus(db, 'pending', { limit: 10 })
     expect(queue.map(({ id, orgName }) => ({ id, orgName }))).toEqual([
       { id: pending!.id, orgName: 'Acme' },
     ])
     // The denied row's org has no organizations row; the join yields null.
-    const reviewed = await VerifiedTokenRequests.listByStatus(db, 'denied')
+    const reviewed = await VerifiedTokenRequests.listByStatus(db, 'denied', { limit: 10 })
     expect(reviewed.map(({ id, orgName }) => ({ id, orgName }))).toEqual([
       { id: denied!.id, orgName: null },
     ])
   })
-})
 
-describe('countPending', () => {
-  test('counts only the organization pending requests', async () => {
+  test('continues after a stable oldest-first cursor', async () => {
     const db = TestApp.database()
+    for (const [suffix, symbol] of [
+      ['bb', 'tEUR'],
+      ['cc', 'tGBP'],
+    ] as const)
+      await VerifiedTokenRequests.create(db, {
+        ...input,
+        address: `0x20c00000000000000000000000000000000000${suffix}`,
+        symbol,
+      })
     await VerifiedTokenRequests.create(db, input)
-    const denied = await VerifiedTokenRequests.create(db, {
-      ...input,
-      address: '0x20c00000000000000000000000000000000000bb',
-      symbol: 'tEUR',
-    })
-    await VerifiedTokenRequests.review(db, denied!.id, {
-      reviewedBy: 'admin@tempo.xyz',
-      status: 'denied',
-    })
-    await VerifiedTokenRequests.create(db, {
-      ...input,
-      address: '0x20c00000000000000000000000000000000000cc',
-      orgId: 'org_2b3c4d5e6f7g8h9j0k1m2n3p',
-      symbol: 'tGBP',
+    const all = await VerifiedTokenRequests.listByStatus(db, 'pending', { limit: 10 })
+    const first = await VerifiedTokenRequests.listByStatus(db, 'pending', { limit: 2 })
+    const last = first.at(-1)!
+    const second = await VerifiedTokenRequests.listByStatus(db, 'pending', {
+      cursor: { createdAt: last.createdAt, id: last.id },
+      limit: 2,
     })
-    expect(await VerifiedTokenRequests.countPending(db, input.orgId)).toBe(1)
+    expect([...first, ...second].map(({ id }) => id)).toEqual(all.map(({ id }) => id))
   })
 })
 

package/src/db/tables/verifiedTokenRequests.ts

@@ -11,44 +11,61 @@ export type Record = Selectable<Table>
 /** Review status of a request. */
 export type Status = Record['status']
 
+/** Maximum pending verification requests retained for one requester. */
+export const maxPendingPerRequester = 10
+
 /**
  * Inserts a pending request; `undefined` when a pending request for
- * (chainId, address) already exists.
+ * (chainId, address) already exists. Throws `PendingLimitError` when the
+ * requester already has the maximum retained pending requests.
  */
 export function create(db: Db.Db, input: create.Input): Promise<Record | undefined> {
   const now = new Date().toISOString()
-  return db.kysely
-    .insertInto('verified_token_requests')
-    .values({
-      address: input.address,
-      chainId: input.chainId,
-      createdAt: now,
-      currency: input.currency,
-      decimals: input.decimals,
-      id: Id.generate('vtr'),
-      logo: input.logo ?? null,
-      logoUri: input.logoUri ?? null,
-      name: input.name,
-      note: input.note ?? null,
-      orgId: input.orgId,
-      requestedBy: input.requestedBy,
-      reviewNote: null,
-      reviewedAt: null,
-      reviewedBy: null,
-      status: 'pending',
-      symbol: input.symbol,
-      updatedAt: now,
-    })
-    .onConflict((oc) =>
-      oc
-        .columns(['chainId', 'address'])
-        // `sql.lit` keeps the predicate literal; a bound parameter would
-        // defeat partial-index inference for the conflict target.
-        .where('status', '=', sql.lit('pending'))
-        .doNothing(),
+  return db.transaction(async (tx) => {
+    // Serialize admission per requester so parallel organizations cannot exceed the retained queue cap.
+    await sql`SELECT pg_advisory_xact_lock(hashtextextended(${`verified-token-requests:${input.requestedBy}`}, 0))`.execute(
+      tx.kysely,
     )
-    .returningAll()
-    .executeTakeFirst()
+    const pending = await tx.kysely
+      .selectFrom('verified_token_requests')
+      .select(({ fn }) => fn.countAll<string>().as('count'))
+      .where('requestedBy', '=', input.requestedBy)
+      .where('status', '=', 'pending')
+      .executeTakeFirstOrThrow()
+    if (Number(pending.count) >= maxPendingPerRequester) throw new PendingLimitError()
+    return tx.kysely
+      .insertInto('verified_token_requests')
+      .values({
+        address: input.address,
+        chainId: input.chainId,
+        createdAt: now,
+        currency: input.currency,
+        decimals: input.decimals,
+        id: Id.generate('vtr'),
+        logo: input.logo ?? null,
+        logoUri: input.logoUri ?? null,
+        name: input.name,
+        note: input.note ?? null,
+        orgId: input.orgId,
+        requestedBy: input.requestedBy,
+        reviewNote: null,
+        reviewedAt: null,
+        reviewedBy: null,
+        status: 'pending',
+        symbol: input.symbol,
+        updatedAt: now,
+      })
+      .onConflict((oc) =>
+        oc
+          .columns(['chainId', 'address'])
+          // `sql.lit` keeps the predicate literal; a bound parameter would
+          // defeat partial-index inference for the conflict target.
+          .where('status', '=', sql.lit('pending'))
+          .doNothing(),
+      )
+      .returningAll()
+      .executeTakeFirst()
+  })
 }
 
 export declare namespace create {
@@ -96,17 +113,42 @@ export function list(db: Db.Db, orgId: string): Promise<Record[]> {
 export function listByStatus(
   db: Db.Db,
   status: Status,
+  options: listByStatus.Options,
 ): Promise<(Record & { orgName: string | null })[]> {
-  return db.kysely
+  const { cursor } = options
+  let query = db.kysely
     .selectFrom('verified_token_requests')
     .leftJoin('organizations', 'organizations.id', 'verified_token_requests.orgId')
     .selectAll('verified_token_requests')
     .select('organizations.name as orgName')
     .where('status', '=', status)
+  if (cursor)
+    query = query.where((eb) =>
+      eb.or([
+        eb('verified_token_requests.createdAt', '>', cursor.createdAt),
+        eb.and([
+          eb('verified_token_requests.createdAt', '=', cursor.createdAt),
+          eb('verified_token_requests.id', '>', cursor.id),
+        ]),
+      ]),
+    )
+  return query
     .orderBy('verified_token_requests.createdAt', 'asc')
+    .orderBy('verified_token_requests.id', 'asc')
+    .limit(options.limit)
     .execute()
 }
 
+export declare namespace listByStatus {
+  /** Pagination options for the global review queue. */
+  type Options = {
+    /** Oldest-first position after which to continue. */
+    cursor?: { createdAt: string; id: string } | undefined
+    /** Maximum records to return. */
+    limit: number
+  }
+}
+
 /** Gets a request by id. */
 export function get(db: Db.Db, id: string): Promise<Record | undefined> {
   return db.kysely
@@ -116,17 +158,6 @@ export function get(db: Db.Db, id: string): Promise<Record | undefined> {
     .executeTakeFirst()
 }
 
-/** Counts an organization's pending requests. */
-export async function countPending(db: Db.Db, orgId: string): Promise<number> {
-  const row = await db.kysely
-    .selectFrom('verified_token_requests')
-    .select(({ fn }) => fn.countAll<string>().as('count'))
-    .where('orgId', '=', orgId)
-    .where('status', '=', 'pending')
-    .executeTakeFirstOrThrow()
-  return Number(row.count)
-}
-
 /** Hard-deletes an org-scoped request while pending; `undefined` otherwise. */
 export function remove(db: Db.Db, orgId: string, id: string): Promise<Record | undefined> {
   return db.kysely
@@ -180,3 +211,8 @@ export function toRequest(record: Record) {
     ...(logoUri === null ? {} : { logoUri }),
   }
 }
+
+/** The requester already has the maximum retained pending requests. */
+export class PendingLimitError extends Error {
+  override readonly name = 'VerifiedTokenRequests.PendingLimitError'
+}

package/src/internal/Auth.test.ts

@@ -75,6 +75,36 @@ describe('require', () => {
       `)
     })
 
+    test('isolates an explicit endpoint bucket from the shared scope quota', async () => {
+      const app = createScopedApp({
+        routes: [
+          {
+            path: '/other',
+            policy: {
+              apiKey: { rateLimit: { limit: 1, period: 'minute' }, scopes: ['data:read'] },
+            },
+          },
+          {
+            path: '/protected',
+            policy: {
+              apiKey: {
+                bucket: 'protected',
+                rateLimit: { limit: 1, period: 'minute' },
+                scopes: ['data:read'],
+              },
+            },
+          },
+        ],
+      })
+      const options = { headers: { 'tempo-api-key': token } }
+
+      const other = await app.request('/other', options)
+      const protected_ = await app.request('/protected', options)
+      const overflow = await app.request('/protected', options)
+
+      expect([other.status, protected_.status, overflow.status]).toEqual([200, 200, 429])
+    })
+
     test('does not parse payment authorization as bearer fallback', async () => {
       const app = createApp()
       const response = await app.request('/protected', {
@@ -1041,6 +1071,42 @@ describe('require', () => {
       expect(response.headers.get('RateLimit-Limit')).toBe('25')
     })
 
+    test('isolates an explicit endpoint bucket from unrelated paid requests', async () => {
+      const auth = {
+        apiKey: { resolve: TestApp.resolver({ keys: [{ ...key, token }] }) },
+        mpp: createMppHandler(),
+        rateLimit: RateLimit.memory(),
+      } satisfies Auth.Context
+      const app = createScopedApp({
+        auth,
+        routes: [
+          {
+            path: '/other',
+            policy: {
+              mpp: { rateLimit: { limit: 1, period: 'minute' }, session: { amount: '1' } },
+            },
+          },
+          {
+            path: '/protected',
+            policy: {
+              mpp: {
+                bucket: 'protected',
+                rateLimit: { limit: 1, period: 'minute' },
+                session: { amount: '1' },
+              },
+            },
+          },
+        ],
+      })
+      const options = { headers: { authorization: 'Payment paid' } }
+
+      const other = await app.request('/other', options)
+      const protected_ = await app.request('/protected', options)
+      const overflow = await app.request('/protected', options)
+
+      expect([other.status, protected_.status, overflow.status]).toEqual([200, 200, 429])
+    })
+
     test('route paid-request limit overrides the global limit', async () => {
       const app = createApp({
         auth: {
@@ -1648,6 +1714,32 @@ describe('require', () => {
       `)
     })
 
+    test('isolates an explicit endpoint bucket from unrelated public requests', async () => {
+      const app = createScopedApp({
+        routes: [
+          {
+            path: '/other',
+            policy: { public: { rateLimit: { limit: 1, period: 'minute' } } },
+          },
+          {
+            path: '/protected',
+            policy: {
+              public: {
+                bucket: 'protected',
+                rateLimit: { limit: 1, period: 'minute' },
+              },
+            },
+          },
+        ],
+      })
+
+      const other = await app.request('/other')
+      const protected_ = await app.request('/protected')
+      const overflow = await app.request('/protected')
+
+      expect([other.status, protected_.status, overflow.status]).toEqual([200, 200, 429])
+    })
+
     test('returns rate-limit error without payment context', async () => {
       const app = createApp({
         auth: {

package/src/internal/Auth.ts

@@ -44,6 +44,7 @@ import type * as Viem from './Viem.js'
 
 const policySymbol = Symbol('tempo-api.auth.policy')
 const mppManagementSymbol = Symbol('tempo-api.auth.mpp-management')
+const trustedClientIps = new WeakMap<Request, string>()
 const defaultApiKeyRateLimit = { limit: 10_000, period: 'minute' } satisfies RateLimit.Limit
 const defaultIdentitySessionTtl = 24 * 60 * 60
 const defaultMppRateLimit = { limit: 100, period: 'minute' } satisfies RateLimit.Limit
@@ -186,6 +187,8 @@ export type PolicyOverride = {
   /** API-key lane: pass quota/scopes overrides, or a boolean to enable/disable. */
   apiKey?:
     | {
+        /** Optional counter bucket that isolates this route's quota. */
+        bucket?: string | undefined
         /** API-key quota override for this route (a protective per-route cap). */
         rateLimit?: RateLimit.Limit | undefined
         /** Required API-key scopes override for this route. */
@@ -196,6 +199,8 @@ export type PolicyOverride = {
   /** MPP paid lane: object to override the Session request, or boolean to enable/disable. */
   mpp?:
     | {
+        /** Optional counter bucket that isolates this route's quota. */
+        bucket?: string | undefined
         /** Paid-request quota override for this route (a protective per-route cap). */
         rateLimit?: RateLimit.Limit | undefined
         /** Tempo Session request override for this route. */
@@ -206,6 +211,8 @@ export type PolicyOverride = {
   /** Public lane: object to override the quota, or boolean to enable/disable. */
   public?:
     | {
+        /** Optional counter bucket that isolates this route's quota. */
+        bucket?: string | undefined
         /** Anonymous public quota override for this route. */
         rateLimit?: RateLimit.Limit | undefined
       }
@@ -288,6 +295,17 @@ export function getPrincipal<environment extends Environment>(c: hono_Context<en
   return c.get('principal') ?? null
 }
 
+/** Resolves the caller IP from configured trusted metadata. */
+export function getTrustedClientIp<environment extends Environment>(c: hono_Context<environment>) {
+  const auth = c.get('auth')
+  return auth ? trustedClientIp(c, auth) : resolveTrustedClientIp(c.req.raw, undefined)
+}
+
+/** Marks a synthesized in-process request with its trusted caller IP address. */
+export function trustClientIp(request: Request, address: string) {
+  trustedClientIps.set(request, address)
+}
+
 /**
  * Guards `:orgId` routes and resolves the organization. Sessions require membership, API keys require ownership, and the super admin bypasses ownership.
  */
@@ -666,8 +684,9 @@ function resolveRequestPolicy(c: hono_Context, options: resolveRequestPolicy.Opt
     const inheritedKey = `${inheritedMethod.toUpperCase()} ${key.slice(key.indexOf(' ') + 1)}`
     return overrides?.[inheritedKey]
   })()
-  const routeOverride =
-    management && configuredOverride ? { mpp: configuredOverride.mpp } : configuredOverride
+  // Generated management routes already materialize the GET's MPP contract.
+  // Reapplying its override would also copy GET-only quota controls.
+  const routeOverride = management ? undefined : configuredOverride
   return {
     management,
     policy: bindMppScope(
@@ -1612,7 +1631,9 @@ export function installMppManagementRoutes(
     if (postPaths.has(target.path))
       throw new Error(`MPP management POST conflicts with an existing route: ${target.path}`)
 
-    const management = policy({ mpp }) as MiddlewareHandler & MppManagementHandler
+    const management = policy({
+      mpp: { session: mpp.session },
+    }) as MiddlewareHandler & MppManagementHandler
     management[mppManagementSymbol] = { description: target.description }
     app.post(
       stripBasePath(target.path, options.basePath),
@@ -1776,6 +1797,7 @@ function resolveApiKeyLane(
   if (override === true) return current ?? default_
   const base = current ?? default_
   return {
+    bucket: override.bucket ?? base.bucket,
     rateLimit: override.rateLimit ?? base.rateLimit,
     scopes: override.scopes ?? base.scopes,
   }
@@ -1791,6 +1813,7 @@ function resolveMppLane(
   if (override === true) return current ?? default_
   const base = current ?? default_
   return {
+    bucket: override.bucket ?? base.bucket,
     rateLimit: override.rateLimit ?? base.rateLimit,
     session: { ...base.session, ...override.session },
   }
@@ -1805,7 +1828,10 @@ function resolvePublicLane(
   if (override === false) return undefined
   if (override === true) return current ?? default_
   const base = current ?? default_
-  return { rateLimit: override.rateLimit ?? base.rateLimit }
+  return {
+    bucket: override.bucket ?? base.bucket,
+    rateLimit: override.rateLimit ?? base.rateLimit,
+  }
 }
 
 function resolveSessionLane(
@@ -2088,7 +2114,7 @@ export function require<environment extends Environment = Environment>(
       const result = paid
         ? null
         : await consumeRateLimit(auth, {
-            key: `api_key:${apiKey.id}:scope:${scope}`,
+            key: rateLimitKey(`api_key:${apiKey.id}:scope:${scope}`, policy.apiKey.bucket),
             limit,
           })
       if (result) {
@@ -2188,7 +2214,7 @@ export function require<environment extends Environment = Environment>(
     const limit = policy.public?.rateLimit
     if (limit) {
       const result = await consumeRateLimit(auth, {
-        key: `public:${publicPrincipal.id}`,
+        key: rateLimitKey(`public:${publicPrincipal.id}`, policy.public?.bucket),
         limit,
       })
       if (result) setRateLimitHeaders(c, result)
@@ -2231,6 +2257,8 @@ export declare namespace require {
     /** API-key access policy. */
     apiKey?:
       | {
+          /** Optional counter bucket that isolates this route's quota. */
+          bucket?: string | undefined
           /** API-key quota override for this route (a protective per-route cap). */
           rateLimit?: RateLimit.Limit | undefined
           /**
@@ -2244,6 +2272,8 @@ export declare namespace require {
     /** MPP payment access policy. */
     mpp?:
       | {
+          /** Optional counter bucket that isolates this route's quota. */
+          bucket?: string | undefined
           /** Paid-request quota override for this route (a protective per-route cap). */
           rateLimit?: RateLimit.Limit | undefined
           /** Tempo Session request policy. */
@@ -2253,6 +2283,8 @@ export declare namespace require {
     /** Public access policy. */
     public?:
       | {
+          /** Optional counter bucket that isolates this route's quota. */
+          bucket?: string | undefined
           /** Anonymous public quota for this route. */
           rateLimit: RateLimit.Limit
         }
@@ -2397,11 +2429,14 @@ function getApiKeyCredential(c: hono_Context): ApiKeyCredential | false | null {
 }
 
 function clientIp(c: hono_Context, auth: Context): string | undefined {
-  return auth.publicClientIp ? auth.publicClientIp(c.req.raw) : c.req.header('cf-connecting-ip')
+  return (
+    trustedClientIps.get(c.req.raw) ??
+    (auth.publicClientIp ? auth.publicClientIp(c.req.raw) : c.req.header('cf-connecting-ip'))
+  )
 }
 
 function trustedClientIp(c: hono_Context, auth: Context): string | undefined {
-  return resolveTrustedClientIp(c.req.raw, auth.publicClientIp)
+  return trustedClientIps.get(c.req.raw) ?? resolveTrustedClientIp(c.req.raw, auth.publicClientIp)
 }
 
 function resolveTrustedClientIp(
@@ -2544,7 +2579,10 @@ async function requirePayment<environment extends Environment>(
 ) {
   if (hasPaymentCredential(c)) {
     const result = await consumeRateLimit(options.auth, {
-      key: `mpp:${options.principal.type}:${options.principal.id}`,
+      key: rateLimitKey(
+        `mpp:${options.principal.type}:${options.principal.id}`,
+        options.policy.mpp?.bucket,
+      ),
       limit: options.policy.mpp?.rateLimit ?? options.auth.mpp?.rateLimit ?? defaultMppRateLimit,
     })
     if (result) {
@@ -2601,6 +2639,10 @@ function requirePaymentOrRateLimit<environment extends Environment>(
   return rateLimitExceeded(c, options.rateLimit)
 }
 
+function rateLimitKey(key: string, bucket: string | undefined) {
+  return bucket === undefined ? key : `${key}:bucket:${bucket}`
+}
+
 /** Emits a `429` with a `Retry-After` derived from the window reset. */
 function rateLimitExceeded(c: hono_Context, result: RateLimit.Result) {
   c.header('Retry-After', String(Math.max(result.reset - Math.ceil(Date.now() / 1_000), 1)))