tapimo 0.15.0 → 0.18.0

package/README.md

@@ -135,6 +135,143 @@ token.symbol
 
 ## Development
 
+### Local API with local Horcrux
+
+Clone the Horcrux backend as a sibling checkout (the checkout must include the
+`horcrux dev` local-signing backend), then prepare this checkout:
+
+```sh
+git clone https://github.com/tempoxyz/horcrux.git ../horcrux
+pnpm setup:env
+```
+
+Set these values in the ignored repo-root `.env`:
+
+```dotenv
+HORCRUX_URL=http://127.0.0.1:3040
+HORCRUX_ACCESS_CLIENT_ID=
+HORCRUX_ACCESS_CLIENT_SECRET=
+HORCRUX_ROUTES_TRANSFER_SUBSIDY_WALLETS=0xf39Fd6e51aad88F6F4ce6aB8827279cffFb92266
+ROUTES_SUBSIDY_MAX_AMOUNT=0.10
+```
+
+Start the opt-in stack with `docker compose --profile subsidies up -d --build`.
+Set `TEMPO_API_HORCRUX_SOURCE` if the sibling checkout is elsewhere. Compose mounts
+the public `seeds/horcrux-wallets.json` fixture read-only and starts `horcrux dev`
+with `HORCRUX_DEV_WALLETS=/etc/horcrux/wallets.json`. To customize the preinitialized
+wallets, copy the manifest, preserve its schema, use stable UUIDs, and set
+`TEMPO_API_HORCRUX_WALLETS` to that host path. Horcrux atomically initializes the
+fixed development team/grant and refuses metadata, key, ID, address, or grant
+conflicts. It preserves wallets, signed history, and replay state on restart; do not
+delete its database volume as a routine reinitialization step.
+
+The fixture contains EVM, Tron, and Solana wallets and uses only publicly compromised
+developer keys. Never use these keys for real credentials or send real funds to any
+derived address. The EVM wallet is public Anvil account 0. API route subsidies still
+use only that EVM address through the normal Horcrux viem SDK; local Horcrux does not
+add API-managed Tron or Solana subsidies. Direct Horcrux HTTP clients identify all
+wallet families by the manifest UUID, while the viem integration can look up its EVM
+wallet by address. The dev backend exposes the normal EVM/Tempo, Solana, Tron, and
+hash signing APIs without policies or broadcasting.
+
+Horcrux shares the API container's network namespace and listens only on loopback;
+unauthenticated SDK access is accepted only by an API with
+`ENVIRONMENT=development`, a loopback HTTP(S) URL, and both Cloudflare credentials
+absent. After changing `.env` or the manifest,
+run `docker compose restart api horcrux`. This profile starts a signer only: it does
+not start bridges, Tron, Solana, Base/Ethereum forks, or other chains. Point the
+relevant RPC URLs at disposable nodes yourself. Signing locally does not change
+where the API broadcasts. Fund the EVM address with disposable destination tokens
+and fee funds on the tested chain only when exercising settlement.
+`ROUTES_SUBSIDY_MAX_AMOUNT` is a per-subsidy cap, not a total spending budget.
+
+Developers not exercising Routes subsidies can leave
+`HORCRUX_ROUTES_TRANSFER_SUBSIDY_WALLETS` empty and run the API without Horcrux
+access. Fee sponsorship keeps its existing setup; there is no private-key fallback
+for Routes subsidies.
+
+### Hosted Routes subsidy wallets
+
+Set `HORCRUX_ROUTES_TRANSFER_SUBSIDY_WALLETS` to a comma-separated list of EVM
+wallet addresses registered in Horcrux. The first address funds new commitments;
+retain retiring addresses until their existing commitments settle. Address-based
+`horcruxAccount` construction is synchronous and requires no discovery request.
+These wallets need the destination token and transaction fee funds on each
+supported destination chain. Fee sponsorship, MPP settlement, and rewards signing
+remain separate.
+
+The first EVM wallet also signs inbound Tempo deposit subsidies through Horcrux
+sign-hash. Fund it with pathUSD and its selected fee token on Tempo. Transfer
+reservations do not count deposit top-ups, so monitor the shared Tempo balance for
+both obligations. Relay fixed-rate deposit addresses use Relay's 1:1 subsidy.
+
+The SDK is pinned to `@zygis-tempo/horcrux-viem@0.1.0` on npm, aliased as
+`@horcrux/viem`. The SDK owns the Horcrux signing protocol; the API still owns
+inventory checks, nonce reservations, transaction persistence, and broadcast.
+
+For production, `apps/api/wrangler.background.jsonc` owns `HORCRUX_URL` and
+`HORCRUX_ROUTES_TRANSFER_SUBSIDY_WALLETS`. CI and `pnpm -C apps/api deploy` run
+`apps/api/scripts/prepare:production.ts` to copy only those values into the HTTP
+Worker's generated `wrangler.deploy.jsonc`. The shared `wrangler.jsonc` has no
+production Horcrux defaults, so local development and previews cannot inherit them.
+The HTTP deployment keeps queue producers but leaves consumers, cron, and the
+reward signer binding on `api-background`.
+
+Keep `HORCRUX_ACCESS_CLIENT_ID` and `HORCRUX_ACCESS_CLIENT_SECRET` as Cloudflare
+secrets on both production Workers before rollout. They are not stored in Wrangler
+configuration or read from GitHub Actions. If the URL or wallet list was previously
+stored as a Cloudflare secret, remove that secret binding before deploying the
+same name as a plain-text Wrangler variable.
+
+For PR and main-tracking previews, configure these once in the API repository's
+GitHub Actions settings. CI uploads them to each preview Worker under the same
+names without the `_DEV` suffix; no manual Worker configuration is needed.
+
+| GitHub Actions setting | Name                                               | Value                                                                                                            |
+| ---------------------- | -------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------- |
+| Secret or variable     | `HORCRUX_URL_DEV`                                  | Cloudflare-accessible runtime API base URL of the Horcrux instance containing the dev wallet (not its admin URL) |
+| Secret or variable     | `HORCRUX_ROUTES_TRANSFER_SUBSIDY_WALLETS_DEV`      | Comma-separated EVM wallet addresses, active first, not UUIDs                                                    |
+| Secret or variable     | `HORCRUX_ROUTES_TRANSFER_SUBSIDY_TRON_WALLETS_DEV` | Comma-separated Tron address and Horcrux UUID pairs, active first                                                |
+| Secret                 | `HORCRUX_ACCESS_CLIENT_ID_DEV`                     | Dev Cloudflare Access client ID                                                                                  |
+| Secret                 | `HORCRUX_ACCESS_CLIENT_SECRET_DEV`                 | Dev Cloudflare Access client secret                                                                              |
+
+Secrets take precedence when both a secret and variable have the same name.
+The credential pair must be complete or absent. Setting a wallet list requires
+the URL and both credentials. Removing both wallet settings disables transfer
+subsidies on the next preview deployment; drain pending commitments first.
+Absent credentials leave existing Worker credentials unchanged. Use only dev
+wallets and an identity authorized for those wallets. CI's disposable local signer
+needs none of these settings.
+
+Grant the workload access to each subsidy wallet and permit its destination-chain
+ERC-20 transfers. `ROUTES_SUBSIDY_MAX_AMOUNT` remains the operational USD limit.
+An empty wallet list disables transfer subsidies; enabled subsidies with incomplete
+Horcrux credentials fail closed. There is no private-key fallback.
+
+For Tempo USDT0 to Tron USDT, set `HORCRUX_ROUTES_TRANSFER_SUBSIDY_TRON_WALLETS`
+to comma-separated `TronAddress:HorcruxWalletUUID` pairs, active first. Fund those
+wallets with Tron USDT and TRX. Set `ROUTES_TRON_SUBSIDY_FEE_LIMIT_SUN` to the
+maximum native fee reserved for each TRC-20 transfer. The API persists Tron
+transaction bytes before Horcrux signing and reuses the same signature and
+transaction on retries. Keep retiring wallets configured until their pending
+transfers settle. The production wallet mapping belongs in
+`apps/api/wrangler.background.jsonc`; the deploy script copies it into the HTTP
+Worker when present. An empty mapping leaves Tron transfer subsidies disabled.
+
+This replaces `ROUTES_TRANSFER_SUBSIDY_ACCOUNT` and
+`ROUTES_TRANSFER_SUBSIDY_PRIVATE_KEY`. For migration, register the existing wallets
+in Horcrux or drain their unsigned commitments before switching addresses. After
+cutover, remove the unused private-key secrets from Cloudflare and GitHub;
+deployment workflows no longer upload them. Persisted signed transactions still
+replay through the existing nonce and settlement records. Token top-up billing
+is unchanged; destination gas remains paid by Tempo.
+
+Run the configuration tests with disposable local infrastructure:
+
+```sh
+pnpm test:local apps/api/src/RoutesTransferSubsidies.test.ts --run
+```
+
 ### Quickprompt
 
 Paste into your agent:

package/dist/ApiKey.d.ts

@@ -46,6 +46,7 @@ export type ApiKey = z.output<typeof schema.ApiKey>;
  * never reach logs. Apply to anything that may embed a credential — error
  * stacks, request dumps, and the values of the `tempo-api-key` and
  * `Authorization` headers (whose tokens match the issued-token pattern).
+ * CLI session tokens are masked too.
  */
 export declare function redact(text: string): string;
 /**

package/dist/ApiKey.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ApiKey.d.ts","sourceRoot":"","sources":["../src/ApiKey.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,KAAK,CAAC,MAAM,UAAU,CAAA;AAM7B,+CAA+C;AAC/C,yBAAiB,MAAM,CAAC;IACtB,gEAAgE;IACzD,MAAM,UAAU,4DAepB,CAAA;IAEH;;;;;OAKG;IACI,MAAM,MAAM;;;;;;;;;;;;;;;;qBAiCjB,CAAA;CACH;AAED,mDAAmD;AACnD,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAA;AAEnD;;;;;GAKG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAI3C;AAiCD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,WAAW,GAAE,MAAM,CAAC,aAAa,CAAgB,GAAG,MAAM,CAEvF;AAED,mDAAmD;AACnD,wBAAgB,UAAU,IAAI,MAAM,CAEnC;AAED,qFAAqF;AACrF,eAAO,MAAM,YAAY,YAAY,CAAA;AAErC,oFAAoF;AACpF,wBAAgB,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE1C;AAED,6EAA6E;AAC7E,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE5C"}
+{"version":3,"file":"ApiKey.d.ts","sourceRoot":"","sources":["../src/ApiKey.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,KAAK,CAAC,MAAM,UAAU,CAAA;AAO7B,+CAA+C;AAC/C,yBAAiB,MAAM,CAAC;IACtB,gEAAgE;IACzD,MAAM,UAAU,4DAepB,CAAA;IAEH;;;;;OAKG;IACI,MAAM,MAAM;;;;;;;;;;;;;;;;qBAiCjB,CAAA;CACH;AAED,mDAAmD;AACnD,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAA;AAEnD;;;;;;GAMG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAM3C;AAiCD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,WAAW,GAAE,MAAM,CAAC,aAAa,CAAgB,GAAG,MAAM,CAEvF;AAED,mDAAmD;AACnD,wBAAgB,UAAU,IAAI,MAAM,CAEnC;AAED,qFAAqF;AACrF,eAAO,MAAM,YAAY,YAAY,CAAA;AAErC,oFAAoF;AACpF,wBAAgB,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE1C;AAED,6EAA6E;AAC7E,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE5C"}

package/dist/ApiKey.js

@@ -12,6 +12,7 @@
  */
 import { Hash, Hex } from 'ox';
 import * as z from 'zod/mini';
+import * as CliAuth from './internal/CliAuth.js';
 import * as Id from './internal/Id.js';
 import * as IpAllowlist from './internal/IpAllowlist.js';
 import * as RateLimit from './internal/RateLimit.js';
@@ -57,11 +58,12 @@ export var schema;
  * never reach logs. Apply to anything that may embed a credential — error
  * stacks, request dumps, and the values of the `tempo-api-key` and
  * `Authorization` headers (whose tokens match the issued-token pattern).
+ * CLI session tokens are masked too.
  */
 export function redact(text) {
-    return text
+    return CliAuth.redact(text
         .replace(tokenPattern(), (match) => `${match.split('sk:')[0]}sk:…`)
-        .replace(legacyTokenPattern(), 'tempo_…');
+        .replace(legacyTokenPattern(), 'tempo_…'));
 }
 /**
  * Token prefix per environment. The prefix encodes the environment so a leaked

package/dist/ApiKey.js.map

@@ -1 +1 @@
-{"version":3,"file":"ApiKey.js","sourceRoot":"","sources":["../src/ApiKey.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,IAAI,CAAA;AAC9B,OAAO,KAAK,CAAC,MAAM,UAAU,CAAA;AAE7B,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,WAAW,MAAM,2BAA2B,CAAA;AACxD,OAAO,KAAK,SAAS,MAAM,yBAAyB,CAAA;AAEpD,+CAA+C;AAC/C,MAAM,KAAW,MAAM,CA2DtB;AA3DD,WAAiB,MAAM;IACrB,gEAAgE;IACnD,iBAAU,GAAG,CAAC;SACxB,QAAQ,CACP,CAAC,CAAC,KAAK,CACL,CAAC;SACE,MAAM,EAAE;SACR,KAAK,CACJ,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,EACf,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,EAC5B,CAAC,CAAC,QAAQ,CAAC,2CAA2C,CAAC,CACxD,CACJ,CACF;SACA,KAAK,CACJ,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,EAChB,CAAC,CAAC,QAAQ,CAAC,0EAA0E,CAAC,CACvF,CAAA;IAEH;;;;;OAKG;IACU,aAAM,GAAG,CAAC,CAAC,MAAM,CAAC;QAC7B,UAAU,EAAE,CAAC;aACV,QAAQ,CAAC,iBAAU,EAAE,EAAE,CAAC;aACxB,KAAK,CACJ,CAAC,CAAC,QAAQ,CACR,uGAAuG,CACxG,EACD,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC,CAC1D;QACH,aAAa,EAAE,CAAC;aACb,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;aACrB,KAAK,CACJ,CAAC,CAAC,QAAQ,CACR,6TAA6T,CAC9T,CACF;QACH,WAAW,EAAE,CAAC;aACX,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC,EAAE,YAAY,CAAC;aACzD,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;QACxC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QAClD,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,0BAA0B,CAAC,CAAC;QAC1E,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,yBAAyB,CAAC,CAAC;QAC9D,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,kCAAkC,CAAC,CAAC;QACvF,UAAU,EAAE,CAAC;aACV,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;aACtD,KAAK,CACJ,CAAC,CAAC,QAAQ,CACR,+LAA+L,CAChM,CACF;QACH,MAAM,EAAE,CAAC;aACN,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;aACnD,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,wCAAwC,CAAC,CAAC;KAC/D,CAAC,CAAA;AACJ,CAAC,EA3DgB,MAAM,KAAN,MAAM,QA2DtB;AAKD;;;;;GAKG;AACH,MAAM,UAAU,MAAM,CAAC,IAAY;IACjC,OAAO,IAAI;SACR,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;SAClE,OAAO,CAAC,kBAAkB,EAAE,EAAE,SAAS,CAAC,CAAA;AAC7C,CAAC;AAED;;;;;GAKG;AACH,MAAM,WAAW,GAAG;IAClB,UAAU,EAAE,WAAW;IACvB,OAAO,EAAE,mBAAmB;CACpB,CAAA;AAEV;;;;;GAKG;AACH,SAAS,YAAY;IACnB,OAAO,sCAAsC,CAAA;AAC/C,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB;IACzB,OAAO,qBAAqB,CAAA;AAC9B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,WAAW,GAA0B,YAAY;IAC7E,OAAO,GAAG,WAAW,CAAC,WAAW,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAA;AAChE,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,UAAU;IACxB,OAAO,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;AAC3B,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,MAAM,YAAY,GAAG,SAAS,CAAA;AAErC,oFAAoF;AACpF,MAAM,UAAU,IAAI,CAAC,KAAa;IAChC,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;AACpD,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,MAAM,CAAC,KAAa;IAClC,OAAO,GAAG,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAA;AACxC,CAAC"}
+{"version":3,"file":"ApiKey.js","sourceRoot":"","sources":["../src/ApiKey.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,IAAI,CAAA;AAC9B,OAAO,KAAK,CAAC,MAAM,UAAU,CAAA;AAE7B,OAAO,KAAK,OAAO,MAAM,uBAAuB,CAAA;AAChD,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,WAAW,MAAM,2BAA2B,CAAA;AACxD,OAAO,KAAK,SAAS,MAAM,yBAAyB,CAAA;AAEpD,+CAA+C;AAC/C,MAAM,KAAW,MAAM,CA2DtB;AA3DD,WAAiB,MAAM;IACrB,gEAAgE;IACnD,iBAAU,GAAG,CAAC;SACxB,QAAQ,CACP,CAAC,CAAC,KAAK,CACL,CAAC;SACE,MAAM,EAAE;SACR,KAAK,CACJ,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,EACf,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,EAC5B,CAAC,CAAC,QAAQ,CAAC,2CAA2C,CAAC,CACxD,CACJ,CACF;SACA,KAAK,CACJ,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,EAChB,CAAC,CAAC,QAAQ,CAAC,0EAA0E,CAAC,CACvF,CAAA;IAEH;;;;;OAKG;IACU,aAAM,GAAG,CAAC,CAAC,MAAM,CAAC;QAC7B,UAAU,EAAE,CAAC;aACV,QAAQ,CAAC,iBAAU,EAAE,EAAE,CAAC;aACxB,KAAK,CACJ,CAAC,CAAC,QAAQ,CACR,uGAAuG,CACxG,EACD,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC,CAC1D;QACH,aAAa,EAAE,CAAC;aACb,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;aACrB,KAAK,CACJ,CAAC,CAAC,QAAQ,CACR,6TAA6T,CAC9T,CACF;QACH,WAAW,EAAE,CAAC;aACX,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC,EAAE,YAAY,CAAC;aACzD,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;QACxC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QAClD,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,0BAA0B,CAAC,CAAC;QAC1E,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,yBAAyB,CAAC,CAAC;QAC9D,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,kCAAkC,CAAC,CAAC;QACvF,UAAU,EAAE,CAAC;aACV,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;aACtD,KAAK,CACJ,CAAC,CAAC,QAAQ,CACR,+LAA+L,CAChM,CACF;QACH,MAAM,EAAE,CAAC;aACN,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;aACnD,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,wCAAwC,CAAC,CAAC;KAC/D,CAAC,CAAA;AACJ,CAAC,EA3DgB,MAAM,KAAN,MAAM,QA2DtB;AAKD;;;;;;GAMG;AACH,MAAM,UAAU,MAAM,CAAC,IAAY;IACjC,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI;SACD,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;SAClE,OAAO,CAAC,kBAAkB,EAAE,EAAE,SAAS,CAAC,CAC5C,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,WAAW,GAAG;IAClB,UAAU,EAAE,WAAW;IACvB,OAAO,EAAE,mBAAmB;CACpB,CAAA;AAEV;;;;;GAKG;AACH,SAAS,YAAY;IACnB,OAAO,sCAAsC,CAAA;AAC/C,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB;IACzB,OAAO,qBAAqB,CAAA;AAC9B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,WAAW,GAA0B,YAAY;IAC7E,OAAO,GAAG,WAAW,CAAC,WAAW,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAA;AAChE,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,UAAU;IACxB,OAAO,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;AAC3B,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,MAAM,YAAY,GAAG,SAAS,CAAA;AAErC,oFAAoF;AACpF,MAAM,UAAU,IAAI,CAAC,KAAa;IAChC,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;AACpD,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,MAAM,CAAC,KAAa;IAClC,OAAO,GAAG,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAA;AACxC,CAAC"}

package/dist/ApiKeys.d.ts

@@ -28,6 +28,10 @@ export declare namespace schema {
      * scope identifiers against its configured catalog.
      */
     const MintInput: z.ZodMiniObject<{
+        createdBy: z.ZodMiniOptional<z.ZodMiniString<string>>;
+        expiresAt: z.ZodMiniOptional<z.ZodMiniISODateTime>;
+        orgId: z.ZodMiniOptional<z.ZodMiniString<string>>;
+        scopes: z.ZodMiniReadonly<z.ZodMiniArray<z.ZodMiniString<string>>>;
         allowedIps: z.ZodMiniDefault<z.ZodMiniReadonly<z.ZodMiniArray<z.ZodMiniString<string>>>>;
         billingActive: z.ZodMiniOptional<z.ZodMiniBoolean<boolean>>;
         environment: z.ZodMiniDefault<z.ZodMiniEnum<{
@@ -40,10 +44,6 @@ export declare namespace schema {
             limit: z.ZodMiniNumber<number>;
             period: z.ZodMiniUnion<readonly [z.ZodMiniLiteral<"minute">, z.ZodMiniLiteral<"second">]>;
         }, z.core.$strip>>>;
-        createdBy: z.ZodMiniOptional<z.ZodMiniString<string>>;
-        expiresAt: z.ZodMiniOptional<z.ZodMiniISODateTime>;
-        orgId: z.ZodMiniOptional<z.ZodMiniString<string>>;
-        scopes: z.ZodMiniReadonly<z.ZodMiniArray<z.ZodMiniString<string>>>;
     }, z.core.$strip>;
     /**
      * A persisted API-key record: the resolved `ApiKey.schema` plus
@@ -51,6 +51,10 @@ export declare namespace schema {
      * and persisted shapes in lockstep.
      */
     const Record: z.ZodMiniObject<{
+        createdAt: z.ZodMiniString<string>;
+        createdBy: z.ZodMiniOptional<z.ZodMiniString<string>>;
+        expiresAt: z.ZodMiniOptional<z.ZodMiniString<string>>;
+        tokenLast4: z.ZodMiniString<string>;
         allowedIps: z.ZodMiniDefault<z.ZodMiniReadonly<z.ZodMiniArray<z.ZodMiniString<string>>>>;
         billingActive: z.ZodMiniOptional<z.ZodMiniBoolean<boolean>>;
         environment: z.ZodMiniDefault<z.ZodMiniEnum<{
@@ -66,10 +70,6 @@ export declare namespace schema {
             period: z.ZodMiniUnion<readonly [z.ZodMiniLiteral<"minute">, z.ZodMiniLiteral<"second">]>;
         }, z.core.$strip>>>;
         scopes: z.ZodMiniReadonly<z.ZodMiniArray<z.ZodMiniString<string>>>;
-        createdAt: z.ZodMiniString<string>;
-        createdBy: z.ZodMiniOptional<z.ZodMiniString<string>>;
-        expiresAt: z.ZodMiniOptional<z.ZodMiniString<string>>;
-        tokenLast4: z.ZodMiniString<string>;
     }, z.core.$strip>;
 }
 /**
@@ -104,9 +104,18 @@ export type MintResult = {
  */
 export declare function mint(state: Store.State, input: MintInput, options?: mint.Options): Promise<MintResult>;
 /** Mints an attributed key after atomically reserving an organization-wide live-key slot. */
-export declare function mintBounded(db: Db.Db, state: Store.State, input: MintInput, options?: mint.Options): Promise<MintResult>;
-/** Durably fences key use before deleting its organization or project. The idempotent fence remains on failure so concurrent attempts cannot reopen the owner. */
+export declare function mintBounded(db: Db.Db, state: Store.State, input: MintInput, options?: mintBounded.Options): Promise<MintResult>;
+export declare namespace mintBounded {
+    /** Options for {@link mintBounded}. */
+    type Options = mint.Options & {
+        /** Scopes the locked policy-source key must authorize before issuance. */
+        sourceScopes?: readonly Scope.Id[] | undefined;
+    };
+}
+/** Durably fences key use before deleting its organization or project. Reconcile failed deletions against committed SQL state before removing the fence. */
 export declare function markOwnerDeleting(state: Store.State, owner: markOwnerDeleting.Owner): Promise<void>;
+/** Removes an aborted deletion's KV fence while holding the SQL owner lock against concurrent deletion. */
+export declare function reconcileOwnerDeletion(db: Db.Db, state: Store.State, owner: markOwnerDeleting.Owner): Promise<void>;
 export declare namespace markOwnerDeleting {
     /** API-key owner being deleted. */
     type Owner = {
@@ -121,6 +130,8 @@ export declare namespace mint {
     type Options = {
         /** Scope catalog accepted while minting the key. */
         scopeCatalog?: Scope.Catalog | undefined;
+        /** Existing key whose explicit route-policy overrides are copied to this replacement. */
+        policySourceApiKeyId?: string | undefined;
     };
 }
 /**
@@ -222,7 +233,7 @@ export declare namespace listByOrg {
     };
 }
 /**
- * Revokes a key by id, deleting its record and index entries.
+ * Revokes a key by id with a durable KV marker, then deletes its record and index entries.
  *
  * @param state - The KV state store holding key records.
  * @param id - The key id (`key_…`).
@@ -345,6 +356,21 @@ export declare namespace backfill {
         scanned: number;
     };
 }
+/** Returns whether a key is revoked or its organization or project is being deleted, in one bulk read. */
+export declare function isFenced(state: Store.State, key: isFenced.Key): Promise<boolean>;
+export declare namespace isFenced {
+    /** Key identity the fences apply to. */
+    type Key = {
+        /** Key id (`key_…`). */
+        id: string;
+        /** Owning organization id. */
+        orgId: string;
+        /** Owning project id, when project-attributed. */
+        projectId?: string | undefined;
+    };
+}
+/** Returns whether a key has a durable KV revocation marker. */
+export declare function isRevoked(state: Store.State, id: string): Promise<boolean>;
 /** Returns whether the organization or attributed project has been deleted. */
 export declare function isOwnerDeleted(state: Store.State, owner: isOwnerDeleted.Owner): Promise<boolean>;
 export declare namespace isOwnerDeleted {

package/dist/ApiKeys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ApiKeys.d.ts","sourceRoot":"","sources":["../src/ApiKeys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,CAAC,MAAM,UAAU,CAAA;AAE7B,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;AACrC,OAAO,KAAK,KAAK,EAAE,MAAM,YAAY,CAAA;AAIrC,OAAO,KAAK,KAAK,MAAM,qBAAqB,CAAA;AAC5C,OAAO,KAAK,KAAK,MAAM,YAAY,CAAA;AAOnC,4DAA4D;AAC5D,eAAO,MAAM,0BAA0B,MAAM,CAAA;AAE7C,uFAAuF;AACvF,eAAO,MAAM,yBAAyB,OAAQ,CAAA;AAE9C,gDAAgD;AAChD,yBAAiB,MAAM,CAAC;IACtB;;;;OAIG;IACI,MAAM,SAAS;;;;;;;;;;;;;;;;;qBAapB,CAAA;IAEF;;;;OAIG;IACI,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;qBAKjB,CAAA;CACH;AAED;;;;;GAKG;AACH,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAA;AAEnD;;;;GAIG;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,SAAS,CAAC,CAAA;AAExD,2EAA2E;AAC3E,MAAM,MAAM,UAAU,GAAG;IACvB,kEAAkE;IAClE,MAAM,EAAE,MAAM,CAAA;IACd,mEAAmE;IACnE,KAAK,EAAE,MAAM,CAAA;CACd,CAAA;AAED;;;;;;;;;GASG;AACH,wBAAsB,IAAI,CACxB,KAAK,EAAE,KAAK,CAAC,KAAK,EAClB,KAAK,EAAE,SAAS,EAChB,OAAO,GAAE,IAAI,CAAC,OAAY,GACzB,OAAO,CAAC,UAAU,CAAC,CAErB;AA8CD,6FAA6F;AAC7F,wBAAsB,WAAW,CAC/B,EAAE,EAAE,EAAE,CAAC,EAAE,EACT,KAAK,EAAE,KAAK,CAAC,KAAK,EAClB,KAAK,EAAE,SAAS,EAChB,OAAO,GAAE,IAAI,CAAC,OAAY,GACzB,OAAO,CAAC,UAAU,CAAC,CAyBrB;AAED,kKAAkK;AAClK,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,KAAK,CAAC,KAAK,EAClB,KAAK,EAAE,iBAAiB,CAAC,KAAK,GAC7B,OAAO,CAAC,IAAI,CAAC,CAEf;AAED,MAAM,CAAC,OAAO,WAAW,iBAAiB,CAAC;IACzC,mCAAmC;IACnC,KAAK,KAAK,GAAG;QACX,8BAA8B;QAC9B,KAAK,EAAE,MAAM,CAAA;QACb,iDAAiD;QACjD,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAC/B,CAAA;CACF;AAED,MAAM,CAAC,OAAO,WAAW,IAAI,CAAC;IAC5B,gCAAgC;IAChC,KAAK,OAAO,GAAG;QACb,oDAAoD;QACpD,YAAY,CAAC,EAAE,KAAK,CAAC,OAAO,GAAG,SAAS,CAAA;KACzC,CAAA;CACF;AAED;;;;;;;;;GASG;AACH,wBAAsB,OAAO,CAC3B,KAAK,EAAE,KAAK,CAAC,KAAK,EAClB,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,OAAO,CAAC,OAAY,GAC5B,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,CAS/B;AAED,MAAM,CAAC,OAAO,WAAW,OAAO,CAAC;IAC/B,mCAAmC;IACnC,KAAK,OAAO,GAAG;QACb,sDAAsD;QACtD,YAAY,CAAC,EAAE,KAAK,CAAC,OAAO,GAAG,SAAS,CAAA;KACzC,CAAA;CACF;AAED;;;;;;;GAOG;AACH,wBAAsB,GAAG,CACvB,KAAK,EAAE,KAAK,CAAC,KAAK,EAClB,EAAE,EAAE,MAAM,EACV,OAAO,GAAE,GAAG,CAAC,OAAY,GACxB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAIxB;AAED,MAAM,CAAC,OAAO,WAAW,GAAG,CAAC;IAC3B,+BAA+B;IAC/B,KAAK,OAAO,GAAG;QACb,oDAAoD;QACpD,YAAY,CAAC,EAAE,KAAK,CAAC,OAAO,GAAG,SAAS,CAAA;KACzC,CAAA;CACF;AAED;;;;;;;GAOG;AACH,wBAAsB,IAAI,CACxB,KAAK,EAAE,KAAK,CAAC,KAAK,EAClB,OAAO,GAAE,IAAI,CAAC,OAAY,GACzB,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAkB5B;AAED,MAAM,CAAC,OAAO,WAAW,IAAI,CAAC;IAC5B,gCAAgC;IAChC,KAAK,OAAO,GAAG;QACb,2DAA2D;QAC3D,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAC1B,iDAAiD;QACjD,YAAY,CAAC,EAAE,KAAK,CAAC,OAAO,GAAG,SAAS,CAAA;KACzC,CAAA;CACF;AAED;;;;;;;;;GASG;AACH,wBAAsB,SAAS,CAC7B,KAAK,EAAE,KAAK,CAAC,KAAK,EAClB,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,SAAS,CAAC,OAAY,GAC9B,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAO5B;AAED,kEAAkE;AAClE,wBAAsB,aAAa,CACjC,KAAK,EAAE,KAAK,CAAC,KAAK,EAClB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,aAAa,CAAC,OAAO,GAC7B,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,CAwC/B;AAED,MAAM,CAAC,OAAO,WAAW,aAAa,CAAC;IACrC,4CAA4C;IAC5C,KAAK,OAAO,GAAG,SAAS,CAAC,OAAO,GAAG;QACjC,sEAAsE;QACtE,eAAe,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;QACrC,sCAAsC;QACtC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAC3B,qCAAqC;QACrC,KAAK,EAAE,MAAM,CAAA;KACd,CAAA;IAED,qCAAqC;IACrC,KAAK,MAAM,GAAG;QACZ,mDAAmD;QACnD,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAC3B,qDAAqD;QACrD,UAAU,EAAE,MAAM,CAAA;QAClB,iDAAiD;QACjD,YAAY,EAAE,OAAO,CAAA;QACrB,sCAAsC;QACtC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;KAC3B,CAAA;CACF;AAED,MAAM,CAAC,OAAO,WAAW,SAAS,CAAC;IACjC,qCAAqC;IACrC,KAAK,OAAO,GAAG;QACb,oDAAoD;QACpD,WAAW,CAAC,EAAE,YAAY,GAAG,SAAS,GAAG,SAAS,CAAA;QAClD,2DAA2D;QAC3D,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAC9B,iDAAiD;QACjD,YAAY,CAAC,EAAE,KAAK,CAAC,OAAO,GAAG,SAAS,CAAA;KACzC,CAAA;CACF;AAED;;;;;;GAMG;AACH,wBAAsB,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAkB7E;AAED,2FAA2F;AAC3F,wBAAsB,aAAa,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAuB/F;AAED;;;;;;;;;GASG;AACH,wBAAsB,MAAM,CAC1B,KAAK,EAAE,KAAK,CAAC,KAAK,EAClB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,MAAM,CAAC,KAAK,EACnB,OAAO,GAAE,MAAM,CAAC,OAAY,GAC3B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAoDxB;AAED,sFAAsF;AACtF,wBAAsB,aAAa,CACjC,EAAE,EAAE,EAAE,CAAC,EAAE,EACT,KAAK,EAAE,KAAK,CAAC,KAAK,EAClB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,MAAM,CAAC,KAAK,EACnB,OAAO,GAAE,aAAa,CAAC,OAAY,GAClC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA0CxB;AAED,MAAM,CAAC,OAAO,WAAW,aAAa,CAAC;IACrC,qDAAqD;IACrD,KAAK,OAAO,GAAG,MAAM,CAAC,OAAO,GAAG;QAC9B,oDAAoD;QACpD,aAAa,CAAC,EAAE,KAAK,GAAG,SAAS,CAAA;KAClC,CAAA;IAED,qDAAqD;IACrD,KAAK,KAAK,GAAG;QACX,wCAAwC;QACxC,KAAK,EAAE,MAAM,CAAA;QACb,gEAAgE;QAChE,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAC/B,CAAA;CACF;AAED,MAAM,CAAC,OAAO,WAAW,MAAM,CAAC;IAC9B,mFAAmF;IACnF,KAAK,KAAK,GAAG;QACX,kFAAkF;QAClF,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAA;QAC1C,mCAAmC;QACnC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QACzB,4CAA4C;QAC5C,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAC1B,2CAA2C;QAC3C,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAC9B,2CAA2C;QAC3C,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,SAAS,CAAA;QACpD,kCAAkC;QAClC,MAAM,CAAC,EAAE,SAAS,KAAK,CAAC,EAAE,EAAE,GAAG,SAAS,CAAA;KACzC,CAAA;IAED,kCAAkC;IAClC,KAAK,OAAO,GAAG;QACb,oDAAoD;QACpD,YAAY,CAAC,EAAE,KAAK,CAAC,OAAO,GAAG,SAAS,CAAA;KACzC,CAAA;CACF;AAED;;;;;;;;GAQG;AACH,wBAAgB,SAAS,CACvB,KAAK,EAAE,KAAK,CAAC,KAAK,EAClB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,SAAS,CAAC,KAAK,EACtB,OAAO,GAAE,SAAS,CAAC,OAAY,GAC9B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAExB;AAED,MAAM,CAAC,OAAO,WAAW,SAAS,CAAC;IACjC,yFAAyF;IACzF,KAAK,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,GAAG,WAAW,CAAC,CAAA;IAEtD,uDAAuD;IACvD,KAAK,OAAO,GAAG,MAAM,CAAC,OAAO,CAAA;CAC9B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,KAAK,CAAC,KAAK,EAClB,OAAO,EAAE,gBAAgB,CAAC,OAAO,GAChC,OAAO,CAAC,MAAM,CAAC,CA2BjB;AAED,MAAM,CAAC,OAAO,WAAW,gBAAgB,CAAC;IACxC,4CAA4C;IAC5C,KAAK,OAAO,GAAG;QACb,6CAA6C;QAC7C,MAAM,EAAE,OAAO,CAAA;QACf,6CAA6C;QAC7C,WAAW,EAAE,YAAY,GAAG,SAAS,CAAA;QACrC,wCAAwC;QACxC,KAAK,EAAE,MAAM,CAAA;QACb,kDAAkD;QAClD,YAAY,CAAC,EAAE,KAAK,CAAC,OAAO,GAAG,SAAS,CAAA;KACzC,CAAA;CACF;AAED;;;;;;;;GAQG;AACH,wBAAsB,QAAQ,CAC5B,KAAK,EAAE,KAAK,CAAC,KAAK,EAClB,OAAO,GAAE,QAAQ,CAAC,OAAY,GAC7B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAe1B;AAED,MAAM,CAAC,OAAO,WAAW,QAAQ,CAAC;IAChC,oCAAoC;IACpC,KAAK,OAAO,GAAG;QACb,iDAAiD;QACjD,YAAY,CAAC,EAAE,KAAK,CAAC,OAAO,GAAG,SAAS,CAAA;KACzC,CAAA;IAED,kCAAkC;IAClC,KAAK,MAAM,GAAG;QACZ,gDAAgD;QAChD,OAAO,EAAE,MAAM,CAAA;QACf,2EAA2E;QAC3E,OAAO,EAAE,MAAM,CAAA;KAChB,CAAA;CACF;AA4LD,+EAA+E;AAC/E,wBAAsB,cAAc,CAClC,KAAK,EAAE,KAAK,CAAC,KAAK,EAClB,KAAK,EAAE,cAAc,CAAC,KAAK,GAC1B,OAAO,CAAC,OAAO,CAAC,CAGlB;AAED,MAAM,CAAC,OAAO,WAAW,cAAc,CAAC;IACtC,qDAAqD;IACrD,KAAK,KAAK,GAAG,iBAAiB,CAAC,KAAK,CAAA;CACrC;AAeD,2EAA2E;AAC3E,qBAAa,iBAAkB,SAAQ,KAAK;IACjC,IAAI,SAA8B;IAC3C,cAEC;CACF;AAED,oEAAoE;AACpE,qBAAa,iBAAkB,SAAQ,KAAK;IACjC,IAAI,SAA8B;IAC3C,YAAY,KAAK,EAAE,MAAM,EAExB;CACF"}
+{"version":3,"file":"ApiKeys.d.ts","sourceRoot":"","sources":["../src/ApiKeys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,CAAC,MAAM,UAAU,CAAA;AAE7B,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;AACrC,OAAO,KAAK,KAAK,EAAE,MAAM,YAAY,CAAA;AAOrC,OAAO,KAAK,KAAK,MAAM,qBAAqB,CAAA;AAC5C,OAAO,KAAK,KAAK,MAAM,YAAY,CAAA;AAOnC,4DAA4D;AAC5D,eAAO,MAAM,0BAA0B,MAAM,CAAA;AAE7C,uFAAuF;AACvF,eAAO,MAAM,yBAAyB,OAAQ,CAAA;AAE9C,gDAAgD;AAChD,yBAAiB,MAAM,CAAC;IACtB;;;;OAIG;IACI,MAAM,SAAS;;;;;;;;;;;;;;;;;qBAapB,CAAA;IAEF;;;;OAIG;IACI,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;qBAKjB,CAAA;CACH;AAED;;;;;GAKG;AACH,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAA;AAEnD;;;;GAIG;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,SAAS,CAAC,CAAA;AAExD,2EAA2E;AAC3E,MAAM,MAAM,UAAU,GAAG;IACvB,kEAAkE;IAClE,MAAM,EAAE,MAAM,CAAA;IACd,mEAAmE;IACnE,KAAK,EAAE,MAAM,CAAA;CACd,CAAA;AAED;;;;;;;;;GASG;AACH,wBAAsB,IAAI,CACxB,KAAK,EAAE,KAAK,CAAC,KAAK,EAClB,KAAK,EAAE,SAAS,EAChB,OAAO,GAAE,IAAI,CAAC,OAAY,GACzB,OAAO,CAAC,UAAU,CAAC,CAErB;AA8CD,6FAA6F;AAC7F,wBAAsB,WAAW,CAC/B,EAAE,EAAE,EAAE,CAAC,EAAE,EACT,KAAK,EAAE,KAAK,CAAC,KAAK,EAClB,KAAK,EAAE,SAAS,EAChB,OAAO,GAAE,WAAW,CAAC,OAAY,GAChC,OAAO,CAAC,UAAU,CAAC,CAwGrB;AAED,MAAM,CAAC,OAAO,WAAW,WAAW,CAAC;IACnC,uCAAuC;IACvC,KAAK,OAAO,GAAG,IAAI,CAAC,OAAO,GAAG;QAC5B,0EAA0E;QAC1E,YAAY,CAAC,EAAE,SAAS,KAAK,CAAC,EAAE,EAAE,GAAG,SAAS,CAAA;KAC/C,CAAA;CACF;AAED,4JAA4J;AAC5J,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,KAAK,CAAC,KAAK,EAClB,KAAK,EAAE,iBAAiB,CAAC,KAAK,GAC7B,OAAO,CAAC,IAAI,CAAC,CAEf;AAED,2GAA2G;AAC3G,wBAAsB,sBAAsB,CAC1C,EAAE,EAAE,EAAE,CAAC,EAAE,EACT,KAAK,EAAE,KAAK,CAAC,KAAK,EAClB,KAAK,EAAE,iBAAiB,CAAC,KAAK,GAC7B,OAAO,CAAC,IAAI,CAAC,CAKf;AAED,MAAM,CAAC,OAAO,WAAW,iBAAiB,CAAC;IACzC,mCAAmC;IACnC,KAAK,KAAK,GAAG;QACX,8BAA8B;QAC9B,KAAK,EAAE,MAAM,CAAA;QACb,iDAAiD;QACjD,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAC/B,CAAA;CACF;AAED,MAAM,CAAC,OAAO,WAAW,IAAI,CAAC;IAC5B,gCAAgC;IAChC,KAAK,OAAO,GAAG;QACb,oDAAoD;QACpD,YAAY,CAAC,EAAE,KAAK,CAAC,OAAO,GAAG,SAAS,CAAA;QACxC,yFAAyF;QACzF,oBAAoB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAC1C,CAAA;CACF;AAED;;;;;;;;;GASG;AACH,wBAAsB,OAAO,CAC3B,KAAK,EAAE,KAAK,CAAC,KAAK,EAClB,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,OAAO,CAAC,OAAY,GAC5B,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,CAS/B;AAED,MAAM,CAAC,OAAO,WAAW,OAAO,CAAC;IAC/B,mCAAmC;IACnC,KAAK,OAAO,GAAG;QACb,sDAAsD;QACtD,YAAY,CAAC,EAAE,KAAK,CAAC,OAAO,GAAG,SAAS,CAAA;KACzC,CAAA;CACF;AAED;;;;;;;GAOG;AACH,wBAAsB,GAAG,CACvB,KAAK,EAAE,KAAK,CAAC,KAAK,EAClB,EAAE,EAAE,MAAM,EACV,OAAO,GAAE,GAAG,CAAC,OAAY,GACxB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAIxB;AAED,MAAM,CAAC,OAAO,WAAW,GAAG,CAAC;IAC3B,+BAA+B;IAC/B,KAAK,OAAO,GAAG;QACb,oDAAoD;QACpD,YAAY,CAAC,EAAE,KAAK,CAAC,OAAO,GAAG,SAAS,CAAA;KACzC,CAAA;CACF;AAED;;;;;;;GAOG;AACH,wBAAsB,IAAI,CACxB,KAAK,EAAE,KAAK,CAAC,KAAK,EAClB,OAAO,GAAE,IAAI,CAAC,OAAY,GACzB,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAkB5B;AAED,MAAM,CAAC,OAAO,WAAW,IAAI,CAAC;IAC5B,gCAAgC;IAChC,KAAK,OAAO,GAAG;QACb,2DAA2D;QAC3D,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAC1B,iDAAiD;QACjD,YAAY,CAAC,EAAE,KAAK,CAAC,OAAO,GAAG,SAAS,CAAA;KACzC,CAAA;CACF;AAED;;;;;;;;;GASG;AACH,wBAAsB,SAAS,CAC7B,KAAK,EAAE,KAAK,CAAC,KAAK,EAClB,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,SAAS,CAAC,OAAY,GAC9B,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAO5B;AAED,kEAAkE;AAClE,wBAAsB,aAAa,CACjC,KAAK,EAAE,KAAK,CAAC,KAAK,EAClB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,aAAa,CAAC,OAAO,GAC7B,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,CAwC/B;AAED,MAAM,CAAC,OAAO,WAAW,aAAa,CAAC;IACrC,4CAA4C;IAC5C,KAAK,OAAO,GAAG,SAAS,CAAC,OAAO,GAAG;QACjC,sEAAsE;QACtE,eAAe,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;QACrC,sCAAsC;QACtC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAC3B,qCAAqC;QACrC,KAAK,EAAE,MAAM,CAAA;KACd,CAAA;IAED,qCAAqC;IACrC,KAAK,MAAM,GAAG;QACZ,mDAAmD;QACnD,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAC3B,qDAAqD;QACrD,UAAU,EAAE,MAAM,CAAA;QAClB,iDAAiD;QACjD,YAAY,EAAE,OAAO,CAAA;QACrB,sCAAsC;QACtC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;KAC3B,CAAA;CACF;AAED,MAAM,CAAC,OAAO,WAAW,SAAS,CAAC;IACjC,qCAAqC;IACrC,KAAK,OAAO,GAAG;QACb,oDAAoD;QACpD,WAAW,CAAC,EAAE,YAAY,GAAG,SAAS,GAAG,SAAS,CAAA;QAClD,2DAA2D;QAC3D,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAC9B,iDAAiD;QACjD,YAAY,CAAC,EAAE,KAAK,CAAC,OAAO,GAAG,SAAS,CAAA;KACzC,CAAA;CACF;AAED;;;;;;GAMG;AACH,wBAAsB,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAoB7E;AAED,2FAA2F;AAC3F,wBAAsB,aAAa,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAuB/F;AAED;;;;;;;;;GASG;AACH,wBAAsB,MAAM,CAC1B,KAAK,EAAE,KAAK,CAAC,KAAK,EAClB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,MAAM,CAAC,KAAK,EACnB,OAAO,GAAE,MAAM,CAAC,OAAY,GAC3B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAoDxB;AAED,sFAAsF;AACtF,wBAAsB,aAAa,CACjC,EAAE,EAAE,EAAE,CAAC,EAAE,EACT,KAAK,EAAE,KAAK,CAAC,KAAK,EAClB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,MAAM,CAAC,KAAK,EACnB,OAAO,GAAE,aAAa,CAAC,OAAY,GAClC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAqExB;AAgBD,MAAM,CAAC,OAAO,WAAW,aAAa,CAAC;IACrC,qDAAqD;IACrD,KAAK,OAAO,GAAG,MAAM,CAAC,OAAO,GAAG;QAC9B,oDAAoD;QACpD,aAAa,CAAC,EAAE,KAAK,GAAG,SAAS,CAAA;KAClC,CAAA;IAED,qDAAqD;IACrD,KAAK,KAAK,GAAG;QACX,wCAAwC;QACxC,KAAK,EAAE,MAAM,CAAA;QACb,gEAAgE;QAChE,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAC/B,CAAA;CACF;AAED,MAAM,CAAC,OAAO,WAAW,MAAM,CAAC;IAC9B,mFAAmF;IACnF,KAAK,KAAK,GAAG;QACX,kFAAkF;QAClF,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAA;QAC1C,mCAAmC;QACnC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QACzB,4CAA4C;QAC5C,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAC1B,2CAA2C;QAC3C,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAC9B,2CAA2C;QAC3C,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,SAAS,CAAA;QACpD,kCAAkC;QAClC,MAAM,CAAC,EAAE,SAAS,KAAK,CAAC,EAAE,EAAE,GAAG,SAAS,CAAA;KACzC,CAAA;IAED,kCAAkC;IAClC,KAAK,OAAO,GAAG;QACb,oDAAoD;QACpD,YAAY,CAAC,EAAE,KAAK,CAAC,OAAO,GAAG,SAAS,CAAA;KACzC,CAAA;CACF;AAED;;;;;;;;GAQG;AACH,wBAAgB,SAAS,CACvB,KAAK,EAAE,KAAK,CAAC,KAAK,EAClB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,SAAS,CAAC,KAAK,EACtB,OAAO,GAAE,SAAS,CAAC,OAAY,GAC9B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAExB;AAED,MAAM,CAAC,OAAO,WAAW,SAAS,CAAC;IACjC,yFAAyF;IACzF,KAAK,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,GAAG,WAAW,CAAC,CAAA;IAEtD,uDAAuD;IACvD,KAAK,OAAO,GAAG,MAAM,CAAC,OAAO,CAAA;CAC9B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,KAAK,CAAC,KAAK,EAClB,OAAO,EAAE,gBAAgB,CAAC,OAAO,GAChC,OAAO,CAAC,MAAM,CAAC,CA2BjB;AAED,MAAM,CAAC,OAAO,WAAW,gBAAgB,CAAC;IACxC,4CAA4C;IAC5C,KAAK,OAAO,GAAG;QACb,6CAA6C;QAC7C,MAAM,EAAE,OAAO,CAAA;QACf,6CAA6C;QAC7C,WAAW,EAAE,YAAY,GAAG,SAAS,CAAA;QACrC,wCAAwC;QACxC,KAAK,EAAE,MAAM,CAAA;QACb,kDAAkD;QAClD,YAAY,CAAC,EAAE,KAAK,CAAC,OAAO,GAAG,SAAS,CAAA;KACzC,CAAA;CACF;AAED;;;;;;;;GAQG;AACH,wBAAsB,QAAQ,CAC5B,KAAK,EAAE,KAAK,CAAC,KAAK,EAClB,OAAO,GAAE,QAAQ,CAAC,OAAY,GAC7B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAe1B;AAED,MAAM,CAAC,OAAO,WAAW,QAAQ,CAAC;IAChC,oCAAoC;IACpC,KAAK,OAAO,GAAG;QACb,iDAAiD;QACjD,YAAY,CAAC,EAAE,KAAK,CAAC,OAAO,GAAG,SAAS,CAAA;KACzC,CAAA;IAED,kCAAkC;IAClC,KAAK,MAAM,GAAG;QACZ,gDAAgD;QAChD,OAAO,EAAE,MAAM,CAAA;QACf,2EAA2E;QAC3E,OAAO,EAAE,MAAM,CAAA;KAChB,CAAA;CACF;AA4LD,0GAA0G;AAC1G,wBAAsB,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,CAUtF;AAED,MAAM,CAAC,OAAO,WAAW,QAAQ,CAAC;IAChC,wCAAwC;IACxC,KAAK,GAAG,GAAG;QACT,wBAAwB;QACxB,EAAE,EAAE,MAAM,CAAA;QACV,8BAA8B;QAC9B,KAAK,EAAE,MAAM,CAAA;QACb,kDAAkD;QAClD,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAC/B,CAAA;CACF;AAED,gEAAgE;AAChE,wBAAsB,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAEhF;AAKD,+EAA+E;AAC/E,wBAAsB,cAAc,CAClC,KAAK,EAAE,KAAK,CAAC,KAAK,EAClB,KAAK,EAAE,cAAc,CAAC,KAAK,GAC1B,OAAO,CAAC,OAAO,CAAC,CAGlB;AAED,MAAM,CAAC,OAAO,WAAW,cAAc,CAAC;IACtC,qDAAqD;IACrD,KAAK,KAAK,GAAG,iBAAiB,CAAC,KAAK,CAAA;CACrC;AAeD,2EAA2E;AAC3E,qBAAa,iBAAkB,SAAQ,KAAK;IACjC,IAAI,SAA8B;IAC3C,cAEC;CACF;AAED,oEAAoE;AACpE,qBAAa,iBAAkB,SAAQ,KAAK;IACjC,IAAI,SAA8B;IAC3C,YAAY,KAAK,EAAE,MAAM,EAExB;CACF"}

package/dist/ApiKeys.js

@@ -16,6 +16,9 @@ import * as ApiKey from './ApiKey.js';
 import * as ApiKeyAdmissions from './db/tables/apiKeyAdmissions.js';
 import * as ApiKeyOwnerTombstones from './db/tables/apiKeyOwnerTombstones.js';
 import * as ApiKeyRevocations from './db/tables/apiKeyRevocations.js';
+import * as Organizations from './db/tables/organizations.js';
+import * as RoutesPolicies from './db/tables/routesPolicies.js';
+import * as RoutesSubsidies from './db/tables/routesSubsidies.js';
 import * as Store from './internal/Store.js';
 import * as Scope from './Scope.js';
 const billingSnapshotSchema = z.object({
@@ -108,15 +111,54 @@ async function mintValidated(state, data, id) {
 }
 /** Mints an attributed key after atomically reserving an organization-wide live-key slot. */
 export async function mintBounded(db, state, input, options = {}) {
-    if (input.orgId === undefined)
+    if (options.sourceScopes && !options.policySourceApiKeyId)
+        throw new RoutesPolicies.InvalidScopeError();
+    if (input.orgId === undefined) {
+        if (options.policySourceApiKeyId)
+            throw new RoutesPolicies.InvalidScopeError();
         return mint(state, input, options);
+    }
     const orgId = input.orgId;
-    const data = validateMintInput(input, options);
+    const validated = validateMintInput(input, options);
     const id = ApiKey.generateId();
     const result = await db.transaction(async (tx) => {
+        const data = await (async () => {
+            if (!options.policySourceApiKeyId)
+                return validated;
+            // Match reassignment/revocation lock order and retain the source lock
+            // through the policy copy. The admission ledger also fences stale KV.
+            await ApiKeyAdmissions.lock(tx, options.policySourceApiKeyId);
+            const source = await get(state, options.policySourceApiKeyId, options);
+            if (!source ||
+                source.orgId !== orgId ||
+                source.projectId !== validated.projectId ||
+                source.environment !== validated.environment ||
+                (options.sourceScopes !== undefined &&
+                    !options.sourceScopes.every((scope) => source.scopes.includes(scope) || source.scopes.includes(Scope.wildcard))) ||
+                !(await ApiKeyAdmissions.matches(tx, source)))
+                throw new RoutesPolicies.InvalidScopeError();
+            // The locked source, not the caller's earlier snapshot, bounds every copied restriction.
+            const { allowedIps: _allowedIps, expiresAt, rateLimits: _rateLimits, ...rest } = validated;
+            const expiry = [expiresAt, source.expiresAt]
+                .filter((value) => value !== undefined)
+                .sort((a, b) => Date.parse(a) - Date.parse(b))[0];
+            return {
+                ...rest,
+                allowedIps: source.allowedIps,
+                ...(expiry === undefined ? {} : { expiresAt: expiry }),
+                ...(source.rateLimits === undefined ? {} : { rateLimits: source.rateLimits }),
+            };
+        })();
+        // Policy copies share deletion's subsidy-before-owner lock order.
+        if (options.policySourceApiKeyId)
+            await RoutesSubsidies.lockOrganization(tx, orgId);
         const owner = { orgId, projectId: data.projectId };
         if (!(await ApiKeyOwnerTombstones.lockActive(tx, owner)))
             throw new OwnerDeletedError();
+        // A rotated one-off keeps its synthetic owner and policies. Materialize
+        // that owner before the replacement loses the original key's self-owner fallback.
+        if (options.policySourceApiKeyId === orgId && !(await Organizations.get(tx, orgId)))
+            await Organizations.create(tx, { id: orgId, name: orgId });
         await ApiKeyAdmissions.lockOrganization(tx, orgId);
         const legacy = (await ApiKeyAdmissions.isBootstrapped(tx, orgId))
             ? { complete: true, records: [] }
@@ -130,16 +172,65 @@ export async function mintBounded(db, state, input, options = {}) {
             orgId,
             projectId: data.projectId ?? null,
         });
-        return admitted ? mintValidated(state, data, id) : null;
+        if (!admitted)
+            return null;
+        await ApiKeyAdmissions.setPendingScopes(tx, id, data.scopes);
+        // Keep the credential unprivileged until its policy copy commits. KV cannot
+        // participate in the database transaction, so publishing the requested
+        // scopes here could leave a broadened key behind when copy/commit fails.
+        const minted = await mintValidated(state, { ...data, scopes: [] }, id);
+        if (options.policySourceApiKeyId)
+            await RoutesPolicies.copyKeyIn(tx, {
+                destination: {
+                    apiKeyId: minted.record.id,
+                    environment: minted.record.environment,
+                    orgId: minted.record.orgId,
+                    ...(minted.record.projectId === undefined ? {} : { projectId: minted.record.projectId }),
+                },
+                source: {
+                    apiKeyId: options.policySourceApiKeyId,
+                    environment: minted.record.environment,
+                    orgId: minted.record.orgId,
+                    ...(minted.record.projectId === undefined ? {} : { projectId: minted.record.projectId }),
+                },
+            });
+        return minted;
     });
     if (!result)
         throw new LiveKeyLimitError(maxLiveKeysPerOrganization);
-    return result;
+    try {
+        const record = await publishScopes(db, state, result.record.id, options);
+        if (!record)
+            throw new Error('minted API key missing while publishing scopes');
+        return { ...result, record };
+    }
+    catch (cause) {
+        // The caller never received this credential. Fence even ambiguous KV writes before freeing its slot.
+        await db.transaction(async (tx) => {
+            await ApiKeyAdmissions.lock(tx, result.record.id);
+            await ApiKeyRevocations.markPending(tx, result.record.id, orgId);
+            await ApiKeyAdmissions.release(tx, result.record.id);
+        });
+        try {
+            await revokeBounded(db, state, result.record.id);
+        }
+        catch {
+            // Failed KV cleanup leaves the non-expiring SQL fence intact; preserve the publication error.
+        }
+        throw cause;
+    }
 }
-/** Durably fences key use before deleting its organization or project. The idempotent fence remains on failure so concurrent attempts cannot reopen the owner. */
+/** Durably fences key use before deleting its organization or project. Reconcile failed deletions against committed SQL state before removing the fence. */
 export async function markOwnerDeleting(state, owner) {
     await state.put(ownerDeletedKey(owner), 'deleting');
 }
+/** Removes an aborted deletion's KV fence while holding the SQL owner lock against concurrent deletion. */
+export async function reconcileOwnerDeletion(db, state, owner) {
+    await db.transaction(async (tx) => {
+        if (await ApiKeyOwnerTombstones.lockActive(tx, owner))
+            await state.delete(ownerDeletedKey(owner));
+    });
+}
 /**
  * Resolves a plaintext API key token to its metadata, or `null`. Expiry is
  * enforced on read — not just via the store's native TTL — so it holds on
@@ -152,7 +243,7 @@ export async function markOwnerDeleting(state, owner) {
  */
 export async function resolve(state, token, options = {}) {
     const record = await read(state, ApiKey.keyFor(token), Date.now(), options.scopeCatalog ?? Scope.catalog);
-    if (!record || (await isOwnerDeleted(state, record)))
+    if (!record || (await isFenced(state, record)))
         return null;
     return record;
 }
@@ -253,13 +344,15 @@ export async function listByOrgPage(state, orgId, options) {
     };
 }
 /**
- * Revokes a key by id, deleting its record and index entries.
+ * Revokes a key by id with a durable KV marker, then deletes its record and index entries.
  *
  * @param state - The KV state store holding key records.
  * @param id - The key id (`key_…`).
  * @returns Whether a matching record was deleted.
  */
 export async function revoke(state, id) {
+    // The ID index can be missing while the token record survives. Keep its fence permanently, even when cleanup cannot find the record.
+    await state.put(`${revokedPrefix}${id}`, '1');
     const recordKey = await state.get(idKeyFor(id));
     if (!recordKey)
         return false;
@@ -369,6 +462,7 @@ export async function update(state, id, input, options = {}) {
 }
 /** Updates a key while atomically enforcing owner fences and admission accounting. */
 export async function updateBounded(db, state, id, input, options = {}) {
+    let reassigning = false;
     const result = await db.transaction(async (tx) => {
         await ApiKeyAdmissions.lock(tx, id);
         const record = await get(state, id, options);
@@ -378,8 +472,14 @@ export async function updateBounded(db, state, id, input, options = {}) {
             (record.orgId !== options.expectedOwner.orgId ||
                 record.projectId !== options.expectedOwner.projectId))
             return { type: 'missing' };
-        if (input.orgId === undefined && input.projectId === undefined)
+        const pendingScopes = (await ApiKeyAdmissions.get(tx, id))?.pendingScopes;
+        // An explicit scope edit supersedes every earlier deferred publication,
+        // including an intentional empty grant. Never revive it from a stale caller.
+        if (input.orgId === undefined && input.projectId === undefined) {
+            if (input.scopes !== undefined)
+                await ApiKeyAdmissions.setPendingScopes(tx, id, null);
             return { type: 'updated', updated: await update(state, id, input, options) };
+        }
         const owner = {
             orgId: input.orgId ?? record.orgId,
             projectId: input.projectId ?? record.projectId,
@@ -387,6 +487,12 @@ export async function updateBounded(db, state, id, input, options = {}) {
         const owners = [owner];
         if (record.orgId !== record.id)
             owners.push({ orgId: record.orgId, projectId: record.projectId });
+        reassigning = owner.orgId !== record.orgId || owner.projectId !== record.projectId;
+        if (reassigning)
+            await RoutesPolicies.lockKeyOrganizations(tx, {
+                apiKeyId: id,
+                orgIds: [record.orgId, owner.orgId],
+            });
         if (!(await ApiKeyOwnerTombstones.lockActiveMany(tx, owners)))
             throw new OwnerDeletedError();
         await ApiKeyAdmissions.lockOrganization(tx, owner.orgId);
@@ -405,14 +511,45 @@ export async function updateBounded(db, state, id, input, options = {}) {
         });
         if (!admitted)
             return { type: 'limit' };
-        const updated = await update(state, id, input, options);
+        if (reassigning) {
+            // Fail closed across the KV/SQL boundary. The key remains scope-less if
+            // clearing, reassignment, or the eventual SQL commit fails.
+            await ApiKeyAdmissions.setPendingScopes(tx, id, input.scopes ?? pendingScopes ?? record.scopes);
+            const disabled = await update(state, id, { scopes: [] }, options);
+            if (!disabled)
+                return { type: 'missing' };
+            await RoutesPolicies.clearKeyIn(tx, { apiKeyId: id });
+        }
+        else if (input.scopes !== undefined)
+            await ApiKeyAdmissions.setPendingScopes(tx, id, null);
+        const transactionalInput = reassigning ? { ...input, scopes: [] } : input;
+        const updated = await update(state, id, transactionalInput, options);
         if (!updated)
             await ApiKeyAdmissions.release(tx, id);
         return { type: 'updated', updated };
     });
     if (result.type === 'limit')
         throw new LiveKeyLimitError(maxLiveKeysPerOrganization);
-    return result.type === 'missing' ? null : result.updated;
+    if (result.type === 'missing')
+        return null;
+    if (!result.updated || !reassigning)
+        return result.updated;
+    return publishScopes(db, state, id, options);
+}
+/** Publishes only the latest committed scope intent, serialized with key edits and revocation. */
+async function publishScopes(db, state, id, options) {
+    return db.transaction(async (tx) => {
+        await ApiKeyAdmissions.lock(tx, id);
+        const record = await get(state, id, options);
+        if (!record || !(await ApiKeyAdmissions.matches(tx, record)))
+            return null;
+        const pending = (await ApiKeyAdmissions.get(tx, id))?.pendingScopes;
+        if (pending == null)
+            return record;
+        const updated = await update(state, id, { scopes: pending }, options);
+        await ApiKeyAdmissions.setPendingScopes(tx, id, null);
+        return updated;
+    });
 }
 /**
  * Re-attributes a key while preserving the existing public API.
@@ -650,6 +787,22 @@ const orgPrefix = 'apikey_org:';
 function orgKeyFor(orgId, id) {
     return `${orgPrefix}${orgId}:${id}`;
 }
+/** Storage-key prefix for durable key revocation markers. */
+const revokedPrefix = 'apikey_revoked:';
+/** Returns whether a key is revoked or its organization or project is being deleted, in one bulk read. */
+export async function isFenced(state, key) {
+    const revoked = `${revokedPrefix}${key.id}`;
+    const org = ownerDeletedKey({ orgId: key.orgId });
+    const project = key.projectId === undefined ? undefined : ownerDeletedKey(key);
+    const values = await Store.getMany(state, project ? [revoked, org, project] : [revoked, org]);
+    return (values.get(revoked) != null ||
+        Boolean(values.get(org)) ||
+        (project !== undefined && values.get(project) != null));
+}
+/** Returns whether a key has a durable KV revocation marker. */
+export async function isRevoked(state, id) {
+    return (await state.get(`${revokedPrefix}${id}`)) !== null;
+}
 /** Storage-key prefix for durable owner deletion markers. */
 const ownerDeletedPrefix = 'apikey_owner_deleted:';
 /** Returns whether the organization or attributed project has been deleted. */