tapimo 0.15.0 → 0.18.0

package/src/apps/management/routes/orgs.test.ts

@@ -1,4 +1,5 @@
 import { Hono } from 'hono'
+import { sql } from 'kysely'
 import { generatePrivateKey, privateKeyToAccount } from 'viem/accounts'
 
 import * as TestApp from '../../../../test/App.js'
@@ -11,6 +12,8 @@ import * as EarlyAccess from '../../../db/tables/earlyAccess.js'
 import * as EnabledBillingSources from '../../../db/tables/enabledBillingSources.js'
 import * as Organizations from '../../../db/tables/organizations.js'
 import * as Projects from '../../../db/tables/projects.js'
+import * as SponsoredTransactions from '../../../db/tables/sponsoredTransactions.js'
+import * as StripeCustomers from '../../../db/tables/stripeCustomers.js'
 import * as Users from '../../../db/tables/users.js'
 import type * as Log from '../../../internal/Log.js'
 import * as RoutesDepositAddress from '../../../internal/routes/DepositAddress.js'
@@ -568,7 +571,39 @@ describe('PATCH /orgs/:orgId', () => {
 })
 
 describe('DELETE /orgs/:orgId', () => {
-  test('rejects a legacy key after deletion when KV cleanup fails', async () => {
+  test('keeps a timed-out Zone sponsorship billable when its owner requests deletion', async () => {
+    const db = TestApp.database()
+    const app = createApp(db)
+    const cookie = await session(app)
+    const created = await app.request('/v1/orgs', json('POST', cookie, { name: 'Acme' }))
+    const org = await TestApp.json(created, Orgs.schema.Organization)
+    await StripeCustomers.create(db, { orgId: org.id, stripeCustomerId: 'cus_zone' })
+    const row = await SponsoredTransactions.upsert(db, {
+      apiKeyId: 'key_zone',
+      billable: true,
+      chainId: 421700001,
+      environment: 'production',
+      orgId: org.id,
+      signPayload: `0x${'bb'.repeat(32)}`,
+      transaction: `0x76${'cc'.repeat(16)}`,
+      transactionHash: `0x${'aa'.repeat(32)}`,
+    })
+    await SponsoredTransactions.fail(db, row.id, '2026-01-01T00:00:00.000Z')
+
+    const response = await app.request(`/v1/orgs/${org.id}`, {
+      headers: { cookie },
+      method: 'DELETE',
+    })
+
+    expect(response.status).toMatchInlineSnapshot(`409`)
+    expect((await response.json()).error.code).toMatchInlineSnapshot(`"sponsorships_unreported"`)
+    expect((await StripeCustomers.get(db, org.id))?.stripeCustomerId).toMatchInlineSnapshot(
+      `"cus_zone"`,
+    )
+    expect(await Organizations.get(db, org.id)).toBeDefined()
+  })
+
+  test('rolls back organization deletion when its KV fence cannot be written', async () => {
     const db = TestApp.database()
     const org = await Organizations.create(db, { name: 'Legacy owner' })
     const legacy = {
@@ -597,11 +632,80 @@ describe('DELETE /orgs/:orgId', () => {
       ...as(secret),
       method: 'DELETE',
     })
-    expect(deleted.status).toBe(200)
+    expect(deleted.status).toBe(502)
+    expect(await Organizations.get(db, legacy.id)).toBeDefined()
+
+    const retained = await app.request(`/v1/orgs/${legacy.id}`, as(legacy.token))
+    expect(retained.status).toBe(200)
+
+    failWrites = false
+    const retried = await app.request(`/v1/orgs/${legacy.id}`, {
+      ...as(secret),
+      method: 'DELETE',
+    })
+    expect(retried.status).toBe(200)
     expect(await Organizations.get(db, legacy.id)).toBeUndefined()
+    expect((await app.request(`/v1/orgs/${legacy.id}`, as(legacy.token))).status).toBe(401)
+  })
+
+  test('restores key access when deletion fails after publishing its KV fence', async () => {
+    const db = TestApp.database()
+    const org = await Organizations.create(db, { name: 'Retained owner' })
+    const legacy = {
+      id: org.id,
+      orgId: org.id,
+      scopes: ['management:read'],
+      token: 'secret_retained_owner',
+    } satisfies TestApp.kvStore.Key
+    const store = TestApp.kvStore({ keys: [legacy] })
+    const app = createApp(db, { kv: { store } })
+    await sql`
+      CREATE FUNCTION reject_owner_deletion() RETURNS trigger LANGUAGE plpgsql AS $$
+      BEGIN RAISE EXCEPTION 'deletion commit rejected'; END $$;
+      CREATE CONSTRAINT TRIGGER reject_owner_deletion AFTER DELETE ON organizations
+      DEFERRABLE INITIALLY DEFERRED FOR EACH ROW EXECUTE FUNCTION reject_owner_deletion();
+    `.execute(db.kysely)
+
+    const deleted = await app.request(`/v1/orgs/${org.id}`, { ...as(secret), method: 'DELETE' })
 
-    const rejected = await app.request(`/v1/orgs/${legacy.id}`, as(legacy.token))
-    expect(rejected.status).toBe(401)
+    expect(deleted.status).toBe(502)
+    expect(await Organizations.get(db, org.id)).toBeDefined()
+    expect(await ApiKeys.isOwnerDeleted(store, { orgId: org.id })).toBe(false)
+    expect((await app.request(`/v1/orgs/${org.id}`, as(legacy.token))).status).toBe(200)
+    await expect(
+      ApiKeys.mint(store, { orgId: org.id, scopes: ['data:read'] }),
+    ).resolves.toBeDefined()
+
+    await sql`DROP TRIGGER reject_owner_deletion ON organizations`.execute(db.kysely)
+    const retried = await app.request(`/v1/orgs/${org.id}`, { ...as(secret), method: 'DELETE' })
+    expect(retried.status).toBe(200)
+    expect(await ApiKeys.isOwnerDeleted(store, { orgId: org.id })).toBe(true)
+  })
+
+  test('rejects a cached key after deletion even when KV record cleanup fails', async () => {
+    const db = TestApp.database()
+    const org = await Organizations.create(db, { name: 'Retained KV record' })
+    const backing = Store.memory()
+    const { token } = await ApiKeys.mint(backing, {
+      orgId: org.id,
+      scopes: ['data:read'],
+    })
+    const store = Store.from({
+      ...backing,
+      async delete() {
+        throw new Error('KV cleanup unavailable')
+      },
+    })
+    const app = createApp(db, { kv: { store } })
+    expect((await app.request('/v1/tokens/not-an-address', as(token))).status).toBe(400)
+
+    const deleted = await app.request(`/v1/orgs/${org.id}`, {
+      ...as(secret),
+      method: 'DELETE',
+    })
+    expect(deleted.status).toBe(200)
+    expect(await Organizations.get(db, org.id)).toBeUndefined()
+    expect((await app.request('/v1/tokens/not-an-address', as(token))).status).toBe(401)
   })
 
   test('deletes an owned organization and cascades its projects', async () => {

package/src/apps/management/routes/orgs.ts

@@ -389,17 +389,22 @@ export function orgs() {
             return subsidizedDepositAddressesActive(c)
           if (await RoutesDepositAddresses.hasSubsidizedRelayAddress(db, Auth.org(c).id))
             return subsidizedDepositAddressesActive(c)
+          const kv = c.get('kv')
           const deleted = await Organizations.deleteOrganization(db, Auth.org(c).id, {
+            beforeCommit: kv
+              ? () => ApiKeys.markOwnerDeleting(kv.store, { orgId: Auth.org(c).id })
+              : undefined,
             onDepositAddressesDeactivated(transitions) {
               for (const transition of transitions)
                 RoutesObservability.recordDepositAddress(c.get('metrics'), transition)
             },
+          }).catch(async (cause) => {
+            if (kv) await ApiKeys.reconcileOwnerDeletion(db, kv.store, { orgId: Auth.org(c).id })
+            throw cause
           })
           if (!deleted) return organizationNotFound(c)
-          const kv = c.get('kv')
           if (kv)
             try {
-              await ApiKeys.markOwnerDeleting(kv.store, { orgId: Auth.org(c).id })
               for (const record of await ApiKeys.listByOrg(kv.store, Auth.org(c).id, {
                 scopeCatalog: c.get('scopeCatalog'),
               }))

package/src/apps/management/routes/usage.test.ts

@@ -273,8 +273,8 @@ describe('GET /orgs/:orgId/usage/requests', () => {
 
     expect(response.status).toBe(200)
     expect(await TestApp.json(response, Usage.schema.getRequestUsage.Response)).toEqual(emptyUsage)
-    // Series, totals, byKey, byRoute, and byStatus each issue one query.
-    expect(query).toHaveBeenCalledTimes(5)
+    // All usage breakdowns share one query.
+    expect(query).toHaveBeenCalledTimes(1)
     const sql = query.mock.calls[0]![0]
     expect(sql).toContain(`org_id = '${org.id}'`)
     expect(sql).toContain(`project_id = '${project.id}'`)

package/src/apps/management/routes/verified-token-requests.test.ts

@@ -247,10 +247,18 @@ describe('POST /v1/orgs/:orgId/verified-token-requests', () => {
     expect(body.error?.code).toBe('request_pending_exists')
   })
 
-  test('caps pending requests per organization', async () => {
+  test('caps pending requests per requester after an organization is deleted', async () => {
     const context = createApp()
     const requests = context.client.v1.orgs[':orgId{org_[A-Za-z0-9_-]+}']['verified-token-requests']
     const { org, owner } = await setup(context)
+    const nextResponse = await context.client.v1.orgs.$post(
+      { json: { name: 'Next' } },
+      as(owner.cookie),
+    )
+    expect(nextResponse.status).toBe(200)
+    if (nextResponse.status !== 200)
+      throw new Error(`Failed to create organization: ${nextResponse.status}`)
+    const next = await nextResponse.json()
 
     for (let index = 0; index < 10; index++) {
       const created = await requests.$post(
@@ -267,10 +275,16 @@ describe('POST /v1/orgs/:orgId/verified-token-requests', () => {
       expect(created.status).toBe(200)
     }
 
+    const deleted = await context.client.v1.orgs[':orgId{org_[A-Za-z0-9_-]+}'].$delete(
+      { param: { orgId: org.id } },
+      as(owner.cookie),
+    )
+    expect(deleted.status).toBe(200)
+
     const overflow = await requests.$post(
       {
         json: { ...token, address: `0x20c${'f'.padStart(37, '0')}` as `0x${string}`, symbol: 'tOVER' }, // prettier-ignore
-        param: { orgId: org.id },
+        param: { orgId: next.id },
       },
       as(owner.cookie),
     )

package/src/apps/management/routes/verified-token-requests.ts

@@ -239,9 +239,6 @@ const paramValidation = {
   message: 'Check the path parameters and try again.',
 } as const
 
-/** Maximum open (pending) requests per organization. */
-const maxPending = 10
-
 /** Mounts organization verified-token request operations. */
 export function verifiedTokenRequests() {
   return new Hono<Environment>()
@@ -265,7 +262,7 @@ export function verifiedTokenRequests() {
             },
             409: {
               codes: ['request_limit_reached', 'request_pending_exists', 'verified_symbol_exists', 'verified_token_exists'], // prettier-ignore
-              description: 'The token is already verified or requested, or the organization is at its pending-request limit.', // prettier-ignore
+              description: 'The token is already verified or requested, or the requester is at the pending-request limit.', // prettier-ignore
             },
           },
           success: { description: 'Created request.', schema: schema.VerifiedTokenRequest },
@@ -297,12 +294,6 @@ export function verifiedTokenRequests() {
               message: 'A verified token already uses this symbol',
               status: 409,
             })
-          if ((await VerifiedTokenRequests.countPending(db, orgId)) >= maxPending)
-            return Response.error(c, {
-              code: 'request_limit_reached',
-              message: `Organizations may have at most ${maxPending} pending requests`,
-              status: 409,
-            })
           const record = await VerifiedTokenRequests.create(db, {
             address: body.address,
             chainId: body.chainId,
@@ -330,6 +321,12 @@ export function verifiedTokenRequests() {
             200,
           )
         } catch (cause) {
+          if (cause instanceof VerifiedTokenRequests.PendingLimitError)
+            return Response.error(c, {
+              code: 'request_limit_reached',
+              message: `Requesters may have at most ${VerifiedTokenRequests.maxPendingPerRequester} pending requests`,
+              status: 409,
+            })
           return Response.upstream(c, cause)
         }
       },

package/src/apps/mcp.test.ts

@@ -1,6 +1,6 @@
 import { Cli as incur_Cli, z } from 'incur'
 import { data } from 'tapimo/apps'
-import { App } from 'tapimo/server'
+import { App, Store } from 'tapimo/server'
 
 import * as TestApp from '../../test/App.js'
 import * as Runtime from '../../test/runtime.js'
@@ -42,32 +42,36 @@ function docsStub() {
 type Host = { fetch: (request: Request) => Response | Promise<Response> }
 
 async function request(host: Host, body: unknown, headers: Record<string, string> = {}) {
-  const response = await host.fetch(
-    new Request(new URL('/mcp', origin), {
-      body: JSON.stringify(body),
-      headers: {
-        accept: 'application/json, text/event-stream',
-        'content-type': 'application/json',
-        ...headers,
-      },
-      method: 'POST',
-    }),
-  )
+  const request = new Request(new URL('/mcp', origin), {
+    body: JSON.stringify(body),
+    headers: {
+      accept: 'application/json, text/event-stream',
+      'content-type': 'application/json',
+      ...headers,
+    },
+    method: 'POST',
+  })
+  if (request.headers.has('cf-connecting-ip')) Object.assign(request, { cf: {} })
+  const response = await host.fetch(request)
   expect(response.status).toBe(200)
   return (await response.json()) as { result: any }
 }
 
-function initialize(host: Host) {
-  return request(host, {
-    id: 1,
-    jsonrpc: '2.0',
-    method: 'initialize',
-    params: {
-      capabilities: {},
-      clientInfo: { name: 'test-client', version: '1.0.0' },
-      protocolVersion: '2025-03-26',
+function initialize(host: Host, headers: Record<string, string> = {}) {
+  return request(
+    host,
+    {
+      id: 1,
+      jsonrpc: '2.0',
+      method: 'initialize',
+      params: {
+        capabilities: {},
+        clientInfo: { name: 'test-client', version: '1.0.0' },
+        protocolVersion: '2025-03-26',
+      },
     },
-  })
+    headers,
+  )
 }
 
 async function toolsList(host: Host) {
@@ -109,8 +113,8 @@ async function toolsSearch(host: Host) {
 }
 
 /** Loads the complete schema and metadata for one catalog tool. */
-async function toolDetails(host: Host, name: string) {
-  return resultJson(await toolsCall(host, 'get_tool_details', { name })) as {
+async function toolDetails(host: Host, name: string, headers: Record<string, string> = {}) {
+  return resultJson(await toolsCall(host, 'get_tool_details', { name }, headers)) as {
     annotations?: { readOnlyHint?: boolean }
     inputSchema: { properties?: Record<string, { description?: string }> }
     name: string
@@ -124,7 +128,7 @@ async function generatedToolCall(
   args: Record<string, unknown>,
   headers: Record<string, string> = {},
 ) {
-  const details = await toolDetails(host, name)
+  const details = await toolDetails(host, name, headers)
   return toolsCall(
     host,
     details.annotations?.readOnlyHint === true ? 'call_read_tool' : 'call_write_tool',
@@ -246,6 +250,85 @@ test('forwards the caller Authorization header to authenticated tools', async ()
   expect(resultJson(allowed)).toMatchObject({ data: [] })
 })
 
+test('preserves Cloudflare client identity across concurrent generated tools', async () => {
+  const store = Store.memory()
+  const db = TestApp.database()
+  await TestApp.verifiedSeed(db, Runtime.get().chainId)
+  const app = App.create({
+    auth: { rateLimit: { store } },
+    cache: { edge: false },
+    db,
+  }).route('/', data())
+  app.route('/', mcp({ docs: false, fetch: (request) => app.fetch(request) }))
+  const headers_a = { 'cf-connecting-ip': '203.0.113.7' }
+  const headers_b = { 'cf-connecting-ip': '198.51.100.9' }
+  await initialize(app, headers_a)
+
+  const [result_a, result_b] = await Promise.all([
+    generatedToolCall(app, 'v1_tokens_get', { verified: true }, headers_a),
+    generatedToolCall(app, 'v1_tokens_get', { verified: true }, headers_b),
+  ])
+
+  expect(result_a.isError, JSON.stringify(result_a.content)).toBeFalsy()
+  expect(result_b.isError, JSON.stringify(result_b.content)).toBeFalsy()
+  const keys = (await store.list({ prefix: 'ratelimit:' })).keys.map((key) => key.name)
+  expect(keys.some((key) => key.endsWith('public:203.0.113.7'))).toBe(true)
+  expect(keys.some((key) => key.endsWith('public:198.51.100.9'))).toBe(true)
+  expect(keys.some((key) => key.endsWith('public:anonymous'))).toBe(false)
+})
+
+test('allows an IP-restricted API key through generated tools', async () => {
+  const db = TestApp.database()
+  await TestApp.verifiedSeed(db, Runtime.get().chainId)
+  const key = {
+    ...TestApp.key,
+    allowedIps: ['203.0.113.0/24'],
+  }
+  const app = App.create({
+    auth: {},
+    cache: { edge: false },
+    db,
+    kv: { store: TestApp.kvStore({ keys: [key] }) },
+  }).route('/', data())
+  app.route('/', mcp({ docs: false, fetch: (request) => app.fetch(request) }))
+  const headers = {
+    authorization: `Bearer ${key.token}`,
+    'cf-connecting-ip': '203.0.113.7',
+  }
+  await initialize(app, headers)
+
+  const result = await generatedToolCall(app, 'v1_tokens_get', { verified: true }, headers)
+
+  expect(result.isError, JSON.stringify(result.content)).toBeFalsy()
+})
+
+test('preserves a configured trusted client identity through generated tools', async () => {
+  const db = TestApp.database()
+  await TestApp.verifiedSeed(db, Runtime.get().chainId)
+  const key = {
+    ...TestApp.key,
+    allowedIps: ['198.51.100.0/24'],
+  }
+  const app = App.create({
+    auth: { public: { clientIp: (request) => request.headers.get('x-real-ip') ?? undefined } },
+    cache: { edge: false },
+    db,
+    kv: { store: TestApp.kvStore({ keys: [key] }) },
+  }).route('/', data())
+  app.route('/', mcp({ docs: false, fetch: (request) => app.fetch(request) }))
+  const headers = {
+    authorization: `Bearer ${key.token}`,
+    'cf-connecting-ip': '203.0.113.7',
+    'tempo-mcp-client-ip': '192.0.2.1',
+    'x-real-ip': '198.51.100.9',
+  }
+  await initialize(app, headers)
+
+  const result = await generatedToolCall(app, 'v1_tokens_get', { verified: true }, headers)
+
+  expect(result.isError, JSON.stringify(result.content)).toBeFalsy()
+})
+
 test('proxies docs tool calls to the remote MCP source', async () => {
   const { host } = createHost({ docs: docsStub() })
   await initialize(host)

package/src/apps/mcp.ts

@@ -16,6 +16,9 @@ const routesTagGroup = 'Routes API'
 /** Tags inside the group hidden from MCP: partner-shaped CoinGecko mirrors and the MCP endpoint itself. */
 const excludedTags = ['CoinGecko', 'MCP']
 
+/** Internal header carrying the trusted caller identity through incur's generated request. */
+const clientIpHeader = 'tempo-mcp-client-ip'
+
 /** Usage guidance surfaced to MCP clients on initialize. */
 const instructions =
   "Tempo MCP provides access to the Tempo API's data and Routes domains, plus documentation. Authenticated tools accept a Tempo API key sent as an `Authorization: Bearer` header on the HTTP request. List endpoints paginate via `cursor`/`nextCursor`. `docs_*` tools search the Tempo documentation."
@@ -106,7 +109,11 @@ export function mcp(options: mcp.Options) {
       // them onto the caller origin and dispatch in-process.
       fetch: (request) => {
         const url = new URL(request.url)
-        return fetch(new Request(new URL(url.pathname + url.search, origin), request))
+        const address = request.headers.get(clientIpHeader)
+        const forwarded = new Request(new URL(url.pathname + url.search, origin), request)
+        forwarded.headers.delete(clientIpHeader)
+        if (address) Auth.trustClientIp(forwarded, address)
+        return fetch(forwarded)
       },
       mcp: { instructions, title },
       openapi: scope(document),
@@ -115,7 +122,7 @@ export function mcp(options: mcp.Options) {
       // forwarded `Authorization` header).
       openapiConfig: {
         compact: true,
-        forwardHeaders: ['authorization'],
+        forwardHeaders: ['authorization', clientIpHeader],
         mode: 'namespace',
         security: false,
       },
@@ -130,7 +137,12 @@ export function mcp(options: mcp.Options) {
     const cli = await resolve(new URL(c.req.url).origin)
     // incur routes on the first path segment; pin the path to `/mcp` so a
     // mount prefix never leaks into its router.
-    return cli.fetch(new Request(new URL('/mcp', c.req.url), c.req.raw))
+    const request = new Request(new URL('/mcp', c.req.url), c.req.raw)
+    // Replace caller input with the identity resolved by the outer auth boundary.
+    request.headers.delete(clientIpHeader)
+    const address = Auth.getTrustedClientIp(c)
+    if (address) request.headers.set(clientIpHeader, address)
+    return cli.fetch(request)
   }
 
   // The documented POST carries the auth policy (described routes are

package/src/apps/mpp/internal/Policy.test.ts

@@ -43,8 +43,19 @@ describe('chainId', () => {
 })
 
 describe('requiresFeePayer', () => {
-  test('requires both a fee-payer method detail and an enabled request', () => {
-    expect(Policy.requiresFeePayer(input)).toBe(true)
+  test.each([
+    ['canonical', { methodDetails: { feePayer: true } }],
+    ['pre-normalized', { feePayer: true }],
+  ])('recognizes %s sponsorship', (_, request) => {
+    expect(
+      Policy.requiresFeePayer({
+        ...input,
+        challenge: { ...input.challenge, request },
+      }),
+    ).toBe(true)
+  })
+
+  test('lets an explicit top-level value disable sponsorship', () => {
     expect(
       Policy.requiresFeePayer({
         ...input,
@@ -84,6 +95,42 @@ describe('assertChainAccess', () => {
 })
 
 describe('authorizeFeePayer', () => {
+  test('rejects pre-normalized sandbox sponsorship on mainnet', async () => {
+    await expect(
+      Policy.authorizeFeePayer({
+        chainId: 4217,
+        db: TestApp.database(),
+        feePayer,
+        input: {
+          ...input,
+          challenge: { ...input.challenge, request: { feePayer: true } },
+        },
+        principal: { ...principal, environment: 'sandbox' },
+        zones,
+      }),
+    ).rejects.toThrowErrorMatchingInlineSnapshot(
+      `[Mpp.Policy.PolicyDeniedError: Mainnet fee sponsorship requires a production API key.]`,
+    )
+  })
+
+  test('requires active billing for pre-normalized mainnet sponsorship', async () => {
+    await expect(
+      Policy.authorizeFeePayer({
+        chainId: 4217,
+        db: TestApp.database(),
+        feePayer,
+        input: {
+          ...input,
+          challenge: { ...input.challenge, request: { feePayer: true } },
+        },
+        principal: principal_projectless,
+        zones,
+      }),
+    ).rejects.toThrowErrorMatchingInlineSnapshot(
+      `[Mpp.Policy.PolicyDeniedError: Active billing is required for mainnet fee sponsorship.]`,
+    )
+  })
+
   test.each([4217, Zones.zoneMainnetInternal.id, Zones.zoneDeel.id])(
     'rejects sandbox sponsorship on chain %s',
     async (chainId) => {
@@ -165,7 +212,7 @@ describe('authorizeFeePayer', () => {
     },
   )
 
-  test('does not require billing when the credential pays its own fee', async () => {
+  test('withholds the managed fee payer from self-funded credentials', async () => {
     await expect(
       Policy.authorizeFeePayer({
         chainId: 4217,
@@ -178,6 +225,6 @@ describe('authorizeFeePayer', () => {
         principal,
         zones,
       }),
-    ).resolves.toBe(feePayer)
+    ).resolves.toBeUndefined()
   })
 })

package/src/apps/mpp/internal/Policy.ts

@@ -18,7 +18,11 @@ export function chainId(input: Mpp.RelayInput): number | undefined {
 /** Whether a Tempo charge credential requests platform fee sponsorship. */
 export function requiresFeePayer(input: Mpp.RelayInput) {
   const request = input.challenge.request
-  return record(request['methodDetails'])?.['feePayer'] === true && request['feePayer'] !== false
+  const details = record(request['methodDetails'])
+  return (
+    (details?.['feePayer'] === true || request['feePayer'] === true) &&
+    request['feePayer'] !== false
+  )
 }
 
 /** Refuses a sponsored transaction that the current fee market cannot admit. */
@@ -80,7 +84,7 @@ export async function authorizeFeePayer(
   options: authorizeFeePayer.Options,
 ): Promise<LocalAccount | undefined> {
   const { chainId, db, feePayer, input, principal, zones } = options
-  if (!feePayer || !requiresFeePayer(input)) return feePayer
+  if (!feePayer || !requiresFeePayer(input)) return undefined
   if (principal?.type !== 'api_key')
     throw new PolicyDeniedError('Fee sponsorship requires an API key.')
   if (!Viem.isMainnet(zones.get(chainId)?.sourceId ?? chainId)) return feePayer

package/src/apps/mpp/internal/Sponsorship.test.ts

@@ -3,6 +3,7 @@ import { SignatureEnvelope, TxEnvelopeTempo } from 'ox/tempo'
 
 import * as TestApp from '../../../../test/App.js'
 import * as Tempo from '../../../../test/Tempo.js'
+import * as ApiKeyOwnerTombstones from '../../../db/tables/apiKeyOwnerTombstones.js'
 import * as BillingSettings from '../../../db/tables/billingSettings.js'
 import * as SponsoredTransactions from '../../../db/tables/sponsoredTransactions.js'
 import type * as Auth from '../../../internal/Auth.js'
@@ -35,6 +36,34 @@ const token = {
 }
 
 describe('record', () => {
+  test.each([undefined, '1.00'])(
+    'rejects a deleted owner with spend limit %s',
+    async (spendLimit) => {
+      const db = TestApp.database()
+      const chainId = Zones.zoneDeel.id
+      await VerifiedTokens.replace(db, chainId, [token])
+      if (spendLimit !== undefined)
+        await BillingSettings.upsert(db, { orgId: principal.orgId, spendLimit })
+      await db.transaction((tx) =>
+        ApiKeyOwnerTombstones.markDeleted(tx, { orgId: principal.orgId }),
+      )
+
+      await expect(
+        Sponsorship.record({
+          db,
+          dbCached: db,
+          principal,
+          serializedTransaction: await transaction({ chainId }),
+          txFeeLimit: 1_000_000n,
+          zones,
+        }),
+      ).rejects.toThrowErrorMatchingInlineSnapshot(
+        `[Mpp.Policy.PolicyDeniedError: Organization no longer exists.]`,
+      )
+      expect(await SponsoredTransactions.listPending(db)).toMatchInlineSnapshot(`[]`)
+    },
+  )
+
   test.each(mainnetChainIds)(
     'records chain %s as billable and eligible for metering',
     async (chainId) => {

package/src/apps/mpp/internal/Sponsorship.ts

@@ -114,17 +114,19 @@ export async function record(options: record.Options): Promise<void> {
     transaction: serializedTransaction,
     transactionHash: Hash.keccak256(serializedTransaction),
   }
-  if (settings?.spendLimit == null) {
-    await SponsoredTransactions.upsert(db, input)
-    return
-  }
   try {
+    if (settings?.spendLimit == null) {
+      await SponsoredTransactions.upsert(db, input)
+      return
+    }
     await SponsoredTransactions.reserve(db, input, {
       chainIds: Zones.chainIds({ sourceId: Viem.chainId.mainnet, zones: zones.values() }),
       max: Billing.toBaseUnits(settings.spendLimit),
       since: Billing.periodStart(settings.period),
     })
   } catch (cause) {
+    if (cause instanceof SponsoredTransactions.OrganizationDeletedError)
+      throw new Policy.PolicyDeniedError('Organization no longer exists.')
     if (cause instanceof SponsoredTransactions.PeriodSpendLimitError)
       throw new Policy.PolicyDeniedError('Spend limit exceeded.')
     throw cause