tapimo 0.15.1 → 0.18.0

package/src/Client.test-d.ts

@@ -1,12 +1,15 @@
 import { Client } from 'tapimo'
 import { Mpp as PublicMpp } from 'tapimo/mpp'
+import { hc } from 'hono/client'
 import type * as z from 'zod/mini'
 
+import type * as Admin from './admin/App.js'
 import * as Activities from './apps/data/routes/activities.js'
 import * as ApiKeys from './apps/management/routes/api-keys.js'
 import * as Balances from './apps/data/routes/balances.js'
 import * as Billing from './apps/management/routes/billing.js'
 import * as Blocks from './apps/data/routes/blocks.js'
+import * as Cli from './apps/management/routes/cli.js'
 import * as Earn from './apps/data/routes/earn.js'
 import * as Exchanges from './apps/data/routes/exchanges.js'
 import * as Faucet from './apps/management/routes/faucet.js'
@@ -83,6 +86,23 @@ test('returns typed client', async () => {
 })
 
 describe('narrows responses by status', () => {
+  test('PUT /earn/verified-vaults preserves per-vault earnings configuration', async () => {
+    const client = hc<ReturnType<typeof Admin.create>>('https://admin.example')
+    const res = await client.earn['verified-vaults'].$put({
+      json: {
+        chainId: 4217,
+        earnings: { rewardDistributors: [] },
+        vaultAddress: `0x${'11'.repeat(20)}`,
+      },
+    })
+    if (res.status === 200) {
+      const json = await res.json()
+      expectTypeOf(json.earnings).toEqualTypeOf<{
+        rewardDistributors: `0x${string}`[]
+      } | null>()
+    }
+  })
+
   test('POST /v1/earn/rewards/eligibility', async () => {
     const client = Client.create()
     const res = await client.v1.earn.rewards.eligibility.$post({
@@ -576,6 +596,8 @@ describe('narrows responses by status', () => {
       expectTypeOf(json.block?.timestamp).toEqualTypeOf<string | undefined>()
       expectTypeOf(json.chainId).toEqualTypeOf<number>()
       expectTypeOf(json.id).toEqualTypeOf<`0x${string}`>()
+      expectTypeOf(json.privateAssetBalance).toEqualTypeOf<string | undefined>()
+      expectTypeOf(json.privateAssetToken).toEqualTypeOf<`0x${string}` | undefined>()
       expectTypeOf(json.shareAllowance).toEqualTypeOf<string>()
       expectTypeOf(json.shareBalance).toEqualTypeOf<string>()
       expectTypeOf(json.shareToken).toEqualTypeOf<`0x${string}`>()
@@ -666,6 +688,11 @@ describe('narrows responses by status', () => {
         address: `0x${'bb'.repeat(20)}`,
         vaultId: `0x${'aa'.repeat(20)}`,
       },
+      query: {
+        end: '2026-09-18T00:00:00.000Z',
+        period: 'custom',
+        start: '2026-09-11T00:00:00.000Z',
+      },
     })
 
     expectTypeOf(res.status).toEqualTypeOf<200 | 400 | 404 | 502 | PaidAccessStatus>()
@@ -677,7 +704,7 @@ describe('narrows responses by status', () => {
       expectTypeOf(json.assetToken).toEqualTypeOf<`0x${string}`>()
       expectTypeOf(json.currentValue).toEqualTypeOf<string>()
       expectTypeOf(json.id).toEqualTypeOf<`0x${string}`>()
-      expectTypeOf(json.period).toEqualTypeOf<'30d' | 'active' | 'lifetime'>()
+      expectTypeOf(json.period).toEqualTypeOf<'7d' | '30d' | 'active' | 'custom' | 'lifetime'>()
       expectTypeOf(json.status).toEqualTypeOf<
         'complete' | 'incomplete_cost_basis' | 'pending_redemption'
       >()
@@ -701,8 +728,11 @@ describe('narrows responses by status', () => {
           totalDeposited: string
           totalWithdrawn: string
         }>()
-      if (json.status === 'complete' && json.period === '30d')
-        expectTypeOf(json.windowEarnings).toEqualTypeOf<string>()
+      if (json.period === '7d' || json.period === '30d' || json.period === 'custom') {
+        expectTypeOf(json.start).toEqualTypeOf<string>()
+        expectTypeOf(json.end).toEqualTypeOf<string>()
+        if (json.status === 'complete') expectTypeOf(json.windowEarnings).toEqualTypeOf<string>()
+      }
       void json
       return
     }
@@ -1694,6 +1724,94 @@ describe('narrows responses by status', () => {
     }
   })
 
+  test('POST /v1/cli/authorizations', async () => {
+    const client = Client.create()
+    const res = await client.v1.cli.authorizations.$post({
+      json: { codeChallenge: 'E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM' },
+    })
+
+    expectTypeOf(res.status).toEqualTypeOf<200 | 404 | 502 | PublicAccessStatus>()
+
+    switch (res.status) {
+      case 200: {
+        const json = await res.json()
+        expectTypeOf(json).toEqualTypeOf<z.output<typeof Cli.schema.CreateResponse>>()
+        return
+      }
+      case 404: {
+        const json = await res.json()
+        expectTypeOf(json.error.code).toEqualTypeOf<'cli_auth_not_enabled'>()
+        return
+      }
+    }
+  })
+
+  test('GET /v1/cli/authorizations/:code', async () => {
+    const client = Client.create()
+    const res = await client.v1.cli.authorizations[':code{[A-Za-z -]+}'].$get({
+      param: { code: 'BCDF-GHJK' },
+    })
+
+    expectTypeOf(res.status).toEqualTypeOf<200 | 400 | 401 | 403 | 404 | 502>()
+
+    switch (res.status) {
+      case 200: {
+        const json = await res.json()
+        expectTypeOf(json.status).toEqualTypeOf<'approved' | 'denied' | 'pending'>()
+        return
+      }
+      case 404: {
+        const json = await res.json()
+        expectTypeOf(json.error.code).toEqualTypeOf<
+          'cli_auth_not_enabled' | 'cli_authorization_not_found'
+        >()
+        return
+      }
+    }
+  })
+
+  test('POST /v1/cli/authorizations/:code/approve', async () => {
+    const client = Client.create()
+    const res = await client.v1.cli.authorizations[':code{[A-Za-z -]+}'].approve.$post({
+      json: {},
+      param: { code: 'BCDF-GHJK' },
+    })
+
+    expectTypeOf(res.status).toEqualTypeOf<200 | 400 | 401 | 403 | 404 | 409 | 502>()
+
+    switch (res.status) {
+      case 200: {
+        const json = await res.json()
+        expectTypeOf(json.status).toEqualTypeOf<'approved' | 'denied'>()
+        return
+      }
+      case 409: {
+        const json = await res.json()
+        expectTypeOf(json.error.code).toEqualTypeOf<'cli_authorization_decided'>()
+        return
+      }
+    }
+  })
+
+  test('POST /v1/cli/authorizations/:code/token', async () => {
+    const client = Client.create()
+    const res = await client.v1.cli.authorizations[':code{[A-Za-z -]+}'].token.$post({
+      json: { codeVerifier: 'dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk' },
+      param: { code: 'BCDF-GHJK' },
+    })
+
+    expectTypeOf(res.status).toEqualTypeOf<200 | 404 | 502 | PublicAccessStatus>()
+
+    if (res.status === 200) {
+      const json = await res.json()
+      if (json.status === 'approved') expectTypeOf(json.token).toEqualTypeOf<string>()
+    }
+    if (res.status === 400) {
+      const json = await res.json()
+      expectTypeOf(json.error.code).toEqualTypeOf<Access400<'body_invalid' | 'param_invalid'>>()
+    }
+  })
+
   test('POST /v1/invitations/:invitationId/accept', async () => {
     const client = Client.create()
     const res = await client.v1.invitations[':invitationId{inv_[A-Za-z0-9_-]+}'].accept.$post({
@@ -2499,7 +2617,7 @@ describe('narrows responses by status', () => {
       },
     })
 
-    expectTypeOf(res.status).toEqualTypeOf<200 | 400 | 502 | PaidAccessStatus>()
+    expectTypeOf(res.status).toEqualTypeOf<200 | 400 | 409 | 502 | PaidAccessStatus>()
 
     switch (res.status) {
       case 200: {
@@ -2543,7 +2661,13 @@ describe('narrows responses by status', () => {
       }
       case 400: {
         const json = await res.json()
-        expectTypeOf(json.error.code).toEqualTypeOf<Access400<'query_invalid'>>()
+        expectTypeOf(json.error.code).toEqualTypeOf<
+          Access400<'query_invalid' | 'route_unavailable'>
+        >()
+        expectTypeOf(json.error.details).toEqualTypeOf<
+          | readonly { message: string; path?: readonly (number | string)[] | undefined }[]
+          | undefined
+        >()
         expectTypeOf(json.error.message).toEqualTypeOf<string>()
         void json
         return
@@ -2651,6 +2775,14 @@ describe('narrows responses by status', () => {
         void json
         return
       }
+      case 400: {
+        const json = await res.json()
+        expectTypeOf(json.error.code).toEqualTypeOf<
+          'amount_too_low' | 'api_key_malformed' | 'body_invalid'
+        >()
+        void json
+        return
+      }
       case 403: {
         const json = await res.json()
         expectTypeOf(json.error.code).toEqualTypeOf<
@@ -2659,21 +2791,29 @@ describe('narrows responses by status', () => {
           | 'billing_past_due'
           | 'billing_required'
           | 'routes_deposit_address_limit_exceeded'
+          | 'routes_not_allowed'
+          | 'routes_subsidy_not_allowed'
           | 'routes_subsidy_not_enabled'
+          | 'routes_suspended'
         >()
         void json
         return
       }
       case 404: {
         const json = await res.json()
-        expectTypeOf(json.error.code).toEqualTypeOf<'deposit_address_not_available'>()
+        expectTypeOf(json.error.code).toEqualTypeOf<
+          'deposit_address_not_available' | 'quote_not_available'
+        >()
         void json
         return
       }
       case 409: {
         const json = await res.json()
         expectTypeOf(json.error.code).toEqualTypeOf<
-          'idempotency_conflict' | 'idempotency_in_progress'
+          | 'idempotency_conflict'
+          | 'idempotency_in_progress'
+          | 'route_policy_changed'
+          | 'route_policy_identity_conflict'
         >()
         void json
         return
@@ -2888,7 +3028,6 @@ describe('narrows responses by status', () => {
       provider: 'stargate',
       recipient: `0x${'11'.repeat(20)}`,
       sender: `0x${'22'.repeat(20)}`,
-      sourceChain: 'eip155:8453',
       sourceToken: '0x833589fcd6edb6e08f4c7c32d4f71b54bda02913',
     } as const
     // @ts-expect-error `Idempotency-Key` is required for route transfer creation.
@@ -2897,6 +3036,10 @@ describe('narrows responses by status', () => {
       header: { 'idempotency-key': 'routes_01k1c5j8q8p0be6j5v9m6d1e4r' },
       json,
     })
+    void client.v1.routes.transfers.$post({
+      header: { 'idempotency-key': 'routes_explicit_source' },
+      json: { ...json, sourceChain: 'eip155:4217' },
+    })
 
     expectTypeOf(res.status).toEqualTypeOf<
       200 | 400 | 403 | 404 | 409 | 501 | 502 | 503 | PublicAccessStatus
@@ -2905,7 +3048,11 @@ describe('narrows responses by status', () => {
     switch (res.status) {
       case 200: {
         const json = await res.json()
-        expectTypeOf(json.action.type).toEqualTypeOf<'evm:calls'>()
+        expectTypeOf(json.action.type).toEqualTypeOf<'evm:calls' | 'tron:calls'>()
+        if (json.action.type === 'tron:calls') {
+          expectTypeOf(json.action.calls[0]!.to).toEqualTypeOf<string>()
+          expectTypeOf(json.action.calls[0]!.value).toEqualTypeOf<string>()
+        }
         expectTypeOf(json.id).toEqualTypeOf<string>()
         expectTypeOf(json.status).toEqualTypeOf<
           z.output<typeof RoutesTransfers.schema.createRoutesTransfer.Response>['status']
@@ -2922,7 +3069,7 @@ describe('narrows responses by status', () => {
       case 409: {
         const json = await res.json()
         expectTypeOf(json.error.code).toEqualTypeOf<
-          'idempotency_conflict' | 'idempotency_in_progress'
+          'idempotency_conflict' | 'idempotency_in_progress' | 'route_policy_changed'
         >()
         void json
         return

package/src/Client.test.ts

@@ -50,7 +50,7 @@ test('applies `apiKey` to canonical header over base headers', async () => {
             "tempo-api-key": "key_option",
             "user-agent": "tempo-api-test",
           },
-          "url": "https://api.test/v1/blocks/latest?",
+          "url": "https://api.test/v1/blocks/latest",
         },
       ]
     `)
@@ -74,7 +74,7 @@ test('merges `apiKey` with dynamic base headers', async () => {
             "authorization": "Payment proof",
             "tempo-api-key": "key_option",
           },
-          "url": "https://api.test/v1/blocks/latest?",
+          "url": "https://api.test/v1/blocks/latest",
         },
       ]
     `)
@@ -95,7 +95,7 @@ test('lets per-request headers override base `apiKey`', async () => {
           "headers": {
             "tempo-api-key": "key_request",
           },
-          "url": "https://api.test/v1/blocks/latest?",
+          "url": "https://api.test/v1/blocks/latest",
         },
       ]
     `)
@@ -111,7 +111,7 @@ test('omits empty API keys', async () => {
       [
         {
           "headers": {},
-          "url": "https://api.test/v1/blocks/latest?",
+          "url": "https://api.test/v1/blocks/latest",
         },
       ]
     `)

package/src/Scope.ts

@@ -73,8 +73,7 @@ export const catalog = [
     selfServe: false,
   },
   {
-    description:
-      'Legacy reward eligibility write scope retained for existing keys; registration requires wildcard access.',
+    description: 'Register wallet and Earn vault reward eligibility associations.',
     scope: 'rewards:write',
     selfServe: false,
   },

package/src/admin/App.ts

@@ -20,6 +20,7 @@ import { apiKeys } from './apps/api-keys.js'
 import { earlyAccess } from './apps/early-access.js'
 import { earnVaults } from './apps/earn-vaults.js'
 import { routes } from './apps/routes.js'
+import { routePolicies } from './apps/route-policies.js'
 import { routesSupport } from './apps/routes-support.js'
 import { organizations } from './apps/organizations.js'
 import { scopes } from './apps/scopes.js'
@@ -97,7 +98,7 @@ export function create(options: create.Options) {
     c.set('metrics', options.metrics)
     c.set('rateLimit', rateLimit)
     c.set('zones', zones)
-    c.set('identity', await identify(c.req.raw))
+    c.set('identity', await identify(c.req.raw, c))
     try {
       return await next()
     } finally {
@@ -161,6 +162,8 @@ export function create(options: create.Options) {
     '/earn/verified-vaults/*',
     '/routes',
     '/routes/*',
+    '/route-policies',
+    '/route-policies/*',
     '/organizations',
     '/organizations/*',
     '/scopes',
@@ -202,6 +205,7 @@ export function create(options: create.Options) {
     .route('/earn/verified-vaults', earnVaults())
     .route('/routes/support', routesSupport())
     .route('/routes', routes())
+    .route('/route-policies', routePolicies())
     .route('/organizations', organizations())
     .route('/scopes', scopes())
     .route('/subsidies', subsidies())
@@ -272,11 +276,13 @@ export declare namespace create {
     /** Transactional email sender used for organization invitations. */
     email?: Email.Sender | undefined
     /**
-     * Extracts the verified admin identity from a request, or `null` to deny.
-     * Must only return an identity for an already-authenticated request (a
-     * verified Access JWT, or a header set by a trusted proxy).
+     * Extracts an already-verified admin identity from the request or middleware
+     * context, or `null` to deny. Authentication middleware must run before this app.
      */
-    identify: (request: Request) => Identity | null | Promise<Identity | null>
+    identify: (
+      request: Request,
+      context: Context<Environment>,
+    ) => Identity | null | Promise<Identity | null>
     /**
      * KV state store backing API-key records (shared with the main API's
      * `kv` option), provisioned against by the `/api-keys` routes.

package/src/admin/apps/api-keys.test.ts

@@ -2,7 +2,10 @@ import * as ApiKey from '../../ApiKey.js'
 import * as core_ApiKeys from '../../ApiKeys.js'
 import * as Organizations from '../../db/tables/organizations.js'
 import * as Projects from '../../db/tables/projects.js'
+import * as RoutesDepositAddresses from '../../db/tables/routesDepositAddresses.js'
+import * as RoutesPolicies from '../../db/tables/routesPolicies.js'
 import * as Users from '../../db/tables/users.js'
+import * as Policy from '../../internal/routes/Policy.js'
 
 import * as TestAdmin from '../../../test/Admin.js'
 import * as TestApp from '../../../test/App.js'
@@ -342,8 +345,69 @@ describe('DELETE /api-keys/:id', () => {
 })
 
 describe('POST /api-keys/:id/rotate', () => {
+  test('allows the replacement of an unused one-off key to claim a deposit address', async () => {
+    const { client, db, store } = await setup()
+    const { record: source } = await core_ApiKeys.mint(store, {
+      scopes: ['routes:read', 'routes:write'],
+    })
+    expect(await Organizations.get(db, source.orgId)).toBeUndefined()
+    const response = await client['api-keys'][':id'].rotate.$post({ param: { id: source.id } })
+    expect(response.status).toBe(200)
+    const replacement = await TestApp.json(response, ApiKeys.schema.rotateApiKey.Response)
+    expect(replacement.orgId).toBe(source.orgId)
+    // Exercise the same owner/capacity boundary as POST /v1/routes/deposit-addresses.
+    await expect(
+      RoutesDepositAddresses.claimCreation(db, {
+        orgId: replacement.orgId,
+        claim: {
+          apiKeyId: replacement.id,
+          irrevocable: false,
+          keyHash: 'ab'.repeat(32),
+          requestHash: 'cd'.repeat(32),
+          ttlMs: 60_000,
+        },
+      }),
+    ).resolves.toMatchObject({ type: 'claimed' })
+  })
+
+  test('security: rotating a one-off key does not discard its route restrictions', async () => {
+    const { client, db, store } = await setup()
+    const { record: source } = await core_ApiKeys.mint(store, {
+      name: 'Restricted one-off',
+      scopes: ['routes:read', 'routes:write'],
+    })
+    // Deposit-address creation materializes the synthetic owner for one-off keys.
+    await Organizations.create(db, { id: source.orgId, name: 'One-off route owner' })
+    const scope = {
+      apiKeyId: source.id,
+      environment: source.environment,
+      orgId: source.orgId,
+    }
+    await RoutesPolicies.save(db, { scope, version: 0, policy: { access: [] } })
+
+    const response = await client['api-keys'][':id'].rotate.$post({ param: { id: source.id } })
+    expect(response.status).toBe(200)
+    const replacement = await TestApp.json(response, ApiKeys.schema.rotateApiKey.Response)
+    expect(replacement.orgId).toBe(source.orgId)
+    expect((await core_ApiKeys.resolve(store, replacement.token))?.scopes).toEqual(source.scopes)
+    const loaded = await RoutesPolicies.load(db, {
+      apiKeyId: replacement.id,
+      environment: replacement.environment,
+      orgId: replacement.orgId,
+    })
+    // Reproduce the runtime's default access for an owner with no org policy.
+    const effective = Policy.resolve({
+      layers: loaded.layers.map((layer) => layer.policy),
+      legacy: loaded.legacy,
+      ...(loaded.layers[0]?.version === 0 ? { defaultAccess: null } : {}),
+    })
+    expect(effective.access).toMatchInlineSnapshot(`[]`)
+  })
+
   test('mints a replacement with the source access and attribution', async () => {
-    const { client, store } = await setup()
+    const { client, db, store } = await setup()
+    await Organizations.create(db, { id: 'org_privy', name: 'Privy' })
+    await Projects.create(db, { id: 'prj_privy', name: 'Zones', orgId: 'org_privy' })
     const { record: source, token: sourceToken } = await core_ApiKeys.mint(store, {
       allowedIps: ['203.0.113.0/24'],
       billingActive: true,
@@ -356,6 +420,16 @@ describe('POST /api-keys/:id/rotate', () => {
       rateLimits: { '*': { limit: 10_000, period: 'minute' } },
       scopes: ['zone:421700001:read', 'zone:421700001:write'],
     })
+    await RoutesPolicies.save(db, {
+      policy: { maxAmount: '12' },
+      scope: {
+        apiKeyId: source.id,
+        environment: 'sandbox',
+        orgId: source.orgId,
+        projectId: source.projectId,
+      },
+      version: 0,
+    })
 
     const response = await client['api-keys'][':id'].rotate.$post({
       param: { id: source.id },
@@ -382,6 +456,14 @@ describe('POST /api-keys/:id/rotate', () => {
       id: body.id,
       scopes: source.scopes,
     })
+    expect(
+      await RoutesPolicies.get(db, {
+        apiKeyId: body.id,
+        environment: 'sandbox',
+        orgId: source.orgId,
+        projectId: source.projectId,
+      }),
+    ).toMatchObject({ policy: { maxAmount: '12' }, version: 1 })
   })
 
   test('unknown id → 404', async () => {
@@ -441,7 +523,7 @@ describe('POST /api-keys/:id/rotate', () => {
       param: { id: source.id },
     })
     const replacement = await TestApp.json(rotateResponse, ApiKeys.schema.rotateApiKey.Response)
-    expect(replacement.orgId).toBe(replacement.id)
+    expect(replacement.orgId).toBe(source.orgId)
 
     const updateResponse = await client['api-keys'][':id'].$patch({
       json: { orgId: organization.id },
@@ -599,6 +681,16 @@ describe('PATCH /api-keys/:id', () => {
       orgId: organization.id,
       scopes: ['data:read'],
     })
+    const originalScope = {
+      apiKeyId: record.id,
+      environment: record.environment,
+      orgId: organization.id,
+    } as const
+    await RoutesPolicies.save(db, {
+      policy: { maxAmount: '5' },
+      scope: originalScope,
+      version: 0,
+    })
     const response = await client['api-keys'][':id'].$patch({
       json: { orgId: other.id },
       param: { id: record.id },
@@ -607,6 +699,10 @@ describe('PATCH /api-keys/:id', () => {
     expect((await core_ApiKeys.resolve(store, token))?.orgId).toBe(other.id)
     expect(await core_ApiKeys.listByOrg(store, organization.id)).toEqual([])
     expect((await core_ApiKeys.listByOrg(store, other.id)).map(({ id }) => id)).toEqual([record.id])
+    expect(await RoutesPolicies.get(db, originalScope)).toMatchObject({ policy: {}, version: 2 })
+
+    await core_ApiKeys.updateBounded(db, store, record.id, { orgId: organization.id })
+    expect(await RoutesPolicies.get(db, originalScope)).toMatchObject({ policy: {}, version: 3 })
   })
 
   test('enforces the destination organization limit when changing attribution', async () => {

package/src/admin/apps/api-keys.ts

@@ -6,6 +6,7 @@ import * as ApiKeys from '../../ApiKeys.js'
 import * as Db from '../../db/Db.js'
 import * as Organizations from '../../db/tables/organizations.js'
 import * as Projects from '../../db/tables/projects.js'
+import * as RoutesPolicies from '../../db/tables/routesPolicies.js'
 import * as Users from '../../db/tables/users.js'
 import * as OpenApi from '../../internal/OpenApi.js'
 import * as Response from '../../internal/Response.js'
@@ -377,20 +378,28 @@ export function apiKeys() {
           })
 
         try {
-          const { record, token } = await ApiKeys.mintBounded(Db.get(c.get('db')), store, {
-            allowedIps: source.allowedIps,
-            createdBy: c.get('identity')!.email,
-            environment: source.environment,
-            scopes: [...new Set(source.scopes)],
-            ...(source.billingActive === undefined ? {} : { billingActive: source.billingActive }),
-            ...(source.expiresAt === undefined ? {} : { expiresAt: source.expiresAt }),
-            ...(source.name === undefined ? {} : { name: source.name }),
-            ...(source.orgId === source.id ? {} : { orgId: source.orgId }),
-            ...(source.projectId === undefined ? {} : { projectId: source.projectId }),
-            ...(source.rateLimits === undefined ? {} : { rateLimits: source.rateLimits }),
-          })
+          const { record, token } = await ApiKeys.mintBounded(
+            Db.get(c.get('db')),
+            store,
+            {
+              allowedIps: source.allowedIps,
+              createdBy: c.get('identity')!.email,
+              environment: source.environment,
+              scopes: [...new Set(source.scopes)],
+              ...(source.billingActive === undefined
+                ? {}
+                : { billingActive: source.billingActive }),
+              ...(source.expiresAt === undefined ? {} : { expiresAt: source.expiresAt }),
+              ...(source.name === undefined ? {} : { name: source.name }),
+              orgId: source.orgId,
+              ...(source.projectId === undefined ? {} : { projectId: source.projectId }),
+              ...(source.rateLimits === undefined ? {} : { rateLimits: source.rateLimits }),
+            },
+            { policySourceApiKeyId: source.id },
+          )
           return c.json(Response.validated(schema.rotateApiKey.Response, { ...record, token }), 200)
         } catch (cause) {
+          if (cause instanceof RoutesPolicies.InvalidScopeError) return ownerNotFound(c)
           if (cause instanceof ApiKeys.OwnerDeletedError) return ownerNotFound(c)
           if (cause instanceof ApiKeys.LiveKeyLimitError) return keyLimitReached(c)
           return Response.upstream(c, cause)