tapimo 0.5.1 → 0.5.2

package/src/db/tables/organizations.ts

@@ -105,6 +105,16 @@ export declare namespace createOwned {
  */
 export function deleteOrganization(db: Db.Db, id: string): Promise<boolean> {
   return db.kysely.transaction().execute(async (trx) => {
+    const unreported = await trx
+      .selectFrom('sponsored_transactions')
+      .select('id')
+      .where('orgId', '=', id)
+      .where('billable', '=', true)
+      .where('meterReportedAt', 'is', null)
+      .limit(1)
+      .executeTakeFirst()
+    if (unreported) throw new UnreportedSponsorshipsError()
+
     await trx
       .deleteFrom('webhook_subscriptions')
       .where('ownerType', '=', 'api_key')
@@ -124,6 +134,19 @@ export function deleteOrganization(db: Db.Db, id: string): Promise<boolean> {
   })
 }
 
+/** Whether an organization has billable sponsorships awaiting settlement. */
+export async function hasUnreportedSponsorships(db: Db.Db, id: string): Promise<boolean> {
+  const record = await db.kysely
+    .selectFrom('sponsored_transactions')
+    .select('id')
+    .where('orgId', '=', id)
+    .where('billable', '=', true)
+    .where('meterReportedAt', 'is', null)
+    .limit(1)
+    .executeTakeFirst()
+  return record !== undefined
+}
+
 /**
  * Reads an organization by id.
  *
@@ -389,3 +412,8 @@ export declare namespace upsert {
     name?: string | undefined
   }
 }
+
+/** Organization deletion is blocked until billable sponsorships settle. */
+export class UnreportedSponsorshipsError extends Error {
+  override name = 'Organizations.UnreportedSponsorshipsError'
+}

package/src/db/tables/requestUsage.ts

@@ -32,7 +32,7 @@ export type MeterEventTable = {
   orgId: string
   reason: string | null
   reportedAt: string | null
-  sequence: number
+  sequence: Count
   state: State
   stripeCustomerId: string
 }
@@ -91,26 +91,6 @@ export async function listPending(db: Db.Db, environment: Environment): Promise<
   return rows.map(toMeterEvent)
 }
 
-/**
- * Counts the meter events already reported for a bucket — the next delta's
- * `sequence`, so a new seal never collides with a settled one.
- *
- * @param db - The database.
- * @param key - The bucket key.
- * @returns The count of reported events for the bucket.
- */
-export async function countReported(db: Db.Db, key: BucketKey): Promise<number> {
-  const row = await db.kysely
-    .selectFrom('request_usage_meter_events')
-    .select((eb) => eb.fn.countAll<string>().as('count'))
-    .where('orgId', '=', key.orgId)
-    .where('environment', '=', key.environment)
-    .where('bucketStart', '=', key.bucketStart)
-    .where('state', '=', 'reported')
-    .executeTakeFirstOrThrow()
-  return Number(row.count)
-}
-
 /**
  * Inserts a frozen `pending` meter event, claiming a delta. Idempotent on the
  * deterministic `identifier`: a re-seal after a crash resolves to the existing
@@ -157,7 +137,7 @@ export declare namespace insertPending {
     identifier: string
     /** Organization id (`org_…`). */
     orgId: string
-    /** Delta sequence within the bucket. */
+    /** Reported-count watermark observed when this delta was claimed. */
     sequence: number
     /** Stripe customer id the event bills against. */
     stripeCustomerId: string
@@ -227,5 +207,5 @@ function toBucket(row: Selectable<BucketTable>): Bucket {
 
 /** Maps a meter-event row to its domain record. */
 function toMeterEvent(row: Selectable<MeterEventTable>): MeterEvent {
-  return { ...row, deltaCount: Number(row.deltaCount) }
+  return { ...row, deltaCount: Number(row.deltaCount), sequence: Number(row.sequence) }
 }

package/src/db/tables/sponsoredTransactions.test.ts

@@ -189,6 +189,47 @@ describe('assignTransactionHash', () => {
     )
     await db.close()
   })
+
+  test('behavior: keeps an over-limit failed intent retryable across a period rollover', async () => {
+    const db = create()
+    await db.migrate()
+    const { transactionHash: _, ...intent } = input
+    vi.useFakeTimers({ now: new Date('2026-01-31T23:59:00.000Z') })
+    try {
+      const failed = await SponsoredTransactions.upsert(db, { ...intent, feeMax: '100' })
+      await SponsoredTransactions.fail(db, failed.id, new Date().toISOString())
+      vi.setSystemTime(new Date('2026-02-01T00:01:00.000Z'))
+      await SponsoredTransactions.upsert(db, {
+        ...intent,
+        feeMax: '100',
+        signPayload: `0x${'bc'.repeat(32)}`,
+      })
+
+      await expect(
+        SponsoredTransactions.assignTransactionHash(db, failed.id, input.transactionHash, {
+          chainIds: [input.chainId],
+          max: 100n,
+          since: '2026-02-01T00:00:00.000Z',
+        }),
+      ).rejects.toBeInstanceOf(SponsoredTransactions.PeriodSpendLimitError)
+      expect(await SponsoredTransactions.get(db, failed.id)).toMatchObject({
+        createdAt: '2026-01-31T23:59:00.000Z',
+        finalizedAt: '2026-02-01T00:01:00.000Z',
+        status: 'failed',
+        transactionHash: null,
+      })
+      expect(
+        (
+          await SponsoredTransactions.listIntents(db, {
+            failedSince: '2026-02-01T00:00:00.000Z',
+          })
+        ).map((record) => record.id),
+      ).toContain(failed.id)
+    } finally {
+      vi.useRealTimers()
+      await db.close()
+    }
+  })
 })
 
 describe('finalize', () => {

package/src/db/tables/sponsoredTransactions.ts

@@ -182,19 +182,58 @@ export declare namespace listIntents {
  * @param db - The database.
  * @param id - The sponsored-transaction id (`stx_…`).
  * @param transactionHash - The matched on-chain transaction hash.
+ * @param limit - The active period spend limit, when enforced.
  */
 export async function assignTransactionHash(
   db: Db.Db,
   id: string,
   transactionHash: string,
+  limit?: reserve.Limit,
 ): Promise<void> {
-  await db.kysely
-    .updateTable('sponsored_transactions')
-    .set({ finalizedAt: null, status: 'pending', transactionHash })
-    .where('id', '=', id)
-    .where('status', 'in', ['failed', 'pending'])
-    .where('transactionHash', 'is', null)
-    .execute()
+  try {
+    await db.transaction(async (tx) => {
+      const record = await get(tx, id)
+      if (
+        !record ||
+        record.transactionHash !== null ||
+        !['failed', 'pending'].includes(record.status)
+      )
+        return
+      if (record.status === 'failed' && record.billable && limit)
+        await sql`select pg_advisory_xact_lock(${billingLockClass}, hashtext(${record.orgId}))`.execute(tx.kysely) // prettier-ignore
+      await tx.kysely
+        .updateTable('sponsored_transactions')
+        .set({
+          ...(record.status === 'failed' ? { createdAt: new Date().toISOString() } : {}),
+          finalizedAt: null,
+          status: 'pending',
+          transactionHash,
+        })
+        .where('id', '=', id)
+        .where('status', '=', record.status)
+        .where('transactionHash', 'is', null)
+        .execute()
+      if (record.status === 'failed' && record.billable && limit) {
+        const committed = await spend(tx, {
+          chainIds: limit.chainIds,
+          orgId: record.orgId,
+          since: limit.since,
+        })
+        if (committed > limit.max) throw new PeriodSpendLimitError()
+      }
+    })
+  } catch (error) {
+    // Keep the on-chain match eligible until budget becomes available.
+    if (error instanceof PeriodSpendLimitError)
+      await db.kysely
+        .updateTable('sponsored_transactions')
+        .set({ finalizedAt: new Date().toISOString() })
+        .where('id', '=', id)
+        .where('status', '=', 'failed')
+        .where('transactionHash', 'is', null)
+        .execute()
+    throw error
+  }
 }
 
 /**

package/src/internal/Auth.test.ts

@@ -743,7 +743,7 @@ describe('require', () => {
   })
 
   describe('mpp', () => {
-    test('uses a default paid-request limit of 100 per minute', async () => {
+    test('uses a default paid-request limit with a normalized IPv6 identity', async () => {
       const rateLimit = underQuota()
       const consume = vi.spyOn(rateLimit, 'consume')
       const app = createApp({
@@ -757,7 +757,7 @@ describe('require', () => {
       const response = await app.request('/protected', {
         headers: {
           authorization: 'Payment paid',
-          'x-forwarded-for': '203.0.113.10',
+          'cf-connecting-ip': '2001:db8:abcd:12::1',
         },
       })
 
@@ -765,7 +765,60 @@ describe('require', () => {
       expect(response.headers.get('RateLimit-Limit')).toBe('100')
       expect(response.headers.get('RateLimit-Scope')).toBe('mpp')
       expect(consume).toHaveBeenCalledWith({
-        key: 'mpp:public:203.0.113.10',
+        key: 'mpp:public:2001:db8:abcd:12',
+        limit: { perMinute: 100 },
+      })
+    })
+
+    test('ignores untrusted forwarding headers for public identity', async () => {
+      const rateLimit = underQuota()
+      const consume = vi.spyOn(rateLimit, 'consume')
+      const app = createApp({
+        auth: {
+          apiKey: { resolve: TestApp.resolver({ keys: [{ ...key, token }] }) },
+          mpp: createMppHandler(),
+          rateLimit,
+        },
+        policy: { mpp: { session: { amount: '1' } } },
+      })
+      const response = await app.request('/protected', {
+        headers: {
+          authorization: 'Payment paid',
+          'x-forwarded-for': '203.0.113.10',
+          'x-real-ip': '203.0.113.11',
+          'x-test-client-ip': '203.0.113.12',
+        },
+      })
+
+      expect(response.status).toBe(200)
+      expect(consume).toHaveBeenCalledWith({
+        key: 'mpp:public:anonymous',
+        limit: { perMinute: 100 },
+      })
+    })
+
+    test('uses a configured trusted client-IP resolver outside Cloudflare', async () => {
+      const rateLimit = underQuota()
+      const consume = vi.spyOn(rateLimit, 'consume')
+      const app = createApp({
+        auth: {
+          apiKey: { resolve: TestApp.resolver({ keys: [{ ...key, token }] }) },
+          mpp: createMppHandler(),
+          publicClientIp: (request) => request.headers.get('x-real-ip') ?? undefined,
+          rateLimit,
+        },
+        policy: { mpp: { session: { amount: '1' } } },
+      })
+      const response = await app.request('/protected', {
+        headers: {
+          authorization: 'Payment paid',
+          'x-real-ip': '2001:db8:abcd:12::99',
+        },
+      })
+
+      expect(response.status).toBe(200)
+      expect(consume).toHaveBeenCalledWith({
+        key: 'mpp:public:2001:db8:abcd:12',
         limit: { perMinute: 100 },
       })
     })
@@ -788,7 +841,7 @@ describe('require', () => {
         headers: {
           authorization: 'Payment paid',
           'tempo-api-key': token,
-          'x-forwarded-for': '203.0.113.10',
+          'cf-connecting-ip': '203.0.113.10',
         },
       })
 
@@ -1228,7 +1281,7 @@ describe('require', () => {
         policy: { public: { rateLimit: { perMinute: 60 } } },
       })
       const response = await app.request('/protected', {
-        headers: { 'x-forwarded-for': '203.0.113.10' },
+        headers: { 'cf-connecting-ip': '203.0.113.10' },
       })
       const body = await response.json()
 
@@ -1280,7 +1333,7 @@ describe('require', () => {
           policy: { public: { rateLimit: { perMinute: 1 } } },
         })
         const response = await app.request('/protected', {
-          headers: { 'x-forwarded-for': '203.0.113.10' },
+          headers: { 'cf-connecting-ip': '203.0.113.10' },
         })
         const body = await response.json()
 
@@ -1338,7 +1391,7 @@ describe('require', () => {
           policy: { public: { rateLimit: { perMinute: 1 } } },
         })
         const pending = app.request('/protected', {
-          headers: { 'x-forwarded-for': '203.0.113.10' },
+          headers: { 'cf-connecting-ip': '203.0.113.10' },
         })
         // Advance past the 300ms consume timeout so it fails open.
         await vi.advanceTimersByTimeAsync(300)
@@ -1382,7 +1435,7 @@ describe('require', () => {
           policy: { public: { rateLimit: { perMinute: 1 } } },
         })
         const response = await app.request('/protected', {
-          headers: { 'x-forwarded-for': '203.0.113.10' },
+          headers: { 'cf-connecting-ip': '203.0.113.10' },
         })
         const body = await response.json()
 
@@ -1419,7 +1472,7 @@ describe('require', () => {
           policy: { public: { rateLimit: { perMinute: 1 } } },
         })
         const response = await app.request('/protected', {
-          headers: { 'x-forwarded-for': '203.0.113.10' },
+          headers: { 'cf-connecting-ip': '203.0.113.10' },
         })
 
         expect(response.status).toMatchInlineSnapshot(`200`)
@@ -1448,7 +1501,7 @@ describe('require', () => {
           policy: { public: { rateLimit: { perMinute: 1 } } },
         })
         const response = await app.request('/protected', {
-          headers: { 'x-forwarded-for': '203.0.113.10' },
+          headers: { 'cf-connecting-ip': '203.0.113.10' },
         })
 
         expect(response.status).toMatchInlineSnapshot(`200`)

package/src/internal/Auth.ts

@@ -58,6 +58,8 @@ export type Context = {
    * framework default.
    */
   publicRateLimit?: RateLimit.Limit | undefined
+  /** Resolves a trusted client IP for public quota identity. */
+  publicClientIp?: ((request: Request) => string | undefined) | undefined
   /** Rate-limit store used by API handlers. */
   rateLimit?: RateLimit.Store | undefined
   /** Session lane resolution (the session surface's capability), or undefined when sessions are unmounted. */
@@ -523,6 +525,9 @@ export function middleware<
     // API-key-only routes (no per-route `policy.public`) still fall back to the
     // deployment's configured public quota.
     publicRateLimit: defaults.public.rateLimit,
+    ...(options.public && options.public.clientIp
+      ? { publicClientIp: options.public.clientIp }
+      : {}),
     ...(options.mpp === false
       ? {}
       : {
@@ -608,6 +613,8 @@ export declare namespace middleware {
     /** Default public access policy. Pass false to disable anonymous access. */
     public?:
       | {
+          /** Resolves the client IP from trusted runtime or proxy metadata. Defaults to `cf-connecting-ip`. */
+          clientIp?: ((request: Request) => string | undefined) | undefined
           /** Anonymous public quota for protected routes. */
           rateLimit?: RateLimit.Limit | undefined
         }
@@ -1567,7 +1574,7 @@ export function require<environment extends Environment = Environment>(
       }
     }
 
-    const publicPrincipal = principalFromPublic(c)
+    const publicPrincipal = principalFromPublic(c, auth)
     if (hasPayment) {
       c.set('principal', publicPrincipal)
       return requirePayment(c, proceed, {
@@ -1901,15 +1908,10 @@ function principalFromApiKey(apiKey: ApiKey.ApiKey): Principal {
   }
 }
 
-function principalFromPublic(c: hono_Context): Principal {
-  const forwarded = c.req.header('x-forwarded-for')?.split(',')[0]?.trim()
+function principalFromPublic(c: hono_Context, auth: Context): Principal {
+  const ip = auth.publicClientIp ? auth.publicClientIp(c.req.raw) : c.req.header('cf-connecting-ip')
   return {
-    id:
-      c.req.header('cf-connecting-ip') ??
-      c.req.header('x-real-ip') ??
-      forwarded ??
-      c.req.header('x-test-client-ip') ??
-      'anonymous',
+    id: ip ? RateLimit.normalizeIp(ip) : 'anonymous',
     type: 'public',
   }
 }

package/src/internal/Cache.test.ts

@@ -1,6 +1,25 @@
 import { Hono } from 'hono'
+import * as z from 'zod/mini'
 import * as Cache from './Cache.js'
 
+describe('urlKey', () => {
+  test('serializes parsed arrays as repeated query parameters', async () => {
+    const schema = z.object({ include: z.array(z.string()) })
+    const app = new Hono<{ Variables: { chainId: number } }>()
+    app.use('*', async (c, next) => {
+      c.set('chainId', 4217)
+      await next()
+    })
+    app.get('/', (c) => c.text(Cache.urlKey(c, schema)))
+
+    const left = await (await app.request('/?include=a%2Cb&include=c')).text()
+    const right = await (await app.request('/?include=a&include=b%2Cc')).text()
+
+    expect(left).toMatchInlineSnapshot(`"http://localhost/?chainId=4217&include=a%2Cb&include=c"`)
+    expect(right).toMatchInlineSnapshot(`"http://localhost/?chainId=4217&include=a&include=b%2Cc"`)
+  })
+})
+
 describe('response', () => {
   test('preserves rate-limit headers without caching them', async () => {
     await withCaches(async () => {

package/src/internal/Cache.ts

@@ -192,11 +192,23 @@ export function urlKey<
   schema extends z.ZodMiniType,
 >(c: Context<environment>, schema: schema): string {
   const url = new URL(c.req.url)
-  const query = schema.parse(Object.fromEntries(url.searchParams)) as Record<string, unknown>
+  const query = schema.parse(
+    Object.fromEntries(
+      Object.entries(c.req.queries()).map(([key, values]) => [
+        key,
+        values.length === 1 ? values[0] : values,
+      ]),
+    ),
+  ) as Record<string, unknown>
   url.search = ''
   if (query['chainId'] === undefined) url.searchParams.set('chainId', String(c.get('chainId')))
   for (const [key, value] of Object.entries(query)) {
     if (value === undefined) continue
+    if (Array.isArray(value)) {
+      for (const item of value)
+        url.searchParams.append(key, String(item as number | string | boolean))
+      continue
+    }
     url.searchParams.set(key, String(value as number | string | boolean))
   }
   return url.toString()

package/src/internal/EdgeCache.test.ts

@@ -130,6 +130,33 @@ describe('middleware', () => {
     expect(store.size).toMatchInlineSnapshot(`0`)
   })
 
+  test('strips payment headers from private responses before sharing them', async () => {
+    const { app, store, downstreamCalls } = createApp()
+
+    const miss = await app.request('/private')
+    const hit = await app.request('/private')
+
+    expect(downstreamCalls()).toMatchInlineSnapshot(`1`)
+    expect(store.size).toMatchInlineSnapshot(`1`)
+    expect(miss.headers.get('payment-receipt')).toMatchInlineSnapshot(`"payer-specific"`)
+    expect(miss.headers.get('payment-session-snapshot')).toMatchInlineSnapshot(`"session-specific"`)
+    expect(hit.headers.get('payment-receipt')).toMatchInlineSnapshot(`null`)
+    expect(hit.headers.get('payment-session-snapshot')).toMatchInlineSnapshot(`null`)
+    expect(hit.headers.get('cache-control')).toMatchInlineSnapshot(
+      `"public, max-age=30, s-maxage=30"`,
+    )
+  })
+
+  test('does not cache responses marked `no-store`', async () => {
+    const { app, store, downstreamCalls } = createApp()
+
+    await app.request('/no-store')
+    await app.request('/no-store')
+
+    expect(downstreamCalls()).toMatchInlineSnapshot(`2`)
+    expect(store.size).toMatchInlineSnapshot(`0`)
+  })
+
   test('does not cache routes that did not opt in', async () => {
     const { app, store, downstreamCalls } = createApp()
 
@@ -271,6 +298,19 @@ function createApp(
     c.set('edgeCache', { maxAge: 30, staleWhileRevalidate: 300 })
     return c.json({ ok: false }, 500)
   })
+  app.get('/private', cacheable, (c) => {
+    c.set('edgeCache', { maxAge: 30 })
+    c.header('Cache-Control', 'private, max-age=30')
+    c.header('Payment-Receipt', 'payer-specific')
+    c.header('Payment-Session-Snapshot', 'session-specific')
+    return c.json({ ok: true })
+  })
+  app.get('/no-store', cacheable, (c) => {
+    c.set('edgeCache', { maxAge: 30 })
+    c.header('Cache-Control', 'no-store')
+    c.header('Payment-Receipt', 'payer-specific')
+    return c.json({ ok: true })
+  })
   app.get('/binary', cacheable, (c) => {
     c.set('edgeCache', { maxAge: 30, staleWhileRevalidate: 300 })
     // Bytes that are not valid UTF-8 (PNG signature) — corrupted if stored via

package/src/internal/EdgeCache.ts

@@ -33,12 +33,16 @@ const volatileHeaders = [
   'cf-cache-status',
   'content-encoding',
   'content-length',
-  'server-timing',
-  'set-cookie',
+  'payment-receipt',
+  'payment-session-snapshot',
   'ratelimit-limit',
   'ratelimit-remaining',
   'ratelimit-reset',
+  'ratelimit-scope',
+  'server-timing',
+  'set-cookie',
   'tempo-request-id',
+  'www-authenticate',
 ]
 
 /**
@@ -115,6 +119,8 @@ export function middleware<environment extends Env>(
     if (c.res.status < 200 || c.res.status >= 300) return
     if (c.res.headers.has('set-cookie')) return
     if (c.res.headers.get('content-type')?.includes('text/event-stream')) return
+    const responseDirectives = (c.res.headers.get('cache-control') ?? '').toLowerCase()
+    if (responseDirectives.includes('no-cache') || responseDirectives.includes('no-store')) return
 
     // Store a public, sanitized copy; the client still receives the original
     // (private, metered) response for this miss. Clone synchronously — the
@@ -247,7 +253,9 @@ function isTextual(contentType: string | null): boolean {
 function cacheKey(requestUrl: string) {
   const url = new URL(requestUrl)
   url.searchParams.sort()
-  return url.toString()
+  // Version the key so entries written before a sanitizer change cannot
+  // survive the deployment that changes the shared-cache boundary.
+  return `edge:v2:${url.toString()}`
 }
 
 function getWaitUntil(c: { executionCtx?: { waitUntil(promise: Promise<unknown>): void } }) {

package/src/internal/FundingQuotes.test.ts

@@ -235,6 +235,32 @@ describe('listQuoteCandidates', () => {
 
     expect(candidate?.id).toBe('tron-usdt-tempo-usdt0-rhino')
   })
+
+  test('selects proven Squid stablecoin corridors', () => {
+    const candidates = [
+      FundingQuotes.listQuoteCandidates({
+        destinationToken: 'USDC.e',
+        provider: 'squid',
+        sourceAmount: '1000000',
+        sourceAmountUnits: 'baseUnits',
+        sourceChain: 'base',
+        sourceToken: 'USDC',
+      })[0],
+      FundingQuotes.listQuoteCandidates({
+        destinationToken: 'USDT0',
+        provider: 'squid',
+        sourceAmount: '1000000',
+        sourceAmountUnits: 'baseUnits',
+        sourceChain: 'ethereum',
+        sourceToken: 'USDT',
+      })[0],
+    ]
+
+    expect(candidates.map((candidate) => candidate?.id)).toEqual([
+      'base-usdc-tempo-usdce-squid',
+      'ethereum-usdt-tempo-usdt0-squid',
+    ])
+  })
 })
 
 describe('listProviders', () => {
@@ -262,6 +288,13 @@ describe('listProviders', () => {
           "requiresApiKey": false,
           "status": "unconfigured",
         },
+        {
+          "id": "squid",
+          "kind": "solverNetwork",
+          "name": "Squid",
+          "requiresApiKey": true,
+          "status": "unconfigured",
+        },
       ]
     `)
   })

package/src/internal/FundingQuotes.ts

@@ -245,6 +245,13 @@ const providers = [
     requiresApiKey: false,
     status: 'unconfigured',
   },
+  {
+    id: 'squid',
+    kind: 'solverNetwork',
+    name: 'Squid',
+    requiresApiKey: true,
+    status: 'unconfigured',
+  },
 ] as const
 
 type TokenInput = (typeof sourceChains)[number]['tokens'][number]
@@ -369,7 +376,9 @@ const inventory: readonly InventoryEntry[] = [
   { destinationToken: 'usdce', provider: 'across', sourceChains: ['ethereum', 'base', 'bnb'], sourceTokens: ['USDC'] }, // prettier-ignore
   { destinationToken: 'usdce', provider: 'relay', sourceChains: ['ethereum', 'base', 'bnb'], sourceTokens: ['USDC', 'USDT'] }, // prettier-ignore
   { destinationToken: 'usdce', provider: 'rhino', sourceChains: ['base', 'solana'], sourceTokens: ['USDC'] }, // prettier-ignore
+  { destinationToken: 'usdce', provider: 'squid', sourceChains: ['ethereum', 'base', 'bnb'], sourceTokens: ['USDC'] }, // prettier-ignore
   { destinationToken: 'usdt0', provider: 'rhino', sourceChains: ['tron'], sourceTokens: ['USDT'] }, // prettier-ignore
+  { destinationToken: 'usdt0', provider: 'squid', sourceChains: ['ethereum', 'base', 'bnb'], sourceTokens: ['USDT'] }, // prettier-ignore
 ]
 
 type InventoryEntry = {

package/src/internal/RateLimit.test.ts

@@ -130,6 +130,18 @@ describe('edge', () => {
     expect(ip.limit).toHaveBeenCalledWith({ key: '2001:db8:abcd:12' })
   })
 
+  test('normalizes equivalent IPv6 addresses to the same /64 prefix', () => {
+    expect([
+      RateLimit.normalizeIp('2001:0db8:abcd:0012::1'),
+      RateLimit.normalizeIp('2001:db8:abcd:12:ffff::2'),
+    ]).toMatchInlineSnapshot(`
+      [
+        "2001:db8:abcd:12",
+        "2001:db8:abcd:12",
+      ]
+    `)
+  })
+
   test('returns 429 when any layer denies', async () => {
     const response = await RateLimit.edge(request({ asn: 64512, ip: '203.0.113.7' }), {
       asn: binding(false),

package/src/internal/RateLimit.ts

@@ -139,12 +139,12 @@ type CfProperties = { asn?: number | undefined }
 function clientKey(request: Request): string {
   const ip = request.headers.get('cf-connecting-ip')
   if (!ip) return 'unknown'
-  if (ip.includes('.')) return ip
-  return ipv6Prefix(ip)
+  return normalizeIp(ip)
 }
 
-/** First four hextets of an IPv6 address, with `::` expanded. */
-function ipv6Prefix(ip: string): string {
+/** Normalizes an IPv4 address or IPv6 /64 prefix for per-client quotas. */
+export function normalizeIp(ip: string): string {
+  if (ip.includes('.')) return ip
   const [address = ''] = ip.split('%')
   const [head = '', tail = ''] = address.split('::')
   const left = head ? head.split(':') : []