tapimo 0.6.0 → 0.7.0

package/src/apps/data/routes/valuation.test.ts

@@ -51,7 +51,11 @@ const seed: readonly SeedToken[] = JSON.parse(
 // Deterministic EUR-based rate set so conversion math is exact in assertions.
 const fixed = FxOracle.from({
   name: 'fixed',
-  rates: async () => ({ asOf: '2026-01-01', base: 'EUR', rates: { AUD: '1.6', USD: '1.0' } }),
+  rates: async () => ({
+    asOf: '2026-01-01T00:00:00.000Z',
+    base: 'EUR',
+    rates: { AUD: '1.6', USD: '1.0' },
+  }),
 })
 
 async function holderWithBalance(client: ReturnType<typeof app>) {
@@ -93,6 +97,17 @@ async function chainSum(holder: `0x${string}`, currency: string) {
 }
 
 describe('GET /addresses/:address/valuation', () => {
+  test('requires a full pricing timestamp', () => {
+    const pricing = { asOf: '2026-01-01', basis: 'nominal', source: 'fixed' }
+    expect(Valuation.schema.Pricing.safeParse(pricing).success).toBe(false)
+    expect(
+      Valuation.schema.Pricing.safeParse({
+        ...pricing,
+        asOf: '2026-01-01T00:00:00.000Z',
+      }).success,
+    ).toBe(true)
+  })
+
   test('normalizes the denomination', () => {
     expect(
       Valuation.schema.getAddressValuation.Query.parse({ denomination: 'aud' }).denomination,
@@ -176,7 +191,7 @@ describe('GET /addresses/:address/valuation', () => {
       expect(aud.amount).toBe(core_Value.format((sum * 16n) / 10n, 6))
       expect(aud.pricing).toMatchInlineSnapshot(`
         {
-          "asOf": "2026-01-01",
+          "asOf": "2026-01-01T00:00:00.000Z",
           "basis": "nominal",
           "source": "fixed",
         }
@@ -201,7 +216,7 @@ describe('GET /addresses/:address/valuation', () => {
     expect(Number(body.amount)).toBeGreaterThan(0)
     expect(body.pricing?.basis).toBe('nominal')
     expect(body.pricing?.source).toBe('ecb')
-    expect(body.pricing?.asOf).toMatch(/^\d{4}-\d{2}-\d{2}$/)
+    expect(body.pricing?.asOf).toBe('2026-01-01T00:00:00.000Z')
   })
 
   test.skipIf(runtime.mode !== 'localnet')(

package/src/apps/data/routes/valuation.ts

@@ -44,11 +44,11 @@ export namespace schema {
   /** Rate provenance for a converted valuation. */
   export const Pricing = z
     .object({
-      asOf: z
-        .string()
+      asOf: z.iso
+        .datetime()
         .check(
-          z.describe('Publication date of the rate set used for conversion.'),
-          z.meta({ examples: ['2026-07-20'] }),
+          z.describe('Publication date of the rate set as an ISO 8601 timestamp.'),
+          z.meta({ examples: ['2026-07-20T00:00:00.000Z'] }),
         ),
       basis: z
         .literal('nominal')

package/src/apps/index.ts

@@ -1,4 +1,5 @@
 export { data, FundingQuoteProviders, FxOracle } from './data/index.js'
 export { management } from './management/index.js'
 export { mcp } from './mcp.js'
+export { mpp } from './mpp/index.js'
 export { relay } from './relay/index.js'

package/src/apps/management/routes/api-keys.test.ts

@@ -5,9 +5,7 @@ import * as Auth from '../../../internal/Auth.js'
 import * as OpenApi from '../../../internal/OpenApi.js'
 import * as Scope from '../../../Scope.js'
 import * as TestApp from '../../../../test/App.js'
-import * as EarlyAccess from '../../../db/tables/earlyAccess.js'
 import * as Memberships from '../../../db/tables/memberships.js'
-import * as Users from '../../../db/tables/users.js'
 import * as Keys from './api-keys.js'
 import * as Me from './me.js'
 import * as Orgs from './orgs.js'
@@ -45,7 +43,6 @@ function createApp(
     db?: ReturnType<typeof TestApp.database>
     kv?: { store: State }
     scopes?: readonly Scope.Entry[]
-    tmp_earlyAccess?: boolean
   } = {},
 ) {
   return TestApp.create({
@@ -54,7 +51,6 @@ function createApp(
     ...(options.kv ? { kv: options.kv } : {}),
     ...(options.scopes ? { scopes: options.scopes } : {}),
     session: { wallet: { origin } },
-    ...(options.tmp_earlyAccess === undefined ? {} : { tmp_earlyAccess: options.tmp_earlyAccess }),
   })
 }
 
@@ -677,66 +673,9 @@ describe('keys', () => {
 })
 
 describe('early access', () => {
-  test('rejects mints from non-early-access sessions', async () => {
-    const app = createApp({ tmp_earlyAccess: true })
-    const cookie = await session(app)
-    const { org, project } = await fixture(app, cookie)
-
-    const denied = await app.request(
-      `/v1/orgs/${org.id}/projects/${project.id}/api-keys`,
-      json('POST', cookie, { scopes: ['data:read'] }),
-    )
-    expect(denied.status).toBe(403)
-    const { requestId, ...body } = (await denied.json()) as { requestId?: string }
-    expect(requestId).toBeDefined()
-    expect(body).toMatchInlineSnapshot(`
-      {
-        "error": {
-          "code": "early_access_required",
-          "message": "Requires early access. Ask a teammate with access to invite you by email, or contact Tempo.",
-        },
-      }
-    `)
-  })
-
-  test('the gate precedes membership resolution', async () => {
-    // The gate depends only on the caller, so it leaks nothing about the
-    // project; early-access strangers still get the membership 404.
-    const db = TestApp.database()
-    const app = createApp({ db, tmp_earlyAccess: true })
-    await EarlyAccess.add(db, { createdBy: 'test', entry: 'example.org' })
-    const owner = await session(app)
-    const { org, project } = await fixture(app, owner)
-
-    const other = await session(app)
-    const gated = await app.request(
-      `/v1/orgs/${org.id}/projects/${project.id}/api-keys`,
-      json('POST', other, { scopes: ['data:read'] }),
-    )
-    expect(gated.status).toBe(403)
-    expect(((await gated.json()) as { error: { code: string } }).error.code).toBe('early_access_required') // prettier-ignore
-
-    const granted = await session(app)
-    const me = await app.request('/v1/me', { headers: { cookie: granted } })
-    const { id: userId } = (await me.json()) as { id: string }
-    await Users.setEmail(db, userId, 'stranger@example.org')
-    const denied = await app.request(
-      `/v1/orgs/${org.id}/projects/${project.id}/api-keys`,
-      json('POST', granted, { scopes: ['data:read'] }),
-    )
-    expect(denied.status).toBe(404)
-  })
-
-  test('lets early-access sessions mint', async () => {
-    const db = TestApp.database()
-    const app = createApp({ db, tmp_earlyAccess: true })
-    await EarlyAccess.add(db, { createdBy: 'test', entry: 'example.org' })
+  test('does not require an early-access grant', async () => {
+    const app = createApp()
     const cookie = await session(app)
-    const user = await TestApp.json(
-      await app.request('/v1/me', { headers: { cookie } }),
-      Me.schema.User,
-    )
-    await Users.setEmail(db, user.id, 'dev@example.org')
     const { org, project } = await fixture(app, cookie)
 
     const minted = await app.request(
@@ -745,16 +684,4 @@ describe('early access', () => {
     )
     expect(minted.status).toBe(200)
   })
-
-  test('lets the super admin mint', async () => {
-    const app = createApp({ tmp_earlyAccess: true })
-    const cookie = await session(app)
-    const { org, project } = await fixture(app, cookie)
-
-    const minted = await app.request(
-      `/v1/orgs/${org.id}/projects/${project.id}/api-keys`,
-      superAdminJson('POST', { scopes: ['data:read'] }),
-    )
-    expect(minted.status).toBe(200)
-  })
 })

package/src/apps/management/routes/api-keys.ts

@@ -1,6 +1,8 @@
 import { type Context, Hono } from 'hono'
 import * as z from 'zod/mini'
 
+import * as Analytics from '../../../analytics/Analytics.js'
+import * as RequestEvents from '../../../analytics/tables/requestEvents.js'
 import * as ApiKeys from '../../../ApiKeys.js'
 import type * as App from '../../../App.js'
 import * as Db from '../../../db/Db.js'
@@ -43,6 +45,12 @@ export namespace schema {
           z.describe('Opaque key id (`key_…`).'),
           z.meta({ examples: ['key_1a2b3c4d5e6f7g8h9j0k1m2n'] }),
         ),
+      lastUsedAt: z
+        .optional(z.string())
+        .check(
+          z.describe('When the key last authenticated a request (ISO 8601).'),
+          z.meta({ examples: ['2026-07-21T12:34:56.000Z'] }),
+        ),
       name: z
         .optional(z.string())
         .check(z.describe('Human-readable key name.'), z.meta({ examples: ['CI'] })),
@@ -225,7 +233,7 @@ export function apiKeys(options: apiKeys.Options = {}) {
   return new Hono<App.Environment>()
     .post(
       '/v1/orgs/:orgId{org_[A-Za-z0-9_-]+}/projects/:projectId{prj_[A-Za-z0-9_-]+}/api-keys',
-      Auth.policy({ session: true, tmp_earlyAccess: true }),
+      Auth.policy({ session: true }),
       Auth.ensureOrg({ role: 'admin' }),
       Auth.ensureProject(),
       OpenApi.validate('param', schema.Params, {
@@ -243,8 +251,8 @@ export function apiKeys(options: apiKeys.Options = {}) {
         responses: OpenApi.responses({
           errors: {
             403: {
-              codes: ['scope_not_issuable', 'early_access_required'],
-              description: 'The requested scopes are not issuable, or the caller lacks early access.', // prettier-ignore
+              codes: ['scope_not_issuable'],
+              description: 'The requested scopes are not issuable.',
             },
             404: 'No accessible project was found for this id.',
           },
@@ -259,7 +267,6 @@ export function apiKeys(options: apiKeys.Options = {}) {
       async (c) => {
         if (Auth.narrowAccess) return Auth.superAdminAccessError(c)
         if (Auth.narrowScope) return Auth.ensureProjectError(c)
-        if (Auth.tmp_narrowEarlyAccess) return Auth.tmp_ensureEarlyAccessError(c)
         if (OpenApi.narrowValidation)
           return OpenApi.validationError(c, {
             code: 'param_invalid',
@@ -375,7 +382,7 @@ export function apiKeys(options: apiKeys.Options = {}) {
           })
           return c.json(
             Response.validated(schema.listApiKeys.Response, {
-              data: records.map(serializeKey),
+              data: await serializeKeys(c, records),
             }),
             200,
           )
@@ -436,7 +443,7 @@ export function apiKeys(options: apiKeys.Options = {}) {
           })
           return c.json(
             Response.validated(schema.listOrgApiKeys.Response, {
-              data: records.map(serializeKey),
+              data: await serializeKeys(c, records),
             }),
             200,
           )
@@ -506,14 +513,30 @@ export declare namespace apiKeys {
   }
 }
 
+/** Enriches key records with their latest authenticated request timestamp. */
+async function serializeKeys(c: Context<App.Environment>, records: readonly ApiKeys.Record[]) {
+  const source = c.get('analytics')
+  if (!source || records.length === 0) return records.map((record) => serializeKey(record))
+  const lastUsedAt = new Map(
+    (
+      await RequestEvents.readLastUsedAt(
+        Analytics.get(source),
+        records.map(({ id }) => id),
+      )
+    ).map((usage) => [usage.apiKeyId, usage.lastUsedAt]),
+  )
+  return records.map((record) => serializeKey(record, lastUsedAt.get(record.id)))
+}
+
 /** Projects a persisted record onto the management key shape (no rate limits, no token). */
-function serializeKey(record: ApiKeys.Record) {
+function serializeKey(record: ApiKeys.Record, lastUsedAt?: string) {
   return {
     createdAt: record.createdAt,
     ...(record.createdBy === undefined ? {} : { createdBy: record.createdBy }),
     environment: record.environment,
     ...(record.expiresAt === undefined ? {} : { expiresAt: record.expiresAt }),
     id: record.id,
+    ...(lastUsedAt === undefined ? {} : { lastUsedAt }),
     ...(record.name === undefined ? {} : { name: record.name }),
     orgId: record.orgId,
     ...(record.projectId === undefined ? {} : { projectId: record.projectId }),

package/src/apps/management/routes/billing.test.ts

@@ -5,11 +5,10 @@ import { generatePrivateKey, privateKeyToAccount } from 'viem/accounts'
 import * as ApiKeys from '../../../ApiKeys.js'
 import * as TestApp from '../../../../test/App.js'
 import * as TestStripe from '../../../../test/Stripe.js'
-import * as EarlyAccess from '../../../db/tables/earlyAccess.js'
+import * as EnabledBillingSources from '../../../db/tables/enabledBillingSources.js'
 import * as Memberships from '../../../db/tables/memberships.js'
 import * as SponsoredTransactions from '../../../db/tables/sponsoredTransactions.js'
 import * as StripeCustomers from '../../../db/tables/stripeCustomers.js'
-import * as Users from '../../../db/tables/users.js'
 import * as Viem from '../../../internal/Viem.js'
 import * as core_Billing from '../Billing.js'
 import type * as App from '../../../App.js'
@@ -66,7 +65,6 @@ function createApp(
     billing?: App.Billing | undefined
     db?: TestApp.create.Options['db']
     kv?: { store: ReturnType<typeof TestApp.kvStore> }
-    tmp_earlyAccess?: boolean
   } = {},
 ) {
   // prettier-ignore
@@ -76,7 +74,6 @@ function createApp(
     db: options.db ?? TestApp.database(),
     ...(options.kv ? { kv: options.kv } : {}),
     session: { wallet: { origin } },
-    ...(options.tmp_earlyAccess === undefined ? {} : { tmp_earlyAccess: options.tmp_earlyAccess }),
   })
 }
 
@@ -108,6 +105,20 @@ async function seeded(app: ReturnType<typeof createApp>) {
   return { cookie, orgId: id }
 }
 
+/** Seeds an owned organization with Stripe setup enabled. */
+async function seededWithStripe(
+  app: ReturnType<typeof createApp>,
+  db: ReturnType<typeof TestApp.database>,
+) {
+  const result = await seeded(app)
+  await EnabledBillingSources.add(db, {
+    createdBy: 'test',
+    orgId: result.orgId,
+    source: 'stripe',
+  })
+  return result
+}
+
 describe('GET /orgs/:orgId/billing', () => {
   test('behavior: synthesizes none for orgs without a billing source', async () => {
     const app = createApp()
@@ -116,6 +127,7 @@ describe('GET /orgs/:orgId/billing', () => {
     expect(response.status).toBe(200)
     expect(await response.json()).toMatchInlineSnapshot(`
       {
+        "enabledSources": [],
         "spend": {
           "amount": "0",
           "currency": "usd",
@@ -139,6 +151,28 @@ describe('GET /orgs/:orgId/billing', () => {
     expect(body.updatedAt).toBeDefined()
   })
 
+  test('behavior: lists organization-wide sources in canonical order', async () => {
+    const db = TestApp.database()
+    const app = createApp({ billing: billingWithSandbox(), db })
+    const { cookie, orgId } = await seeded(app)
+    await EnabledBillingSources.add(db, { createdBy: 'test', orgId, source: 'tempo' })
+    await EnabledBillingSources.add(db, { createdBy: 'test', orgId, source: 'stripe' })
+
+    const production = await app.request(`/v1/orgs/${orgId}/billing`, { headers: { cookie } })
+    const sandbox = await app.request(`/v1/orgs/${orgId}/billing?environment=sandbox`, {
+      headers: { cookie },
+    })
+
+    expect(await production.json()).toMatchObject({
+      enabledSources: ['stripe', 'tempo'],
+      status: 'none',
+    })
+    expect(await sandbox.json()).toMatchObject({
+      enabledSources: ['stripe', 'tempo'],
+      status: 'none',
+    })
+  })
+
   test('behavior: the super admin reads any org', async () => {
     const db = TestApp.database()
     const app = createApp({ db })
@@ -165,7 +199,7 @@ describe('GET /orgs/:orgId/billing', () => {
     expect(response.status).toBe(401)
   })
 
-  test('behavior: 501 when billing is unconfigured', async () => {
+  test('behavior: reads database-backed state when Stripe is unconfigured', async () => {
     const app = TestApp.create({
       auth: { superAdmin: { secret } },
       db: TestApp.database(),
@@ -173,9 +207,18 @@ describe('GET /orgs/:orgId/billing', () => {
     })
     const { cookie, orgId } = await seeded(app)
     const response = await app.request(`/v1/orgs/${orgId}/billing`, { headers: { cookie } })
-    expect(response.status).toBe(501)
-    const body = (await response.json()) as { error: { code: string } }
-    expect(body.error.code).toMatchInlineSnapshot(`"billing_unconfigured"`)
+    expect(response.status).toBe(200)
+    expect(await response.json()).toMatchInlineSnapshot(`
+      {
+        "enabledSources": [],
+        "spend": {
+          "amount": "0",
+          "currency": "usd",
+          "period": "month",
+        },
+        "status": "none",
+      }
+    `)
   })
 })
 
@@ -202,6 +245,7 @@ describe('PATCH /orgs/:orgId/billing', () => {
     expect(response.status).toBe(200)
     expect(await response.json()).toMatchInlineSnapshot(`
       {
+        "enabledSources": [],
         "spend": {
           "amount": "0",
           "currency": "usd",
@@ -294,7 +338,7 @@ describe('PATCH /orgs/:orgId/billing', () => {
     expect(response.status).toBe(404)
   })
 
-  test('behavior: 501 when billing is unconfigured', async () => {
+  test('behavior: updates database-backed state when Stripe is unconfigured', async () => {
     const app = TestApp.create({
       auth: { superAdmin: { secret } },
       db: TestApp.database(),
@@ -303,9 +347,12 @@ describe('PATCH /orgs/:orgId/billing', () => {
     const { cookie, orgId } = await seeded(app)
     const response = await app.request(
       `/v1/orgs/${orgId}/billing`,
-      patch(cookie, { spendLimit: null }),
+      patch(cookie, { spendLimit: { amount: '250' } }),
     )
-    expect(response.status).toBe(501)
+    expect(response.status).toBe(200)
+    expect(
+      ((await response.json()) as { spendLimit?: { amount: string } }).spendLimit?.amount,
+    ).toBe('250')
   })
 })
 
@@ -355,8 +402,9 @@ describe('POST /orgs/:orgId/billing/stripe/checkout', () => {
   })
 
   test('behavior: an unreachable Stripe maps to the upstream error envelope', async () => {
-    const app = createApp()
-    const { cookie, orgId } = await seeded(app)
+    const db = TestApp.database()
+    const app = createApp({ db })
+    const { cookie, orgId } = await seededWithStripe(app, db)
     // First Stripe call the route makes is the customer create; the connection
     // is refused for real (no transport fake).
     const response = await app.request(`/v1/orgs/${orgId}/billing/stripe/checkout`, post(cookie))
@@ -366,9 +414,13 @@ describe('POST /orgs/:orgId/billing/stripe/checkout', () => {
   })
 })
 
-describe('early access', () => {
-  test('behavior: checkout requires early access', async () => {
-    const app = createApp({ tmp_earlyAccess: true })
+describe('billing source access', () => {
+  test('behavior: checkout requires Stripe to be enabled', async () => {
+    const app = TestApp.create({
+      auth: { superAdmin: { secret } },
+      db: TestApp.database(),
+      session: { wallet: { origin } },
+    })
     const { cookie, orgId } = await seeded(app)
     const response = await app.request(`/v1/orgs/${orgId}/billing/stripe/checkout`, post(cookie))
     expect(response.status).toBe(403)
@@ -377,75 +429,29 @@ describe('early access', () => {
     expect(body).toMatchInlineSnapshot(`
       {
         "error": {
-          "code": "early_access_required",
-          "message": "Requires early access. Ask a teammate with access to invite you by email, or contact Tempo.",
+          "code": "billing_source_disabled",
+          "message": "Stripe billing is not enabled for this organization",
         },
       }
     `)
   })
 
-  test('behavior: the gate precedes membership resolution', async () => {
-    // The gate depends only on the caller, so it leaks nothing about the org;
-    // early-access strangers still get the membership 404.
+  test('behavior: the source gate replaces temporary billing early access', async () => {
     const db = TestApp.database()
-    const app = createApp({ db, tmp_earlyAccess: true })
-    await EarlyAccess.add(db, { createdBy: 'test', entry: 'example.org' })
-    const { orgId } = await seeded(app)
-
-    const other = await session(app)
-    const gated = await app.request(`/v1/orgs/${orgId}/billing/stripe/checkout`, post(other))
-    expect(gated.status).toBe(403)
-    expect(((await gated.json()) as { error: { code: string } }).error.code).toBe('early_access_required') // prettier-ignore
-
-    const granted = await session(app)
-    const me = await app.request('/v1/me', { headers: { cookie: granted } })
-    const { id: userId } = (await me.json()) as { id: string }
-    await Users.setEmail(db, userId, 'stranger@example.org')
-    expect(
-      (await app.request(`/v1/orgs/${orgId}/billing/stripe/checkout`, post(granted))).status,
-    ).toBe(404)
-  })
-
-  test('behavior: the gate precedes the owner-role check', async () => {
-    const db = TestApp.database()
-    const app = createApp({ db, tmp_earlyAccess: true })
-    await EarlyAccess.add(db, { createdBy: 'test', entry: 'example.org' })
-    const { orgId } = await seeded(app)
-    const member = await session(app)
-    const me = await app.request('/v1/me', { headers: { cookie: member } })
-    const { id: userId } = (await me.json()) as { id: string }
-    await Memberships.create(db, { orgId, role: 'member', userId })
-
-    const gated = await app.request(`/v1/orgs/${orgId}/billing/stripe/checkout`, post(member))
-    expect(gated.status).toBe(403)
-    expect(((await gated.json()) as { error: { code: string } }).error.code).toBe('early_access_required') // prettier-ignore
-
-    // Early-access members still fail the owner-role check.
-    await Users.setEmail(db, userId, 'member@example.org')
-    const write = await app.request(`/v1/orgs/${orgId}/billing/stripe/checkout`, post(member))
-    expect(write.status).toBe(403)
-    expect(((await write.json()) as { error: { code: string } }).error.code).toBe('forbidden')
-  })
-
-  test('behavior: early-access owners pass the gate', async () => {
-    const db = TestApp.database()
-    const app = createApp({ db, tmp_earlyAccess: true })
-    await EarlyAccess.add(db, { createdBy: 'test', entry: 'example.org' })
-    const { cookie, orgId } = await seeded(app)
-    const me = await app.request('/v1/me', { headers: { cookie } })
-    const { id: userId } = (await me.json()) as { id: string }
-    await Users.setEmail(db, userId, 'dev@example.org')
+    const app = createApp({ db })
+    const { cookie, orgId } = await seededWithStripe(app, db)
 
-    // The unreachable Stripe upstream (502) proves the request passed the gate.
+    // The unreachable Stripe upstream proves source access, not user early access, is the gate.
     const response = await app.request(`/v1/orgs/${orgId}/billing/stripe/checkout`, post(cookie))
     expect(response.status).toBe(502)
     expect(((await response.json()) as { error: { code: string } }).error.code).toBe('upstream_error') // prettier-ignore
   })
 
-  test('behavior: management keys pass the gate', async () => {
+  test('behavior: an enabled management key reaches Stripe', async () => {
+    const db = TestApp.database()
     const store = TestApp.kvStore({ keys: [] })
-    const app = createApp({ tmp_earlyAccess: true, kv: { store } })
-    const { orgId } = await seeded(app)
+    const app = createApp({ db, kv: { store } })
+    const { orgId } = await seededWithStripe(app, db)
     const { token } = await ApiKeys.mint(store, { orgId, scopes: ['management:write'] })
 
     const response = await app.request(`/v1/orgs/${orgId}/billing/stripe/checkout`, {
@@ -455,9 +461,10 @@ describe('early access', () => {
     expect(response.status).toBe(502)
   })
 
-  test('behavior: the super admin passes the gate', async () => {
-    const app = createApp({ tmp_earlyAccess: true })
-    const { orgId } = await seeded(app)
+  test('behavior: an enabled super admin reaches Stripe', async () => {
+    const db = TestApp.database()
+    const app = createApp({ db })
+    const { orgId } = await seededWithStripe(app, db)
 
     const response = await app.request(`/v1/orgs/${orgId}/billing/stripe/checkout`, {
       ...as(secret),
@@ -551,6 +558,7 @@ describe('DELETE /orgs/:orgId', () => {
     const db = TestApp.database()
     const app = createApp({ db })
     const { cookie, orgId } = await seeded(app)
+    await EnabledBillingSources.add(db, { createdBy: 'test', orgId, source: 'stripe' })
     await StripeCustomers.create(db, { orgId, stripeCustomerId: 'cus_cascade' })
 
     const response = await app.request(`/v1/orgs/${orgId}`, {
@@ -558,19 +566,30 @@ describe('DELETE /orgs/:orgId', () => {
       method: 'DELETE',
     })
     expect(response.status).toBe(200)
+    expect(await EnabledBillingSources.listByOrg(db, orgId)).toEqual([])
     expect(await StripeCustomers.get(db, orgId)).toBeUndefined()
   })
 })
 
 describe('environment scoping', () => {
-  test('behavior: sandbox is 501 when no sandbox source is configured', async () => {
+  test('behavior: sandbox billing state remains readable without a Stripe source', async () => {
     const app = createApp()
     const { cookie, orgId } = await seeded(app)
     const response = await app.request(`/v1/orgs/${orgId}/billing?environment=sandbox`, {
       headers: { cookie },
     })
-    expect(response.status).toBe(501)
-    expect(((await response.json()) as { error: { code: string } }).error.code).toBe('billing_unconfigured') // prettier-ignore
+    expect(response.status).toBe(200)
+    expect(await response.json()).toMatchInlineSnapshot(`
+      {
+        "enabledSources": [],
+        "spend": {
+          "amount": "0",
+          "currency": "usd",
+          "period": "month",
+        },
+        "status": "none",
+      }
+    `)
   })
 
   test('behavior: rejects an unknown environment', async () => {
@@ -756,7 +775,7 @@ describe.runIf(TestStripe.secretKey)('stripe sandbox (direct)', () => {
   test('checkout provisions distinct customers per environment', { timeout: 30_000 }, async () => {
     const db = TestApp.database()
     const app = createApp({ billing: sandboxBillingBoth(), db })
-    const { cookie, orgId } = await seeded(app)
+    const { cookie, orgId } = await seededWithStripe(app, db)
 
     const prod = await app.request(`/v1/orgs/${orgId}/billing/stripe/checkout`, post(cookie))
     const sbx = await app.request(`/v1/orgs/${orgId}/billing/stripe/checkout?environment=sandbox`, post(cookie)) // prettier-ignore
@@ -783,7 +802,7 @@ describe.runIf(TestStripe.secretKey)('stripe sandbox (direct)', () => {
   test('checkout provisions a real customer and setup session', { timeout: 30_000 }, async () => {
     const db = TestApp.database()
     const app = createApp({ billing: sandboxBilling(), db })
-    const { cookie, orgId } = await seeded(app)
+    const { cookie, orgId } = await seededWithStripe(app, db)
 
     const response = await app.request(`/v1/orgs/${orgId}/billing/stripe/checkout`, post(cookie))
     // Track for teardown before asserting: a failed assertion must not leak
@@ -831,7 +850,7 @@ describe.runIf(TestStripe.secretKey)('stripe sandbox (direct)', () => {
       // prettier-ignore
       const db = TestApp.database()
       const app = createApp({ billing: sandboxBilling(), db })
-      const { cookie, orgId } = await seeded(app)
+      const { cookie, orgId } = await seededWithStripe(app, db)
       const checkout = await app.request(`/v1/orgs/${orgId}/billing/stripe/checkout`, post(cookie))
       const customerId = (await StripeCustomers.get(db, orgId))?.stripeCustomerId
       if (customerId) TestStripe.track(customerId)
@@ -844,8 +863,9 @@ describe.runIf(TestStripe.secretKey)('stripe sandbox (direct)', () => {
         invoice_settings: { default_payment_method: attached.paymentMethod },
       })
       await StripeCustomers.setStatus(db, orgId, 'active')
+      await EnabledBillingSources.remove(db, { orgId, source: 'stripe' })
 
-      // The list reads live Stripe state: card details plus the default marker.
+      // Disabling setup does not block management of the existing Stripe source.
       const list = await app.request(`/v1/orgs/${orgId}/billing/payment-methods`, {
         headers: { cookie },
       })
@@ -900,7 +920,7 @@ describe.runIf(TestStripe.secretKey)('stripe sandbox (direct)', () => {
       // prettier-ignore
       const db = TestApp.database()
       const app = createApp({ billing: sandboxBilling(), db })
-      const { cookie, orgId } = await seeded(app)
+      const { cookie, orgId } = await seededWithStripe(app, db)
       const checkout = await app.request(`/v1/orgs/${orgId}/billing/stripe/checkout`, post(cookie))
       const customerId = (await StripeCustomers.get(db, orgId))?.stripeCustomerId
       if (customerId) TestStripe.track(customerId)
@@ -930,11 +950,12 @@ describe.runIf(TestStripe.secretKey)('stripe sandbox (direct)', () => {
 
     const db = TestApp.database()
     const app = createApp({ billing: sandboxBilling(), db })
-    const { cookie, orgId } = await seeded(app)
+    const { cookie, orgId } = await seededWithStripe(app, db)
     const checkout = await app.request(`/v1/orgs/${orgId}/billing/stripe/checkout`, post(cookie))
     const customerId = (await StripeCustomers.get(db, orgId))?.stripeCustomerId
     if (customerId) TestStripe.track(customerId)
     expect(checkout.status).toBe(200)
+    await EnabledBillingSources.remove(db, { orgId, source: 'stripe' })
 
     const response = await app.request(`/v1/orgs/${orgId}/billing/stripe/manage`, post(cookie))
     expect(response.status).toBe(200)
@@ -963,7 +984,7 @@ describe.runIf(TestStripe.secretKey)('stripe sandbox (live delivery)', () => {
   })
 
   test('attach → active, detach → none, delete → canceled', { timeout: 300_000 }, async () => {
-    const { cookie, orgId } = await seeded(app)
+    const { cookie, orgId } = await seededWithStripe(app, db)
     const checkout = await app.request(`/v1/orgs/${orgId}/billing/stripe/checkout`, post(cookie))
     const customerId = (await StripeCustomers.get(db, orgId))?.stripeCustomerId
     if (customerId) TestStripe.track(customerId)