tapimo 0.6.0 → 0.7.1

package/src/apps/data/routes/valuation.test.ts

@@ -51,7 +51,11 @@ const seed: readonly SeedToken[] = JSON.parse(
 // Deterministic EUR-based rate set so conversion math is exact in assertions.
 const fixed = FxOracle.from({
   name: 'fixed',
-  rates: async () => ({ asOf: '2026-01-01', base: 'EUR', rates: { AUD: '1.6', USD: '1.0' } }),
+  rates: async () => ({
+    asOf: '2026-01-01T00:00:00.000Z',
+    base: 'EUR',
+    rates: { AUD: '1.6', USD: '1.0' },
+  }),
 })
 
 async function holderWithBalance(client: ReturnType<typeof app>) {
@@ -93,6 +97,17 @@ async function chainSum(holder: `0x${string}`, currency: string) {
 }
 
 describe('GET /addresses/:address/valuation', () => {
+  test('requires a full pricing timestamp', () => {
+    const pricing = { asOf: '2026-01-01', basis: 'nominal', source: 'fixed' }
+    expect(Valuation.schema.Pricing.safeParse(pricing).success).toBe(false)
+    expect(
+      Valuation.schema.Pricing.safeParse({
+        ...pricing,
+        asOf: '2026-01-01T00:00:00.000Z',
+      }).success,
+    ).toBe(true)
+  })
+
   test('normalizes the denomination', () => {
     expect(
       Valuation.schema.getAddressValuation.Query.parse({ denomination: 'aud' }).denomination,
@@ -176,7 +191,7 @@ describe('GET /addresses/:address/valuation', () => {
       expect(aud.amount).toBe(core_Value.format((sum * 16n) / 10n, 6))
       expect(aud.pricing).toMatchInlineSnapshot(`
         {
-          "asOf": "2026-01-01",
+          "asOf": "2026-01-01T00:00:00.000Z",
           "basis": "nominal",
           "source": "fixed",
         }
@@ -201,7 +216,7 @@ describe('GET /addresses/:address/valuation', () => {
     expect(Number(body.amount)).toBeGreaterThan(0)
     expect(body.pricing?.basis).toBe('nominal')
     expect(body.pricing?.source).toBe('ecb')
-    expect(body.pricing?.asOf).toMatch(/^\d{4}-\d{2}-\d{2}$/)
+    expect(body.pricing?.asOf).toBe('2026-01-01T00:00:00.000Z')
   })
 
   test.skipIf(runtime.mode !== 'localnet')(

package/src/apps/data/routes/valuation.ts

@@ -44,11 +44,11 @@ export namespace schema {
   /** Rate provenance for a converted valuation. */
   export const Pricing = z
     .object({
-      asOf: z
-        .string()
+      asOf: z.iso
+        .datetime()
         .check(
-          z.describe('Publication date of the rate set used for conversion.'),
-          z.meta({ examples: ['2026-07-20'] }),
+          z.describe('Publication date of the rate set as an ISO 8601 timestamp.'),
+          z.meta({ examples: ['2026-07-20T00:00:00.000Z'] }),
         ),
       basis: z
         .literal('nominal')

package/src/apps/data/routes/verified-tokens.test.ts

@@ -87,6 +87,21 @@ describe('GET /verified-tokens', () => {
     )
     expect(second.status).toBe(304)
   })
+
+  test('refreshes cached reads after a snapshot publish', async () => {
+    const db = TestApp.database()
+    await VerifiedTokens.replace(db, chainId, seedList)
+    const client = TestApp.client({ auth: { keys: [reader] }, db })
+
+    await client.v1['verified-tokens'].$get({ query: {} }, as(reader))
+    await VerifiedTokens.replace(db, chainId, seedList.slice(1))
+
+    const response = await client.v1['verified-tokens'].$get({ query: {} }, as(reader))
+    const body = await TestApp.json(response, Verified.schema.listVerifiedTokens.Response)
+    expect(body.data.map((token) => token.address)).toEqual(
+      seedList.slice(1).map((token) => token.address),
+    )
+  })
 })
 
 describe('GET /verified-tokens/currencies', () => {
@@ -97,6 +112,23 @@ describe('GET /verified-tokens/currencies', () => {
     const body = await TestApp.json(response, Verified.schema.getVerifiedTokenCurrencies.Response)
     expect([...body.data]).toEqual(['EUR', 'USD'])
   })
+
+  test('refreshes cached reads after a snapshot publish', async () => {
+    const db = TestApp.database()
+    await VerifiedTokens.replace(db, chainId, seedList)
+    const client = TestApp.client({ auth: { keys: [reader] }, db })
+
+    await client.v1['verified-tokens'].currencies.$get({ query: {} }, as(reader))
+    await VerifiedTokens.replace(
+      db,
+      chainId,
+      seedList.filter((token) => token.currency === 'USD'),
+    )
+
+    const response = await client.v1['verified-tokens'].currencies.$get({ query: {} }, as(reader))
+    const body = await TestApp.json(response, Verified.schema.getVerifiedTokenCurrencies.Response)
+    expect([...body.data]).toEqual(['USD'])
+  })
 })
 
 describe('GET /verified-tokens/:address', () => {
@@ -123,4 +155,23 @@ describe('GET /verified-tokens/:address', () => {
     const body = (await response.json()) as { error?: { code?: string } }
     expect(body.error?.code).toBe('verified_token_not_found')
   })
+
+  test('refreshes cached reads after a snapshot publish', async () => {
+    const db = TestApp.database()
+    await VerifiedTokens.replace(db, chainId, seedList)
+    const client = TestApp.client({ auth: { keys: [reader] }, db })
+    const address = seedList[0].address
+
+    await client.v1['verified-tokens'][':address'].$get(
+      { param: { address }, query: {} },
+      as(reader),
+    )
+    await VerifiedTokens.replace(db, chainId, seedList.slice(1))
+
+    const response = await client.v1['verified-tokens'][':address'].$get(
+      { param: { address }, query: {} },
+      as(reader),
+    )
+    expect(response.status).toBe(404)
+  })
 })

package/src/apps/data/routes/verified-tokens.ts

@@ -4,6 +4,7 @@ import * as z from 'zod/mini'
 import type * as App from '../../../App.js'
 import * as Auth from '../../../internal/Auth.js'
 import * as Cache from '../../../internal/Cache.js'
+import * as EdgeCache from '../../../internal/EdgeCache.js'
 import * as OpenApi from '../../../internal/OpenApi.js'
 import * as Response from '../../../internal/Response.js'
 import * as Schema from '../../../internal/Schema.js'
@@ -168,11 +169,23 @@ export function verifiedTokens() {
         summary: 'List verified tokens',
         tags: ['Verified Tokens'],
       }),
-      Cache.response<App.Environment>({
-        cacheControl: Cache.policies.stable,
-        name: 'tempo-api:verified-tokens:v1',
-        key: (c) => Cache.urlKey(c, schema.listVerifiedTokens.Query),
-      }),
+      // The shared edge cache is URL-keyed and cannot include the snapshot version.
+      EdgeCache.setEligibility(
+        Cache.response<App.Environment>({
+          cacheControl: Cache.policies.stable,
+          name: 'tempo-api:verified-tokens:v1',
+          key: async (c) => {
+            const base = Cache.urlKey(c, schema.listVerifiedTokens.Query)
+            const query = schema.listVerifiedTokens.Query.parse(
+              Object.fromEntries(new URL(c.req.url).searchParams),
+            )
+            const chainId = query.chainId ?? c.get('chainId')
+            const { version } = await VerifiedTokens.snapshot(c, chainId)
+            return `${base}:v:${version}`
+          },
+        }),
+        () => false,
+      ),
       async (c) => {
         if (Auth.narrowAccess) return Auth.paidAccessError(c)
         if (OpenApi.narrowValidation)
@@ -213,11 +226,23 @@ export function verifiedTokens() {
         summary: 'List verified currencies',
         tags: ['Verified Tokens'],
       }),
-      Cache.response<App.Environment>({
-        cacheControl: Cache.policies.stable,
-        name: 'tempo-api:verified-tokens:v1',
-        key: (c) => Cache.urlKey(c, schema.getVerifiedTokenCurrencies.Query),
-      }),
+      // The shared edge cache is URL-keyed and cannot include the snapshot version.
+      EdgeCache.setEligibility(
+        Cache.response<App.Environment>({
+          cacheControl: Cache.policies.stable,
+          name: 'tempo-api:verified-tokens:v1',
+          key: async (c) => {
+            const base = Cache.urlKey(c, schema.getVerifiedTokenCurrencies.Query)
+            const query = schema.getVerifiedTokenCurrencies.Query.parse(
+              Object.fromEntries(new URL(c.req.url).searchParams),
+            )
+            const chainId = query.chainId ?? c.get('chainId')
+            const { version } = await VerifiedTokens.snapshot(c, chainId)
+            return `${base}:v:${version}`
+          },
+        }),
+        () => false,
+      ),
       async (c) => {
         if (Auth.narrowAccess) return Auth.paidAccessError(c)
         if (OpenApi.narrowValidation)
@@ -265,11 +290,23 @@ export function verifiedTokens() {
         summary: 'Get verified token',
         tags: ['Verified Tokens'],
       }),
-      Cache.response<App.Environment>({
-        cacheControl: Cache.policies.stable,
-        name: 'tempo-api:verified-tokens:v1',
-        key: (c) => Cache.urlKey(c, schema.getVerifiedToken.Query),
-      }),
+      // The shared edge cache is URL-keyed and cannot include the snapshot version.
+      EdgeCache.setEligibility(
+        Cache.response<App.Environment>({
+          cacheControl: Cache.policies.stable,
+          name: 'tempo-api:verified-tokens:v1',
+          key: async (c) => {
+            const base = Cache.urlKey(c, schema.getVerifiedToken.Query)
+            const query = schema.getVerifiedToken.Query.parse(
+              Object.fromEntries(new URL(c.req.url).searchParams),
+            )
+            const chainId = query.chainId ?? c.get('chainId')
+            const { version } = await VerifiedTokens.snapshot(c, chainId)
+            return `${base}:v:${version}`
+          },
+        }),
+        () => false,
+      ),
       async (c) => {
         if (Auth.narrowAccess) return Auth.paidAccessError(c)
         if (OpenApi.narrowValidation)

package/src/apps/data/routes/webhooks.test.ts

@@ -1736,6 +1736,33 @@ describe.skipIf(Runtime.get().mode === 'localnet')('poll', () => {
     `)
   })
 
+  test('block:created preserves the cursor when a block header cannot be read', async () => {
+    const db = TestApp.database()
+    const missingBlock = 4_000_000_000
+    const cursor = encodeCursor([missingBlock - 1, endOfBlockIndex])
+    const subscription = await Core.createSubscription(db, {
+      chainId: 42431,
+      destination: { type: 'url', url: 'https://hooks.example.com/x' },
+      eventType: 'block:created',
+      filters: { number: { eq: `0x${missingBlock.toString(16)}` } },
+      owner: { orgId: 'org_test', type: 'api_key' },
+    })
+    await Core.setCursor(db, subscription.id, cursor)
+
+    await expect(
+      Webhooks.poll({
+        chainId: 42431,
+        eventTypes: ['block:created'],
+        headBlockNumber: missingBlock + 2,
+        client,
+        db,
+        tidx: realTidx,
+      }),
+    ).rejects.toThrow()
+
+    expect(await Core.getCursor(db, subscription.id)).toBe(cursor)
+  })
+
   test('transaction:included filters on txs columns and inner calls', async () => {
     const db = TestApp.database()
     const subscription = await Core.createSubscription(db, {
@@ -1778,6 +1805,35 @@ describe.skipIf(Runtime.get().mode === 'localnet')('poll', () => {
     } else expect(tx?.feeToken).toBeUndefined()
   })
 
+  test('transaction:included preserves the cursor when a confirmed block is unavailable', async () => {
+    const db = TestApp.database()
+    const missingBlock = 4_000_000_000
+    const cursor = encodeCursor([missingBlock - 1, endOfBlockIndex])
+    const subscription = await Core.createSubscription(db, {
+      chainId: 42431,
+      destination: { type: 'url', url: 'https://hooks.example.com/x' },
+      eventType: 'transaction:included',
+      filters: { blockNumber: { eq: `0x${missingBlock.toString(16)}` } },
+      owner: { orgId: 'org_test', type: 'api_key' },
+    })
+    await Core.setCursor(db, subscription.id, cursor)
+
+    await expect(
+      Webhooks.poll({
+        chainId: 42431,
+        eventTypes: ['transaction:included'],
+        headBlockNumber: missingBlock + 2,
+        client,
+        db,
+        tidx: realTidx,
+      }),
+    ).rejects.toThrowErrorMatchingInlineSnapshot(`
+      [Webhooks.BlockUnavailableError: Block 4000000000 is unavailable.]
+    `)
+
+    expect(await Core.getCursor(db, subscription.id)).toBe(cursor)
+  })
+
   test('transaction:included matches exact empty calldata through the poller', async () => {
     const db = TestApp.database()
     const subscription = await Core.createSubscription(db, {

package/src/apps/data/routes/webhooks.ts

@@ -2485,7 +2485,7 @@ type RpcBlock = Awaited<ReturnType<Viem.getClient.ReturnType['getBlock']>>
 /** Per-tick lazy cache of fetched block headers, full blocks, and receipts. */
 type ChainCache = {
   /** Full raw block (with transactions) via `eth_getBlockByNumber(n, true)`. */
-  block(n: number): Promise<Record<string, unknown> | undefined>
+  block(n: number): Promise<Record<string, unknown>>
   /** Viem-formatted block header (transaction hashes only) via `getBlock`. */
   header(n: number): Promise<RpcBlock | undefined>
   /** Receipts for a block keyed by lowercased transaction hash. */
@@ -2495,7 +2495,7 @@ type ChainCache = {
 /** Builds a per-tick {@link ChainCache} bound to a viem client. */
 function createChainCache(client: Viem.getClient.ReturnType): ChainCache {
   const headers = new Map<number, Promise<RpcBlock | undefined>>()
-  const blocks = new Map<number, Promise<Record<string, unknown> | undefined>>()
+  const blocks = new Map<number, Promise<Record<string, unknown>>>()
   const receipts = new Map<number, Promise<Map<string, Record<string, unknown>>>>()
   return {
     block(n) {
@@ -2506,7 +2506,10 @@ function createChainCache(client: Viem.getClient.ReturnType): ChainCache {
         p = rpc<Record<string, unknown> | null>(client, 'eth_getBlockByNumber', [
           blockTag(n),
           true,
-        ]).then((b) => b ?? undefined)
+        ]).then((block) => {
+          if (!block) throw new BlockUnavailableError(n)
+          return block
+        })
         blocks.set(n, p)
       }
       return p
@@ -2514,9 +2517,7 @@ function createChainCache(client: Viem.getClient.ReturnType): ChainCache {
     header(n) {
       let p = headers.get(n)
       if (!p) {
-        p = client
-          .getBlock({ blockNumber: BigInt(n), includeTransactions: false })
-          .catch(() => undefined)
+        p = client.getBlock({ blockNumber: BigInt(n), includeTransactions: false })
         headers.set(n, p)
       }
       return p
@@ -2999,10 +3000,10 @@ async function scanTxs(options: {
   const items: ScanItem[] = []
   for (let n = window.from; n <= window.to; n++) {
     const block = await cache.block(n)
-    const txs = Array.isArray(block?.['transactions']) ? (block!['transactions'] as unknown[]) : []
+    const txs = Array.isArray(block['transactions']) ? (block['transactions'] as unknown[]) : []
     if (txs.length === 0) continue
     const receipts = needsReceipt || includeReceipt ? await cache.receipts(n) : undefined
-    const timestamp = asString(block?.['timestamp'])
+    const timestamp = asString(block['timestamp'])
 
     for (let i = 0; i < txs.length; i++) {
       const tx = txs[i] as Record<string, unknown>
@@ -3195,3 +3196,11 @@ function unauthorized(c: Context<App.Environment>) {
     status: 401,
   })
 }
+
+class BlockUnavailableError extends Error {
+  override name = 'Webhooks.BlockUnavailableError'
+
+  constructor(blockNumber: number) {
+    super(`Block ${blockNumber} is unavailable.`)
+  }
+}

package/src/apps/index.ts

@@ -1,4 +1,5 @@
 export { data, FundingQuoteProviders, FxOracle } from './data/index.js'
 export { management } from './management/index.js'
 export { mcp } from './mcp.js'
+export { mpp } from './mpp/index.js'
 export { relay } from './relay/index.js'

package/src/apps/management/routes/api-keys.test.ts

@@ -5,9 +5,7 @@ import * as Auth from '../../../internal/Auth.js'
 import * as OpenApi from '../../../internal/OpenApi.js'
 import * as Scope from '../../../Scope.js'
 import * as TestApp from '../../../../test/App.js'
-import * as EarlyAccess from '../../../db/tables/earlyAccess.js'
 import * as Memberships from '../../../db/tables/memberships.js'
-import * as Users from '../../../db/tables/users.js'
 import * as Keys from './api-keys.js'
 import * as Me from './me.js'
 import * as Orgs from './orgs.js'
@@ -45,7 +43,6 @@ function createApp(
     db?: ReturnType<typeof TestApp.database>
     kv?: { store: State }
     scopes?: readonly Scope.Entry[]
-    tmp_earlyAccess?: boolean
   } = {},
 ) {
   return TestApp.create({
@@ -54,7 +51,6 @@ function createApp(
     ...(options.kv ? { kv: options.kv } : {}),
     ...(options.scopes ? { scopes: options.scopes } : {}),
     session: { wallet: { origin } },
-    ...(options.tmp_earlyAccess === undefined ? {} : { tmp_earlyAccess: options.tmp_earlyAccess }),
   })
 }
 
@@ -677,66 +673,9 @@ describe('keys', () => {
 })
 
 describe('early access', () => {
-  test('rejects mints from non-early-access sessions', async () => {
-    const app = createApp({ tmp_earlyAccess: true })
-    const cookie = await session(app)
-    const { org, project } = await fixture(app, cookie)
-
-    const denied = await app.request(
-      `/v1/orgs/${org.id}/projects/${project.id}/api-keys`,
-      json('POST', cookie, { scopes: ['data:read'] }),
-    )
-    expect(denied.status).toBe(403)
-    const { requestId, ...body } = (await denied.json()) as { requestId?: string }
-    expect(requestId).toBeDefined()
-    expect(body).toMatchInlineSnapshot(`
-      {
-        "error": {
-          "code": "early_access_required",
-          "message": "Requires early access. Ask a teammate with access to invite you by email, or contact Tempo.",
-        },
-      }
-    `)
-  })
-
-  test('the gate precedes membership resolution', async () => {
-    // The gate depends only on the caller, so it leaks nothing about the
-    // project; early-access strangers still get the membership 404.
-    const db = TestApp.database()
-    const app = createApp({ db, tmp_earlyAccess: true })
-    await EarlyAccess.add(db, { createdBy: 'test', entry: 'example.org' })
-    const owner = await session(app)
-    const { org, project } = await fixture(app, owner)
-
-    const other = await session(app)
-    const gated = await app.request(
-      `/v1/orgs/${org.id}/projects/${project.id}/api-keys`,
-      json('POST', other, { scopes: ['data:read'] }),
-    )
-    expect(gated.status).toBe(403)
-    expect(((await gated.json()) as { error: { code: string } }).error.code).toBe('early_access_required') // prettier-ignore
-
-    const granted = await session(app)
-    const me = await app.request('/v1/me', { headers: { cookie: granted } })
-    const { id: userId } = (await me.json()) as { id: string }
-    await Users.setEmail(db, userId, 'stranger@example.org')
-    const denied = await app.request(
-      `/v1/orgs/${org.id}/projects/${project.id}/api-keys`,
-      json('POST', granted, { scopes: ['data:read'] }),
-    )
-    expect(denied.status).toBe(404)
-  })
-
-  test('lets early-access sessions mint', async () => {
-    const db = TestApp.database()
-    const app = createApp({ db, tmp_earlyAccess: true })
-    await EarlyAccess.add(db, { createdBy: 'test', entry: 'example.org' })
+  test('does not require an early-access grant', async () => {
+    const app = createApp()
     const cookie = await session(app)
-    const user = await TestApp.json(
-      await app.request('/v1/me', { headers: { cookie } }),
-      Me.schema.User,
-    )
-    await Users.setEmail(db, user.id, 'dev@example.org')
     const { org, project } = await fixture(app, cookie)
 
     const minted = await app.request(
@@ -745,16 +684,4 @@ describe('early access', () => {
     )
     expect(minted.status).toBe(200)
   })
-
-  test('lets the super admin mint', async () => {
-    const app = createApp({ tmp_earlyAccess: true })
-    const cookie = await session(app)
-    const { org, project } = await fixture(app, cookie)
-
-    const minted = await app.request(
-      `/v1/orgs/${org.id}/projects/${project.id}/api-keys`,
-      superAdminJson('POST', { scopes: ['data:read'] }),
-    )
-    expect(minted.status).toBe(200)
-  })
 })

package/src/apps/management/routes/api-keys.ts

@@ -1,6 +1,8 @@
 import { type Context, Hono } from 'hono'
 import * as z from 'zod/mini'
 
+import * as Analytics from '../../../analytics/Analytics.js'
+import * as RequestEvents from '../../../analytics/tables/requestEvents.js'
 import * as ApiKeys from '../../../ApiKeys.js'
 import type * as App from '../../../App.js'
 import * as Db from '../../../db/Db.js'
@@ -43,6 +45,12 @@ export namespace schema {
           z.describe('Opaque key id (`key_…`).'),
           z.meta({ examples: ['key_1a2b3c4d5e6f7g8h9j0k1m2n'] }),
         ),
+      lastUsedAt: z
+        .optional(z.string())
+        .check(
+          z.describe('When the key last authenticated a request (ISO 8601).'),
+          z.meta({ examples: ['2026-07-21T12:34:56.000Z'] }),
+        ),
       name: z
         .optional(z.string())
         .check(z.describe('Human-readable key name.'), z.meta({ examples: ['CI'] })),
@@ -225,7 +233,7 @@ export function apiKeys(options: apiKeys.Options = {}) {
   return new Hono<App.Environment>()
     .post(
       '/v1/orgs/:orgId{org_[A-Za-z0-9_-]+}/projects/:projectId{prj_[A-Za-z0-9_-]+}/api-keys',
-      Auth.policy({ session: true, tmp_earlyAccess: true }),
+      Auth.policy({ session: true }),
       Auth.ensureOrg({ role: 'admin' }),
       Auth.ensureProject(),
       OpenApi.validate('param', schema.Params, {
@@ -243,8 +251,8 @@ export function apiKeys(options: apiKeys.Options = {}) {
         responses: OpenApi.responses({
           errors: {
             403: {
-              codes: ['scope_not_issuable', 'early_access_required'],
-              description: 'The requested scopes are not issuable, or the caller lacks early access.', // prettier-ignore
+              codes: ['scope_not_issuable'],
+              description: 'The requested scopes are not issuable.',
             },
             404: 'No accessible project was found for this id.',
           },
@@ -259,7 +267,6 @@ export function apiKeys(options: apiKeys.Options = {}) {
       async (c) => {
         if (Auth.narrowAccess) return Auth.superAdminAccessError(c)
         if (Auth.narrowScope) return Auth.ensureProjectError(c)
-        if (Auth.tmp_narrowEarlyAccess) return Auth.tmp_ensureEarlyAccessError(c)
         if (OpenApi.narrowValidation)
           return OpenApi.validationError(c, {
             code: 'param_invalid',
@@ -375,7 +382,7 @@ export function apiKeys(options: apiKeys.Options = {}) {
           })
           return c.json(
             Response.validated(schema.listApiKeys.Response, {
-              data: records.map(serializeKey),
+              data: await serializeKeys(c, records),
             }),
             200,
           )
@@ -436,7 +443,7 @@ export function apiKeys(options: apiKeys.Options = {}) {
           })
           return c.json(
             Response.validated(schema.listOrgApiKeys.Response, {
-              data: records.map(serializeKey),
+              data: await serializeKeys(c, records),
             }),
             200,
           )
@@ -506,14 +513,30 @@ export declare namespace apiKeys {
   }
 }
 
+/** Enriches key records with their latest authenticated request timestamp. */
+async function serializeKeys(c: Context<App.Environment>, records: readonly ApiKeys.Record[]) {
+  const source = c.get('analytics')
+  if (!source || records.length === 0) return records.map((record) => serializeKey(record))
+  const lastUsedAt = new Map(
+    (
+      await RequestEvents.readLastUsedAt(
+        Analytics.get(source),
+        records.map(({ id }) => id),
+      )
+    ).map((usage) => [usage.apiKeyId, usage.lastUsedAt]),
+  )
+  return records.map((record) => serializeKey(record, lastUsedAt.get(record.id)))
+}
+
 /** Projects a persisted record onto the management key shape (no rate limits, no token). */
-function serializeKey(record: ApiKeys.Record) {
+function serializeKey(record: ApiKeys.Record, lastUsedAt?: string) {
   return {
     createdAt: record.createdAt,
     ...(record.createdBy === undefined ? {} : { createdBy: record.createdBy }),
     environment: record.environment,
     ...(record.expiresAt === undefined ? {} : { expiresAt: record.expiresAt }),
     id: record.id,
+    ...(lastUsedAt === undefined ? {} : { lastUsedAt }),
     ...(record.name === undefined ? {} : { name: record.name }),
     orgId: record.orgId,
     ...(record.projectId === undefined ? {} : { projectId: record.projectId }),