✅ No new issues found.

Reviewed changes — routes dashboard key ratelimit edits through the public API SDK (keys.updateKey), replacing the bespoke tRPC route, following the same pattern already used for credits, external-id, metadata, and expiration.

• Migrate useEditKeyRatelimits to the SDK — hooks/use-edit-ratelimits.ts now calls getUnkeyClient().keys.updateKey({ keyId, ratelimits }) via a plain useMutation, mapping form rules to { name, limit, duration: rule.refillInterval, autoApply }.
• Clear on disable — sends an empty (non-nil) ratelimits: [] when limits are disabled, which the v2 handler treats as "delete all existing rules."
• Toast/cache wiring — onSuccess reads variables.keyId (was data.keyId) and invalidates trpcUtils.api.keys.list; onError uses the shared getErrorMessage helper.
• Remove legacy route — deletes lib/trpc/routers/key/updateRatelimit.ts and its key.update.ratelimit registration in routers/index.ts.
• Comment rename — edit-ratelimits/index.tsx comment updated useEditRatelimits → useEditKeyRatelimits.

I verified the load-bearing API contract against svc/api/routes/v2_keys_update_key/handler.go: ratelimit reconciliation is gated on req.Ratelimits != nil and keyed by name, so an empty non-nil array clears all rules (disabled path) and a populated array performs a full delete-missing + upsert (enabled path) — matching the old tRPC behavior. The mapped field names and types line up with the SDK RatelimitRequest schema.

Two non-blocking observations, both inherited from the broader SDK-migration effort rather than introduced here:

• The v2 API reconciles ratelimits by name, so renaming a rule is a delete + recreate (the row id and created timestamp reset). This differs from the old id-keyed tRPC path but is how every v2 client behaves.
• The removed tRPC route emitted a ratelimit.update audit event with per-rule metadata; the v2 handler's ratelimit block emits no ratelimit-specific audit event. This granular audit trail is lost — consistent with the credits/external-id migrations, so likely intentional, but worth confirming that dropping the per-rule audit detail is acceptable.

  ^{｜ ⚠️ this action is pinned to a commit SHA, which freezes the cleanup step — switch to @v0 or keep the SHA fresh with Dependabot ｜ View workflow run ｜ Using Claude Opus ｜ 𝕏}