@webwaka/core 1.3.0

package/src/core/billing/index.test.ts

@@ -0,0 +1,154 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { BillingLedger, UsageCategory, LedgerEntryType } from './index';
+import { logger } from '../logger';
+
+describe('CORE-8: Platform Billing & Usage Ledger', () => {
+  let billingLedger: BillingLedger;
+  let mockDb: any;
+
+  beforeEach(() => {
+    mockDb = {
+      prepare: vi.fn().mockReturnThis(),
+      bind: vi.fn().mockReturnThis(),
+      run: vi.fn().mockResolvedValue({ success: true }),
+      first: vi.fn().mockResolvedValue({ balance: 500000 }) // 5000 NGN
+    };
+
+    billingLedger = new BillingLedger(mockDb);
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  // ─── recordUsage (existing) ───────────────────────────────────────────────
+
+  it('should record usage with integer kobo values', async () => {
+    const entry = await billingLedger.recordUsage(
+      'tenant-1',
+      UsageCategory.AI_TOKENS,
+      1500, // 15 NGN
+      'OpenRouter GPT-4o-mini usage'
+    );
+
+    expect(entry.tenantId).toBe('tenant-1');
+    expect(entry.type).toBe(LedgerEntryType.DEBIT);
+    expect(entry.category).toBe(UsageCategory.AI_TOKENS);
+    expect(entry.amountKobo).toBe(1500);
+    expect(entry.description).toBe('OpenRouter GPT-4o-mini usage');
+    expect(entry.id).toBeDefined();
+    expect(entry.createdAt).toBeInstanceOf(Date);
+  });
+
+  it('should reject non-integer kobo values', async () => {
+    await expect(
+      billingLedger.recordUsage('tenant-1', UsageCategory.AI_TOKENS, 1500.5, 'Invalid amount')
+    ).rejects.toThrow('Amount must be a positive integer in kobo');
+  });
+
+  it('should reject negative kobo values', async () => {
+    await expect(
+      billingLedger.recordUsage('tenant-1', UsageCategory.AI_TOKENS, -100, 'Invalid amount')
+    ).rejects.toThrow('Amount must be a positive integer in kobo');
+  });
+
+  // ─── recordCredit ─────────────────────────────────────────────────────────
+
+  it('should record a credit entry with CREDIT type', async () => {
+    const entry = await billingLedger.recordCredit(
+      'tenant-1',
+      UsageCategory.SUBSCRIPTION_CREDIT,
+      500000, // 5000 NGN top-up
+      'Wallet top-up via Paystack'
+    );
+
+    expect(entry.tenantId).toBe('tenant-1');
+    expect(entry.type).toBe(LedgerEntryType.CREDIT);
+    expect(entry.category).toBe(UsageCategory.SUBSCRIPTION_CREDIT);
+    expect(entry.amountKobo).toBe(500000);
+    expect(entry.description).toBe('Wallet top-up via Paystack');
+    expect(entry.id).toBeDefined();
+    expect(entry.createdAt).toBeInstanceOf(Date);
+  });
+
+  it('should include optional metadata on credit entry when provided', async () => {
+    const meta = { reference: 'PAY_REF_001', channel: 'paystack' };
+    const entry = await billingLedger.recordCredit(
+      'tenant-2',
+      UsageCategory.SUBSCRIPTION_CREDIT,
+      100000,
+      'Promotional credit',
+      meta
+    );
+
+    expect(entry.metadata).toEqual(meta);
+  });
+
+  it('should omit metadata from credit entry when not provided', async () => {
+    const entry = await billingLedger.recordCredit(
+      'tenant-2',
+      UsageCategory.SUBSCRIPTION_CREDIT,
+      100000,
+      'Promo credit'
+    );
+
+    expect(entry.metadata).toBeUndefined();
+  });
+
+  it('should reject non-integer kobo on recordCredit', async () => {
+    await expect(
+      billingLedger.recordCredit(
+        'tenant-1',
+        UsageCategory.SUBSCRIPTION_CREDIT,
+        999.99,
+        'Bad amount'
+      )
+    ).rejects.toThrow('Amount must be a positive integer in kobo');
+  });
+
+  it('should reject negative kobo on recordCredit', async () => {
+    await expect(
+      billingLedger.recordCredit(
+        'tenant-1',
+        UsageCategory.SUBSCRIPTION_CREDIT,
+        -500,
+        'Bad amount'
+      )
+    ).rejects.toThrow('Amount must be a positive integer in kobo');
+  });
+
+  it('should allow recording both a debit and a credit for the same tenant', async () => {
+    const debit = await billingLedger.recordUsage(
+      'tenant-1',
+      UsageCategory.AI_TOKENS,
+      2000,
+      'AI usage charge'
+    );
+    const credit = await billingLedger.recordCredit(
+      'tenant-1',
+      UsageCategory.SUBSCRIPTION_CREDIT,
+      50000,
+      'Top-up'
+    );
+
+    expect(debit.type).toBe(LedgerEntryType.DEBIT);
+    expect(credit.type).toBe(LedgerEntryType.CREDIT);
+    expect(debit.tenantId).toBe(credit.tenantId);
+    expect(debit.id).not.toBe(credit.id);
+  });
+
+  // ─── getTenantBalance stub ────────────────────────────────────────────────
+
+  it('should return 0 and emit a logger.warn flagging the stub', async () => {
+    const warnSpy = vi.spyOn(logger, 'warn');
+
+    const balance = await billingLedger.getTenantBalance('tenant-1');
+
+    expect(balance).toBe(0);
+    expect(warnSpy).toHaveBeenCalledOnce();
+    expect(warnSpy).toHaveBeenCalledWith(
+      expect.stringContaining('stub'),
+      expect.objectContaining({ tenantId: 'tenant-1' })
+    );
+  });
+});

package/src/core/billing/index.ts

@@ -0,0 +1,132 @@
+/**
+ * CORE-8: Platform Billing & Usage Ledger
+ * Blueprint Reference: Part 10.1 (Central Management & Economics)
+ * Blueprint Reference: Part 9.1 #6 (Africa First - Integer Kobo Values)
+ *
+ * Implements internal ledger for tracking tenant API/AI usage and credits.
+ */
+
+import { logger } from '../logger';
+
+export enum LedgerEntryType {
+  CREDIT = 'CREDIT',
+  DEBIT = 'DEBIT'
+}
+
+export enum UsageCategory {
+  AI_TOKENS = 'AI_TOKENS',
+  SMS_SENT = 'SMS_SENT',
+  EMAIL_SENT = 'EMAIL_SENT',
+  SUBSCRIPTION_FEE = 'SUBSCRIPTION_FEE',
+  SUBSCRIPTION_CREDIT = 'SUBSCRIPTION_CREDIT'
+}
+
+export interface LedgerEntry {
+  id: string;
+  tenantId: string;
+  type: LedgerEntryType;
+  category: UsageCategory;
+  amountKobo: number; // Integer kobo values (Part 9.1 #6)
+  description: string;
+  metadata?: Record<string, any>;
+  createdAt: Date;
+  deletedAt?: Date; // Soft deletes
+}
+
+/** Shared kobo validation used by both debit and credit paths. */
+function validateKobo(amountKobo: number): void {
+  if (!Number.isInteger(amountKobo) || amountKobo < 0) {
+    throw new Error('Amount must be a positive integer in kobo');
+  }
+}
+
+export class BillingLedger {
+  private db: any; // Type would be D1Database from @cloudflare/workers-types
+
+  constructor(db: any) {
+    this.db = db;
+  }
+
+  /**
+   * Records a usage debit for a tenant.
+   */
+  async recordUsage(
+    tenantId: string,
+    category: UsageCategory,
+    amountKobo: number,
+    description: string,
+    metadata?: Record<string, any>
+  ): Promise<LedgerEntry> {
+    validateKobo(amountKobo);
+
+    const entry: LedgerEntry = {
+      id: crypto.randomUUID(),
+      tenantId,
+      type: LedgerEntryType.DEBIT,
+      category,
+      amountKobo,
+      description,
+      ...(metadata !== undefined ? { metadata } : {}),
+      createdAt: new Date(),
+    };
+
+    // In a real implementation, this would insert into D1:
+    // await this.db.prepare('INSERT INTO ledger_entries ...').bind(...).run();
+
+    return entry;
+  }
+
+  /**
+   * Records a credit for a tenant (wallet top-up, refund, promotional credit,
+   * or subscription payment).
+   */
+  async recordCredit(
+    tenantId: string,
+    category: UsageCategory,
+    amountKobo: number,
+    description: string,
+    metadata?: Record<string, any>
+  ): Promise<LedgerEntry> {
+    validateKobo(amountKobo);
+
+    const entry: LedgerEntry = {
+      id: crypto.randomUUID(),
+      tenantId,
+      type: LedgerEntryType.CREDIT,
+      category,
+      amountKobo,
+      description,
+      ...(metadata !== undefined ? { metadata } : {}),
+      createdAt: new Date(),
+    };
+
+    // In a real implementation, this would insert into D1:
+    // await this.db.prepare('INSERT INTO ledger_entries ...').bind(...).run();
+
+    return entry;
+  }
+
+  /**
+   * Calculates the current balance for a tenant.
+   *
+   * @stub This implementation always returns 0. Real balance calculation
+   * requires D1 database wiring (separate task). Any caller that gates
+   * actions on this value will silently allow unlimited usage until
+   * D1 integration is complete.
+   */
+  async getTenantBalance(tenantId: string): Promise<number> {
+    logger.warn(
+      'getTenantBalance is a stub and always returns 0. D1 integration is required for real balance calculation.',
+      { tenantId }
+    );
+
+    // Real implementation:
+    // const result = await this.db.prepare(
+    //   'SELECT SUM(CASE WHEN type = "CREDIT" THEN amountKobo ELSE -amountKobo END) as balance ' +
+    //   'FROM ledger_entries WHERE tenantId = ? AND deletedAt IS NULL'
+    // ).bind(tenantId).first();
+    // return result.balance ?? 0;
+
+    return 0;
+  }
+}

package/src/core/booking/index.test.ts

@@ -0,0 +1,153 @@
+import { describe, it, expect, beforeEach } from 'vitest';
+import { BookingEngine } from './index';
+
+const T1 = 'tenant_alpha';
+const T2 = 'tenant_beta';
+
+describe('CORE-10: Universal Booking & Scheduling Engine', () => {
+  let bookingEngine: BookingEngine;
+
+  beforeEach(() => {
+    bookingEngine = new BookingEngine();
+  });
+
+  it('should create a booking if resource is available', () => {
+    const slot = {
+      startTime: new Date('2026-03-15T10:00:00Z'),
+      endTime: new Date('2026-03-15T11:00:00Z'),
+    };
+
+    const booking = bookingEngine.createBooking(T1, 'res_1', 'user_1', slot);
+    expect(booking.status).toBe('confirmed');
+    expect(booking.tenantId).toBe(T1);
+    expect(booking.resourceId).toBe('res_1');
+    expect(booking.userId).toBe('user_1');
+    expect(booking.id).toMatch(/^bk_/);
+    expect(booking.slot).toEqual(slot);
+  });
+
+  it('should reject booking if resource is not available (overlapping)', () => {
+    const slot1 = {
+      startTime: new Date('2026-03-15T10:00:00Z'),
+      endTime: new Date('2026-03-15T11:00:00Z'),
+    };
+    const slot2 = {
+      startTime: new Date('2026-03-15T10:30:00Z'),
+      endTime: new Date('2026-03-15T11:30:00Z'),
+    };
+
+    bookingEngine.createBooking(T1, 'res_1', 'user_1', slot1);
+
+    expect(() => {
+      bookingEngine.createBooking(T1, 'res_1', 'user_2', slot2);
+    }).toThrow('Resource is not available for the requested time slot');
+  });
+
+  it('should allow booking after cancellation', () => {
+    const slot = {
+      startTime: new Date('2026-03-15T10:00:00Z'),
+      endTime: new Date('2026-03-15T11:00:00Z'),
+    };
+
+    const booking1 = bookingEngine.createBooking(T1, 'res_1', 'user_1', slot);
+    const cancelled = bookingEngine.cancelBooking(T1, booking1.id);
+    expect(cancelled).toBe(true);
+
+    const booking2 = bookingEngine.createBooking(T1, 'res_1', 'user_2', slot);
+    expect(booking2.status).toBe('confirmed');
+  });
+
+  it('should allow bookings for different resources in the same slot', () => {
+    const slot = {
+      startTime: new Date('2026-03-15T10:00:00Z'),
+      endTime: new Date('2026-03-15T11:00:00Z'),
+    };
+
+    const b1 = bookingEngine.createBooking(T1, 'res_1', 'user_1', slot);
+    const b2 = bookingEngine.createBooking(T1, 'res_2', 'user_2', slot);
+
+    expect(b1.status).toBe('confirmed');
+    expect(b2.status).toBe('confirmed');
+  });
+
+  it('should allow adjacent bookings (no overlap)', () => {
+    const slot1 = {
+      startTime: new Date('2026-03-15T10:00:00Z'),
+      endTime: new Date('2026-03-15T11:00:00Z'),
+    };
+    const slot2 = {
+      startTime: new Date('2026-03-15T11:00:00Z'),
+      endTime: new Date('2026-03-15T12:00:00Z'),
+    };
+
+    bookingEngine.createBooking(T1, 'res_1', 'user_1', slot1);
+    const b2 = bookingEngine.createBooking(T1, 'res_1', 'user_2', slot2);
+    expect(b2.status).toBe('confirmed');
+  });
+
+  it('should return false when cancelling a non-existent booking', () => {
+    const result = bookingEngine.cancelBooking(T1, 'bk_nonexistent');
+    expect(result).toBe(false);
+  });
+
+  it('should report resource unavailable when booked within a containing slot', () => {
+    const outer = {
+      startTime: new Date('2026-03-15T09:00:00Z'),
+      endTime: new Date('2026-03-15T12:00:00Z'),
+    };
+    const inner = {
+      startTime: new Date('2026-03-15T10:00:00Z'),
+      endTime: new Date('2026-03-15T11:00:00Z'),
+    };
+
+    bookingEngine.createBooking(T1, 'res_1', 'user_1', outer);
+
+    expect(() => {
+      bookingEngine.createBooking(T1, 'res_1', 'user_2', inner);
+    }).toThrow('Resource is not available for the requested time slot');
+  });
+
+  it('should check availability without creating a booking', () => {
+    const slot = {
+      startTime: new Date('2026-03-15T10:00:00Z'),
+      endTime: new Date('2026-03-15T11:00:00Z'),
+    };
+
+    expect(bookingEngine.isAvailable(T1, 'res_1', slot)).toBe(true);
+    bookingEngine.createBooking(T1, 'res_1', 'user_1', slot);
+    expect(bookingEngine.isAvailable(T1, 'res_1', slot)).toBe(false);
+  });
+
+  // ─── Cross-Tenant Isolation ───────────────────────────────────────────────
+
+  it('cross-tenant: booking by tenant_A does not block the same slot for tenant_B', () => {
+    const slot = {
+      startTime: new Date('2026-03-15T10:00:00Z'),
+      endTime: new Date('2026-03-15T11:00:00Z'),
+    };
+
+    bookingEngine.createBooking(T1, 'res_1', 'user_1', slot);
+
+    // Same resource and slot for T2 must still be available
+    expect(bookingEngine.isAvailable(T2, 'res_1', slot)).toBe(true);
+    const b2 = bookingEngine.createBooking(T2, 'res_1', 'user_2', slot);
+    expect(b2.status).toBe('confirmed');
+    expect(b2.tenantId).toBe(T2);
+  });
+
+  it('cross-tenant: cancelBooking by tenant_B cannot cancel tenant_A booking', () => {
+    const slot = {
+      startTime: new Date('2026-03-15T10:00:00Z'),
+      endTime: new Date('2026-03-15T11:00:00Z'),
+    };
+
+    const booking = bookingEngine.createBooking(T1, 'res_1', 'user_1', slot);
+
+    // T2 attempts to cancel T1's booking — must return false (not found in T2)
+    const result = bookingEngine.cancelBooking(T2, booking.id);
+    expect(result).toBe(false);
+
+    // Original booking should still be active (blocking T1's slot)
+    expect(bookingEngine.isAvailable(T1, 'res_1', slot)).toBe(false);
+  });
+});

package/src/core/booking/index.ts

@@ -0,0 +1,91 @@
+/**
+ * CORE-10: Universal Booking & Scheduling Engine
+ * Blueprint Reference: Part 10.3 (Transport), Part 10.7 (Health)
+ *
+ * Unified system for managing time slots, availability, and reservations.
+ *
+ * Tenant Isolation: every mutating and querying method requires a tenantId.
+ * All data is scoped per tenant — cross-tenant leakage is impossible by construction.
+ */
+
+export interface TimeSlot {
+  startTime: Date;
+  endTime: Date;
+}
+
+export interface Booking {
+  id: string;
+  tenantId: string;
+  resourceId: string;
+  userId: string;
+  slot: TimeSlot;
+  status: 'pending' | 'confirmed' | 'cancelled';
+}
+
+export class BookingEngine {
+  private bookings: Booking[] = [];
+
+  /**
+   * Checks if a resource is available for a given time slot within a tenant.
+   */
+  isAvailable(tenantId: string, resourceId: string, requestedSlot: TimeSlot): boolean {
+    const resourceBookings = this.bookings.filter(b =>
+      b.tenantId === tenantId &&
+      b.resourceId === resourceId &&
+      b.status !== 'cancelled'
+    );
+
+    for (const booking of resourceBookings) {
+      if (
+        requestedSlot.startTime < booking.slot.endTime &&
+        requestedSlot.endTime > booking.slot.startTime
+      ) {
+        return false;
+      }
+    }
+
+    return true;
+  }
+
+  /**
+   * Creates a new booking if the resource is available within the tenant.
+   */
+  createBooking(tenantId: string, resourceId: string, userId: string, slot: TimeSlot): Booking {
+    if (!this.isAvailable(tenantId, resourceId, slot)) {
+      throw new Error('Resource is not available for the requested time slot');
+    }
+
+    const newBooking: Booking = {
+      id: `bk_${crypto.randomUUID()}`,
+      tenantId,
+      resourceId,
+      userId,
+      slot,
+      status: 'confirmed',
+    };
+
+    this.bookings.push(newBooking);
+
+    // eventBus.publish(WebWakaEventType.BOOKING_CONFIRMED, createEvent(WebWakaEventType.BOOKING_CONFIRMED, tenantId, newBooking));
+
+    return newBooking;
+  }
+
+  /**
+   * Cancels an existing booking, scoped to the tenant.
+   * Returns false if the booking does not exist within the tenant.
+   */
+  cancelBooking(tenantId: string, bookingId: string): boolean {
+    const booking = this.bookings.find(
+      b => b.id === bookingId && b.tenantId === tenantId
+    );
+    if (booking) {
+      booking.status = 'cancelled';
+
+      // eventBus.publish(WebWakaEventType.BOOKING_CANCELLED, createEvent(WebWakaEventType.BOOKING_CANCELLED, tenantId, booking));
+
+      return true;
+    }
+    return false;
+  }
+}

package/src/core/chat/index.test.ts

@@ -0,0 +1,159 @@
+import { describe, it, expect, beforeEach } from 'vitest';
+import { ChatEngine } from './index';
+
+const T1 = 'tenant_alpha';
+const T2 = 'tenant_beta';
+
+describe('CORE-13: Real-Time Chat & Communication', () => {
+  let chatEngine: ChatEngine;
+
+  beforeEach(() => {
+    chatEngine = new ChatEngine();
+  });
+
+  it('should create a chat channel', () => {
+    const channel = chatEngine.createChannel(T1, ['user1', 'user2'], { type: 'support' });
+
+    expect(channel.id).toMatch(/^ch_/);
+    expect(channel.tenantId).toBe(T1);
+    expect(channel.participants).toContain('user1');
+    expect(channel.participants).toContain('user2');
+    expect(channel.metadata['type']).toBe('support');
+    expect(channel.createdAt).toBeInstanceOf(Date);
+  });
+
+  it('should create a channel with default empty metadata', () => {
+    const channel = chatEngine.createChannel(T1, ['user1', 'user2']);
+    expect(channel.metadata).toEqual({});
+  });
+
+  it('should send a message to a channel', () => {
+    const channel = chatEngine.createChannel(T1, ['user1', 'user2']);
+
+    const message = chatEngine.sendMessage(T1, channel.id, 'user1', 'Hello, world!');
+
+    expect(message.id).toMatch(/^msg_/);
+    expect(message.tenantId).toBe(T1);
+    expect(message.content).toBe('Hello, world!');
+    expect(message.senderId).toBe('user1');
+    expect(message.status).toBe('sent');
+    expect(message.type).toBe('text');
+    expect(message.channelId).toBe(channel.id);
+  });
+
+  it('should not allow non-participants to send text messages', () => {
+    const channel = chatEngine.createChannel(T1, ['user1', 'user2']);
+
+    expect(() => {
+      chatEngine.sendMessage(T1, channel.id, 'user3', 'Hello, world!');
+    }).toThrow('Sender is not a participant in this channel');
+  });
+
+  it('should allow system messages from non-participants', () => {
+    const channel = chatEngine.createChannel(T1, ['user1', 'user2']);
+    const msg = chatEngine.sendMessage(T1, channel.id, 'system', 'User joined', 'system');
+    expect(msg.type).toBe('system');
+    expect(msg.status).toBe('sent');
+  });
+
+  it('should throw when sending to a non-existent channel', () => {
+    expect(() => {
+      chatEngine.sendMessage(T1, 'ch_nonexistent', 'user1', 'Hi');
+    }).toThrow('Channel not found');
+  });
+
+  it('should retrieve messages for a channel in reverse order', () => {
+    const channel = chatEngine.createChannel(T1, ['user1', 'user2']);
+
+    chatEngine.sendMessage(T1, channel.id, 'user1', 'Message 1');
+    chatEngine.sendMessage(T1, channel.id, 'user2', 'Message 2');
+    chatEngine.sendMessage(T1, channel.id, 'user1', 'Message 3');
+
+    const messages = chatEngine.getMessages(T1, channel.id);
+
+    expect(messages).toHaveLength(3);
+    expect(messages[0]!.content).toBe('Message 3');
+    expect(messages[2]!.content).toBe('Message 1');
+  });
+
+  it('should support pagination with limit and offset', () => {
+    const channel = chatEngine.createChannel(T1, ['user1', 'user2']);
+
+    for (let i = 1; i <= 5; i++) {
+      chatEngine.sendMessage(T1, channel.id, 'user1', `Message ${i}`);
+    }
+
+    const page1 = chatEngine.getMessages(T1, channel.id, 2, 0);
+    expect(page1).toHaveLength(2);
+    expect(page1[0]!.content).toBe('Message 5');
+
+    const page2 = chatEngine.getMessages(T1, channel.id, 2, 2);
+    expect(page2).toHaveLength(2);
+    expect(page2[0]!.content).toBe('Message 3');
+  });
+
+  it('should return empty array for channel with no messages', () => {
+    const channel = chatEngine.createChannel(T1, ['user1', 'user2']);
+    expect(chatEngine.getMessages(T1, channel.id)).toHaveLength(0);
+  });
+
+  it('should mark messages as read', () => {
+    const channel = chatEngine.createChannel(T1, ['user1', 'user2']);
+
+    const msg1 = chatEngine.sendMessage(T1, channel.id, 'user1', 'Message 1');
+    const msg2 = chatEngine.sendMessage(T1, channel.id, 'user1', 'Message 2');
+
+    chatEngine.markAsRead(T1, channel.id, [msg1.id, msg2.id]);
+
+    const messages = chatEngine.getMessages(T1, channel.id);
+    expect(messages[0]!.status).toBe('read');
+    expect(messages[1]!.status).toBe('read');
+  });
+
+  it('should only mark specified messages as read', () => {
+    const channel = chatEngine.createChannel(T1, ['user1', 'user2']);
+
+    const msg1 = chatEngine.sendMessage(T1, channel.id, 'user1', 'Message 1');
+    chatEngine.sendMessage(T1, channel.id, 'user1', 'Message 2');
+
+    chatEngine.markAsRead(T1, channel.id, [msg1.id]);
+
+    const messages = chatEngine.getMessages(T1, channel.id);
+    expect(messages[0]!.status).toBe('sent');
+    expect(messages[1]!.status).toBe('read');
+  });
+
+  it('should send image message type', () => {
+    const channel = chatEngine.createChannel(T1, ['user1', 'user2']);
+    const msg = chatEngine.sendMessage(T1, channel.id, 'user1', 'https://img.url/photo.jpg', 'image');
+    expect(msg.type).toBe('image');
+  });
+
+  // ─── Cross-Tenant Isolation ───────────────────────────────────────────────
+
+  it('cross-tenant: tenant_B cannot send messages into tenant_A channel', () => {
+    const channel = chatEngine.createChannel(T1, ['user1', 'user2']);
+
+    expect(() => {
+      chatEngine.sendMessage(T2, channel.id, 'user1', 'Cross-tenant hack');
+    }).toThrow('Channel not found');
+  });
+
+  it('cross-tenant: tenant_B getMessages returns empty for tenant_A channel', () => {
+    const channel = chatEngine.createChannel(T1, ['user1', 'user2']);
+    chatEngine.sendMessage(T1, channel.id, 'user1', 'Secret message');
+
+    const result = chatEngine.getMessages(T2, channel.id);
+    expect(result).toHaveLength(0);
+  });
+
+  it('cross-tenant: markAsRead by tenant_B has no effect on tenant_A messages', () => {
+    const channel = chatEngine.createChannel(T1, ['user1', 'user2']);
+    const msg = chatEngine.sendMessage(T1, channel.id, 'user1', 'Hi');
+
+    chatEngine.markAsRead(T2, channel.id, [msg.id]);
+
+    const messages = chatEngine.getMessages(T1, channel.id);
+    expect(messages[0]!.status).toBe('sent');
+  });
+});