create-ailk 0.24.0 → 0.26.0

package/templates/apps/api/src/services/offerings/__tests__/connection.test.ts

@@ -1,975 +0,0 @@
-/**
- * services/offerings/connection.ts — the Organization's Stripe connection.
- *
- * #8876 D6, AC-2: the summary answers mode, last four and three timestamps,
- * selects no ciphertext and no token, answers only its own Organization, and
- * reports a corrupt row as `"unreadable"`, never absent.
- *
- * #8907 (spec docs/specs/8907-the-organization-stripe-connection-custody-spec.md):
- * the three probes run together and decide from all three results (AC-4);
- * the token lookup forgets a deleted or reset token at once (AC-7); a replace
- * keeps the token and returns to test, and the compare-and-swap never loses
- * or resurrects a row (AC-8); the cipher binds the Organization, the field
- * and the mode, and the rekey walk rotates every row once (AC-10); the
- * use-time client never touches the process flag and never decrypts a live
- * row off production (AC-13).
- *
- * Prisma is the repo's in-memory, where-honouring double; the real
- * `lib/stripe.ts` wrapper is used unless a case replaces it with a fake
- * client; `node:crypto`'s `createDecipheriv` is spied, not replaced.
- */
-import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
-import { readFileSync } from "node:fs";
-import { join } from "node:path";
-
-// eslint-disable-next-line no-restricted-syntax -- lib/prisma.ts wraps the external DB boundary (PrismaClient requires a live connection); the in-memory double is the repo-standard where-honouring test double for it.
-jest.mock("../../../lib/prisma.js", () =>
-  jest
-    .requireActual<typeof import("../../../__tests__/factories/in-memory-prisma")>(
-      "../../../__tests__/factories/in-memory-prisma",
-    )
-    .createInMemoryPrisma(),
-);
-
-const mockLoggerError = jest.fn();
-const mockLoggerWarn = jest.fn();
-jest.mock("@working-theory/observability", () => ({
-  logger: {
-    error: (...args: unknown[]) => mockLoggerError(...args),
-    warn: (...args: unknown[]) => mockLoggerWarn(...args),
-    info: jest.fn(),
-    debug: jest.fn(),
-  },
-}));
-
-jest.mock("node:crypto", () => {
-  const actual = jest.requireActual<typeof import("node:crypto")>("node:crypto");
-  return { ...actual, createDecipheriv: jest.fn(actual.createDecipheriv) };
-});
-
-const mockStripeClientForConnection = jest.fn();
-// `getStripeClient()` caches its client for the process, so a case that needs a
-// refusal swaps it (#9285); every other case calls through to the real one.
-const mockGetStripeClient = jest.fn();
-// eslint-disable-next-line no-restricted-syntax -- lib/stripe.ts is the Stripe HTTP boundary; the real wrapper runs unless a case swaps in a fake client
-jest.mock("../../../lib/stripe.js", () => {
-  const actual = jest.requireActual<typeof import("../../../lib/stripe.js")>("../../../lib/stripe.js");
-  return {
-    ...actual,
-    stripeClientForConnection: (...args: Parameters<typeof actual.stripeClientForConnection>) =>
-      mockStripeClientForConnection(...args),
-    getStripeClient: () => mockGetStripeClient(),
-  };
-});
-
-import { config } from "../../../config/index.js";
-import { prisma } from "../../../lib/prisma.js";
-import * as stripeLib from "../../../lib/stripe.js";
-import {
-  decryptStripeConnectionValue,
-  deleteStripeConnection,
-  encryptStripeConnectionValue,
-  findStripeConnectionByWebhookToken,
-  formatRekeyReport,
-  getEnvironmentStripeSource,
-  getOfferingsConnectionState,
-  getStripeConnectionSummary,
-  goLiveStripeConnection,
-  organizationOwnsEnvironmentStripeKey,
-  PROBE_TIMEOUT_MS,
-  probeStripeKey,
-  putStripeConnectionKey,
-  readConnectionForWrite,
-  rekeyStripeConnections,
-  resetStripeWebhook,
-  StripeConnectionStoreError,
-  setStripeWebhookSecret,
-  stripeClientForOrganization,
-  type StripeConnectionWriteRow,
-} from "../connection.js";
-import { FIXTURE_ORG, FIXTURE_ORG_2, FIXTURE_NOW, seedOfferings } from "./fixtures.js";
-
-type Row = Record<string, unknown>;
-// The in-memory double exposes its store and recorded delegates, which the
-// PrismaClient type the import carries does not name, so it is named here once.
-// eslint-disable-next-line no-restricted-syntax -- justified above
-const db = prisma as unknown as {
-  __db: Record<string, Row[]>;
-  stripeConnection: {
-    findUnique: jest.Mock;
-    findMany: jest.Mock;
-    create: jest.Mock;
-    updateMany: jest.Mock;
-    deleteMany: jest.Mock;
-  };
-};
-
-const REPO_ROOT = join(__dirname, "..", "..", "..", "..", "..", "..");
-const actualStripe = jest.requireActual<typeof import("../../../lib/stripe.js")>("../../../lib/stripe.js");
-
-const KEY_A = randomBytes(32);
-const KEY_B = randomBytes(32);
-const KEY_C = randomBytes(32);
-
-/** Keys composed at run time, as the existing suites compose live prefixes. */
-const testKey = (body = "a".repeat(24)) => ["rk", "test", body].join("_");
-const liveKey = (body = "L".repeat(24)) => ["rk", "live", body].join("_");
-const SECRET = ["whsec", "s".repeat(32)].join("_");
-
-// The double stamps `updatedAt` on every write; a caller's explicit value
-// (the rekey walk restores the one it read) is kept here, as Prisma keeps it.
-const originalUpdateMany = db.stripeConnection.updateMany.getMockImplementation()!;
-db.stripeConnection.updateMany.mockImplementation(async (args: { where: Row; data: Row }) => {
-  const matched = (db.__db.stripeConnection ?? []).filter(
-    (r) =>
-      r.organizationId === args.where.organizationId &&
-      (args.where.updatedAt === undefined ||
-        (r.updatedAt as Date).getTime() === (args.where.updatedAt as Date).getTime()),
-  );
-  const result = await originalUpdateMany(args);
-  if (args.data.updatedAt instanceof Date) {
-    for (const row of matched) row.updatedAt = args.data.updatedAt;
-  }
-  return result;
-});
-
-const savedEnv = { VERCEL_ENV: process.env.VERCEL_ENV, VERCEL: process.env.VERCEL };
-function setBuild(env: { VERCEL_ENV?: string; VERCEL?: string }): void {
-  delete process.env.VERCEL_ENV;
-  delete process.env.VERCEL;
-  Object.assign(process.env, env);
-}
-
-function rows(): Row[] {
-  return db.__db.stripeConnection ?? [];
-}
-function rowOf(organizationId: string): Row | undefined {
-  return rows().find((r) => r.organizationId === organizationId);
-}
-
-async function observed(organizationId: string): Promise<StripeConnectionWriteRow | null> {
-  const row = await readConnectionForWrite(organizationId);
-  if (row === "unreadable") throw new Error("unreadable row");
-  return row;
-}
-
-/** Remove a test fixture's row outright; the delete itself is under test below. */
-function wipe(organizationId: string): void {
-  db.__db.stripeConnection = rows().filter((r) => r.organizationId !== organizationId);
-}
-
-async function connect(organizationId: string, key = testKey()) {
-  return putStripeConnectionKey(organizationId, key, key.slice(-4), await observed(organizationId));
-}
-
-beforeEach(async () => {
-  for (const key of Object.keys(db.__db)) delete db.__db[key];
-  jest.clearAllMocks();
-  mockStripeClientForConnection.mockImplementation(actualStripe.stripeClientForConnection);
-  Object.assign(config, { STRIPE_CONNECTION_KEY: KEY_A, STRIPE_CONNECTION_KEY_PREVIOUS: undefined });
-  setBuild({});
-  await seedOfferings(prisma, { now: FIXTURE_NOW });
-});
-
-afterAll(() => {
-  setBuild({});
-  if (savedEnv.VERCEL_ENV !== undefined) process.env.VERCEL_ENV = savedEnv.VERCEL_ENV;
-  if (savedEnv.VERCEL !== undefined) process.env.VERCEL = savedEnv.VERCEL;
-  Object.assign(config, { STRIPE_CONNECTION_KEY: undefined, STRIPE_CONNECTION_KEY_PREVIOUS: undefined });
-});
-
-describe("getStripeConnectionSummary (#8876 D6, AC-2)", () => {
-  it("answers exactly mode, last4 and three timestamps", async () => {
-    const row = db.__db.stripeConnection![0]!;
-    const summary = await getStripeConnectionSummary(FIXTURE_ORG);
-    expect(summary).toEqual({
-      mode: "test",
-      last4: "4242",
-      connectedAt: (row.createdAt as Date).toISOString(),
-      liveAt: null,
-      updatedAt: (row.updatedAt as Date).toISOString(),
-    });
-    expect(Object.keys(summary as object).sort()).toEqual(
-      ["connectedAt", "last4", "liveAt", "mode", "updatedAt"],
-    );
-  });
-
-  it("selects exactly the five safe columns, by organizationId", async () => {
-    await getStripeConnectionSummary(FIXTURE_ORG);
-    expect(db.stripeConnection.findUnique).toHaveBeenCalledTimes(1);
-    const args = db.stripeConnection.findUnique.mock.calls[0]![0] as { where: Row; select: Row };
-    expect(args.where).toEqual({ organizationId: FIXTURE_ORG });
-    expect(args.select).toEqual({ mode: true, keyLast4: true, liveAt: true, createdAt: true, updatedAt: true });
-  });
-
-  it("answers null for another Organization's id", async () => {
-    expect(await getStripeConnectionSummary(FIXTURE_ORG_2)).toBeNull();
-  });
-
-  it("answers a live connection with its go-live time", async () => {
-    const liveAt = new Date("2026-10-21T09:00:00.000Z");
-    Object.assign(db.__db.stripeConnection![0]!, { mode: "live", liveAt });
-    expect(await getStripeConnectionSummary(FIXTURE_ORG)).toMatchObject({
-      mode: "live",
-      liveAt: liveAt.toISOString(),
-    });
-  });
-
-  it.each([
-    ["a three-character last4", { keyLast4: "424" }],
-    ["an unknown mode", { mode: "prod" }],
-    ["a live row with no go-live time", { mode: "live" }],
-    ["an invalid date", { createdAt: new Date(Number.NaN) }],
-  ])("answers unreadable, not null, for %s — and logs only the reason", async (_label, patch) => {
-    Object.assign(db.__db.stripeConnection![0]!, patch);
-    expect(await getStripeConnectionSummary(FIXTURE_ORG)).toBe("unreadable");
-    expect(mockLoggerError).toHaveBeenCalledTimes(1);
-    expect(mockLoggerError.mock.calls[0]![0]).toEqual({
-      organizationId: FIXTURE_ORG,
-      reason: "connection_unreadable",
-    });
-    expect(JSON.stringify(mockLoggerError.mock.calls)).not.toContain("424");
-  });
-
-  // The tree search for the delegate runs `git grep`, which a scaffold cannot:
-  // it lives in delegate-confinement.test.ts, kept out of the template (#9179).
-});
-
-// ─── AC-4 — the probes ──────────────────────────────────────────────────────
-
-type Outcome = { reject?: unknown } | "hang" | undefined;
-
-/**
- * A fake client whose three list calls each settle only once all three were
- * started, so a probe that awaited them one by one would never settle.
- */
-function fakeClient(outcomes: { products?: Outcome; prices?: Outcome; sessions?: Outcome } = {}) {
-  let started = 0;
-  let release!: () => void;
-  const allStarted = new Promise<void>((resolve) => (release = resolve));
-  const call = (outcome: Outcome) =>
-    jest.fn(async () => {
-      started += 1;
-      if (started === 3) release();
-      if (outcome === "hang") return new Promise(() => undefined);
-      await allStarted;
-      if (outcome?.reject !== undefined) throw outcome.reject;
-      return { data: [] };
-    });
-  return {
-    products: { list: call(outcomes.products) },
-    prices: { list: call(outcomes.prices) },
-    checkout: { sessions: { list: call(outcomes.sessions) } },
-  };
-}
-
-const stripeError = (type: string, statusCode?: number) =>
-  Object.assign(new Error("Stripe said no — text that must never be logged"), { type, statusCode });
-const PROBE_INPUT = { organizationId: FIXTURE_ORG, key: testKey(), mode: "test" as const, liveAt: null };
-
-describe("probeStripeKey (#8907 D5, AC-4)", () => {
-  it("answers usable when all three resolve, each called once with limit 1", async () => {
-    const client = fakeClient();
-    mockStripeClientForConnection.mockReturnValue(client);
-    expect(await probeStripeKey(PROBE_INPUT)).toBe("usable");
-    for (const list of [client.products.list, client.prices.list, client.checkout.sessions.list]) {
-      expect(list).toHaveBeenCalledTimes(1);
-      expect(list).toHaveBeenCalledWith({ limit: 1 });
-    }
-    expect(mockStripeClientForConnection).toHaveBeenCalledWith(PROBE_INPUT);
-  });
-
-  it("answers not_usable for a permission refusal on a later probe, after starting all three", async () => {
-    const client = fakeClient({ prices: { reject: stripeError("StripePermissionError", 403) } });
-    mockStripeClientForConnection.mockReturnValue(client);
-    expect(await probeStripeKey(PROBE_INPUT)).toBe("not_usable");
-    expect(client.checkout.sessions.list).toHaveBeenCalledTimes(1);
-  });
-
-  it("answers not_usable for an authentication refusal on the first probe", async () => {
-    mockStripeClientForConnection.mockReturnValue(
-      fakeClient({ products: { reject: stripeError("StripeAuthenticationError") } }),
-    );
-    expect(await probeStripeKey(PROBE_INPUT)).toBe("not_usable");
-  });
-
-  it("answers unavailable for a transient error, logging its class name only", async () => {
-    mockStripeClientForConnection.mockReturnValue(
-      fakeClient({ sessions: { reject: stripeError("StripeConnectionError") } }),
-    );
-    expect(await probeStripeKey(PROBE_INPUT)).toBe("unavailable");
-    expect(mockLoggerWarn).toHaveBeenCalledWith(
-      { organizationId: FIXTURE_ORG, outcome: "unavailable", errName: "Error" },
-      expect.any(String),
-    );
-    expect(JSON.stringify(mockLoggerWarn.mock.calls)).not.toContain("Stripe said no");
-  });
-
-  it("answers unavailable when a probe never settles within PROBE_TIMEOUT_MS", async () => {
-    jest.useFakeTimers();
-    try {
-      mockStripeClientForConnection.mockReturnValue(fakeClient({ prices: "hang" }));
-      const pending = probeStripeKey(PROBE_INPUT);
-      await jest.advanceTimersByTimeAsync(PROBE_TIMEOUT_MS);
-      expect(await pending).toBe("unavailable");
-    } finally {
-      jest.useRealTimers();
-    }
-  });
-
-  it("answers not_usable when the factory builds no client", async () => {
-    mockStripeClientForConnection.mockReturnValue(null);
-    expect(await probeStripeKey(PROBE_INPUT)).toBe("not_usable");
-  });
-});
-
-// ─── AC-7 — the token lookup ────────────────────────────────────────────────
-
-function tokenOf(organizationId: string): string {
-  return rowOf(organizationId)!.webhookToken as string;
-}
-
-describe("findStripeConnectionByWebhookToken (#8907 D11, AC-7)", () => {
-  beforeEach(async () => {
-    wipe(FIXTURE_ORG);
-    await connect(FIXTURE_ORG);
-  });
-
-  it("answers ok with the secret after a connect and a secret set", async () => {
-    await setStripeWebhookSecret(FIXTURE_ORG, SECRET, await observed(FIXTURE_ORG));
-    expect(await findStripeConnectionByWebhookToken(tokenOf(FIXTURE_ORG))).toEqual({
-      kind: "ok",
-      organizationId: FIXTURE_ORG,
-      mode: "test",
-      webhookSecret: SECRET,
-    });
-  });
-
-  it("forgets the token the moment the row is deleted", async () => {
-    const token = tokenOf(FIXTURE_ORG);
-    const seen = (await observed(FIXTURE_ORG))!;
-    expect(await deleteStripeConnection(FIXTURE_ORG, seen)).toEqual({
-      kind: "removed",
-      audit: { mode: "test", last4: testKey().slice(-4) },
-    });
-    expect(await findStripeConnectionByWebhookToken(token)).toEqual({ kind: "not-found" });
-    expect(await deleteStripeConnection(FIXTURE_ORG, seen)).toEqual({ kind: "absent" });
-  });
-
-  it("forgets the old token on a reset, and the new one has no secret", async () => {
-    await setStripeWebhookSecret(FIXTURE_ORG, SECRET, await observed(FIXTURE_ORG));
-    const old = tokenOf(FIXTURE_ORG);
-    const reset = await resetStripeWebhook(FIXTURE_ORG, (await observed(FIXTURE_ORG))!);
-    expect(reset.kind).toBe("webhook_reset");
-    const fresh = tokenOf(FIXTURE_ORG);
-    expect(fresh).not.toBe(old);
-    expect(fresh).toMatch(/^[A-Za-z0-9_-]{43}$/);
-    expect(await findStripeConnectionByWebhookToken(old)).toEqual({ kind: "not-found" });
-    expect(await findStripeConnectionByWebhookToken(fresh)).toEqual({
-      kind: "not-configured",
-      organizationId: FIXTURE_ORG,
-      mode: "test",
-    });
-  });
-
-  it("answers not-found for a 42-character token without reading", async () => {
-    db.stripeConnection.findUnique.mockClear();
-    expect(await findStripeConnectionByWebhookToken("a".repeat(42))).toEqual({ kind: "not-found" });
-    expect(db.stripeConnection.findUnique).not.toHaveBeenCalled();
-  });
-
-  it("answers unreadable for a test-bound secret on a row now live, and logs it", async () => {
-    setBuild({ VERCEL_ENV: "production" });
-    await setStripeWebhookSecret(FIXTURE_ORG, SECRET, await observed(FIXTURE_ORG));
-    Object.assign(rowOf(FIXTURE_ORG)!, { mode: "live", liveAt: new Date() });
-    mockLoggerError.mockClear();
-    expect(await findStripeConnectionByWebhookToken(tokenOf(FIXTURE_ORG))).toEqual({
-      kind: "unreadable",
-      organizationId: FIXTURE_ORG,
-    });
-    expect(mockLoggerError).toHaveBeenCalledWith(
-      { organizationId: FIXTURE_ORG, reason: "credential_unreadable" },
-      expect.any(String),
-    );
-  });
-
-  it("never decrypts a live row's secret on a preview build", async () => {
-    Object.assign(rowOf(FIXTURE_ORG)!, {
-      mode: "live",
-      liveAt: new Date(),
-      webhookSecretCiphertext: encryptStripeConnectionValue(SECRET, FIXTURE_ORG, "webhook-secret:live", KEY_A),
-    });
-    setBuild({ VERCEL_ENV: "preview" });
-    (createDecipheriv as jest.Mock).mockClear();
-    expect(await findStripeConnectionByWebhookToken(tokenOf(FIXTURE_ORG))).toEqual({
-      kind: "unreadable",
-      organizationId: FIXTURE_ORG,
-    });
-    expect(createDecipheriv).not.toHaveBeenCalled();
-    setBuild({ VERCEL_ENV: "production" });
-    expect(await findStripeConnectionByWebhookToken(tokenOf(FIXTURE_ORG))).toMatchObject({
-      kind: "ok",
-      webhookSecret: SECRET,
-    });
-  });
-});
-
-// ─── AC-8 — replace and the compare-and-swap ────────────────────────────────
-
-describe("putStripeConnectionKey and goLiveStripeConnection (#8907 D6, AC-8)", () => {
-  beforeEach(async () => {
-    wipe(FIXTURE_ORG);
-  });
-
-  it("names a first connect connect, and a second key replace — keeping the token and the secret", async () => {
-    expect((await connect(FIXTURE_ORG)).kind).toBe("connect");
-    await setStripeWebhookSecret(FIXTURE_ORG, SECRET, await observed(FIXTURE_ORG));
-    const before = { ...rowOf(FIXTURE_ORG)! };
-
-    const second = testKey("b".repeat(20) + "WXYZ");
-    const result = await connect(FIXTURE_ORG, second);
-    expect(result).toEqual({
-      kind: "replace",
-      saved: { mode: "test", webhookSecretSet: true, liveAt: null, updatedAt: expect.any(String) },
-      audit: { mode: "test", last4: "WXYZ" },
-    });
-    const after = rowOf(FIXTURE_ORG)!;
-    expect(after.webhookToken).toBe(before.webhookToken);
-    expect(after.createdAt).toEqual(before.createdAt);
-    expect(after.keyLast4).toBe("WXYZ");
-    expect(after.credentialCiphertext).not.toBe(before.credentialCiphertext);
-    expect(decryptStripeConnectionValue(after.credentialCiphertext as string, FIXTURE_ORG, "credential")).toBe(second);
-    expect(after.webhookSecretCiphertext).toBe(before.webhookSecretCiphertext);
-  });
-
-  it("returns a live connection to test on replace, keeping the token and clearing the secret", async () => {
-    await connect(FIXTURE_ORG);
-    const live = await goLiveStripeConnection(FIXTURE_ORG, liveKey(), "LLLL", SECRET, new Date(), await observed(FIXTURE_ORG));
-    expect(live.kind).toBe("go_live");
-    const token = tokenOf(FIXTURE_ORG);
-
-    const result = await connect(FIXTURE_ORG, testKey("c".repeat(24)));
-    expect(result.kind).toBe("replace");
-    expect(rowOf(FIXTURE_ORG)).toMatchObject({
-      mode: "test",
-      liveAt: null,
-      webhookSecretCiphertext: null,
-      webhookToken: token,
-    });
-  });
-
-  it("answers connection_changed after one retry when the row keeps changing, leaving the newer row", async () => {
-    await connect(FIXTURE_ORG);
-    const seen = await observed(FIXTURE_ORG);
-    const newer = rowOf(FIXTURE_ORG)!.credentialCiphertext;
-    // Another write lands between each read and its swap.
-    const bump = async (args: { where: Row; data: Row }) => {
-      const row = rowOf(FIXTURE_ORG)!;
-      row.updatedAt = new Date((row.updatedAt as Date).getTime() + 1000);
-      return originalUpdateMany(args);
-    };
-    db.stripeConnection.updateMany.mockImplementationOnce(bump).mockImplementationOnce(bump);
-    const result = await putStripeConnectionKey(FIXTURE_ORG, testKey("d".repeat(24)), "dddd", seen);
-    expect(result).toEqual({ kind: "connection_changed" });
-    expect(db.stripeConnection.updateMany).toHaveBeenCalledTimes(2);
-    expect(rowOf(FIXTURE_ORG)!.credentialCiphertext).toBe(newer);
-  });
-
-  it("never re-creates a connection a disconnect removed between the read and the swap", async () => {
-    await connect(FIXTURE_ORG);
-    const seen = await observed(FIXTURE_ORG);
-    wipe(FIXTURE_ORG);
-    const result = await putStripeConnectionKey(FIXTURE_ORG, testKey("e".repeat(24)), "eeee", seen);
-    expect(result).toEqual({ kind: "connection_changed" });
-    expect(rowOf(FIXTURE_ORG)).toBeUndefined();
-  });
-
-  it("re-keys a live connection on go-live, keeping it live and keeping the token", async () => {
-    await connect(FIXTURE_ORG);
-    await goLiveStripeConnection(FIXTURE_ORG, liveKey(), "LLLL", SECRET, new Date(), await observed(FIXTURE_ORG));
-    const token = tokenOf(FIXTURE_ORG);
-    const rotated = liveKey("M".repeat(20) + "MNOP");
-    const result = await goLiveStripeConnection(FIXTURE_ORG, rotated, "MNOP", SECRET, new Date(), await observed(FIXTURE_ORG));
-    expect(result.kind).toBe("go_live");
-    expect(rowOf(FIXTURE_ORG)).toMatchObject({ mode: "live", keyLast4: "MNOP", webhookToken: token });
-  });
-
-  it("answers connection_required for go-live and the secret with no row, and key_not_configured with no key", async () => {
-    expect(await goLiveStripeConnection(FIXTURE_ORG, liveKey(), "LLLL", SECRET, new Date(), null)).toEqual({
-      kind: "connection_required",
-    });
-    expect(await setStripeWebhookSecret(FIXTURE_ORG, SECRET, null)).toEqual({ kind: "connection_required" });
-    Object.assign(config, { STRIPE_CONNECTION_KEY: undefined });
-    expect(await connect(FIXTURE_ORG)).toEqual({ kind: "key_not_configured" });
-    expect(rowOf(FIXTURE_ORG)).toBeUndefined();
-  });
-});
-
-// ─── The retry re-applies the first read's guards (D3, SEC-8907-3) ──────────
-
-describe("a row that goes live between the read and the swap (#8907 D3)", () => {
-  /** The next swap misses because production took the row live in between. */
-  function goesLiveBeforeTheSwap(): void {
-    db.stripeConnection.updateMany.mockImplementationOnce(async (args: { where: Row; data: Row }) => {
-      const row = rowOf(FIXTURE_ORG)!;
-      Object.assign(row, {
-        mode: "live",
-        liveAt: new Date(),
-        updatedAt: new Date((row.updatedAt as Date).getTime() + 1000),
-      });
-      return originalUpdateMany(args);
-    });
-  }
-
-  beforeEach(async () => {
-    wipe(FIXTURE_ORG);
-    await connect(FIXTURE_ORG);
-    setBuild({ VERCEL_ENV: "preview" });
-  });
-
-  it("answers live_mode_unavailable and leaves the live row exactly as production wrote it", async () => {
-    for (const write of [
-      (seen: StripeConnectionWriteRow) => putStripeConnectionKey(FIXTURE_ORG, testKey("h".repeat(24)), "hhhh", seen),
-      (seen: StripeConnectionWriteRow) => setStripeWebhookSecret(FIXTURE_ORG, SECRET, seen),
-      (seen: StripeConnectionWriteRow) => resetStripeWebhook(FIXTURE_ORG, seen),
-    ]) {
-      Object.assign(rowOf(FIXTURE_ORG)!, { mode: "test", liveAt: null });
-      const seen = (await observed(FIXTURE_ORG))!;
-      goesLiveBeforeTheSwap();
-      const result = await write(seen);
-      const stored = JSON.stringify(rowOf(FIXTURE_ORG));
-      expect(result).toEqual({ kind: "live_mode_unavailable" });
-      expect(db.stripeConnection.updateMany).toHaveBeenCalledTimes(1);
-      expect(JSON.stringify(rowOf(FIXTURE_ORG))).toBe(stored);
-      db.stripeConnection.updateMany.mockClear();
-    }
-  });
-
-  it("never deletes a live row from a preview, nor one that went live after the read", async () => {
-    const seen = (await observed(FIXTURE_ORG))!;
-    Object.assign(rowOf(FIXTURE_ORG)!, {
-      mode: "live",
-      liveAt: new Date(),
-      updatedAt: new Date((rowOf(FIXTURE_ORG)!.updatedAt as Date).getTime() + 1000),
-    });
-    expect(await deleteStripeConnection(FIXTURE_ORG, seen)).toEqual({ kind: "live_mode_unavailable" });
-    expect(await deleteStripeConnection(FIXTURE_ORG, (await observed(FIXTURE_ORG))!)).toEqual({
-      kind: "live_mode_unavailable",
-    });
-    expect(rowOf(FIXTURE_ORG)).toBeDefined();
-  });
-
-  it("names the row it actually deleted when a replace committed after the read", async () => {
-    setBuild({ VERCEL_ENV: "production" });
-    const seen = (await observed(FIXTURE_ORG))!;
-    Object.assign(rowOf(FIXTURE_ORG)!, {
-      keyLast4: "NEWR",
-      updatedAt: new Date((rowOf(FIXTURE_ORG)!.updatedAt as Date).getTime() + 1000),
-    });
-    expect(await deleteStripeConnection(FIXTURE_ORG, seen)).toEqual({
-      kind: "removed",
-      audit: { mode: "test", last4: "NEWR" },
-    });
-  });
-
-  it("never binds a secret entered for test mode to a row that went live in between, on production", async () => {
-    setBuild({ VERCEL_ENV: "production" });
-    const seen = (await observed(FIXTURE_ORG))!;
-    goesLiveBeforeTheSwap();
-    expect(await setStripeWebhookSecret(FIXTURE_ORG, SECRET, seen)).toEqual({ kind: "connection_changed" });
-    expect(rowOf(FIXTURE_ORG)).toMatchObject({ mode: "live", webhookSecretCiphertext: null });
-  });
-
-  it("never lets a replace undo a go-live that committed while its probe ran, on production", async () => {
-    setBuild({ VERCEL_ENV: "production" });
-    const seen = (await observed(FIXTURE_ORG))!;
-    goesLiveBeforeTheSwap();
-    expect(await putStripeConnectionKey(FIXTURE_ORG, testKey("h".repeat(24)), "hhhh", seen)).toEqual({
-      kind: "connection_changed",
-    });
-    expect(rowOf(FIXTURE_ORG)).toMatchObject({ mode: "live" });
-  });
-
-  it("answers a production reset with the mode it actually reset", async () => {
-    setBuild({ VERCEL_ENV: "production" });
-    const seen = (await observed(FIXTURE_ORG))!;
-    goesLiveBeforeTheSwap();
-    const result = await resetStripeWebhook(FIXTURE_ORG, seen);
-    expect(result).toMatchObject({
-      kind: "webhook_reset",
-      saved: { mode: "live", webhookSecretSet: false },
-      audit: { mode: "live" },
-    });
-  });
-});
-
-describe("collisions and the store boundary (#8907 D6)", () => {
-  beforeEach(async () => {
-    wipe(FIXTURE_ORG);
-  });
-
-  it("retries a first connect that lost a race from the read, replacing the winner's row", async () => {
-    db.stripeConnection.create.mockImplementationOnce(async () => {
-      rows().push({
-        id: "stripecon_winner",
-        organizationId: FIXTURE_ORG,
-        mode: "test",
-        keyLast4: "wwww",
-        credentialCiphertext: "v1.x.y.z",
-        webhookToken: "W".repeat(43),
-        webhookSecretCiphertext: null,
-        liveAt: null,
-        createdAt: new Date(),
-        updatedAt: new Date(),
-      });
-      throw Object.assign(new Error("Unique constraint failed on organization_id"), { code: "P2002" });
-    });
-    const result = await putStripeConnectionKey(FIXTURE_ORG, testKey(), "aaaa", null);
-    expect(result.kind).toBe("replace");
-    expect(rows().filter((r) => r.organizationId === FIXTURE_ORG)).toHaveLength(1);
-    expect(rowOf(FIXTURE_ORG)).toMatchObject({ keyLast4: "aaaa", webhookToken: "W".repeat(43) });
-  });
-
-  it("retries a reset whose new token collides, with another token", async () => {
-    await connect(FIXTURE_ORG);
-    const old = tokenOf(FIXTURE_ORG);
-    db.stripeConnection.updateMany.mockImplementationOnce(async () => {
-      throw Object.assign(new Error("Unique constraint failed on webhook_token"), { code: "P2002" });
-    });
-    const result = await resetStripeWebhook(FIXTURE_ORG, (await observed(FIXTURE_ORG))!);
-    expect(result.kind).toBe("webhook_reset");
-    expect(db.stripeConnection.updateMany).toHaveBeenCalledTimes(2);
-    expect(tokenOf(FIXTURE_ORG)).not.toBe(old);
-  });
-
-  it("rethrows any store failure with a fixed message and no cause", async () => {
-    await connect(FIXTURE_ORG);
-    const sentinel = "v1.SeNtInEl.CiPhEr.TeXt";
-    db.stripeConnection.updateMany.mockRejectedValueOnce(
-      Object.assign(new Error(`check constraint violated: ${sentinel}`), { code: "P2010" }),
-    );
-    const err = await setStripeWebhookSecret(FIXTURE_ORG, SECRET, await observed(FIXTURE_ORG)).catch((e: unknown) => e);
-    expect(err).toBeInstanceOf(StripeConnectionStoreError);
-    expect(err).toMatchObject({ message: "stripe connection store call failed", uniqueViolation: false });
-    expect((err as Error).cause).toBeUndefined();
-    expect(JSON.stringify(err)).not.toContain("SeNtInEl");
-  });
-
-  it("walks every row with a non-positive page size instead of looping", async () => {
-    setBuild({ VERCEL_ENV: "production" });
-    await connect(FIXTURE_ORG);
-    expect(await rekeyStripeConnections({ pageSize: 0 })).toMatchObject({ ok: true, scanned: 1 });
-  });
-});
-
-// ─── AC-10 — the cipher and the rekey walk ──────────────────────────────────
-
-/** The envelope with a 12-byte tag, which decrypt must refuse. */
-function shortTagValue(plaintext: string, organizationId: string, key: Buffer): string {
-  const iv = randomBytes(12);
-  const cipher = createCipheriv("aes-256-gcm", key, iv, { authTagLength: 12 });
-  cipher.setAAD(Buffer.from(`stripe-connection:v1:${organizationId}:credential`, "utf8"));
-  const ciphertext = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
-  return ["v1", iv.toString("base64url"), cipher.getAuthTag().toString("base64url"), ciphertext.toString("base64url")].join(".");
-}
-
-describe("the cipher (#8907 D2, AC-10)", () => {
-  it("binds a value to its Organization and its field", () => {
-    const stored = encryptStripeConnectionValue(testKey(), FIXTURE_ORG, "credential", KEY_A);
-    expect(decryptStripeConnectionValue(stored, FIXTURE_ORG, "credential")).toBe(testKey());
-    expect(decryptStripeConnectionValue(stored, FIXTURE_ORG_2, "credential")).toBeNull();
-    expect(decryptStripeConnectionValue(stored, FIXTURE_ORG, "webhook-secret:test")).toBeNull();
-    const secret = encryptStripeConnectionValue(SECRET, FIXTURE_ORG, "webhook-secret:test", KEY_A);
-    expect(decryptStripeConnectionValue(secret, FIXTURE_ORG, "webhook-secret:live")).toBeNull();
-  });
-
-  it("refuses a value with a 12-byte tag", () => {
-    const stored = shortTagValue(testKey(), FIXTURE_ORG, KEY_A);
-    expect(decryptStripeConnectionValue(stored, FIXTURE_ORG, "credential")).toBeNull();
-  });
-});
-
-describe("rekeyStripeConnections (#8907 D13, AC-10)", () => {
-  // The walk runs on a production build only.
-  beforeEach(() => setBuild({ VERCEL_ENV: "production" }));
-
-  async function seedUnderA(): Promise<Map<string, Date>> {
-    wipe(FIXTURE_ORG);
-    await connect(FIXTURE_ORG);
-    await setStripeWebhookSecret(FIXTURE_ORG, SECRET, await observed(FIXTURE_ORG));
-    await connect(FIXTURE_ORG_2, testKey("f".repeat(24)));
-    return new Map(rows().map((r) => [r.organizationId as string, r.updatedAt as Date]));
-  }
-
-  function everyValueDecrypts(): boolean {
-    return rows().every(
-      (r) =>
-        decryptStripeConnectionValue(r.credentialCiphertext as string, r.organizationId as string, "credential") !== null &&
-        (r.webhookSecretCiphertext === null ||
-          decryptStripeConnectionValue(r.webhookSecretCiphertext as string, r.organizationId as string, "webhook-secret:test") !== null),
-    );
-  }
-
-  it("rotates every row once, keeps each row's updatedAt, and is idempotent", async () => {
-    const updatedAt = await seedUnderA();
-    Object.assign(config, { STRIPE_CONNECTION_KEY: KEY_B, STRIPE_CONNECTION_KEY_PREVIOUS: KEY_A });
-    expect(everyValueDecrypts()).toBe(true);
-
-    const first = await rekeyStripeConnections({ pageSize: 1 });
-    expect(first).toEqual({
-      ok: true,
-      scanned: 2,
-      current: 0,
-      rekeyed: 2,
-      changed: 0,
-      unreadable: 0,
-      remaining: 0,
-    });
-
-    Object.assign(config, { STRIPE_CONNECTION_KEY_PREVIOUS: undefined });
-    expect(everyValueDecrypts()).toBe(true);
-    for (const row of rows()) {
-      expect(row.updatedAt).toEqual(updatedAt.get(row.organizationId as string));
-    }
-
-    const second = await rekeyStripeConnections();
-    expect(second).toMatchObject({ ok: true, rekeyed: 0, current: 2, remaining: 0 });
-  });
-
-  it("leaves a row an owner replaced mid-walk alone, as changed", async () => {
-    await seedUnderA();
-    Object.assign(config, { STRIPE_CONNECTION_KEY: KEY_B, STRIPE_CONNECTION_KEY_PREVIOUS: KEY_A });
-    const replacement = encryptStripeConnectionValue(testKey("g".repeat(24)), FIXTURE_ORG, "credential", KEY_B);
-    const originalFindMany = db.stripeConnection.findMany.getMockImplementation()!;
-    db.stripeConnection.findMany.mockImplementationOnce(async (args: Row) => {
-      const page = await originalFindMany(args);
-      Object.assign(rowOf(FIXTURE_ORG)!, { credentialCiphertext: replacement, updatedAt: new Date(Date.now() + 5000) });
-      return page;
-    });
-    const result = await rekeyStripeConnections();
-    expect(result).toMatchObject({ ok: true, rekeyed: 1, changed: 1, remaining: 1 });
-    expect(rowOf(FIXTURE_ORG)!.credentialCiphertext).toBe(replacement);
-  });
-
-  it("counts a row under a third key unreadable, leaves it untouched, and keeps remaining at 0", async () => {
-    await seedUnderA();
-    const foreign = encryptStripeConnectionValue(testKey(), FIXTURE_ORG_2, "credential", KEY_C);
-    Object.assign(rowOf(FIXTURE_ORG_2)!, { credentialCiphertext: foreign });
-    Object.assign(config, { STRIPE_CONNECTION_KEY: KEY_B, STRIPE_CONNECTION_KEY_PREVIOUS: KEY_A });
-    const result = await rekeyStripeConnections();
-    expect(result).toMatchObject({ ok: true, rekeyed: 1, unreadable: 1, remaining: 0 });
-    expect(rowOf(FIXTURE_ORG_2)!.credentialCiphertext).toBe(foreign);
-    expect(mockLoggerError).toHaveBeenCalledWith(
-      { organizationId: FIXTURE_ORG_2, reason: "credential_unreadable" },
-      expect.any(String),
-    );
-  });
-
-  it("refuses to run off production, reading and writing nothing", async () => {
-    await seedUnderA();
-    const before = JSON.stringify(rows());
-    Object.assign(config, { STRIPE_CONNECTION_KEY: KEY_B, STRIPE_CONNECTION_KEY_PREVIOUS: KEY_A });
-    for (const env of [{}, { VERCEL_ENV: "preview" }, { VERCEL: "1" }]) {
-      setBuild(env);
-      db.stripeConnection.findMany.mockClear();
-      const result = await rekeyStripeConnections();
-      expect(result).toEqual({ ok: false, reason: "not_production" });
-      expect(formatRekeyReport(result)).toBe("[stripe-connections-rekey] not_production");
-      expect(db.stripeConnection.findMany).not.toHaveBeenCalled();
-    }
-    expect(JSON.stringify(rows())).toBe(before);
-  });
-
-  it("needs the current key", async () => {
-    Object.assign(config, { STRIPE_CONNECTION_KEY: undefined });
-    expect(await rekeyStripeConnections()).toEqual({ ok: false, reason: "key_not_configured" });
-  });
-
-  it("reports counts only", async () => {
-    await seedUnderA();
-    const line = formatRekeyReport(await rekeyStripeConnections());
-    expect(line).toMatch(
-      /^\[stripe-connections-rekey\] scanned=\d+ current=\d+ rekeyed=\d+ changed=\d+ unreadable=\d+ remaining=\d+$/,
-    );
-  });
-});
-
-// ─── AC-13 — the use-time client ────────────────────────────────────────────
-
-const ORG_A = FIXTURE_ORG;
-const ORG_B = FIXTURE_ORG_2;
-
-describe("stripeClientForOrganization (#8907 D12, AC-13)", () => {
-  beforeEach(() => {
-    db.__db.stripeConnection = [];
-    const base = { keyLast4: "LLLL", webhookSecretCiphertext: null, createdAt: new Date(), updatedAt: new Date() };
-    rows().push(
-      {
-        ...base,
-        id: "stripecon_a",
-        organizationId: ORG_A,
-        mode: "live",
-        liveAt: new Date("2026-10-18T09:00:00.000Z"),
-        webhookToken: "A".repeat(43),
-        credentialCiphertext: encryptStripeConnectionValue(liveKey(), ORG_A, "credential", KEY_A),
-      },
-      {
-        ...base,
-        id: "stripecon_b",
-        organizationId: ORG_B,
-        mode: "test",
-        liveAt: null,
-        webhookToken: "B".repeat(43),
-        credentialCiphertext: encryptStripeConnectionValue(liveKey(), ORG_B, "credential", KEY_A),
-      },
-    );
-  });
-
-  it("serves a live Organization and refuses a test one holding a live key, never touching the process flag", async () => {
-    setBuild({ VERCEL_ENV: "production" });
-    expect(stripeLib.stripeKeyMode()).toBe("test");
-    const a = await stripeClientForOrganization(ORG_A);
-    expect(a).toMatchObject({ kind: "ok", mode: "live" });
-    expect(await stripeClientForOrganization(ORG_B)).toEqual({ kind: "unusable" });
-    expect(mockLoggerWarn).toHaveBeenCalledWith(
-      { organizationId: ORG_B, reason: "connection_mode_mismatch" },
-      expect.any(String),
-    );
-    expect(stripeLib.stripeKeyMode()).toBe("test");
-  });
-
-  it("refuses a live row on Vercel with no VERCEL_ENV before any decrypt", async () => {
-    setBuild({ VERCEL: "1" });
-    (createDecipheriv as jest.Mock).mockClear();
-    expect(await stripeClientForOrganization(ORG_A)).toEqual({ kind: "unusable" });
-    expect(createDecipheriv).not.toHaveBeenCalled();
-  });
-
-  it("refuses a credential that does not decrypt, and answers none with no row", async () => {
-    Object.assign(rowOf(ORG_B)!, {
-      credentialCiphertext: encryptStripeConnectionValue(testKey(), ORG_B, "credential", KEY_C),
-    });
-    expect(await stripeClientForOrganization(ORG_B)).toEqual({ kind: "unusable" });
-    expect(mockLoggerError).toHaveBeenCalledWith(
-      { organizationId: ORG_B, reason: "credential_unreadable" },
-      expect.any(String),
-    );
-    db.__db.stripeConnection = [];
-    expect(await stripeClientForOrganization(ORG_A)).toEqual({ kind: "none" });
-  });
-
-  it("names no process admission in the connection path, and passes the strict predicate once", () => {
-    // Composed, so this file never names the admission call it polices. The
-    // billing route's half is checked in that route's own suite, which ships
-    // with the multi-tenant slice that delivers the route (#9179).
-    const processFlags = new RegExp(
-      [["admit", "Live", "Restricted", "Key"].join(""), "stripeKeyMode", "liveKeyAdmitted"].join("|"),
-    );
-    expect(readFileSync(join(REPO_ROOT, "apps/api/src/services/offerings/connection.ts"), "utf8")).not.toMatch(
-      processFlags,
-    );
-    const lib = readFileSync(join(REPO_ROOT, "apps/api/src/lib/stripe.ts"), "utf8");
-    expect(lib.match(/productionBuild:/g)).toEqual(["productionBuild:"]);
-    expect(lib).toContain("productionBuild: isProductionBuild()");
-  });
-});
-
-// ─── #9285 AC-8, AC-9 — the environment key's owner ─────────────────────────
-
-describe("the environment Stripe key and the Organization that owns it (#9285 AC-8, AC-9)", () => {
-  const saved = {
-    key: process.env["STRIPE_SECRET_KEY"],
-    modules: process.env["AILK_ENABLED_MODULES"],
-    owner: process.env["STRIPE_ENV_ORGANIZATION_ID"],
-  };
-  const restore = (name: string, value: string | undefined) => {
-    if (value === undefined) delete process.env[name];
-    else process.env[name] = value;
-  };
-
-  beforeEach(() => {
-    db.__db.stripeConnection = [];
-    mockGetStripeClient.mockReset().mockImplementation(() => actualStripe.getStripeClient());
-    process.env["STRIPE_SECRET_KEY"] = testKey();
-    process.env["AILK_ENABLED_MODULES"] = "multi-tenant";
-    delete process.env["STRIPE_ENV_ORGANIZATION_ID"];
-  });
-  afterAll(() => {
-    restore("STRIPE_SECRET_KEY", saved.key);
-    restore("AILK_ENABLED_MODULES", saved.modules);
-    restore("STRIPE_ENV_ORGANIZATION_ID", saved.owner);
-  });
-
-  it("with the multi-tenant module, only the Organization STRIPE_ENV_ORGANIZATION_ID names owns it", () => {
-    // Unset: nobody owns it (fail closed).
-    expect(organizationOwnsEnvironmentStripeKey(ORG_A)).toBe(false);
-    expect(organizationOwnsEnvironmentStripeKey(ORG_B)).toBe(false);
-    // Blank or whitespace: nobody.
-    for (const blank of ["", "   "]) {
-      process.env["STRIPE_ENV_ORGANIZATION_ID"] = blank;
-      expect(organizationOwnsEnvironmentStripeKey(ORG_A)).toBe(false);
-    }
-    // Naming no Organization: nobody.
-    process.env["STRIPE_ENV_ORGANIZATION_ID"] = "org_unknown";
-    expect(organizationOwnsEnvironmentStripeKey(ORG_A)).toBe(false);
-    // Naming one: that one alone.
-    process.env["STRIPE_ENV_ORGANIZATION_ID"] = ORG_A;
-    expect(organizationOwnsEnvironmentStripeKey(ORG_A)).toBe(true);
-    expect(organizationOwnsEnvironmentStripeKey(ORG_B)).toBe(false);
-  });
-
-  it("without the multi-tenant module, the single Organization owns it and the variable is not read", () => {
-    process.env["AILK_ENABLED_MODULES"] = "";
-    process.env["STRIPE_ENV_ORGANIZATION_ID"] = "org_unknown";
-    expect(organizationOwnsEnvironmentStripeKey(ORG_A)).toBe(true);
-    delete process.env["AILK_ENABLED_MODULES"];
-    expect(organizationOwnsEnvironmentStripeKey(ORG_B)).toBe(true);
-  });
-
-  it("reports the source and the Offerings state to the owner alone, and never a key class it cannot sell through", async () => {
-    process.env["STRIPE_ENV_ORGANIZATION_ID"] = ORG_A;
-    expect(getEnvironmentStripeSource(ORG_A)).toEqual({ source: "environment", mode: "test" });
-    expect(await getOfferingsConnectionState(ORG_A)).toBe("environment");
-    expect(getEnvironmentStripeSource(ORG_B)).toBeNull();
-    expect(await getOfferingsConnectionState(ORG_B)).toBeNull();
-    // No usable key class: no source, even for the owner.
-    process.env["STRIPE_SECRET_KEY"] = ["pk", "test", "a".repeat(24)].join("_");
-    expect(getEnvironmentStripeSource(ORG_A)).toBeNull();
-    expect(await getOfferingsConnectionState(ORG_A)).toBeNull();
-  });
-
-  it("lets a stored connection win over the environment state", async () => {
-    process.env["STRIPE_ENV_ORGANIZATION_ID"] = ORG_A;
-    const now = new Date();
-    rows().push({
-      id: "stripecon_a",
-      organizationId: ORG_A,
-      mode: "test",
-      liveAt: null,
-      keyLast4: "aaaa",
-      webhookToken: "A".repeat(43),
-      webhookSecretCiphertext: null,
-      credentialCiphertext: encryptStripeConnectionValue(testKey(), ORG_A, "credential", KEY_A),
-      createdAt: now,
-      updatedAt: now,
-    });
-    expect(await getOfferingsConnectionState(ORG_A)).toMatchObject({ mode: "test", last4: "aaaa" });
-  });
-
-  it("sells an Organization with no stored row through the environment client, and no other", async () => {
-    process.env["STRIPE_ENV_ORGANIZATION_ID"] = ORG_A;
-    const owned = await stripeClientForOrganization(ORG_A);
-    expect(owned).toMatchObject({ kind: "ok", mode: "test" });
-    expect(await stripeClientForOrganization(ORG_B)).toEqual({ kind: "none" });
-    // The per-key factory is never used for the environment key.
-    expect(mockStripeClientForConnection).not.toHaveBeenCalled();
-  });
-
-  it("answers unusable when the owner's key is one the process refuses", async () => {
-    process.env["STRIPE_ENV_ORGANIZATION_ID"] = ORG_A;
-    mockGetStripeClient.mockImplementationOnce(() => {
-      throw new Error("refused");
-    });
-    expect(await stripeClientForOrganization(ORG_A)).toEqual({ kind: "unusable" });
-  });
-});