payment-kit 1.29.1 → 1.29.3

package/api/src/index.ts

@@ -1,168 +1,29 @@
-import 'express-async-errors';
-
-import path from 'path';
-
-import { fallback } from '@blocklet/sdk/lib/middlewares/fallback';
-import cookieParser from 'cookie-parser';
-import cors from 'cors';
+// Blocklet server shell — Phase 7 (W2-0); express→hono Phase 4.
+//
+// Service assembly lives in ./bootstrap (shared with the dev shell ../dev.ts).
+// This file is the PRODUCTION entry (api/dist/index.js): build the service and
+// LISTEN the hono app via @hono/node-server `serve({ fetch })`, then start
+// background services in the listen callback. Other hosts import
+// @arcblock/payment-service and own listen/lifecycle themselves.
+//
+// Phase 4: the loopback bridge + express app shell are gone — the hono app
+// (service.fetch) serves every route natively (resource domains + DID-Connect +
+// production static/SPA fallback). The dev client + HMR are served by ../dev.ts
+// (a connect shell), never by this production entry.
 import dotenv from 'dotenv-flow';
-import express, { ErrorRequestHandler } from 'express';
-// eslint-disable-next-line import/no-extraneous-dependencies
-import { CustomError, formatError, getStatusFromError } from '@blocklet/error';
-import { csrf } from '@blocklet/sdk/lib/middlewares';
-import { cdn } from '@blocklet/sdk/lib/middlewares/cdn';
-import { xss } from '@blocklet/xss';
-
-import { syncCurrencyLogo } from './crons/currency';
-import crons from './crons/index';
-import { ensureStakedForGas } from './integrations/arcblock/stake';
-import { initResourceHandler } from './integrations/blocklet/resource';
-import { initUserHandler } from './integrations/blocklet/user';
-import { ensureWebhookRegistered } from './integrations/stripe/setup';
-import { handlers } from './libs/auth';
-import logger, { setupAccessLogger } from './libs/logger';
-import { contextMiddleware, ensureI18n } from './libs/middleware';
-import { ensureCreateOverdraftProtectionPrices } from './libs/overdraft-protection';
-import { initEventBroadcast } from './libs/ws';
-import { startCheckoutSessionQueue } from './queues/checkout-session';
-import { startCreditConsumeQueue } from './queues/credit-consume';
-import { startCreditGrantQueue } from './queues/credit-grant';
-import { startReconciliationQueue } from './queues/credit-reconciliation';
-import { startDiscountStatusQueue } from './queues/discount-status';
-import { startEventQueue } from './queues/event';
-import { startExchangeRateHealthQueue } from './queues/exchange-rate-health';
-import { startInvoiceQueue } from './queues/invoice';
-import { startNotificationQueue } from './queues/notification';
-import { startPaymentQueue } from './queues/payment';
-import { startPayoutQueue } from './queues/payout';
-import { startRefundQueue } from './queues/refund';
-import { startUploadBillingInfoListener } from './queues/space';
-import { startSubscriptionQueue } from './queues/subscription';
-import { startTokenTransferQueue } from './queues/token-transfer';
-import { startVendorCommissionQueue } from './queues/vendors/commission';
-import { startVendorFulfillmentQueue } from './queues/vendors/fulfillment';
-import { startCoordinatedFulfillmentQueue } from './queues/vendors/fulfillment-coordinator';
-import routes from './routes';
-import autoRechargeAuthorizationHandlers from './routes/connect/auto-recharge-auth';
-import changePaymentHandlers from './routes/connect/change-payment';
-import changePlanHandlers from './routes/connect/change-plan';
-import collectHandlers from './routes/connect/collect';
-import collectBatchHandlers from './routes/connect/collect-batch';
-import delegationHandlers from './routes/connect/delegation';
-import overdraftProtectionHandlers from './routes/connect/overdraft-protection';
-import payHandlers from './routes/connect/pay';
-import reStakeHandlers from './routes/connect/re-stake';
-import rechargeHandlers from './routes/connect/recharge';
-import rechargeAccountHandlers from './routes/connect/recharge-account';
-import setupHandlers from './routes/connect/setup';
-import subscribeHandlers from './routes/connect/subscribe';
-import changePayerHandlers from './routes/connect/change-payer';
-import { initialize } from './store/models';
-import { sequelize } from './store/sequelize';
+import { serve } from '@hono/node-server';
 
 dotenv.config();
 
-initialize(sequelize);
-
-export const app = express();
-setupAccessLogger(app);
-app.set('trust proxy', true);
-app.use(cookieParser());
-app.use((req, res, next) => {
-  if (req.originalUrl.startsWith('/api/integrations/stripe/webhook')) {
-    next();
-  } else {
-    express.json({ limit: '1 mb' })(req, res, next);
-  }
-});
-app.use(express.urlencoded({ extended: true, limit: '1 mb' }));
-app.use(cors());
-app.use(xss({ allowedKeys: [] }));
-app.use(csrf());
-app.use(ensureI18n());
-app.use(cdn());
-
-const router = express.Router();
-handlers.attach(Object.assign({ app: router }, collectHandlers));
-handlers.attach(Object.assign({ app: router }, collectBatchHandlers));
-handlers.attach(Object.assign({ app: router }, payHandlers));
-handlers.attach(Object.assign({ app: router }, setupHandlers));
-handlers.attach(Object.assign({ app: router }, subscribeHandlers));
-handlers.attach(Object.assign({ app: router }, changePaymentHandlers));
-handlers.attach(Object.assign({ app: router }, changePlanHandlers));
-handlers.attach(Object.assign({ app: router }, rechargeHandlers));
-handlers.attach(Object.assign({ app: router }, rechargeAccountHandlers));
-handlers.attach(Object.assign({ app: router }, delegationHandlers));
-handlers.attach(Object.assign({ app: router }, overdraftProtectionHandlers));
-handlers.attach(Object.assign({ app: router }, reStakeHandlers));
-handlers.attach(Object.assign({ app: router }, autoRechargeAuthorizationHandlers));
-handlers.attach(Object.assign({ app: router }, changePayerHandlers));
-router.use('/api', routes);
-
-const isProduction = process.env.BLOCKLET_MODE === 'production';
-
-app.use(contextMiddleware);
-app.use(router);
-
-if (isProduction) {
-  const staticDir = path.resolve(process.env.BLOCKLET_APP_DIR!, 'dist');
-  app.use(express.static(staticDir, { maxAge: '30d', index: false }));
-  app.use(fallback('index.html', { root: staticDir }));
-}
-
-// eslint-disable-next-line @typescript-eslint/no-unused-vars
-app.use(<ErrorRequestHandler>((err, req, res, _next) => {
-  logger.error('handle router error', err);
-  if (err instanceof CustomError) {
-    res.status(getStatusFromError(err)).json({ error: formatError(err) });
-    return;
-  }
-  if (req.accepts('json')) {
-    res.status(500).send({ error: err.message });
-  } else {
-    res.status(500).send('Something broke!');
-  }
-}));
-
-const port = parseInt(process.env.BLOCKLET_PORT!, 10);
-
-export const server = app.listen(port, (err?: any) => {
-  if (err) throw err;
-  logger.info(`> payment-kit ready on ${port}`);
-
-  syncCurrencyLogo();
-  ensureCreateOverdraftProtectionPrices();
-  startPaymentQueue().then(() => logger.info('payment queue started'));
-  startInvoiceQueue().then(() => logger.info('invoice queue started'));
-  startSubscriptionQueue().then(() => logger.info('subscription queue started'));
-  startEventQueue().then(() => logger.info('event queue started'));
-  startPayoutQueue().then(() => logger.info('payout queue started'));
-  startVendorCommissionQueue().then(() => logger.info('vendor commission queue started'));
-  startVendorFulfillmentQueue().then(() => logger.info('vendor fulfillment queue started'));
-  startCoordinatedFulfillmentQueue().then(() => logger.info('coordinated fulfillment queue started'));
-  startCheckoutSessionQueue().then(() => logger.info('checkoutSession queue started'));
-  startNotificationQueue().then(() => logger.info('notification queue started'));
-  startRefundQueue().then(() => logger.info('refund queue started'));
-  startCreditConsumeQueue().then(() => logger.info('credit queue started'));
-  startCreditGrantQueue().then(() => logger.info('credit grant queue started'));
-  startTokenTransferQueue().then(() => logger.info('token transfer queue started'));
-  startReconciliationQueue().then(() => logger.info('credit reconciliation queue started'));
-  startDiscountStatusQueue().then(() => logger.info('discount status queue started'));
-  startExchangeRateHealthQueue();
-  logger.info('exchange rate health queue started');
-  startUploadBillingInfoListener();
-
-  if (process.env.BLOCKLET_MODE === 'production') {
-    ensureWebhookRegistered().catch(console.error);
-  }
-
-  ensureStakedForGas().catch(console.error);
-
-  crons.init();
+// eslint-disable-next-line import/first
+import { buildService, onListening } from './bootstrap';
 
-  initEventBroadcast();
+const { service, port } = buildService();
 
-  initResourceHandler();
+// @hono/node-server serve(): the listeningListener is the exact equivalent of the
+// old express app.listen(port, cb) — it fires once the socket is bound, which is
+// where background services start. serve() returns the underlying Node Server
+// (used by dev tooling for HMR upgrades and by lifecycle teardown).
+export const server = serve({ fetch: service.fetch, port }, (info) => onListening(service, info.port));
 
-  initUserHandler();
-});
+export { service };

package/api/src/integrations/app-store/client.ts

@@ -18,6 +18,7 @@
 // Tests replace this class via jest mocks.
 
 import { config as configApple, validate as validateAppleReceipt } from 'node-apple-receipt-verify';
+import { appStoreWriteEnabled } from '../../libs/env';
 
 import logger from '../../libs/logger';
 import {
@@ -112,8 +113,6 @@ export type AppStoreSettings = {
   private_key_pem?: string;
 };
 
-const WRITE_ENABLED = process.env.APP_STORE_WRITE_ENABLED === 'true';
-
 export class AppStoreClient {
   declare readonly bundleId: string;
 
@@ -348,7 +347,7 @@ export class AppStoreClient {
   /** Refund — Apple actually doesn't let third parties refund subscriptions; this is here for symmetry with GooglePlayClient. */
   // eslint-disable-next-line class-methods-use-this, require-await
   public async refundSubscription(originalTransactionId: string): Promise<void> {
-    if (!WRITE_ENABLED) {
+    if (!appStoreWriteEnabled()) {
       throw new Error(
         `refundSubscription(${originalTransactionId}) is gated behind APP_STORE_WRITE_ENABLED env. Note: Apple Server API has no third-party refund endpoint — refunds must be requested by the end user via reportProblem.apple.com or by Apple support.`
       );
@@ -359,7 +358,7 @@ export class AppStoreClient {
   /** Cancel — same caveat as refund: Apple expects the user to cancel via App Store > Subscriptions. */
   // eslint-disable-next-line class-methods-use-this, require-await
   public async cancelSubscription(originalTransactionId: string): Promise<void> {
-    if (!WRITE_ENABLED) {
+    if (!appStoreWriteEnabled()) {
       throw new Error(
         `cancelSubscription(${originalTransactionId}) is gated behind APP_STORE_WRITE_ENABLED env. Apple does not expose a server-initiated cancel — the user must cancel from their device.`
       );

package/api/src/integrations/app-store/handlers/subscription.ts

@@ -10,7 +10,7 @@
 // `transactionId` changes per charge. We store both in payment_details for
 // audit, but uniqueness/de-dup keys off originalTransactionId.
 
-import { createEvent } from '../../../libs/audit';
+import { createEvent, reportAuditFailure } from '../../../libs/audit';
 import logger from '../../../libs/logger';
 import { Customer, PaymentMethod, Price, Subscription, SubscriptionItem } from '../../../store/models';
 import {
@@ -156,7 +156,7 @@ export async function ingestVerifiedAppStorePurchase({
         }
       }
       await existing.update(updatePatch);
-      createEvent('Subscription', 'customer.subscription.started', existing).catch(console.error);
+      createEvent('Subscription', 'customer.subscription.started', existing).catch(reportAuditFailure);
       logger.info('app_store verify: reactivated lapsed subscription from fresh transaction', {
         subscriptionId: existing.id,
         originalTransactionId: transaction.originalTransactionId,
@@ -331,7 +331,7 @@ export async function ingestVerifiedAppStorePurchase({
     } as any);
   }
 
-  createEvent('Subscription', 'customer.subscription.started', subscription).catch(console.error);
+  createEvent('Subscription', 'customer.subscription.started', subscription).catch(reportAuditFailure);
   logger.info('app_store verify: subscription created', {
     subscriptionId: subscription.id,
     customerId: customer.id,
@@ -545,7 +545,7 @@ async function handleAppStoreSubscribed({
     pending_invoice_item_interval: { interval: 'month', interval_count: 1 } as any,
   } as any);
 
-  createEvent('Subscription', 'customer.subscription.started', subscription).catch(console.error);
+  createEvent('Subscription', 'customer.subscription.started', subscription).catch(reportAuditFailure);
   logger.info('app_store SUBSCRIBED — subscription created from webhook', {
     subscriptionId: subscription.id,
     customerId: customer.id,
@@ -574,13 +574,13 @@ async function handleAppStoreRenewed(
       },
     },
   });
-  createEvent('Subscription', 'customer.subscription.started', subscription).catch(console.error);
+  createEvent('Subscription', 'customer.subscription.started', subscription).catch(reportAuditFailure);
 }
 
 async function markAppStoreExpired(subscription: Subscription): Promise<void> {
   if (['canceled', 'incomplete_expired'].includes(subscription.status as string)) return;
   await subscription.update({ status: 'canceled', ended_at: Math.floor(Date.now() / 1000) });
-  createEvent('Subscription', 'customer.subscription.deleted', subscription).catch(console.error);
+  createEvent('Subscription', 'customer.subscription.deleted', subscription).catch(reportAuditFailure);
 }
 
 async function markAppStorePastDue(subscription: Subscription): Promise<void> {
@@ -631,5 +631,5 @@ async function handleAppStoreRevoked(
     refunded: isRefund,
   });
 
-  createEvent('Subscription', 'customer.subscription.deleted', subscription).catch(console.error);
+  createEvent('Subscription', 'customer.subscription.deleted', subscription).catch(reportAuditFailure);
 }

package/api/src/integrations/app-store/signed-data-verifier.ts

@@ -26,6 +26,7 @@ import type {
 } from '@apple/app-store-server-library';
 
 import logger from '../../libs/logger';
+import { appStoreSkipSignatureVerify, isProduction } from '../../libs/env';
 import { APPLE_ROOT_CERTS } from './apple-root-certs';
 
 const verifierCache = new Map<string, SignedDataVerifier>();
@@ -46,13 +47,13 @@ async function getVerifier(bundleId: string, environment: 'production' | 'sandbo
 }
 
 export function isSignatureVerificationSkipped(): boolean {
-  if (process.env.APP_STORE_SKIP_SIGNATURE_VERIFY !== 'true') return false;
+  if (!appStoreSkipSignatureVerify()) return false;
   // Production fail-closed: even when the bypass flag is set we refuse to
   // honor it in production, and log loudly so the misconfiguration is
   // visible. The flag exists for unit tests / local sandbox debugging where
   // the synthetic JWS isn't signed by Apple; in production it would silently
   // downgrade a critical trust boundary to decode-only (CWE-347).
-  if (process.env.BLOCKLET_MODE === 'production') {
+  if (isProduction()) {
     logger.error(
       'app_store: APP_STORE_SKIP_SIGNATURE_VERIFY=true ignored in production — JWS signature verification stays enabled'
     );

package/api/src/integrations/arcblock/token.ts

@@ -5,16 +5,30 @@ import { BN, fromTokenToUnit, fromUnitToToken, toBN, toBase58, toBase64 } from '
 import { types } from '@ocap/mcrypto';
 import { verify as verifyVC } from '@arcblock/vc';
 import { BlockletService } from '@blocklet/sdk/service/blocklet';
+import env, { blockletAppHost } from '../../libs/env';
 
 import { PaymentMethod } from '../../store/models';
 import type { TPaymentCurrency } from '../../store/models';
 import { wallet } from '../../libs/auth';
 import logger from '../../libs/logger';
-import env from '../../libs/env';
 import { sleep } from '../../libs/util';
 import { getGasPayerExtra } from '../../libs/payment';
 
-const blockletService = new BlockletService();
+// Lazy singleton: `new BlockletService()` runs `checkBlockletEnvironment()`,
+// which throws unless BLOCKLET_APP_ID/DID/EK/ABT_NODE_* are present. Those env
+// vars only exist inside a blocklet runtime — when payment-core is embedded in
+// a host like arc, constructing this at module-init crashes the whole graph on
+// import. Defer to first use so the import is environment-agnostic; the routing
+// -rule feature (the only consumer) simply requires the host to supply that env
+// when it is actually exercised.
+// eslint-disable-next-line @typescript-eslint/naming-convention -- intentional _-prefixed module singleton
+let _blockletService: InstanceType<typeof BlockletService> | undefined;
+function getBlockletService(): InstanceType<typeof BlockletService> {
+  if (!_blockletService) {
+    _blockletService = new BlockletService();
+  }
+  return _blockletService;
+}
 
 export function isOnchainCredit(paymentCurrency: TPaymentCurrency) {
   return paymentCurrency.type === 'credit' && !!paymentCurrency.token_config;
@@ -154,7 +168,7 @@ async function createTokenVC(data: { tokenAddress: string; symbol: string; websi
  * Step 2: Publish VC (Verifiable Credential) for token via routing rule
  */
 async function publishTokenVC(vc: any) {
-  const { blocklet: blockletInfo } = await blockletService.getBlocklet();
+  const { blocklet: blockletInfo } = await getBlockletService().getBlocklet();
   const site = blockletInfo?.site;
 
   if (!site?.id) {
@@ -226,7 +240,7 @@ async function publishTokenVC(vc: any) {
   try {
     let result;
     if (isUpdate) {
-      result = await blockletService.updateRoutingRule({
+      result = await getBlockletService().updateRoutingRule({
         id: site.id,
         rule: {
           id: existingRule.id,
@@ -234,7 +248,7 @@ async function publishTokenVC(vc: any) {
         },
       });
     } else {
-      result = await blockletService.addRoutingRule({
+      result = await getBlockletService().addRoutingRule({
         id: site.id,
         rule,
       });
@@ -279,7 +293,7 @@ export async function createToken(data: { name: string; symbol: string; decimal?
         name: data.name,
         symbol: data.symbol,
         description: `Token created by ${env.appName || 'Payment Kit'}`,
-        website: env.appUrl || process.env.BLOCKLET_APP_HOST,
+        website: env.appUrl || blockletAppHost(),
         icon: '',
         maxTotalSupply: null,
         decimal: data.decimal ?? 10,
@@ -307,7 +321,7 @@ export async function createToken(data: { name: string; symbol: string; decimal?
     const vc = await createTokenVC({
       tokenAddress: factoryItx.token.address,
       symbol: data.symbol,
-      website: env.appUrl || process.env.BLOCKLET_APP_HOST!,
+      website: env.appUrl || blockletAppHost()!,
       chainId,
     });
 

package/api/src/integrations/google-play/handlers/subscription.ts

@@ -7,7 +7,7 @@
 
 import { Op } from 'sequelize';
 
-import { createEvent } from '../../../libs/audit';
+import { createEvent, reportAuditFailure } from '../../../libs/audit';
 import logger from '../../../libs/logger';
 import { Customer, PaymentMethod, Price, Subscription, SubscriptionItem } from '../../../store/models';
 import { GooglePlayClient, GooglePlaySubscriptionPurchase } from '../client';
@@ -268,12 +268,12 @@ async function handleRenewedOrDeferred({
       },
     },
   });
-  createEvent('Subscription', 'customer.subscription.started', subscription).catch(console.error);
+  createEvent('Subscription', 'customer.subscription.started', subscription).catch(reportAuditFailure);
 }
 
 async function handleResumed(subscription: Subscription): Promise<void> {
   await subscription.update({ status: 'active' });
-  createEvent('Subscription', 'customer.subscription.started', subscription).catch(console.error);
+  createEvent('Subscription', 'customer.subscription.started', subscription).catch(reportAuditFailure);
 }
 
 async function markPastDue(subscription: Subscription): Promise<void> {
@@ -293,7 +293,7 @@ async function scheduleCancelAtPeriodEnd(subscription: Subscription): Promise<vo
 async function markExpired(subscription: Subscription): Promise<void> {
   if (['canceled', 'incomplete_expired'].includes(subscription.status as string)) return;
   await subscription.update({ status: 'canceled', canceled_at: Math.floor(Date.now() / 1000) });
-  createEvent('Subscription', 'customer.subscription.deleted', subscription).catch(console.error);
+  createEvent('Subscription', 'customer.subscription.deleted', subscription).catch(reportAuditFailure);
 }
 
 /**
@@ -526,7 +526,7 @@ export async function ingestVerifiedGooglePlayPurchase({
     return { subscription: winner, isFirstSubscribe: false, purchase };
   }
 
-  createEvent('Subscription', 'customer.subscription.started', subscription).catch(console.error);
+  createEvent('Subscription', 'customer.subscription.started', subscription).catch(reportAuditFailure);
   logger.info('google_play verify: subscription created', {
     subscriptionId: subscription.id,
     customerId: customer.id,
@@ -561,5 +561,5 @@ async function handleRevoked(subscription: Subscription): Promise<void> {
     subscriptionId: subscription.id,
   });
 
-  createEvent('Subscription', 'customer.subscription.deleted', subscription).catch(console.error);
+  createEvent('Subscription', 'customer.subscription.deleted', subscription).catch(reportAuditFailure);
 }

package/api/src/integrations/google-play/handlers/voided.ts

@@ -11,7 +11,7 @@
 //     refundType:  1 = FULL,     2 = QUANTITY_BASED
 //   }
 
-import { createEvent } from '../../../libs/audit';
+import { createEvent, reportAuditFailure } from '../../../libs/audit';
 import logger from '../../../libs/logger';
 import { Subscription } from '../../../store/models';
 
@@ -91,7 +91,7 @@ export async function handleGooglePlayVoidedPurchase({
         google_play_voided_refund_type: refundType,
       },
     });
-    createEvent('Subscription', 'customer.subscription.deleted', subscription).catch(console.error);
+    createEvent('Subscription', 'customer.subscription.deleted', subscription).catch(reportAuditFailure);
   }
 
   // TODO: create a Refund row for audit. Blocked on payment_intent_id schema —

package/api/src/integrations/google-play/verify.ts

@@ -9,6 +9,7 @@
 // Cloudflare Workers（payment-kit 是统一代码）。
 
 import logger from '../../libs/logger';
+import { googlePubsubSkipSignatureVerify, isProduction } from '../../libs/env';
 
 export type PubSubJwtClaims = {
   iss: string;
@@ -80,7 +81,7 @@ export type VerifyOptions = {
 };
 
 function defaultSkipSignature(): boolean {
-  return process.env.GOOGLE_PUBSUB_SKIP_SIGNATURE_VERIFY === 'true';
+  return googlePubsubSkipSignatureVerify();
 }
 
 /**
@@ -93,7 +94,7 @@ function defaultSkipSignature(): boolean {
  */
 function effectiveSkipSignature(requested: boolean): boolean {
   if (!requested) return false;
-  if (process.env.BLOCKLET_MODE === 'production') {
+  if (isProduction()) {
     logger.error(
       'google_play: signature verification skip refused in production — Pub/Sub JWT signature verification stays enabled'
     );

package/api/src/integrations/iap-reconcile.ts

@@ -20,6 +20,7 @@
 // every 5 minutes by default; tuneable via `IAP_RECONCILE_CRON_TIME`.
 
 import { Op } from 'sequelize';
+import { iapReconcileBatchSize } from '../libs/env';
 
 import { createEvent } from '../libs/audit';
 import logger from '../libs/logger';
@@ -30,9 +31,6 @@ import { GooglePlayClient, GooglePlaySubscriptionPurchase } from './google-play/
 /** Don't re-check subs that were updated by a webhook within the last 5 minutes. */
 const RECENT_UPDATE_GUARD_MS = 5 * 60 * 1000;
 
-/** Per-channel batch cap so a single cron tick can't stall on Apple/Google rate limits. */
-const DEFAULT_BATCH_SIZE = Number(process.env.IAP_RECONCILE_BATCH_SIZE ?? '100');
-
 type ReconcileStats = { checked: number; updated: number; errors: number };
 
 const emptyStats = (): ReconcileStats => ({ checked: 0, updated: 0, errors: 0 });
@@ -149,7 +147,7 @@ async function backfillMissingSubscriptionItems(): Promise<void> {
 // App Store
 // ---------------------------------------------------------------------------
 
-export async function reconcileAppStore(batchSize = DEFAULT_BATCH_SIZE): Promise<ReconcileStats> {
+export async function reconcileAppStore(batchSize = iapReconcileBatchSize()): Promise<ReconcileStats> {
   const stats = emptyStats();
   const methods = await PaymentMethod.findAll({ where: { type: 'app_store' } });
   if (methods.length === 0) return stats;
@@ -293,7 +291,7 @@ export async function applyAppStoreTransactionDrift(
 // Google Play
 // ---------------------------------------------------------------------------
 
-export async function reconcileGooglePlay(batchSize = DEFAULT_BATCH_SIZE): Promise<ReconcileStats> {
+export async function reconcileGooglePlay(batchSize = iapReconcileBatchSize()): Promise<ReconcileStats> {
   const stats = emptyStats();
   const methods = await PaymentMethod.findAll({ where: { type: 'google_play' } });
   if (methods.length === 0) return stats;

package/api/src/integrations/stripe/handlers/invoice.ts

@@ -6,7 +6,7 @@ import type Stripe from 'stripe';
 
 import type { WhereOptions } from 'sequelize';
 import { checkUsageReportEmpty } from '../../../libs/subscription';
-import { createEvent } from '../../../libs/audit';
+import { createEvent, reportAuditFailure } from '../../../libs/audit';
 import { getLock } from '../../../libs/lock';
 import logger from '../../../libs/logger';
 import {
@@ -361,7 +361,7 @@ export async function handleStripeInvoiceCreated(event: TEventExpanded, client:
       createEvent('Subscription', 'usage.report.empty', subscription, {
         usageReportStart,
         usageReportEnd,
-      }).catch(console.error);
+      }).catch(reportAuditFailure);
       logger.info('create usage report empty event', {
         subscriptionId: subscription.id,
         usageReportStart,

package/api/src/integrations/stripe/handlers/subscription.ts

@@ -12,7 +12,7 @@ import {
 } from '../../../libs/subscription';
 import { CheckoutSession, PaymentMethod, Subscription, TEventExpanded } from '../../../store/models';
 import { getCheckoutSessionSubscriptionIds } from '../../../libs/session';
-import { createEvent } from '../../../libs/audit';
+import { createEvent, reportAuditFailure } from '../../../libs/audit';
 
 export async function handleStripeSubscriptionSucceed(subscription: Subscription, status: string) {
   if (!subscription.payment_details?.stripe?.subscription_id) {
@@ -51,9 +51,9 @@ export async function handleStripeSubscriptionSucceed(subscription: Subscription
 
   await subscription.update({ status });
   if (subscription.trial_end && subscription.trial_end > Date.now() / 1000 && subscription.status === 'trialing') {
-    createEvent('Subscription', 'customer.subscription.trial_start', subscription).catch(console.error);
+    createEvent('Subscription', 'customer.subscription.trial_start', subscription).catch(reportAuditFailure);
   } else if (subscription.status === 'active') {
-    createEvent('Subscription', 'customer.subscription.started', subscription).catch(console.error);
+    createEvent('Subscription', 'customer.subscription.started', subscription).catch(reportAuditFailure);
   }
   logger.info('subscription become active on stripe event', { id: subscription.id, status: subscription.status });
 

package/api/src/libs/archive/query.ts

@@ -5,9 +5,14 @@ import path from 'path';
 import { QueryTypes, Op } from 'sequelize';
 
 import logger from '../logger';
+import { getInstanceDid } from '../context';
+import { getTenantMode } from '../tenant';
+import { TENANT_TABLES } from '../../store/tenant-tables';
 import { ArchiveMetadata } from '../../store/models/archive-metadata';
 import { listArchiveFiles, openArchiveSequelize } from './store';
 
+const TENANT_TABLE_SET: ReadonlySet<string> = new Set(TENANT_TABLES);
+
 type ArchiveQueryParams = {
   table: string;
   id?: string;
@@ -52,6 +57,20 @@ function buildWhereClause(params: ArchiveQueryParams) {
     replacements.customerId = params.customer_id;
   }
 
+  // 洞 G (Phase 4): archived rows are snapshots of tenant tables — scope the
+  // read by instance_did so an admin can't query another tenant's archive.
+  // multi mode is strict (fail-closed); single mode also accepts legacy
+  // pre-backfill snapshots (instance_did NULL), which all belong to the one
+  // deployment tenant (mirrors the resolveRowTenant single-mode default).
+  if (TENANT_TABLE_SET.has(params.table)) {
+    replacements.instance_did = getInstanceDid();
+    if (getTenantMode() === 'single') {
+      conditions.push('(instance_did = :instance_did OR instance_did IS NULL)');
+    } else {
+      conditions.push('instance_did = :instance_did');
+    }
+  }
+
   return { clause: conditions.join(' AND '), replacements };
 }