payment-kit 1.29.1 → 1.29.3

package/api/src/store/models/product-vendor.ts

@@ -1,12 +1,15 @@
 /* eslint-disable @typescript-eslint/lines-between-class-members */
-import { CreationOptional, DataTypes, InferAttributes, InferCreationAttributes, Model } from 'sequelize';
+import { CreationOptional, DataTypes, InferAttributes, InferCreationAttributes } from 'sequelize';
+import { TenantModel } from '../tenant-model';
+import { getInstanceDid } from '../../libs/context';
 
 import { createIdGenerator } from '../../libs/util';
 
 export const nextProductVendorId = createIdGenerator('pv', 24);
 
-export class ProductVendor extends Model<InferAttributes<ProductVendor>, InferCreationAttributes<ProductVendor>> {
+export class ProductVendor extends TenantModel<InferAttributes<ProductVendor>, InferCreationAttributes<ProductVendor>> {
   declare id: CreationOptional<string>;
+  declare instance_did?: string; // tenant column (Phase 1, W1-1a), nullable until Phase 2 backfill; scoped queries land in Phase 3
   declare vendor_key: string;
   declare vendor_type: string;
   declare name: string;
@@ -35,7 +38,8 @@ export class ProductVendor extends Model<InferAttributes<ProductVendor>, InferCr
     vendor_key: {
       type: DataTypes.STRING(50),
       allowNull: false,
-      unique: true,
+      // uniqueness is per tenant since Phase 2 (decision D3):
+      // uq_product_vendors_tenant_key ON (instance_did, vendor_key)
     },
     vendor_type: {
       type: DataTypes.STRING(50),
@@ -98,13 +102,19 @@ export class ProductVendor extends Model<InferAttributes<ProductVendor>, InferCr
   };
 
   public static initialize(sequelize: any) {
-    this.init(ProductVendor.GENESIS_ATTRIBUTES, {
-      sequelize,
-      modelName: 'ProductVendor',
-      tableName: 'product_vendors',
-      createdAt: 'created_at',
-      updatedAt: 'updated_at',
-    });
+    this.init(
+      {
+        ...ProductVendor.GENESIS_ATTRIBUTES,
+        instance_did: { type: DataTypes.STRING(64), allowNull: true, defaultValue: () => getInstanceDid() },
+      },
+      {
+        sequelize,
+        modelName: 'ProductVendor',
+        tableName: 'product_vendors',
+        createdAt: 'created_at',
+        updatedAt: 'updated_at',
+      }
+    );
   }
 }
 

package/api/src/store/models/product.ts

@@ -1,9 +1,11 @@
 /* eslint-disable @typescript-eslint/lines-between-class-members */
 import pick from 'lodash/pick';
-import { CreationOptional, DataTypes, InferAttributes, InferCreationAttributes, Model, Sequelize } from 'sequelize';
+import { CreationOptional, DataTypes, InferAttributes, InferCreationAttributes, Sequelize } from 'sequelize';
 import type { LiteralUnion } from 'type-fest';
+import { TenantModel } from '../tenant-model';
+import { getInstanceDid } from '../../libs/context';
 
-import { createEvent } from '../../libs/audit';
+import { createEvent, reportAuditFailure } from '../../libs/audit';
 import { createIdGenerator } from '../../libs/util';
 
 export const nextProductId = createIdGenerator('prod', 14);
@@ -11,13 +13,14 @@ export const nextProductId = createIdGenerator('prod', 14);
 export type ProductFeature = { name: string };
 
 // @link https://stripe.com/docs/api/products
-export class Product extends Model<InferAttributes<Product>, InferCreationAttributes<Product>> {
+export class Product extends TenantModel<InferAttributes<Product>, InferCreationAttributes<Product>> {
   // Unique identifier for the object.
   declare id: CreationOptional<string>;
 
   // Whether the product is currently available for purchase.
   declare active: boolean;
   declare livemode: boolean;
+  declare instance_did?: string; // tenant column (Phase 1, W1-1a), nullable until Phase 2 backfill; scoped queries land in Phase 3
   declare locked: CreationOptional<boolean>;
 
   declare type: LiteralUnion<'service' | 'good' | 'credit', string>;
@@ -154,6 +157,12 @@ export class Product extends Model<InferAttributes<Product>, InferCreationAttrib
     this.init(
       {
         ...Product.GENESIS_ATTRIBUTES,
+        instance_did: {
+          type: DataTypes.STRING(64),
+          allowNull: true,
+          // bare creates must still land in the active tenant (single mode = app DID)
+          defaultValue: () => getInstanceDid(),
+        },
         cross_sell: {
           type: DataTypes.JSON,
           allowNull: true,
@@ -171,13 +180,13 @@ export class Product extends Model<InferAttributes<Product>, InferCreationAttrib
         updatedAt: 'updated_at',
         hooks: {
           afterCreate: (model: Product, options) => {
-            createEvent('Product', 'product.created', model, options).catch(console.error);
+            createEvent('Product', 'product.created', model, options).catch(reportAuditFailure);
           },
           afterUpdate: (model: Product, options) => {
-            createEvent('Product', 'product.updated', model, options).catch(console.error);
+            createEvent('Product', 'product.updated', model, options).catch(reportAuditFailure);
           },
           afterDestroy: (model: Product, options) => {
-            createEvent('Product', 'product.deleted', model, options).catch(console.error);
+            createEvent('Product', 'product.deleted', model, options).catch(reportAuditFailure);
           },
         },
       }

package/api/src/store/models/promotion-code.ts

@@ -4,7 +4,6 @@ import {
   DataTypes,
   InferAttributes,
   InferCreationAttributes,
-  Model,
   Op,
   FindOptions,
   WhereOptions,
@@ -12,19 +11,22 @@ import {
 import { fromTokenToUnit } from '@ocap/util';
 
 import type { LiteralUnion } from 'type-fest';
+import { TenantModel } from '../tenant-model';
+import { getInstanceDid } from '../../libs/context';
 import { createIdGenerator, formatMetadata } from '../../libs/util';
 import { trimDecimals } from '../../libs/math-utils';
 import type { NFTConfig, Restrictions, VCConfig, VerificationType } from './types';
 import type { TPaymentCurrency } from './payment-currency';
-import { createEvent } from '../../libs/audit';
+import { createEvent, reportAuditFailure } from '../../libs/audit';
 
 const nextId = createIdGenerator('promo', 24);
 
 // @link https://stripe.com/docs/api/promotion_codes
 // eslint-disable-next-line prettier/prettier
-export class PromotionCode extends Model<InferAttributes<PromotionCode>, InferCreationAttributes<PromotionCode>> {
+export class PromotionCode extends TenantModel<InferAttributes<PromotionCode>, InferCreationAttributes<PromotionCode>> {
   declare id: CreationOptional<string>;
   declare livemode: boolean;
+  declare instance_did?: string; // tenant column (Phase 1, W1-1a), nullable until Phase 2 backfill; scoped queries land in Phase 3
   declare active: boolean;
   declare locked: CreationOptional<boolean>;
 
@@ -127,6 +129,12 @@ export class PromotionCode extends Model<InferAttributes<PromotionCode>, InferCr
     this.init(
       {
         ...PromotionCode.GENESIS_ATTRIBUTES,
+        instance_did: {
+          type: DataTypes.STRING(64),
+          allowNull: true,
+          // bare creates must still land in the active tenant (single mode = app DID)
+          defaultValue: () => getInstanceDid(),
+        },
         verification_type: {
           type: DataTypes.ENUM('code', 'nft', 'vc', 'user_restricted'),
           defaultValue: 'code',
@@ -157,13 +165,13 @@ export class PromotionCode extends Model<InferAttributes<PromotionCode>, InferCr
         updatedAt: 'updated_at',
         hooks: {
           afterCreate: (model: PromotionCode, options) => {
-            createEvent('PromotionCode', 'promotion_code.created', model, options).catch(console.error);
+            createEvent('PromotionCode', 'promotion_code.created', model, options).catch(reportAuditFailure);
           },
           afterUpdate: (model: PromotionCode, options) => {
-            createEvent('PromotionCode', 'promotion_code.updated', model, options).catch(console.error);
+            createEvent('PromotionCode', 'promotion_code.updated', model, options).catch(reportAuditFailure);
           },
           afterDestroy: (model: PromotionCode, options) => {
-            createEvent('PromotionCode', 'promotion_code.deleted', model, options).catch(console.error);
+            createEvent('PromotionCode', 'promotion_code.deleted', model, options).catch(reportAuditFailure);
           },
         },
       }

package/api/src/store/models/refund.ts

@@ -1,10 +1,12 @@
 /* eslint-disable @typescript-eslint/lines-between-class-members */
 /* eslint-disable @typescript-eslint/indent */
 import { BN } from '@ocap/util';
-import { CreationOptional, DataTypes, InferAttributes, InferCreationAttributes, Model, Op, Sequelize } from 'sequelize';
+import { CreationOptional, DataTypes, InferAttributes, InferCreationAttributes, Op, Sequelize } from 'sequelize';
 import type { LiteralUnion } from 'type-fest';
+import { TenantModel } from '../tenant-model';
+import { getInstanceDid } from '../../libs/context';
 
-import { createEvent, createStatusEvent } from '../../libs/audit';
+import { createEvent, createStatusEvent, reportAuditFailure } from '../../libs/audit';
 import { createIdGenerator } from '../../libs/util';
 import type { GroupedBN, PaymentDetails, PaymentError } from './types';
 
@@ -12,11 +14,12 @@ export const nextRefundId = createIdGenerator('re', 24);
 
 // @link https://stripe.com/docs/api/payment_intents
 // eslint-disable-next-line prettier/prettier
-export class Refund extends Model<InferAttributes<Refund>, InferCreationAttributes<Refund>> {
+export class Refund extends TenantModel<InferAttributes<Refund>, InferCreationAttributes<Refund>> {
   // Unique identifier for the object.
   declare id: CreationOptional<string>;
 
   declare livemode: boolean;
+  declare instance_did?: string; // tenant column (Phase 1, W1-1a), nullable until Phase 2 backfill; scoped queries land in Phase 3
   declare description: string;
 
   declare amount: string;
@@ -188,6 +191,12 @@ export class Refund extends Model<InferAttributes<Refund>, InferCreationAttribut
     this.init(
       {
         ...Refund.GENESIS_ATTRIBUTES,
+        instance_did: {
+          type: DataTypes.STRING(64),
+          allowNull: true,
+          // bare creates must still land in the active tenant (single mode = app DID)
+          defaultValue: () => getInstanceDid(),
+        },
         payment_method_id: {
           type: DataTypes.STRING(30),
           allowNull: true,
@@ -211,7 +220,7 @@ export class Refund extends Model<InferAttributes<Refund>, InferCreationAttribut
         updatedAt: 'updated_at',
         hooks: {
           afterCreate: (model: Refund, options) => {
-            createEvent('Refund', 'refund.created', model, options).catch(console.error);
+            createEvent('Refund', 'refund.created', model, options).catch(reportAuditFailure);
           },
           afterUpdate: (model: Refund, options) => {
             createStatusEvent(
@@ -220,10 +229,10 @@ export class Refund extends Model<InferAttributes<Refund>, InferCreationAttribut
               { canceled: 'canceled', processing: 'processing', succeeded: 'succeeded' },
               model,
               options
-            ).catch(console.error);
+            ).catch(reportAuditFailure);
           },
           afterDestroy: (model: Refund, options) => {
-            createEvent('Refund', 'refund.deleted', model, options).catch(console.error);
+            createEvent('Refund', 'refund.deleted', model, options).catch(reportAuditFailure);
           },
         },
       }

package/api/src/store/models/revenue-snapshot.ts

@@ -1,13 +1,19 @@
 /* eslint-disable @typescript-eslint/lines-between-class-members */
-import { CreationOptional, DataTypes, InferAttributes, InferCreationAttributes, Model } from 'sequelize';
+import { CreationOptional, DataTypes, InferAttributes, InferCreationAttributes } from 'sequelize';
+import { TenantModel } from '../tenant-model';
+import { getInstanceDid } from '../../libs/context';
 
 import { createIdGenerator } from '../../libs/util';
 
 const nextId = createIdGenerator('rs', 24);
 
-export class RevenueSnapshot extends Model<InferAttributes<RevenueSnapshot>, InferCreationAttributes<RevenueSnapshot>> {
+export class RevenueSnapshot extends TenantModel<
+  InferAttributes<RevenueSnapshot>,
+  InferCreationAttributes<RevenueSnapshot>
+> {
   declare id: CreationOptional<string>;
   declare livemode: boolean;
+  declare instance_did?: string; // tenant column (Phase 1, W1-1a), nullable until Phase 2 backfill; scoped queries land in Phase 3
   declare currency_id: string;
 
   declare timestamp: number;
@@ -95,13 +101,19 @@ export class RevenueSnapshot extends Model<InferAttributes<RevenueSnapshot>, Inf
   };
 
   public static initialize(sequelize: any) {
-    this.init(RevenueSnapshot.GENESIS_ATTRIBUTES, {
-      sequelize,
-      modelName: 'RevenueSnapshot',
-      tableName: 'revenue_snapshots',
-      createdAt: 'created_at',
-      updatedAt: 'updated_at',
-    });
+    this.init(
+      {
+        ...RevenueSnapshot.GENESIS_ATTRIBUTES,
+        instance_did: { type: DataTypes.STRING(64), allowNull: true, defaultValue: () => getInstanceDid() },
+      },
+      {
+        sequelize,
+        modelName: 'RevenueSnapshot',
+        tableName: 'revenue_snapshots',
+        createdAt: 'created_at',
+        updatedAt: 'updated_at',
+      }
+    );
   }
 
   public static associate() {}

package/api/src/store/models/setting.ts

@@ -1,5 +1,7 @@
 /* eslint-disable @typescript-eslint/lines-between-class-members */
-import { CreationOptional, DataTypes, InferAttributes, InferCreationAttributes, Model } from 'sequelize';
+import { CreationOptional, DataTypes, InferAttributes, InferCreationAttributes } from 'sequelize';
+import { TenantModel } from '../tenant-model';
+import { getInstanceDid } from '../../libs/context';
 
 import { createIdGenerator } from '../../libs/util';
 import type { SettingType } from './types';
@@ -7,10 +9,11 @@ import type { SettingType } from './types';
 const nextId = createIdGenerator('set', 24);
 
 // eslint-disable-next-line prettier/prettier
-export class Setting extends Model<InferAttributes<Setting>, InferCreationAttributes<Setting>> {
+export class Setting extends TenantModel<InferAttributes<Setting>, InferCreationAttributes<Setting>> {
   declare id: CreationOptional<string>;
 
   declare livemode: boolean;
+  declare instance_did?: string; // tenant column (Phase 1, W1-1a), nullable until Phase 2 backfill; scoped queries land in Phase 3
 
   declare type: SettingType;
   declare mount_location: string;
@@ -71,13 +74,19 @@ export class Setting extends Model<InferAttributes<Setting>, InferCreationAttrib
   };
 
   public static initialize(sequelize: any) {
-    this.init(Setting.GENESIS_ATTRIBUTES, {
-      sequelize,
-      modelName: 'Setting',
-      tableName: 'settings',
-      createdAt: 'created_at',
-      updatedAt: 'updated_at',
-    });
+    this.init(
+      {
+        ...Setting.GENESIS_ATTRIBUTES,
+        instance_did: { type: DataTypes.STRING(64), allowNull: true, defaultValue: () => getInstanceDid() },
+      },
+      {
+        sequelize,
+        modelName: 'Setting',
+        tableName: 'settings',
+        createdAt: 'created_at',
+        updatedAt: 'updated_at',
+      }
+    );
   }
 }
 

package/api/src/store/models/setup-intent.ts

@@ -1,9 +1,11 @@
 /* eslint-disable @typescript-eslint/lines-between-class-members */
 /* eslint-disable @typescript-eslint/indent */
-import { CreationOptional, DataTypes, InferAttributes, InferCreationAttributes, Model } from 'sequelize';
+import { CreationOptional, DataTypes, InferAttributes, InferCreationAttributes } from 'sequelize';
 import type { LiteralUnion } from 'type-fest';
+import { TenantModel } from '../tenant-model';
+import { getInstanceDid } from '../../libs/context';
 
-import { createEvent, createStatusEvent } from '../../libs/audit';
+import { createEvent, createStatusEvent, reportAuditFailure } from '../../libs/audit';
 import { createIdGenerator } from '../../libs/util';
 import type { PaymentDetails, PaymentError, PaymentMethodOptions } from './types';
 
@@ -11,11 +13,12 @@ const nextId = createIdGenerator('seti', 24);
 
 // @link https://stripe.com/docs/api/setup_intents
 // eslint-disable-next-line prettier/prettier
-export class SetupIntent extends Model<InferAttributes<SetupIntent>, InferCreationAttributes<SetupIntent>> {
+export class SetupIntent extends TenantModel<InferAttributes<SetupIntent>, InferCreationAttributes<SetupIntent>> {
   // Unique identifier for the object.
   declare id: CreationOptional<string>;
 
   declare livemode: boolean;
+  declare instance_did?: string; // tenant column (Phase 1, W1-1a), nullable until Phase 2 backfill; scoped queries land in Phase 3
   declare description: string;
 
   declare currency_id: string;
@@ -156,31 +159,37 @@ export class SetupIntent extends Model<InferAttributes<SetupIntent>, InferCreati
   };
 
   public static initialize(sequelize: any) {
-    this.init(SetupIntent.GENESIS_ATTRIBUTES, {
-      sequelize,
-      modelName: 'SetupIntent',
-      tableName: 'setup_intents',
-      createdAt: 'created_at',
-      updatedAt: 'updated_at',
-      hooks: {
-        afterCreate: (model: SetupIntent, options) => {
-          createEvent('SetupIntent', 'setup_intent.created', model, options).catch(console.error);
-        },
-        afterUpdate: (model: SetupIntent, options) => {
-          createStatusEvent(
-            'SetupIntent',
-            'setup_intent',
-            {
-              requires_action: 'requires_action',
-              canceled: 'canceled',
-              succeeded: 'succeeded',
-            },
-            model,
-            options
-          ).catch(console.error);
-        },
+    this.init(
+      {
+        ...SetupIntent.GENESIS_ATTRIBUTES,
+        instance_did: { type: DataTypes.STRING(64), allowNull: true, defaultValue: () => getInstanceDid() },
       },
-    });
+      {
+        sequelize,
+        modelName: 'SetupIntent',
+        tableName: 'setup_intents',
+        createdAt: 'created_at',
+        updatedAt: 'updated_at',
+        hooks: {
+          afterCreate: (model: SetupIntent, options) => {
+            createEvent('SetupIntent', 'setup_intent.created', model, options).catch(reportAuditFailure);
+          },
+          afterUpdate: (model: SetupIntent, options) => {
+            createStatusEvent(
+              'SetupIntent',
+              'setup_intent',
+              {
+                requires_action: 'requires_action',
+                canceled: 'canceled',
+                succeeded: 'succeeded',
+              },
+              model,
+              options
+            ).catch(reportAuditFailure);
+          },
+        },
+      }
+    );
   }
 
   public static associate(models: any) {

package/api/src/store/models/subscription-item.ts

@@ -1,14 +1,20 @@
 /* eslint-disable @typescript-eslint/lines-between-class-members */
-import { CreationOptional, DataTypes, InferAttributes, InferCreationAttributes, Model } from 'sequelize';
+import { CreationOptional, DataTypes, InferAttributes, InferCreationAttributes } from 'sequelize';
+import { TenantModel } from '../tenant-model';
+import { getInstanceDid } from '../../libs/context';
 
 import { createIdGenerator } from '../../libs/util';
 
 export const nextSubscriptionItemId = createIdGenerator('si', 14);
 
 // eslint-disable-next-line prettier/prettier
-export class SubscriptionItem extends Model<InferAttributes<SubscriptionItem>, InferCreationAttributes<SubscriptionItem>> {
+export class SubscriptionItem extends TenantModel<
+  InferAttributes<SubscriptionItem>,
+  InferCreationAttributes<SubscriptionItem>
+> {
   declare id: CreationOptional<string>;
   declare livemode: boolean;
+  declare instance_did?: string; // tenant column (Phase 1, W1-1a), nullable until Phase 2 backfill; scoped queries land in Phase 3
 
   // The identifier of the subscription this item belongs to.
   declare subscription_id: string;
@@ -74,13 +80,19 @@ export class SubscriptionItem extends Model<InferAttributes<SubscriptionItem>, I
   };
 
   public static initialize(sequelize: any) {
-    this.init(SubscriptionItem.GENESIS_ATTRIBUTES, {
-      sequelize,
-      modelName: 'SubscriptionItem',
-      tableName: 'subscription_items',
-      createdAt: 'created_at',
-      updatedAt: 'updated_at',
-    });
+    this.init(
+      {
+        ...SubscriptionItem.GENESIS_ATTRIBUTES,
+        instance_did: { type: DataTypes.STRING(64), allowNull: true, defaultValue: () => getInstanceDid() },
+      },
+      {
+        sequelize,
+        modelName: 'SubscriptionItem',
+        tableName: 'subscription_items',
+        createdAt: 'created_at',
+        updatedAt: 'updated_at',
+      }
+    );
   }
 
   public static associate(models: any) {

package/api/src/store/models/subscription-schedule.ts

@@ -1,6 +1,8 @@
 /* eslint-disable @typescript-eslint/lines-between-class-members */
-import { CreationOptional, DataTypes, InferAttributes, InferCreationAttributes, Model } from 'sequelize';
+import { CreationOptional, DataTypes, InferAttributes, InferCreationAttributes } from 'sequelize';
 import type { LiteralUnion } from 'type-fest';
+import { TenantModel } from '../tenant-model';
+import { getInstanceDid } from '../../libs/context';
 
 import { createIdGenerator } from '../../libs/util';
 import type { SubscriptionSchedulePhase } from './types';
@@ -8,10 +10,14 @@ import type { SubscriptionSchedulePhase } from './types';
 const nextId = createIdGenerator('ss', 24);
 
 // eslint-disable-next-line prettier/prettier
-export class SubscriptionSchedule extends Model<InferAttributes<SubscriptionSchedule>, InferCreationAttributes<SubscriptionSchedule>> {
+export class SubscriptionSchedule extends TenantModel<
+  InferAttributes<SubscriptionSchedule>,
+  InferCreationAttributes<SubscriptionSchedule>
+> {
   declare id: CreationOptional<string>;
 
   declare livemode: boolean;
+  declare instance_did?: string; // tenant column (Phase 1, W1-1a), nullable until Phase 2 backfill; scoped queries land in Phase 3
 
   declare current_phase: {
     end_date: Date;
@@ -137,13 +143,19 @@ export class SubscriptionSchedule extends Model<InferAttributes<SubscriptionSche
   };
 
   public static initialize(sequelize: any) {
-    this.init(SubscriptionSchedule.GENESIS_ATTRIBUTES, {
-      sequelize,
-      modelName: 'SubscriptionSchedule',
-      tableName: 'subscription_schedules',
-      createdAt: 'created_at',
-      updatedAt: 'updated_at',
-    });
+    this.init(
+      {
+        ...SubscriptionSchedule.GENESIS_ATTRIBUTES,
+        instance_did: { type: DataTypes.STRING(64), allowNull: true, defaultValue: () => getInstanceDid() },
+      },
+      {
+        sequelize,
+        modelName: 'SubscriptionSchedule',
+        tableName: 'subscription_schedules',
+        createdAt: 'created_at',
+        updatedAt: 'updated_at',
+      }
+    );
   }
 
   public static associate(models: any) {

package/api/src/store/models/subscription.ts

@@ -1,9 +1,11 @@
 /* eslint-disable @typescript-eslint/indent */
 /* eslint-disable @typescript-eslint/lines-between-class-members */
-import { CreationOptional, DataTypes, InferAttributes, InferCreationAttributes, Model, Sequelize } from 'sequelize';
+import { CreationOptional, DataTypes, InferAttributes, InferCreationAttributes, Sequelize } from 'sequelize';
 import type { LiteralUnion } from 'type-fest';
+import { TenantModel } from '../tenant-model';
+import { getInstanceDid } from '../../libs/context';
 
-import { createCustomEvent, createEvent, createStatusEvent } from '../../libs/audit';
+import { createCustomEvent, createEvent, createStatusEvent, reportAuditFailure } from '../../libs/audit';
 import logger from '../../libs/logger';
 import { createIdGenerator } from '../../libs/util';
 import { Invoice } from './invoice';
@@ -20,10 +22,11 @@ export const nextSubscriptionId = createIdGenerator('sub', 24);
 
 // FIXME: subscription settings https://dashboard.stripe.com/settings/billing/automatic
 // eslint-disable-next-line prettier/prettier
-export class Subscription extends Model<InferAttributes<Subscription>, InferCreationAttributes<Subscription>> {
+export class Subscription extends TenantModel<InferAttributes<Subscription>, InferCreationAttributes<Subscription>> {
   declare id: CreationOptional<string>;
 
   declare livemode: boolean;
+  declare instance_did?: string; // tenant column (Phase 1, W1-1a), nullable until Phase 2 backfill; scoped queries land in Phase 3
 
   declare currency_id: string;
   declare customer_id: string;
@@ -299,6 +302,12 @@ export class Subscription extends Model<InferAttributes<Subscription>, InferCrea
     this.init(
       {
         ...Subscription.GENESIS_ATTRIBUTES,
+        instance_did: {
+          type: DataTypes.STRING(64),
+          allowNull: true,
+          // bare creates must still land in the active tenant (single mode = app DID)
+          defaultValue: () => getInstanceDid(),
+        },
         proration_behavior: {
           type: DataTypes.ENUM('always_invoice', 'create_prorations', 'none'),
           defaultValue: 'none',
@@ -369,10 +378,10 @@ export class Subscription extends Model<InferAttributes<Subscription>, InferCrea
         updatedAt: 'updated_at',
         hooks: {
           afterCreate: (model: Subscription, options) => {
-            createEvent('Subscription', 'customer.subscription.created', model, options).catch(console.error);
+            createEvent('Subscription', 'customer.subscription.created', model, options).catch(reportAuditFailure);
           },
           afterUpdate: async (model: Subscription, options) => {
-            createEvent('Subscription', 'customer.subscription.updated', model, options).catch(console.error);
+            createEvent('Subscription', 'customer.subscription.updated', model, options).catch(reportAuditFailure);
 
             if (model.trial_start) {
               const previousLatestInvoiceId = model.previous('latest_invoice_id');
@@ -389,7 +398,9 @@ export class Subscription extends Model<InferAttributes<Subscription>, InferCrea
                 });
                 if (count === 2) {
                   // 当且仅当 有试用期的订阅更新了 && 恰好有 2 次账单,此时订阅的试用期刚好结束
-                  createEvent('Subscription', 'customer.subscription.trial_end', model, options).catch(console.error);
+                  createEvent('Subscription', 'customer.subscription.trial_end', model, options).catch(
+                    reportAuditFailure
+                  );
                 }
               }
             }
@@ -400,9 +411,9 @@ export class Subscription extends Model<InferAttributes<Subscription>, InferCrea
               { canceled: 'deleted', past_due: 'past_due' },
               model,
               options
-            ).catch(console.error);
+            ).catch(reportAuditFailure);
             createCustomEvent('Subscription', 'customer.subscription', getSubscriptionEventType, model, options).catch(
-              console.error
+              reportAuditFailure
             );
           },
         },
@@ -482,11 +493,11 @@ export class Subscription extends Model<InferAttributes<Subscription>, InferCrea
     if (this.trial_end && this.trial_end > Date.now() / 1000) {
       if (this.status !== 'trialing') {
         await this.update({ status: 'trialing' });
-        createEvent('Subscription', 'customer.subscription.trial_start', this).catch(console.error);
+        createEvent('Subscription', 'customer.subscription.trial_start', this).catch(reportAuditFailure);
       }
     } else {
       await this.update({ status: 'active' });
-      createEvent('Subscription', 'customer.subscription.started', this).catch(console.error);
+      createEvent('Subscription', 'customer.subscription.started', this).catch(reportAuditFailure);
     }
 
     return true;