npm - payment-kit - Versions diffs - 1.29.1 → 1.29.3 - Mend

payment-kit 1.29.1 → 1.29.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (343) hide show

package/api/dev.ts +41 -2
package/api/hono.d.ts +42 -0
package/api/node-sqlite.d.ts +12 -0
package/api/src/bootstrap.ts +47 -0
package/api/src/crons/base.ts +3 -3
package/api/src/crons/currency.ts +1 -1
package/api/src/crons/index.ts +41 -37
package/api/src/crons/metering-subscription-detection.ts +1 -1
package/api/src/crons/overdue-detection.ts +2 -2
package/api/src/crons/retry-pending-events.ts +6 -0
package/api/src/crons/tenant-fanout.ts +82 -0
package/api/src/host-node/did-connect-runtime-node.ts +33 -0
package/api/src/host-node/serve-static-arc.ts +68 -0
package/api/src/host-node/serve-static.ts +41 -0
package/api/src/index.ts +22 -161
package/api/src/integrations/app-store/client.ts +3 -4
package/api/src/integrations/app-store/handlers/subscription.ts +7 -7
package/api/src/integrations/app-store/signed-data-verifier.ts +3 -2
package/api/src/integrations/arcblock/token.ts +21 -7
package/api/src/integrations/google-play/handlers/subscription.ts +6 -6
package/api/src/integrations/google-play/handlers/voided.ts +2 -2
package/api/src/integrations/google-play/verify.ts +3 -2
package/api/src/integrations/iap-reconcile.ts +3 -5
package/api/src/integrations/stripe/handlers/invoice.ts +2 -2
package/api/src/integrations/stripe/handlers/subscription.ts +3 -3
package/api/src/libs/archive/query.ts +19 -0
package/api/src/libs/audit.ts +61 -4
package/api/src/libs/auth.ts +247 -47
package/api/src/libs/context.ts +89 -1
package/api/src/libs/currency.ts +2 -2
package/api/src/libs/dayjs.ts +8 -2
package/api/src/libs/did-connect/runtime-did-connect-js.ts +88 -0
package/api/src/libs/did-connect/tenant-identity.ts +221 -0
package/api/src/libs/drivers/auth-storage.ts +118 -0
package/api/src/libs/drivers/cron.ts +264 -0
package/api/src/libs/drivers/db.ts +170 -0
package/api/src/libs/drivers/identity.ts +142 -0
package/api/src/libs/drivers/index.ts +40 -0
package/api/src/libs/drivers/locks.ts +226 -0
package/api/src/libs/drivers/migrate-runner.ts +70 -0
package/api/src/libs/drivers/queue.ts +104 -0
package/api/src/libs/drivers/secrets.ts +194 -0
package/api/src/libs/env.ts +170 -54
package/api/src/libs/exchange-rate/service.ts +7 -6
package/api/src/libs/http-fetch-adapter.ts +60 -0
package/api/src/libs/invoice.ts +1 -1
package/api/src/libs/lock.ts +51 -47
package/api/src/libs/logger.ts +48 -8
package/api/src/libs/notification/index.ts +1 -1
package/api/src/libs/notification/template/customer-credit-low-balance.ts +2 -1
package/api/src/libs/notification/template/customer-revenue-succeeded.ts +1 -1
package/api/src/libs/notification/template/customer-reward-succeeded.ts +1 -1
package/api/src/libs/overdraft-protection.ts +1 -1
package/api/src/libs/payout.ts +1 -1
package/api/src/libs/queue/index.ts +271 -52
package/api/src/libs/queue/runtime.ts +175 -0
package/api/src/libs/resource.ts +3 -3
package/api/src/libs/secrets.ts +38 -0
package/api/src/libs/session.ts +3 -2
package/api/src/libs/subscription.ts +5 -5
package/api/src/libs/tenant.ts +92 -0
package/api/src/libs/url.ts +3 -3
package/api/src/libs/util.ts +21 -13
package/api/src/middlewares/hono/cdn.ts +63 -0
package/api/src/middlewares/hono/context.ts +80 -0
package/api/src/middlewares/hono/csrf.ts +83 -0
package/api/src/middlewares/hono/fallback.ts +194 -0
package/api/src/middlewares/hono/pipeline.ts +73 -0
package/api/src/middlewares/hono/resource-mount.ts +42 -0
package/api/src/middlewares/hono/resource.ts +63 -0
package/api/src/middlewares/hono/security.ts +209 -0
package/api/src/middlewares/hono/session.ts +114 -0
package/api/src/middlewares/hono/xss.ts +61 -0
package/api/src/queues/auto-recharge.ts +12 -10
package/api/src/queues/checkout-session.ts +38 -21
package/api/src/queues/credit-consume.ts +40 -36
package/api/src/queues/credit-grant.ts +25 -18
package/api/src/queues/credit-reconciliation.ts +7 -5
package/api/src/queues/discount-status.ts +9 -6
package/api/src/queues/event.ts +41 -11
package/api/src/queues/exchange-rate-health.ts +49 -30
package/api/src/queues/invoice.ts +18 -15
package/api/src/queues/notification.ts +14 -7
package/api/src/queues/payment.ts +64 -37
package/api/src/queues/payout.ts +37 -21
package/api/src/queues/refund.ts +36 -18
package/api/src/queues/subscription.ts +83 -53
package/api/src/queues/token-transfer.ts +15 -10
package/api/src/queues/usage-record.ts +8 -5
package/api/src/queues/vendors/commission.ts +7 -5
package/api/src/queues/vendors/fulfillment-coordinator.ts +17 -13
package/api/src/queues/vendors/fulfillment.ts +4 -2
package/api/src/queues/vendors/return-processor.ts +5 -3
package/api/src/queues/vendors/return-scanner.ts +5 -4
package/api/src/queues/vendors/status-check.ts +10 -7
package/api/src/queues/webhook.ts +60 -32
package/api/src/routes/connect/shared.ts +1 -2
package/api/src/routes/connect/subscribe.ts +3 -3
package/api/src/routes/{archive.ts → hono/archive.ts} +69 -64
package/api/src/routes/{auto-recharge-configs.ts → hono/auto-recharge-configs.ts} +39 -28
package/api/src/routes/{checkout-sessions.ts → hono/checkout-sessions.ts} +790 -923
package/api/src/routes/{coupons.ts → hono/coupons.ts} +93 -76
package/api/src/routes/{credit-grants.ts → hono/credit-grants.ts} +140 -126
package/api/src/routes/hono/credit-tokens.ts +43 -0
package/api/src/routes/{credit-transactions.ts → hono/credit-transactions.ts} +37 -29
package/api/src/routes/{customers.ts → hono/customers.ts} +199 -224
package/api/src/routes/{donations.ts → hono/donations.ts} +41 -32
package/api/src/routes/{entitlements.ts → hono/entitlements.ts} +28 -25
package/api/src/routes/{events.ts → hono/events.ts} +107 -71
package/api/src/routes/{exchange-rate-providers.ts → hono/exchange-rate-providers.ts} +138 -126
package/api/src/routes/hono/exchange-rates.ts +77 -0
package/api/src/routes/hono/index.ts +115 -0
package/api/src/routes/{integrations → hono/integrations}/app-store.ts +68 -48
package/api/src/routes/{integrations → hono/integrations}/google-play.ts +78 -58
package/api/src/routes/hono/integrations/stripe.ts +74 -0
package/api/src/routes/{invoices.ts → hono/invoices.ts} +253 -244
package/api/src/routes/{meter-events.ts → hono/meter-events.ts} +120 -110
package/api/src/routes/hono/meters.ts +288 -0
package/api/src/routes/hono/passports.ts +73 -0
package/api/src/routes/{payment-currencies.ts → hono/payment-currencies.ts} +219 -197
package/api/src/routes/{payment-intents.ts → hono/payment-intents.ts} +136 -132
package/api/src/routes/{payment-links.ts → hono/payment-links.ts} +145 -128
package/api/src/routes/{payment-methods.ts → hono/payment-methods.ts} +125 -93
package/api/src/routes/{payment-stats.ts → hono/payment-stats.ts} +30 -25
package/api/src/routes/{payouts.ts → hono/payouts.ts} +55 -47
package/api/src/routes/{prices.ts → hono/prices.ts} +265 -242
package/api/src/routes/{pricing-table.ts → hono/pricing-table.ts} +94 -87
package/api/src/routes/{products.ts → hono/products.ts} +172 -159
package/api/src/routes/{promotion-codes.ts → hono/promotion-codes.ts} +207 -185
package/api/src/routes/hono/redirect.ts +24 -0
package/api/src/routes/{refunds.ts → hono/refunds.ts} +98 -83
package/api/src/routes/{settings.ts → hono/settings.ts} +64 -55
package/api/src/routes/{subscription-items.ts → hono/subscription-items.ts} +64 -57
package/api/src/routes/{subscriptions.ts → hono/subscriptions.ts} +475 -528
package/api/src/routes/{tax-rates.ts → hono/tax-rates.ts} +71 -70
package/api/src/routes/hono/tool.ts +69 -0
package/api/src/routes/{usage-records.ts → hono/usage-records.ts} +47 -42
package/api/src/routes/{vendor.ts → hono/vendor.ts} +315 -167
package/api/src/routes/{webhook-attempts.ts → hono/webhook-attempts.ts} +17 -13
package/api/src/routes/hono/webhook-endpoints.ts +126 -0
package/api/src/service.ts +814 -0
package/api/src/store/migrations/20230911-seeding.ts +2 -1
package/api/src/store/migrations/20260609-remove-did-space-jobs.ts +23 -0
package/api/src/store/migrations/20260610-tenant-columns.ts +40 -0
package/api/src/store/migrations/20260611-tenant-backfill.ts +33 -0
package/api/src/store/models/auto-recharge-config.ts +22 -10
package/api/src/store/models/checkout-session.ts +15 -14
package/api/src/store/models/coupon.ts +29 -20
package/api/src/store/models/credit-grant.ts +38 -29
package/api/src/store/models/credit-transaction.ts +32 -21
package/api/src/store/models/customer.ts +19 -17
package/api/src/store/models/discount.ts +11 -2
package/api/src/store/models/entitlement-grant.ts +21 -9
package/api/src/store/models/entitlement-product.ts +21 -9
package/api/src/store/models/entitlement.ts +19 -10
package/api/src/store/models/event.ts +18 -9
package/api/src/store/models/exchange-rate-provider.ts +17 -4
package/api/src/store/models/invoice-item.ts +18 -9
package/api/src/store/models/invoice.ts +16 -8
package/api/src/store/models/meter-event.ts +27 -9
package/api/src/store/models/meter.ts +31 -22
package/api/src/store/models/payment-currency.ts +25 -8
package/api/src/store/models/payment-intent.ts +15 -6
package/api/src/store/models/payment-link.ts +15 -6
package/api/src/store/models/payment-method.ts +38 -22
package/api/src/store/models/payment-stat.ts +18 -9
package/api/src/store/models/payout.ts +15 -6
package/api/src/store/models/price-quote.ts +17 -8
package/api/src/store/models/price.ts +24 -12
package/api/src/store/models/pricing-table.ts +29 -20
package/api/src/store/models/product-vendor.ts +20 -10
package/api/src/store/models/product.ts +15 -6
package/api/src/store/models/promotion-code.ts +14 -6
package/api/src/store/models/refund.ts +15 -6
package/api/src/store/models/revenue-snapshot.ts +21 -9
package/api/src/store/models/setting.ts +18 -9
package/api/src/store/models/setup-intent.ts +36 -27
package/api/src/store/models/subscription-item.ts +21 -9
package/api/src/store/models/subscription-schedule.ts +21 -9
package/api/src/store/models/subscription.ts +21 -10
package/api/src/store/models/tax-rate.ts +29 -21
package/api/src/store/models/usage-record.ts +11 -2
package/api/src/store/models/webhook-attempt.ts +18 -9
package/api/src/store/models/webhook-endpoint.ts +18 -9
package/api/src/store/scoped-core.ts +55 -0
package/api/src/store/scoped.ts +247 -0
package/api/src/store/sequelize.ts +82 -23
package/api/src/store/sql-migrations.ts +20 -0
package/api/src/store/tenant-backfill.ts +260 -0
package/api/src/store/tenant-model.ts +124 -0
package/api/src/store/tenant-tables.ts +50 -0
package/api/tests/bootstrap/bootstrap.spec.ts +162 -0
package/api/tests/crons/tenant-fanout.spec.ts +158 -0
package/api/tests/embedded/embedded-multi-mode-d3.spec.ts +257 -0
package/api/tests/fixtures/bare-query-violation.ts +13 -0
package/api/tests/fixtures/core-env-violation.ts +10 -0
package/api/tests/fixtures/host-read-violation.ts +19 -0
package/api/tests/fixtures/tenants.ts +4 -0
package/api/tests/integrations/iap-tenant.spec.ts +284 -0
package/api/tests/libs/archive-query.spec.ts +26 -0
package/api/tests/libs/audit-tenant.spec.ts +153 -0
package/api/tests/libs/context.spec.ts +204 -0
package/api/tests/libs/core-config.spec.ts +115 -0
package/api/tests/libs/cron-driver-d2.spec.ts +237 -0
package/api/tests/libs/crons-conservation-d2.spec.ts +52 -0
package/api/tests/libs/did-connect-runtime-js.spec.ts +98 -0
package/api/tests/libs/did-connect-tenant-identity.spec.ts +159 -0
package/api/tests/libs/lock-tenant.spec.ts +66 -0
package/api/tests/libs/scoped.spec.ts +222 -0
package/api/tests/libs/secrets-facade.spec.ts +52 -0
package/api/tests/libs/service-host.spec.ts +37 -0
package/api/tests/libs/tenancy-slot-authority.spec.ts +209 -0
package/api/tests/libs/tenant-middleware.spec.ts +42 -0
package/api/tests/libs/tenant-scanner.spec.ts +120 -0
package/api/tests/middlewares/hono/cdn.spec.ts +70 -0
package/api/tests/middlewares/hono/context.spec.ts +113 -0
package/api/tests/middlewares/hono/csrf.spec.ts +136 -0
package/api/tests/middlewares/hono/fallback.spec.ts +67 -0
package/api/tests/middlewares/hono/pipeline.spec.ts +47 -0
package/api/tests/middlewares/hono/security.spec.ts +181 -0
package/api/tests/middlewares/hono/session.spec.ts +42 -0
package/api/tests/middlewares/hono/xss.spec.ts +81 -0
package/api/tests/models/tenant-backfill.spec.ts +287 -0
package/api/tests/models/tenant-columns-model.spec.ts +46 -0
package/api/tests/models/tenant-columns.spec.ts +161 -0
package/api/tests/queues/credit-consume-batch.spec.ts +8 -1
package/api/tests/queues/credit-consume.spec.ts +8 -1
package/api/tests/queues/event-tenant.spec.ts +292 -0
package/api/tests/queues/exchange-rate-health-tenant-d6.spec.ts +62 -0
package/api/tests/queues/queue-parity.spec.ts +249 -0
package/api/tests/queues/queue-runtime-surface.spec.ts +277 -0
package/api/tests/queues/queue-teardown-d2.spec.ts +127 -0
package/api/tests/queues/tenant-matrix-a.spec.ts +245 -0
package/api/tests/queues/tenant-matrix-b.spec.ts +168 -0
package/api/tests/routes/connect/hono-attach.spec.ts +107 -0
package/api/tests/service/collapse.spec.ts +96 -0
package/api/tests/service/didconnect-storage-slot.spec.ts +60 -0
package/api/tests/service/fail-closed-http.spec.ts +79 -0
package/api/tests/service/static-arc-handler.spec.ts +101 -0
package/api/tests/service/static-externalized.spec.ts +48 -0
package/api/tests/store/tenant-crosscut.spec.ts +202 -0
package/api/tests/store/tenant-model-spike.spec.ts +177 -0
package/api/tests/store/tenant-model.spec.ts +162 -0
package/api/tests/store/tenant-residual.spec.ts +196 -0
package/api/third.d.ts +4 -0
package/blocklet.yml +1 -1
package/cloudflare/MIGRATION-RUNBOOK.md +3 -8
package/cloudflare/README.md +34 -27
package/cloudflare/STAGING-MIGRATION-GUIDE.md +3 -15
package/cloudflare/build.ts +33 -13
package/cloudflare/cf-adapter.ts +419 -0
package/cloudflare/did-connect-runtime.ts +96 -0
package/cloudflare/did-connect-token-storage.ts +151 -0
package/cloudflare/esbuild-cf-config.cjs +407 -0
package/cloudflare/migrations/0006_tenant_columns.sql +46 -0
package/cloudflare/migrations/0007_tenant_backfill_indexes.sql +65 -0
package/cloudflare/migrations/0008_schema_parity.sql +16 -0
package/cloudflare/migrations/0009_remove_did_space_jobs.sql +5 -0
package/cloudflare/queue-runtime-mode.ts +13 -0
package/cloudflare/run-build.js +33 -403
package/cloudflare/scripts/cf-package-import-probe.mjs +90 -0
package/cloudflare/scripts/didconnect-mock-smoke.mjs +140 -0
package/cloudflare/shims/blocklet-sdk/asset-host-transformer.ts +20 -0
package/cloudflare/shims/blocklet-sdk/config.ts +8 -1
package/cloudflare/shims/blocklet-sdk/login.ts +12 -0
package/cloudflare/shims/blocklet-sdk/service-api.ts +14 -0
package/cloudflare/shims/blocklet-sdk/session.ts +4 -2
package/cloudflare/shims/blocklet-sdk/util-constants.ts +8 -0
package/cloudflare/shims/blocklet-sdk/wallet-authenticator.ts +16 -1
package/cloudflare/shims/blocklet-sdk/wallet-handler.ts +18 -3
package/cloudflare/shims/cron.ts +38 -158
package/cloudflare/shims/events.ts +124 -0
package/cloudflare/shims/fastq.ts +15 -1
package/cloudflare/shims/nedb-storage.ts +16 -8
package/cloudflare/shims/xss.ts +8 -0
package/cloudflare/tenant-middleware.ts +36 -0
package/cloudflare/tests/cf-adapter.spec.ts +244 -0
package/cloudflare/tests/did-connect-token-storage.spec.ts +105 -0
package/cloudflare/tests/tenant-middleware.spec.ts +160 -0
package/cloudflare/tests/worker-handler-gate.spec.ts +69 -0
package/cloudflare/vite.config.ts +53 -45
package/cloudflare/worker.ts +261 -448
package/cloudflare/wrangler.json +0 -6
package/cloudflare/wrangler.jsonc +0 -6
package/cloudflare/wrangler.local-e2e.jsonc +25 -0
package/cloudflare/wrangler.staging.json +0 -6
package/jest.config.js +3 -1
package/package.json +33 -38
package/scripts/bootstrap-inject.ts +166 -0
package/scripts/core-env-whitelist.json +1 -0
package/scripts/e2e-12b-runtime.ts +149 -0
package/scripts/e2e-core-config.ts +125 -0
package/scripts/e2e-d1-tenancy.ts +116 -0
package/scripts/e2e-d2-cron-queue.ts +139 -0
package/scripts/e2e-d3-embedded-multi.ts +171 -0
package/scripts/e2e-hono-s2.ts +125 -0
package/scripts/e2e-hono-s3e.ts +135 -0
package/scripts/e2e-hono-s4.ts +114 -0
package/scripts/e2e-migration-contract.ts +100 -0
package/scripts/e2e-s0.ts +61 -0
package/scripts/e2e-s1.ts +107 -0
package/scripts/e2e-s2.ts +178 -0
package/scripts/e2e-s3.ts +110 -0
package/scripts/e2e-s4.ts +191 -0
package/scripts/e2e-s5.ts +139 -0
package/scripts/e2e-s6.ts +127 -0
package/scripts/e2e-tenant-model.ts +119 -0
package/scripts/e2e-tenant-worker.ts +199 -0
package/scripts/gen-sql-migrations.js +46 -0
package/scripts/phase8-codemod.js +219 -0
package/scripts/phase9a-env-getters-codemod.js +82 -0
package/scripts/scan-core-env.js +109 -0
package/scripts/scan-tenant-queries.js +235 -0
package/scripts/schema-drift-guard.ts +210 -0
package/scripts/tenant-scan-whitelist.json +1 -0
package/src/app.tsx +2 -1
package/src/env.d.ts +13 -1
package/src/libs/service-host.ts +13 -0
package/tsconfig.json +1 -1
package/vite.arc.config.ts +159 -0
package/api/src/libs/did-space.ts +0 -235
package/api/src/libs/middleware.ts +0 -50
package/api/src/libs/security.ts +0 -192
package/api/src/queues/space.ts +0 -662
package/api/src/routes/credit-tokens.ts +0 -38
package/api/src/routes/exchange-rates.ts +0 -87
package/api/src/routes/index.ts +0 -142
package/api/src/routes/integrations/stripe.ts +0 -61
package/api/src/routes/meters.ts +0 -274
package/api/src/routes/passports.ts +0 -68
package/api/src/routes/redirect.ts +0 -20
package/api/src/routes/tool.ts +0 -65
package/api/src/routes/webhook-endpoints.ts +0 -126
package/api/tests/routes/credit-grants.spec.ts +0 -1261
package/cloudflare/did-connect-auth.ts +0 -527
package/cloudflare/shims/did-space-js.ts +0 -17
package/cloudflare/shims/did-space.ts +0 -11
package/cloudflare/shims/express-compat/index.ts +0 -80
package/cloudflare/shims/express-compat/types.ts +0 -41
package/cloudflare/shims/lock.ts +0 -115
package/cloudflare/shims/queue.ts +0 -611
package/cloudflare/tests/shims/queue-delayed-persist.spec.ts +0 -87
package/cloudflare/tests/shims/queue-scheduled.spec.ts +0 -186

package/api/tests/service/fail-closed-http.spec.ts ADDED Viewed

@@ -0,0 +1,79 @@
+// TM-4 (frontend-serve P4) — MANDATORY fail-closed regression lock.
+//
+// Project principle #1: in multi-tenant mode a request with no resolvable
+// Host/tenant context MUST fail closed (4xx), never fall back to APP_PID/default
+// tenant. P4 wires a host static/SPA handler onto the full node hono app (after
+// the api/connect routes). This lock proves that slot did NOT weaken the API
+// gate: with createNodeStaticHandler attached, an /api/* request from an unbound
+// host still 400s with TENANT_HOST_UNRESOLVED. Runs in did-pay (no arc dev
+// runtime) — the same buildHonoApp + contextMiddleware the production svc uses.
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { Hono } from 'hono';
+import { getInstanceDid } from '../../src/libs/context';
+import { createDefaultIdentityDriver, type IdentityDriver, setIdentityDriver } from '../../src/libs/drivers/identity';
+import { contextMiddleware, ensureI18n } from '../../src/middlewares/hono/context';
+import { createNodeStaticHandler } from '../../src/host-node/serve-static-arc';
+import { buildHonoApp } from '../../src/service';
+const BOUND = 'did:abt:zBOUNDTENANTAAAAAAAAAAAAAAAAAA';
+const identity: IdentityDriver = {
+  resolveInstanceDidForHost: (host) => (host === 'bound.example' ? BOUND : null),
+};
+let webRoot: string;
+beforeAll(() => {
+  webRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'tm4-web-'));
+  fs.writeFileSync(path.join(webRoot, 'index.html'), '<!doctype html><div id="app"></div>');
+});
+afterAll(() => fs.rmSync(webRoot, { recursive: true, force: true }));
+afterEach(() => {
+  delete process.env.PAYMENT_TENANT_MODE;
+  setIdentityDriver(createDefaultIdentityDriver());
+});
+// the production wiring: native pipeline (with the Host→tenant contextMiddleware)
+// + the host static/SPA slot attached last (exactly buildHonoApp's 3rd arg).
+function buildAppWithStatic(): Hono {
+  return buildHonoApp(
+    (native) => {
+      native.use('*', ensureI18n());
+      native.use('*', contextMiddleware());
+      native.get('/api/settings', (c) => c.json({ tenant: getInstanceDid() }));
+    },
+    undefined,
+    createNodeStaticHandler(webRoot)
+  );
+}
+describe('TM-4 — static slot must not weaken the multi-tenant API gate (P4)', () => {
+  it('multi mode, UNBOUND host: /api/settings → 400 fail-closed (no default-tenant fallback)', async () => {
+    process.env.PAYMENT_TENANT_MODE = 'multi';
+    setIdentityDriver(identity);
+    const app = buildAppWithStatic();
+    const res = await app.fetch(new Request('http://unbound.example/api/settings', { headers: { host: 'unbound.example' } }));
+    expect(res.status).toBe(400);
+    expect((await res.json()).error.code).toBe('TENANT_HOST_UNRESOLVED');
+  });
+  it('multi mode, BOUND host: /api/settings resolves its tenant (gate passes, slot present)', async () => {
+    process.env.PAYMENT_TENANT_MODE = 'multi';
+    setIdentityDriver(identity);
+    const app = buildAppWithStatic();
+    const res = await app.fetch(new Request('http://bound.example/api/settings', { headers: { host: 'bound.example' } }));
+    expect(res.status).toBe(200);
+    expect((await res.json()).tenant).toBe(BOUND);
+  });
+  it('the static slot still serves the SPA shell (html GET) — coexists with the gate', async () => {
+    process.env.PAYMENT_TENANT_MODE = 'multi';
+    setIdentityDriver(identity);
+    const app = buildAppWithStatic();
+    const res = await app.fetch(new Request('http://bound.example/admin', { headers: { host: 'bound.example', accept: 'text/html' } }));
+    expect(res.status).toBe(200);
+    expect(await res.text()).toContain('<div id="app">');
+  });
+});

package/api/tests/service/static-arc-handler.spec.ts ADDED Viewed

@@ -0,0 +1,101 @@
+// P3b (README D3 / F3) — arc-node clean static/SPA handler.
+//
+// Drives createNodeStaticHandler over a real temp webRoot through buildHonoApp's
+// staticHandler slot (the same wiring arc uses), via in-process app.fetch.
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { buildHonoApp } from '../../src/service';
+import { createNodeStaticHandler } from '../../src/host-node/serve-static-arc';
+let webRoot: string;
+beforeAll(() => {
+  webRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'arc-webroot-'));
+  fs.mkdirSync(path.join(webRoot, 'assets'), { recursive: true });
+  // index.html with a build-time bootstrap already baked in (P2) — the handler
+  // must serve this VERBATIM, no server-side re-injection.
+  fs.writeFileSync(
+    path.join(webRoot, 'index.html'),
+    '<!doctype html><html><head><script>window.blocklet={prefix:"/.well-known/payment"}</script></head><body><div id="app"></div></body></html>'
+  );
+  fs.writeFileSync(path.join(webRoot, 'assets', 'app.js'), 'console.log("asset")');
+});
+afterAll(() => {
+  fs.rmSync(webRoot, { recursive: true, force: true });
+});
+const appWith = () => buildHonoApp(undefined, undefined, createNodeStaticHandler(webRoot));
+describe('P3b — createNodeStaticHandler', () => {
+  it('bad-input: throws at construction when webRoot has no index.html', () => {
+    const empty = fs.mkdtempSync(path.join(os.tmpdir(), 'arc-empty-'));
+    expect(() => createNodeStaticHandler(empty)).toThrow(/no index\.html/);
+    fs.rmSync(empty, { recursive: true, force: true });
+  });
+  it('happy: root + deep link return index.html, asset hits the file', async () => {
+    const app = appWith();
+    const root = await app.fetch(new Request('http://h/', { headers: { accept: 'text/html' } }));
+    expect(root.status).toBe(200);
+    expect(await root.text()).toContain('<div id="app">');
+    const deep = await app.fetch(new Request('http://h/admin', { headers: { accept: 'text/html' } }));
+    expect(deep.status).toBe(200);
+    expect(await deep.text()).toContain('<!doctype html');
+    const asset = await app.fetch(new Request('http://h/assets/app.js'));
+    expect(asset.status).toBe(200);
+    expect(await asset.text()).toContain('console.log("asset")');
+  });
+  it('bad-input: non-GET / non-html accept does not return index.html', async () => {
+    const app = appWith();
+    const post = await app.fetch(new Request('http://h/admin', { method: 'POST', headers: { accept: 'text/html' } }));
+    expect(post.status).not.toBe(200);
+    const json = await app.fetch(new Request('http://h/admin', { headers: { accept: 'application/json' } }));
+    expect(await json.text()).not.toContain('<!doctype html');
+  });
+  it('security: asset miss → 404, NOT index.html (RESOURCE_PATTERN, T3b.2)', async () => {
+    const app = appWith();
+    const miss = await app.fetch(new Request('http://h/assets/nope.js'));
+    expect(miss.status).toBe(404);
+    expect(await miss.text()).not.toContain('<!doctype html');
+  });
+  it('security: path traversal never leaks out-of-webRoot files (asset-typed → 404; SPA-typed → index.html, never passwd)', async () => {
+    const app = appWith();
+    const indexHtml = fs.readFileSync(path.join(webRoot, 'index.html'), 'utf8');
+    // asset-typed traversal (serveStatic must reject, never serve outside webRoot)
+    for (const p of ['/assets/..%2f..%2f..%2f..%2fetc%2fpasswd.js', '/assets/../../../../etc/hosts.css']) {
+      const res = await app.fetch(new Request(`http://h${p}`));
+      const body = await res.text();
+      expect(body).not.toMatch(/root:.*:0:0:/); // no /etc/passwd content
+      expect(res.status).toBe(404); // miss, not a leaked file
+    }
+    // SPA-typed traversal (no asset extension) → safe app shell, NOT a host file
+    const spa = await app.fetch(new Request('http://h/../../../../etc/passwd', { headers: { accept: 'text/html' } }));
+    const spaBody = await spa.text();
+    expect(spaBody).not.toMatch(/root:.*:0:0:/);
+    expect(spaBody === indexHtml || spa.status === 404).toBe(true);
+  });
+  it('data-loss: /api/* is NOT swallowed by the static handler (wired last)', async () => {
+    const app = appWith();
+    const res = await app.fetch(new Request('http://h/api/healthz'));
+    expect(res.status).toBe(200);
+    expect(await res.json()).toEqual({ ok: true });
+  });
+  it('data-leak: index.html is served VERBATIM — exactly one window.blocklet (no server-side re-inject, TM-3)', async () => {
+    const app = appWith();
+    const res = await app.fetch(new Request('http://h/dashboard', { headers: { accept: 'text/html' } }));
+    const html = await res.text();
+    expect((html.match(/window\.blocklet\s*=/g) || []).length).toBe(1);
+    // byte-identical to the build artifact
+    expect(html).toBe(fs.readFileSync(path.join(webRoot, 'index.html'), 'utf8'));
+  });
+});

package/api/tests/service/static-externalized.spec.ts ADDED Viewed

@@ -0,0 +1,48 @@
+// S3-CF Phase 1 inversion ① — static/SPA shell externalized from buildHonoApp.
+//
+// The runtime-neutral hono app must NOT wire node-only static serving
+// (@hono/node-server/serve-static + the node:fs fallback) itself — that is what
+// kept `http.fetch` node-bound and forced the CF worker onto a second surface.
+// Instead the HOST injects a `staticHandler` (node blocklet-server replicates
+// today's serving; the CF/standalone worker serves assets via env.ASSETS and
+// injects nothing). This spec locks the delegation.
+import { Hono } from 'hono';
+import { buildHonoApp } from '../../src/service';
+describe('Phase 1 (S3-CF) — static/SPA shell externalized from buildHonoApp', () => {
+  it('serves no static itself — an unmatched html GET 404s when no staticHandler is given', async () => {
+    const app = buildHonoApp();
+    const res = await app.fetch(
+      new Request('http://app.local/some/spa/deeplink', { headers: { accept: 'text/html' } })
+    );
+    // No SPA fallback is wired into the neutral app; the host owns it.
+    expect(res.status).toBe(404);
+  });
+  it('invokes the host-provided staticHandler exactly once with the app, after the api/connect routes', async () => {
+    let called = 0;
+    let received: unknown;
+    const app = buildHonoApp(undefined, undefined, (a: Hono) => {
+      called += 1;
+      received = a;
+      a.get('/__host_static_probe', (c) => c.text('served-by-host'));
+    });
+    expect(called).toBe(1);
+    expect(received).toBe(app);
+    const res = await app.fetch(new Request('http://app.local/__host_static_probe'));
+    expect(res.status).toBe(200);
+    expect(await res.text()).toBe('served-by-host');
+  });
+  it('keeps /api/healthz reachable even with a host staticHandler wired last', async () => {
+    const app = buildHonoApp(undefined, undefined, (a: Hono) => {
+      a.use('*', async (c) => c.text('static-catchall'));
+    });
+    const res = await app.fetch(new Request('http://app.local/api/healthz'));
+    // healthz is registered before the host static catch-all, so it still wins.
+    expect(res.status).toBe(200);
+    expect(await res.json()).toEqual({ ok: true });
+  });
+});

package/api/tests/store/tenant-crosscut.spec.ts ADDED Viewed

@@ -0,0 +1,202 @@
+// Phase 6 (W1′) — cross-cutting tenant isolation CI (two engines, blocking).
+//
+// Not per-route: assert the SAME read-isolation invariant over the WHOLE tenant
+// model surface generically, on BOTH engines:
+//   - real Sequelize (Node): every one of the 38 tenant models — a bare
+//     findAll returns only the active tenant's rows, and a cross-tenant
+//     findByPk returns null (§13.1). Rows are seeded with a raw INSERT (driven
+//     by PRAGMA table_info) so the crosscut is model-agnostic — it exercises
+//     the scoping, not each model's business validators/hooks.
+//   - sequelize-d1 shim (worker): the same invariant on the shim base.
+//   - index hit: a WHERE instance_did = ? equality predicate uses the
+//     idx_<table>_instance_did index (SEARCH), not a full SCAN.
+import { DatabaseSync } from 'node:sqlite';
+import { DataTypes, Sequelize } from 'sequelize';
+import { getDefaultInstanceDid, withTenant } from '../../src/libs/context';
+import { makeTenantModel } from '../../src/store/tenant-model';
+import realModels, { Coupon, initialize } from '../../src/store/models';
+import { TENANT_TABLES } from '../../src/store/tenant-tables';
+import { TENANT_A, TENANT_B } from '../fixtures/tenants';
+const TENANT_TABLE_SET = new Set(TENANT_TABLES);
+const sequelize = new Sequelize('sqlite::memory:', { logging: false });
+initialize(sequelize);
+beforeAll(async () => {
+  await sequelize.sync({ force: true });
+  // raw seeding uses dummy FK values; this test exercises tenant scoping, not
+  // referential integrity, so disable FK enforcement for the inserts.
+  await sequelize.query('PRAGMA foreign_keys = OFF');
+});
+afterAll(() => sequelize.close());
+function dummyForSqlType(type: string, seed: string): string | number {
+  const t = (type || '').toUpperCase();
+  if (/INT/.test(t)) return 0;
+  if (/REAL|FLOA|DOUB|DEC|NUM/.test(t)) return 0;
+  if (/BOOL|TINYINT/.test(t)) return 0;
+  if (/DATE|TIME/.test(t)) return '2024-01-01 00:00:00.000 +00:00';
+  if (/JSON/.test(t)) return '{}';
+  // unique per row+column so a standalone UNIQUE column can't collide across the
+  // two tenant rows we insert.
+  return seed;
+}
+// raw-insert one row for `tenant` into `table`. Returns the value of the
+// single-column `id` PK (null when the table has a composite PK — those skip
+// the findByPk assertion and rely on findAll isolation).
+async function seedRaw(table: string, tenant: string, idVal: string): Promise<string | null> {
+  const cols = (await sequelize.query(`PRAGMA table_info("${table}")`, {
+    type: (DataTypes as any).SELECT ?? 'SELECT',
+  })) as any[];
+  const pkCols = cols.filter((c) => c.pk).map((c) => c.name);
+  const values: Record<string, any> = { instance_did: tenant };
+  for (const c of cols) {
+    if (c.name === 'instance_did') continue;
+    const required = c.notnull === 1 && c.dflt_value === null;
+    if (c.pk) values[c.name] = idVal;
+    else if (required) values[c.name] = dummyForSqlType(c.type, `${idVal}-${c.name}`);
+  }
+  const names = Object.keys(values);
+  await sequelize.query(
+    `INSERT INTO "${table}" (${names.map((n) => `"${n}"`).join(',')}) VALUES (${names.map((n) => `:${n}`).join(',')})`,
+    { replacements: values }
+  );
+  return pkCols.length === 1 && pkCols[0] === 'id' ? idVal : null;
+}
+const tenantModels = Object.values<any>(realModels).filter((m) => TENANT_TABLE_SET.has(m.tableName));
+describe('cross-cut read isolation over all tenant models (real Sequelize)', () => {
+  it('covers all 38 tenant tables', () => {
+    expect(tenantModels.length).toBe(38);
+  });
+  it.each(tenantModels.map((m) => [m.tableName, m]))(
+    '%s: bare findAll returns only active tenant rows; cross-tenant findByPk -> null',
+    async (table: string, Model: any) => {
+      const idA = await seedRaw(table, TENANT_A, `a-${table}`);
+      const idB = await seedRaw(table, TENANT_B, `b-${table}`);
+      // bare findAll under A returns ONLY A's rows — no B row leaks
+      const aRows: any[] = await withTenant(TENANT_A, () => Model.findAll());
+      expect(aRows.length).toBeGreaterThan(0);
+      expect(aRows.every((r) => r.instance_did === TENANT_A)).toBe(true);
+      // cross-tenant findByPk -> null (not-found, §13.1); same-tenant works.
+      // composite-PK tables (idA/idB null) rely on the findAll isolation above.
+      if (idA && idB) {
+        expect(await withTenant(TENANT_A, () => Model.findByPk(idB))).toBeNull();
+        expect(await withTenant(TENANT_A, () => Model.findByPk(idA))).not.toBeNull();
+      }
+    }
+  );
+});
+// ---------------------------------------------------------------------------
+// Second engine: the sequelize-d1 shim (worker runtime) over a node:sqlite fake
+// D1 — the SAME makeTenantModel mechanism on the OTHER base class.
+// ---------------------------------------------------------------------------
+function makeFakeD1(db: DatabaseSync) {
+  const prepare = (sql: string) => {
+    let bound: any[] = [];
+    const stmt: any = {
+      __sql: sql,
+      bind: (...vals: any[]) => {
+        bound = vals;
+        return stmt;
+      },
+      all: () => ({ results: db.prepare(sql).all(...bound), meta: {} }),
+      run: () => {
+        const r = db.prepare(sql).run(...bound);
+        return { meta: { changes: Number(r.changes), last_row_id: Number(r.lastInsertRowid) } };
+      },
+      first: () => db.prepare(sql).get(...bound) ?? null,
+    };
+    return stmt;
+  };
+  return {
+    prepare,
+    batch: async (stmts: any[]) =>
+      stmts.map((s) => {
+        if (/^\s*SELECT/i.test(s.__sql)) return s.all();
+        s.run();
+        return { results: [], meta: {} };
+      }),
+  };
+}
+describe('cross-cut read isolation on the sequelize-d1 shim engine', () => {
+  let ShimWidget: any;
+  const TABLE = 'coupons'; // a real tenant table so isTenantTable() is true and the shim scopes
+  beforeAll(() => {
+    // eslint-disable-next-line global-require, import/no-dynamic-require, @typescript-eslint/no-var-requires
+    const shim = require('../../../cloudflare/shims/sequelize-d1');
+    const db = new DatabaseSync(':memory:');
+    db.exec(`CREATE TABLE ${TABLE} (id TEXT PRIMARY KEY, instance_did TEXT, name TEXT)`);
+    shim.setDB(makeFakeD1(db));
+    ShimWidget = class extends makeTenantModel(shim.Model) {};
+    ShimWidget.init(
+      { id: {}, instance_did: {}, name: {} },
+      { sequelize: { models: {} }, modelName: 'CrosscutWidget', tableName: TABLE }
+    );
+  });
+  it('shim: bare findAll returns only active tenant; cross-tenant findByPk -> null', async () => {
+    await withTenant(TENANT_A, () => ShimWidget.create({ id: 'a1', name: 'a' }));
+    await withTenant(TENANT_B, () => ShimWidget.create({ id: 'b1', name: 'b' }));
+    const aRows: any[] = await withTenant(TENANT_A, () => ShimWidget.findAll());
+    expect(aRows.map((r) => r.id)).toEqual(['a1']);
+    expect(aRows.every((r) => r.instance_did === TENANT_A)).toBe(true);
+    expect(await withTenant(TENANT_A, () => ShimWidget.findByPk('b1'))).toBeNull();
+    expect(await withTenant(TENANT_A, () => ShimWidget.findByPk('a1'))).not.toBeNull();
+  });
+});
+describe('single mode is NOT a passthrough — it injects instance_did = APP_PID', () => {
+  // The single-tenant blocklet-server safety rope: single mode does not "let
+  // bare queries through because there is only one tenant" — it scopes every
+  // query to the default tenant (BLOCKLET_APP_PID). A row stamped with a
+  // DIFFERENT instance_did must NOT be visible in single mode.
+  it('single-mode bare findAll only returns default-tenant rows, not a foreign-stamped row', async () => {
+    const savedMode = process.env.PAYMENT_TENANT_MODE;
+    process.env.PAYMENT_TENANT_MODE = 'single';
+    try {
+      const appPid = getDefaultInstanceDid(); // BLOCKLET_APP_PID in the test env
+      expect(appPid).toBeTruthy();
+      await sequelize.query('DELETE FROM coupons');
+      // one row in the default tenant, one foreign-stamped row (raw, bypassing stamp)
+      await sequelize.query(
+        `INSERT INTO coupons (id, instance_did, livemode, duration, name, created_via, created_at, updated_at)
+         VALUES ('own', :pid, 0, 'once', 'own', 'api', :ts, :ts), ('foreign', :other, 0, 'once', 'foreign', 'api', :ts, :ts)`,
+        { replacements: { pid: appPid, other: TENANT_B, ts: '2024-01-01 00:00:00.000 +00:00' } }
+      );
+      // no withTenant -> single mode default fill = APP_PID, NOT a passthrough
+      const rows: any[] = await Coupon.findAll();
+      expect(rows.map((r) => r.id)).toEqual(['own']);
+      expect(await Coupon.findByPk('foreign')).toBeNull();
+    } finally {
+      if (savedMode === undefined) delete process.env.PAYMENT_TENANT_MODE;
+      else process.env.PAYMENT_TENANT_MODE = savedMode;
+    }
+  });
+});
+describe('index hit: instance_did equality uses an index, not a full scan', () => {
+  it('EXPLAIN QUERY PLAN on WHERE instance_did = ? uses the idx_<table>_instance_did index', async () => {
+    // sync() does not create the migration index; create it as the Phase 2
+    // backfill migration does (idx_<table>_instance_did) and prove it is used.
+    await sequelize.query('CREATE INDEX IF NOT EXISTS idx_subscriptions_instance_did ON subscriptions(instance_did)');
+    const plan = (await sequelize.query('EXPLAIN QUERY PLAN SELECT * FROM subscriptions WHERE instance_did = :did', {
+      replacements: { did: TENANT_A },
+      type: (DataTypes as any).SELECT ?? 'SELECT',
+    })) as any[];
+    const text = JSON.stringify(plan);
+    expect(text).toMatch(/USING (COVERING )?INDEX idx_subscriptions_instance_did/);
+    expect(text).not.toMatch(/SCAN subscriptions(?! USING)/);
+  });
+});

package/api/tests/store/tenant-model-spike.spec.ts ADDED Viewed

@@ -0,0 +1,177 @@
+// SPIKE: validate the TenantModel base-class mechanism against BOTH query
+// engines in one run — real Sequelize (Node) and the sequelize-d1 shim
+// (worker). Go/No-Go for `TENANT-ISOLATION-DESIGN.md` §12.
+//
+// Proves: (a) static override + super works on both bases; (b) `this`
+// resolves to the concrete model through the extra inheritance layer (shim);
+// (c) scopeWhere idempotency absorbs the findByPk->findOne->findAll double
+// injection; (d) cross-tenant read/write/aggregate are isolated; (e) the
+// worker reads the tenant via ALS (withTenant).
+import { DatabaseSync } from 'node:sqlite';
+import { DataTypes, Model as RealModel, Sequelize } from 'sequelize';
+import { withTenant } from '../../src/libs/context';
+import { makeTenantModel } from '../../src/store/tenant-model';
+import { TENANT_A, TENANT_B } from '../fixtures/tenants';
+// 'coupons' is a real tenant table (in TENANT_TABLES) -> _isTenantTable() true.
+// We give it a minimal schema we fully control, on a throwaway DB.
+const TABLE = 'coupons';
+// ---------------------------------------------------------------------------
+// Base 1: real Sequelize (Node runtime)
+// ---------------------------------------------------------------------------
+describe('TenantModel over real Sequelize', () => {
+  let sequelize: Sequelize;
+  let Widget: any;
+  beforeAll(async () => {
+    sequelize = new Sequelize({ dialect: 'sqlite', storage: ':memory:', logging: false });
+    Widget = class extends makeTenantModel(RealModel) {};
+    Widget.init(
+      {
+        id: { type: DataTypes.STRING, primaryKey: true },
+        instance_did: { type: DataTypes.STRING },
+        name: { type: DataTypes.STRING },
+        qty: { type: DataTypes.INTEGER },
+      },
+      { sequelize, modelName: 'Widget', tableName: TABLE, timestamps: false }
+    );
+    await sequelize.sync();
+  });
+  afterAll(async () => {
+    await sequelize.close();
+  });
+  beforeEach(async () => {
+    await sequelize.query(`DELETE FROM ${TABLE}`);
+    await withTenant(TENANT_A, () => Widget.create({ id: 'a1', name: 'a-one', qty: 10 }));
+    await withTenant(TENANT_A, () => Widget.create({ id: 'a2', name: 'a-two', qty: 5 }));
+    await withTenant(TENANT_B, () => Widget.create({ id: 'b1', name: 'b-one', qty: 100 }));
+  });
+  it('findAll returns only the active tenant', async () => {
+    const a = await withTenant(TENANT_A, () => Widget.findAll());
+    expect(a.map((r: any) => r.id).sort()).toEqual(['a1', 'a2']);
+    const b = await withTenant(TENANT_B, () => Widget.findAll());
+    expect(b.map((r: any) => r.id)).toEqual(['b1']);
+  });
+  it('findByPk across tenants returns null (delegation + idempotent double-scope)', async () => {
+    expect(await withTenant(TENANT_A, () => Widget.findByPk('a1'))).not.toBeNull();
+    expect(await withTenant(TENANT_A, () => Widget.findByPk('b1'))).toBeNull();
+  });
+  it('create stamps the active tenant', async () => {
+    const row = await withTenant(TENANT_A, () => Widget.findByPk('a1'));
+    expect(row.instance_did).toBe(TENANT_A);
+  });
+  it('sum aggregates only the active tenant', async () => {
+    expect(await withTenant(TENANT_A, () => Widget.sum('qty'))).toBe(15);
+    expect(await withTenant(TENANT_B, () => Widget.sum('qty'))).toBe(100);
+  });
+  it('update never crosses tenants', async () => {
+    await withTenant(TENANT_A, () => Widget.update({ name: 'a-upd' }, { where: {} }));
+    const b1 = await withTenant(TENANT_B, () => Widget.findByPk('b1'));
+    expect(b1.name).toBe('b-one');
+  });
+  it('explicit matching instance_did is idempotent; conflicting fails closed', async () => {
+    await expect(withTenant(TENANT_A, () => Widget.findAll({ where: { instance_did: TENANT_A } }))).resolves.toHaveLength(2);
+    await expect(withTenant(TENANT_A, () => Widget.findAll({ where: { instance_did: TENANT_B } }))).rejects.toThrow(/conflicts with the active tenant/);
+  });
+});
+// ---------------------------------------------------------------------------
+// Base 2: sequelize-d1 shim (worker runtime), backed by node:sqlite as a
+// minimal D1-compatible fake.
+// ---------------------------------------------------------------------------
+function makeFakeD1(db: DatabaseSync) {
+  const prepare = (sql: string) => {
+    let bound: any[] = [];
+    const stmt: any = {
+      __sql: sql,
+      bind: (...vals: any[]) => {
+        bound = vals;
+        return stmt;
+      },
+      all: () => ({ results: db.prepare(sql).all(...bound), meta: {} }),
+      run: () => {
+        const r = db.prepare(sql).run(...bound);
+        return { meta: { changes: Number(r.changes), last_row_id: Number(r.lastInsertRowid) } };
+      },
+      first: () => db.prepare(sql).get(...bound) ?? null,
+    };
+    return stmt;
+  };
+  return {
+    prepare,
+    batch: async (stmts: any[]) =>
+      stmts.map((s) => {
+        if (/^\s*SELECT/i.test(s.__sql)) return s.all();
+        s.run();
+        return { results: [], meta: {} };
+      }),
+  };
+}
+describe('TenantModel over sequelize-d1 shim', () => {
+  let ShimModel: any;
+  let setDB: any;
+  let Widget: any;
+  beforeAll(() => {
+    // eslint-disable-next-line global-require, @typescript-eslint/no-var-requires
+    const shim = require('../../../cloudflare/shims/sequelize-d1');
+    ShimModel = shim.Model;
+    setDB = shim.setDB;
+    const db = new DatabaseSync(':memory:');
+    db.exec(`CREATE TABLE ${TABLE} (id TEXT PRIMARY KEY, instance_did TEXT, name TEXT, qty INTEGER)`);
+    setDB(makeFakeD1(db));
+    Widget = class extends makeTenantModel(ShimModel) {};
+    Widget.init(
+      { id: {}, instance_did: {}, name: {}, qty: {} },
+      { sequelize: { models: {} }, modelName: 'Widget', tableName: TABLE }
+    );
+  });
+  beforeEach(async () => {
+    await withTenant(TENANT_A, () => Widget.destroy({ where: {} }));
+    await withTenant(TENANT_B, () => Widget.destroy({ where: {} }));
+    await withTenant(TENANT_A, () => Widget.create({ id: 'a1', name: 'a-one', qty: 10 }));
+    await withTenant(TENANT_A, () => Widget.create({ id: 'a2', name: 'a-two', qty: 5 }));
+    await withTenant(TENANT_B, () => Widget.create({ id: 'b1', name: 'b-one', qty: 100 }));
+  });
+  it('findAll returns only the active tenant', async () => {
+    const a = await withTenant(TENANT_A, () => Widget.findAll());
+    expect(a.map((r: any) => r.id).sort()).toEqual(['a1', 'a2']);
+    const b = await withTenant(TENANT_B, () => Widget.findAll());
+    expect(b.map((r: any) => r.id)).toEqual(['b1']);
+  });
+  it('findByPk across tenants returns null (this-resolution + delegation through extra layer)', async () => {
+    expect(await withTenant(TENANT_A, () => Widget.findByPk('a1'))).not.toBeNull();
+    expect(await withTenant(TENANT_A, () => Widget.findByPk('b1'))).toBeNull();
+  });
+  it('create stamps the active tenant', async () => {
+    const row = await withTenant(TENANT_A, () => Widget.findByPk('a1'));
+    expect(row.instance_did).toBe(TENANT_A);
+  });
+  it('update never crosses tenants', async () => {
+    await withTenant(TENANT_A, () => Widget.update({ name: 'a-upd' }, { where: {} }));
+    const b1 = await withTenant(TENANT_B, () => Widget.findByPk('b1'));
+    expect(b1.name).toBe('b-one');
+  });
+  it('conflicting explicit instance_did fails closed', async () => {
+    await expect(withTenant(TENANT_A, () => Widget.findAll({ where: { instance_did: TENANT_B } }))).rejects.toThrow(/conflicts with the active tenant/);
+  });
+});