tapimo 0.15.1 → 0.18.1

package/src/apps/management/routes/orgs.test.ts

@@ -1,4 +1,5 @@
 import { Hono } from 'hono'
+import { sql } from 'kysely'
 import { generatePrivateKey, privateKeyToAccount } from 'viem/accounts'
 
 import * as TestApp from '../../../../test/App.js'
@@ -11,6 +12,8 @@ import * as EarlyAccess from '../../../db/tables/earlyAccess.js'
 import * as EnabledBillingSources from '../../../db/tables/enabledBillingSources.js'
 import * as Organizations from '../../../db/tables/organizations.js'
 import * as Projects from '../../../db/tables/projects.js'
+import * as SponsoredTransactions from '../../../db/tables/sponsoredTransactions.js'
+import * as StripeCustomers from '../../../db/tables/stripeCustomers.js'
 import * as Users from '../../../db/tables/users.js'
 import type * as Log from '../../../internal/Log.js'
 import * as RoutesDepositAddress from '../../../internal/routes/DepositAddress.js'
@@ -568,7 +571,39 @@ describe('PATCH /orgs/:orgId', () => {
 })
 
 describe('DELETE /orgs/:orgId', () => {
-  test('rejects a legacy key after deletion when KV cleanup fails', async () => {
+  test('keeps a timed-out Zone sponsorship billable when its owner requests deletion', async () => {
+    const db = TestApp.database()
+    const app = createApp(db)
+    const cookie = await session(app)
+    const created = await app.request('/v1/orgs', json('POST', cookie, { name: 'Acme' }))
+    const org = await TestApp.json(created, Orgs.schema.Organization)
+    await StripeCustomers.create(db, { orgId: org.id, stripeCustomerId: 'cus_zone' })
+    const row = await SponsoredTransactions.upsert(db, {
+      apiKeyId: 'key_zone',
+      billable: true,
+      chainId: 421700001,
+      environment: 'production',
+      orgId: org.id,
+      signPayload: `0x${'bb'.repeat(32)}`,
+      transaction: `0x76${'cc'.repeat(16)}`,
+      transactionHash: `0x${'aa'.repeat(32)}`,
+    })
+    await SponsoredTransactions.fail(db, row.id, '2026-01-01T00:00:00.000Z')
+
+    const response = await app.request(`/v1/orgs/${org.id}`, {
+      headers: { cookie },
+      method: 'DELETE',
+    })
+
+    expect(response.status).toMatchInlineSnapshot(`409`)
+    expect((await response.json()).error.code).toMatchInlineSnapshot(`"sponsorships_unreported"`)
+    expect((await StripeCustomers.get(db, org.id))?.stripeCustomerId).toMatchInlineSnapshot(
+      `"cus_zone"`,
+    )
+    expect(await Organizations.get(db, org.id)).toBeDefined()
+  })
+
+  test('rolls back organization deletion when its KV fence cannot be written', async () => {
     const db = TestApp.database()
     const org = await Organizations.create(db, { name: 'Legacy owner' })
     const legacy = {
@@ -597,11 +632,80 @@ describe('DELETE /orgs/:orgId', () => {
       ...as(secret),
       method: 'DELETE',
     })
-    expect(deleted.status).toBe(200)
+    expect(deleted.status).toBe(502)
+    expect(await Organizations.get(db, legacy.id)).toBeDefined()
+
+    const retained = await app.request(`/v1/orgs/${legacy.id}`, as(legacy.token))
+    expect(retained.status).toBe(200)
+
+    failWrites = false
+    const retried = await app.request(`/v1/orgs/${legacy.id}`, {
+      ...as(secret),
+      method: 'DELETE',
+    })
+    expect(retried.status).toBe(200)
     expect(await Organizations.get(db, legacy.id)).toBeUndefined()
+    expect((await app.request(`/v1/orgs/${legacy.id}`, as(legacy.token))).status).toBe(401)
+  })
+
+  test('restores key access when deletion fails after publishing its KV fence', async () => {
+    const db = TestApp.database()
+    const org = await Organizations.create(db, { name: 'Retained owner' })
+    const legacy = {
+      id: org.id,
+      orgId: org.id,
+      scopes: ['management:read'],
+      token: 'secret_retained_owner',
+    } satisfies TestApp.kvStore.Key
+    const store = TestApp.kvStore({ keys: [legacy] })
+    const app = createApp(db, { kv: { store } })
+    await sql`
+      CREATE FUNCTION reject_owner_deletion() RETURNS trigger LANGUAGE plpgsql AS $$
+      BEGIN RAISE EXCEPTION 'deletion commit rejected'; END $$;
+      CREATE CONSTRAINT TRIGGER reject_owner_deletion AFTER DELETE ON organizations
+      DEFERRABLE INITIALLY DEFERRED FOR EACH ROW EXECUTE FUNCTION reject_owner_deletion();
+    `.execute(db.kysely)
+
+    const deleted = await app.request(`/v1/orgs/${org.id}`, { ...as(secret), method: 'DELETE' })
 
-    const rejected = await app.request(`/v1/orgs/${legacy.id}`, as(legacy.token))
-    expect(rejected.status).toBe(401)
+    expect(deleted.status).toBe(502)
+    expect(await Organizations.get(db, org.id)).toBeDefined()
+    expect(await ApiKeys.isOwnerDeleted(store, { orgId: org.id })).toBe(false)
+    expect((await app.request(`/v1/orgs/${org.id}`, as(legacy.token))).status).toBe(200)
+    await expect(
+      ApiKeys.mint(store, { orgId: org.id, scopes: ['data:read'] }),
+    ).resolves.toBeDefined()
+
+    await sql`DROP TRIGGER reject_owner_deletion ON organizations`.execute(db.kysely)
+    const retried = await app.request(`/v1/orgs/${org.id}`, { ...as(secret), method: 'DELETE' })
+    expect(retried.status).toBe(200)
+    expect(await ApiKeys.isOwnerDeleted(store, { orgId: org.id })).toBe(true)
+  })
+
+  test('rejects a cached key after deletion even when KV record cleanup fails', async () => {
+    const db = TestApp.database()
+    const org = await Organizations.create(db, { name: 'Retained KV record' })
+    const backing = Store.memory()
+    const { token } = await ApiKeys.mint(backing, {
+      orgId: org.id,
+      scopes: ['data:read'],
+    })
+    const store = Store.from({
+      ...backing,
+      async delete() {
+        throw new Error('KV cleanup unavailable')
+      },
+    })
+    const app = createApp(db, { kv: { store } })
+    expect((await app.request('/v1/tokens/not-an-address', as(token))).status).toBe(400)
+
+    const deleted = await app.request(`/v1/orgs/${org.id}`, {
+      ...as(secret),
+      method: 'DELETE',
+    })
+    expect(deleted.status).toBe(200)
+    expect(await Organizations.get(db, org.id)).toBeUndefined()
+    expect((await app.request('/v1/tokens/not-an-address', as(token))).status).toBe(401)
   })
 
   test('deletes an owned organization and cascades its projects', async () => {

package/src/apps/management/routes/orgs.ts

@@ -389,17 +389,22 @@ export function orgs() {
             return subsidizedDepositAddressesActive(c)
           if (await RoutesDepositAddresses.hasSubsidizedRelayAddress(db, Auth.org(c).id))
             return subsidizedDepositAddressesActive(c)
+          const kv = c.get('kv')
           const deleted = await Organizations.deleteOrganization(db, Auth.org(c).id, {
+            beforeCommit: kv
+              ? () => ApiKeys.markOwnerDeleting(kv.store, { orgId: Auth.org(c).id })
+              : undefined,
             onDepositAddressesDeactivated(transitions) {
               for (const transition of transitions)
                 RoutesObservability.recordDepositAddress(c.get('metrics'), transition)
             },
+          }).catch(async (cause) => {
+            if (kv) await ApiKeys.reconcileOwnerDeletion(db, kv.store, { orgId: Auth.org(c).id })
+            throw cause
           })
           if (!deleted) return organizationNotFound(c)
-          const kv = c.get('kv')
           if (kv)
             try {
-              await ApiKeys.markOwnerDeleting(kv.store, { orgId: Auth.org(c).id })
               for (const record of await ApiKeys.listByOrg(kv.store, Auth.org(c).id, {
                 scopeCatalog: c.get('scopeCatalog'),
               }))

package/src/apps/management/routes/usage.test.ts

@@ -273,8 +273,8 @@ describe('GET /orgs/:orgId/usage/requests', () => {
 
     expect(response.status).toBe(200)
     expect(await TestApp.json(response, Usage.schema.getRequestUsage.Response)).toEqual(emptyUsage)
-    // Series, totals, byKey, byRoute, and byStatus each issue one query.
-    expect(query).toHaveBeenCalledTimes(5)
+    // All usage breakdowns share one query.
+    expect(query).toHaveBeenCalledTimes(1)
     const sql = query.mock.calls[0]![0]
     expect(sql).toContain(`org_id = '${org.id}'`)
     expect(sql).toContain(`project_id = '${project.id}'`)

package/src/apps/mpp/internal/Policy.test.ts

@@ -43,8 +43,19 @@ describe('chainId', () => {
 })
 
 describe('requiresFeePayer', () => {
-  test('requires both a fee-payer method detail and an enabled request', () => {
-    expect(Policy.requiresFeePayer(input)).toBe(true)
+  test.each([
+    ['canonical', { methodDetails: { feePayer: true } }],
+    ['pre-normalized', { feePayer: true }],
+  ])('recognizes %s sponsorship', (_, request) => {
+    expect(
+      Policy.requiresFeePayer({
+        ...input,
+        challenge: { ...input.challenge, request },
+      }),
+    ).toBe(true)
+  })
+
+  test('lets an explicit top-level value disable sponsorship', () => {
     expect(
       Policy.requiresFeePayer({
         ...input,
@@ -84,6 +95,42 @@ describe('assertChainAccess', () => {
 })
 
 describe('authorizeFeePayer', () => {
+  test('rejects pre-normalized sandbox sponsorship on mainnet', async () => {
+    await expect(
+      Policy.authorizeFeePayer({
+        chainId: 4217,
+        db: TestApp.database(),
+        feePayer,
+        input: {
+          ...input,
+          challenge: { ...input.challenge, request: { feePayer: true } },
+        },
+        principal: { ...principal, environment: 'sandbox' },
+        zones,
+      }),
+    ).rejects.toThrowErrorMatchingInlineSnapshot(
+      `[Mpp.Policy.PolicyDeniedError: Mainnet fee sponsorship requires a production API key.]`,
+    )
+  })
+
+  test('requires active billing for pre-normalized mainnet sponsorship', async () => {
+    await expect(
+      Policy.authorizeFeePayer({
+        chainId: 4217,
+        db: TestApp.database(),
+        feePayer,
+        input: {
+          ...input,
+          challenge: { ...input.challenge, request: { feePayer: true } },
+        },
+        principal: principal_projectless,
+        zones,
+      }),
+    ).rejects.toThrowErrorMatchingInlineSnapshot(
+      `[Mpp.Policy.PolicyDeniedError: Active billing is required for mainnet fee sponsorship.]`,
+    )
+  })
+
   test.each([4217, Zones.zoneMainnetInternal.id, Zones.zoneDeel.id])(
     'rejects sandbox sponsorship on chain %s',
     async (chainId) => {
@@ -165,7 +212,7 @@ describe('authorizeFeePayer', () => {
     },
   )
 
-  test('does not require billing when the credential pays its own fee', async () => {
+  test('withholds the managed fee payer from self-funded credentials', async () => {
     await expect(
       Policy.authorizeFeePayer({
         chainId: 4217,
@@ -178,6 +225,6 @@ describe('authorizeFeePayer', () => {
         principal,
         zones,
       }),
-    ).resolves.toBe(feePayer)
+    ).resolves.toBeUndefined()
   })
 })

package/src/apps/mpp/internal/Policy.ts

@@ -18,7 +18,11 @@ export function chainId(input: Mpp.RelayInput): number | undefined {
 /** Whether a Tempo charge credential requests platform fee sponsorship. */
 export function requiresFeePayer(input: Mpp.RelayInput) {
   const request = input.challenge.request
-  return record(request['methodDetails'])?.['feePayer'] === true && request['feePayer'] !== false
+  const details = record(request['methodDetails'])
+  return (
+    (details?.['feePayer'] === true || request['feePayer'] === true) &&
+    request['feePayer'] !== false
+  )
 }
 
 /** Refuses a sponsored transaction that the current fee market cannot admit. */
@@ -80,7 +84,7 @@ export async function authorizeFeePayer(
   options: authorizeFeePayer.Options,
 ): Promise<LocalAccount | undefined> {
   const { chainId, db, feePayer, input, principal, zones } = options
-  if (!feePayer || !requiresFeePayer(input)) return feePayer
+  if (!feePayer || !requiresFeePayer(input)) return undefined
   if (principal?.type !== 'api_key')
     throw new PolicyDeniedError('Fee sponsorship requires an API key.')
   if (!Viem.isMainnet(zones.get(chainId)?.sourceId ?? chainId)) return feePayer

package/src/apps/mpp/internal/Sponsorship.test.ts

@@ -3,6 +3,7 @@ import { SignatureEnvelope, TxEnvelopeTempo } from 'ox/tempo'
 
 import * as TestApp from '../../../../test/App.js'
 import * as Tempo from '../../../../test/Tempo.js'
+import * as ApiKeyOwnerTombstones from '../../../db/tables/apiKeyOwnerTombstones.js'
 import * as BillingSettings from '../../../db/tables/billingSettings.js'
 import * as SponsoredTransactions from '../../../db/tables/sponsoredTransactions.js'
 import type * as Auth from '../../../internal/Auth.js'
@@ -35,6 +36,34 @@ const token = {
 }
 
 describe('record', () => {
+  test.each([undefined, '1.00'])(
+    'rejects a deleted owner with spend limit %s',
+    async (spendLimit) => {
+      const db = TestApp.database()
+      const chainId = Zones.zoneDeel.id
+      await VerifiedTokens.replace(db, chainId, [token])
+      if (spendLimit !== undefined)
+        await BillingSettings.upsert(db, { orgId: principal.orgId, spendLimit })
+      await db.transaction((tx) =>
+        ApiKeyOwnerTombstones.markDeleted(tx, { orgId: principal.orgId }),
+      )
+
+      await expect(
+        Sponsorship.record({
+          db,
+          dbCached: db,
+          principal,
+          serializedTransaction: await transaction({ chainId }),
+          txFeeLimit: 1_000_000n,
+          zones,
+        }),
+      ).rejects.toThrowErrorMatchingInlineSnapshot(
+        `[Mpp.Policy.PolicyDeniedError: Organization no longer exists.]`,
+      )
+      expect(await SponsoredTransactions.listPending(db)).toMatchInlineSnapshot(`[]`)
+    },
+  )
+
   test.each(mainnetChainIds)(
     'records chain %s as billable and eligible for metering',
     async (chainId) => {

package/src/apps/mpp/internal/Sponsorship.ts

@@ -114,17 +114,19 @@ export async function record(options: record.Options): Promise<void> {
     transaction: serializedTransaction,
     transactionHash: Hash.keccak256(serializedTransaction),
   }
-  if (settings?.spendLimit == null) {
-    await SponsoredTransactions.upsert(db, input)
-    return
-  }
   try {
+    if (settings?.spendLimit == null) {
+      await SponsoredTransactions.upsert(db, input)
+      return
+    }
     await SponsoredTransactions.reserve(db, input, {
       chainIds: Zones.chainIds({ sourceId: Viem.chainId.mainnet, zones: zones.values() }),
       max: Billing.toBaseUnits(settings.spendLimit),
       since: Billing.periodStart(settings.period),
     })
   } catch (cause) {
+    if (cause instanceof SponsoredTransactions.OrganizationDeletedError)
+      throw new Policy.PolicyDeniedError('Organization no longer exists.')
     if (cause instanceof SponsoredTransactions.PeriodSpendLimitError)
       throw new Policy.PolicyDeniedError('Spend limit exceeded.')
     throw cause

package/src/apps/relay/App.test.ts

@@ -5,7 +5,7 @@ import { Hash, Hex, Secp256k1 } from 'ox'
 import { ZoneRpcAuthentication } from 'ox/tempo'
 import { createClient, http } from 'viem'
 import { prepareTransactionRequest, sendRawTransactionSync, signTransaction } from 'viem/actions'
-import { Account as TempoAccount, Actions, Transaction, withRelay } from 'viem/tempo'
+import { Account as TempoAccount, Actions, Addresses, Transaction, withRelay } from 'viem/tempo'
 
 import * as TestApp from '../../../test/App.js'
 import * as Containers from '../../../test/containers.js'
@@ -25,6 +25,7 @@ import * as SponsoredTransactions from '../../db/tables/sponsoredTransactions.js
 import * as StripeCustomers from '../../db/tables/stripeCustomers.js'
 import * as core_Billing from '../management/Billing.js'
 import * as RequestListener from '../../handlers/internal/requestListener.js'
+import * as Store from '../../internal/Store.js'
 import * as Tidx from '../../internal/Tidx.js'
 import * as Viem from '../../internal/Viem.js'
 import * as Sponsorships from './Sponsorships.js'
@@ -125,6 +126,36 @@ const keys = [
   },
 ] as const satisfies readonly TestApp.kvStore.Key[]
 
+describe('behavior: multisig coordination', () => {
+  test('uses configured state and reports coordinator failures', async () => {
+    const entries: Log.Entry[] = []
+    const store = Store.memory()
+    const app = TestApp.create({
+      auth: { keys },
+      logger: (entry) => void entries.push(entry),
+      relay: { multisig: { store } },
+    })
+    const hash = Hex.random(32)
+    const request = async () => {
+      const response = await app.request('/rpc/relay', {
+        body: JSON.stringify({
+          id: 1,
+          jsonrpc: '2.0',
+          method: 'multisig_getOperation',
+          params: [hash],
+        }),
+        headers: { 'content-type': 'application/json', 'tempo-api-key': 'secret_unscoped' },
+        method: 'POST',
+      })
+      return response.json()
+    }
+    expect(await request()).toMatchObject({ result: null })
+    await store.put(`multisig:v2:multisig:operation:${hash}`, 'invalid')
+    expect(await request()).toMatchObject({ error: { code: -32603 } })
+    expect(entries.at(-1)?.rpc).toMatchObject({ serverErrors: 1 })
+  })
+})
+
 describe('behavior: Zone chain routing', () => {
   const zoneSelectors = [
     ['relay', 'path'],
@@ -712,6 +743,8 @@ describe.skipIf(runtime.mode !== 'localnet')('behavior: sponsorship', () => {
           "finalizationAttemptedAt": null,
           "finalizedAt": null,
           "id": "<id>",
+          "meterEventFirstAttemptedAt": null,
+          "meterReportAttemptedAt": null,
           "meterReportedAt": null,
           "orgId": "org_1",
           "projectId": "prj_1",
@@ -720,6 +753,7 @@ describe.skipIf(runtime.mode !== 'localnet')('behavior: sponsorship', () => {
           "status": "pending",
           "transaction": "<hex>",
           "transactionHash": "<hash>",
+          "transactionHashReconciled": false,
         }
       `)
   })
@@ -1239,6 +1273,56 @@ describe('behavior: mainnet billing gate', () => {
     await TestApp.verifiedSeed(db, Viem.chainId.mainnet)
   }
 
+  test('behavior: uses the same sponsor fee token for each authenticated organization', async () => {
+    const db = TestApp.database()
+    const ousd = '0x20c0000000000000000000006a37DA5C996874BE'
+    await activate(db, 'org_1')
+    await activate(db, 'org_2')
+    await TestApp.verifiedSeed(db, Viem.chainId.mainnet, {
+      tokens: [Addresses.pathUsd, ousd].map((address) => ({
+        address,
+        currency: 'USD',
+        decimals: 6,
+        name: address === ousd ? 'OUSD' : 'pathUSD',
+        symbol: address === ousd ? 'OUSD' : 'pathUSD',
+      })),
+    })
+    const app = TestApp.create({
+      auth: { keys },
+      db,
+      relay: {
+        feePayer: {
+          account: feePayerAccount,
+          resolveFeeToken: ({ chainId }) => {
+            expect(chainId).toBe(Viem.chainId.mainnet)
+            return ousd
+          },
+        },
+      },
+      supportedChainIds: [Viem.chainId.mainnet],
+    })
+
+    for (const [nonce, { orgId, token }] of [
+      { orgId: 'org_1', token: 'secret_sponsor_prod' },
+      { orgId: 'org_2', token: 'secret_wildcard_prod' },
+      { orgId: 'org_1', token: 'secret_sponsor_prod' },
+    ].entries()) {
+      const body = await relayRequest(app, {
+        method: 'eth_signRawTransaction',
+        params: [await signSponsorable({ chainId: Viem.chainId.mainnet, nonce })],
+        token,
+      })
+      expect(body.error).toBeUndefined()
+      const signed = Transaction.deserialize(body.result as `0x76${string}`)
+      expect(signed.feeToken?.toString().toLowerCase()).toBe(ousd.toLowerCase())
+      const row = (await SponsoredTransactions.listPending(db)).find(
+        (row) => row.transactionHash === Hash.keccak256(body.result!),
+      )
+      expect(row?.orgId).toBe(orgId)
+      expect(row?.feeToken?.toLowerCase()).toBe(ousd.toLowerCase())
+    }
+  })
+
   /** Configures one attributed project for Tempo-funded sponsorship. */
   async function configureSubsidy(db: ReturnType<typeof TestApp.database>) {
     await Organizations.create(db, { id: 'org_1', name: 'Privy' })

package/src/apps/relay/App.ts

@@ -2,6 +2,7 @@ import { Hono } from 'hono'
 import { createMiddleware } from 'hono/factory'
 import { Hash, Hex, RpcResponse } from 'ox'
 import { ZoneRpcAuthentication } from 'ox/tempo'
+import type { Address } from 'viem'
 import { Addresses, TokenId, Transaction } from 'viem/tempo'
 
 import type * as App from '../../App.js'
@@ -75,10 +76,19 @@ export declare namespace relay {
           NonNullable<Handler.relay.Options['feePayer']>,
           'account' | 'feeToken' | 'name' | 'url'
         > & {
+          /** Resolves the sponsor's fee token using the transaction chain. */
+          resolveFeeToken?:
+            | ((options: {
+                /** Transaction chain id. */
+                chainId: number
+              }) => Address | undefined)
+            | undefined
           /** Per-transaction fee cap (decimal USD string); orgs tighten it, never loosen. @default '1.00' */
           txFeeLimit?: string | undefined
         })
       | undefined
+    /** Native multisig coordination backed by authoritative atomic storage. */
+    multisig?: Handler.relay.Options['multisig'] | undefined
   }
 }
 
@@ -151,11 +161,18 @@ function middleware(options: middleware.Options) {
         principal?.type === 'api_key' &&
         (principal.apiKey.scopes.includes('rpc-relay:sponsor') ||
           principal.apiKey.scopes.includes(Scope.wildcard))
-      // Lifted so validation and the sponsored-token default read one value.
-      const feeToken_sponsor = options.feePayer.feeToken ?? Addresses.pathUsd
+      // Resolve against the transaction chain because one app serves mainnet,
+      // testnet, and hosted Zones concurrently.
+      const feeToken_sponsor = (chainId: number) => {
+        return (
+          options.feePayer?.resolveFeeToken?.({ chainId }) ??
+          options.feePayer?.feeToken ??
+          Addresses.pathUsd
+        )
+      }
       return {
         ...options.feePayer,
-        feeToken: feeToken_sponsor,
+        resolveFeeToken: feeToken_sponsor,
         validate: async (transaction) => {
           // Allowlist the chains this deployment serves rather than denylisting
           // only mainnet: the relay resolves chainId from the request body, so
@@ -230,7 +247,7 @@ function middleware(options: middleware.Options) {
           }
           const feeToken = (() => {
             try {
-              return TokenId.toAddress(transaction.feeToken ?? feeToken_sponsor)
+              return TokenId.toAddress(transaction.feeToken ?? feeToken_sponsor(id))
             } catch {
               return undefined
             }
@@ -388,6 +405,12 @@ function middleware(options: middleware.Options) {
               : await SponsoredTransactions.reserve(db, input, billingLimit)
             return { subsidized: !record.billable }
           } catch (error) {
+            if (error instanceof SponsoredTransactions.OrganizationDeletedError)
+              rejectSponsorship({
+                chainId: event.chainId,
+                message: 'Organization no longer exists.',
+                reason: 'billing_required',
+              })
             if (error instanceof SponsoredTransactions.AttributionConflictError)
               rejectSponsorship({
                 chainId: event.chainId,
@@ -466,6 +489,7 @@ function middleware(options: middleware.Options) {
       cache: c.get('store'),
       ...(options.features ? { features: options.features } : {}),
       getClient,
+      ...(options.multisig ? { multisig: options.multisig } : {}),
       onRequest: async (request) => {
         const method = sponsorshipMethod(request.method)
         const params = 'params' in request && Array.isArray(request.params) ? request.params : []

package/src/apps/relay/Sponsorships.test.ts

@@ -339,6 +339,29 @@ describe('reconcile', () => {
     await db.close()
   })
 
+  test('behavior: replaces an unresolved recorded hash by sign payload', async () => {
+    const db = create()
+    await db.migrate()
+    const sponsorship = await SponsoredTransactions.upsert(db, {
+      ...input,
+      signPayload,
+      transactionHash: `0x${'cc'.repeat(32)}`,
+    })
+
+    const result = await Sponsorships.reconcile(db, {
+      feePayer: '0xFee0000000000000000000000000000000000000',
+      getClient: () => rpc,
+      getTidx: () => tidx([{ from: sender, hash: minedHash }]),
+    })
+
+    expect(result).toMatchObject({ matched: 1 })
+    expect(await SponsoredTransactions.get(db, sponsorship.id)).toMatchObject({
+      status: 'pending',
+      transactionHash: minedHash,
+    })
+    await db.close()
+  })
+
   test('behavior: recovers recently failed intents by sign payload', async () => {
     const db = create()
     await db.migrate()
@@ -373,6 +396,44 @@ describe('reconcile', () => {
     await db.close()
   })
 
+  test('behavior: recovers a failed recorded hash by sign payload without duplicating spend', async () => {
+    const db = create()
+    await db.migrate()
+    await Organizations.create(db, { id: 'org_1', name: 'One' })
+    const recordedHash = `0x${'cc'.repeat(32)}`
+    const sponsorship = await SponsoredTransactions.upsert(db, {
+      ...input,
+      signPayload,
+      transactionHash: recordedHash,
+    })
+    await SponsoredTransactions.fail(db, sponsorship.id, '2026-01-01T00:00:00.000Z')
+
+    vi.useFakeTimers({ now: new Date('2026-01-01T00:01:00.000Z') })
+    try {
+      const options = {
+        feePayer: '0xFee0000000000000000000000000000000000000' as const,
+        getClient: () => rpc,
+        getTidx: () => tidx([{ block_num: 1, from: sender, hash: minedHash, idx: 0 }]),
+      }
+      expect(await Sponsorships.reconcile(db, options)).toMatchObject({ matched: 1 })
+      expect(
+        await Sponsorships.finalize(db, {
+          getClient: () => client({ [minedHash]: { effectiveGasPrice: '0x3', gasUsed: '0x5208' } }),
+        }),
+      ).toMatchObject({ finalized: 1 })
+      expect(await Sponsorships.reconcile(db, options)).toMatchObject({ matched: 0 })
+    } finally {
+      vi.useRealTimers()
+    }
+
+    expect(await SponsoredTransactions.get(db, sponsorship.id)).toMatchObject({
+      status: 'finalized',
+      transactionHash: minedHash,
+    })
+    expect(await SponsoredTransactions.list(db, { limit: 10 })).toHaveLength(1)
+    await db.close()
+  })
+
   test('behavior: spend-limit refusals are not operational errors', async () => {
     const db = create()
     await db.migrate()
@@ -460,6 +521,41 @@ describe('reconcile', () => {
     await db.close()
   })
 
+  test('behavior: scans fill intents and submitted hashes from independent windows', async () => {
+    const db = create()
+    await db.migrate()
+    vi.useFakeTimers({ now: new Date('2026-01-01T00:00:00.000Z') })
+    try {
+      await SponsoredTransactions.upsert(db, {
+        ...input,
+        signPayload: `0x${'ee'.repeat(32)}`,
+      })
+      vi.setSystemTime(new Date('2026-01-01T01:00:00.000Z'))
+      const { transactionHash: _, ...intent } = input
+      await SponsoredTransactions.upsert(db, { ...intent, signPayload })
+      const queries: string[] = []
+
+      await Sponsorships.reconcile(db, {
+        feePayer: '0xFee0000000000000000000000000000000000000',
+        getClient: () => rpc,
+        getTidx: () =>
+          ({
+            fetch: async (options: { query: string }) => {
+              queries.push(options.query)
+              return { rows: [] }
+            },
+          }) as never,
+      })
+
+      expect(queries).toHaveLength(2)
+      expect(queries[0]).toContain("block_timestamp >= '2026-01-01 00:58:00'")
+      expect(queries[1]).toContain("block_timestamp >= '2025-12-31 23:58:00'")
+    } finally {
+      vi.useRealTimers()
+      await db.close()
+    }
+  })
+
   test('behavior: an indexer error leaves intents for the next pass', async () => {
     const db = create()
     await db.migrate()
@@ -483,7 +579,7 @@ describe('reconcile', () => {
         "scanned": 0,
       }
     `)
-    expect(await SponsoredTransactions.listIntents(db)).toHaveLength(1)
+    expect(await SponsoredTransactions.listReconciliationCandidates(db)).toHaveLength(1)
     await db.close()
   })
 })