tapimo 0.5.0 → 0.5.2

package/src/apps/relay/Sponsorships.ts

@@ -10,10 +10,12 @@ import {
 import { getTransactionReceipt } from 'viem/actions'
 
 import * as Db from '../../db/Db.js'
+import * as BillingSettings from '../../db/tables/billingSettings.js'
 import * as Fees from '../../internal/Fees.js'
 import * as SponsoredTransactions from '../../db/tables/sponsoredTransactions.js'
 import * as Tidx from '../../internal/Tidx.js'
 import * as Viem from '../../internal/Viem.js'
+import * as Billing from '../management/Billing.js'
 
 /**
  * Runs one finalization pass over pending sponsored transactions: rows with a
@@ -177,7 +179,12 @@ export async function reconcile(db: Db.Db, options: reconcile.Options): Promise<
         )
         const intent = bySignPayload.get(signPayload)
         if (!intent) continue
-        await SponsoredTransactions.assignTransactionHash(db, intent.id, hash)
+        await SponsoredTransactions.assignTransactionHash(
+          db,
+          intent.id,
+          hash,
+          await options.limitFor?.(intent),
+        )
         bySignPayload.delete(signPayload)
         result.matched++
       } catch {
@@ -204,6 +211,12 @@ export declare namespace reconcile {
     getClient: (chainId: number) => Client
     /** TIDX client resolver keyed by the intent's chain id. */
     getTidx: (chainId: number) => Tidx.Client
+    /** Resolves the current period spend limit before reopening a failed intent. */
+    limitFor?:
+      | ((
+          intent: SponsoredTransactions.Record,
+        ) => Promise<SponsoredTransactions.reserve.Limit | undefined>)
+      | undefined
     /** Lookback slack before the oldest intent's creation. @default 2 minutes */
     skewMs?: number | undefined
   }
@@ -270,6 +283,16 @@ export function createFinalizer(options: createFinalizer.Options): createFinaliz
               feePayer,
               getClient,
               getTidx: (chainId) => getTidx(chainId as Viem.ChainId),
+              limitFor: async (intent) => {
+                if (!intent.billable || !Viem.isMainnet(intent.chainId)) return undefined
+                const settings = await BillingSettings.get(db, intent.orgId)
+                if (settings?.spendLimit == null) return undefined
+                return {
+                  chainIds: [Viem.chainId.mainnet],
+                  max: Billing.toBaseUnits(settings.spendLimit),
+                  since: Billing.periodStart(settings.period),
+                }
+              },
             })
           : { matched: 0, scanned: 0 }
       const finalized = await finalize(db, {

package/src/db/Db.test.ts

@@ -1,10 +1,10 @@
 import { nanoid } from 'nanoid'
 
-import { postgresUrl } from '../../test/containers.js'
+import * as Runtime from '../../test/runtime.js'
 import * as Db from './Db.js'
 import * as Organizations from './tables/organizations.js'
 
-const create = () => Db.postgres({ connectionString: postgresUrl, schema: `t_${nanoid()}` })
+const create = () => Db.postgres({ connectionString: Runtime.postgresUrl, schema: `t_${nanoid()}` })
 
 describe('postgres', () => {
   test('behavior: migrate is idempotent', async () => {
@@ -16,7 +16,7 @@ describe('postgres', () => {
   })
 
   test('behavior: creates a Postgres db without schema scoping', async () => {
-    const db = Db.postgres({ connectionString: postgresUrl })
+    const db = Db.postgres({ connectionString: Runtime.postgresUrl })
     await db.close()
   })
 
@@ -24,14 +24,14 @@ describe('postgres', () => {
     const schema = `t_${nanoid()}`
     // Pre-create the schema so concurrent migrate races only on the
     // `migrations` ledger, not `CREATE SCHEMA`.
-    const seed = Db.postgres({ connectionString: postgresUrl, schema })
+    const seed = Db.postgres({ connectionString: Runtime.postgresUrl, schema })
     await Organizations.get(seed, 'x').catch(() => {})
     await seed.close()
 
     // Several runners migrate the same fresh schema at once (mirrors parallel
     // deploys). The session advisory lock serializes them; none throw.
     const dbs = Array.from({ length: 5 }, () =>
-      Db.postgres({ connectionString: postgresUrl, schema }),
+      Db.postgres({ connectionString: Runtime.postgresUrl, schema }),
     )
     await Promise.all(dbs.map((db) => db.migrate()))
     const created = await Organizations.create(dbs[0]!, { id: 'org_race', name: 'Race' })

package/src/db/Db.ts

@@ -641,6 +641,10 @@ export const migrations: readonly Migration[] = [
         .on('inviteLinkRedemptions')
         .columns(['inviteLinkId', 'createdAt']),
   },
+  {
+    name: '0058_request_usage_sequence_bigint',
+    up: (db) => raw(db, sql`ALTER TABLE request_usage_meter_events ALTER COLUMN sequence TYPE bigint`), // prettier-ignore
+  },
 ]
 
 /**

package/src/db/Schema.ts

@@ -272,7 +272,7 @@ export const RequestUsageMeterEvent = z.object({
     .check(z.describe('When Stripe acknowledged the event (ISO 8601), or null.')),
   sequence: z
     .number()
-    .check(z.describe('Delta sequence within the bucket; `0` is the initial seal, `1..n` later deltas.')), // prettier-ignore
+    .check(z.describe('Reported-count watermark observed when this delta was claimed.')),
   state: z
     .enum(['pending', 'reported', 'skipped'])
     .check(z.describe('Exactly-once state: `pending` retries, `reported` is done, `skipped` is audited.')), // prettier-ignore

package/src/db/tables/billingSettings.test.ts

@@ -1,10 +1,10 @@
 import { nanoid } from 'nanoid'
 
-import { postgresUrl } from '../../../test/containers.js'
+import * as Runtime from '../../../test/runtime.js'
 import * as Db from '../Db.js'
 import * as BillingSettings from './billingSettings.js'
 
-const create = () => Db.postgres({ connectionString: postgresUrl, schema: `t_${nanoid()}` })
+const create = () => Db.postgres({ connectionString: Runtime.postgresUrl, schema: `t_${nanoid()}` })
 
 /** Redacts nondeterministic row fields (timestamps). */
 function redact(record: BillingSettings.Record) {

package/src/db/tables/organizations.test.ts

@@ -1,11 +1,13 @@
 import { nanoid } from 'nanoid'
 
+import * as Runtime from '../../../test/runtime.js'
 import * as Webhooks from '../../internal/Webhooks.js'
 import * as Db from '../Db.js'
 import * as Organizations from './organizations.js'
-import { postgresUrl } from '../../../test/containers.js'
+import * as SponsoredTransactions from './sponsoredTransactions.js'
+import * as StripeCustomers from './stripeCustomers.js'
 
-const create = () => Db.postgres({ connectionString: postgresUrl, schema: `t_${nanoid()}` })
+const create = () => Db.postgres({ connectionString: Runtime.postgresUrl, schema: `t_${nanoid()}` })
 
 /** Redacts nondeterministic row fields (generated nanoid ids, timestamps). */
 function redact(record: Organizations.Record) {
@@ -127,6 +129,34 @@ describe('upsert', () => {
 })
 
 describe('deleteOrganization', () => {
+  test('behavior: preserves an org with unreported billable sponsorships', async () => {
+    const db = create()
+    await db.migrate()
+    await Organizations.create(db, { id: 'org_1', name: 'One' })
+    await StripeCustomers.create(db, {
+      orgId: 'org_1',
+      stripeCustomerId: 'cus_org_1',
+    })
+    await SponsoredTransactions.upsert(db, {
+      apiKeyId: 'key_1',
+      billable: true,
+      chainId: 4217,
+      environment: 'production',
+      orgId: 'org_1',
+      projectId: 'prj_1',
+      signPayload: `0x${'bb'.repeat(32)}`,
+      transaction: `0x76${'cc'.repeat(16)}`,
+      transactionHash: `0x${'aa'.repeat(32)}`,
+    })
+
+    await expect(Organizations.deleteOrganization(db, 'org_1')).rejects.toThrow(
+      Organizations.UnreportedSponsorshipsError,
+    )
+    expect(await Organizations.get(db, 'org_1')).toBeDefined()
+    expect(await StripeCustomers.get(db, 'org_1')).toBeDefined()
+    await db.close()
+  })
+
   test('behavior: deletes api-key-owned webhook subscriptions', async () => {
     const db = create()
     await db.migrate()

package/src/db/tables/organizations.ts

@@ -105,6 +105,16 @@ export declare namespace createOwned {
  */
 export function deleteOrganization(db: Db.Db, id: string): Promise<boolean> {
   return db.kysely.transaction().execute(async (trx) => {
+    const unreported = await trx
+      .selectFrom('sponsored_transactions')
+      .select('id')
+      .where('orgId', '=', id)
+      .where('billable', '=', true)
+      .where('meterReportedAt', 'is', null)
+      .limit(1)
+      .executeTakeFirst()
+    if (unreported) throw new UnreportedSponsorshipsError()
+
     await trx
       .deleteFrom('webhook_subscriptions')
       .where('ownerType', '=', 'api_key')
@@ -124,6 +134,19 @@ export function deleteOrganization(db: Db.Db, id: string): Promise<boolean> {
   })
 }
 
+/** Whether an organization has billable sponsorships awaiting settlement. */
+export async function hasUnreportedSponsorships(db: Db.Db, id: string): Promise<boolean> {
+  const record = await db.kysely
+    .selectFrom('sponsored_transactions')
+    .select('id')
+    .where('orgId', '=', id)
+    .where('billable', '=', true)
+    .where('meterReportedAt', 'is', null)
+    .limit(1)
+    .executeTakeFirst()
+  return record !== undefined
+}
+
 /**
  * Reads an organization by id.
  *
@@ -389,3 +412,8 @@ export declare namespace upsert {
     name?: string | undefined
   }
 }
+
+/** Organization deletion is blocked until billable sponsorships settle. */
+export class UnreportedSponsorshipsError extends Error {
+  override name = 'Organizations.UnreportedSponsorshipsError'
+}

package/src/db/tables/requestUsage.ts

@@ -32,7 +32,7 @@ export type MeterEventTable = {
   orgId: string
   reason: string | null
   reportedAt: string | null
-  sequence: number
+  sequence: Count
   state: State
   stripeCustomerId: string
 }
@@ -91,26 +91,6 @@ export async function listPending(db: Db.Db, environment: Environment): Promise<
   return rows.map(toMeterEvent)
 }
 
-/**
- * Counts the meter events already reported for a bucket — the next delta's
- * `sequence`, so a new seal never collides with a settled one.
- *
- * @param db - The database.
- * @param key - The bucket key.
- * @returns The count of reported events for the bucket.
- */
-export async function countReported(db: Db.Db, key: BucketKey): Promise<number> {
-  const row = await db.kysely
-    .selectFrom('request_usage_meter_events')
-    .select((eb) => eb.fn.countAll<string>().as('count'))
-    .where('orgId', '=', key.orgId)
-    .where('environment', '=', key.environment)
-    .where('bucketStart', '=', key.bucketStart)
-    .where('state', '=', 'reported')
-    .executeTakeFirstOrThrow()
-  return Number(row.count)
-}
-
 /**
  * Inserts a frozen `pending` meter event, claiming a delta. Idempotent on the
  * deterministic `identifier`: a re-seal after a crash resolves to the existing
@@ -157,7 +137,7 @@ export declare namespace insertPending {
     identifier: string
     /** Organization id (`org_…`). */
     orgId: string
-    /** Delta sequence within the bucket. */
+    /** Reported-count watermark observed when this delta was claimed. */
     sequence: number
     /** Stripe customer id the event bills against. */
     stripeCustomerId: string
@@ -227,5 +207,5 @@ function toBucket(row: Selectable<BucketTable>): Bucket {
 
 /** Maps a meter-event row to its domain record. */
 function toMeterEvent(row: Selectable<MeterEventTable>): MeterEvent {
-  return { ...row, deltaCount: Number(row.deltaCount) }
+  return { ...row, deltaCount: Number(row.deltaCount), sequence: Number(row.sequence) }
 }

package/src/db/tables/sponsoredTransactions.test.ts

@@ -1,10 +1,10 @@
 import { nanoid } from 'nanoid'
 
-import { postgresUrl } from '../../../test/containers.js'
+import * as Runtime from '../../../test/runtime.js'
 import * as Db from '../Db.js'
 import * as SponsoredTransactions from './sponsoredTransactions.js'
 
-const create = () => Db.postgres({ connectionString: postgresUrl, schema: `t_${nanoid()}` })
+const create = () => Db.postgres({ connectionString: Runtime.postgresUrl, schema: `t_${nanoid()}` })
 
 /** Baseline insert input; tests override per case. */
 const input = {
@@ -95,6 +95,23 @@ describe('upsert', () => {
     await db.close()
   })
 
+  test('behavior: rejects a sign payload already attributed to another org', async () => {
+    const db = create()
+    await db.migrate()
+    const first = await SponsoredTransactions.upsert(db, input)
+
+    await expect(
+      SponsoredTransactions.upsert(db, {
+        ...input,
+        orgId: 'org_2',
+        transactionHash: `0x${'dd'.repeat(32)}`,
+      }),
+    ).rejects.toThrow()
+
+    expect(await SponsoredTransactions.get(db, first.id)).toStrictEqual(first)
+    await db.close()
+  })
+
   test('behavior: a raw submission reopens a failed fill intent', async () => {
     const db = create()
     await db.migrate()
@@ -172,6 +189,47 @@ describe('assignTransactionHash', () => {
     )
     await db.close()
   })
+
+  test('behavior: keeps an over-limit failed intent retryable across a period rollover', async () => {
+    const db = create()
+    await db.migrate()
+    const { transactionHash: _, ...intent } = input
+    vi.useFakeTimers({ now: new Date('2026-01-31T23:59:00.000Z') })
+    try {
+      const failed = await SponsoredTransactions.upsert(db, { ...intent, feeMax: '100' })
+      await SponsoredTransactions.fail(db, failed.id, new Date().toISOString())
+      vi.setSystemTime(new Date('2026-02-01T00:01:00.000Z'))
+      await SponsoredTransactions.upsert(db, {
+        ...intent,
+        feeMax: '100',
+        signPayload: `0x${'bc'.repeat(32)}`,
+      })
+
+      await expect(
+        SponsoredTransactions.assignTransactionHash(db, failed.id, input.transactionHash, {
+          chainIds: [input.chainId],
+          max: 100n,
+          since: '2026-02-01T00:00:00.000Z',
+        }),
+      ).rejects.toBeInstanceOf(SponsoredTransactions.PeriodSpendLimitError)
+      expect(await SponsoredTransactions.get(db, failed.id)).toMatchObject({
+        createdAt: '2026-01-31T23:59:00.000Z',
+        finalizedAt: '2026-02-01T00:01:00.000Z',
+        status: 'failed',
+        transactionHash: null,
+      })
+      expect(
+        (
+          await SponsoredTransactions.listIntents(db, {
+            failedSince: '2026-02-01T00:00:00.000Z',
+          })
+        ).map((record) => record.id),
+      ).toContain(failed.id)
+    } finally {
+      vi.useRealTimers()
+      await db.close()
+    }
+  })
 })
 
 describe('finalize', () => {

package/src/db/tables/sponsoredTransactions.ts

@@ -47,20 +47,27 @@ export async function upsert(db: Db.Db, input: upsert.Input): Promise<Record> {
     .insertInto('sponsored_transactions')
     .values(record)
     .onConflict((oc) =>
-      oc.column('signPayload').doUpdateSet((eb) => ({
-        // Same sign payload = same envelope = same cap; only fills older nulls.
-        currency: eb.fn.coalesce(eb.ref('sponsored_transactions.currency'), eb.ref('excluded.currency')), // prettier-ignore
-        feeMax: eb.fn.coalesce(eb.ref('sponsored_transactions.feeMax'), eb.ref('excluded.feeMax')),
-        // A raw submission fills the intent's hash; a duplicate intent never
-        // clears an already-known hash.
-        transactionHash: eb.fn.coalesce(
-          eb.ref('excluded.transactionHash'),
-          eb.ref('sponsored_transactions.transactionHash'),
-        ),
-        createdAt: sql`CASE WHEN ${eb.ref('sponsored_transactions.status')} = 'failed' THEN ${eb.ref('excluded.createdAt')} ELSE ${eb.ref('sponsored_transactions.createdAt')} END`,
-        finalizedAt: sql`CASE WHEN ${eb.ref('sponsored_transactions.status')} = 'failed' THEN NULL ELSE ${eb.ref('sponsored_transactions.finalizedAt')} END`,
-        status: sql`CASE WHEN ${eb.ref('sponsored_transactions.status')} = 'failed' THEN 'pending' ELSE ${eb.ref('sponsored_transactions.status')} END`,
-      })),
+      oc
+        .column('signPayload')
+        .doUpdateSet((eb) => ({
+          // Same sign payload = same envelope = same cap; only fills older nulls.
+          currency: eb.fn.coalesce(eb.ref('sponsored_transactions.currency'), eb.ref('excluded.currency')), // prettier-ignore
+          feeMax: eb.fn.coalesce(
+            eb.ref('sponsored_transactions.feeMax'),
+            eb.ref('excluded.feeMax'),
+          ),
+          // A raw submission fills the intent's hash; a duplicate intent never
+          // clears an already-known hash.
+          transactionHash: eb.fn.coalesce(
+            eb.ref('excluded.transactionHash'),
+            eb.ref('sponsored_transactions.transactionHash'),
+          ),
+          createdAt: sql`CASE WHEN ${eb.ref('sponsored_transactions.status')} = 'failed' THEN ${eb.ref('excluded.createdAt')} ELSE ${eb.ref('sponsored_transactions.createdAt')} END`,
+          finalizedAt: sql`CASE WHEN ${eb.ref('sponsored_transactions.status')} = 'failed' THEN NULL ELSE ${eb.ref('sponsored_transactions.finalizedAt')} END`,
+          status: sql`CASE WHEN ${eb.ref('sponsored_transactions.status')} = 'failed' THEN 'pending' ELSE ${eb.ref('sponsored_transactions.status')} END`,
+        }))
+        // A shared envelope cannot transfer billing attribution across tenants.
+        .where('sponsored_transactions.orgId', '=', input.orgId),
     )
     .returningAll()
     .executeTakeFirstOrThrow()
@@ -175,19 +182,58 @@ export declare namespace listIntents {
  * @param db - The database.
  * @param id - The sponsored-transaction id (`stx_…`).
  * @param transactionHash - The matched on-chain transaction hash.
+ * @param limit - The active period spend limit, when enforced.
  */
 export async function assignTransactionHash(
   db: Db.Db,
   id: string,
   transactionHash: string,
+  limit?: reserve.Limit,
 ): Promise<void> {
-  await db.kysely
-    .updateTable('sponsored_transactions')
-    .set({ finalizedAt: null, status: 'pending', transactionHash })
-    .where('id', '=', id)
-    .where('status', 'in', ['failed', 'pending'])
-    .where('transactionHash', 'is', null)
-    .execute()
+  try {
+    await db.transaction(async (tx) => {
+      const record = await get(tx, id)
+      if (
+        !record ||
+        record.transactionHash !== null ||
+        !['failed', 'pending'].includes(record.status)
+      )
+        return
+      if (record.status === 'failed' && record.billable && limit)
+        await sql`select pg_advisory_xact_lock(${billingLockClass}, hashtext(${record.orgId}))`.execute(tx.kysely) // prettier-ignore
+      await tx.kysely
+        .updateTable('sponsored_transactions')
+        .set({
+          ...(record.status === 'failed' ? { createdAt: new Date().toISOString() } : {}),
+          finalizedAt: null,
+          status: 'pending',
+          transactionHash,
+        })
+        .where('id', '=', id)
+        .where('status', '=', record.status)
+        .where('transactionHash', 'is', null)
+        .execute()
+      if (record.status === 'failed' && record.billable && limit) {
+        const committed = await spend(tx, {
+          chainIds: limit.chainIds,
+          orgId: record.orgId,
+          since: limit.since,
+        })
+        if (committed > limit.max) throw new PeriodSpendLimitError()
+      }
+    })
+  } catch (error) {
+    // Keep the on-chain match eligible until budget becomes available.
+    if (error instanceof PeriodSpendLimitError)
+      await db.kysely
+        .updateTable('sponsored_transactions')
+        .set({ finalizedAt: new Date().toISOString() })
+        .where('id', '=', id)
+        .where('status', '=', 'failed')
+        .where('transactionHash', 'is', null)
+        .execute()
+    throw error
+  }
 }
 
 /**

package/src/db/tables/stripeCustomers.test.ts

@@ -1,10 +1,10 @@
 import { nanoid } from 'nanoid'
 
-import { postgresUrl } from '../../../test/containers.js'
+import * as Runtime from '../../../test/runtime.js'
 import * as Db from '../Db.js'
 import * as StripeCustomers from './stripeCustomers.js'
 
-const create = () => Db.postgres({ connectionString: postgresUrl, schema: `t_${nanoid()}` })
+const create = () => Db.postgres({ connectionString: Runtime.postgresUrl, schema: `t_${nanoid()}` })
 
 /** Redacts nondeterministic row fields (timestamps). */
 function redact(record: StripeCustomers.Record) {

package/src/internal/Auth.test.ts

@@ -743,7 +743,7 @@ describe('require', () => {
   })
 
   describe('mpp', () => {
-    test('uses a default paid-request limit of 100 per minute', async () => {
+    test('uses a default paid-request limit with a normalized IPv6 identity', async () => {
       const rateLimit = underQuota()
       const consume = vi.spyOn(rateLimit, 'consume')
       const app = createApp({
@@ -757,7 +757,7 @@ describe('require', () => {
       const response = await app.request('/protected', {
         headers: {
           authorization: 'Payment paid',
-          'x-forwarded-for': '203.0.113.10',
+          'cf-connecting-ip': '2001:db8:abcd:12::1',
         },
       })
 
@@ -765,7 +765,60 @@ describe('require', () => {
       expect(response.headers.get('RateLimit-Limit')).toBe('100')
       expect(response.headers.get('RateLimit-Scope')).toBe('mpp')
       expect(consume).toHaveBeenCalledWith({
-        key: 'mpp:public:203.0.113.10',
+        key: 'mpp:public:2001:db8:abcd:12',
+        limit: { perMinute: 100 },
+      })
+    })
+
+    test('ignores untrusted forwarding headers for public identity', async () => {
+      const rateLimit = underQuota()
+      const consume = vi.spyOn(rateLimit, 'consume')
+      const app = createApp({
+        auth: {
+          apiKey: { resolve: TestApp.resolver({ keys: [{ ...key, token }] }) },
+          mpp: createMppHandler(),
+          rateLimit,
+        },
+        policy: { mpp: { session: { amount: '1' } } },
+      })
+      const response = await app.request('/protected', {
+        headers: {
+          authorization: 'Payment paid',
+          'x-forwarded-for': '203.0.113.10',
+          'x-real-ip': '203.0.113.11',
+          'x-test-client-ip': '203.0.113.12',
+        },
+      })
+
+      expect(response.status).toBe(200)
+      expect(consume).toHaveBeenCalledWith({
+        key: 'mpp:public:anonymous',
+        limit: { perMinute: 100 },
+      })
+    })
+
+    test('uses a configured trusted client-IP resolver outside Cloudflare', async () => {
+      const rateLimit = underQuota()
+      const consume = vi.spyOn(rateLimit, 'consume')
+      const app = createApp({
+        auth: {
+          apiKey: { resolve: TestApp.resolver({ keys: [{ ...key, token }] }) },
+          mpp: createMppHandler(),
+          publicClientIp: (request) => request.headers.get('x-real-ip') ?? undefined,
+          rateLimit,
+        },
+        policy: { mpp: { session: { amount: '1' } } },
+      })
+      const response = await app.request('/protected', {
+        headers: {
+          authorization: 'Payment paid',
+          'x-real-ip': '2001:db8:abcd:12::99',
+        },
+      })
+
+      expect(response.status).toBe(200)
+      expect(consume).toHaveBeenCalledWith({
+        key: 'mpp:public:2001:db8:abcd:12',
         limit: { perMinute: 100 },
       })
     })
@@ -788,7 +841,7 @@ describe('require', () => {
         headers: {
           authorization: 'Payment paid',
           'tempo-api-key': token,
-          'x-forwarded-for': '203.0.113.10',
+          'cf-connecting-ip': '203.0.113.10',
         },
       })
 
@@ -1228,7 +1281,7 @@ describe('require', () => {
         policy: { public: { rateLimit: { perMinute: 60 } } },
       })
       const response = await app.request('/protected', {
-        headers: { 'x-forwarded-for': '203.0.113.10' },
+        headers: { 'cf-connecting-ip': '203.0.113.10' },
       })
       const body = await response.json()
 
@@ -1280,7 +1333,7 @@ describe('require', () => {
           policy: { public: { rateLimit: { perMinute: 1 } } },
         })
         const response = await app.request('/protected', {
-          headers: { 'x-forwarded-for': '203.0.113.10' },
+          headers: { 'cf-connecting-ip': '203.0.113.10' },
         })
         const body = await response.json()
 
@@ -1338,7 +1391,7 @@ describe('require', () => {
           policy: { public: { rateLimit: { perMinute: 1 } } },
         })
         const pending = app.request('/protected', {
-          headers: { 'x-forwarded-for': '203.0.113.10' },
+          headers: { 'cf-connecting-ip': '203.0.113.10' },
         })
         // Advance past the 300ms consume timeout so it fails open.
         await vi.advanceTimersByTimeAsync(300)
@@ -1382,7 +1435,7 @@ describe('require', () => {
           policy: { public: { rateLimit: { perMinute: 1 } } },
         })
         const response = await app.request('/protected', {
-          headers: { 'x-forwarded-for': '203.0.113.10' },
+          headers: { 'cf-connecting-ip': '203.0.113.10' },
         })
         const body = await response.json()
 
@@ -1419,7 +1472,7 @@ describe('require', () => {
           policy: { public: { rateLimit: { perMinute: 1 } } },
         })
         const response = await app.request('/protected', {
-          headers: { 'x-forwarded-for': '203.0.113.10' },
+          headers: { 'cf-connecting-ip': '203.0.113.10' },
         })
 
         expect(response.status).toMatchInlineSnapshot(`200`)
@@ -1448,7 +1501,7 @@ describe('require', () => {
           policy: { public: { rateLimit: { perMinute: 1 } } },
         })
         const response = await app.request('/protected', {
-          headers: { 'x-forwarded-for': '203.0.113.10' },
+          headers: { 'cf-connecting-ip': '203.0.113.10' },
         })
 
         expect(response.status).toMatchInlineSnapshot(`200`)