@pafi-dev/issuer-postgres 0.2.0 → 0.3.0

package/dist/migrations/index.d.cts

@@ -3,10 +3,8 @@ import { MigrationInterface, QueryRunner } from 'typeorm';
 /**
  * Single consolidated initial schema for `@pafi-dev/issuer-postgres`.
  *
- * Combines what gg56 split into two migrations (`InitialSchema` +
- * `AddPendingCredits`) plus the `user_op_hash` column, since this is
- * the v1.4-and-after baseline. Issuers adopting the SDK from scratch
- * apply this once.
+ * Issuers adopting the SDK from scratch apply this migration once;
+ * subsequent schema changes ship as follow-up migrations.
  *
  * Tables:
  *   user_balances         — off-chain point balance per (user, token)
@@ -40,6 +38,138 @@ declare class CreateRedemptionHistory1746230400001 implements MigrationInterface
     down(queryRunner: QueryRunner): Promise<void>;
 }
 
+/**
+ * Adds a partial unique index on `ledger_journal` to enforce
+ * idempotency for indexer-driven reasons:
+ *
+ *   UNIQUE (user_address, tx_hash, reason) WHERE tx_hash IS NOT NULL
+ *
+ * Last-line defense against double-deduct / double-credit when the
+ * mint or burn indexer replays the same on-chain event (reorg, pod
+ * restart, duplicate replica). Rows with `tx_hash IS NULL` (off-chain
+ * credits like AIRDROP, refunds) are unaffected by the partial
+ * predicate.
+ *
+ * Pre-flight: existing duplicate `(user_address, tx_hash, reason)`
+ * rows with non-null `tx_hash` will block index creation. Operators
+ * who suspect prior double-processing should reconcile manually
+ * before applying. The query below surfaces offenders:
+ *
+ *   SELECT user_address, tx_hash, reason, COUNT(*)
+ *   FROM ledger_journal
+ *   WHERE tx_hash IS NOT NULL
+ *   GROUP BY user_address, tx_hash, reason
+ *   HAVING COUNT(*) > 1;
+ */
+declare class AddJournalIdempotencyIndex1747500000000 implements MigrationInterface {
+    name: string;
+    up(queryRunner: QueryRunner): Promise<void>;
+    down(queryRunner: QueryRunner): Promise<void>;
+}
+
+/**
+ * Replaces the narrow `IDX_locked_mint_user_status` (3 cols:
+ * `user_address`, `token_address`, `status`) with three composite
+ * indexes that match the actual query shapes used by the SDK.
+ *
+ * Index rationale:
+ *
+ *   `IDX_locked_mint_user_token_status_expires`
+ *     Covers `sumPendingLocks` (called inside every `getBalance` +
+ *     `lockForMinting`). The 4-col index lets Postgres push
+ *     `expires_at > NOW()` into the index range scan instead of
+ *     post-filtering rows from the heap. Without it, unswept
+ *     expired locks cause a latency cliff under load.
+ *
+ *   `IDX_locked_mint_user_token_amount_status`
+ *     Covers `PointIndexer.pickMatchingLock` and the lock-resolution
+ *     `findOne` inside `deductBalance`. The amount column is the
+ *     selectivity-critical predicate (PENDING locks for the same
+ *     user/token often share a token but differ by amount).
+ *
+ *   `IDX_locked_mint_pending_expires` (partial)
+ *     Covers the `markExpiredLocks` sweep. Partial predicate
+ *     `WHERE status = 'PENDING'` keeps the index small — terminal
+ *     rows (`MINTED` / `EXPIRED` / `FAILED`) drop out automatically.
+ *
+ * --- Operational notes ---
+ *
+ * `CREATE INDEX CONCURRENTLY` runs without a write lock on the table
+ * — safe on production traffic — but cannot run inside a transaction
+ * block. `transaction = false` disables TypeORM's per-migration
+ * transaction wrapping. Trade-off: if this migration partially
+ * fails, one or more indexes may be left in an INVALID state
+ * (`pg_index.indisvalid = false`). Recovery:
+ *
+ *   -- find half-built indexes
+ *   SELECT i.relname AS index_name
+ *   FROM pg_index x
+ *     JOIN pg_class i ON i.oid = x.indexrelid
+ *     JOIN pg_class t ON t.oid = x.indrelid
+ *   WHERE t.relname = 'locked_mint_requests' AND NOT x.indisvalid;
+ *
+ *   -- drop and rerun the migration
+ *   DROP INDEX CONCURRENTLY IF EXISTS "<index_name>";
+ *
+ * On large tables (10M+ rows) each `CREATE INDEX CONCURRENTLY` can
+ * take several minutes — it makes two table passes plus a final
+ * synchronisation. Plan accordingly.
+ */
+declare class AddLockedMintCompositeIndexes1747600000000 implements MigrationInterface {
+    name: string;
+    /**
+     * CONCURRENTLY index DDL cannot run inside a transaction. Tell
+     * TypeORM to issue these statements directly.
+     */
+    transaction: false;
+    up(queryRunner: QueryRunner): Promise<void>;
+    down(queryRunner: QueryRunner): Promise<void>;
+}
+
+/**
+ * Audit PACI5-7 — Tx-hash idempotency tuple collapses multi-token mints
+ * into a single debit.
+ *
+ * The original idempotency index (`UQ_ledger_journal_user_tx_reason`,
+ * shipped in `1747500000000-AddJournalIdempotencyIndex`) was
+ *
+ *   UNIQUE (user_address, tx_hash, reason) WHERE tx_hash IS NOT NULL
+ *
+ * which omits `token_address`. When a single transaction mints two
+ * different PointTokens for the same user (legitimate batched
+ * EIP-7702 claim, or Pimlico bundler grouping two single-mint
+ * UserOps into one bundle), the second indexer's "already processed?"
+ * lookup matches the first token's journal row and the debit is
+ * silently skipped — yet `PointIndexer.finalize` still flips the
+ * second lock to MINTED. Result: on-chain mint with no off-chain
+ * debit → off-chain balance stays spendable → user can re-mint until
+ * the issuer cap is exhausted.
+ *
+ * This migration replaces the tuple with the corrected one:
+ *
+ *   UNIQUE (user_address, token_address, tx_hash, reason)
+ *     WHERE tx_hash IS NOT NULL
+ *
+ * The `deductBalance` "already" lookup is updated to include
+ * `token_address` in the same release.
+ *
+ * Pre-flight: the new index is strictly more permissive than the old
+ * one (adds a column to the key, never removes), so no existing row
+ * pair that was unique under the old index can collide under the new
+ * one. Safe to apply on populated databases without reconciliation.
+ *
+ * Down migration restores the original (vulnerable) index — intended
+ * only for emergency rollback. Operators rolling back must also
+ * revert the `deductBalance` lookup in `postgresPointLedger.ts`;
+ * otherwise the application would query a four-column tuple against
+ * a three-column index and idempotency would fail open.
+ */
+declare class FixIdempotencyAddTokenAddress1747700000000 implements MigrationInterface {
+    name: string;
+    up(queryRunner: QueryRunner): Promise<void>;
+    down(queryRunner: QueryRunner): Promise<void>;
+}
+
 /**
  * All shipped migrations in chronological order. Drop into TypeORM's
  * `migrations` config:
@@ -51,6 +181,6 @@ declare class CreateRedemptionHistory1746230400001 implements MigrationInterface
  *     migrations: [...PAFI_MIGRATIONS, ...yourCustomMigrations],
  *   });
  */
-declare const PAFI_MIGRATIONS: readonly [typeof InitialSchema1700000000000, typeof CreateRedemptionHistory1746230400001];
+declare const PAFI_MIGRATIONS: readonly [typeof InitialSchema1700000000000, typeof CreateRedemptionHistory1746230400001, typeof AddJournalIdempotencyIndex1747500000000, typeof AddLockedMintCompositeIndexes1747600000000, typeof FixIdempotencyAddTokenAddress1747700000000];
 
-export { CreateRedemptionHistory1746230400001, InitialSchema1700000000000, PAFI_MIGRATIONS };
+export { AddJournalIdempotencyIndex1747500000000, AddLockedMintCompositeIndexes1747600000000, CreateRedemptionHistory1746230400001, FixIdempotencyAddTokenAddress1747700000000, InitialSchema1700000000000, PAFI_MIGRATIONS };

package/dist/migrations/index.d.ts

@@ -3,10 +3,8 @@ import { MigrationInterface, QueryRunner } from 'typeorm';
 /**
  * Single consolidated initial schema for `@pafi-dev/issuer-postgres`.
  *
- * Combines what gg56 split into two migrations (`InitialSchema` +
- * `AddPendingCredits`) plus the `user_op_hash` column, since this is
- * the v1.4-and-after baseline. Issuers adopting the SDK from scratch
- * apply this once.
+ * Issuers adopting the SDK from scratch apply this migration once;
+ * subsequent schema changes ship as follow-up migrations.
  *
  * Tables:
  *   user_balances         — off-chain point balance per (user, token)
@@ -40,6 +38,138 @@ declare class CreateRedemptionHistory1746230400001 implements MigrationInterface
     down(queryRunner: QueryRunner): Promise<void>;
 }
 
+/**
+ * Adds a partial unique index on `ledger_journal` to enforce
+ * idempotency for indexer-driven reasons:
+ *
+ *   UNIQUE (user_address, tx_hash, reason) WHERE tx_hash IS NOT NULL
+ *
+ * Last-line defense against double-deduct / double-credit when the
+ * mint or burn indexer replays the same on-chain event (reorg, pod
+ * restart, duplicate replica). Rows with `tx_hash IS NULL` (off-chain
+ * credits like AIRDROP, refunds) are unaffected by the partial
+ * predicate.
+ *
+ * Pre-flight: existing duplicate `(user_address, tx_hash, reason)`
+ * rows with non-null `tx_hash` will block index creation. Operators
+ * who suspect prior double-processing should reconcile manually
+ * before applying. The query below surfaces offenders:
+ *
+ *   SELECT user_address, tx_hash, reason, COUNT(*)
+ *   FROM ledger_journal
+ *   WHERE tx_hash IS NOT NULL
+ *   GROUP BY user_address, tx_hash, reason
+ *   HAVING COUNT(*) > 1;
+ */
+declare class AddJournalIdempotencyIndex1747500000000 implements MigrationInterface {
+    name: string;
+    up(queryRunner: QueryRunner): Promise<void>;
+    down(queryRunner: QueryRunner): Promise<void>;
+}
+
+/**
+ * Replaces the narrow `IDX_locked_mint_user_status` (3 cols:
+ * `user_address`, `token_address`, `status`) with three composite
+ * indexes that match the actual query shapes used by the SDK.
+ *
+ * Index rationale:
+ *
+ *   `IDX_locked_mint_user_token_status_expires`
+ *     Covers `sumPendingLocks` (called inside every `getBalance` +
+ *     `lockForMinting`). The 4-col index lets Postgres push
+ *     `expires_at > NOW()` into the index range scan instead of
+ *     post-filtering rows from the heap. Without it, unswept
+ *     expired locks cause a latency cliff under load.
+ *
+ *   `IDX_locked_mint_user_token_amount_status`
+ *     Covers `PointIndexer.pickMatchingLock` and the lock-resolution
+ *     `findOne` inside `deductBalance`. The amount column is the
+ *     selectivity-critical predicate (PENDING locks for the same
+ *     user/token often share a token but differ by amount).
+ *
+ *   `IDX_locked_mint_pending_expires` (partial)
+ *     Covers the `markExpiredLocks` sweep. Partial predicate
+ *     `WHERE status = 'PENDING'` keeps the index small — terminal
+ *     rows (`MINTED` / `EXPIRED` / `FAILED`) drop out automatically.
+ *
+ * --- Operational notes ---
+ *
+ * `CREATE INDEX CONCURRENTLY` runs without a write lock on the table
+ * — safe on production traffic — but cannot run inside a transaction
+ * block. `transaction = false` disables TypeORM's per-migration
+ * transaction wrapping. Trade-off: if this migration partially
+ * fails, one or more indexes may be left in an INVALID state
+ * (`pg_index.indisvalid = false`). Recovery:
+ *
+ *   -- find half-built indexes
+ *   SELECT i.relname AS index_name
+ *   FROM pg_index x
+ *     JOIN pg_class i ON i.oid = x.indexrelid
+ *     JOIN pg_class t ON t.oid = x.indrelid
+ *   WHERE t.relname = 'locked_mint_requests' AND NOT x.indisvalid;
+ *
+ *   -- drop and rerun the migration
+ *   DROP INDEX CONCURRENTLY IF EXISTS "<index_name>";
+ *
+ * On large tables (10M+ rows) each `CREATE INDEX CONCURRENTLY` can
+ * take several minutes — it makes two table passes plus a final
+ * synchronisation. Plan accordingly.
+ */
+declare class AddLockedMintCompositeIndexes1747600000000 implements MigrationInterface {
+    name: string;
+    /**
+     * CONCURRENTLY index DDL cannot run inside a transaction. Tell
+     * TypeORM to issue these statements directly.
+     */
+    transaction: false;
+    up(queryRunner: QueryRunner): Promise<void>;
+    down(queryRunner: QueryRunner): Promise<void>;
+}
+
+/**
+ * Audit PACI5-7 — Tx-hash idempotency tuple collapses multi-token mints
+ * into a single debit.
+ *
+ * The original idempotency index (`UQ_ledger_journal_user_tx_reason`,
+ * shipped in `1747500000000-AddJournalIdempotencyIndex`) was
+ *
+ *   UNIQUE (user_address, tx_hash, reason) WHERE tx_hash IS NOT NULL
+ *
+ * which omits `token_address`. When a single transaction mints two
+ * different PointTokens for the same user (legitimate batched
+ * EIP-7702 claim, or Pimlico bundler grouping two single-mint
+ * UserOps into one bundle), the second indexer's "already processed?"
+ * lookup matches the first token's journal row and the debit is
+ * silently skipped — yet `PointIndexer.finalize` still flips the
+ * second lock to MINTED. Result: on-chain mint with no off-chain
+ * debit → off-chain balance stays spendable → user can re-mint until
+ * the issuer cap is exhausted.
+ *
+ * This migration replaces the tuple with the corrected one:
+ *
+ *   UNIQUE (user_address, token_address, tx_hash, reason)
+ *     WHERE tx_hash IS NOT NULL
+ *
+ * The `deductBalance` "already" lookup is updated to include
+ * `token_address` in the same release.
+ *
+ * Pre-flight: the new index is strictly more permissive than the old
+ * one (adds a column to the key, never removes), so no existing row
+ * pair that was unique under the old index can collide under the new
+ * one. Safe to apply on populated databases without reconciliation.
+ *
+ * Down migration restores the original (vulnerable) index — intended
+ * only for emergency rollback. Operators rolling back must also
+ * revert the `deductBalance` lookup in `postgresPointLedger.ts`;
+ * otherwise the application would query a four-column tuple against
+ * a three-column index and idempotency would fail open.
+ */
+declare class FixIdempotencyAddTokenAddress1747700000000 implements MigrationInterface {
+    name: string;
+    up(queryRunner: QueryRunner): Promise<void>;
+    down(queryRunner: QueryRunner): Promise<void>;
+}
+
 /**
  * All shipped migrations in chronological order. Drop into TypeORM's
  * `migrations` config:
@@ -51,6 +181,6 @@ declare class CreateRedemptionHistory1746230400001 implements MigrationInterface
  *     migrations: [...PAFI_MIGRATIONS, ...yourCustomMigrations],
  *   });
  */
-declare const PAFI_MIGRATIONS: readonly [typeof InitialSchema1700000000000, typeof CreateRedemptionHistory1746230400001];
+declare const PAFI_MIGRATIONS: readonly [typeof InitialSchema1700000000000, typeof CreateRedemptionHistory1746230400001, typeof AddJournalIdempotencyIndex1747500000000, typeof AddLockedMintCompositeIndexes1747600000000, typeof FixIdempotencyAddTokenAddress1747700000000];
 
-export { CreateRedemptionHistory1746230400001, InitialSchema1700000000000, PAFI_MIGRATIONS };
+export { AddJournalIdempotencyIndex1747500000000, AddLockedMintCompositeIndexes1747600000000, CreateRedemptionHistory1746230400001, FixIdempotencyAddTokenAddress1747700000000, InitialSchema1700000000000, PAFI_MIGRATIONS };

package/dist/migrations/index.js

@@ -130,13 +130,109 @@ var CreateRedemptionHistory1746230400001 = class {
   }
 };
 
+// src/migrations/1747500000000-AddJournalIdempotencyIndex.ts
+var AddJournalIdempotencyIndex1747500000000 = class {
+  name = "AddJournalIdempotencyIndex1747500000000";
+  async up(queryRunner) {
+    await queryRunner.query(`
+      CREATE UNIQUE INDEX IF NOT EXISTS "UQ_ledger_journal_user_tx_reason"
+        ON "ledger_journal" ("user_address", "tx_hash", "reason")
+        WHERE "tx_hash" IS NOT NULL
+    `);
+  }
+  async down(queryRunner) {
+    await queryRunner.query(
+      `DROP INDEX IF EXISTS "UQ_ledger_journal_user_tx_reason"`
+    );
+  }
+};
+
+// src/migrations/1747600000000-AddLockedMintCompositeIndexes.ts
+var AddLockedMintCompositeIndexes1747600000000 = class {
+  name = "AddLockedMintCompositeIndexes1747600000000";
+  /**
+   * CONCURRENTLY index DDL cannot run inside a transaction. Tell
+   * TypeORM to issue these statements directly.
+   */
+  transaction = false;
+  async up(queryRunner) {
+    await queryRunner.query(`
+      CREATE INDEX CONCURRENTLY IF NOT EXISTS
+        "IDX_locked_mint_user_token_status_expires"
+      ON "locked_mint_requests"
+        ("user_address", "token_address", "status", "expires_at")
+    `);
+    await queryRunner.query(`
+      CREATE INDEX CONCURRENTLY IF NOT EXISTS
+        "IDX_locked_mint_user_token_amount_status"
+      ON "locked_mint_requests"
+        ("user_address", "token_address", "amount", "status")
+    `);
+    await queryRunner.query(`
+      CREATE INDEX CONCURRENTLY IF NOT EXISTS
+        "IDX_locked_mint_pending_expires"
+      ON "locked_mint_requests" ("expires_at")
+      WHERE "status" = 'PENDING'
+    `);
+    await queryRunner.query(
+      `DROP INDEX CONCURRENTLY IF EXISTS "IDX_locked_mint_user_status"`
+    );
+  }
+  async down(queryRunner) {
+    await queryRunner.query(`
+      CREATE INDEX CONCURRENTLY IF NOT EXISTS "IDX_locked_mint_user_status"
+      ON "locked_mint_requests" ("user_address", "token_address", "status")
+    `);
+    await queryRunner.query(
+      `DROP INDEX CONCURRENTLY IF EXISTS "IDX_locked_mint_pending_expires"`
+    );
+    await queryRunner.query(
+      `DROP INDEX CONCURRENTLY IF EXISTS "IDX_locked_mint_user_token_amount_status"`
+    );
+    await queryRunner.query(
+      `DROP INDEX CONCURRENTLY IF EXISTS "IDX_locked_mint_user_token_status_expires"`
+    );
+  }
+};
+
+// src/migrations/1747700000000-FixIdempotencyAddTokenAddress.ts
+var FixIdempotencyAddTokenAddress1747700000000 = class {
+  name = "FixIdempotencyAddTokenAddress1747700000000";
+  async up(queryRunner) {
+    await queryRunner.query(
+      `DROP INDEX IF EXISTS "UQ_ledger_journal_user_tx_reason"`
+    );
+    await queryRunner.query(`
+      CREATE UNIQUE INDEX IF NOT EXISTS "UQ_ledger_journal_user_token_tx_reason"
+        ON "ledger_journal" ("user_address", "token_address", "tx_hash", "reason")
+        WHERE "tx_hash" IS NOT NULL
+    `);
+  }
+  async down(queryRunner) {
+    await queryRunner.query(
+      `DROP INDEX IF EXISTS "UQ_ledger_journal_user_token_tx_reason"`
+    );
+    await queryRunner.query(`
+      CREATE UNIQUE INDEX IF NOT EXISTS "UQ_ledger_journal_user_tx_reason"
+        ON "ledger_journal" ("user_address", "tx_hash", "reason")
+        WHERE "tx_hash" IS NOT NULL
+    `);
+  }
+};
+
 // src/migrations/index.ts
 var PAFI_MIGRATIONS = [
   InitialSchema1700000000000,
-  CreateRedemptionHistory1746230400001
+  CreateRedemptionHistory1746230400001,
+  AddJournalIdempotencyIndex1747500000000,
+  AddLockedMintCompositeIndexes1747600000000,
+  FixIdempotencyAddTokenAddress1747700000000
 ];
 export {
+  AddJournalIdempotencyIndex1747500000000,
+  AddLockedMintCompositeIndexes1747600000000,
   CreateRedemptionHistory1746230400001,
+  FixIdempotencyAddTokenAddress1747700000000,
   InitialSchema1700000000000,
   PAFI_MIGRATIONS
 };

package/dist/migrations/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/migrations/1700000000000-InitialSchema.ts","../../src/migrations/1746230400001-CreateRedemptionHistory.ts","../../src/migrations/index.ts"],"sourcesContent":["import type { MigrationInterface, QueryRunner } from \"typeorm\";\n\n/**\n * Single consolidated initial schema for `@pafi-dev/issuer-postgres`.\n *\n * Combines what gg56 split into two migrations (`InitialSchema` +\n * `AddPendingCredits`) plus the `user_op_hash` column, since this is\n * the v1.4-and-after baseline. Issuers adopting the SDK from scratch\n * apply this once.\n *\n * Tables:\n *   user_balances         — off-chain point balance per (user, token)\n *   locked_mint_requests  — reservations during mint flow\n *   pending_credits       — reserved credits during burn/redeem flow\n *   ledger_journal        — append-only audit trail of every delta\n *   indexer_cursors       — PointIndexer / BurnIndexer block cursors\n *\n * Issuer-specific extensions (campaign rules, KYC tables, custom\n * scenarios) belong in a follow-up migration — never edit this file\n * in place once it ships.\n */\nexport class InitialSchema1700000000000 implements MigrationInterface {\n  name = \"InitialSchema1700000000000\";\n\n  public async up(queryRunner: QueryRunner): Promise<void> {\n    await queryRunner.query(`CREATE EXTENSION IF NOT EXISTS \"pgcrypto\"`);\n\n    // ─── user_balances ──────────────────────────────────────────────\n    await queryRunner.query(`\n      CREATE TABLE \"user_balances\" (\n        \"user_address\" varchar(42) NOT NULL,\n        \"token_address\" varchar(42) NOT NULL,\n        \"balance\" numeric(78, 0) NOT NULL DEFAULT 0,\n        \"updated_at\" TIMESTAMP NOT NULL DEFAULT now(),\n        CONSTRAINT \"PK_user_balances\" PRIMARY KEY (\"user_address\", \"token_address\")\n      )\n    `);\n\n    // ─── locked_mint_requests ───────────────────────────────────────\n    await queryRunner.query(`\n      CREATE TABLE \"locked_mint_requests\" (\n        \"id\" uuid NOT NULL DEFAULT gen_random_uuid(),\n        \"user_address\" varchar(42) NOT NULL,\n        \"token_address\" varchar(42) NOT NULL,\n        \"amount\" numeric(78, 0) NOT NULL,\n        \"status\" varchar(16) NOT NULL DEFAULT 'PENDING',\n        \"created_at\" TIMESTAMP NOT NULL DEFAULT now(),\n        \"expires_at\" TIMESTAMP WITH TIME ZONE NOT NULL,\n        \"tx_hash\" varchar(66),\n        \"user_op_hash\" varchar(66),\n        CONSTRAINT \"PK_locked_mint_requests\" PRIMARY KEY (\"id\")\n      )\n    `);\n    await queryRunner.query(`\n      CREATE INDEX \"IDX_locked_mint_user_status\"\n        ON \"locked_mint_requests\" (\"user_address\", \"token_address\", \"status\")\n    `);\n    await queryRunner.query(`\n      CREATE INDEX \"IDX_locked_mint_user_op_hash\"\n        ON \"locked_mint_requests\" (\"user_op_hash\")\n    `);\n\n    // ─── pending_credits ────────────────────────────────────────────\n    await queryRunner.query(`\n      CREATE TABLE \"pending_credits\" (\n        \"id\" uuid NOT NULL DEFAULT gen_random_uuid(),\n        \"user_address\" varchar(42) NOT NULL,\n        \"token_address\" varchar(42) NOT NULL,\n        \"amount\" numeric(78, 0) NOT NULL,\n        \"status\" varchar(16) NOT NULL DEFAULT 'PENDING',\n        \"tx_hash\" varchar(66),\n        \"user_op_hash\" varchar(66),\n        \"created_at\" TIMESTAMP NOT NULL DEFAULT now(),\n        \"expires_at\" TIMESTAMP WITH TIME ZONE NOT NULL,\n        \"resolved_at\" TIMESTAMP WITH TIME ZONE,\n        CONSTRAINT \"PK_pending_credits\" PRIMARY KEY (\"id\")\n      )\n    `);\n    await queryRunner.query(`\n      CREATE INDEX \"IDX_pending_credits_user_status\"\n        ON \"pending_credits\" (\"user_address\", \"token_address\", \"status\")\n    `);\n    await queryRunner.query(`\n      CREATE INDEX \"IDX_pending_credits_tx_hash\"\n        ON \"pending_credits\" (\"tx_hash\")\n    `);\n    await queryRunner.query(`\n      CREATE INDEX \"IDX_pending_credits_user_op_hash\"\n        ON \"pending_credits\" (\"user_op_hash\")\n    `);\n\n    // ─── ledger_journal ─────────────────────────────────────────────\n    await queryRunner.query(`\n      CREATE TABLE \"ledger_journal\" (\n        \"id\" uuid NOT NULL DEFAULT gen_random_uuid(),\n        \"user_address\" varchar(42) NOT NULL,\n        \"token_address\" varchar(42) NOT NULL,\n        \"delta\" numeric(78, 0) NOT NULL,\n        \"reason\" varchar(128) NOT NULL,\n        \"tx_hash\" varchar(66),\n        \"created_at\" TIMESTAMP NOT NULL DEFAULT now(),\n        CONSTRAINT \"PK_ledger_journal\" PRIMARY KEY (\"id\")\n      )\n    `);\n    await queryRunner.query(`\n      CREATE INDEX \"IDX_ledger_journal_user_created\"\n        ON \"ledger_journal\" (\"user_address\", \"token_address\", \"created_at\")\n    `);\n\n    // ─── indexer_cursors ────────────────────────────────────────────\n    await queryRunner.query(`\n      CREATE TABLE \"indexer_cursors\" (\n        \"id\" varchar(64) NOT NULL,\n        \"next_block\" numeric(78, 0) NOT NULL,\n        \"updated_at\" TIMESTAMP NOT NULL DEFAULT now(),\n        CONSTRAINT \"PK_indexer_cursors\" PRIMARY KEY (\"id\")\n      )\n    `);\n  }\n\n  public async down(queryRunner: QueryRunner): Promise<void> {\n    await queryRunner.query(`DROP TABLE \"indexer_cursors\"`);\n    await queryRunner.query(`DROP INDEX \"IDX_ledger_journal_user_created\"`);\n    await queryRunner.query(`DROP TABLE \"ledger_journal\"`);\n    await queryRunner.query(`DROP INDEX \"IDX_pending_credits_user_op_hash\"`);\n    await queryRunner.query(`DROP INDEX \"IDX_pending_credits_tx_hash\"`);\n    await queryRunner.query(`DROP INDEX \"IDX_pending_credits_user_status\"`);\n    await queryRunner.query(`DROP TABLE \"pending_credits\"`);\n    await queryRunner.query(`DROP INDEX \"IDX_locked_mint_user_op_hash\"`);\n    await queryRunner.query(`DROP INDEX \"IDX_locked_mint_user_status\"`);\n    await queryRunner.query(`DROP TABLE \"locked_mint_requests\"`);\n    await queryRunner.query(`DROP TABLE \"user_balances\"`);\n  }\n}\n","import { MigrationInterface, QueryRunner } from \"typeorm\";\n\n/**\n * Adds the `redemption_history` table — append-only log of successful\n * redemption initiates, indexed by (user, time) for the daily-limit\n * SUM() query.\n *\n * This is INDEPENDENT from the main InitialSchema (different timestamp,\n * later than 1700000000000). Issuers who already deployed InitialSchema\n * apply this on top.\n */\nexport class CreateRedemptionHistory1746230400001 implements MigrationInterface {\n  name = \"CreateRedemptionHistory1746230400001\";\n\n  public async up(queryRunner: QueryRunner): Promise<void> {\n    await queryRunner.query(`\n      CREATE TABLE IF NOT EXISTS redemption_history (\n        id                    uuid           PRIMARY KEY DEFAULT gen_random_uuid(),\n        user_address          varchar(42)    NOT NULL,\n        token_address         varchar(42),\n        amount_pt             numeric(78, 0) NOT NULL,\n        created_at_unix_sec   bigint         NOT NULL,\n        reservation_id        varchar(64),\n        row_created_at        timestamptz    NOT NULL DEFAULT NOW(),\n        CONSTRAINT redemption_history_amount_positive CHECK (amount_pt > 0)\n      )\n    `);\n\n    await queryRunner.query(`\n      CREATE INDEX IF NOT EXISTS idx_redemption_history_user_created\n        ON redemption_history (user_address, created_at_unix_sec DESC)\n    `);\n  }\n\n  public async down(queryRunner: QueryRunner): Promise<void> {\n    await queryRunner.query(\n      `DROP INDEX IF EXISTS idx_redemption_history_user_created`,\n    );\n    await queryRunner.query(`DROP TABLE IF EXISTS redemption_history`);\n  }\n}\n","export { InitialSchema1700000000000 } from \"./1700000000000-InitialSchema\";\nexport { CreateRedemptionHistory1746230400001 } from \"./1746230400001-CreateRedemptionHistory\";\n\nimport { InitialSchema1700000000000 } from \"./1700000000000-InitialSchema\";\nimport { CreateRedemptionHistory1746230400001 } from \"./1746230400001-CreateRedemptionHistory\";\n\n/**\n * All shipped migrations in chronological order. Drop into TypeORM's\n * `migrations` config:\n *\n *   import { PAFI_MIGRATIONS } from \"@pafi-dev/issuer-postgres/migrations\";\n *\n *   new DataSource({\n *     entities: [...PAFI_ENTITIES, ...yourCustomEntities],\n *     migrations: [...PAFI_MIGRATIONS, ...yourCustomMigrations],\n *   });\n */\nexport const PAFI_MIGRATIONS = [\n  InitialSchema1700000000000,\n  CreateRedemptionHistory1746230400001,\n] as const;\n"],"mappings":";AAqBO,IAAM,6BAAN,MAA+D;AAAA,EACpE,OAAO;AAAA,EAEP,MAAa,GAAG,aAAyC;AACvD,UAAM,YAAY,MAAM,2CAA2C;AAGnE,UAAM,YAAY,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,KAQvB;AAGD,UAAM,YAAY,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,KAavB;AACD,UAAM,YAAY,MAAM;AAAA;AAAA;AAAA,KAGvB;AACD,UAAM,YAAY,MAAM;AAAA;AAAA;AAAA,KAGvB;AAGD,UAAM,YAAY,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,KAcvB;AACD,UAAM,YAAY,MAAM;AAAA;AAAA;AAAA,KAGvB;AACD,UAAM,YAAY,MAAM;AAAA;AAAA;AAAA,KAGvB;AACD,UAAM,YAAY,MAAM;AAAA;AAAA;AAAA,KAGvB;AAGD,UAAM,YAAY,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,KAWvB;AACD,UAAM,YAAY,MAAM;AAAA;AAAA;AAAA,KAGvB;AAGD,UAAM,YAAY,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,KAOvB;AAAA,EACH;AAAA,EAEA,MAAa,KAAK,aAAyC;AACzD,UAAM,YAAY,MAAM,8BAA8B;AACtD,UAAM,YAAY,MAAM,8CAA8C;AACtE,UAAM,YAAY,MAAM,6BAA6B;AACrD,UAAM,YAAY,MAAM,+CAA+C;AACvE,UAAM,YAAY,MAAM,0CAA0C;AAClE,UAAM,YAAY,MAAM,8CAA8C;AACtE,UAAM,YAAY,MAAM,8BAA8B;AACtD,UAAM,YAAY,MAAM,2CAA2C;AACnE,UAAM,YAAY,MAAM,0CAA0C;AAClE,UAAM,YAAY,MAAM,mCAAmC;AAC3D,UAAM,YAAY,MAAM,4BAA4B;AAAA,EACtD;AACF;;;AC1HO,IAAM,uCAAN,MAAyE;AAAA,EAC9E,OAAO;AAAA,EAEP,MAAa,GAAG,aAAyC;AACvD,UAAM,YAAY,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,KAWvB;AAED,UAAM,YAAY,MAAM;AAAA;AAAA;AAAA,KAGvB;AAAA,EACH;AAAA,EAEA,MAAa,KAAK,aAAyC;AACzD,UAAM,YAAY;AAAA,MAChB;AAAA,IACF;AACA,UAAM,YAAY,MAAM,yCAAyC;AAAA,EACnE;AACF;;;ACvBO,IAAM,kBAAkB;AAAA,EAC7B;AAAA,EACA;AACF;","names":[]}
+{"version":3,"sources":["../../src/migrations/1700000000000-InitialSchema.ts","../../src/migrations/1746230400001-CreateRedemptionHistory.ts","../../src/migrations/1747500000000-AddJournalIdempotencyIndex.ts","../../src/migrations/1747600000000-AddLockedMintCompositeIndexes.ts","../../src/migrations/1747700000000-FixIdempotencyAddTokenAddress.ts","../../src/migrations/index.ts"],"sourcesContent":["import type { MigrationInterface, QueryRunner } from \"typeorm\";\n\n/**\n * Single consolidated initial schema for `@pafi-dev/issuer-postgres`.\n *\n * Issuers adopting the SDK from scratch apply this migration once;\n * subsequent schema changes ship as follow-up migrations.\n *\n * Tables:\n *   user_balances         — off-chain point balance per (user, token)\n *   locked_mint_requests  — reservations during mint flow\n *   pending_credits       — reserved credits during burn/redeem flow\n *   ledger_journal        — append-only audit trail of every delta\n *   indexer_cursors       — PointIndexer / BurnIndexer block cursors\n *\n * Issuer-specific extensions (campaign rules, KYC tables, custom\n * scenarios) belong in a follow-up migration — never edit this file\n * in place once it ships.\n */\nexport class InitialSchema1700000000000 implements MigrationInterface {\n  name = \"InitialSchema1700000000000\";\n\n  public async up(queryRunner: QueryRunner): Promise<void> {\n    await queryRunner.query(`CREATE EXTENSION IF NOT EXISTS \"pgcrypto\"`);\n\n    // ─── user_balances ──────────────────────────────────────────────\n    await queryRunner.query(`\n      CREATE TABLE \"user_balances\" (\n        \"user_address\" varchar(42) NOT NULL,\n        \"token_address\" varchar(42) NOT NULL,\n        \"balance\" numeric(78, 0) NOT NULL DEFAULT 0,\n        \"updated_at\" TIMESTAMP NOT NULL DEFAULT now(),\n        CONSTRAINT \"PK_user_balances\" PRIMARY KEY (\"user_address\", \"token_address\")\n      )\n    `);\n\n    // ─── locked_mint_requests ───────────────────────────────────────\n    await queryRunner.query(`\n      CREATE TABLE \"locked_mint_requests\" (\n        \"id\" uuid NOT NULL DEFAULT gen_random_uuid(),\n        \"user_address\" varchar(42) NOT NULL,\n        \"token_address\" varchar(42) NOT NULL,\n        \"amount\" numeric(78, 0) NOT NULL,\n        \"status\" varchar(16) NOT NULL DEFAULT 'PENDING',\n        \"created_at\" TIMESTAMP NOT NULL DEFAULT now(),\n        \"expires_at\" TIMESTAMP WITH TIME ZONE NOT NULL,\n        \"tx_hash\" varchar(66),\n        \"user_op_hash\" varchar(66),\n        CONSTRAINT \"PK_locked_mint_requests\" PRIMARY KEY (\"id\")\n      )\n    `);\n    await queryRunner.query(`\n      CREATE INDEX \"IDX_locked_mint_user_status\"\n        ON \"locked_mint_requests\" (\"user_address\", \"token_address\", \"status\")\n    `);\n    await queryRunner.query(`\n      CREATE INDEX \"IDX_locked_mint_user_op_hash\"\n        ON \"locked_mint_requests\" (\"user_op_hash\")\n    `);\n\n    // ─── pending_credits ────────────────────────────────────────────\n    await queryRunner.query(`\n      CREATE TABLE \"pending_credits\" (\n        \"id\" uuid NOT NULL DEFAULT gen_random_uuid(),\n        \"user_address\" varchar(42) NOT NULL,\n        \"token_address\" varchar(42) NOT NULL,\n        \"amount\" numeric(78, 0) NOT NULL,\n        \"status\" varchar(16) NOT NULL DEFAULT 'PENDING',\n        \"tx_hash\" varchar(66),\n        \"user_op_hash\" varchar(66),\n        \"created_at\" TIMESTAMP NOT NULL DEFAULT now(),\n        \"expires_at\" TIMESTAMP WITH TIME ZONE NOT NULL,\n        \"resolved_at\" TIMESTAMP WITH TIME ZONE,\n        CONSTRAINT \"PK_pending_credits\" PRIMARY KEY (\"id\")\n      )\n    `);\n    await queryRunner.query(`\n      CREATE INDEX \"IDX_pending_credits_user_status\"\n        ON \"pending_credits\" (\"user_address\", \"token_address\", \"status\")\n    `);\n    await queryRunner.query(`\n      CREATE INDEX \"IDX_pending_credits_tx_hash\"\n        ON \"pending_credits\" (\"tx_hash\")\n    `);\n    await queryRunner.query(`\n      CREATE INDEX \"IDX_pending_credits_user_op_hash\"\n        ON \"pending_credits\" (\"user_op_hash\")\n    `);\n\n    // ─── ledger_journal ─────────────────────────────────────────────\n    await queryRunner.query(`\n      CREATE TABLE \"ledger_journal\" (\n        \"id\" uuid NOT NULL DEFAULT gen_random_uuid(),\n        \"user_address\" varchar(42) NOT NULL,\n        \"token_address\" varchar(42) NOT NULL,\n        \"delta\" numeric(78, 0) NOT NULL,\n        \"reason\" varchar(128) NOT NULL,\n        \"tx_hash\" varchar(66),\n        \"created_at\" TIMESTAMP NOT NULL DEFAULT now(),\n        CONSTRAINT \"PK_ledger_journal\" PRIMARY KEY (\"id\")\n      )\n    `);\n    await queryRunner.query(`\n      CREATE INDEX \"IDX_ledger_journal_user_created\"\n        ON \"ledger_journal\" (\"user_address\", \"token_address\", \"created_at\")\n    `);\n\n    // ─── indexer_cursors ────────────────────────────────────────────\n    await queryRunner.query(`\n      CREATE TABLE \"indexer_cursors\" (\n        \"id\" varchar(64) NOT NULL,\n        \"next_block\" numeric(78, 0) NOT NULL,\n        \"updated_at\" TIMESTAMP NOT NULL DEFAULT now(),\n        CONSTRAINT \"PK_indexer_cursors\" PRIMARY KEY (\"id\")\n      )\n    `);\n  }\n\n  public async down(queryRunner: QueryRunner): Promise<void> {\n    await queryRunner.query(`DROP TABLE \"indexer_cursors\"`);\n    await queryRunner.query(`DROP INDEX \"IDX_ledger_journal_user_created\"`);\n    await queryRunner.query(`DROP TABLE \"ledger_journal\"`);\n    await queryRunner.query(`DROP INDEX \"IDX_pending_credits_user_op_hash\"`);\n    await queryRunner.query(`DROP INDEX \"IDX_pending_credits_tx_hash\"`);\n    await queryRunner.query(`DROP INDEX \"IDX_pending_credits_user_status\"`);\n    await queryRunner.query(`DROP TABLE \"pending_credits\"`);\n    await queryRunner.query(`DROP INDEX \"IDX_locked_mint_user_op_hash\"`);\n    await queryRunner.query(`DROP INDEX \"IDX_locked_mint_user_status\"`);\n    await queryRunner.query(`DROP TABLE \"locked_mint_requests\"`);\n    await queryRunner.query(`DROP TABLE \"user_balances\"`);\n  }\n}\n","import { MigrationInterface, QueryRunner } from \"typeorm\";\n\n/**\n * Adds the `redemption_history` table — append-only log of successful\n * redemption initiates, indexed by (user, time) for the daily-limit\n * SUM() query.\n *\n * This is INDEPENDENT from the main InitialSchema (different timestamp,\n * later than 1700000000000). Issuers who already deployed InitialSchema\n * apply this on top.\n */\nexport class CreateRedemptionHistory1746230400001 implements MigrationInterface {\n  name = \"CreateRedemptionHistory1746230400001\";\n\n  public async up(queryRunner: QueryRunner): Promise<void> {\n    await queryRunner.query(`\n      CREATE TABLE IF NOT EXISTS redemption_history (\n        id                    uuid           PRIMARY KEY DEFAULT gen_random_uuid(),\n        user_address          varchar(42)    NOT NULL,\n        token_address         varchar(42),\n        amount_pt             numeric(78, 0) NOT NULL,\n        created_at_unix_sec   bigint         NOT NULL,\n        reservation_id        varchar(64),\n        row_created_at        timestamptz    NOT NULL DEFAULT NOW(),\n        CONSTRAINT redemption_history_amount_positive CHECK (amount_pt > 0)\n      )\n    `);\n\n    await queryRunner.query(`\n      CREATE INDEX IF NOT EXISTS idx_redemption_history_user_created\n        ON redemption_history (user_address, created_at_unix_sec DESC)\n    `);\n  }\n\n  public async down(queryRunner: QueryRunner): Promise<void> {\n    await queryRunner.query(\n      `DROP INDEX IF EXISTS idx_redemption_history_user_created`,\n    );\n    await queryRunner.query(`DROP TABLE IF EXISTS redemption_history`);\n  }\n}\n","import type { MigrationInterface, QueryRunner } from \"typeorm\";\n\n/**\n * Adds a partial unique index on `ledger_journal` to enforce\n * idempotency for indexer-driven reasons:\n *\n *   UNIQUE (user_address, tx_hash, reason) WHERE tx_hash IS NOT NULL\n *\n * Last-line defense against double-deduct / double-credit when the\n * mint or burn indexer replays the same on-chain event (reorg, pod\n * restart, duplicate replica). Rows with `tx_hash IS NULL` (off-chain\n * credits like AIRDROP, refunds) are unaffected by the partial\n * predicate.\n *\n * Pre-flight: existing duplicate `(user_address, tx_hash, reason)`\n * rows with non-null `tx_hash` will block index creation. Operators\n * who suspect prior double-processing should reconcile manually\n * before applying. The query below surfaces offenders:\n *\n *   SELECT user_address, tx_hash, reason, COUNT(*)\n *   FROM ledger_journal\n *   WHERE tx_hash IS NOT NULL\n *   GROUP BY user_address, tx_hash, reason\n *   HAVING COUNT(*) > 1;\n */\nexport class AddJournalIdempotencyIndex1747500000000\n  implements MigrationInterface\n{\n  name = \"AddJournalIdempotencyIndex1747500000000\";\n\n  public async up(queryRunner: QueryRunner): Promise<void> {\n    await queryRunner.query(`\n      CREATE UNIQUE INDEX IF NOT EXISTS \"UQ_ledger_journal_user_tx_reason\"\n        ON \"ledger_journal\" (\"user_address\", \"tx_hash\", \"reason\")\n        WHERE \"tx_hash\" IS NOT NULL\n    `);\n  }\n\n  public async down(queryRunner: QueryRunner): Promise<void> {\n    await queryRunner.query(\n      `DROP INDEX IF EXISTS \"UQ_ledger_journal_user_tx_reason\"`,\n    );\n  }\n}\n","import type { MigrationInterface, QueryRunner } from \"typeorm\";\n\n/**\n * Replaces the narrow `IDX_locked_mint_user_status` (3 cols:\n * `user_address`, `token_address`, `status`) with three composite\n * indexes that match the actual query shapes used by the SDK.\n *\n * Index rationale:\n *\n *   `IDX_locked_mint_user_token_status_expires`\n *     Covers `sumPendingLocks` (called inside every `getBalance` +\n *     `lockForMinting`). The 4-col index lets Postgres push\n *     `expires_at > NOW()` into the index range scan instead of\n *     post-filtering rows from the heap. Without it, unswept\n *     expired locks cause a latency cliff under load.\n *\n *   `IDX_locked_mint_user_token_amount_status`\n *     Covers `PointIndexer.pickMatchingLock` and the lock-resolution\n *     `findOne` inside `deductBalance`. The amount column is the\n *     selectivity-critical predicate (PENDING locks for the same\n *     user/token often share a token but differ by amount).\n *\n *   `IDX_locked_mint_pending_expires` (partial)\n *     Covers the `markExpiredLocks` sweep. Partial predicate\n *     `WHERE status = 'PENDING'` keeps the index small — terminal\n *     rows (`MINTED` / `EXPIRED` / `FAILED`) drop out automatically.\n *\n * --- Operational notes ---\n *\n * `CREATE INDEX CONCURRENTLY` runs without a write lock on the table\n * — safe on production traffic — but cannot run inside a transaction\n * block. `transaction = false` disables TypeORM's per-migration\n * transaction wrapping. Trade-off: if this migration partially\n * fails, one or more indexes may be left in an INVALID state\n * (`pg_index.indisvalid = false`). Recovery:\n *\n *   -- find half-built indexes\n *   SELECT i.relname AS index_name\n *   FROM pg_index x\n *     JOIN pg_class i ON i.oid = x.indexrelid\n *     JOIN pg_class t ON t.oid = x.indrelid\n *   WHERE t.relname = 'locked_mint_requests' AND NOT x.indisvalid;\n *\n *   -- drop and rerun the migration\n *   DROP INDEX CONCURRENTLY IF EXISTS \"<index_name>\";\n *\n * On large tables (10M+ rows) each `CREATE INDEX CONCURRENTLY` can\n * take several minutes — it makes two table passes plus a final\n * synchronisation. Plan accordingly.\n */\nexport class AddLockedMintCompositeIndexes1747600000000\n  implements MigrationInterface\n{\n  name = \"AddLockedMintCompositeIndexes1747600000000\";\n\n  /**\n   * CONCURRENTLY index DDL cannot run inside a transaction. Tell\n   * TypeORM to issue these statements directly.\n   */\n  transaction = false as const;\n\n  public async up(queryRunner: QueryRunner): Promise<void> {\n    // Order matters: create the replacement indexes BEFORE dropping\n    // the narrow one, so concurrent reads always have at least one\n    // usable index throughout the migration.\n    await queryRunner.query(`\n      CREATE INDEX CONCURRENTLY IF NOT EXISTS\n        \"IDX_locked_mint_user_token_status_expires\"\n      ON \"locked_mint_requests\"\n        (\"user_address\", \"token_address\", \"status\", \"expires_at\")\n    `);\n\n    await queryRunner.query(`\n      CREATE INDEX CONCURRENTLY IF NOT EXISTS\n        \"IDX_locked_mint_user_token_amount_status\"\n      ON \"locked_mint_requests\"\n        (\"user_address\", \"token_address\", \"amount\", \"status\")\n    `);\n\n    await queryRunner.query(`\n      CREATE INDEX CONCURRENTLY IF NOT EXISTS\n        \"IDX_locked_mint_pending_expires\"\n      ON \"locked_mint_requests\" (\"expires_at\")\n      WHERE \"status\" = 'PENDING'\n    `);\n\n    // The old `(user_address, token_address, status)` index is a\n    // strict prefix of the new 4-col index, so dropping it is safe.\n    await queryRunner.query(\n      `DROP INDEX CONCURRENTLY IF EXISTS \"IDX_locked_mint_user_status\"`,\n    );\n  }\n\n  public async down(queryRunner: QueryRunner): Promise<void> {\n    // Restore the original narrow index first, then drop the new\n    // ones — same \"always have a usable index\" invariant in reverse.\n    await queryRunner.query(`\n      CREATE INDEX CONCURRENTLY IF NOT EXISTS \"IDX_locked_mint_user_status\"\n      ON \"locked_mint_requests\" (\"user_address\", \"token_address\", \"status\")\n    `);\n    await queryRunner.query(\n      `DROP INDEX CONCURRENTLY IF EXISTS \"IDX_locked_mint_pending_expires\"`,\n    );\n    await queryRunner.query(\n      `DROP INDEX CONCURRENTLY IF EXISTS \"IDX_locked_mint_user_token_amount_status\"`,\n    );\n    await queryRunner.query(\n      `DROP INDEX CONCURRENTLY IF EXISTS \"IDX_locked_mint_user_token_status_expires\"`,\n    );\n  }\n}\n","import type { MigrationInterface, QueryRunner } from \"typeorm\";\n\n/**\n * Audit PACI5-7 — Tx-hash idempotency tuple collapses multi-token mints\n * into a single debit.\n *\n * The original idempotency index (`UQ_ledger_journal_user_tx_reason`,\n * shipped in `1747500000000-AddJournalIdempotencyIndex`) was\n *\n *   UNIQUE (user_address, tx_hash, reason) WHERE tx_hash IS NOT NULL\n *\n * which omits `token_address`. When a single transaction mints two\n * different PointTokens for the same user (legitimate batched\n * EIP-7702 claim, or Pimlico bundler grouping two single-mint\n * UserOps into one bundle), the second indexer's \"already processed?\"\n * lookup matches the first token's journal row and the debit is\n * silently skipped — yet `PointIndexer.finalize` still flips the\n * second lock to MINTED. Result: on-chain mint with no off-chain\n * debit → off-chain balance stays spendable → user can re-mint until\n * the issuer cap is exhausted.\n *\n * This migration replaces the tuple with the corrected one:\n *\n *   UNIQUE (user_address, token_address, tx_hash, reason)\n *     WHERE tx_hash IS NOT NULL\n *\n * The `deductBalance` \"already\" lookup is updated to include\n * `token_address` in the same release.\n *\n * Pre-flight: the new index is strictly more permissive than the old\n * one (adds a column to the key, never removes), so no existing row\n * pair that was unique under the old index can collide under the new\n * one. Safe to apply on populated databases without reconciliation.\n *\n * Down migration restores the original (vulnerable) index — intended\n * only for emergency rollback. Operators rolling back must also\n * revert the `deductBalance` lookup in `postgresPointLedger.ts`;\n * otherwise the application would query a four-column tuple against\n * a three-column index and idempotency would fail open.\n */\nexport class FixIdempotencyAddTokenAddress1747700000000\n  implements MigrationInterface\n{\n  name = \"FixIdempotencyAddTokenAddress1747700000000\";\n\n  public async up(queryRunner: QueryRunner): Promise<void> {\n    await queryRunner.query(\n      `DROP INDEX IF EXISTS \"UQ_ledger_journal_user_tx_reason\"`,\n    );\n    await queryRunner.query(`\n      CREATE UNIQUE INDEX IF NOT EXISTS \"UQ_ledger_journal_user_token_tx_reason\"\n        ON \"ledger_journal\" (\"user_address\", \"token_address\", \"tx_hash\", \"reason\")\n        WHERE \"tx_hash\" IS NOT NULL\n    `);\n  }\n\n  public async down(queryRunner: QueryRunner): Promise<void> {\n    await queryRunner.query(\n      `DROP INDEX IF EXISTS \"UQ_ledger_journal_user_token_tx_reason\"`,\n    );\n    await queryRunner.query(`\n      CREATE UNIQUE INDEX IF NOT EXISTS \"UQ_ledger_journal_user_tx_reason\"\n        ON \"ledger_journal\" (\"user_address\", \"tx_hash\", \"reason\")\n        WHERE \"tx_hash\" IS NOT NULL\n    `);\n  }\n}\n","export { InitialSchema1700000000000 } from \"./1700000000000-InitialSchema\";\nexport { CreateRedemptionHistory1746230400001 } from \"./1746230400001-CreateRedemptionHistory\";\nexport { AddJournalIdempotencyIndex1747500000000 } from \"./1747500000000-AddJournalIdempotencyIndex\";\nexport { AddLockedMintCompositeIndexes1747600000000 } from \"./1747600000000-AddLockedMintCompositeIndexes\";\nexport { FixIdempotencyAddTokenAddress1747700000000 } from \"./1747700000000-FixIdempotencyAddTokenAddress\";\n\nimport { InitialSchema1700000000000 } from \"./1700000000000-InitialSchema\";\nimport { CreateRedemptionHistory1746230400001 } from \"./1746230400001-CreateRedemptionHistory\";\nimport { AddJournalIdempotencyIndex1747500000000 } from \"./1747500000000-AddJournalIdempotencyIndex\";\nimport { AddLockedMintCompositeIndexes1747600000000 } from \"./1747600000000-AddLockedMintCompositeIndexes\";\nimport { FixIdempotencyAddTokenAddress1747700000000 } from \"./1747700000000-FixIdempotencyAddTokenAddress\";\n\n/**\n * All shipped migrations in chronological order. Drop into TypeORM's\n * `migrations` config:\n *\n *   import { PAFI_MIGRATIONS } from \"@pafi-dev/issuer-postgres/migrations\";\n *\n *   new DataSource({\n *     entities: [...PAFI_ENTITIES, ...yourCustomEntities],\n *     migrations: [...PAFI_MIGRATIONS, ...yourCustomMigrations],\n *   });\n */\nexport const PAFI_MIGRATIONS = [\n  InitialSchema1700000000000,\n  CreateRedemptionHistory1746230400001,\n  AddJournalIdempotencyIndex1747500000000,\n  AddLockedMintCompositeIndexes1747600000000,\n  FixIdempotencyAddTokenAddress1747700000000,\n] as const;\n"],"mappings":";AAmBO,IAAM,6BAAN,MAA+D;AAAA,EACpE,OAAO;AAAA,EAEP,MAAa,GAAG,aAAyC;AACvD,UAAM,YAAY,MAAM,2CAA2C;AAGnE,UAAM,YAAY,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,KAQvB;AAGD,UAAM,YAAY,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,KAavB;AACD,UAAM,YAAY,MAAM;AAAA;AAAA;AAAA,KAGvB;AACD,UAAM,YAAY,MAAM;AAAA;AAAA;AAAA,KAGvB;AAGD,UAAM,YAAY,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,KAcvB;AACD,UAAM,YAAY,MAAM;AAAA;AAAA;AAAA,KAGvB;AACD,UAAM,YAAY,MAAM;AAAA;AAAA;AAAA,KAGvB;AACD,UAAM,YAAY,MAAM;AAAA;AAAA;AAAA,KAGvB;AAGD,UAAM,YAAY,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,KAWvB;AACD,UAAM,YAAY,MAAM;AAAA;AAAA;AAAA,KAGvB;AAGD,UAAM,YAAY,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,KAOvB;AAAA,EACH;AAAA,EAEA,MAAa,KAAK,aAAyC;AACzD,UAAM,YAAY,MAAM,8BAA8B;AACtD,UAAM,YAAY,MAAM,8CAA8C;AACtE,UAAM,YAAY,MAAM,6BAA6B;AACrD,UAAM,YAAY,MAAM,+CAA+C;AACvE,UAAM,YAAY,MAAM,0CAA0C;AAClE,UAAM,YAAY,MAAM,8CAA8C;AACtE,UAAM,YAAY,MAAM,8BAA8B;AACtD,UAAM,YAAY,MAAM,2CAA2C;AACnE,UAAM,YAAY,MAAM,0CAA0C;AAClE,UAAM,YAAY,MAAM,mCAAmC;AAC3D,UAAM,YAAY,MAAM,4BAA4B;AAAA,EACtD;AACF;;;ACxHO,IAAM,uCAAN,MAAyE;AAAA,EAC9E,OAAO;AAAA,EAEP,MAAa,GAAG,aAAyC;AACvD,UAAM,YAAY,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,KAWvB;AAED,UAAM,YAAY,MAAM;AAAA;AAAA;AAAA,KAGvB;AAAA,EACH;AAAA,EAEA,MAAa,KAAK,aAAyC;AACzD,UAAM,YAAY;AAAA,MAChB;AAAA,IACF;AACA,UAAM,YAAY,MAAM,yCAAyC;AAAA,EACnE;AACF;;;ACfO,IAAM,0CAAN,MAEP;AAAA,EACE,OAAO;AAAA,EAEP,MAAa,GAAG,aAAyC;AACvD,UAAM,YAAY,MAAM;AAAA;AAAA;AAAA;AAAA,KAIvB;AAAA,EACH;AAAA,EAEA,MAAa,KAAK,aAAyC;AACzD,UAAM,YAAY;AAAA,MAChB;AAAA,IACF;AAAA,EACF;AACF;;;ACOO,IAAM,6CAAN,MAEP;AAAA,EACE,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA,EAMP,cAAc;AAAA,EAEd,MAAa,GAAG,aAAyC;AAIvD,UAAM,YAAY,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA,KAKvB;AAED,UAAM,YAAY,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA,KAKvB;AAED,UAAM,YAAY,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA,KAKvB;AAID,UAAM,YAAY;AAAA,MAChB;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAa,KAAK,aAAyC;AAGzD,UAAM,YAAY,MAAM;AAAA;AAAA;AAAA,KAGvB;AACD,UAAM,YAAY;AAAA,MAChB;AAAA,IACF;AACA,UAAM,YAAY;AAAA,MAChB;AAAA,IACF;AACA,UAAM,YAAY;AAAA,MAChB;AAAA,IACF;AAAA,EACF;AACF;;;ACtEO,IAAM,6CAAN,MAEP;AAAA,EACE,OAAO;AAAA,EAEP,MAAa,GAAG,aAAyC;AACvD,UAAM,YAAY;AAAA,MAChB;AAAA,IACF;AACA,UAAM,YAAY,MAAM;AAAA;AAAA;AAAA;AAAA,KAIvB;AAAA,EACH;AAAA,EAEA,MAAa,KAAK,aAAyC;AACzD,UAAM,YAAY;AAAA,MAChB;AAAA,IACF;AACA,UAAM,YAAY,MAAM;AAAA;AAAA;AAAA;AAAA,KAIvB;AAAA,EACH;AACF;;;AC3CO,IAAM,kBAAkB;AAAA,EAC7B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;","names":[]}

package/package.json

@@ -1,7 +1,16 @@
 {
   "name": "@pafi-dev/issuer-postgres",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Postgres-backed IPointLedger implementation for @pafi-dev/issuer — TypeORM entities + migrations + base service issuers can drop in directly",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Pacific-Finance-Lab/pafi-sdk.git",
+    "directory": "packages/issuer-postgres"
+  },
+  "homepage": "https://github.com/Pacific-Finance-Lab/pafi-sdk/tree/main/packages/issuer-postgres#readme",
+  "bugs": {
+    "url": "https://github.com/Pacific-Finance-Lab/pafi-sdk/issues"
+  },
   "type": "module",
   "main": "./dist/index.cjs",
   "module": "./dist/index.js",
@@ -42,25 +51,27 @@
     "dist"
   ],
   "dependencies": {
-    "@pafi-dev/issuer": "0.8.0"
+    "@pafi-dev/issuer": "0.29.0"
   },
   "peerDependencies": {
     "typeorm": "^0.3.0",
     "viem": "^2.0.0"
   },
   "devDependencies": {
+    "@vitest/coverage-v8": "^2.1.0",
+    "reflect-metadata": "^0.1.14",
     "tsup": "^8.0.0",
-    "typescript": "^5.5.0",
     "typeorm": "^0.3.20",
+    "typescript": "^5.5.0",
     "viem": "^2.21.0",
-    "vitest": "^2.0.0",
-    "reflect-metadata": "^0.1.14"
+    "vitest": "^2.0.0"
   },
   "license": "Apache-2.0",
   "scripts": {
     "build": "tsup",
     "test": "vitest run --passWithNoTests",
     "test:watch": "vitest",
+    "test:cov": "vitest run --coverage --passWithNoTests",
     "typecheck": "tsc --noEmit"
   }
 }