@secondlayer/shared 11.7.1 → 11.8.1

package/dist/src/db/queries/subgraphs.js

@@ -1,18 +1,5 @@
-import { createRequire } from "node:module";
-var __defProp = Object.defineProperty;
-var __returnValue = (v) => v;
-function __exportSetter(name, newValue) {
-  this[name] = __returnValue.bind(null, newValue);
-}
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, {
-      get: all[name],
-      enumerable: true,
-      configurable: true,
-      set: __exportSetter.bind(all, name)
-    });
-};
+// src/db/queries/subgraphs.ts
+import { sql as sql2 } from "kysely";
 
 // src/mode.ts
 var VALID_MODES = [
@@ -67,7 +54,6 @@ function parseJsonb(value) {
 }
 
 // src/db/queries/subgraphs.ts
-import { sql as sql2 } from "kysely";
 function pgSchemaName(subgraphName) {
   const safeName = subgraphName.replace(/-/g, "_");
   return `subgraph_${safeName}`;
@@ -77,13 +63,6 @@ function localSubgraphAccountId(accountId) {
     return "";
   return accountId ?? "";
 }
-function pgSchemaNameFor(accountId, subgraphName) {
-  if (!accountId)
-    return pgSchemaName(subgraphName);
-  const accountPrefix = accountId.slice(0, 8).replace(/-/g, "_");
-  const safeName = subgraphName.replace(/-/g, "_");
-  return `subgraph_${accountPrefix}_${safeName}`;
-}
 async function registerSubgraph(db, data) {
   const accountId = localSubgraphAccountId(data.accountId);
   const values = {
@@ -197,21 +176,20 @@ async function rewindLiveProgress(db, name, lastProcessedBlock) {
   }).where("name", "=", name).execute();
 }
 export {
-  updateSubgraphStatus,
-  updateSubgraphHandlerPath,
-  updateSubgraphExpiry,
-  rewindLiveProgress,
-  registerSubgraph,
-  recordSubgraphProcessed,
-  recordLiveProgress,
-  recordLiveError,
-  pgSchemaNameFor,
-  pgSchemaName,
-  localSubgraphAccountId,
-  listSubgraphs,
+  deleteSubgraph,
   getSubgraph,
-  deleteSubgraph
+  listSubgraphs,
+  localSubgraphAccountId,
+  pgSchemaName,
+  recordLiveError,
+  recordLiveProgress,
+  recordSubgraphProcessed,
+  registerSubgraph,
+  rewindLiveProgress,
+  updateSubgraphExpiry,
+  updateSubgraphHandlerPath,
+  updateSubgraphStatus
 };
 
-//# debugId=EEA4A11D75AFDFDE64756E2164756E21
+//# debugId=BAA950C11B40A13F64756E2164756E21
 //# sourceMappingURL=subgraphs.js.map

package/dist/src/db/queries/subgraphs.js.map

@@ -1,12 +1,12 @@
 {
   "version": 3,
-  "sources": ["../src/mode.ts", "../src/db/jsonb.ts", "../src/db/queries/subgraphs.ts"],
+  "sources": ["../src/db/queries/subgraphs.ts", "../src/mode.ts", "../src/db/jsonb.ts"],
   "sourcesContent": [
+    "import { type Kysely, sql } from \"kysely\";\nimport { isPlatformMode } from \"../../mode.ts\";\nimport { jsonb } from \"../jsonb.ts\";\nimport type { Database, Subgraph } from \"../types.ts\";\n\n/** Convert a subgraph name to its PostgreSQL schema name. */\nexport function pgSchemaName(subgraphName: string): string {\n\tconst safeName = subgraphName.replace(/-/g, \"_\");\n\treturn `subgraph_${safeName}`;\n}\n\n/** OSS writes empty account_id — name is the local unique key. */\nexport function localSubgraphAccountId(accountId?: string): string {\n\tif (!isPlatformMode()) return \"\";\n\treturn accountId ?? \"\";\n}\n\nexport async function registerSubgraph(\n\tdb: Kysely<Database>,\n\tdata: {\n\t\tname: string;\n\t\tversion: string;\n\t\tdefinition: Record<string, unknown>;\n\t\tschemaHash: string;\n\t\thandlerPath: string;\n\t\tapiKeyId?: string;\n\t\taccountId?: string;\n\t\tschemaName?: string;\n\t\tstartBlock?: number;\n\t\thandlerCode?: string;\n\t\tsourceCode?: string;\n\t},\n): Promise<Subgraph> {\n\tconst accountId = localSubgraphAccountId(data.accountId);\n\tconst values = {\n\t\tname: data.name,\n\t\tversion: data.version,\n\t\tdefinition: jsonb<Record<string, unknown>>(data.definition),\n\t\tschema_hash: data.schemaHash,\n\t\thandler_path: data.handlerPath,\n\t\taccount_id: accountId,\n\t\thandler_code: data.handlerCode ?? null,\n\t\tsource_code: data.sourceCode ?? null,\n\t\tschema_name: data.schemaName ?? null,\n\t\tstart_block: data.startBlock ?? 0,\n\t};\n\tconst updateSet = {\n\t\tversion: data.version,\n\t\tdefinition: jsonb<Record<string, unknown>>(data.definition),\n\t\tschema_hash: data.schemaHash,\n\t\thandler_path: data.handlerPath,\n\t\thandler_code: data.handlerCode ?? null,\n\t\tsource_code: data.sourceCode ?? null,\n\t\tschema_name: data.schemaName ?? null,\n\t\tstart_block: data.startBlock ?? 0,\n\t\tupdated_at: new Date(),\n\t};\n\n\t// OSS: name is unique. Upsert by name so leftover rows with a non-empty\n\t// account_id (pre-local-namespace deploys) don't insert a second row.\n\tif (!isPlatformMode()) {\n\t\tconst existing = await db\n\t\t\t.selectFrom(\"subgraphs\")\n\t\t\t.select(\"id\")\n\t\t\t.where(\"name\", \"=\", data.name)\n\t\t\t.executeTakeFirst();\n\t\tif (existing) {\n\t\t\treturn await db\n\t\t\t\t.updateTable(\"subgraphs\")\n\t\t\t\t.set({ ...updateSet, account_id: \"\" })\n\t\t\t\t.where(\"id\", \"=\", existing.id)\n\t\t\t\t.returningAll()\n\t\t\t\t.executeTakeFirstOrThrow();\n\t\t}\n\t\treturn await db\n\t\t\t.insertInto(\"subgraphs\")\n\t\t\t.values(values)\n\t\t\t.returningAll()\n\t\t\t.executeTakeFirstOrThrow();\n\t}\n\n\treturn await db\n\t\t.insertInto(\"subgraphs\")\n\t\t.values(values)\n\t\t.onConflict((oc) =>\n\t\t\toc.columns([\"name\", \"account_id\"]).doUpdateSet(updateSet),\n\t\t)\n\t\t.returningAll()\n\t\t.executeTakeFirstOrThrow();\n}\n\nexport async function getSubgraph(\n\tdb: Kysely<Database>,\n\tname: string,\n\taccountId?: string,\n): Promise<Subgraph | null> {\n\tlet query = db.selectFrom(\"subgraphs\").selectAll().where(\"name\", \"=\", name);\n\n\tif (isPlatformMode() && accountId !== undefined) {\n\t\tquery = query.where(\"account_id\", \"=\", accountId);\n\t}\n\n\treturn (await query.executeTakeFirst()) ?? null;\n}\n\nexport async function listSubgraphs(\n\tdb: Kysely<Database>,\n\taccountId?: string,\n): Promise<Subgraph[]> {\n\tlet query = db.selectFrom(\"subgraphs\").selectAll();\n\tif (isPlatformMode() && accountId !== undefined) {\n\t\tquery = query.where(\"account_id\", \"=\", accountId);\n\t}\n\treturn query.execute();\n}\n\nexport async function updateSubgraphStatus(\n\tdb: Kysely<Database>,\n\tname: string,\n\tstatus: string,\n\tlastProcessedBlock?: number,\n): Promise<void> {\n\tawait db\n\t\t.updateTable(\"subgraphs\")\n\t\t.set({\n\t\t\tstatus,\n\t\t\t...(lastProcessedBlock !== undefined\n\t\t\t\t? { last_processed_block: lastProcessedBlock }\n\t\t\t\t: {}),\n\t\t\tupdated_at: new Date(),\n\t\t})\n\t\t.where(\"name\", \"=\", name)\n\t\t.execute();\n}\n\n/** Live-walk ERROR write (f069): a block whose handlers ALL failed\n *  (`processed === 0 && errors > 0`, `block-processor.ts`'s `applyProgress`)\n *  is stamped 'error' and its height is recorded as processed, same as\n *  `updateSubgraphStatus(db, name, \"error\", blockHeight)` — except the\n *  cursor half of that write now goes through the same conditional `<`\n *  guard as {@link recordLiveProgress}. Marking a subgraph 'error' is not\n *  itself replay-sensitive, but it shares the `last_processed_block` column\n *  with the replay guard: an unconditional write here could regress the\n *  cursor a racing (successful) writer already advanced past, which is\n *  exactly the regress-then-re-walk loop this guard exists to close. In\n *  practice `ctx.rollbackTo` (`runner.ts`) means an all-failed block never\n *  flushes writes, so a lost race here is always a silent no-op, never a\n *  case that needs `CursorRaceLostError`-style tx abort. Returns whether\n *  the write applied. Live path only — reindex/backfill's error stamping\n *  goes through {@link updateSubgraphStatus} unconditionally, as before. */\nexport async function recordLiveError(\n\tdb: Kysely<Database>,\n\tname: string,\n\tblockHeight: number,\n): Promise<boolean> {\n\tconst result = await db\n\t\t.updateTable(\"subgraphs\")\n\t\t.set({\n\t\t\tstatus: \"error\",\n\t\t\tlast_processed_block: blockHeight,\n\t\t\tupdated_at: new Date(),\n\t\t})\n\t\t.where(\"name\", \"=\", name)\n\t\t.where(\"last_processed_block\", \"<\", blockHeight)\n\t\t.executeTakeFirst();\n\treturn Number(result.numUpdatedRows ?? 0n) > 0;\n}\n\nexport async function recordSubgraphProcessed(\n\tdb: Kysely<Database>,\n\tname: string,\n\tprocessed: number,\n\terrors: number,\n\tlastError?: string,\n): Promise<void> {\n\tawait db\n\t\t.updateTable(\"subgraphs\")\n\t\t.set({\n\t\t\ttotal_processed: sql`total_processed + ${processed}`,\n\t\t\ttotal_errors: sql`total_errors + ${errors}`,\n\t\t\t...(lastError\n\t\t\t\t? { last_error: lastError, last_error_at: new Date() }\n\t\t\t\t: {}),\n\t\t\tupdated_at: new Date(),\n\t\t})\n\t\t.where(\"name\", \"=\", name)\n\t\t.execute();\n}\n\nexport async function updateSubgraphHandlerPath(\n\tdb: Kysely<Database>,\n\tname: string,\n\thandlerPath: string,\n\topts?: { handlerCode?: string; sourceCode?: string },\n): Promise<void> {\n\tawait db\n\t\t.updateTable(\"subgraphs\")\n\t\t.set({\n\t\t\thandler_path: handlerPath,\n\t\t\t...(opts?.handlerCode != null ? { handler_code: opts.handlerCode } : {}),\n\t\t\t...(opts?.sourceCode != null ? { source_code: opts.sourceCode } : {}),\n\t\t\tupdated_at: new Date(),\n\t\t})\n\t\t.where(\"name\", \"=\", name)\n\t\t.execute();\n}\n\nexport async function deleteSubgraph(\n\tdb: Kysely<Database>,\n\tname: string,\n\taccountId?: string,\n): Promise<Subgraph | null> {\n\tconst subgraph = await getSubgraph(db, name, accountId);\n\tif (!subgraph) return null;\n\n\t// Use stored schema_name if available, otherwise compute\n\tconst schemaName = subgraph.schema_name ?? pgSchemaName(name);\n\n\t// Cascade to webhooks: a webhook pointing at a deleted\n\t// subgraph + table will throw `relation does not exist` on every\n\t// subsequent emission. Pause active subs and purge any pending outbox\n\t// rows so receivers don't get phantom replays. We don't delete the\n\t// webhooks themselves — operators may want to repoint them at a\n\t// resurrected subgraph; we just stop them firing.\n\tawait db\n\t\t.updateTable(\"webhooks\")\n\t\t.set({\n\t\t\tstatus: \"paused\",\n\t\t\tlast_error: `Subgraph \"${name}\" deleted; webhook auto-paused.`,\n\t\t\tupdated_at: new Date(),\n\t\t})\n\t\t.where(\"subgraph_name\", \"=\", name)\n\t\t.execute();\n\tawait db\n\t\t.deleteFrom(\"webhook_outbox\")\n\t\t.where(\"status\", \"=\", \"pending\")\n\t\t.where(\"webhook_id\", \"in\", (qb) =>\n\t\t\tqb.selectFrom(\"webhooks\").select(\"id\").where(\"subgraph_name\", \"=\", name),\n\t\t)\n\t\t.execute();\n\n\t// Drop the subgraph's schema (CASCADE drops all tables within).\n\tawait sql`DROP SCHEMA IF EXISTS ${sql.raw(`\"${schemaName}\"`)} CASCADE`.execute(\n\t\tdb,\n\t);\n\n\t// Remove from registry\n\tawait db.deleteFrom(\"subgraphs\").where(\"id\", \"=\", subgraph.id).execute();\n\n\treturn subgraph;\n}\n\n/** Set or clear a paid subgraph's expiry (NULL = no expiry, e.g. on claim). */\nexport async function updateSubgraphExpiry(\n\tdb: Kysely<Database>,\n\tname: string,\n\taccountId: string,\n\texpiresAt: Date | null,\n): Promise<void> {\n\tawait db\n\t\t.updateTable(\"subgraphs\")\n\t\t.set({ expires_at: expiresAt })\n\t\t.where(\"name\", \"=\", name)\n\t\t.where(\"account_id\", \"=\", accountId)\n\t\t.execute();\n}\n\n/** Live-walk progress write: advances the cursor and PROMOTES toward\n *  'active' (deploying/error → active keeps reorg eligibility, reorg.ts gates\n *  on it) but never overwrites an explicit 'reindexing' park — unconditional\n *  status stamping let catch-up flap a parked subgraph back into its own path\n *  per block, fighting the queued reindex op.\n *\n *  `last_processed_block` is now written CONDITIONALLY — `WHERE\n *  last_processed_block < lastProcessedBlock`, mirroring\n *  `advanceOperationCursor`'s (`subgraph-operations.ts`) comparison shape —\n *  and returns whether THIS call actually advanced it. This used to be\n *  unconditional by design, on the premise that the only two writers able to\n *  advance/rewind a given subgraph's cursor concurrently (the catch-up walk\n *  and the reorg handler) serialize on an in-process per-subgraph lock +\n *  reorg epoch guard (`packages/subgraphs/src/runtime/catchup.ts`,\n *  `subgraphBlockLockHeld` / `reorgEpoch`; f057). That guard is in-process\n *  only. The f068 investigation\n *  (`docs/internal/audits/asset-holdings-unreproducible-balances-f068.md`)\n *  found a cross-process sequence it does not cover: a catch-up leader that\n *  loses its advisory-lock connection mid-walk keeps writing (leadership is\n *  checked only at walk entry, not per-iteration) while a new leader takes\n *  over and walks the same range — both commit increments for overlapping\n *  heights, and every regressed cursor write from the laggard re-triggers a\n *  full re-walk, growing per-height application without bound. The\n *  conditional advance here (paired with the fast-path replay guard armed on\n *  the live path in `block-processor.ts`) is now the cross-process\n *  guarantee: a block at/below the current cursor can never re-advance it,\n *  so a laggard's commits can no longer regress-then-retrigger.\n *\n *  This conditionality is why the reorg rewind can no longer go through this\n *  function — a rewind's whole point is to move the cursor *backward*, which\n *  the `<` guard would silently refuse. Reorg mode calls\n *  {@link rewindLiveProgress} instead, which keeps the old unconditional\n *  semantics and is safe specifically because the reorg path takes a\n *  transaction-scoped advisory lock (`reorg.ts`) other writers can't cross. */\nexport async function recordLiveProgress(\n\tdb: Kysely<Database>,\n\tname: string,\n\tlastProcessedBlock: number,\n): Promise<boolean> {\n\tconst result = await db\n\t\t.updateTable(\"subgraphs\")\n\t\t.set({\n\t\t\tlast_processed_block: lastProcessedBlock,\n\t\t\tstatus: sql`CASE WHEN status = 'reindexing' THEN status ELSE 'active' END`,\n\t\t\tupdated_at: new Date(),\n\t\t})\n\t\t.where(\"name\", \"=\", name)\n\t\t.where(\"last_processed_block\", \"<\", lastProcessedBlock)\n\t\t.executeTakeFirst();\n\treturn Number(result.numUpdatedRows ?? 0n) > 0;\n}\n\n/** Reorg-rewind progress write: the OLD unconditional `recordLiveProgress`\n *  semantics, verbatim — moves `last_processed_block` to the fork height\n *  regardless of its current value, because that is by definition a\n *  backward move the conditional `<` guard in `recordLiveProgress` would\n *  refuse. Same status-promotion CASE (never unparks an explicit\n *  'reindexing').\n *\n *  Callers: exclusively the subgraph-reorg path\n *  (`packages/subgraphs/src/runtime/reorg.ts`, via `block-processor.ts`'s\n *  `reorgRewind` mode), which is safe from the cross-process race this\n *  function reintroduces because it holds a transaction-scoped Postgres\n *  advisory lock (`pg_advisory_xact_lock`) for the whole\n *  delete+reprocess+rewind sequence — no other writer can interleave a\n *  forward write between the rewind and the fork block's reprocess. Do not\n *  call this from the live catch-up path. */\nexport async function rewindLiveProgress(\n\tdb: Kysely<Database>,\n\tname: string,\n\tlastProcessedBlock: number,\n): Promise<void> {\n\tawait db\n\t\t.updateTable(\"subgraphs\")\n\t\t.set({\n\t\t\tlast_processed_block: lastProcessedBlock,\n\t\t\tstatus: sql`CASE WHEN status = 'reindexing' THEN status ELSE 'active' END`,\n\t\t\tupdated_at: new Date(),\n\t\t})\n\t\t.where(\"name\", \"=\", name)\n\t\t.execute();\n}\n",
     "/**\n * Instance modes for the Secondlayer platform.\n *\n * - `oss`: self-hosted, single-tenant. No auth middleware, no platform routes\n *   (projects, admin). Everything runs against a single `DATABASE_URL`.\n *   Intended for `docker compose up`.\n *\n * - `platform`: the metered archive deployment. Magic-link auth, API keys,\n *   accounts, credits, and metered `/v1` reads (Index + Streams + subgraphs)\n *   against a single shared DB. No paid tier ladder — one metered `free`\n *   tier plus first-party internal service credentials.\n */\n\nexport type InstanceMode = \"oss\" | \"platform\";\n\n/** What the operator wrote in the env — `archive` is the honest name for the\n *  metered public-archive deployment and aliases `platform` behaviorally. */\nexport type DeclaredInstanceMode = InstanceMode | \"archive\";\n\nconst VALID_MODES: readonly DeclaredInstanceMode[] = [\n\t\"oss\",\n\t\"platform\",\n\t\"archive\",\n];\n\nfunction declaredMode(): DeclaredInstanceMode {\n\tconst raw = process.env.INSTANCE_MODE?.trim().toLowerCase();\n\tif (raw && (VALID_MODES as readonly string[]).includes(raw)) {\n\t\treturn raw as DeclaredInstanceMode;\n\t}\n\treturn \"oss\";\n}\n\n/**\n * Resolve the active instance mode from `process.env.INSTANCE_MODE`.\n * Defaults to `\"oss\"` — the safest default for self-hosters who deploy\n * without setting the variable. `archive` normalizes to `platform` here so\n * every behavioral branch stays a two-way choice; use\n * `getDeclaredInstanceMode()` for display surfaces.\n */\nexport function getInstanceMode(): InstanceMode {\n\tconst declared = declaredMode();\n\treturn declared === \"archive\" ? \"platform\" : declared;\n}\n\n/** The mode as declared in the env, for status/identity surfaces. */\nexport function getDeclaredInstanceMode(): DeclaredInstanceMode {\n\treturn declaredMode();\n}\n\n/**\n * True when public reads are credit-metered (the free window, retention, and\n * credits gates arm). Platform/archive deployments meter by default;\n * self-host never does unless the operator explicitly sets\n * `METERED_READS=true`. `METERED_READS=false` disarms a metered deployment.\n */\nexport function isMeteredReads(): boolean {\n\tconst override = process.env.METERED_READS?.trim().toLowerCase();\n\tif (override === \"true\") return true;\n\tif (override === \"false\") return false;\n\treturn getInstanceMode() === \"platform\";\n}\n\n/** True when the active mode is `\"platform\"` (shared multi-tenant). */\nexport function isPlatformMode(): boolean {\n\treturn getInstanceMode() === \"platform\";\n}\n\n/** True when the active mode is `\"oss\"` (self-hosted). */\nexport function isOssMode(): boolean {\n\treturn getInstanceMode() === \"oss\";\n}\n",
-    "import { type RawBuilder, sql } from \"kysely\";\n\n/**\n * Safely encode a JS value as a JSONB literal for Kysely inserts/updates.\n * Kysely + postgres.js double-encodes JSON when using parameterized queries\n * with ::jsonb casts. This uses sql.raw to inline a properly escaped literal.\n *\n * Generic parameter lets callers set the RawBuilder's output type so they\n * don't need to cast at the insert site. Default is `unknown` — widen at\n * the call site when the column type is narrower, e.g. `jsonb<MyShape>(...)`.\n */\nexport function jsonb<T = unknown>(value: T): RawBuilder<T> {\n\tconst escaped = JSON.stringify(value, (_k, v) =>\n\t\ttypeof v === \"bigint\" ? v.toString() : v,\n\t).replace(/'/g, \"''\");\n\treturn sql`${sql.raw(`'${escaped}'::jsonb`)}`;\n}\n\n/**\n * Safely parse a JSONB value from the database.\n * Handles double-encoded strings where postgres.js returns a JSON string\n * instead of a parsed object.\n */\nexport function parseJsonb<T = unknown>(value: unknown): T {\n\tif (typeof value === \"string\") {\n\t\ttry {\n\t\t\treturn JSON.parse(value) as T;\n\t\t} catch {\n\t\t\treturn value as T;\n\t\t}\n\t}\n\treturn (value ?? {}) as T;\n}\n",
-    "import { type Kysely, sql } from \"kysely\";\nimport { isPlatformMode } from \"../../mode.ts\";\nimport { jsonb } from \"../jsonb.ts\";\nimport type { Database, Subgraph } from \"../types.ts\";\n\n/**\n * Convert a subgraph name to its PostgreSQL schema name (legacy form).\n * Pre shared-rip every tenant DB had its own schema namespace so disambiguation\n * was implicit. Kept for oss mode (single-tenant) and legacy-row fallback.\n * Platform-mode deploys use `pgSchemaNameFor(accountId, name)`.\n */\nexport function pgSchemaName(subgraphName: string): string {\n\tconst safeName = subgraphName.replace(/-/g, \"_\");\n\treturn `subgraph_${safeName}`;\n}\n\n/** OSS writes empty account_id — name is the local unique key. */\nexport function localSubgraphAccountId(accountId?: string): string {\n\tif (!isPlatformMode()) return \"\";\n\treturn accountId ?? \"\";\n}\n\n/**\n * Account-scoped schema name. Matches migration 0028's rename pattern:\n *   subgraph_{first8charsOfAccountId, dashes-as-underscores}_{name}\n * Empty accountId falls back to legacy form (oss mode).\n */\nexport function pgSchemaNameFor(\n\taccountId: string,\n\tsubgraphName: string,\n): string {\n\tif (!accountId) return pgSchemaName(subgraphName);\n\tconst accountPrefix = accountId.slice(0, 8).replace(/-/g, \"_\");\n\tconst safeName = subgraphName.replace(/-/g, \"_\");\n\treturn `subgraph_${accountPrefix}_${safeName}`;\n}\n\nexport async function registerSubgraph(\n\tdb: Kysely<Database>,\n\tdata: {\n\t\tname: string;\n\t\tversion: string;\n\t\tdefinition: Record<string, unknown>;\n\t\tschemaHash: string;\n\t\thandlerPath: string;\n\t\tapiKeyId?: string;\n\t\taccountId?: string;\n\t\tschemaName?: string;\n\t\tstartBlock?: number;\n\t\thandlerCode?: string;\n\t\tsourceCode?: string;\n\t},\n): Promise<Subgraph> {\n\tconst accountId = localSubgraphAccountId(data.accountId);\n\tconst values = {\n\t\tname: data.name,\n\t\tversion: data.version,\n\t\tdefinition: jsonb<Record<string, unknown>>(data.definition),\n\t\tschema_hash: data.schemaHash,\n\t\thandler_path: data.handlerPath,\n\t\taccount_id: accountId,\n\t\thandler_code: data.handlerCode ?? null,\n\t\tsource_code: data.sourceCode ?? null,\n\t\tschema_name: data.schemaName ?? null,\n\t\tstart_block: data.startBlock ?? 0,\n\t};\n\tconst updateSet = {\n\t\tversion: data.version,\n\t\tdefinition: jsonb<Record<string, unknown>>(data.definition),\n\t\tschema_hash: data.schemaHash,\n\t\thandler_path: data.handlerPath,\n\t\thandler_code: data.handlerCode ?? null,\n\t\tsource_code: data.sourceCode ?? null,\n\t\tschema_name: data.schemaName ?? null,\n\t\tstart_block: data.startBlock ?? 0,\n\t\tupdated_at: new Date(),\n\t};\n\n\t// OSS: name is unique. Upsert by name so leftover rows with a non-empty\n\t// account_id (pre-local-namespace deploys) don't insert a second row.\n\tif (!isPlatformMode()) {\n\t\tconst existing = await db\n\t\t\t.selectFrom(\"subgraphs\")\n\t\t\t.select(\"id\")\n\t\t\t.where(\"name\", \"=\", data.name)\n\t\t\t.executeTakeFirst();\n\t\tif (existing) {\n\t\t\treturn await db\n\t\t\t\t.updateTable(\"subgraphs\")\n\t\t\t\t.set({ ...updateSet, account_id: \"\" })\n\t\t\t\t.where(\"id\", \"=\", existing.id)\n\t\t\t\t.returningAll()\n\t\t\t\t.executeTakeFirstOrThrow();\n\t\t}\n\t\treturn await db\n\t\t\t.insertInto(\"subgraphs\")\n\t\t\t.values(values)\n\t\t\t.returningAll()\n\t\t\t.executeTakeFirstOrThrow();\n\t}\n\n\treturn await db\n\t\t.insertInto(\"subgraphs\")\n\t\t.values(values)\n\t\t.onConflict((oc) =>\n\t\t\toc.columns([\"name\", \"account_id\"]).doUpdateSet(updateSet),\n\t\t)\n\t\t.returningAll()\n\t\t.executeTakeFirstOrThrow();\n}\n\nexport async function getSubgraph(\n\tdb: Kysely<Database>,\n\tname: string,\n\taccountId?: string,\n): Promise<Subgraph | null> {\n\tlet query = db.selectFrom(\"subgraphs\").selectAll().where(\"name\", \"=\", name);\n\n\tif (isPlatformMode() && accountId !== undefined) {\n\t\tquery = query.where(\"account_id\", \"=\", accountId);\n\t}\n\n\treturn (await query.executeTakeFirst()) ?? null;\n}\n\nexport async function listSubgraphs(\n\tdb: Kysely<Database>,\n\taccountId?: string,\n): Promise<Subgraph[]> {\n\tlet query = db.selectFrom(\"subgraphs\").selectAll();\n\tif (isPlatformMode() && accountId !== undefined) {\n\t\tquery = query.where(\"account_id\", \"=\", accountId);\n\t}\n\treturn query.execute();\n}\n\nexport async function updateSubgraphStatus(\n\tdb: Kysely<Database>,\n\tname: string,\n\tstatus: string,\n\tlastProcessedBlock?: number,\n): Promise<void> {\n\tawait db\n\t\t.updateTable(\"subgraphs\")\n\t\t.set({\n\t\t\tstatus,\n\t\t\t...(lastProcessedBlock !== undefined\n\t\t\t\t? { last_processed_block: lastProcessedBlock }\n\t\t\t\t: {}),\n\t\t\tupdated_at: new Date(),\n\t\t})\n\t\t.where(\"name\", \"=\", name)\n\t\t.execute();\n}\n\n/** Live-walk ERROR write (f069): a block whose handlers ALL failed\n *  (`processed === 0 && errors > 0`, `block-processor.ts`'s `applyProgress`)\n *  is stamped 'error' and its height is recorded as processed, same as\n *  `updateSubgraphStatus(db, name, \"error\", blockHeight)` — except the\n *  cursor half of that write now goes through the same conditional `<`\n *  guard as {@link recordLiveProgress}. Marking a subgraph 'error' is not\n *  itself replay-sensitive, but it shares the `last_processed_block` column\n *  with the replay guard: an unconditional write here could regress the\n *  cursor a racing (successful) writer already advanced past, which is\n *  exactly the regress-then-re-walk loop this guard exists to close. In\n *  practice `ctx.rollbackTo` (`runner.ts`) means an all-failed block never\n *  flushes writes, so a lost race here is always a silent no-op, never a\n *  case that needs `CursorRaceLostError`-style tx abort. Returns whether\n *  the write applied. Live path only — reindex/backfill's error stamping\n *  goes through {@link updateSubgraphStatus} unconditionally, as before. */\nexport async function recordLiveError(\n\tdb: Kysely<Database>,\n\tname: string,\n\tblockHeight: number,\n): Promise<boolean> {\n\tconst result = await db\n\t\t.updateTable(\"subgraphs\")\n\t\t.set({\n\t\t\tstatus: \"error\",\n\t\t\tlast_processed_block: blockHeight,\n\t\t\tupdated_at: new Date(),\n\t\t})\n\t\t.where(\"name\", \"=\", name)\n\t\t.where(\"last_processed_block\", \"<\", blockHeight)\n\t\t.executeTakeFirst();\n\treturn Number(result.numUpdatedRows ?? 0n) > 0;\n}\n\nexport async function recordSubgraphProcessed(\n\tdb: Kysely<Database>,\n\tname: string,\n\tprocessed: number,\n\terrors: number,\n\tlastError?: string,\n): Promise<void> {\n\tawait db\n\t\t.updateTable(\"subgraphs\")\n\t\t.set({\n\t\t\ttotal_processed: sql`total_processed + ${processed}`,\n\t\t\ttotal_errors: sql`total_errors + ${errors}`,\n\t\t\t...(lastError\n\t\t\t\t? { last_error: lastError, last_error_at: new Date() }\n\t\t\t\t: {}),\n\t\t\tupdated_at: new Date(),\n\t\t})\n\t\t.where(\"name\", \"=\", name)\n\t\t.execute();\n}\n\nexport async function updateSubgraphHandlerPath(\n\tdb: Kysely<Database>,\n\tname: string,\n\thandlerPath: string,\n\topts?: { handlerCode?: string; sourceCode?: string },\n): Promise<void> {\n\tawait db\n\t\t.updateTable(\"subgraphs\")\n\t\t.set({\n\t\t\thandler_path: handlerPath,\n\t\t\t...(opts?.handlerCode != null ? { handler_code: opts.handlerCode } : {}),\n\t\t\t...(opts?.sourceCode != null ? { source_code: opts.sourceCode } : {}),\n\t\t\tupdated_at: new Date(),\n\t\t})\n\t\t.where(\"name\", \"=\", name)\n\t\t.execute();\n}\n\nexport async function deleteSubgraph(\n\tdb: Kysely<Database>,\n\tname: string,\n\taccountId?: string,\n): Promise<Subgraph | null> {\n\tconst subgraph = await getSubgraph(db, name, accountId);\n\tif (!subgraph) return null;\n\n\t// Use stored schema_name if available, otherwise compute\n\tconst schemaName = subgraph.schema_name ?? pgSchemaName(name);\n\n\t// Cascade to webhooks: a webhook pointing at a deleted\n\t// subgraph + table will throw `relation does not exist` on every\n\t// subsequent emission. Pause active subs and purge any pending outbox\n\t// rows so receivers don't get phantom replays. We don't delete the\n\t// webhooks themselves — operators may want to repoint them at a\n\t// resurrected subgraph; we just stop them firing.\n\tawait db\n\t\t.updateTable(\"webhooks\")\n\t\t.set({\n\t\t\tstatus: \"paused\",\n\t\t\tlast_error: `Subgraph \"${name}\" deleted; webhook auto-paused.`,\n\t\t\tupdated_at: new Date(),\n\t\t})\n\t\t.where(\"subgraph_name\", \"=\", name)\n\t\t.execute();\n\tawait db\n\t\t.deleteFrom(\"webhook_outbox\")\n\t\t.where(\"status\", \"=\", \"pending\")\n\t\t.where(\"webhook_id\", \"in\", (qb) =>\n\t\t\tqb.selectFrom(\"webhooks\").select(\"id\").where(\"subgraph_name\", \"=\", name),\n\t\t)\n\t\t.execute();\n\n\t// Drop the subgraph's schema (CASCADE drops all tables within).\n\tawait sql`DROP SCHEMA IF EXISTS ${sql.raw(`\"${schemaName}\"`)} CASCADE`.execute(\n\t\tdb,\n\t);\n\n\t// Remove from registry\n\tawait db.deleteFrom(\"subgraphs\").where(\"id\", \"=\", subgraph.id).execute();\n\n\treturn subgraph;\n}\n\n/** Set or clear a paid subgraph's expiry (NULL = no expiry, e.g. on claim). */\nexport async function updateSubgraphExpiry(\n\tdb: Kysely<Database>,\n\tname: string,\n\taccountId: string,\n\texpiresAt: Date | null,\n): Promise<void> {\n\tawait db\n\t\t.updateTable(\"subgraphs\")\n\t\t.set({ expires_at: expiresAt })\n\t\t.where(\"name\", \"=\", name)\n\t\t.where(\"account_id\", \"=\", accountId)\n\t\t.execute();\n}\n\n/** Live-walk progress write: advances the cursor and PROMOTES toward\n *  'active' (deploying/error → active keeps reorg eligibility, reorg.ts gates\n *  on it) but never overwrites an explicit 'reindexing' park — unconditional\n *  status stamping let catch-up flap a parked subgraph back into its own path\n *  per block, fighting the queued reindex op.\n *\n *  `last_processed_block` is now written CONDITIONALLY — `WHERE\n *  last_processed_block < lastProcessedBlock`, mirroring\n *  `advanceOperationCursor`'s (`subgraph-operations.ts`) comparison shape —\n *  and returns whether THIS call actually advanced it. This used to be\n *  unconditional by design, on the premise that the only two writers able to\n *  advance/rewind a given subgraph's cursor concurrently (the catch-up walk\n *  and the reorg handler) serialize on an in-process per-subgraph lock +\n *  reorg epoch guard (`packages/subgraphs/src/runtime/catchup.ts`,\n *  `subgraphBlockLockHeld` / `reorgEpoch`; f057). That guard is in-process\n *  only. The f068 investigation\n *  (`docs/internal/audits/asset-holdings-unreproducible-balances-f068.md`)\n *  found a cross-process sequence it does not cover: a catch-up leader that\n *  loses its advisory-lock connection mid-walk keeps writing (leadership is\n *  checked only at walk entry, not per-iteration) while a new leader takes\n *  over and walks the same range — both commit increments for overlapping\n *  heights, and every regressed cursor write from the laggard re-triggers a\n *  full re-walk, growing per-height application without bound. The\n *  conditional advance here (paired with the fast-path replay guard armed on\n *  the live path in `block-processor.ts`) is now the cross-process\n *  guarantee: a block at/below the current cursor can never re-advance it,\n *  so a laggard's commits can no longer regress-then-retrigger.\n *\n *  This conditionality is why the reorg rewind can no longer go through this\n *  function — a rewind's whole point is to move the cursor *backward*, which\n *  the `<` guard would silently refuse. Reorg mode calls\n *  {@link rewindLiveProgress} instead, which keeps the old unconditional\n *  semantics and is safe specifically because the reorg path takes a\n *  transaction-scoped advisory lock (`reorg.ts`) other writers can't cross. */\nexport async function recordLiveProgress(\n\tdb: Kysely<Database>,\n\tname: string,\n\tlastProcessedBlock: number,\n): Promise<boolean> {\n\tconst result = await db\n\t\t.updateTable(\"subgraphs\")\n\t\t.set({\n\t\t\tlast_processed_block: lastProcessedBlock,\n\t\t\tstatus: sql`CASE WHEN status = 'reindexing' THEN status ELSE 'active' END`,\n\t\t\tupdated_at: new Date(),\n\t\t})\n\t\t.where(\"name\", \"=\", name)\n\t\t.where(\"last_processed_block\", \"<\", lastProcessedBlock)\n\t\t.executeTakeFirst();\n\treturn Number(result.numUpdatedRows ?? 0n) > 0;\n}\n\n/** Reorg-rewind progress write: the OLD unconditional `recordLiveProgress`\n *  semantics, verbatim — moves `last_processed_block` to the fork height\n *  regardless of its current value, because that is by definition a\n *  backward move the conditional `<` guard in `recordLiveProgress` would\n *  refuse. Same status-promotion CASE (never unparks an explicit\n *  'reindexing').\n *\n *  Callers: exclusively the subgraph-reorg path\n *  (`packages/subgraphs/src/runtime/reorg.ts`, via `block-processor.ts`'s\n *  `reorgRewind` mode), which is safe from the cross-process race this\n *  function reintroduces because it holds a transaction-scoped Postgres\n *  advisory lock (`pg_advisory_xact_lock`) for the whole\n *  delete+reprocess+rewind sequence — no other writer can interleave a\n *  forward write between the rewind and the fork block's reprocess. Do not\n *  call this from the live catch-up path. */\nexport async function rewindLiveProgress(\n\tdb: Kysely<Database>,\n\tname: string,\n\tlastProcessedBlock: number,\n): Promise<void> {\n\tawait db\n\t\t.updateTable(\"subgraphs\")\n\t\t.set({\n\t\t\tlast_processed_block: lastProcessedBlock,\n\t\t\tstatus: sql`CASE WHEN status = 'reindexing' THEN status ELSE 'active' END`,\n\t\t\tupdated_at: new Date(),\n\t\t})\n\t\t.where(\"name\", \"=\", name)\n\t\t.execute();\n}\n"
+    "import { type RawBuilder, sql } from \"kysely\";\n\n/**\n * Safely encode a JS value as a JSONB literal for Kysely inserts/updates.\n * Kysely + postgres.js double-encodes JSON when using parameterized queries\n * with ::jsonb casts. This uses sql.raw to inline a properly escaped literal.\n *\n * Generic parameter lets callers set the RawBuilder's output type so they\n * don't need to cast at the insert site. Default is `unknown` — widen at\n * the call site when the column type is narrower, e.g. `jsonb<MyShape>(...)`.\n */\nexport function jsonb<T = unknown>(value: T): RawBuilder<T> {\n\tconst escaped = JSON.stringify(value, (_k, v) =>\n\t\ttypeof v === \"bigint\" ? v.toString() : v,\n\t).replace(/'/g, \"''\");\n\treturn sql`${sql.raw(`'${escaped}'::jsonb`)}`;\n}\n\n/**\n * Safely parse a JSONB value from the database.\n * Handles double-encoded strings where postgres.js returns a JSON string\n * instead of a parsed object.\n */\nexport function parseJsonb<T = unknown>(value: unknown): T {\n\tif (typeof value === \"string\") {\n\t\ttry {\n\t\t\treturn JSON.parse(value) as T;\n\t\t} catch {\n\t\t\treturn value as T;\n\t\t}\n\t}\n\treturn (value ?? {}) as T;\n}\n"
   ],
-  "mappings": ";;;;;;;;;;;;;;;;;AAmBA,IAAM,cAA+C;AAAA,EACpD;AAAA,EACA;AAAA,EACA;AACD;AAEA,SAAS,YAAY,GAAyB;AAAA,EAC7C,MAAM,MAAM,QAAQ,IAAI,eAAe,KAAK,EAAE,YAAY;AAAA,EAC1D,IAAI,OAAQ,YAAkC,SAAS,GAAG,GAAG;AAAA,IAC5D,OAAO;AAAA,EACR;AAAA,EACA,OAAO;AAAA;AAUD,SAAS,eAAe,GAAiB;AAAA,EAC/C,MAAM,WAAW,aAAa;AAAA,EAC9B,OAAO,aAAa,YAAY,aAAa;AAAA;AAIvC,SAAS,uBAAuB,GAAyB;AAAA,EAC/D,OAAO,aAAa;AAAA;AASd,SAAS,cAAc,GAAY;AAAA,EACzC,MAAM,WAAW,QAAQ,IAAI,eAAe,KAAK,EAAE,YAAY;AAAA,EAC/D,IAAI,aAAa;AAAA,IAAQ,OAAO;AAAA,EAChC,IAAI,aAAa;AAAA,IAAS,OAAO;AAAA,EACjC,OAAO,gBAAgB,MAAM;AAAA;AAIvB,SAAS,cAAc,GAAY;AAAA,EACzC,OAAO,gBAAgB,MAAM;AAAA;AAIvB,SAAS,SAAS,GAAY;AAAA,EACpC,OAAO,gBAAgB,MAAM;AAAA;;;ACtE9B;AAWO,SAAS,KAAkB,CAAC,OAAyB;AAAA,EAC3D,MAAM,UAAU,KAAK,UAAU,OAAO,CAAC,IAAI,MAC1C,OAAO,MAAM,WAAW,EAAE,SAAS,IAAI,CACxC,EAAE,QAAQ,MAAM,IAAI;AAAA,EACpB,OAAO,MAAM,IAAI,IAAI,IAAI,iBAAiB;AAAA;AAQpC,SAAS,UAAuB,CAAC,OAAmB;AAAA,EAC1D,IAAI,OAAO,UAAU,UAAU;AAAA,IAC9B,IAAI;AAAA,MACH,OAAO,KAAK,MAAM,KAAK;AAAA,MACtB,MAAM;AAAA,MACP,OAAO;AAAA;AAAA,EAET;AAAA,EACA,OAAQ,SAAS,CAAC;AAAA;;;AC/BnB,gBAAsB;AAWf,SAAS,YAAY,CAAC,cAA8B;AAAA,EAC1D,MAAM,WAAW,aAAa,QAAQ,MAAM,GAAG;AAAA,EAC/C,OAAO,YAAY;AAAA;AAIb,SAAS,sBAAsB,CAAC,WAA4B;AAAA,EAClE,IAAI,CAAC,eAAe;AAAA,IAAG,OAAO;AAAA,EAC9B,OAAO,aAAa;AAAA;AAQd,SAAS,eAAe,CAC9B,WACA,cACS;AAAA,EACT,IAAI,CAAC;AAAA,IAAW,OAAO,aAAa,YAAY;AAAA,EAChD,MAAM,gBAAgB,UAAU,MAAM,GAAG,CAAC,EAAE,QAAQ,MAAM,GAAG;AAAA,EAC7D,MAAM,WAAW,aAAa,QAAQ,MAAM,GAAG;AAAA,EAC/C,OAAO,YAAY,iBAAiB;AAAA;AAGrC,eAAsB,gBAAgB,CACrC,IACA,MAaoB;AAAA,EACpB,MAAM,YAAY,uBAAuB,KAAK,SAAS;AAAA,EACvD,MAAM,SAAS;AAAA,IACd,MAAM,KAAK;AAAA,IACX,SAAS,KAAK;AAAA,IACd,YAAY,MAA+B,KAAK,UAAU;AAAA,IAC1D,aAAa,KAAK;AAAA,IAClB,cAAc,KAAK;AAAA,IACnB,YAAY;AAAA,IACZ,cAAc,KAAK,eAAe;AAAA,IAClC,aAAa,KAAK,cAAc;AAAA,IAChC,aAAa,KAAK,cAAc;AAAA,IAChC,aAAa,KAAK,cAAc;AAAA,EACjC;AAAA,EACA,MAAM,YAAY;AAAA,IACjB,SAAS,KAAK;AAAA,IACd,YAAY,MAA+B,KAAK,UAAU;AAAA,IAC1D,aAAa,KAAK;AAAA,IAClB,cAAc,KAAK;AAAA,IACnB,cAAc,KAAK,eAAe;AAAA,IAClC,aAAa,KAAK,cAAc;AAAA,IAChC,aAAa,KAAK,cAAc;AAAA,IAChC,aAAa,KAAK,cAAc;AAAA,IAChC,YAAY,IAAI;AAAA,EACjB;AAAA,EAIA,IAAI,CAAC,eAAe,GAAG;AAAA,IACtB,MAAM,WAAW,MAAM,GACrB,WAAW,WAAW,EACtB,OAAO,IAAI,EACX,MAAM,QAAQ,KAAK,KAAK,IAAI,EAC5B,iBAAiB;AAAA,IACnB,IAAI,UAAU;AAAA,MACb,OAAO,MAAM,GACX,YAAY,WAAW,EACvB,IAAI,KAAK,WAAW,YAAY,GAAG,CAAC,EACpC,MAAM,MAAM,KAAK,SAAS,EAAE,EAC5B,aAAa,EACb,wBAAwB;AAAA,IAC3B;AAAA,IACA,OAAO,MAAM,GACX,WAAW,WAAW,EACtB,OAAO,MAAM,EACb,aAAa,EACb,wBAAwB;AAAA,EAC3B;AAAA,EAEA,OAAO,MAAM,GACX,WAAW,WAAW,EACtB,OAAO,MAAM,EACb,WAAW,CAAC,OACZ,GAAG,QAAQ,CAAC,QAAQ,YAAY,CAAC,EAAE,YAAY,SAAS,CACzD,EACC,aAAa,EACb,wBAAwB;AAAA;AAG3B,eAAsB,WAAW,CAChC,IACA,MACA,WAC2B;AAAA,EAC3B,IAAI,QAAQ,GAAG,WAAW,WAAW,EAAE,UAAU,EAAE,MAAM,QAAQ,KAAK,IAAI;AAAA,EAE1E,IAAI,eAAe,KAAK,cAAc,WAAW;AAAA,IAChD,QAAQ,MAAM,MAAM,cAAc,KAAK,SAAS;AAAA,EACjD;AAAA,EAEA,OAAQ,MAAM,MAAM,iBAAiB,KAAM;AAAA;AAG5C,eAAsB,aAAa,CAClC,IACA,WACsB;AAAA,EACtB,IAAI,QAAQ,GAAG,WAAW,WAAW,EAAE,UAAU;AAAA,EACjD,IAAI,eAAe,KAAK,cAAc,WAAW;AAAA,IAChD,QAAQ,MAAM,MAAM,cAAc,KAAK,SAAS;AAAA,EACjD;AAAA,EACA,OAAO,MAAM,QAAQ;AAAA;AAGtB,eAAsB,oBAAoB,CACzC,IACA,MACA,QACA,oBACgB;AAAA,EAChB,MAAM,GACJ,YAAY,WAAW,EACvB,IAAI;AAAA,IACJ;AAAA,OACI,uBAAuB,YACxB,EAAE,sBAAsB,mBAAmB,IAC3C,CAAC;AAAA,IACJ,YAAY,IAAI;AAAA,EACjB,CAAC,EACA,MAAM,QAAQ,KAAK,IAAI,EACvB,QAAQ;AAAA;AAkBX,eAAsB,eAAe,CACpC,IACA,MACA,aACmB;AAAA,EACnB,MAAM,SAAS,MAAM,GACnB,YAAY,WAAW,EACvB,IAAI;AAAA,IACJ,QAAQ;AAAA,IACR,sBAAsB;AAAA,IACtB,YAAY,IAAI;AAAA,EACjB,CAAC,EACA,MAAM,QAAQ,KAAK,IAAI,EACvB,MAAM,wBAAwB,KAAK,WAAW,EAC9C,iBAAiB;AAAA,EACnB,OAAO,OAAO,OAAO,kBAAkB,EAAE,IAAI;AAAA;AAG9C,eAAsB,uBAAuB,CAC5C,IACA,MACA,WACA,QACA,WACgB;AAAA,EAChB,MAAM,GACJ,YAAY,WAAW,EACvB,IAAI;AAAA,IACJ,iBAAiB,yBAAwB;AAAA,IACzC,cAAc,sBAAqB;AAAA,OAC/B,YACD,EAAE,YAAY,WAAW,eAAe,IAAI,KAAO,IACnD,CAAC;AAAA,IACJ,YAAY,IAAI;AAAA,EACjB,CAAC,EACA,MAAM,QAAQ,KAAK,IAAI,EACvB,QAAQ;AAAA;AAGX,eAAsB,yBAAyB,CAC9C,IACA,MACA,aACA,MACgB;AAAA,EAChB,MAAM,GACJ,YAAY,WAAW,EACvB,IAAI;AAAA,IACJ,cAAc;AAAA,OACV,MAAM,eAAe,OAAO,EAAE,cAAc,KAAK,YAAY,IAAI,CAAC;AAAA,OAClE,MAAM,cAAc,OAAO,EAAE,aAAa,KAAK,WAAW,IAAI,CAAC;AAAA,IACnE,YAAY,IAAI;AAAA,EACjB,CAAC,EACA,MAAM,QAAQ,KAAK,IAAI,EACvB,QAAQ;AAAA;AAGX,eAAsB,cAAc,CACnC,IACA,MACA,WAC2B;AAAA,EAC3B,MAAM,WAAW,MAAM,YAAY,IAAI,MAAM,SAAS;AAAA,EACtD,IAAI,CAAC;AAAA,IAAU,OAAO;AAAA,EAGtB,MAAM,aAAa,SAAS,eAAe,aAAa,IAAI;AAAA,EAQ5D,MAAM,GACJ,YAAY,UAAU,EACtB,IAAI;AAAA,IACJ,QAAQ;AAAA,IACR,YAAY,aAAa;AAAA,IACzB,YAAY,IAAI;AAAA,EACjB,CAAC,EACA,MAAM,iBAAiB,KAAK,IAAI,EAChC,QAAQ;AAAA,EACV,MAAM,GACJ,WAAW,gBAAgB,EAC3B,MAAM,UAAU,KAAK,SAAS,EAC9B,MAAM,cAAc,MAAM,CAAC,OAC3B,GAAG,WAAW,UAAU,EAAE,OAAO,IAAI,EAAE,MAAM,iBAAiB,KAAK,IAAI,CACxE,EACC,QAAQ;AAAA,EAGV,MAAM,6BAA4B,KAAI,IAAI,IAAI,aAAa,YAAY,QACtE,EACD;AAAA,EAGA,MAAM,GAAG,WAAW,WAAW,EAAE,MAAM,MAAM,KAAK,SAAS,EAAE,EAAE,QAAQ;AAAA,EAEvE,OAAO;AAAA;AAIR,eAAsB,oBAAoB,CACzC,IACA,MACA,WACA,WACgB;AAAA,EAChB,MAAM,GACJ,YAAY,WAAW,EACvB,IAAI,EAAE,YAAY,UAAU,CAAC,EAC7B,MAAM,QAAQ,KAAK,IAAI,EACvB,MAAM,cAAc,KAAK,SAAS,EAClC,QAAQ;AAAA;AAqCX,eAAsB,kBAAkB,CACvC,IACA,MACA,oBACmB;AAAA,EACnB,MAAM,SAAS,MAAM,GACnB,YAAY,WAAW,EACvB,IAAI;AAAA,IACJ,sBAAsB;AAAA,IACtB,QAAQ;AAAA,IACR,YAAY,IAAI;AAAA,EACjB,CAAC,EACA,MAAM,QAAQ,KAAK,IAAI,EACvB,MAAM,wBAAwB,KAAK,kBAAkB,EACrD,iBAAiB;AAAA,EACnB,OAAO,OAAO,OAAO,kBAAkB,EAAE,IAAI;AAAA;AAkB9C,eAAsB,kBAAkB,CACvC,IACA,MACA,oBACgB;AAAA,EAChB,MAAM,GACJ,YAAY,WAAW,EACvB,IAAI;AAAA,IACJ,sBAAsB;AAAA,IACtB,QAAQ;AAAA,IACR,YAAY,IAAI;AAAA,EACjB,CAAC,EACA,MAAM,QAAQ,KAAK,IAAI,EACvB,QAAQ;AAAA;",
-  "debugId": "EEA4A11D75AFDFDE64756E2164756E21",
+  "mappings": ";AAAA,gBAAsB;;;ACmBtB,IAAM,cAA+C;AAAA,EACpD;AAAA,EACA;AAAA,EACA;AACD;AAEA,SAAS,YAAY,GAAyB;AAAA,EAC7C,MAAM,MAAM,QAAQ,IAAI,eAAe,KAAK,EAAE,YAAY;AAAA,EAC1D,IAAI,OAAQ,YAAkC,SAAS,GAAG,GAAG;AAAA,IAC5D,OAAO;AAAA,EACR;AAAA,EACA,OAAO;AAAA;AAUD,SAAS,eAAe,GAAiB;AAAA,EAC/C,MAAM,WAAW,aAAa;AAAA,EAC9B,OAAO,aAAa,YAAY,aAAa;AAAA;AAIvC,SAAS,uBAAuB,GAAyB;AAAA,EAC/D,OAAO,aAAa;AAAA;AASd,SAAS,cAAc,GAAY;AAAA,EACzC,MAAM,WAAW,QAAQ,IAAI,eAAe,KAAK,EAAE,YAAY;AAAA,EAC/D,IAAI,aAAa;AAAA,IAAQ,OAAO;AAAA,EAChC,IAAI,aAAa;AAAA,IAAS,OAAO;AAAA,EACjC,OAAO,gBAAgB,MAAM;AAAA;AAIvB,SAAS,cAAc,GAAY;AAAA,EACzC,OAAO,gBAAgB,MAAM;AAAA;AAIvB,SAAS,SAAS,GAAY;AAAA,EACpC,OAAO,gBAAgB,MAAM;AAAA;;;ACtE9B;AAWO,SAAS,KAAkB,CAAC,OAAyB;AAAA,EAC3D,MAAM,UAAU,KAAK,UAAU,OAAO,CAAC,IAAI,MAC1C,OAAO,MAAM,WAAW,EAAE,SAAS,IAAI,CACxC,EAAE,QAAQ,MAAM,IAAI;AAAA,EACpB,OAAO,MAAM,IAAI,IAAI,IAAI,iBAAiB;AAAA;AAQpC,SAAS,UAAuB,CAAC,OAAmB;AAAA,EAC1D,IAAI,OAAO,UAAU,UAAU;AAAA,IAC9B,IAAI;AAAA,MACH,OAAO,KAAK,MAAM,KAAK;AAAA,MACtB,MAAM;AAAA,MACP,OAAO;AAAA;AAAA,EAET;AAAA,EACA,OAAQ,SAAS,CAAC;AAAA;;;AFzBZ,SAAS,YAAY,CAAC,cAA8B;AAAA,EAC1D,MAAM,WAAW,aAAa,QAAQ,MAAM,GAAG;AAAA,EAC/C,OAAO,YAAY;AAAA;AAIb,SAAS,sBAAsB,CAAC,WAA4B;AAAA,EAClE,IAAI,CAAC,eAAe;AAAA,IAAG,OAAO;AAAA,EAC9B,OAAO,aAAa;AAAA;AAGrB,eAAsB,gBAAgB,CACrC,IACA,MAaoB;AAAA,EACpB,MAAM,YAAY,uBAAuB,KAAK,SAAS;AAAA,EACvD,MAAM,SAAS;AAAA,IACd,MAAM,KAAK;AAAA,IACX,SAAS,KAAK;AAAA,IACd,YAAY,MAA+B,KAAK,UAAU;AAAA,IAC1D,aAAa,KAAK;AAAA,IAClB,cAAc,KAAK;AAAA,IACnB,YAAY;AAAA,IACZ,cAAc,KAAK,eAAe;AAAA,IAClC,aAAa,KAAK,cAAc;AAAA,IAChC,aAAa,KAAK,cAAc;AAAA,IAChC,aAAa,KAAK,cAAc;AAAA,EACjC;AAAA,EACA,MAAM,YAAY;AAAA,IACjB,SAAS,KAAK;AAAA,IACd,YAAY,MAA+B,KAAK,UAAU;AAAA,IAC1D,aAAa,KAAK;AAAA,IAClB,cAAc,KAAK;AAAA,IACnB,cAAc,KAAK,eAAe;AAAA,IAClC,aAAa,KAAK,cAAc;AAAA,IAChC,aAAa,KAAK,cAAc;AAAA,IAChC,aAAa,KAAK,cAAc;AAAA,IAChC,YAAY,IAAI;AAAA,EACjB;AAAA,EAIA,IAAI,CAAC,eAAe,GAAG;AAAA,IACtB,MAAM,WAAW,MAAM,GACrB,WAAW,WAAW,EACtB,OAAO,IAAI,EACX,MAAM,QAAQ,KAAK,KAAK,IAAI,EAC5B,iBAAiB;AAAA,IACnB,IAAI,UAAU;AAAA,MACb,OAAO,MAAM,GACX,YAAY,WAAW,EACvB,IAAI,KAAK,WAAW,YAAY,GAAG,CAAC,EACpC,MAAM,MAAM,KAAK,SAAS,EAAE,EAC5B,aAAa,EACb,wBAAwB;AAAA,IAC3B;AAAA,IACA,OAAO,MAAM,GACX,WAAW,WAAW,EACtB,OAAO,MAAM,EACb,aAAa,EACb,wBAAwB;AAAA,EAC3B;AAAA,EAEA,OAAO,MAAM,GACX,WAAW,WAAW,EACtB,OAAO,MAAM,EACb,WAAW,CAAC,OACZ,GAAG,QAAQ,CAAC,QAAQ,YAAY,CAAC,EAAE,YAAY,SAAS,CACzD,EACC,aAAa,EACb,wBAAwB;AAAA;AAG3B,eAAsB,WAAW,CAChC,IACA,MACA,WAC2B;AAAA,EAC3B,IAAI,QAAQ,GAAG,WAAW,WAAW,EAAE,UAAU,EAAE,MAAM,QAAQ,KAAK,IAAI;AAAA,EAE1E,IAAI,eAAe,KAAK,cAAc,WAAW;AAAA,IAChD,QAAQ,MAAM,MAAM,cAAc,KAAK,SAAS;AAAA,EACjD;AAAA,EAEA,OAAQ,MAAM,MAAM,iBAAiB,KAAM;AAAA;AAG5C,eAAsB,aAAa,CAClC,IACA,WACsB;AAAA,EACtB,IAAI,QAAQ,GAAG,WAAW,WAAW,EAAE,UAAU;AAAA,EACjD,IAAI,eAAe,KAAK,cAAc,WAAW;AAAA,IAChD,QAAQ,MAAM,MAAM,cAAc,KAAK,SAAS;AAAA,EACjD;AAAA,EACA,OAAO,MAAM,QAAQ;AAAA;AAGtB,eAAsB,oBAAoB,CACzC,IACA,MACA,QACA,oBACgB;AAAA,EAChB,MAAM,GACJ,YAAY,WAAW,EACvB,IAAI;AAAA,IACJ;AAAA,OACI,uBAAuB,YACxB,EAAE,sBAAsB,mBAAmB,IAC3C,CAAC;AAAA,IACJ,YAAY,IAAI;AAAA,EACjB,CAAC,EACA,MAAM,QAAQ,KAAK,IAAI,EACvB,QAAQ;AAAA;AAkBX,eAAsB,eAAe,CACpC,IACA,MACA,aACmB;AAAA,EACnB,MAAM,SAAS,MAAM,GACnB,YAAY,WAAW,EACvB,IAAI;AAAA,IACJ,QAAQ;AAAA,IACR,sBAAsB;AAAA,IACtB,YAAY,IAAI;AAAA,EACjB,CAAC,EACA,MAAM,QAAQ,KAAK,IAAI,EACvB,MAAM,wBAAwB,KAAK,WAAW,EAC9C,iBAAiB;AAAA,EACnB,OAAO,OAAO,OAAO,kBAAkB,EAAE,IAAI;AAAA;AAG9C,eAAsB,uBAAuB,CAC5C,IACA,MACA,WACA,QACA,WACgB;AAAA,EAChB,MAAM,GACJ,YAAY,WAAW,EACvB,IAAI;AAAA,IACJ,iBAAiB,yBAAwB;AAAA,IACzC,cAAc,sBAAqB;AAAA,OAC/B,YACD,EAAE,YAAY,WAAW,eAAe,IAAI,KAAO,IACnD,CAAC;AAAA,IACJ,YAAY,IAAI;AAAA,EACjB,CAAC,EACA,MAAM,QAAQ,KAAK,IAAI,EACvB,QAAQ;AAAA;AAGX,eAAsB,yBAAyB,CAC9C,IACA,MACA,aACA,MACgB;AAAA,EAChB,MAAM,GACJ,YAAY,WAAW,EACvB,IAAI;AAAA,IACJ,cAAc;AAAA,OACV,MAAM,eAAe,OAAO,EAAE,cAAc,KAAK,YAAY,IAAI,CAAC;AAAA,OAClE,MAAM,cAAc,OAAO,EAAE,aAAa,KAAK,WAAW,IAAI,CAAC;AAAA,IACnE,YAAY,IAAI;AAAA,EACjB,CAAC,EACA,MAAM,QAAQ,KAAK,IAAI,EACvB,QAAQ;AAAA;AAGX,eAAsB,cAAc,CACnC,IACA,MACA,WAC2B;AAAA,EAC3B,MAAM,WAAW,MAAM,YAAY,IAAI,MAAM,SAAS;AAAA,EACtD,IAAI,CAAC;AAAA,IAAU,OAAO;AAAA,EAGtB,MAAM,aAAa,SAAS,eAAe,aAAa,IAAI;AAAA,EAQ5D,MAAM,GACJ,YAAY,UAAU,EACtB,IAAI;AAAA,IACJ,QAAQ;AAAA,IACR,YAAY,aAAa;AAAA,IACzB,YAAY,IAAI;AAAA,EACjB,CAAC,EACA,MAAM,iBAAiB,KAAK,IAAI,EAChC,QAAQ;AAAA,EACV,MAAM,GACJ,WAAW,gBAAgB,EAC3B,MAAM,UAAU,KAAK,SAAS,EAC9B,MAAM,cAAc,MAAM,CAAC,OAC3B,GAAG,WAAW,UAAU,EAAE,OAAO,IAAI,EAAE,MAAM,iBAAiB,KAAK,IAAI,CACxE,EACC,QAAQ;AAAA,EAGV,MAAM,6BAA4B,KAAI,IAAI,IAAI,aAAa,YAAY,QACtE,EACD;AAAA,EAGA,MAAM,GAAG,WAAW,WAAW,EAAE,MAAM,MAAM,KAAK,SAAS,EAAE,EAAE,QAAQ;AAAA,EAEvE,OAAO;AAAA;AAIR,eAAsB,oBAAoB,CACzC,IACA,MACA,WACA,WACgB;AAAA,EAChB,MAAM,GACJ,YAAY,WAAW,EACvB,IAAI,EAAE,YAAY,UAAU,CAAC,EAC7B,MAAM,QAAQ,KAAK,IAAI,EACvB,MAAM,cAAc,KAAK,SAAS,EAClC,QAAQ;AAAA;AAqCX,eAAsB,kBAAkB,CACvC,IACA,MACA,oBACmB;AAAA,EACnB,MAAM,SAAS,MAAM,GACnB,YAAY,WAAW,EACvB,IAAI;AAAA,IACJ,sBAAsB;AAAA,IACtB,QAAQ;AAAA,IACR,YAAY,IAAI;AAAA,EACjB,CAAC,EACA,MAAM,QAAQ,KAAK,IAAI,EACvB,MAAM,wBAAwB,KAAK,kBAAkB,EACrD,iBAAiB;AAAA,EACnB,OAAO,OAAO,OAAO,kBAAkB,EAAE,IAAI;AAAA;AAkB9C,eAAsB,kBAAkB,CACvC,IACA,MACA,oBACgB;AAAA,EAChB,MAAM,GACJ,YAAY,WAAW,EACvB,IAAI;AAAA,IACJ,sBAAsB;AAAA,IACtB,QAAQ;AAAA,IACR,YAAY,IAAI;AAAA,EACjB,CAAC,EACA,MAAM,QAAQ,KAAK,IAAI,EACvB,QAAQ;AAAA;",
+  "debugId": "BAA950C11B40A13F64756E2164756E21",
   "names": []
 }

package/dist/src/db/queries/sync-scope.d.ts

@@ -163,7 +163,6 @@ interface SubgraphsTable {
 	handler_code: string | null;
 	source_code: string | null;
 	project_id: string | null;
-	visibility: Generated<string>;
 	/** Paid (wallet-ghost) deploys expire unless renewed or claimed; NULL = no expiry. */
 	expires_at: Date | null;
 	/** (event type, contract) probe pairs persisted at deploy for weight classification. */
@@ -793,6 +792,7 @@ interface Database {
 	coverage_segments: CoverageSegmentsTable;
 	stage_failures: StageFailuresTable;
 	archive_fetches: ArchiveFetchesTable;
+	usage_ledger: UsageLedgerTable;
 	waitlists: WaitlistsTable;
 	waitlist_signups: WaitlistSignupsTable;
 }
@@ -837,6 +837,27 @@ interface ArchiveFetchesTable {
 	via_allowance: Generated<boolean>;
 	charged_at: Generated<Date>;
 }
+/**
+* One metered ledger for every billable unit (archive partitions, hosted
+* Index/Streams rows, and future hosted-stack meters). Append-only, written
+* only by `meter()`. `idempotency_key` is UNIQUE so a retried submission
+* no-ops instead of double-charging. `debited` is false when the balance
+* (or a spend cap) refused the charge — the row still exists so the gap is
+* visible, never silently dropped. `usd_micros` is negative for a Stripe
+* top-up (`unit: "topup"`).
+*/
+interface UsageLedgerTable {
+	id: Generated<string>;
+	account_id: string;
+	unit: string;
+	quantity: string | number | bigint;
+	usd_micros: string | number | bigint;
+	debited: Generated<boolean>;
+	source: string;
+	idempotency_key: string;
+	occurred_at: Generated<Date>;
+	recorded_at: Generated<Date>;
+}
 type WebhookStatus = "active" | "paused" | "error";
 /** Polymorphic webhook mode: `subgraph` reacts to processed table rows;
 *  `chain` reacts to raw chain events matched directly off the Index/Streams
@@ -899,6 +920,10 @@ interface WebhookOutboxTable {
 	failed_at: Date | null;
 	locked_by: string | null;
 	locked_until: Date | null;
+	/** Set when a reorg marks an in-flight row `dead` instead of retrying it
+	*  into an orphaned fork. Null otherwise — delivery failures track their
+	*  history on `webhooks.last_error`, not per-row. */
+	last_error: string | null;
 	created_at: Generated<Date>;
 }
 interface WebhookDeliveriesTable {
@@ -994,4 +1019,4 @@ declare function upsertSyncScope(db: Kysely<Database>, scope: SyncScope): Promis
 * restore we can vouch for.
 */
 declare function resolveSyncScope(db: Kysely<Database>, network: string): Promise<SyncScope>;
-export { upsertSyncScope, syncStartHeightFromEnv, resolveSyncScope, getSyncScope, SYNC_START_HEIGHT_ENV, InvalidSyncStartHeightError };
+export { InvalidSyncStartHeightError, SYNC_START_HEIGHT_ENV, getSyncScope, resolveSyncScope, syncStartHeightFromEnv, upsertSyncScope };

package/dist/src/db/queries/sync-scope.js

@@ -1,19 +1,3 @@
-import { createRequire } from "node:module";
-var __defProp = Object.defineProperty;
-var __returnValue = (v) => v;
-function __exportSetter(name, newValue) {
-  this[name] = __returnValue.bind(null, newValue);
-}
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, {
-      get: all[name],
-      enumerable: true,
-      configurable: true,
-      set: __exportSetter.bind(all, name)
-    });
-};
-
 // src/db/queries/sync-scope.ts
 var SYNC_START_HEIGHT_ENV = "SECONDLAYER_SYNC_START_HEIGHT";
 
@@ -104,13 +88,13 @@ async function resolveSyncScope(db, network) {
   };
 }
 export {
-  upsertSyncScope,
-  syncStartHeightFromEnv,
-  resolveSyncScope,
-  getSyncScope,
+  InvalidSyncStartHeightError,
   SYNC_START_HEIGHT_ENV,
-  InvalidSyncStartHeightError
+  getSyncScope,
+  resolveSyncScope,
+  syncStartHeightFromEnv,
+  upsertSyncScope
 };
 
-//# debugId=A8458ACA2A49456264756E2164756E21
+//# debugId=0BAF9C1F28590E5C64756E2164756E21
 //# sourceMappingURL=sync-scope.js.map

package/dist/src/db/queries/sync-scope.js.map

@@ -4,7 +4,7 @@
   "sourcesContent": [
     "import type { Kysely } from \"kysely\";\nimport type { BootstrapSource, SyncScope } from \"../../coverage/evaluate.ts\";\nimport type { Database } from \"../types.ts\";\n\n/**\n * The instance's declared sync scope.\n *\n * An instance that starts at height N is not an instance missing the first N\n * blocks — but nothing in the schema said so, so every consumer had to guess\n * from `MIN(height)`. `sync_scopes` records the declaration; this module is the\n * only place that reads it, and it always answers in the `SyncScope` shape the\n * coverage evaluator consumes.\n *\n * `resolveSyncScope` never fails on an instance that predates the table: with\n * no row it derives a scope from what the database already shows, so an\n * existing install keeps working without a backfill dance.\n */\n\n/**\n * Declares a forward-only instance: history below this height is deliberately\n * absent, not lost. Read only when no `sync_scopes` row exists — a recorded\n * scope always wins, because it is the one an operator committed to.\n */\nexport const SYNC_START_HEIGHT_ENV = \"SECONDLAYER_SYNC_START_HEIGHT\";\n\nexport class InvalidSyncStartHeightError extends Error {\n\treadonly name = \"InvalidSyncStartHeightError\";\n\tconstructor(readonly value: string) {\n\t\tsuper(\n\t\t\t`${SYNC_START_HEIGHT_ENV} must be a non-negative integer (got ${value})`,\n\t\t);\n\t}\n}\n\n/**\n * Throws rather than ignoring a malformed value: a typo'd start height that\n * silently falls back to genesis would report a real forward-only instance as\n * an 8M-block gap, which is the exact confusion this table exists to end.\n */\nexport function syncStartHeightFromEnv(\n\tenv: NodeJS.ProcessEnv = process.env,\n): number | null {\n\tconst raw = env[SYNC_START_HEIGHT_ENV];\n\tif (raw === undefined || raw.trim() === \"\") return null;\n\tconst height = Number(raw.trim());\n\tif (!Number.isInteger(height) || height < 0) {\n\t\tthrow new InvalidSyncStartHeightError(raw);\n\t}\n\treturn height;\n}\n\nfunction toScope(row: {\n\tnetwork: string;\n\tstart_height: number | string;\n\ttarget_height: number | string | null;\n\tbootstrap_source: BootstrapSource;\n\tbootstrap_manifest_digest: string | null;\n\tgenesis_hash: string | null;\n}): SyncScope {\n\treturn {\n\t\tnetwork: row.network,\n\t\tstart_height: Number(row.start_height),\n\t\ttarget_height:\n\t\t\trow.target_height === null ? null : Number(row.target_height),\n\t\tbootstrap: {\n\t\t\tsource: row.bootstrap_source,\n\t\t\tmanifest_digest: row.bootstrap_manifest_digest,\n\t\t\tgenesis_hash: row.genesis_hash,\n\t\t},\n\t};\n}\n\nexport async function getSyncScope(\n\tdb: Kysely<Database>,\n\tnetwork: string,\n): Promise<SyncScope | null> {\n\tconst row = await db\n\t\t.selectFrom(\"sync_scopes\")\n\t\t.select([\n\t\t\t\"network\",\n\t\t\t\"start_height\",\n\t\t\t\"target_height\",\n\t\t\t\"bootstrap_source\",\n\t\t\t\"bootstrap_manifest_digest\",\n\t\t\t\"genesis_hash\",\n\t\t])\n\t\t.where(\"network\", \"=\", network)\n\t\t.executeTakeFirst();\n\treturn row ? toScope(row) : null;\n}\n\n/**\n * Record (or restate) the scope for a network. Bootstrap and re-bootstrap are\n * the writers; the upsert is idempotent so re-running a restore over the same\n * archive does not fork the declaration.\n */\nexport async function upsertSyncScope(\n\tdb: Kysely<Database>,\n\tscope: SyncScope,\n): Promise<SyncScope> {\n\tconst row = await db\n\t\t.insertInto(\"sync_scopes\")\n\t\t.values({\n\t\t\tnetwork: scope.network,\n\t\t\tstart_height: scope.start_height,\n\t\t\ttarget_height: scope.target_height,\n\t\t\tbootstrap_source: scope.bootstrap.source,\n\t\t\tbootstrap_manifest_digest: scope.bootstrap.manifest_digest,\n\t\t\tgenesis_hash: scope.bootstrap.genesis_hash,\n\t\t})\n\t\t.onConflict((oc) =>\n\t\t\toc.column(\"network\").doUpdateSet({\n\t\t\t\tstart_height: scope.start_height,\n\t\t\t\ttarget_height: scope.target_height,\n\t\t\t\tbootstrap_source: scope.bootstrap.source,\n\t\t\t\tbootstrap_manifest_digest: scope.bootstrap.manifest_digest,\n\t\t\t\tgenesis_hash: scope.bootstrap.genesis_hash,\n\t\t\t\tupdated_at: new Date(),\n\t\t\t}),\n\t\t)\n\t\t.returning([\n\t\t\t\"network\",\n\t\t\t\"start_height\",\n\t\t\t\"target_height\",\n\t\t\t\"bootstrap_source\",\n\t\t\t\"bootstrap_manifest_digest\",\n\t\t\t\"genesis_hash\",\n\t\t])\n\t\t.executeTakeFirstOrThrow();\n\treturn toScope(row);\n}\n\n/**\n * The persisted scope, or one derived from the database when none was ever\n * recorded.\n *\n * The derivation is deliberately conservative: it claims only what the data\n * already shows (the lowest canonical block, the genesis hash if genesis is\n * present) and never invents provenance — an instance whose history starts\n * above genesis with no recorded bootstrap is an `import`, not an archive\n * restore we can vouch for.\n */\nexport async function resolveSyncScope(\n\tdb: Kysely<Database>,\n\tnetwork: string,\n): Promise<SyncScope> {\n\tconst persisted = await getSyncScope(db, network);\n\tif (persisted) return persisted;\n\n\tconst declaredStart = syncStartHeightFromEnv();\n\tconst lowest = await db\n\t\t.selectFrom(\"blocks\")\n\t\t.select(({ fn }) => fn.min(\"height\").as(\"min\"))\n\t\t.where(\"canonical\", \"=\", true)\n\t\t.executeTakeFirst();\n\tconst lowestStored =\n\t\tlowest?.min === null || lowest?.min === undefined\n\t\t\t? null\n\t\t\t: Number(lowest.min);\n\tconst startHeight = declaredStart ?? lowestStored ?? 0;\n\n\tconst genesis =\n\t\tstartHeight === 0\n\t\t\t? await db\n\t\t\t\t\t.selectFrom(\"blocks\")\n\t\t\t\t\t.select(\"hash\")\n\t\t\t\t\t.where(\"canonical\", \"=\", true)\n\t\t\t\t\t.where(\"height\", \"=\", 0)\n\t\t\t\t\t.executeTakeFirst()\n\t\t\t: undefined;\n\n\treturn {\n\t\tnetwork,\n\t\tstart_height: startHeight,\n\t\ttarget_height: null,\n\t\tbootstrap: {\n\t\t\tsource: startHeight === 0 ? \"genesis\" : \"import\",\n\t\t\tmanifest_digest: null,\n\t\t\tgenesis_hash: genesis?.hash ?? null,\n\t\t},\n\t};\n}\n"
   ],
-  "mappings": ";;;;;;;;;;;;;;;;;AAuBO,IAAM,wBAAwB;AAAA;AAE9B,MAAM,oCAAoC,MAAM;AAAA,EAEjC;AAAA,EADZ,OAAO;AAAA,EAChB,WAAW,CAAU,OAAe;AAAA,IACnC,MACC,GAAG,6DAA6D,QACjE;AAAA,IAHoB;AAAA;AAKtB;AAOO,SAAS,sBAAsB,CACrC,MAAyB,QAAQ,KACjB;AAAA,EAChB,MAAM,MAAM,IAAI;AAAA,EAChB,IAAI,QAAQ,aAAa,IAAI,KAAK,MAAM;AAAA,IAAI,OAAO;AAAA,EACnD,MAAM,SAAS,OAAO,IAAI,KAAK,CAAC;AAAA,EAChC,IAAI,CAAC,OAAO,UAAU,MAAM,KAAK,SAAS,GAAG;AAAA,IAC5C,MAAM,IAAI,4BAA4B,GAAG;AAAA,EAC1C;AAAA,EACA,OAAO;AAAA;AAGR,SAAS,OAAO,CAAC,KAOH;AAAA,EACb,OAAO;AAAA,IACN,SAAS,IAAI;AAAA,IACb,cAAc,OAAO,IAAI,YAAY;AAAA,IACrC,eACC,IAAI,kBAAkB,OAAO,OAAO,OAAO,IAAI,aAAa;AAAA,IAC7D,WAAW;AAAA,MACV,QAAQ,IAAI;AAAA,MACZ,iBAAiB,IAAI;AAAA,MACrB,cAAc,IAAI;AAAA,IACnB;AAAA,EACD;AAAA;AAGD,eAAsB,YAAY,CACjC,IACA,SAC4B;AAAA,EAC5B,MAAM,MAAM,MAAM,GAChB,WAAW,aAAa,EACxB,OAAO;AAAA,IACP;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACD,CAAC,EACA,MAAM,WAAW,KAAK,OAAO,EAC7B,iBAAiB;AAAA,EACnB,OAAO,MAAM,QAAQ,GAAG,IAAI;AAAA;AAQ7B,eAAsB,eAAe,CACpC,IACA,OACqB;AAAA,EACrB,MAAM,MAAM,MAAM,GAChB,WAAW,aAAa,EACxB,OAAO;AAAA,IACP,SAAS,MAAM;AAAA,IACf,cAAc,MAAM;AAAA,IACpB,eAAe,MAAM;AAAA,IACrB,kBAAkB,MAAM,UAAU;AAAA,IAClC,2BAA2B,MAAM,UAAU;AAAA,IAC3C,cAAc,MAAM,UAAU;AAAA,EAC/B,CAAC,EACA,WAAW,CAAC,OACZ,GAAG,OAAO,SAAS,EAAE,YAAY;AAAA,IAChC,cAAc,MAAM;AAAA,IACpB,eAAe,MAAM;AAAA,IACrB,kBAAkB,MAAM,UAAU;AAAA,IAClC,2BAA2B,MAAM,UAAU;AAAA,IAC3C,cAAc,MAAM,UAAU;AAAA,IAC9B,YAAY,IAAI;AAAA,EACjB,CAAC,CACF,EACC,UAAU;AAAA,IACV;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACD,CAAC,EACA,wBAAwB;AAAA,EAC1B,OAAO,QAAQ,GAAG;AAAA;AAanB,eAAsB,gBAAgB,CACrC,IACA,SACqB;AAAA,EACrB,MAAM,YAAY,MAAM,aAAa,IAAI,OAAO;AAAA,EAChD,IAAI;AAAA,IAAW,OAAO;AAAA,EAEtB,MAAM,gBAAgB,uBAAuB;AAAA,EAC7C,MAAM,SAAS,MAAM,GACnB,WAAW,QAAQ,EACnB,OAAO,GAAG,SAAS,GAAG,IAAI,QAAQ,EAAE,GAAG,KAAK,CAAC,EAC7C,MAAM,aAAa,KAAK,IAAI,EAC5B,iBAAiB;AAAA,EACnB,MAAM,eACL,QAAQ,QAAQ,QAAQ,QAAQ,QAAQ,YACrC,OACA,OAAO,OAAO,GAAG;AAAA,EACrB,MAAM,cAAc,iBAAiB,gBAAgB;AAAA,EAErD,MAAM,UACL,gBAAgB,IACb,MAAM,GACL,WAAW,QAAQ,EACnB,OAAO,MAAM,EACb,MAAM,aAAa,KAAK,IAAI,EAC5B,MAAM,UAAU,KAAK,CAAC,EACtB,iBAAiB,IAClB;AAAA,EAEJ,OAAO;AAAA,IACN;AAAA,IACA,cAAc;AAAA,IACd,eAAe;AAAA,IACf,WAAW;AAAA,MACV,QAAQ,gBAAgB,IAAI,YAAY;AAAA,MACxC,iBAAiB;AAAA,MACjB,cAAc,SAAS,QAAQ;AAAA,IAChC;AAAA,EACD;AAAA;",
-  "debugId": "A8458ACA2A49456264756E2164756E21",
+  "mappings": ";AAuBO,IAAM,wBAAwB;AAAA;AAE9B,MAAM,oCAAoC,MAAM;AAAA,EAEjC;AAAA,EADZ,OAAO;AAAA,EAChB,WAAW,CAAU,OAAe;AAAA,IACnC,MACC,GAAG,6DAA6D,QACjE;AAAA,IAHoB;AAAA;AAKtB;AAOO,SAAS,sBAAsB,CACrC,MAAyB,QAAQ,KACjB;AAAA,EAChB,MAAM,MAAM,IAAI;AAAA,EAChB,IAAI,QAAQ,aAAa,IAAI,KAAK,MAAM;AAAA,IAAI,OAAO;AAAA,EACnD,MAAM,SAAS,OAAO,IAAI,KAAK,CAAC;AAAA,EAChC,IAAI,CAAC,OAAO,UAAU,MAAM,KAAK,SAAS,GAAG;AAAA,IAC5C,MAAM,IAAI,4BAA4B,GAAG;AAAA,EAC1C;AAAA,EACA,OAAO;AAAA;AAGR,SAAS,OAAO,CAAC,KAOH;AAAA,EACb,OAAO;AAAA,IACN,SAAS,IAAI;AAAA,IACb,cAAc,OAAO,IAAI,YAAY;AAAA,IACrC,eACC,IAAI,kBAAkB,OAAO,OAAO,OAAO,IAAI,aAAa;AAAA,IAC7D,WAAW;AAAA,MACV,QAAQ,IAAI;AAAA,MACZ,iBAAiB,IAAI;AAAA,MACrB,cAAc,IAAI;AAAA,IACnB;AAAA,EACD;AAAA;AAGD,eAAsB,YAAY,CACjC,IACA,SAC4B;AAAA,EAC5B,MAAM,MAAM,MAAM,GAChB,WAAW,aAAa,EACxB,OAAO;AAAA,IACP;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACD,CAAC,EACA,MAAM,WAAW,KAAK,OAAO,EAC7B,iBAAiB;AAAA,EACnB,OAAO,MAAM,QAAQ,GAAG,IAAI;AAAA;AAQ7B,eAAsB,eAAe,CACpC,IACA,OACqB;AAAA,EACrB,MAAM,MAAM,MAAM,GAChB,WAAW,aAAa,EACxB,OAAO;AAAA,IACP,SAAS,MAAM;AAAA,IACf,cAAc,MAAM;AAAA,IACpB,eAAe,MAAM;AAAA,IACrB,kBAAkB,MAAM,UAAU;AAAA,IAClC,2BAA2B,MAAM,UAAU;AAAA,IAC3C,cAAc,MAAM,UAAU;AAAA,EAC/B,CAAC,EACA,WAAW,CAAC,OACZ,GAAG,OAAO,SAAS,EAAE,YAAY;AAAA,IAChC,cAAc,MAAM;AAAA,IACpB,eAAe,MAAM;AAAA,IACrB,kBAAkB,MAAM,UAAU;AAAA,IAClC,2BAA2B,MAAM,UAAU;AAAA,IAC3C,cAAc,MAAM,UAAU;AAAA,IAC9B,YAAY,IAAI;AAAA,EACjB,CAAC,CACF,EACC,UAAU;AAAA,IACV;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACD,CAAC,EACA,wBAAwB;AAAA,EAC1B,OAAO,QAAQ,GAAG;AAAA;AAanB,eAAsB,gBAAgB,CACrC,IACA,SACqB;AAAA,EACrB,MAAM,YAAY,MAAM,aAAa,IAAI,OAAO;AAAA,EAChD,IAAI;AAAA,IAAW,OAAO;AAAA,EAEtB,MAAM,gBAAgB,uBAAuB;AAAA,EAC7C,MAAM,SAAS,MAAM,GACnB,WAAW,QAAQ,EACnB,OAAO,GAAG,SAAS,GAAG,IAAI,QAAQ,EAAE,GAAG,KAAK,CAAC,EAC7C,MAAM,aAAa,KAAK,IAAI,EAC5B,iBAAiB;AAAA,EACnB,MAAM,eACL,QAAQ,QAAQ,QAAQ,QAAQ,QAAQ,YACrC,OACA,OAAO,OAAO,GAAG;AAAA,EACrB,MAAM,cAAc,iBAAiB,gBAAgB;AAAA,EAErD,MAAM,UACL,gBAAgB,IACb,MAAM,GACL,WAAW,QAAQ,EACnB,OAAO,MAAM,EACb,MAAM,aAAa,KAAK,IAAI,EAC5B,MAAM,UAAU,KAAK,CAAC,EACtB,iBAAiB,IAClB;AAAA,EAEJ,OAAO;AAAA,IACN;AAAA,IACA,cAAc;AAAA,IACd,eAAe;AAAA,IACf,WAAW;AAAA,MACV,QAAQ,gBAAgB,IAAI,YAAY;AAAA,MACxC,iBAAiB;AAAA,MACjB,cAAc,SAAS,QAAQ;AAAA,IAChC;AAAA,EACD;AAAA;",
+  "debugId": "0BAF9C1F28590E5C64756E2164756E21",
   "names": []
 }

package/dist/src/db/queries/webhooks.d.ts

@@ -153,7 +153,6 @@ interface SubgraphsTable {
 	handler_code: string | null;
 	source_code: string | null;
 	project_id: string | null;
-	visibility: Generated<string>;
 	/** Paid (wallet-ghost) deploys expire unless renewed or claimed; NULL = no expiry. */
 	expires_at: Date | null;
 	/** (event type, contract) probe pairs persisted at deploy for weight classification. */
@@ -783,6 +782,7 @@ interface Database {
 	coverage_segments: CoverageSegmentsTable;
 	stage_failures: StageFailuresTable;
 	archive_fetches: ArchiveFetchesTable;
+	usage_ledger: UsageLedgerTable;
 	waitlists: WaitlistsTable;
 	waitlist_signups: WaitlistSignupsTable;
 }
@@ -827,6 +827,27 @@ interface ArchiveFetchesTable {
 	via_allowance: Generated<boolean>;
 	charged_at: Generated<Date>;
 }
+/**
+* One metered ledger for every billable unit (archive partitions, hosted
+* Index/Streams rows, and future hosted-stack meters). Append-only, written
+* only by `meter()`. `idempotency_key` is UNIQUE so a retried submission
+* no-ops instead of double-charging. `debited` is false when the balance
+* (or a spend cap) refused the charge — the row still exists so the gap is
+* visible, never silently dropped. `usd_micros` is negative for a Stripe
+* top-up (`unit: "topup"`).
+*/
+interface UsageLedgerTable {
+	id: Generated<string>;
+	account_id: string;
+	unit: string;
+	quantity: string | number | bigint;
+	usd_micros: string | number | bigint;
+	debited: Generated<boolean>;
+	source: string;
+	idempotency_key: string;
+	occurred_at: Generated<Date>;
+	recorded_at: Generated<Date>;
+}
 type WebhookStatus = "active" | "paused" | "error";
 /** Polymorphic webhook mode: `subgraph` reacts to processed table rows;
 *  `chain` reacts to raw chain events matched directly off the Index/Streams
@@ -890,6 +911,10 @@ interface WebhookOutboxTable {
 	failed_at: Date | null;
 	locked_by: string | null;
 	locked_until: Date | null;
+	/** Set when a reorg marks an in-flight row `dead` instead of retrying it
+	*  into an orphaned fork. Null otherwise — delivery failures track their
+	*  history on `webhooks.last_error`, not per-row. */
+	last_error: string | null;
 	created_at: Generated<Date>;
 }
 interface WebhookDeliveriesTable {
@@ -1004,4 +1029,4 @@ declare function rotateWebhookSecret(db: Kysely<Database>, accountId: string, id
 declare function getWebhookSigningSecret(webhook: Webhook): string;
 /** Fire `webhooks:changed` notify so the emitter hot-reloads its cache. */
 declare function notifyWebhooksChanged(db: Kysely<Database>, accountId: string): Promise<void>;
-export { updateWebhook, toggleWebhookStatus, rotateWebhookSecret, notifyWebhooksChanged, listWebhooks, listActiveChainWebhooks, getWebhookSigningSecret, getWebhookByName, getWebhook, deleteWebhook, createWebhook, UpdateWebhookInput, RotateSecretResult, CreateWebhookResult, CreateWebhookInput };
+export { CreateWebhookInput, CreateWebhookResult, RotateSecretResult, UpdateWebhookInput, createWebhook, deleteWebhook, getWebhook, getWebhookByName, getWebhookSigningSecret, listActiveChainWebhooks, listWebhooks, notifyWebhooksChanged, rotateWebhookSecret, toggleWebhookStatus, updateWebhook };

package/dist/src/db/queries/webhooks.js

@@ -14,49 +14,17 @@ var __export = (target, all) => {
     });
 };
 
-// src/mode.ts
-var VALID_MODES = [
-  "oss",
-  "platform",
-  "archive"
-];
-function declaredMode() {
-  const raw = process.env.INSTANCE_MODE?.trim().toLowerCase();
-  if (raw && VALID_MODES.includes(raw)) {
-    return raw;
-  }
-  return "oss";
-}
-function getInstanceMode() {
-  const declared = declaredMode();
-  return declared === "archive" ? "platform" : declared;
-}
-function getDeclaredInstanceMode() {
-  return declaredMode();
-}
-function isMeteredReads() {
-  const override = process.env.METERED_READS?.trim().toLowerCase();
-  if (override === "true")
-    return true;
-  if (override === "false")
-    return false;
-  return getInstanceMode() === "platform";
-}
-function isPlatformMode() {
-  return getInstanceMode() === "platform";
-}
-function isOssMode() {
-  return getInstanceMode() === "oss";
-}
+// src/db/queries/webhooks.ts
+import { sql } from "kysely";
 
 // src/crypto/hmac.ts
 var exports_hmac = {};
 __export(exports_hmac, {
-  verifySignatureHeader: () => verifySignatureHeader,
-  verifySignature: () => verifySignature,
-  signPayload: () => signPayload,
+  createSignatureHeader: () => createSignatureHeader,
   generateSecret: () => generateSecret,
-  createSignatureHeader: () => createSignatureHeader
+  signPayload: () => signPayload,
+  verifySignature: () => verifySignature,
+  verifySignatureHeader: () => verifySignatureHeader
 });
 import { createHmac, randomBytes } from "node:crypto";
 function generateSecret() {
@@ -114,6 +82,43 @@ import {
   unlinkSync
 } from "node:fs";
 import { resolve } from "node:path";
+
+// src/mode.ts
+var VALID_MODES = [
+  "oss",
+  "platform",
+  "archive"
+];
+function declaredMode() {
+  const raw = process.env.INSTANCE_MODE?.trim().toLowerCase();
+  if (raw && VALID_MODES.includes(raw)) {
+    return raw;
+  }
+  return "oss";
+}
+function getInstanceMode() {
+  const declared = declaredMode();
+  return declared === "archive" ? "platform" : declared;
+}
+function getDeclaredInstanceMode() {
+  return declaredMode();
+}
+function isMeteredReads() {
+  const override = process.env.METERED_READS?.trim().toLowerCase();
+  if (override === "true")
+    return true;
+  if (override === "false")
+    return false;
+  return getInstanceMode() === "platform";
+}
+function isPlatformMode() {
+  return getInstanceMode() === "platform";
+}
+function isOssMode() {
+  return getInstanceMode() === "oss";
+}
+
+// src/crypto/secrets.ts
 var KEY_ENV = "SECONDLAYER_SECRETS_KEY";
 var IV_LEN = 12;
 var TAG_LEN = 16;
@@ -228,7 +233,6 @@ function generateSecretsKey() {
 }
 
 // src/db/queries/webhooks.ts
-import { sql } from "kysely";
 async function createWebhook(db, input) {
   const signingSecret = generateSecret();
   const kind = input.kind ?? "subgraph";
@@ -344,18 +348,18 @@ async function notifyWebhooksChanged(db, accountId) {
   await sql`SELECT pg_notify('webhooks:changed', ${accountId})`.execute(db);
 }
 export {
-  updateWebhook,
-  toggleWebhookStatus,
-  rotateWebhookSecret,
-  notifyWebhooksChanged,
-  listWebhooks,
-  listActiveChainWebhooks,
-  getWebhookSigningSecret,
-  getWebhookByName,
-  getWebhook,
+  createWebhook,
   deleteWebhook,
-  createWebhook
+  getWebhook,
+  getWebhookByName,
+  getWebhookSigningSecret,
+  listActiveChainWebhooks,
+  listWebhooks,
+  notifyWebhooksChanged,
+  rotateWebhookSecret,
+  toggleWebhookStatus,
+  updateWebhook
 };
 
-//# debugId=8CB695561D569ACB64756E2164756E21
+//# debugId=0300624A605962A764756E2164756E21
 //# sourceMappingURL=webhooks.js.map