@secondlayer/shared 6.41.1 → 6.41.3

package/dist/src/db/index.d.ts

@@ -137,6 +137,7 @@ interface SubgraphsTable {
 	/** (event type, contract) probe pairs persisted at deploy for weight classification. */
 	sparse_probe_targets: unknown | null;
 	database_url_enc: ColumnType<Buffer | null, Buffer | null | undefined, Buffer | null>;
+	sandbox_workers: Generated<boolean>;
 	created_at: Generated<Date>;
 	updated_at: Generated<Date>;
 }
@@ -752,6 +753,11 @@ interface X402PaymentsTable {
 	/** USD-micros to credit on confirmation, for deposit rows the reconciler
 	*  settles asynchronously. NULL for per-call settles (credit nothing). */
 	credit_usd_micros: string | null;
+	/** Idempotency key: stamped exactly once when this row's credit is applied.
+	*  NULL means never credited (or not a credit-bearing row). Pre-migration
+	*  non-pending deposit rows are backfilled to a non-null sentinel so the
+	*  reconciler's heal path can never double-credit them. */
+	credited_at: Generated<Date> | null;
 }
 type TenantStatus = "provisioning" | "active" | "limit_warning" | "paused_limit" | "suspended" | "error" | "deleted";
 interface TenantsTable {

package/dist/src/db/queries/chain-reorgs.d.ts

@@ -119,6 +119,7 @@ interface SubgraphsTable {
 	/** (event type, contract) probe pairs persisted at deploy for weight classification. */
 	sparse_probe_targets: unknown | null;
 	database_url_enc: ColumnType<Buffer | null, Buffer | null | undefined, Buffer | null>;
+	sandbox_workers: Generated<boolean>;
 	created_at: Generated<Date>;
 	updated_at: Generated<Date>;
 }
@@ -734,6 +735,11 @@ interface X402PaymentsTable {
 	/** USD-micros to credit on confirmation, for deposit rows the reconciler
 	*  settles asynchronously. NULL for per-call settles (credit nothing). */
 	credit_usd_micros: string | null;
+	/** Idempotency key: stamped exactly once when this row's credit is applied.
+	*  NULL means never credited (or not a credit-bearing row). Pre-migration
+	*  non-pending deposit rows are backfilled to a non-null sentinel so the
+	*  reconciler's heal path can never double-credit them. */
+	credited_at: Generated<Date> | null;
 }
 type TenantStatus = "provisioning" | "active" | "limit_warning" | "paused_limit" | "suspended" | "error" | "deleted";
 interface TenantsTable {

package/dist/src/db/queries/contracts.d.ts

@@ -119,6 +119,7 @@ interface SubgraphsTable {
 	/** (event type, contract) probe pairs persisted at deploy for weight classification. */
 	sparse_probe_targets: unknown | null;
 	database_url_enc: ColumnType<Buffer | null, Buffer | null | undefined, Buffer | null>;
+	sandbox_workers: Generated<boolean>;
 	created_at: Generated<Date>;
 	updated_at: Generated<Date>;
 }
@@ -734,6 +735,11 @@ interface X402PaymentsTable {
 	/** USD-micros to credit on confirmation, for deposit rows the reconciler
 	*  settles asynchronously. NULL for per-call settles (credit nothing). */
 	credit_usd_micros: string | null;
+	/** Idempotency key: stamped exactly once when this row's credit is applied.
+	*  NULL means never credited (or not a credit-bearing row). Pre-migration
+	*  non-pending deposit rows are backfilled to a non-null sentinel so the
+	*  reconciler's heal path can never double-credit them. */
+	credited_at: Generated<Date> | null;
 }
 type TenantStatus = "provisioning" | "active" | "limit_warning" | "paused_limit" | "suspended" | "error" | "deleted";
 interface TenantsTable {

package/dist/src/db/queries/integrity.d.ts

@@ -119,6 +119,7 @@ interface SubgraphsTable {
 	/** (event type, contract) probe pairs persisted at deploy for weight classification. */
 	sparse_probe_targets: unknown | null;
 	database_url_enc: ColumnType<Buffer | null, Buffer | null | undefined, Buffer | null>;
+	sandbox_workers: Generated<boolean>;
 	created_at: Generated<Date>;
 	updated_at: Generated<Date>;
 }
@@ -734,6 +735,11 @@ interface X402PaymentsTable {
 	/** USD-micros to credit on confirmation, for deposit rows the reconciler
 	*  settles asynchronously. NULL for per-call settles (credit nothing). */
 	credit_usd_micros: string | null;
+	/** Idempotency key: stamped exactly once when this row's credit is applied.
+	*  NULL means never credited (or not a credit-bearing row). Pre-migration
+	*  non-pending deposit rows are backfilled to a non-null sentinel so the
+	*  reconciler's heal path can never double-credit them. */
+	credited_at: Generated<Date> | null;
 }
 type TenantStatus = "provisioning" | "active" | "limit_warning" | "paused_limit" | "suspended" | "error" | "deleted";
 interface TenantsTable {

package/dist/src/db/queries/subgraph-gaps.d.ts

@@ -119,6 +119,7 @@ interface SubgraphsTable {
 	/** (event type, contract) probe pairs persisted at deploy for weight classification. */
 	sparse_probe_targets: unknown | null;
 	database_url_enc: ColumnType<Buffer | null, Buffer | null | undefined, Buffer | null>;
+	sandbox_workers: Generated<boolean>;
 	created_at: Generated<Date>;
 	updated_at: Generated<Date>;
 }
@@ -734,6 +735,11 @@ interface X402PaymentsTable {
 	/** USD-micros to credit on confirmation, for deposit rows the reconciler
 	*  settles asynchronously. NULL for per-call settles (credit nothing). */
 	credit_usd_micros: string | null;
+	/** Idempotency key: stamped exactly once when this row's credit is applied.
+	*  NULL means never credited (or not a credit-bearing row). Pre-migration
+	*  non-pending deposit rows are backfilled to a non-null sentinel so the
+	*  reconciler's heal path can never double-credit them. */
+	credited_at: Generated<Date> | null;
 }
 type TenantStatus = "provisioning" | "active" | "limit_warning" | "paused_limit" | "suspended" | "error" | "deleted";
 interface TenantsTable {

package/dist/src/db/queries/subgraph-operations.d.ts

@@ -119,6 +119,7 @@ interface SubgraphsTable {
 	/** (event type, contract) probe pairs persisted at deploy for weight classification. */
 	sparse_probe_targets: unknown | null;
 	database_url_enc: ColumnType<Buffer | null, Buffer | null | undefined, Buffer | null>;
+	sandbox_workers: Generated<boolean>;
 	created_at: Generated<Date>;
 	updated_at: Generated<Date>;
 }
@@ -734,6 +735,11 @@ interface X402PaymentsTable {
 	/** USD-micros to credit on confirmation, for deposit rows the reconciler
 	*  settles asynchronously. NULL for per-call settles (credit nothing). */
 	credit_usd_micros: string | null;
+	/** Idempotency key: stamped exactly once when this row's credit is applied.
+	*  NULL means never credited (or not a credit-bearing row). Pre-migration
+	*  non-pending deposit rows are backfilled to a non-null sentinel so the
+	*  reconciler's heal path can never double-credit them. */
+	credited_at: Generated<Date> | null;
 }
 type TenantStatus = "provisioning" | "active" | "limit_warning" | "paused_limit" | "suspended" | "error" | "deleted";
 interface TenantsTable {

package/dist/src/db/queries/subgraphs.d.ts

@@ -120,6 +120,7 @@ interface SubgraphsTable {
 	/** (event type, contract) probe pairs persisted at deploy for weight classification. */
 	sparse_probe_targets: unknown | null;
 	database_url_enc: ColumnType<Buffer | null, Buffer | null | undefined, Buffer | null>;
+	sandbox_workers: Generated<boolean>;
 	created_at: Generated<Date>;
 	updated_at: Generated<Date>;
 }
@@ -735,6 +736,11 @@ interface X402PaymentsTable {
 	/** USD-micros to credit on confirmation, for deposit rows the reconciler
 	*  settles asynchronously. NULL for per-call settles (credit nothing). */
 	credit_usd_micros: string | null;
+	/** Idempotency key: stamped exactly once when this row's credit is applied.
+	*  NULL means never credited (or not a credit-bearing row). Pre-migration
+	*  non-pending deposit rows are backfilled to a non-null sentinel so the
+	*  reconciler's heal path can never double-credit them. */
+	credited_at: Generated<Date> | null;
 }
 type TenantStatus = "provisioning" | "active" | "limit_warning" | "paused_limit" | "suspended" | "error" | "deleted";
 interface TenantsTable {

package/dist/src/db/queries/subscriptions.d.ts

@@ -119,6 +119,7 @@ interface SubgraphsTable {
 	/** (event type, contract) probe pairs persisted at deploy for weight classification. */
 	sparse_probe_targets: unknown | null;
 	database_url_enc: ColumnType<Buffer | null, Buffer | null | undefined, Buffer | null>;
+	sandbox_workers: Generated<boolean>;
 	created_at: Generated<Date>;
 	updated_at: Generated<Date>;
 }
@@ -734,6 +735,11 @@ interface X402PaymentsTable {
 	/** USD-micros to credit on confirmation, for deposit rows the reconciler
 	*  settles asynchronously. NULL for per-call settles (credit nothing). */
 	credit_usd_micros: string | null;
+	/** Idempotency key: stamped exactly once when this row's credit is applied.
+	*  NULL means never credited (or not a credit-bearing row). Pre-migration
+	*  non-pending deposit rows are backfilled to a non-null sentinel so the
+	*  reconciler's heal path can never double-credit them. */
+	credited_at: Generated<Date> | null;
 }
 type TenantStatus = "provisioning" | "active" | "limit_warning" | "paused_limit" | "suspended" | "error" | "deleted";
 interface TenantsTable {

package/dist/src/db/schema.d.ts

@@ -118,6 +118,7 @@ interface SubgraphsTable {
 	/** (event type, contract) probe pairs persisted at deploy for weight classification. */
 	sparse_probe_targets: unknown | null;
 	database_url_enc: ColumnType<Buffer | null, Buffer | null | undefined, Buffer | null>;
+	sandbox_workers: Generated<boolean>;
 	created_at: Generated<Date>;
 	updated_at: Generated<Date>;
 }
@@ -733,6 +734,11 @@ interface X402PaymentsTable {
 	/** USD-micros to credit on confirmation, for deposit rows the reconciler
 	*  settles asynchronously. NULL for per-call settles (credit nothing). */
 	credit_usd_micros: string | null;
+	/** Idempotency key: stamped exactly once when this row's credit is applied.
+	*  NULL means never credited (or not a credit-bearing row). Pre-migration
+	*  non-pending deposit rows are backfilled to a non-null sentinel so the
+	*  reconciler's heal path can never double-credit them. */
+	credited_at: Generated<Date> | null;
 }
 type TenantStatus = "provisioning" | "active" | "limit_warning" | "paused_limit" | "suspended" | "error" | "deleted";
 interface TenantsTable {

package/dist/src/index.d.ts

@@ -118,6 +118,7 @@ interface SubgraphsTable {
 	/** (event type, contract) probe pairs persisted at deploy for weight classification. */
 	sparse_probe_targets: unknown | null;
 	database_url_enc: ColumnType<Buffer | null, Buffer | null | undefined, Buffer | null>;
+	sandbox_workers: Generated<boolean>;
 	created_at: Generated<Date>;
 	updated_at: Generated<Date>;
 }
@@ -733,6 +734,11 @@ interface X402PaymentsTable {
 	/** USD-micros to credit on confirmation, for deposit rows the reconciler
 	*  settles asynchronously. NULL for per-call settles (credit nothing). */
 	credit_usd_micros: string | null;
+	/** Idempotency key: stamped exactly once when this row's credit is applied.
+	*  NULL means never credited (or not a credit-bearing row). Pre-migration
+	*  non-pending deposit rows are backfilled to a non-null sentinel so the
+	*  reconciler's heal path can never double-credit them. */
+	credited_at: Generated<Date> | null;
 }
 type TenantStatus = "provisioning" | "active" | "limit_warning" | "paused_limit" | "suspended" | "error" | "deleted";
 interface TenantsTable {

package/dist/src/node/local-client.d.ts

@@ -119,6 +119,7 @@ interface SubgraphsTable {
 	/** (event type, contract) probe pairs persisted at deploy for weight classification. */
 	sparse_probe_targets: unknown | null;
 	database_url_enc: ColumnType<Buffer | null, Buffer | null | undefined, Buffer | null>;
+	sandbox_workers: Generated<boolean>;
 	created_at: Generated<Date>;
 	updated_at: Generated<Date>;
 }
@@ -734,6 +735,11 @@ interface X402PaymentsTable {
 	/** USD-micros to credit on confirmation, for deposit rows the reconciler
 	*  settles asynchronously. NULL for per-call settles (credit nothing). */
 	credit_usd_micros: string | null;
+	/** Idempotency key: stamped exactly once when this row's credit is applied.
+	*  NULL means never credited (or not a credit-bearing row). Pre-migration
+	*  non-pending deposit rows are backfilled to a non-null sentinel so the
+	*  reconciler's heal path can never double-credit them. */
+	credited_at: Generated<Date> | null;
 }
 type TenantStatus = "provisioning" | "active" | "limit_warning" | "paused_limit" | "suspended" | "error" | "deleted";
 interface TenantsTable {

package/migrations/0108_x402_payments_credited_at.ts

@@ -0,0 +1,41 @@
+import { type Kysely, sql } from "kysely";
+import { onControlPlane } from "../src/db/migration-role.ts";
+
+// `credited_at` is the idempotency key for deposit crediting: stamped exactly
+// once, whenever a deposit's balance credit is applied. Only a row where it's
+// NULL is eligible for the reconciler's heal path (f069).
+//
+// THE TRAP: right after ADD COLUMN, every existing row (including historical
+// `confirmed` deposits the old route-handler path already credited) has
+// credited_at = NULL. If the reconciler treated NULL as "never credited" for
+// those rows, it would DOUBLE-CREDIT every already-credited historical
+// deposit. So we backfill all pre-existing non-pending deposit rows to a
+// non-null sentinel (`updated_at`) — their true credit state is unknowable
+// from ledger data alone, so healing must never touch them. `pending` rows
+// stay NULL (not yet credited, still eligible once they confirm) and
+// non-deposit rows stay NULL (they never carry a credit). Only rows created
+// AFTER this migration are ever heal-eligible. Back-crediting truly-stranded
+// historical rows is a separate founder payout decision, OUT OF SCOPE here.
+export async function up(db: Kysely<unknown>): Promise<void> {
+	await sql`SET lock_timeout = '30s'`.execute(db);
+	await onControlPlane(async () => {
+		await sql`
+			ALTER TABLE x402_payments
+				ADD COLUMN IF NOT EXISTS credited_at TIMESTAMPTZ
+		`.execute(db);
+		await sql`
+			UPDATE x402_payments
+				SET credited_at = updated_at
+				WHERE kind = 'deposit' AND state <> 'pending' AND credited_at IS NULL
+		`.execute(db);
+	});
+}
+
+export async function down(db: Kysely<unknown>): Promise<void> {
+	await onControlPlane(async () => {
+		await sql`
+			ALTER TABLE x402_payments
+				DROP COLUMN IF EXISTS credited_at
+		`.execute(db);
+	});
+}

package/migrations/0109_subgraphs_sandbox_workers.ts

@@ -0,0 +1,28 @@
+import { type Kysely, sql } from "kysely";
+import { onControlPlane } from "../src/db/migration-role.ts";
+
+// f071 Stage 2a: per-subgraph opt-in for the sandboxed (Bun Worker) handler
+// execution path. Default FALSE everywhere — the global env flag
+// (SUBGRAPH_SANDBOX_WORKERS) is the capability switch, this column is the
+// per-tenant rollout switch; both must be true for a subgraph to route
+// through the worker path (see runtime/sandbox/flag.ts). No subgraph is
+// opted in by this migration — that's a later, separate cutover decision
+// (Stage 2c). Control-plane (TARGET) — the subgraphs control-plane table.
+export async function up(db: Kysely<unknown>): Promise<void> {
+	await sql`SET lock_timeout = '30s'`.execute(db);
+	await onControlPlane(async () => {
+		await sql`
+			ALTER TABLE subgraphs
+				ADD COLUMN IF NOT EXISTS sandbox_workers BOOLEAN NOT NULL DEFAULT FALSE
+		`.execute(db);
+	});
+}
+
+export async function down(db: Kysely<unknown>): Promise<void> {
+	await onControlPlane(async () => {
+		await sql`
+			ALTER TABLE subgraphs
+				DROP COLUMN IF EXISTS sandbox_workers
+		`.execute(db);
+	});
+}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@secondlayer/shared",
-	"version": "6.41.1",
+	"version": "6.41.3",
 	"license": "MIT",
 	"repository": {
 		"type": "git",
@@ -167,7 +167,7 @@
 		"prepublishOnly": "bun run build"
 	},
 	"dependencies": {
-		"@secondlayer/stacks": "^2.10.0",
+		"@secondlayer/stacks": "^2.11.0",
 		"kysely": "0.28.15",
 		"kysely-postgres-js": "3.0.0",
 		"postgres": "^3.4.6",