tapimo 0.14.0 → 0.15.0

package/dist/db/tables/routesIdempotency.d.ts

@@ -0,0 +1,166 @@
+import type { Selectable } from 'kysely';
+import type * as Db from '../Db.js';
+import type * as db_Schema from '../Schema.js';
+/** Columns of the `routes_idempotency_requests` table. */
+export type Table = db_Schema.RoutesIdempotencyRequest;
+/** A stored idempotency claim. */
+export type Record = Selectable<Table>;
+/** Route creation operations sharing the idempotency table. */
+export declare const operations: {
+    readonly depositAddress: 'deposit_address';
+    readonly transfer: 'transfer';
+};
+/** Route creation operation owning an idempotency claim. */
+export type Operation = (typeof operations)[keyof typeof operations];
+/**
+ * Claims `(apiKeyId, keyHash)` for one creation attempt. A live claim rejects
+ * mismatches, blocks pending work, resumes checkpoints, or replays completion.
+ * Deposit checkpoints are shared across rotated keys for the same scoped request.
+ */
+export declare function claim(db: Db.Db, input: claim.Input): Promise<claim.Result>;
+export declare namespace claim {
+    /** Claim identity and retention. */
+    type Input = {
+        /** API key id (`key_…`) the claim is scoped to. */
+        apiKeyId: string;
+        /** Older fingerprints accepted only when reading an existing claim. */
+        compatibleRequestHashes?: readonly string[] | undefined;
+        /** Whether provider success creates liability that must not expire. */
+        irrevocable: boolean;
+        /** SHA-256 of the caller Idempotency-Key. */
+        keyHash: string;
+        /** Route creation operation owning the claim. */
+        operation: Operation;
+        /** Organization owning the route creation. */
+        orgId: string;
+        /** Whether an adopted provider checkpoint carries irrevocable liability. */
+        recoveredIrrevocable?: boolean | undefined;
+        /** SHA-256 fingerprint of the canonical validated request. */
+        requestHash: string;
+        /** Lease duration for the pending execution, in milliseconds. */
+        ttlMs: number;
+    };
+    /** Outcome of a claim attempt. */
+    type Result = {
+        createdAt: string;
+        type: 'claimed';
+    } | {
+        type: 'mismatch';
+    } | {
+        type: 'pending';
+    } | {
+        response: string;
+        type: 'replay';
+    } | {
+        /** Whether the checkpoint still carries current quote terms. */
+        checkpointFresh: boolean;
+        createdAt: string;
+        recoveredClaim?: release.Input | undefined;
+        response: string;
+        type: 'resume';
+    };
+}
+/** Returns whether the database rejected a claim for a deleted owner. */
+export declare function isOwnerFenceError(cause: unknown): boolean;
+/** Marks an owned live claim as potentially creating irrevocable provider liability. */
+export declare function markProviderAttempt(db: Db.Db, input: markProviderAttempt.Input): Promise<boolean>;
+export declare namespace markProviderAttempt {
+    /** Owned pending claim and renewed liability lease. */
+    type Input = release.Input & {
+        /** Renewed pending lease duration, in milliseconds. */
+        ttlMs: number;
+    };
+}
+/** Counts pending or provisioned deposit-address claims for an organization creator. */
+export declare function countInFlightDepositAddresses(db: Db.Db, owner: countInFlightDepositAddresses.Owner): Promise<number>;
+export declare namespace countInFlightDepositAddresses {
+    /** Canonical creator scope, with organization fallback for unowned rows. */
+    type Owner = {
+        /** Organization id (`org_…`). */
+        orgId: string;
+        /** Canonical creator id (`usr_…`). */
+        userId: string | null;
+    };
+}
+/** Reserves one canonical reusable match across idempotency keys. */
+export declare function reserveDepositAddressMatch(db: Db.Db, input: reserveDepositAddressMatch.Input): Promise<reserveDepositAddressMatch.Result>;
+export declare namespace reserveDepositAddressMatch {
+    /** Claim and canonical match identity. */
+    type Input = release.Input & {
+        /** SHA-256 fingerprint of the canonical reusable match. */
+        matchHash: string;
+        /** Organization owning the reusable match. */
+        orgId: string;
+        /** Renewed pending lease duration, in milliseconds. */
+        ttlMs: number;
+    };
+    /** Match reservation, recovery, or ownership outcome. */
+    type Result = {
+        type: 'lost';
+    } | {
+        type: 'pending';
+    } | {
+        type: 'provisioned';
+    } | {
+        type: 'reserved';
+    } | {
+        checkpointFresh: boolean;
+        claim: release.Input;
+        response: string;
+        type: 'resume';
+    };
+}
+/** Returns whether provider provisioning may still create an address for an organization. */
+export declare function hasInFlightDepositAddress(db: Db.Db, orgId: string): Promise<boolean>;
+/** Returns whether a rolling deployment left route work without attributable ownership. */
+export declare function hasUnattributedInFlightClaim(db: Db.Db): Promise<boolean>;
+/** Stores a provider result before committing its API resource and replay response. */
+export declare function checkpoint(db: Db.Db, input: checkpoint.Input): Promise<Record | undefined>;
+export declare namespace checkpoint {
+    /** Provider result and owned claim required for durable recovery. */
+    type Input = {
+        /** API key id (`key_…`) the claim is scoped to. */
+        apiKeyId: string;
+        /** Creation time returned by the successful claim. */
+        createdAt: string;
+        /** SHA-256 of the caller Idempotency-Key. */
+        keyHash: string;
+        /** Recovery checkpoint retention in milliseconds. */
+        replayTtlMs: number;
+        /** Serialized provider result required to resume resource creation. */
+        response: string;
+    };
+}
+/** Completes an owned pending or provisioned claim with its replay response. */
+export declare function complete(db: Db.Db, input: complete.Input): Promise<Record | undefined>;
+export declare namespace complete {
+    /** Completion fields. */
+    type Input = {
+        /** API key id (`key_…`) the claim is scoped to. */
+        apiKeyId: string;
+        /** Creation time returned by the successful claim. */
+        createdAt: string;
+        /** SHA-256 of the caller Idempotency-Key. */
+        keyHash: string;
+        /** Successful-response replay retention from completion, in milliseconds. */
+        replayTtlMs: number;
+        /** Serialized success response replayed for the retention window. */
+        response: string;
+        /** Transfer id (`rtr_…`) when the request created a route transfer. */
+        transferId?: string | undefined;
+    };
+}
+/** Releases a pending claim after a retryable failure. */
+export declare function release(db: Db.Db, input: release.Input): Promise<void>;
+export declare namespace release {
+    /** Pending claim identity. */
+    type Input = {
+        /** API key id (`key_…`) the claim is scoped to. */
+        apiKeyId: string;
+        /** Creation time returned by the successful claim. */
+        createdAt: string;
+        /** SHA-256 of the caller Idempotency-Key. */
+        keyHash: string;
+    };
+}
+//# sourceMappingURL=routesIdempotency.d.ts.map

package/dist/db/tables/routesIdempotency.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routesIdempotency.d.ts","sourceRoot":"","sources":["../../../src/db/tables/routesIdempotency.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAqB,UAAU,EAAE,MAAM,QAAQ,CAAA;AAG3D,OAAO,KAAK,KAAK,EAAE,MAAM,UAAU,CAAA;AACnC,OAAO,KAAK,KAAK,SAAS,MAAM,cAAc,CAAA;AAE9C,0DAA0D;AAC1D,MAAM,MAAM,KAAK,GAAG,SAAS,CAAC,wBAAwB,CAAA;AACtD,kCAAkC;AAClC,MAAM,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,CAAA;AAEtC,+DAA+D;AAC/D,eAAO,MAAM,UAAU;aACrB,cAAc,EAAE,iBAAiB;aACjC,QAAQ,EAAE,UAAU;CACZ,CAAA;AAEV,4DAA4D;AAC5D,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,OAAO,UAAU,CAAC,CAAA;AAEpE;;;;GAIG;AACH,wBAAsB,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAkIhF;AAED,MAAM,CAAC,OAAO,WAAW,KAAK,CAAC;IAC7B,oCAAoC;IACpC,KAAK,KAAK,GAAG;QACX,mDAAmD;QACnD,QAAQ,EAAE,MAAM,CAAA;QAChB,uEAAuE;QACvE,uBAAuB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAA;QACvD,uEAAuE;QACvE,WAAW,EAAE,OAAO,CAAA;QACpB,6CAA6C;QAC7C,OAAO,EAAE,MAAM,CAAA;QACf,iDAAiD;QACjD,SAAS,EAAE,SAAS,CAAA;QACpB,8CAA8C;QAC9C,KAAK,EAAE,MAAM,CAAA;QACb,4EAA4E;QAC5E,oBAAoB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;QAC1C,8DAA8D;QAC9D,WAAW,EAAE,MAAM,CAAA;QACnB,iEAAiE;QACjE,KAAK,EAAE,MAAM,CAAA;KACd,CAAA;IAED,kCAAkC;IAClC,KAAK,MAAM,GACP;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,SAAS,CAAA;KAAE,GACtC;QAAE,IAAI,EAAE,UAAU,CAAA;KAAE,GACpB;QAAE,IAAI,EAAE,SAAS,CAAA;KAAE,GACnB;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,QAAQ,CAAA;KAAE,GACpC;QACE,gEAAgE;QAChE,eAAe,EAAE,OAAO,CAAA;QACxB,SAAS,EAAE,MAAM,CAAA;QACjB,cAAc,CAAC,EAAE,OAAO,CAAC,KAAK,GAAG,SAAS,CAAA;QAC1C,QAAQ,EAAE,MAAM,CAAA;QAChB,IAAI,EAAE,QAAQ,CAAA;KACf,CAAA;CACN;AAED,yEAAyE;AACzE,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CASzD;AAED,wFAAwF;AACxF,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,EAAE,CAAC,EAAE,EACT,KAAK,EAAE,mBAAmB,CAAC,KAAK,GAC/B,OAAO,CAAC,OAAO,CAAC,CAiBlB;AAED,MAAM,CAAC,OAAO,WAAW,mBAAmB,CAAC;IAC3C,uDAAuD;IACvD,KAAK,KAAK,GAAG,OAAO,CAAC,KAAK,GAAG;QAC3B,uDAAuD;QACvD,KAAK,EAAE,MAAM,CAAA;KACd,CAAA;CACF;AAED,wFAAwF;AACxF,wBAAsB,6BAA6B,CACjD,EAAE,EAAE,EAAE,CAAC,EAAE,EACT,KAAK,EAAE,6BAA6B,CAAC,KAAK,GACzC,OAAO,CAAC,MAAM,CAAC,CAejB;AAED,MAAM,CAAC,OAAO,WAAW,6BAA6B,CAAC;IACrD,4EAA4E;IAC5E,KAAK,KAAK,GAAG;QACX,iCAAiC;QACjC,KAAK,EAAE,MAAM,CAAA;QACb,sCAAsC;QACtC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;KACtB,CAAA;CACF;AAED,qEAAqE;AACrE,wBAAsB,0BAA0B,CAC9C,EAAE,EAAE,EAAE,CAAC,EAAE,EACT,KAAK,EAAE,0BAA0B,CAAC,KAAK,GACtC,OAAO,CAAC,0BAA0B,CAAC,MAAM,CAAC,CAqE5C;AAED,MAAM,CAAC,OAAO,WAAW,0BAA0B,CAAC;IAClD,0CAA0C;IAC1C,KAAK,KAAK,GAAG,OAAO,CAAC,KAAK,GAAG;QAC3B,2DAA2D;QAC3D,SAAS,EAAE,MAAM,CAAA;QACjB,8CAA8C;QAC9C,KAAK,EAAE,MAAM,CAAA;QACb,uDAAuD;QACvD,KAAK,EAAE,MAAM,CAAA;KACd,CAAA;IAED,yDAAyD;IACzD,KAAK,MAAM,GACP;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,GAChB;QAAE,IAAI,EAAE,SAAS,CAAA;KAAE,GACnB;QAAE,IAAI,EAAE,aAAa,CAAA;KAAE,GACvB;QAAE,IAAI,EAAE,UAAU,CAAA;KAAE,GACpB;QAAE,eAAe,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,QAAQ,CAAA;KAAE,CAAA;CACzF;AAED,6FAA6F;AAC7F,wBAAsB,yBAAyB,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAY1F;AAED,2FAA2F;AAC3F,wBAAsB,4BAA4B,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAY9E;AAED,uFAAuF;AACvF,wBAAgB,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAe1F;AAED,MAAM,CAAC,OAAO,WAAW,UAAU,CAAC;IAClC,qEAAqE;IACrE,KAAK,KAAK,GAAG;QACX,mDAAmD;QACnD,QAAQ,EAAE,MAAM,CAAA;QAChB,sDAAsD;QACtD,SAAS,EAAE,MAAM,CAAA;QACjB,6CAA6C;QAC7C,OAAO,EAAE,MAAM,CAAA;QACf,qDAAqD;QACrD,WAAW,EAAE,MAAM,CAAA;QACnB,uEAAuE;QACvE,QAAQ,EAAE,MAAM,CAAA;KACjB,CAAA;CACF;AAED,gFAAgF;AAChF,wBAAgB,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAiBtF;AAED,MAAM,CAAC,OAAO,WAAW,QAAQ,CAAC;IAChC,yBAAyB;IACzB,KAAK,KAAK,GAAG;QACX,mDAAmD;QACnD,QAAQ,EAAE,MAAM,CAAA;QAChB,sDAAsD;QACtD,SAAS,EAAE,MAAM,CAAA;QACjB,6CAA6C;QAC7C,OAAO,EAAE,MAAM,CAAA;QACf,6EAA6E;QAC7E,WAAW,EAAE,MAAM,CAAA;QACnB,qEAAqE;QACrE,QAAQ,EAAE,MAAM,CAAA;QAChB,uEAAuE;QACvE,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAChC,CAAA;CACF;AAED,0DAA0D;AAC1D,wBAAsB,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAQ5E;AAED,MAAM,CAAC,OAAO,WAAW,OAAO,CAAC;IAC/B,8BAA8B;IAC9B,KAAK,KAAK,GAAG;QACX,mDAAmD;QACnD,QAAQ,EAAE,MAAM,CAAA;QAChB,sDAAsD;QACtD,SAAS,EAAE,MAAM,CAAA;QACjB,6CAA6C;QAC7C,OAAO,EAAE,MAAM,CAAA;KAChB,CAAA;CACF"}

package/dist/db/tables/routesIdempotency.js

@@ -0,0 +1,330 @@
+import * as pg from 'pg';
+/** Route creation operations sharing the idempotency table. */
+export const operations = {
+    depositAddress: 'deposit_address',
+    transfer: 'transfer',
+};
+/**
+ * Claims `(apiKeyId, keyHash)` for one creation attempt. A live claim rejects
+ * mismatches, blocks pending work, resumes checkpoints, or replays completion.
+ * Deposit checkpoints are shared across rotated keys for the same scoped request.
+ */
+export async function claim(db, input) {
+    const now = new Date();
+    const requestHashes = [input.requestHash, ...(input.compatibleRequestHashes ?? [])];
+    const record = {
+        apiKeyId: input.apiKeyId,
+        createdAt: now.toISOString(),
+        expiresAt: new Date(now.getTime() + input.ttlMs).toISOString(),
+        irrevocable: input.irrevocable,
+        keyHash: input.keyHash,
+        matchHash: null,
+        operation: input.operation,
+        orgId: input.orgId,
+        requestHash: input.requestHash,
+        response: null,
+        status: 'pending',
+        transferId: null,
+    };
+    const inserted = await db.kysely
+        .insertInto('routes_idempotency_requests')
+        .values(record)
+        .onConflict((oc) => oc.columns(['apiKeyId', 'keyHash']).doNothing())
+        .returningAll()
+        .executeTakeFirst();
+    if (inserted) {
+        if (input.operation !== operations.depositAddress)
+            return { createdAt: inserted.createdAt, type: 'claimed' };
+        // Expired unsubsidized checkpoints stop sharing; irrevocable subsidized results remain recoverable after key rotation.
+        const recoverable = await db.kysely
+            .selectFrom('routes_idempotency_requests')
+            .selectAll()
+            .where((eb) => eb.or([eb('apiKeyId', '!=', inserted.apiKeyId), eb('keyHash', '!=', inserted.keyHash)]))
+            .where((eb) => eb.or([
+            eb.and([eb('operation', '=', operations.depositAddress), eb('orgId', '=', input.orgId)]),
+            eb.and([
+                eb('apiKeyId', '=', input.apiKeyId),
+                eb('operation', 'is', null),
+                eb('orgId', 'is', null),
+            ]),
+        ]))
+            .where('requestHash', 'in', requestHashes)
+            .where('status', '=', 'provisioned')
+            .where((eb) => eb.or([eb('expiresAt', '>', now.toISOString()), eb('irrevocable', '=', true)]))
+            .orderBy('createdAt', 'asc')
+            .forUpdate()
+            .executeTakeFirst();
+        if (!recoverable)
+            return { createdAt: inserted.createdAt, type: 'claimed' };
+        await db.kysely
+            .updateTable('routes_idempotency_requests')
+            .set({
+            irrevocable: recoverable.irrevocable || input.recoveredIrrevocable === true,
+            operation: input.operation,
+            orgId: input.orgId,
+            requestHash: input.requestHash,
+        })
+            .where('apiKeyId', '=', recoverable.apiKeyId)
+            .where('createdAt', '=', recoverable.createdAt)
+            .where('keyHash', '=', recoverable.keyHash)
+            .where('status', '=', 'provisioned')
+            .execute();
+        return {
+            checkpointFresh: recoverable.expiresAt > now.toISOString(),
+            createdAt: inserted.createdAt,
+            recoveredClaim: {
+                apiKeyId: recoverable.apiKeyId,
+                createdAt: recoverable.createdAt,
+                keyHash: recoverable.keyHash,
+            },
+            response: recoverable.response ?? '',
+            type: 'resume',
+        };
+    }
+    // Reclaim an expired row in place; the guard keeps two callers from both
+    // reclaiming (only one UPDATE matches the still-expired predicate).
+    const reclaimed = await db.kysely
+        .updateTable('routes_idempotency_requests')
+        .set(record)
+        .where('apiKeyId', '=', input.apiKeyId)
+        .where('keyHash', '=', input.keyHash)
+        .where('expiresAt', '<=', now.toISOString())
+        .where('irrevocable', '=', false)
+        .where('status', '!=', 'provisioned')
+        .returningAll()
+        .executeTakeFirst();
+    if (reclaimed)
+        return { createdAt: reclaimed.createdAt, type: 'claimed' };
+    const existing = await db.kysely
+        .selectFrom('routes_idempotency_requests')
+        .selectAll()
+        .where('apiKeyId', '=', input.apiKeyId)
+        .where('keyHash', '=', input.keyHash)
+        .executeTakeFirst();
+    // The row vanished between the insert and the read (released claim); retry.
+    if (!existing)
+        return claim(db, input);
+    if (!requestHashes.includes(existing.requestHash))
+        return { type: 'mismatch' };
+    if (existing.orgId !== null && existing.orgId !== input.orgId)
+        return { type: 'mismatch' };
+    if (existing.operation !== null && existing.operation !== input.operation)
+        return { type: 'mismatch' };
+    // Claims created before organization reservations existed adopt ownership when retried.
+    if (existing.orgId === null || existing.operation === null) {
+        const adopted = await db.kysely
+            .updateTable('routes_idempotency_requests')
+            .set({
+            irrevocable: existing.irrevocable ||
+                (existing.status === 'provisioned' && input.recoveredIrrevocable === true),
+            operation: input.operation,
+            orgId: input.orgId,
+            requestHash: input.requestHash,
+        })
+            .where('apiKeyId', '=', input.apiKeyId)
+            .where('keyHash', '=', input.keyHash)
+            .where((eb) => eb.or([eb('operation', 'is', null), eb('orgId', 'is', null)]))
+            .returning('apiKeyId')
+            .executeTakeFirst();
+        if (!adopted)
+            return claim(db, input);
+    }
+    if (existing.status === 'pending')
+        return { type: 'pending' };
+    if (existing.status === 'provisioned')
+        return {
+            checkpointFresh: existing.expiresAt > now.toISOString(),
+            createdAt: existing.createdAt,
+            response: existing.response ?? '',
+            type: 'resume',
+        };
+    return { response: existing.response ?? '', type: 'replay' };
+}
+/** Returns whether the database rejected a claim for a deleted owner. */
+export function isOwnerFenceError(cause) {
+    return (cause instanceof pg.DatabaseError &&
+        cause.code === '23503' &&
+        [
+            'ownerless route idempotency creation is disabled',
+            'route idempotency owner was deleted',
+        ].includes(cause.message));
+}
+/** Marks an owned live claim as potentially creating irrevocable provider liability. */
+export async function markProviderAttempt(db, input) {
+    const now = new Date();
+    return Boolean(await db.kysely
+        .updateTable('routes_idempotency_requests')
+        .set({
+        expiresAt: new Date(now.getTime() + input.ttlMs).toISOString(),
+        irrevocable: true,
+    })
+        .where('apiKeyId', '=', input.apiKeyId)
+        .where('createdAt', '=', input.createdAt)
+        .where('expiresAt', '>', now.toISOString())
+        .where('keyHash', '=', input.keyHash)
+        .where('status', '=', 'pending')
+        .returning('apiKeyId')
+        .executeTakeFirst());
+}
+/** Counts pending or provisioned deposit-address claims for an organization creator. */
+export async function countInFlightDepositAddresses(db, owner) {
+    const now = new Date().toISOString();
+    let query = db.kysely
+        .selectFrom('routes_idempotency_requests')
+        .select(({ fn }) => fn.countAll().as('count'))
+        .where((eb) => inFlight(eb, now))
+        .where('operation', '=', operations.depositAddress);
+    const userId = owner.userId;
+    query = userId
+        ? query.where('orgId', 'in', (eb) => eb.selectFrom('organizations').select('id').where('userId', '=', userId))
+        : query.where('orgId', '=', owner.orgId);
+    const result = await query.executeTakeFirstOrThrow();
+    return Number(result.count);
+}
+/** Reserves one canonical reusable match across idempotency keys. */
+export async function reserveDepositAddressMatch(db, input) {
+    const now = new Date();
+    const pending = await db.kysely
+        .updateTable('routes_idempotency_requests')
+        .set({
+        expiresAt: new Date(now.getTime() + input.ttlMs).toISOString(),
+        matchHash: input.matchHash,
+    })
+        .where('apiKeyId', '=', input.apiKeyId)
+        .where('createdAt', '=', input.createdAt)
+        .where('keyHash', '=', input.keyHash)
+        .where('expiresAt', '>', now.toISOString())
+        .where('status', '=', 'pending')
+        .returningAll()
+        .executeTakeFirst();
+    const claimed = pending ??
+        (await db.kysely
+            .updateTable('routes_idempotency_requests')
+            .set({ matchHash: input.matchHash })
+            .where('apiKeyId', '=', input.apiKeyId)
+            .where('createdAt', '=', input.createdAt)
+            .where('keyHash', '=', input.keyHash)
+            .where('status', '=', 'provisioned')
+            .returningAll()
+            .executeTakeFirst());
+    if (!claimed)
+        return { type: 'lost' };
+    const provisioned = await db.kysely
+        .selectFrom('routes_idempotency_requests')
+        .selectAll()
+        .where((eb) => eb.or([eb('apiKeyId', '!=', input.apiKeyId), eb('keyHash', '!=', input.keyHash)]))
+        .where('matchHash', '=', input.matchHash)
+        .where('operation', '=', operations.depositAddress)
+        .where('orgId', '=', input.orgId)
+        .where('status', '=', 'provisioned')
+        .where((eb) => eb.or([eb('expiresAt', '>', now.toISOString()), eb('irrevocable', '=', true)]))
+        .orderBy('createdAt', 'asc')
+        .forUpdate()
+        .executeTakeFirst();
+    if (provisioned && claimed.status === 'pending') {
+        return {
+            checkpointFresh: provisioned.expiresAt > now.toISOString(),
+            claim: {
+                apiKeyId: provisioned.apiKeyId,
+                createdAt: provisioned.createdAt,
+                keyHash: provisioned.keyHash,
+            },
+            response: provisioned.response ?? '',
+            type: 'resume',
+        };
+    }
+    const inProgress = await db.kysely
+        .selectFrom('routes_idempotency_requests')
+        .select('apiKeyId')
+        .where((eb) => eb.or([eb('apiKeyId', '!=', input.apiKeyId), eb('keyHash', '!=', input.keyHash)]))
+        .where('matchHash', '=', input.matchHash)
+        .where('operation', '=', operations.depositAddress)
+        .where('orgId', '=', input.orgId)
+        .where((eb) => inFlight(eb, now.toISOString()))
+        .forUpdate()
+        .executeTakeFirst();
+    if (claimed.status === 'provisioned')
+        return { type: 'provisioned' };
+    if (!provisioned && !inProgress)
+        return { type: 'reserved' };
+    if (claimed.status === 'pending')
+        await release(db, input);
+    return { type: 'pending' };
+}
+/** Returns whether provider provisioning may still create an address for an organization. */
+export async function hasInFlightDepositAddress(db, orgId) {
+    const now = new Date().toISOString();
+    return Boolean(await db.kysely
+        .selectFrom('routes_idempotency_requests')
+        .select('apiKeyId')
+        .where((eb) => inFlight(eb, now))
+        .where('operation', '=', operations.depositAddress)
+        .where('orgId', '=', orgId)
+        .limit(1)
+        .executeTakeFirst());
+}
+/** Returns whether a rolling deployment left route work without attributable ownership. */
+export async function hasUnattributedInFlightClaim(db) {
+    const now = new Date().toISOString();
+    return Boolean(await db.kysely
+        .selectFrom('routes_idempotency_requests')
+        .select('apiKeyId')
+        .where('status', 'in', ['pending', 'provisioned'])
+        .where((eb) => eb.or([eb('operation', 'is', null), eb('orgId', 'is', null)]))
+        .where((eb) => eb.or([eb('expiresAt', '>', now), eb('irrevocable', '=', true)]))
+        .limit(1)
+        .executeTakeFirst());
+}
+/** Stores a provider result before committing its API resource and replay response. */
+export function checkpoint(db, input) {
+    const now = new Date();
+    return db.kysely
+        .updateTable('routes_idempotency_requests')
+        .set({
+        expiresAt: new Date(now.getTime() + input.replayTtlMs).toISOString(),
+        response: input.response,
+        status: 'provisioned',
+    })
+        .where('apiKeyId', '=', input.apiKeyId)
+        .where('createdAt', '=', input.createdAt)
+        .where('keyHash', '=', input.keyHash)
+        .where('status', '=', 'pending')
+        .returningAll()
+        .executeTakeFirst();
+}
+/** Completes an owned pending or provisioned claim with its replay response. */
+export function complete(db, input) {
+    const now = new Date();
+    return db.kysely
+        .updateTable('routes_idempotency_requests')
+        .set({
+        expiresAt: new Date(now.getTime() + input.replayTtlMs).toISOString(),
+        irrevocable: false,
+        response: input.response,
+        status: 'completed',
+        transferId: input.transferId ?? null,
+    })
+        .where('apiKeyId', '=', input.apiKeyId)
+        .where('createdAt', '=', input.createdAt)
+        .where('keyHash', '=', input.keyHash)
+        .where('status', 'in', ['pending', 'provisioned'])
+        .returningAll()
+        .executeTakeFirst();
+}
+/** Releases a pending claim after a retryable failure. */
+export async function release(db, input) {
+    await db.kysely
+        .deleteFrom('routes_idempotency_requests')
+        .where('apiKeyId', '=', input.apiKeyId)
+        .where('createdAt', '=', input.createdAt)
+        .where('keyHash', '=', input.keyHash)
+        .where('status', '=', 'pending')
+        .execute();
+}
+function inFlight(eb, now) {
+    return eb.and([
+        eb('status', 'in', ['pending', 'provisioned']),
+        eb.or([eb('expiresAt', '>', now), eb('irrevocable', '=', true)]),
+    ]);
+}
+//# sourceMappingURL=routesIdempotency.js.map

package/dist/db/tables/routesIdempotency.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routesIdempotency.js","sourceRoot":"","sources":["../../../src/db/tables/routesIdempotency.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,IAAI,CAAA;AAUxB,+DAA+D;AAC/D,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,cAAc,EAAE,iBAAiB;IACjC,QAAQ,EAAE,UAAU;CACZ,CAAA;AAKV;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,EAAS,EAAE,KAAkB;IACvD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;IACtB,MAAM,aAAa,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC,KAAK,CAAC,uBAAuB,IAAI,EAAE,CAAC,CAAC,CAAA;IACnF,MAAM,MAAM,GAAW;QACrB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;QAC5B,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE;QAC9D,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,SAAS;QACjB,UAAU,EAAE,IAAI;KACjB,CAAA;IACD,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,MAAM;SAC7B,UAAU,CAAC,6BAA6B,CAAC;SACzC,MAAM,CAAC,MAAM,CAAC;SACd,UAAU,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;SACnE,YAAY,EAAE;SACd,gBAAgB,EAAE,CAAA;IACrB,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,KAAK,CAAC,SAAS,KAAK,UAAU,CAAC,cAAc;YAC/C,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;QAC3D,uHAAuH;QACvH,MAAM,WAAW,GAAG,MAAM,EAAE,CAAC,MAAM;aAChC,UAAU,CAAC,6BAA6B,CAAC;aACzC,SAAS,EAAE;aACX,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CACZ,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CACxF;aACA,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CACZ,EAAE,CAAC,EAAE,CAAC;YACJ,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,GAAG,EAAE,UAAU,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;YACxF,EAAE,CAAC,GAAG,CAAC;gBACL,EAAE,CAAC,UAAU,EAAE,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC;gBACnC,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC;gBAC3B,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC;aACxB,CAAC;SACH,CAAC,CACH;aACA,KAAK,CAAC,aAAa,EAAE,IAAI,EAAE,aAAa,CAAC;aACzC,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,aAAa,CAAC;aACnC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,GAAG,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,EAAE,EAAE,CAAC,aAAa,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;aAC7F,OAAO,CAAC,WAAW,EAAE,KAAK,CAAC;aAC3B,SAAS,EAAE;aACX,gBAAgB,EAAE,CAAA;QACrB,IAAI,CAAC,WAAW;YAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;QAC3E,MAAM,EAAE,CAAC,MAAM;aACZ,WAAW,CAAC,6BAA6B,CAAC;aAC1C,GAAG,CAAC;YACH,WAAW,EAAE,WAAW,CAAC,WAAW,IAAI,KAAK,CAAC,oBAAoB,KAAK,IAAI;YAC3E,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,WAAW,EAAE,KAAK,CAAC,WAAW;SAC/B,CAAC;aACD,KAAK,CAAC,UAAU,EAAE,GAAG,EAAE,WAAW,CAAC,QAAQ,CAAC;aAC5C,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,WAAW,CAAC,SAAS,CAAC;aAC9C,KAAK,CAAC,SAAS,EAAE,GAAG,EAAE,WAAW,CAAC,OAAO,CAAC;aAC1C,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,aAAa,CAAC;aACnC,OAAO,EAAE,CAAA;QACZ,OAAO;YACL,eAAe,EAAE,WAAW,CAAC,SAAS,GAAG,GAAG,CAAC,WAAW,EAAE;YAC1D,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,cAAc,EAAE;gBACd,QAAQ,EAAE,WAAW,CAAC,QAAQ;gBAC9B,SAAS,EAAE,WAAW,CAAC,SAAS;gBAChC,OAAO,EAAE,WAAW,CAAC,OAAO;aAC7B;YACD,QAAQ,EAAE,WAAW,CAAC,QAAQ,IAAI,EAAE;YACpC,IAAI,EAAE,QAAQ;SACf,CAAA;IACH,CAAC;IAED,yEAAyE;IACzE,oEAAoE;IACpE,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,MAAM;SAC9B,WAAW,CAAC,6BAA6B,CAAC;SAC1C,GAAG,CAAC,MAAM,CAAC;SACX,KAAK,CAAC,UAAU,EAAE,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC;SACtC,KAAK,CAAC,SAAS,EAAE,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC;SACpC,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC;SAC3C,KAAK,CAAC,aAAa,EAAE,GAAG,EAAE,KAAK,CAAC;SAChC,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,aAAa,CAAC;SACpC,YAAY,EAAE;SACd,gBAAgB,EAAE,CAAA;IACrB,IAAI,SAAS;QAAE,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;IAEzE,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,MAAM;SAC7B,UAAU,CAAC,6BAA6B,CAAC;SACzC,SAAS,EAAE;SACX,KAAK,CAAC,UAAU,EAAE,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC;SACtC,KAAK,CAAC,SAAS,EAAE,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC;SACpC,gBAAgB,EAAE,CAAA;IACrB,4EAA4E;IAC5E,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;IACtC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAA;IAC9E,IAAI,QAAQ,CAAC,KAAK,KAAK,IAAI,IAAI,QAAQ,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAA;IAC1F,IAAI,QAAQ,CAAC,SAAS,KAAK,IAAI,IAAI,QAAQ,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;QACvE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAA;IAC7B,wFAAwF;IACxF,IAAI,QAAQ,CAAC,KAAK,KAAK,IAAI,IAAI,QAAQ,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QAC3D,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,MAAM;aAC5B,WAAW,CAAC,6BAA6B,CAAC;aAC1C,GAAG,CAAC;YACH,WAAW,EACT,QAAQ,CAAC,WAAW;gBACpB,CAAC,QAAQ,CAAC,MAAM,KAAK,aAAa,IAAI,KAAK,CAAC,oBAAoB,KAAK,IAAI,CAAC;YAC5E,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,WAAW,EAAE,KAAK,CAAC,WAAW;SAC/B,CAAC;aACD,KAAK,CAAC,UAAU,EAAE,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC;aACtC,KAAK,CAAC,SAAS,EAAE,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC;aACpC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;aAC5E,SAAS,CAAC,UAAU,CAAC;aACrB,gBAAgB,EAAE,CAAA;QACrB,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;IACvC,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;IAC7D,IAAI,QAAQ,CAAC,MAAM,KAAK,aAAa;QACnC,OAAO;YACL,eAAe,EAAE,QAAQ,CAAC,SAAS,GAAG,GAAG,CAAC,WAAW,EAAE;YACvD,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,QAAQ,EAAE,QAAQ,CAAC,QAAQ,IAAI,EAAE;YACjC,IAAI,EAAE,QAAQ;SACf,CAAA;IACH,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;AAC9D,CAAC;AAyCD,yEAAyE;AACzE,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,OAAO,CACL,KAAK,YAAY,EAAE,CAAC,aAAa;QACjC,KAAK,CAAC,IAAI,KAAK,OAAO;QACtB;YACE,kDAAkD;YAClD,qCAAqC;SACtC,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAC1B,CAAA;AACH,CAAC;AAED,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,EAAS,EACT,KAAgC;IAEhC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;IACtB,OAAO,OAAO,CACZ,MAAM,EAAE,CAAC,MAAM;SACZ,WAAW,CAAC,6BAA6B,CAAC;SAC1C,GAAG,CAAC;QACH,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE;QAC9D,WAAW,EAAE,IAAI;KAClB,CAAC;SACD,KAAK,CAAC,UAAU,EAAE,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC;SACtC,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,KAAK,CAAC,SAAS,CAAC;SACxC,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC;SAC1C,KAAK,CAAC,SAAS,EAAE,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC;SACpC,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,SAAS,CAAC;SAC/B,SAAS,CAAC,UAAU,CAAC;SACrB,gBAAgB,EAAE,CACtB,CAAA;AACH,CAAC;AAUD,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,EAAS,EACT,KAA0C;IAE1C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IACpC,IAAI,KAAK,GAAG,EAAE,CAAC,MAAM;SAClB,UAAU,CAAC,6BAA6B,CAAC;SACzC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,EAAU,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;SACrD,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;SAChC,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,UAAU,CAAC,cAAc,CAAC,CAAA;IACrD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAA;IAC3B,KAAK,GAAG,MAAM;QACZ,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,CAChC,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC,CACzE;QACH,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,CAAA;IAC1C,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,uBAAuB,EAAE,CAAA;IACpD,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAC7B,CAAC;AAYD,qEAAqE;AACrE,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,EAAS,EACT,KAAuC;IAEvC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;IACtB,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,MAAM;SAC5B,WAAW,CAAC,6BAA6B,CAAC;SAC1C,GAAG,CAAC;QACH,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE;QAC9D,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC;SACD,KAAK,CAAC,UAAU,EAAE,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC;SACtC,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,KAAK,CAAC,SAAS,CAAC;SACxC,KAAK,CAAC,SAAS,EAAE,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC;SACpC,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC;SAC1C,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,SAAS,CAAC;SAC/B,YAAY,EAAE;SACd,gBAAgB,EAAE,CAAA;IACrB,MAAM,OAAO,GACX,OAAO;QACP,CAAC,MAAM,EAAE,CAAC,MAAM;aACb,WAAW,CAAC,6BAA6B,CAAC;aAC1C,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;aACnC,KAAK,CAAC,UAAU,EAAE,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC;aACtC,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,KAAK,CAAC,SAAS,CAAC;aACxC,KAAK,CAAC,SAAS,EAAE,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC;aACpC,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,aAAa,CAAC;aACnC,YAAY,EAAE;aACd,gBAAgB,EAAE,CAAC,CAAA;IACxB,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;IACrC,MAAM,WAAW,GAAG,MAAM,EAAE,CAAC,MAAM;SAChC,UAAU,CAAC,6BAA6B,CAAC;SACzC,SAAS,EAAE;SACX,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CACZ,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAClF;SACA,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,KAAK,CAAC,SAAS,CAAC;SACxC,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,UAAU,CAAC,cAAc,CAAC;SAClD,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC;SAChC,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,aAAa,CAAC;SACnC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,GAAG,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,EAAE,EAAE,CAAC,aAAa,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;SAC7F,OAAO,CAAC,WAAW,EAAE,KAAK,CAAC;SAC3B,SAAS,EAAE;SACX,gBAAgB,EAAE,CAAA;IACrB,IAAI,WAAW,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAChD,OAAO;YACL,eAAe,EAAE,WAAW,CAAC,SAAS,GAAG,GAAG,CAAC,WAAW,EAAE;YAC1D,KAAK,EAAE;gBACL,QAAQ,EAAE,WAAW,CAAC,QAAQ;gBAC9B,SAAS,EAAE,WAAW,CAAC,SAAS;gBAChC,OAAO,EAAE,WAAW,CAAC,OAAO;aAC7B;YACD,QAAQ,EAAE,WAAW,CAAC,QAAQ,IAAI,EAAE;YACpC,IAAI,EAAE,QAAQ;SACf,CAAA;IACH,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,MAAM;SAC/B,UAAU,CAAC,6BAA6B,CAAC;SACzC,MAAM,CAAC,UAAU,CAAC;SAClB,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CACZ,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAClF;SACA,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,KAAK,CAAC,SAAS,CAAC;SACxC,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,UAAU,CAAC,cAAc,CAAC;SAClD,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC;SAChC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;SAC9C,SAAS,EAAE;SACX,gBAAgB,EAAE,CAAA;IACrB,IAAI,OAAO,CAAC,MAAM,KAAK,aAAa;QAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAA;IACpE,IAAI,CAAC,WAAW,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAA;IAC5D,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;QAAE,MAAM,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;IAC1D,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;AAC5B,CAAC;AAsBD,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,EAAS,EAAE,KAAa;IACtE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IACpC,OAAO,OAAO,CACZ,MAAM,EAAE,CAAC,MAAM;SACZ,UAAU,CAAC,6BAA6B,CAAC;SACzC,MAAM,CAAC,UAAU,CAAC;SAClB,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;SAChC,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,UAAU,CAAC,cAAc,CAAC;SAClD,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC;SAC1B,KAAK,CAAC,CAAC,CAAC;SACR,gBAAgB,EAAE,CACtB,CAAA;AACH,CAAC;AAED,2FAA2F;AAC3F,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,EAAS;IAC1D,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IACpC,OAAO,OAAO,CACZ,MAAM,EAAE,CAAC,MAAM;SACZ,UAAU,CAAC,6BAA6B,CAAC;SACzC,MAAM,CAAC,UAAU,CAAC;SAClB,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;SACjD,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;SAC5E,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,aAAa,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;SAC/E,KAAK,CAAC,CAAC,CAAC;SACR,gBAAgB,EAAE,CACtB,CAAA;AACH,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,UAAU,CAAC,EAAS,EAAE,KAAuB;IAC3D,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;IACtB,OAAO,EAAE,CAAC,MAAM;SACb,WAAW,CAAC,6BAA6B,CAAC;SAC1C,GAAG,CAAC;QACH,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE;QACpE,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,MAAM,EAAE,aAAa;KACtB,CAAC;SACD,KAAK,CAAC,UAAU,EAAE,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC;SACtC,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,KAAK,CAAC,SAAS,CAAC;SACxC,KAAK,CAAC,SAAS,EAAE,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC;SACpC,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,SAAS,CAAC;SAC/B,YAAY,EAAE;SACd,gBAAgB,EAAE,CAAA;AACvB,CAAC;AAkBD,gFAAgF;AAChF,MAAM,UAAU,QAAQ,CAAC,EAAS,EAAE,KAAqB;IACvD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;IACtB,OAAO,EAAE,CAAC,MAAM;SACb,WAAW,CAAC,6BAA6B,CAAC;SAC1C,GAAG,CAAC;QACH,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE;QACpE,WAAW,EAAE,KAAK;QAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,MAAM,EAAE,WAAW;QACnB,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;KACrC,CAAC;SACD,KAAK,CAAC,UAAU,EAAE,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC;SACtC,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,KAAK,CAAC,SAAS,CAAC;SACxC,KAAK,CAAC,SAAS,EAAE,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC;SACpC,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;SACjD,YAAY,EAAE;SACd,gBAAgB,EAAE,CAAA;AACvB,CAAC;AAoBD,0DAA0D;AAC1D,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,EAAS,EAAE,KAAoB;IAC3D,MAAM,EAAE,CAAC,MAAM;SACZ,UAAU,CAAC,6BAA6B,CAAC;SACzC,KAAK,CAAC,UAAU,EAAE,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC;SACtC,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,KAAK,CAAC,SAAS,CAAC;SACxC,KAAK,CAAC,SAAS,EAAE,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC;SACpC,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,SAAS,CAAC;SAC/B,OAAO,EAAE,CAAA;AACd,CAAC;AAcD,SAAS,QAAQ,CAAC,EAAiE,EAAE,GAAW;IAC9F,OAAO,EAAE,CAAC,GAAG,CAAC;QACZ,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;QAC9C,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,aAAa,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;KACjE,CAAC,CAAA;AACJ,CAAC"}

package/dist/db/tables/routesSubsidies.d.ts

@@ -0,0 +1,27 @@
+import { type Selectable } from 'kysely';
+import type * as Db from '../Db.js';
+import type * as db_Schema from '../Schema.js';
+/** Columns of the `routes_subsidies` table. */
+export type Table = db_Schema.RoutesSubsidy;
+/** A stored Routes subsidy policy. */
+export type Record = Selectable<Table>;
+/** Locks organization subsidy liability changes inside the caller's transaction. */
+export declare function lockOrganization(db: Db.Db, orgId: string): Promise<void>;
+/** Reads an organization's default Routes subsidy policy. */
+export declare function getOrganization(db: Db.Db, orgId: string): Promise<Record | undefined>;
+/** Enables or replaces an organization's Routes subsidy policy. */
+export declare function upsertOrganization(db: Db.Db, input: upsertOrganization.Input): Promise<Record>;
+export declare namespace upsertOrganization {
+    /** Fields accepted when enabling or replacing a Routes subsidy policy. */
+    type Input = {
+        /** Interval over which the subsidy limit applies. */
+        frequency: 'tx';
+        /** Maximum Routes subsidy gap in decimal USD. */
+        maxAmount: string;
+        /** Organization id (`org_…`) the policy belongs to. */
+        orgId: string;
+    };
+}
+/** Disables an organization's Routes subsidy policy. */
+export declare function removeOrganization(db: Db.Db, orgId: string): Promise<boolean>;
+//# sourceMappingURL=routesSubsidies.d.ts.map

package/dist/db/tables/routesSubsidies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routesSubsidies.d.ts","sourceRoot":"","sources":["../../../src/db/tables/routesSubsidies.ts"],"names":[],"mappings":"AAAA,OAAO,EAAO,KAAK,UAAU,EAAE,MAAM,QAAQ,CAAA;AAE7C,OAAO,KAAK,KAAK,EAAE,MAAM,UAAU,CAAA;AACnC,OAAO,KAAK,KAAK,SAAS,MAAM,cAAc,CAAA;AAE9C,+CAA+C;AAC/C,MAAM,MAAM,KAAK,GAAG,SAAS,CAAC,aAAa,CAAA;AAE3C,sCAAsC;AACtC,MAAM,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,CAAA;AAEtC,oFAAoF;AACpF,wBAAsB,gBAAgB,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAG9E;AAED,6DAA6D;AAC7D,wBAAgB,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAMrF;AAED,mEAAmE;AACnE,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,kBAAkB,CAAC,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAsB9F;AAED,MAAM,CAAC,OAAO,WAAW,kBAAkB,CAAC;IAC1C,0EAA0E;IAC1E,KAAK,KAAK,GAAG;QACX,qDAAqD;QACrD,SAAS,EAAE,IAAI,CAAA;QACf,iDAAiD;QACjD,SAAS,EAAE,MAAM,CAAA;QACjB,uDAAuD;QACvD,KAAK,EAAE,MAAM,CAAA;KACd,CAAA;CACF;AAED,wDAAwD;AACxD,wBAAsB,kBAAkB,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAMnF"}

package/dist/db/tables/routesSubsidies.js

@@ -0,0 +1,45 @@
+import { sql } from 'kysely';
+/** Locks organization subsidy liability changes inside the caller's transaction. */
+export async function lockOrganization(db, orgId) {
+    const key = `routes-subsidy:${orgId}`;
+    await sql `SELECT pg_advisory_xact_lock(hashtextextended(${key}, 0))`.execute(db.kysely);
+}
+/** Reads an organization's default Routes subsidy policy. */
+export function getOrganization(db, orgId) {
+    return db.kysely
+        .selectFrom('routes_subsidies')
+        .selectAll()
+        .where('orgId', '=', orgId)
+        .executeTakeFirst();
+}
+/** Enables or replaces an organization's Routes subsidy policy. */
+export function upsertOrganization(db, input) {
+    const now = new Date().toISOString();
+    return db.kysely
+        .insertInto('routes_subsidies')
+        .values({
+        createdAt: now,
+        enabled: true,
+        frequency: input.frequency,
+        maxAmount: input.maxAmount,
+        orgId: input.orgId,
+        updatedAt: now,
+    })
+        .onConflict((oc) => oc.column('orgId').doUpdateSet({
+        enabled: true,
+        frequency: input.frequency,
+        maxAmount: input.maxAmount,
+        updatedAt: now,
+    }))
+        .returningAll()
+        .executeTakeFirstOrThrow();
+}
+/** Disables an organization's Routes subsidy policy. */
+export async function removeOrganization(db, orgId) {
+    const result = await db.kysely
+        .deleteFrom('routes_subsidies')
+        .where('orgId', '=', orgId)
+        .executeTakeFirst();
+    return result.numDeletedRows > 0n;
+}
+//# sourceMappingURL=routesSubsidies.js.map

package/dist/db/tables/routesSubsidies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routesSubsidies.js","sourceRoot":"","sources":["../../../src/db/tables/routesSubsidies.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAmB,MAAM,QAAQ,CAAA;AAW7C,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EAAS,EAAE,KAAa;IAC7D,MAAM,GAAG,GAAG,kBAAkB,KAAK,EAAE,CAAA;IACrC,MAAM,GAAG,CAAA,iDAAiD,GAAG,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,CAAA;AACzF,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,eAAe,CAAC,EAAS,EAAE,KAAa;IACtD,OAAO,EAAE,CAAC,MAAM;SACb,UAAU,CAAC,kBAAkB,CAAC;SAC9B,SAAS,EAAE;SACX,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC;SAC1B,gBAAgB,EAAE,CAAA;AACvB,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,kBAAkB,CAAC,EAAS,EAAE,KAA+B;IAC3E,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IACpC,OAAO,EAAE,CAAC,MAAM;SACb,UAAU,CAAC,kBAAkB,CAAC;SAC9B,MAAM,CAAC;QACN,SAAS,EAAE,GAAG;QACd,OAAO,EAAE,IAAI;QACb,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,GAAG;KACf,CAAC;SACD,UAAU,CAAC,CAAC,EAAE,EAAE,EAAE,CACjB,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC;QAC7B,OAAO,EAAE,IAAI;QACb,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS,EAAE,GAAG;KACf,CAAC,CACH;SACA,YAAY,EAAE;SACd,uBAAuB,EAAE,CAAA;AAC9B,CAAC;AAcD,wDAAwD;AACxD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EAAS,EAAE,KAAa;IAC/D,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,MAAM;SAC3B,UAAU,CAAC,kBAAkB,CAAC;SAC9B,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC;SAC1B,gBAAgB,EAAE,CAAA;IACrB,OAAO,MAAM,CAAC,cAAc,GAAG,EAAE,CAAA;AACnC,CAAC"}

package/dist/db/tables/{fundingTransferEvents.d.ts → routesTransferEvents.d.ts}

@@ -1,12 +1,12 @@
 import type { Selectable } from 'kysely';
 import type * as Db from '../Db.js';
 import type * as db_Schema from '../Schema.js';
-/** Columns of the `funding_transfer_events` table. */
-export type Table = db_Schema.FundingTransferEvent;
+/** Columns of the `routes_transfer_events` table. */
+export type Table = db_Schema.RoutesTransferEvent;
 /** One immutable public snapshot at a material version. */
 export type Record = Selectable<Table>;
 /** Inserts an event row. Callers commit it with its transfer row in one transaction. */
 export declare function insert(db: Db.Db, record: Record): Promise<Record>;
 /** Lists a transfer's events, oldest version first. */
 export declare function listByTransfer(db: Db.Db, transferId: string): Promise<Record[]>;
-//# sourceMappingURL=fundingTransferEvents.d.ts.map
+//# sourceMappingURL=routesTransferEvents.d.ts.map

package/dist/db/tables/routesTransferEvents.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routesTransferEvents.d.ts","sourceRoot":"","sources":["../../../src/db/tables/routesTransferEvents.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAA;AAExC,OAAO,KAAK,KAAK,EAAE,MAAM,UAAU,CAAA;AACnC,OAAO,KAAK,KAAK,SAAS,MAAM,cAAc,CAAA;AAE9C,qDAAqD;AACrD,MAAM,MAAM,KAAK,GAAG,SAAS,CAAC,mBAAmB,CAAA;AACjD,2DAA2D;AAC3D,MAAM,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,CAAA;AAEtC,wFAAwF;AACxF,wBAAgB,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAMjE;AAED,uDAAuD;AACvD,wBAAgB,cAAc,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAO/E"}