tapimo 0.15.0 → 0.18.0

package/src/db/tables/rewardRuns.ts

@@ -355,6 +355,7 @@ export async function latestSummary(
     .where('chainId', '=', String(options.chainId))
     .where('vaultAddress', '=', normalize(options.vaultAddress))
     .orderBy('startsAfter', 'desc')
+    .limit(1)
     .executeTakeFirst()
   if (!row) return undefined
   return {
@@ -399,6 +400,7 @@ export async function latestStatement(
       ]),
     )
     .orderBy('endsAt', 'desc')
+    .limit(1)
     .executeTakeFirst()
   if (!row) return undefined
   const record = toRecord(row)
@@ -419,6 +421,8 @@ export async function latestDelivered(
     .where('vaultAddress', '=', normalize(options.vaultAddress))
     .where('phase', '=', 'delivered')
     .orderBy('endsAt', 'desc')
+    // `executeTakeFirst` adds no LIMIT; without one Postgres returns every run.
+    .limit(1)
     .executeTakeFirst()) as DeliveredSummary | undefined
 }
 

package/src/db/tables/rewardTransactionAttempts.ts

@@ -200,6 +200,7 @@ export async function latestForIntent(
       'asc',
     )
     .orderBy('createdAt', 'desc')
+    .limit(1)
     .executeTakeFirst()
   return row ? toRecord(row) : undefined
 }
@@ -249,6 +250,7 @@ export async function latestRecoverable(
     .where('state', 'in', ['created', 'signed', 'broadcast', 'confirmed'])
     .where(sql<boolean>`intent ->> 'operation' = ${options.operation}`)
     .orderBy('createdAt', 'desc')
+    .limit(1)
     .executeTakeFirst()
   return row ? toRecord(row) : undefined
 }

package/src/db/tables/routesDepositAddresses.test.ts

@@ -75,7 +75,87 @@ describe('getByProviderAddress', () => {
   })
 })
 
+describe('grandfatherLegacySponsored', () => {
+  test('preserves fixed-rate identity when pinning enterprise terms', async () => {
+    const record = await seed({
+      providerState: { fixedRate: '1:1', routePolicyKey: '["","1:1"]' },
+      snapshot: TestRoutes.depositAddressSnapshot({
+        provider: { id: 'fixed_rate_reviewed', name: 'Fixed rate reviewed' },
+        recipient: `0x${'93'.repeat(20)}`,
+        subsidize: true,
+      }),
+    })
+    await RoutesDepositAddresses.grandfatherLegacySponsored(db, {
+      addressIds: [record.id],
+      apply: true,
+      commitment: {
+        maxAmount: '0.05',
+        scope: { environment: 'production', orgId: record.orgId },
+        versions: [1],
+      },
+    })
+    const stored = await RoutesDepositAddresses.get(db, record.id)
+    expect(stored?.providerState).toMatchInlineSnapshot(`
+      {
+        "fixedRate": "1:1",
+        "routePolicy": {
+          "maxAmount": "0.05",
+          "scope": {
+            "environment": "production",
+            "orgId": "org_deposit_addresses",
+          },
+          "subsidyPayer": "enterprise",
+          "versions": [
+            1,
+          ],
+        },
+        "routePolicyKey": "["[\\"enterprise\\",\\"0.050000\\"]","1:1"]",
+      }
+    `)
+  })
+})
+
 describe('routes migration', () => {
+  test('reports ambiguous legacy rows and only applies explicitly reviewed enterprise terms', async () => {
+    const reviewed = await seed({
+      snapshot: TestRoutes.depositAddressSnapshot({
+        provider: { id: 'legacy_reviewed', name: 'Legacy reviewed' },
+        recipient: `0x${'91'.repeat(20)}`,
+        subsidize: true,
+      }),
+    })
+    const ambiguous = await seed({
+      snapshot: TestRoutes.depositAddressSnapshot({
+        provider: { id: 'legacy_ambiguous', name: 'Legacy ambiguous' },
+        recipient: `0x${'92'.repeat(20)}`,
+        subsidize: true,
+      }),
+    })
+    const options = {
+      addressIds: [reviewed.id, 'rda_missing'],
+      commitment: {
+        maxAmount: '12.5',
+        scope: { environment: 'production', orgId: reviewed.orgId },
+        versions: [4] as number[],
+      },
+    } satisfies RoutesDepositAddresses.grandfatherLegacySponsored.Options
+
+    const dryRun = await RoutesDepositAddresses.grandfatherLegacySponsored(db, options)
+    expect(dryRun).toMatchObject({
+      ambiguous: expect.arrayContaining([ambiguous.id]),
+      applied: false,
+      grandfathered: [reviewed.id],
+      missing: ['rda_missing'],
+    })
+    await RoutesDepositAddresses.grandfatherLegacySponsored(db, { ...options, apply: true })
+
+    expect((await RoutesDepositAddresses.get(db, reviewed.id))?.providerState).toMatchObject({
+      routePolicy: { maxAmount: '12.5', subsidyPayer: 'enterprise', versions: [4] },
+      routePolicyKey: '["enterprise","12.500000"]',
+    })
+    expect((await RoutesDepositAddresses.get(db, ambiguous.id))?.providerState).toBeNull()
+  })
+
   test('backfills canonical creator attribution for retained addresses', async () => {
     const orgId = 'org_deposit_address_creator_backfill'
     const userId = 'usr_deposit_address_creator_backfill'
@@ -726,6 +806,135 @@ describe('failPoll', () => {
 })
 
 describe('insertOrGet', () => {
+  test('keeps legacy reuse and provider state isolated from newer policy addresses', async () => {
+    const legacy = await seed({
+      providerState: { checkEndpoint: '/intents/status/v3?requestId=legacy' },
+    })
+    const match: RoutesDepositAddresses.Match = {
+      destinationTokenKey: legacy.destinationTokenKey,
+      environment: legacy.environment,
+      orgId: legacy.orgId,
+      recipient: legacy.recipient,
+      refundAddress: legacy.refundAddress,
+      sourceChainId: legacy.sourceChainId,
+      sourceTokenKey: legacy.sourceTokenKey,
+      subsidize: legacy.subsidize,
+    }
+    const pinned = {
+      ...legacy,
+      address: `0x${'da'.repeat(20)}`,
+      id: DepositAddress.generateId(),
+      providerState: { routePolicyKey: '["tempo","0.150000"]' },
+      snapshot: { ...legacy.snapshot, address: `0x${'da'.repeat(20)}` },
+    }
+    await RoutesDepositAddresses.insertOrGet(db, {
+      match: { ...match, policyKey: '["tempo","0.150000"]', providerId: legacy.providerId },
+      record: pinned,
+    })
+    // A rolling legacy reader supplies neither policyKey nor providerId, even after provider configuration changes.
+    expect(await RoutesDepositAddresses.getMatching(db, match)).toEqual(legacy)
+    expect(
+      await RoutesDepositAddresses.insertOrGet(db, {
+        match,
+        record: {
+          ...legacy,
+          address: `0x${'db'.repeat(20)}`,
+          id: DepositAddress.generateId(),
+          providerId: 'rotated_provider',
+          providerState: {},
+        },
+      }),
+    ).toEqual(legacy)
+    expect(
+      await RoutesDepositAddresses.getMatching(db, {
+        ...match,
+        policyKey: '["tempo","0.150000"]',
+        providerId: legacy.providerId,
+      }),
+    ).toEqual(pinned)
+    expect(await RoutesDepositAddresses.get(db, legacy.id)).toEqual(legacy)
+  })
+
+  test('creates and independently reuses addresses with different pinned caps', async () => {
+    const first = await seed({
+      providerState: { routePolicyKey: '["tempo","0.050000"]' },
+    })
+    const record = {
+      ...first,
+      address: `0x${'ed'.repeat(20)}`,
+      id: DepositAddress.generateId(new Date('2027-03-01')),
+      providerState: { routePolicyKey: '["tempo","0.150000"]' },
+    }
+    const match: RoutesDepositAddresses.Match = {
+      destinationTokenKey: record.destinationTokenKey,
+      environment: record.environment,
+      orgId: record.orgId,
+      policyKey: '["tempo","0.150000"]',
+      providerId: record.providerId,
+      recipient: record.recipient,
+      refundAddress: record.refundAddress,
+      sourceChainId: record.sourceChainId,
+      sourceTokenKey: record.sourceTokenKey,
+      subsidize: record.subsidize,
+    }
+
+    const results = await Promise.all([
+      RoutesDepositAddresses.insertOrGet(db, { match, record }),
+      RoutesDepositAddresses.insertOrGet(db, {
+        match,
+        record: {
+          ...record,
+          address: `0x${'ee'.repeat(20)}`,
+          id: DepositAddress.generateId(new Date('2027-03-02')),
+        },
+      }),
+    ])
+    expect(results[0]).toEqual(results[1])
+    expect(results[0]?.address).not.toBe(first.address)
+    expect(await RoutesDepositAddresses.getMatching(db, match)).toEqual(results[0])
+    expect(
+      await RoutesDepositAddresses.getMatching(db, {
+        ...match,
+        policyKey: '["tempo","0.050000"]',
+      }),
+    ).toEqual(first)
+    expect(await RoutesDepositAddresses.get(db, first.id)).toEqual(first)
+  })
+
+  test.each(['provider', 'policy'] as const)(
+    'reports a late %s conflict without assigning the wrong provider or physical address',
+    async (difference) => {
+      const first = await seed()
+      const record = {
+        ...first,
+        address: difference === 'policy' ? first.address : `0x${'ef'.repeat(20)}`,
+        id: DepositAddress.generateId(new Date('2027-02-01')),
+        providerId: difference === 'provider' ? 'different_provider' : first.providerId,
+        providerState: difference === 'policy' ? { routePolicyKey: '["tempo","0.050000"]' } : {},
+      }
+      const match: RoutesDepositAddresses.Match = {
+        destinationTokenKey: record.destinationTokenKey,
+        environment: record.environment,
+        orgId: record.orgId,
+        policyKey: difference === 'policy' ? '["tempo","0.050000"]' : undefined,
+        providerId: record.providerId,
+        recipient: record.recipient,
+        refundAddress: record.refundAddress,
+        sourceChainId: record.sourceChainId,
+        sourceTokenKey: record.sourceTokenKey,
+        subsidize: record.subsidize,
+      }
+
+      // Both requests passed preflight; the winner is persisted before the loser's insert.
+      for (let attempt = 0; attempt < 2; attempt++)
+        await expect(
+          RoutesDepositAddresses.insertOrGet(db, { match, record }),
+        ).rejects.toBeInstanceOf(RoutesDepositAddresses.IdentityConflictError)
+      expect(await RoutesDepositAddresses.get(db, record.id)).toBeUndefined()
+      expect(await RoutesDepositAddresses.get(db, first.id)).toEqual(first)
+    },
+  )
+
   test('returns the existing address for an identical reusable identity', async () => {
     const record = await seed()
     const match: RoutesDepositAddresses.Match = {
@@ -1020,6 +1229,60 @@ describe('summarize', () => {
 })
 
 describe('checkpointPoll', () => {
+  test.each([
+    {
+      routePolicy: { maxAmount: '0.05', scope: owner, subsidyPayer: 'tempo', versions: [1] },
+      routePolicyKey: '["tempo","0.050000"]',
+    },
+    { fixedRate: '1:1', routePolicyKey: '["","1:1"]' },
+    {
+      fixedRate: '1:1',
+      routePolicy: {
+        maxAmount: '0.05',
+        scope: owner,
+        subsidyPayer: 'enterprise',
+        versions: [0, 0],
+      },
+      routePolicyKey: '["[\\"enterprise\\",\\"0.050000\\"]","1:1"]',
+    },
+    { routePolicy: null, routePolicyKey: 'invalid' },
+    {},
+  ])(
+    'preserves financial terms across provider cursor replacement and completion: %j',
+    async (providerState) => {
+      const record = await seed({ providerState })
+      const [claim] = await RoutesDepositAddresses.claimDue(db, {
+        leaseUntil: '2027-01-01T00:01:00.000Z',
+        limit: 1,
+        now: '2027-01-01T00:00:00.000Z',
+        providerId: record.providerId,
+      })
+      if (!claim) throw new Error('Expected a claimed address.')
+      const checkpoint = await RoutesDepositAddresses.checkpointPoll(db, {
+        id: record.id,
+        pollLeaseVersion: claim.pollLeaseVersion,
+        providerState: {
+          cursor: 'next',
+          fixedRate: '2:1',
+          routePolicy: { subsidyPayer: 'enterprise' },
+          routePolicyKey: 'replacement',
+        },
+      })
+      expect(checkpoint?.providerState).toEqual({ ...providerState, cursor: 'next' })
+      const completed = await RoutesDepositAddresses.completePoll(db, {
+        id: record.id,
+        pollLeaseVersion: claim.pollLeaseVersion,
+        providerState: null,
+        providerRequestIds: [],
+        lastPolledAt: '2027-01-01T00:00:10.000Z',
+        nextPollAt: '2027-01-01T00:01:10.000Z',
+      })
+      expect(completed?.providerState).toEqual(
+        Object.keys(providerState).length ? providerState : null,
+      )
+    },
+  )
+
   test('retains the lease while saving progress and rejects a stale fence', async () => {
     const record = await seed()
     const [claim] = await RoutesDepositAddresses.claimDue(db, {

package/src/db/tables/routesDepositAddresses.ts

@@ -1,8 +1,8 @@
 import { sql, type JSONColumnType, type Selectable } from 'kysely'
-import * as pg from 'pg'
 
 import type * as Db from '../Db.js'
 import type * as db_Schema from '../Schema.js'
+import * as Policy from '../../internal/routes/Policy.js'
 import * as RoutesIdempotency from './routesIdempotency.js'
 import * as RoutesSubsidies from './routesSubsidies.js'
 
@@ -15,6 +15,69 @@ export type Table = Omit<db_Schema.RoutesDepositAddress, 'providerRequestIds'> &
 /** A stored route deposit address. */
 export type Record = Selectable<Table>
 
+/** Reviews and optionally pins explicitly approved legacy sponsored addresses. */
+export async function grandfatherLegacySponsored(
+  db: Db.Db,
+  options: grandfatherLegacySponsored.Options,
+): Promise<grandfatherLegacySponsored.Report> {
+  let query = db.kysely
+    .selectFrom('routes_deposit_addresses')
+    .select(['id', 'providerState'])
+    .where('orgId', '=', options.commitment.scope.orgId)
+    .where('environment', '=', options.commitment.scope.environment)
+    .where('subsidize', '=', true)
+    .where(sql<boolean>`provider_state->'routePolicy' IS NULL`)
+    .orderBy('id')
+  query =
+    options.commitment.scope.projectId === undefined
+      ? query.where('projectId', 'is', null)
+      : query.where('projectId', '=', options.commitment.scope.projectId)
+  const legacy = await query.execute()
+  const known = new Set(options.addressIds)
+  const existing = new Set(legacy.map(({ id }) => id))
+  const grandfathered = legacy.filter(({ id }) => known.has(id)).map(({ id }) => id)
+  const ambiguous = legacy.filter(({ id }) => !known.has(id)).map(({ id }) => id)
+  const missing = options.addressIds.filter((id) => !existing.has(id))
+  if (options.apply === true && grandfathered.length > 0) {
+    const routePolicy = Policy.schema.Commitment.parse({
+      ...options.commitment,
+      subsidyPayer: 'enterprise',
+    })
+    await db.kysely
+      .updateTable('routes_deposit_addresses')
+      .set({
+        providerState: sql`coalesce(provider_state, '{}'::jsonb) || jsonb_build_object(
+          'routePolicy', ${JSON.stringify(routePolicy)}::jsonb,
+          'routePolicyKey', CASE WHEN provider_state->>'fixedRate' = '1:1'
+            THEN ${Policy.depositKey({ fixedRate: '1:1', routePolicy })}::text
+            ELSE ${Policy.commitmentKey(routePolicy)}::text END
+        )`,
+      })
+      .where('id', 'in', grandfathered)
+      .where('subsidize', '=', true)
+      .where(sql<boolean>`provider_state->'routePolicy' IS NULL`)
+      .execute()
+  }
+  return { ambiguous, applied: options.apply === true, grandfathered, missing }
+}
+
+export declare namespace grandfatherLegacySponsored {
+  type Options = {
+    /** Explicitly reviewed, unambiguous legacy address ids. */
+    addressIds: readonly string[]
+    /** Current approved limits and provenance; payer is forced to enterprise. */
+    commitment: Omit<Policy.Commitment, 'subsidyPayer'>
+    /** Writes when true; omitted is a dry run. */
+    apply?: boolean | undefined
+  }
+  type Report = {
+    ambiguous: readonly string[]
+    applied: boolean
+    grandfathered: readonly string[]
+    missing: readonly string[]
+  }
+}
+
 /** Ownership filter derived from the authenticated API key. */
 export type Owner = {
   /** Key environment. */
@@ -27,6 +90,10 @@ export type Owner = {
 
 /** Identity fields that make one reusable address match a caller request. */
 export type Match = Owner & {
+  /** Stable immutable financial commitment identity (empty for legacy rows). */
+  policyKey?: string | undefined
+  /** Provider that provisioned the reusable address. */
+  providerId?: string | undefined
   /** Customer destination token key. */
   destinationTokenKey: string
   /** Tempo account that receives completed deposits. */
@@ -123,6 +190,7 @@ export function validateCreationCapacity(
   return db
     .transaction(async (tx) => {
       await RoutesSubsidies.lockOrganization(tx, options.orgId)
+      await options.checkPolicy?.(tx)
       const organization = await getCapacityOwner(tx, options.orgId)
       if (!organization) throw new OwnerNotFoundError()
       await lockCapacityOwner(tx, organization)
@@ -143,6 +211,18 @@ export function validateCreationCapacity(
           })
         return { allowed: true, result: { record: matching, type: 'existing' } } as const
       }
+      // Different commitments may provision new addresses; the same commitment cannot silently switch providers.
+      if (
+        await matchingIdentity(tx, options.match)
+          .where(
+            sql<string>`coalesce(provider_state->>'routePolicyKey', '')`,
+            '=',
+            options.match.policyKey ?? '',
+          )
+          .select('id')
+          .executeTakeFirst()
+      )
+        throw new IdentityConflictError()
       // Old workers cannot prove a checkpoint's owner or match; exact same-key retries attribute it before this fence.
       if (await RoutesIdempotency.hasUnattributedInFlightClaim(tx)) throw new MatchInProgressError()
       const reservation = await RoutesIdempotency.reserveDepositAddressMatch(tx, {
@@ -172,6 +252,8 @@ export function validateCreationCapacity(
 export declare namespace validateCreationCapacity {
   /** Reusable identity and organization capacity bound. */
   type Options = {
+    /** Validates fresh instructions under the same lock as capacity and reuse. */
+    checkPolicy?: ((db: Db.Db) => Promise<void>) | undefined
     /** Pending claim released atomically when the creator-wide cap is full. */
     claim: RoutesIdempotency.release.Input
     /** Maximum durable and in-flight addresses for one canonical creator. */
@@ -312,35 +394,15 @@ export async function insertOrGet(db: Db.Db, options: insertOrGet.Options): Prom
       ...options.record,
       providerRequestIds: JSON.stringify(options.record.providerRequestIds),
     })
-    .onConflict((oc) =>
-      oc
-        .columns([
-          'orgId',
-          'environment',
-          'projectId',
-          'sourceChainId',
-          'sourceTokenKey',
-          'destinationTokenKey',
-          'recipient',
-          'refundAddress',
-          'subsidize',
-        ])
-        .doNothing(),
-    )
+    // Handle both financial-identity and physical-provider-address uniqueness without replacing either row.
+    .onConflict((oc) => oc.doNothing())
     .returningAll()
     .executeTakeFirst()
-    .catch((cause) => {
-      if (
-        cause instanceof pg.DatabaseError &&
-        cause.code === '23505' &&
-        cause.constraint === 'routes_deposit_addresses_provider_address_key'
-      )
-        throw new ConflictError()
-      throw cause
-    })
   if (record) return record
   const existing = await getMatching(db, options.match)
   if (existing) return existing
+  if (await matchingIdentity(db, options.match).select('id').executeTakeFirst())
+    throw new IdentityConflictError()
   throw new ConflictError()
 }
 
@@ -707,9 +769,17 @@ export declare namespace summarize {
 
 /** Gets the reusable address that matches one owner and route identity. */
 export function getMatching(db: Db.Db, match: Match): Promise<Record | undefined> {
-  let query = db.kysely
-    .selectFrom('routes_deposit_addresses')
+  let query = matchingIdentity(db, match)
     .selectAll()
+    .where(sql<string>`coalesce(provider_state->>'routePolicyKey', '')`, '=', match.policyKey ?? '')
+  if (match.providerId !== undefined) query = query.where('providerId', '=', match.providerId)
+  return query.executeTakeFirst()
+}
+
+/** Matches route ownership across financial commitments, including deactivated addresses. */
+function matchingIdentity(db: Db.Db, match: Match) {
+  const query = db.kysely
+    .selectFrom('routes_deposit_addresses')
     .where('destinationTokenKey', '=', match.destinationTokenKey)
     .where('environment', '=', match.environment)
     .where('orgId', '=', match.orgId)
@@ -718,11 +788,9 @@ export function getMatching(db: Db.Db, match: Match): Promise<Record | undefined
     .where('sourceChainId', '=', match.sourceChainId)
     .where('sourceTokenKey', '=', match.sourceTokenKey)
     .where('subsidize', '=', match.subsidize)
-  query =
-    match.projectId === undefined
-      ? query.where('projectId', 'is', null)
-      : query.where('projectId', '=', match.projectId)
-  return query.executeTakeFirst()
+  return match.projectId === undefined
+    ? query.where('projectId', 'is', null)
+    : query.where('projectId', '=', match.projectId)
 }
 
 /** Lists active provider addresses for one source-chain token. */
@@ -862,7 +930,7 @@ export declare namespace renewPoll {
 export function checkpointPoll(db: Db.Db, options: checkpointPoll.Options) {
   return db.kysely
     .updateTable('routes_deposit_addresses')
-    .set({ providerState: options.providerState })
+    .set({ providerState: pollState(options.providerState) })
     .where('id', '=', options.id)
     .where('pollLeaseVersion', '=', options.pollLeaseVersion)
     .returningAll()
@@ -887,7 +955,7 @@ export function completePoll(
       pollFailureCount: 0,
       pollLeaseUntil: null,
       providerRequestIds: JSON.stringify(options.providerRequestIds),
-      providerState: options.providerState,
+      providerState: pollState(options.providerState),
     })
     .where('id', '=', options.id)
     .where('pollLeaseVersion', '=', options.pollLeaseVersion)
@@ -895,6 +963,17 @@ export function completePoll(
     .executeTakeFirst()
 }
 
+// Provider cursors may replace private state, but cannot change or erase financial terms.
+function pollState(state: Record['providerState']) {
+  const encoded = state === null ? null : JSON.stringify(state)
+  return sql<Record['providerState']>`CASE
+    WHEN provider_state ?| ARRAY['fixedRate', 'routePolicy', 'routePolicyKey'] THEN
+      (coalesce(${encoded}::jsonb, '{}'::jsonb) - 'fixedRate' - 'routePolicy' - 'routePolicyKey') ||
+      (SELECT jsonb_object_agg(key, value) FROM jsonb_each(provider_state)
+        WHERE key IN ('fixedRate', 'routePolicy', 'routePolicyKey'))
+    ELSE (${encoded}::jsonb - 'fixedRate' - 'routePolicy' - 'routePolicyKey') END`
+}
+
 export declare namespace completePoll {
   /** Successful reconciliation result guarded by the claimed lease version. */
   type Options = {
@@ -984,6 +1063,11 @@ export class ConflictError extends Error {
   override name = 'RoutesDepositAddresses.ConflictError'
 }
 
+/** The requested identity conflicts with an existing provider or physical address commitment. */
+export class IdentityConflictError extends Error {
+  override name = 'RoutesDepositAddresses.IdentityConflictError'
+}
+
 /** Organization deposit-address cap reached. */
 export class LimitExceededError extends Error {
   override name = 'RoutesDepositAddresses.LimitExceededError'