tapimo 0.9.0 → 0.10.1

package/src/apps/data/routes/zones.bench.ts

@@ -0,0 +1,32 @@
+import * as Tidx from '../../../internal/Tidx.js'
+import * as Viem from '../../../internal/Viem.js'
+import * as TestApp from '../../../../test/App.js'
+import * as QueryBench from '../../../../test/QueryBench.js'
+
+const senderTag = `0x${'00'.repeat(32)}`
+const zoneChainIds = {
+  4217: 421_700_002,
+  42431: 424_310_002,
+} as const
+
+QueryBench.bench({
+  chainId: false,
+  name: 'listZoneWithdrawals',
+  path: {
+    4217: `/v1/zones/withdrawals/${senderTag}?chainId=${zoneChainIds[4217]}`,
+    42431: `/v1/zones/withdrawals/${senderTag}?chainId=${zoneChainIds[42431]}`,
+  },
+  zones: ({ chainId }) => {
+    const rpcUrl = Viem.resolveUrl(process.env.RPC_URL, chainId) ?? Viem.url[chainId]
+    const tidxUrl = Viem.resolveUrl(process.env.TIDX_URL, chainId) ?? Tidx.url[chainId]
+    if (!rpcUrl || !tidxUrl) throw new Error(`Missing Zone upstream for chain ${chainId}.`)
+    return [
+      TestApp.zone({
+        chainId: zoneChainIds[chainId],
+        rpcUrl,
+        sourceChainId: chainId,
+        tidxUrl,
+      }),
+    ]
+  },
+})

package/src/apps/data/routes/zones.test.ts

@@ -419,7 +419,7 @@ describe('GET /v1/zones/withdrawals/:senderTag', () => {
         },
         {
           "examples": [
-            421700001,
+            1424310001,
           ],
           "name": "chainId",
           "required": true,

package/src/apps/data/routes/zones.ts

@@ -43,7 +43,7 @@ export namespace schema {
       .strictObject({
         chainId: Schema.ChainId.check(
           z.describe('The chain id of the Zone where the withdrawal originated.'),
-          z.meta({ examples: [421_700_001] }),
+          z.meta({ examples: [1_424_310_001] }),
         ),
       })
       .check(z.describe('Query parameters used to select the originating Zone.'))
@@ -176,7 +176,12 @@ export function zones() {
       name: 'tempo-api:zone-withdrawals:v1',
       key: (c) => {
         const principal = Auth.getPrincipal(c)
-        return `${principal?.type ?? 'unknown'}:${principal?.id ?? 'unknown'}:${Cache.urlKey(c, schema.listZoneWithdrawals.Query)}`
+        const url = new URL(Cache.urlKey(c, schema.listZoneWithdrawals.Query))
+        url.searchParams.set(
+          'principal',
+          `${principal?.type ?? 'unknown'}:${principal?.id ?? 'unknown'}`,
+        )
+        return url.toString()
       },
     }),
     async (c) => {

package/src/apps/funding/routes/chains.test.ts

@@ -22,7 +22,7 @@ const providers = [
     integratorId: '0xdead',
     userAddress: '0x1111111111111111111111111111111111111111',
   }),
-  Relay.relay({ userAddress: '0x1111111111111111111111111111111111111111' }),
+  Relay.relay({ userAddresses: TestFunding.relayQuoteUsers }),
   Rhino.rhino(),
   Squid.squid({
     integratorId: 'squid-integrator-id',

package/src/apps/funding/routes/deposit-addresses.test.ts

@@ -45,7 +45,7 @@ const providers = [
     integratorId: '0xdead',
     userAddress: '0x1111111111111111111111111111111111111111',
   }),
-  Relay.relay({ userAddress: '0x1111111111111111111111111111111111111111' }),
+  Relay.relay({ userAddresses: TestFunding.relayQuoteUsers }),
   Rhino.rhino(),
   Squid.squid({
     integratorId: 'squid-integrator-id',

package/src/apps/funding/routes/deposit-addresses.ts

@@ -712,7 +712,7 @@ export function depositAddresses(options: depositAddresses.Options = {}) {
     .post(
       '/v1/funding/deposit-addresses/:id{fda_[A-Za-z0-9_-]+}/reconcile',
       Auth.policy({
-        apiKey: { rateLimit: { perMinute: 10 }, scopes: ['funding:write'] },
+        apiKey: { rateLimit: { limit: 10, period: 'minute' }, scopes: ['funding:write'] },
       }),
       OpenApi.validate('param', schema.reconcileFundingDepositAddress.Params, {
         code: 'param_invalid',

package/src/apps/funding/routes/providers.test.ts

@@ -28,7 +28,7 @@ const providers = [
     integratorId: '0xdead',
     userAddress: '0x1111111111111111111111111111111111111111',
   }),
-  Relay.relay({ userAddress: '0x1111111111111111111111111111111111111111' }),
+  Relay.relay({ userAddresses: TestFunding.relayQuoteUsers }),
   Rhino.rhino(),
   Squid.squid({
     integratorId: 'squid-integrator-id',

package/src/apps/funding/routes/quotes.test.ts

@@ -28,7 +28,7 @@ const providers = [
     integratorId: '0xdead',
     userAddress: '0x1111111111111111111111111111111111111111',
   }),
-  Relay.relay({ userAddress: '0x1111111111111111111111111111111111111111' }),
+  Relay.relay({ userAddresses: TestFunding.relayQuoteUsers }),
   Rhino.rhino(),
   Squid.squid({
     integratorId: 'squid-integrator-id',
@@ -271,7 +271,7 @@ describe('GET /funding/quotes', () => {
       const response_promise = app.request(quoteUrl({ ...baseUsdcQuery, provider: 'across' }), {
         headers: TestApp.auth.headers,
       })
-      await vi.advanceTimersByTimeAsync(2_000)
+      await vi.advanceTimersByTimeAsync(5_000)
       const response = await response_promise
 
       expect(response.status).toBe(502)

package/src/apps/funding/routes/transfers.test.ts

@@ -27,11 +27,8 @@ const db = TestApp.database()
 /** Providers exercised against executable calls on a forked source chain. */
 const executableProviders = [
   {
-    create: (sender: string) =>
-      Relay.relay({
-        ...(process.env.RELAY_API_KEY ? { apiKey: process.env.RELAY_API_KEY } : {}),
-        userAddress: sender,
-      }),
+    create: (_sender: string) =>
+      Relay.relay(process.env.RELAY_API_KEY ? { apiKey: process.env.RELAY_API_KEY } : {}),
     id: 'relay',
   },
 ] as const
@@ -282,7 +279,7 @@ describe('POST /funding/transfers', () => {
       providerResponse(),
   ) {
     return FundingProvider.from({
-      ...Relay.relay({ userAddress: '0x1111111111111111111111111111111111111111' }),
+      ...Relay.relay(),
       prepareTransfer,
     })
   }

package/src/apps/funding/routes/transfers.ts

@@ -110,7 +110,7 @@ export namespace schema {
           .check(
             z.regex(/^eip155:\d+$/),
             z.describe('Configured Zone CAIP-2 id.'),
-            z.meta({ examples: ['eip155:421700001'] }),
+            z.meta({ examples: ['eip155:1424310001'] }),
           ),
         destinationToken: FundingTransfer.schema.CreateRequest.shape.destinationToken,
         mode: destinationCreateFields.mode,

package/src/apps/management/routes/billing.ts

@@ -699,7 +699,7 @@ export function billing() {
       Auth.policy({
         apiKey: false,
         mpp: false,
-        public: { rateLimit: { perMinute: 600 } },
+        public: { rateLimit: { limit: 600, period: 'minute' } },
         session: false,
       }),
       OpenApi.describeRoute({ hide: true, summary: 'Stripe webhook' }),

package/src/apps/management/routes/faucet.ts

@@ -10,8 +10,8 @@ import * as Value from '../../../internal/Value.js'
 import * as Viem from '../../../internal/Viem.js'
 import type { Environment } from '../App.js'
 
-const addressRateLimit = { perMinute: 1 } satisfies RateLimit.Limit
-const userRateLimit = { perMinute: 3 } satisfies RateLimit.Limit
+const addressRateLimit = { limit: 1, period: 'minute' } satisfies RateLimit.Limit
+const userRateLimit = { limit: 3, period: 'minute' } satisfies RateLimit.Limit
 
 /** OpenAPI schemas owned by the sandbox faucet. */
 export namespace schema {

package/src/apps/management/routes/me.test.ts

@@ -1,7 +1,10 @@
 import { serve } from '@hono/node-server'
 import * as Accounts from 'accounts/server'
 import { exportJWK, generateKeyPair } from 'jose'
+import { P256 } from 'ox'
 import { generatePrivateKey, privateKeyToAccount } from 'viem/accounts'
+import { Account } from 'viem/tempo'
+import { tempoTestnet } from 'viem/tempo/chains'
 
 import * as TestApp from '../../../../test/App.js'
 import * as Me from './me.js'
@@ -18,6 +21,34 @@ function createApp() {
   })
 }
 
+describe('SIWE verification', () => {
+  test('surfaces configured RPC failures as dependency errors', async () => {
+    const account = Account.fromHeadlessWebAuthn(P256.randomPrivateKey(), {
+      origin,
+      rpId: 'localhost',
+    })
+    let chainId_seen: number | undefined
+    const app = TestApp.create({
+      rpc: ({ chainId }) => {
+        chainId_seen = chainId
+        return { url: 'http://127.0.0.1:1' }
+      },
+    })
+
+    const { verifyResponse } = await TestApp.signIn(app, account, {
+      chainId: tempoTestnet.id,
+    })
+
+    expect(verifyResponse.status).toBe(502)
+    expect(chainId_seen).toMatchInlineSnapshot(`42431`)
+    expect(await verifyResponse.json()).toMatchInlineSnapshot(`
+      {
+        "error": "signature verification unavailable",
+      }
+    `)
+  })
+})
+
 describe('GET /me', () => {
   test('returns the signed-in user', async () => {
     const app = createApp()

package/src/apps/mcp.ts

@@ -138,7 +138,10 @@ export function mcp(options: mcp.Options) {
   const app = new Hono<App.Environment>()
     .post(
       '/mcp',
-      Auth.policy({ apiKey: { scopes: [] }, public: { rateLimit: { perMinute: 100 } } }),
+      Auth.policy({
+        apiKey: { scopes: [] },
+        public: { rateLimit: { limit: 100, period: 'minute' } },
+      }),
       OpenApi.describeRoute({
         description:
           "A stateless streamable-HTTP MCP server: send JSON-RPC 2.0 messages as `POST` with `Accept: application/json, text/event-stream`. Tools mirror the API's data domain, plus `docs_*` documentation search. Anonymous requests allow 100 requests per minute; send `Authorization: Bearer <api key>` for protected tools.",

package/src/apps/mpp/Mpp.test.ts

@@ -91,6 +91,17 @@ describe('MPP relay', () => {
     expect(await response.json()).toEqual({ success: true })
   })
 
+  test('verifies a zero-amount proof credential', async () => {
+    const app = TestApp.create({ auth: { keys: [key] } })
+    const input = await credential({ amount: '0' })
+    const response = await post(app, '/v1/mpp/validate', input)
+
+    expect(payloadType(input)).toBe('proof')
+    expect(input.source).toBeDefined()
+    expect(response.status).toBe(200)
+    expect(await response.json()).toEqual({ success: true })
+  })
+
   test('validates and finalizes a pushed credential without a second submission', async () => {
     const app = TestApp.create({ auth: { keys: [key] } })
     const input = await credential({ mode: 'push', supportedModes: ['push'] })
@@ -619,7 +630,7 @@ type CredentialPayload = { hash?: string; type?: unknown }
 
 async function credential(options: credential.Options = {}): Promise<Mpp.RelayInput> {
   const issuer = createIssuer(options)
-  const challenge = await issuer.challenge.tempo.charge({ amount: '1' })
+  const challenge = await issuer.challenge.tempo.charge({ amount: options.amount ?? '1' })
   const authorization = await createClient(options).createCredential(
     new Response(null, {
       headers: { 'www-authenticate': Mppx.Challenge.serialize(challenge) },
@@ -631,6 +642,7 @@ async function credential(options: credential.Options = {}): Promise<Mpp.RelayIn
 
 declare namespace credential {
   type Options = {
+    amount?: string | undefined
     feePayer?: boolean | undefined
     mode?: 'pull' | 'push' | undefined
     supportedModes?: ('pull' | 'push')[] | undefined

package/src/apps/mpp/Mpp.ts

@@ -67,6 +67,8 @@ export type RelayInput = {
   challenge: Challenge
   /** Method-specific MPP credential payload. */
   payload: unknown
+  /** Optional payer identifier supplied with the credential. */
+  source?: string | undefined
 }
 
 /** Broadcast MPP payment receipt. */
@@ -200,6 +202,12 @@ export namespace schema {
           z.describe('The method-specific MPP credential payload.'),
           z.meta({ examples: [{ signature: `0x${'aa'.repeat(65)}`, type: 'transaction' }] }),
         ),
+      source: z
+        .optional(z.string())
+        .check(
+          z.describe('An optional payer identifier supplied with the credential.'),
+          z.meta({ examples: ['did:pkh:eip155:4217:0x1234567890abcdef1234567890abcdef12345678'] }),
+        ),
     }),
     'An MPP payment credential and its challenge.',
   )

package/src/apps/mpp/internal/Adapter.ts

@@ -49,7 +49,7 @@ export function create(options: create.Options): Adapter {
   /** Validates and screens a credential, rejecting when either check fails. */
   async function validateOrThrow(input: Mpp.RelayInput) {
     const result = await time('mpp_validate', () =>
-      Mppx.Method.validateCredential(methods, Mppx.Credential.from(input)),
+      Mppx.Method.validateCredential(methods, credential(input)),
     )
     await time('mpp_screen', () => screenManager.screen(Utils.addresses(result)))
   }
@@ -65,7 +65,7 @@ export function create(options: create.Options): Adapter {
       try {
         await validateOrThrow(input)
         const result = await time('mpp_broadcast', () =>
-          Mppx.Method.broadcastCredential(methods, Mppx.Credential.from(input)),
+          Mppx.Method.broadcastCredential(methods, credential(input)),
         )
         return {
           receipt: {
@@ -91,6 +91,14 @@ export function create(options: create.Options): Adapter {
   }
 }
 
+function credential(input: Mpp.RelayInput) {
+  return Mppx.Credential.from({
+    challenge: input.challenge,
+    payload: input.payload,
+    ...(input.source === undefined ? {} : { source: input.source }),
+  })
+}
+
 export declare namespace create {
   /** Dependencies used to validate and broadcast Tempo credentials. */
   type Options = {

package/src/db/Db.test.ts

@@ -5,6 +5,7 @@ import * as Runtime from '../../test/runtime.js'
 import * as Db from './Db.js'
 import * as Invitations from './tables/invitations.js'
 import * as Organizations from './tables/organizations.js'
+import * as WebhookSubscriptions from './tables/webhookSubscriptions.js'
 
 const create = () => Db.postgres({ connectionString: Runtime.postgresUrl, schema: `t_${nanoid()}` })
 
@@ -39,14 +40,47 @@ describe('postgres', () => {
     await db.close()
   })
 
-  test('behavior: concurrent migrate tolerates the ledger race', async () => {
+  test('behavior: defers schema creation until migration', async () => {
     const schema = `t_${nanoid()}`
-    // Pre-create the schema so concurrent migrate races only on the
-    // `migrations` ledger, not `CREATE SCHEMA`.
-    const seed = Db.postgres({ connectionString: Runtime.postgresUrl, schema })
-    await Organizations.get(seed, 'x').catch(() => {})
-    await seed.close()
+    const db = Db.postgres({ connectionString: Runtime.postgresUrl, schema })
+    const exists = async () =>
+      (
+        await sql<{
+          exists: boolean
+        }>`SELECT EXISTS (SELECT 1 FROM pg_namespace WHERE nspname = ${schema}) AS exists`.execute(
+          db.kysely,
+        )
+      ).rows[0]!.exists
+
+    await sql`SELECT 1`.execute(db.kysely)
+    expect(await exists()).toBe(false)
+    await db.migrate()
+    expect(await exists()).toBe(true)
+    await db.close()
+  })
+
+  test('behavior: qualifies repository queries with the configured schema', async () => {
+    const db = Db.postgres({
+      connectionString: Runtime.postgresUrl,
+      schema: `t_MixedCase_${nanoid()}`,
+    })
+    await sql`SET search_path TO public`.execute(db.kysely)
+    await db.migrate()
+    await sql`SET search_path TO public`.execute(db.kysely)
+    await db.transaction(async (tx) => {
+      await Organizations.create(tx, { id: 'org_qualified', name: 'Qualified' })
+    })
+    expect((await Organizations.get(db, 'org_qualified'))?.name).toBe('Qualified')
+    expect(
+      await WebhookSubscriptions.compareAndSetCursors(db, {
+        cursors: [{ cursor: 'next', expectedCursor: null, subscriptionId: 'wh_missing' }],
+      }),
+    ).toEqual(new Set())
+    await db.close()
+  })
 
+  test('behavior: concurrent migrate tolerates the ledger race', async () => {
+    const schema = `t_${nanoid()}`
     // Several runners migrate the same fresh schema at once (mirrors parallel
     // deploys). The session advisory lock serializes them; none throw.
     const dbs = Array.from({ length: 5 }, () =>

package/src/db/Db.ts

@@ -7,6 +7,7 @@ import {
   PostgresDialect,
   type RawBuilder,
   sql,
+  WithSchemaPlugin,
 } from 'kysely'
 import * as pg from 'pg'
 
@@ -35,6 +36,7 @@ import type * as Users from './tables/users.js'
 import type * as VerifiedTokenRequests from './tables/verifiedTokenRequests.js'
 import type * as VerifiedTokens from './tables/verifiedTokens.js'
 import type * as WebhookDeliveries from './tables/webhookDeliveries.js'
+import type * as WebhookQueueEvents from './tables/webhookQueueEvents.js'
 import type * as WebhookSubscriptions from './tables/webhookSubscriptions.js'
 
 /**
@@ -81,6 +83,7 @@ export type Database = {
   verified_token_requests: VerifiedTokenRequests.Table
   verified_tokens: VerifiedTokens.Table
   webhook_deliveries: WebhookDeliveries.Table
+  webhook_queue_events: WebhookQueueEvents.Table
   webhook_subscriptions: WebhookSubscriptions.Table
 }
 
@@ -1280,6 +1283,85 @@ export const migrations: readonly Migration[] = [
         .on('fundingDepositAddresses')
         .columns(['orgId', 'environment', 'address', 'projectId']),
   },
+  {
+    name: '0115_webhook_queue_events',
+    up: (db) =>
+      db.schema
+        .createTable('webhookQueueEvents')
+        .ifNotExists()
+        .addColumn('subscriptionId', 'text', (c) =>
+          c.notNull().references('webhookSubscriptions.id').onDelete('cascade'),
+        )
+        .addColumn('eventId', 'text', (c) => c.notNull())
+        .addColumn('envelope', 'jsonb', (c) => c.notNull())
+        .addColumn('createdAt', 'text', (c) => c.notNull())
+        .addColumn('expiresAt', 'text', (c) => c.notNull())
+        .addPrimaryKeyConstraint('webhook_queue_events_pkey', ['subscriptionId', 'eventId']),
+  },
+  {
+    name: '0116_webhook_queue_events_expires_index',
+    up: (db) =>
+      db.schema
+        .createIndex('webhook_queue_events_expires_idx')
+        .ifNotExists()
+        .on('webhookQueueEvents')
+        .column('expiresAt'),
+  },
+  {
+    name: '0117_webhook_queue_events_ledger_columns',
+    up: (db) =>
+      raw(
+        db,
+        sql`ALTER TABLE webhook_queue_events
+          ADD COLUMN IF NOT EXISTS status text NOT NULL DEFAULT 'pending',
+          ADD COLUMN IF NOT EXISTS attempt_count integer NOT NULL DEFAULT 0,
+          ADD COLUMN IF NOT EXISTS attempting_at text,
+          ADD COLUMN IF NOT EXISTS next_attempt_at text`,
+      ),
+  },
+  {
+    name: '0118_webhook_queue_events_status_check',
+    up: (db) =>
+      raw(
+        db,
+        sql`ALTER TABLE webhook_queue_events DROP CONSTRAINT IF EXISTS webhook_queue_events_status_check, ADD CONSTRAINT webhook_queue_events_status_check CHECK (status IN ('failed', 'pending', 'skipped', 'succeeded'))`,
+      ),
+  },
+  {
+    name: '0119_webhook_queue_events_pending_index',
+    up: (db) =>
+      // NULLS FIRST matches the due-sweep order (null = due immediately);
+      // INCLUDE lets the pending gauge take min(created_at) index-only.
+      raw(
+        db,
+        sql`CREATE INDEX IF NOT EXISTS webhook_queue_events_pending_idx ON webhook_queue_events (next_attempt_at NULLS FIRST) INCLUDE (created_at) WHERE status = 'pending'`,
+      ),
+  },
+  {
+    name: '0120_webhook_queue_events_pending_index_drop',
+    up: (db) => raw(db, sql`DROP INDEX IF EXISTS webhook_queue_events_pending_idx`),
+  },
+  {
+    name: '0121_webhook_queue_events_pending_index_expiry',
+    up: (db) =>
+      // Recreated with expires_at so claimable and gauge queries, which all
+      // filter expiry at query time, stay index-only.
+      raw(
+        db,
+        sql`CREATE INDEX IF NOT EXISTS webhook_queue_events_pending_idx ON webhook_queue_events (next_attempt_at NULLS FIRST) INCLUDE (created_at, expires_at) WHERE status = 'pending'`,
+      ),
+  },
+  {
+    name: '0122_webhook_queue_events_expired_pending_cleanup',
+    up: (db) =>
+      // Pre-ledger rows already past their staging TTL were dead under the
+      // old read path; pending rows no longer expire, so drop them once
+      // instead of resurrecting them as eternal obligations.
+      raw(
+        db,
+        sql`DELETE FROM webhook_queue_events WHERE status = 'pending' AND attempting_at IS NULL AND expires_at <= to_char(now() AT TIME ZONE 'utc', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"')`,
+      ),
+  },
 ]
 
 /**
@@ -1301,6 +1383,15 @@ function raw(db: Kysely<Database>, statement: RawBuilder<unknown>) {
  * @returns The database.
  */
 export function from(dialect: Dialect): Db {
+  return fromDialect(dialect)
+}
+
+/** Builds a database with internal dialect-specific options. */
+function fromDialect(dialect: Dialect, options: fromDialect.Options = {}): Db {
+  const root = new Kysely<Database>({ dialect, plugins: [new CamelCasePlugin()] })
+  // Qualify repository queries instead of relying on session search_path;
+  // transaction poolers reset session state between statements.
+  const kysely = options.schema ? root.withPlugin(new WithSchemaPlugin(options.schema)) : root
   // Builds Db over a top-level Kysely handle or transaction-scoped Kysely handle.
   function build(kysely: Kysely<Database>): Db {
     // Prevents same-handle nested transactions from deadlocking capped pools.
@@ -1314,9 +1405,19 @@ export function from(dialect: Dialect): Db {
       async migrate() {
         // A session advisory lock serializes the full run, including bootstrap
         // DDL and ledger inserts. Pin one connection and unlock in `finally`.
-        await kysely.connection().execute(async (db) => {
+        await root.connection().execute(async (db) => {
           await sql`SELECT pg_advisory_lock(${migrateLockKey})`.execute(db)
           try {
+            if (options.schema) {
+              await db.executeQuery(
+                CompiledQuery.raw(
+                  `CREATE SCHEMA IF NOT EXISTS ${pg.escapeIdentifier(options.schema)}`,
+                ),
+              )
+              await sql`SELECT set_config('search_path', quote_ident(${options.schema}), false)`.execute(
+                db,
+              )
+            }
             await sql`CREATE TABLE IF NOT EXISTS migrations (name TEXT PRIMARY KEY, checksum TEXT NOT NULL, applied_at TEXT NOT NULL)`.execute(
               db,
             )
@@ -1378,12 +1479,20 @@ export function from(dialect: Dialect): Db {
       },
     }
   }
-  return build(new Kysely<Database>({ dialect, plugins: [new CamelCasePlugin()] }))
+  return build(kysely)
+}
+
+declare namespace fromDialect {
+  /** Internal database construction options. */
+  type Options = {
+    /** Schema that Kysely qualifies on every repository query. */
+    schema?: string | undefined
+  }
 }
 
 /**
  * Creates a Postgres-backed {@link Db} via Kysely's `PostgresDialect`. Optional
- * `schema` scopes every pooled connection and caps the pool for test isolation.
+ * `schema` qualifies repository queries, scopes migrations, and caps the pool.
  *
  * @param options - Postgres options.
  * @returns The database.
@@ -1391,21 +1500,7 @@ export function from(dialect: Dialect): Db {
 export function postgres(options: postgres.Options): Db {
   const { connectionString, schema } = options
   const pool = new pg.Pool(schema ? { connectionString, max: 1 } : { connectionString })
-  return from(
-    new PostgresDialect({
-      pool,
-      ...(schema
-        ? {
-            onCreateConnection: async (connection) => {
-              await connection.executeQuery(
-                CompiledQuery.raw(`CREATE SCHEMA IF NOT EXISTS "${schema}"`),
-              )
-              await connection.executeQuery(CompiledQuery.raw(`SET search_path TO "${schema}"`))
-            },
-          }
-        : {}),
-    }),
-  )
+  return fromDialect(new PostgresDialect({ pool }), { schema })
 }
 
 export declare namespace postgres {
@@ -1413,7 +1508,7 @@ export declare namespace postgres {
   type Options = {
     /** Postgres connection string (`postgresql://…`). */
     connectionString: string
-    /** Schema to create and scope the session to (isolates concurrent tests). */
+    /** Schema to qualify and create during migration (isolates concurrent tests). */
     schema?: string | undefined
   }
 }

package/src/db/Schema.ts

@@ -874,3 +874,35 @@ export const WebhookDelivery = z.object({
 
 /** Columns of the `webhook_deliveries` table. */
 export type WebhookDelivery = z.output<typeof WebhookDelivery>
+
+/** A durable webhook envelope staged before its compact Queue reference is admitted. */
+export const WebhookQueueEvent = z.object({
+  attemptCount: z.number().check(z.describe('Delivery attempts claimed so far.')),
+  attemptingAt: z
+    .nullable(z.string())
+    .check(z.describe('ISO timestamp of the current claim, or null when unclaimed.')),
+  createdAt: z.string().check(z.describe('ISO timestamp when the envelope was staged.')),
+  envelope: z
+    .custom<Webhooks.Envelope>()
+    .check(z.describe('The full webhook envelope retained outside Cloudflare Queues.')),
+  eventId: z.string().check(z.describe('Idempotent event id (`evt_...`).')),
+  expiresAt: z
+    .string()
+    .check(
+      z.describe(
+        'ISO dedupe retention deadline, restarted at terminal transitions; inert while pending.',
+      ),
+    ),
+  nextAttemptAt: z
+    .nullable(z.string())
+    .check(z.describe('ISO retry due time, or null when due immediately.')),
+  status: z
+    .enum(['failed', 'pending', 'skipped', 'succeeded'])
+    .check(z.describe('Delivery-obligation lifecycle status.')),
+  subscriptionId: z
+    .string()
+    .check(z.describe('Owning subscription id (`wh_...`); FK with `ON DELETE CASCADE`.')),
+})
+
+/** Columns of the `webhook_queue_events` table. */
+export type WebhookQueueEvent = z.output<typeof WebhookQueueEvent>

package/src/db/tables/sponsoredTransactions.ts

@@ -1,4 +1,4 @@
-import type { ExpressionBuilder, Selectable, SqlBool } from 'kysely'
+import type { ExpressionBuilder, Selectable } from 'kysely'
 import { sql } from 'kysely'
 
 import * as Id from '../../internal/Id.js'
@@ -222,7 +222,14 @@ export async function assignTransactionHash(
         .where('status', '=', record.status)
         .where('transactionHash', 'is', null)
       if (record.status === 'failed')
-        query = query.where(sql<SqlBool>`exists (select 1 from organizations where organizations.id = sponsored_transactions.org_id)`) // prettier-ignore
+        query = query.where((eb) =>
+          eb.exists(
+            eb
+              .selectFrom('organizations')
+              .select('organizations.id')
+              .whereRef('organizations.id', '=', 'sponsored_transactions.orgId'),
+          ),
+        )
       const updated = await query.executeTakeFirst()
       if (updated.numUpdatedRows === 0n) return
       if (record.status === 'failed' && record.billable && limit) {