[silvertakana]

Replacement for #513, which supersedes it. The original PR is left open and untouched.

The original branch held four commits, but three of them are already in main through #505 (4d5c1453, 84a81f23, 2466d8be) and only cfc6e864 is unique to it. This branch therefore carries exactly that one commit, replayed onto current main (c7db26fe). Re-applying the three older commits would have made things worse, not better: main already has const result = await verifyCrossServiceSignature(...), while 4d5c1453 carries it un-awaited, so cherry-picking it would regress main.

An in-place update of #513 is not possible without a force-push, for the same reason as #511: the branch is not patch-equivalent to a main that has since advanced by squash commits.

What it fixes

The database migration that adds the replay-protection table could not be run twice: a second attempt failed instead of doing nothing. It is now safe to re-run, so a deployment that was interrupted partway through the migration can simply try again.

Why it matters

Migrations get re-run in practice (a failed deploy, a retried pipeline, a fresh environment). A migration that cannot be re-run turns a small interruption into a manual database cleanup.

How the commits map

Original	On this branch
cfc6e864 make the nonce migration idempotent	88fd953e
—	5f99e550 chore(release): bump version to 2.68.13 (main is at 2.68.9)

The old note "builds on #505 and must not merge before it" is obsolete: #505 is already in main, and main's cross-service code files (middleware.ts, verify.ts, nonceCache.ts, types.ts, service/tier/route.ts) are byte-identical to what the original branch carried.

Files changed (2 files, +18 / -4)

• package.json
• prisma/migrations/20260915170000_add_cross_service_nonce/migration.sql

CREATE TABLE IF NOT EXISTS and CREATE INDEX IF NOT EXISTS make a second prisma migrate deploy a no-op rather than a 42P07 failure.

Gate results (local, this branch)

Gate	Result
pnpm test	164 files, 1629 tests passed
pnpm exec tsc --noEmit	clean
pnpm lint + pnpm check:demo-gates	clean
pnpm build	clean
Migration Integrity Test (node tests/migration/run.mjs, the workflow that triggers on prisma/migrations/**)	passed, all assertions green, exit 0

On gitleaks: no new allowlist entries were added here. The flagged generic-api-key finding traces to commit 4d5c1453 introducing a dummy 32-character fixture secret, which #505 already fixed on main by rotating the fixture and adding the fingerprint to .gitleaksignore. This branch does not contain 4d5c1453 at all, so the finding cannot fire from it.

A green check here still does not prove the migration re-runs cleanly against a real production database; the local run above exercises a throwaway Postgres 16 instance built the same way the CI workflow builds it.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!