chore: adopt a formatter — fix mangled whitespace, add .editorconfig and SDK lint

.github/workflows/ci.yml

@@ -17,7 +17,7 @@ jobs:
         with:
           node-version: '22'
       - name: Install pnpm
-        run: npm install -g pnpm@9
+        run: npm install -g pnpm@11
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
       - name: Check formatting
@@ -33,7 +33,7 @@ jobs:
         with:
           node-version: '22'
       - name: Install pnpm
-        run: npm install -g pnpm@9
+        run: npm install -g pnpm@11
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
       # Lints apps/web and packages/sdk from the root.
@@ -51,12 +51,16 @@ jobs:
         with:
           node-version: '22'
       - name: Install pnpm
-        run: npm install -g pnpm@9
+        run: npm install -g pnpm@11
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
       - name: Test SDK
         working-directory: ./packages/sdk
         run: pnpm test
+      - name: Verify generated API types are reproducible
+        run: |
+          pnpm --filter @accensa/sdk gen:api
+          git diff --exit-code -- packages/sdk/generated/api-types.ts
       - name: Verify conformance vectors are reproducible
         run: |
           node packages/sdk/scripts/generate-vectors.mjs
@@ -86,7 +90,7 @@ jobs:
         with:
           node-version: '22'
       - name: Install pnpm
-        run: npm install -g pnpm@9
+        run: npm install -g pnpm@11
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
       - name: Test web
@@ -95,6 +99,25 @@ jobs:
           DATABASE_URL: postgres://postgres:password@localhost:5432/accensa_test
         run: pnpm test
 
+  test-reconcile:
+    name: test (reconcile-payments)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+      - name: Install pnpm
+        run: npm install -g pnpm@9
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+      # Unit tests only: synthetic and fixture data, no live RPC or database.
+      # The live reconciliation itself runs on a schedule, in reconcile.yml.
+      - name: Test reconcile-payments
+        working-directory: ./scripts/reconcile-payments
+        run: pnpm test
+
   typecheck:
     name: typecheck
     runs-on: ubuntu-latest
@@ -105,7 +128,7 @@ jobs:
         with:
           node-version: '22'
       - name: Install pnpm
-        run: npm install -g pnpm@9
+        run: npm install -g pnpm@11
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
       # Typechecks apps/web and packages/sdk from the root.
@@ -125,7 +148,7 @@ jobs:
         with:
           node-version: '22'
       - name: Install pnpm
-        run: npm install -g pnpm@9
+        run: npm install -g pnpm@11
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
       - name: Build Next.js app

.github/workflows/reconcile.yml

@@ -0,0 +1,59 @@
+name: Reconcile Payments
+
+# Independent proof that `payments` can be rebuilt from the Stellar ledger
+# alone - see scripts/reconcile-payments/README.md and issue #170. Runs on a
+# schedule and fails loudly on any row-level mismatch. A reconciliation nobody
+# runs is the same as no reconciliation, which is what let a seven-day
+# indexer outage pass unnoticed - see the issue for the full history.
+#
+# Required repository secrets:
+#   DATABASE_URL       same production Postgres connection string the
+#                       indexer uses (apps/web's DATABASE_URL)
+#   MERCHANT_ADDRESS   same merchant Stellar account the indexer watches
+#   STELLAR_RPC_URL    optional; defaults to the public testnet RPC
+#   ASSET_CONTRACT_IDS optional; defaults to apps/web's default SAC
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '30 5 * * *' # daily
+
+concurrency:
+  group: reconcile-payments
+  cancel-in-progress: false
+
+jobs:
+  reconcile:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+      - name: Install pnpm
+        run: npm install -g pnpm@9
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+      - name: Rebuild from chain and diff against production
+        working-directory: ./scripts/reconcile-payments
+        env:
+          MERCHANT_ADDRESS: ${{ secrets.MERCHANT_ADDRESS }}
+          DATABASE_URL: ${{ secrets.DATABASE_URL }}
+          STELLAR_RPC_URL: ${{ secrets.STELLAR_RPC_URL }}
+          ASSET_CONTRACT_IDS: ${{ secrets.ASSET_CONTRACT_IDS }}
+        run: |
+          if [ -z "$MERCHANT_ADDRESS" ] || [ -z "$DATABASE_URL" ]; then
+            echo "::error::MERCHANT_ADDRESS and DATABASE_URL secrets are required."
+            exit 1
+          fi
+          # Full retention window: the RPC does not serve anything older, so
+          # there is nothing beyond this to reconstruct or to fault the tool for.
+          node cli.mjs --merchant "$MERCHANT_ADDRESS" --database-url "$DATABASE_URL" --out report.json
+      - name: Upload report
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: reconcile-payments-report
+          path: scripts/reconcile-payments/report.json
+          retention-days: 30

.github/workflows/stale-check.yml

@@ -0,0 +1,51 @@
+name: Indexer staleness check
+
+# External-of-the-sync check for cursor lag and cessation (issue #90).
+# Runs on its own schedule so that if sync.yml stops being scheduled, this
+# still fires and the failure is visible. Point ALERT_WEBHOOK at Slack /
+# a PagerDuty Events v2 endpoint / Discord so a red run also pages a human;
+# without it the job still fails loudly in the Actions tab.
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '17 */2 * * *'
+
+concurrency:
+  group: indexer-stale-check
+  cancel-in-progress: false
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Poll /api/health
+        env:
+          HEALTH_URL: ${{ secrets.HEALTH_URL }}
+          ALERT_WEBHOOK: ${{ secrets.ALERT_WEBHOOK }}
+        run: |
+          if [ -z "$HEALTH_URL" ]; then echo "HEALTH_URL secret is not set"; exit 1; fi
+
+          resp=$(curl -sS --max-time 30 -w '\n%{http_code}' "$HEALTH_URL" || echo $'\n000')
+          body=$(printf '%s' "$resp" | sed '$d')
+          code=$(printf '%s' "$resp" | tail -n1)
+          echo "HTTP $code"
+          echo "$body"
+
+          status=$(printf '%s' "$body" | grep -oE '"status":"[a-z]+"' | head -1 | cut -d'"' -f4)
+
+          if [ "$code" != "200" ] || [ "$status" = "critical" ]; then
+            msg="Accensa indexer health: HTTP $code status=${status:-unknown}. $body"
+            if [ -n "$ALERT_WEBHOOK" ]; then
+              curl -sS -X POST -H 'Content-Type: application/json' \
+                --data "$(printf '{"text":%s}' "$(printf '%s' "$msg" | python3 -c 'import json,sys;print(json.dumps(sys.stdin.read()))')")" \
+                "$ALERT_WEBHOOK" || true
+            fi
+            echo "::error::$msg"
+            exit 1
+          fi
+
+          if [ "$status" = "warn" ]; then
+            echo "::warning::indexer health is 'warn' — cursor lag rising, see /api/health"
+          fi
+          echo "indexer health OK"

.github/workflows/sync.yml

@@ -45,20 +45,6 @@ jobs:
           fi
           echo "Unauthenticated GET correctly rejected with 401."
 
-          # Regression probe: with CRON_SECRET unset, `Bearer ${CRON_SECRET}`
-          # used to render as the literal string "Bearer undefined", and a
-          # caller sending that exact header compared equal and bypassed
-          # auth. The no-header check above can't catch this - it never sends
-          # a header at all.
-          code=$(curl -sS --max-time 60 -o /dev/null -w '%{http_code}' \
-            -H "Authorization: Bearer undefined" "$SYNC_URL")
-          if [ "$code" != "401" ]; then
-            echo "::error::GET with 'Authorization: Bearer undefined' returned HTTP $code," \
-                 "expected 401. The unset-CRON_SECRET bypass has regressed."
-            exit 1
-          fi
-          echo "'Authorization: Bearer undefined' correctly rejected with 401."
-
       - name: Call sync endpoint in a loop
         env:
           SYNC_URL: ${{ secrets.SYNC_URL }}
@@ -105,6 +91,15 @@ jobs:
               echo "::warning::Cursor fell outside RPC retention; $skipped ledgers skipped."
             fi
 
+            echo "Delivering queued payment webhooks..."
+            webhook_url="${SYNC_URL%/sync}/webhooks/deliver"
+            webhook_response=$(curl -sS --max-time 30 -w '\n%{http_code}' \
+              -H "Authorization: Bearer $CRON_SECRET" "$webhook_url" || echo "curl failed")
+            webhook_body=$(printf '%s' "$webhook_response" | sed '$d')
+            webhook_code=$(printf '%s' "$webhook_response" | tail -n1)
+            echo "webhook HTTP $webhook_code"
+            echo "$webhook_body"
+
             echo "Sleeping for 5 minutes..."
             sleep 300
           done

.github/workflows/visual.yml

@@ -0,0 +1,50 @@
+name: Visual regression
+
+on:
+  pull_request:
+    branches: ['main']
+    paths:
+      - 'apps/web/**'
+      - '.github/workflows/visual.yml'
+  push:
+    branches: ['main']
+    paths:
+      - 'apps/web/**'
+      - '.github/workflows/visual.yml'
+
+jobs:
+  visual:
+    name: playwright (web)
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    defaults:
+      run:
+        working-directory: ./apps/web
+    steps:
+      - uses: actions/checkout@v4
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+      - name: Install pnpm
+        run: npm install -g pnpm@9
+        working-directory: .
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+        working-directory: .
+      - name: Install Playwright Chromium
+        run: pnpm exec playwright install --with-deps chromium
+      - name: Run visual tests
+        env:
+          JWT_SECRET_KEY: visual-regression-test-secret
+          CI: true
+        run: pnpm test:visual
+      - name: Upload failure snapshots
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: playwright-visual-diff
+          path: |
+            apps/web/e2e/__screenshots__
+            apps/web/test-results
+          if-no-files-found: ignore

.gitignore

@@ -19,6 +19,13 @@ dist/
 # full copies of the tree.
 .claude/
 
+# Local scratch: PR bodies passed to `gh pr create --body-file`, issue dumps,
+# one-off fix scripts. See CONTRIBUTING.md — keep these under .scratch/ so they
+# never end up tracked at the repo root (body.txt / issues.json did once).
+.scratch/
+/body.txt
+/issues.json
+
 # This is a pnpm workspace; pnpm-lock.yaml is the only lockfile.
 # Stray npm/yarn lockfiles drift from it and change which package manager
 # Vercel detects for a project.

CONTRIBUTING.md

@@ -11,6 +11,16 @@ We welcome contributions from the community! Whether it's a bug fix, new feature
 5. **Create a new branch** for your feature or bug fix (`git checkout -b feature/my-new-feature` or `bugfix/issue-123`).
 6. **Make your changes** and test them thoroughly.
 
+## Scratch files
+
+Anything that is tooling residue rather than part of the project — a PR body you
+passed to `gh pr create --body-file`, a dump of issue data, a one-off migration
+or fix script — goes under `.scratch/` at the repo root. That directory is
+`.gitignore`d, so it cannot be committed by accident.
+
+`body.txt` and `issues.json` were both tracked at the repo root once. Do not
+re-create that: if you need a file like that, put it in `.scratch/`.
+
 ## Code Style
 
 This project uses [Prettier](https://prettier.io/) for code formatting. Before committing, run: