fix(withdraw): gate balance increment on event INSERT rowcount to prevent double-counting

.github/SECURITY_SETUP_CHECKLIST.md

@@ -1,6 +1,6 @@
 # GitHub Security Setup Checklist
 
-This checklist helps ensure that GitHub's security features are properly configured for the FlowFi repository.
+This checklist helps repository administrators ensure that GitHub's security features are properly configured for the FlowFi repository. For the canonical security policy (reporting guidelines, supported versions, response timelines), see [SECURITY.md](../SECURITY.md). For the implementation status and next steps, see [SECURITY_IMPLEMENTATION_SUMMARY.md](../SECURITY_IMPLEMENTATION_SUMMARY.md).
 
 ## Repository Security Settings
 

.github/pull_request_template.md

@@ -61,6 +61,7 @@ Closes #
 - [ ] New and existing unit tests pass locally with my changes
 - [ ] Any dependent changes have been merged and published
 - [ ] I have checked for breaking changes and documented them if applicable
+- [ ] If this change adds or modifies a metric, I have updated the Grafana dashboard and the alert rules in `backend/docs/observability/`
 
 ## Additional Notes
 <!-- Any additional information that reviewers should know -->

.github/workflows/ci.yml

@@ -13,6 +13,24 @@ on:
     branches: [main, develop]
 
 jobs:
+  changes:
+    name: Detect changes
+    runs-on: ubuntu-latest
+    outputs:
+      backend: ${{ steps.filter.outputs.backend }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Check changed files
+        id: filter
+        uses: dorny/paths-filter@v3
+        with:
+          filters: |
+            backend:
+              - 'backend/**'
+              - 'package-lock.json'
+
   frontend:
     name: Frontend CI
     runs-on: ubuntu-latest
@@ -34,21 +52,36 @@ jobs:
         run: npm run lint
         working-directory: frontend
 
-      - name: Install Rollup Native Binding
-        run: npm install @rollup/rollup-linux-x64-gnu --no-save
-        working-directory: frontend
-
       - name: Run Frontend Tests
         run: npm run test:coverage
         working-directory: frontend
 
+      - name: Upload frontend coverage to Codecov
+        uses: codecov/codecov-action@v5
+        with:
+          files: frontend/coverage/lcov.info
+          flags: frontend
+          name: frontend-coverage
+          fail_ci_if_error: false
+          verbose: true
+        env:
+          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
+
       - name: Build
         run: npm run build
         working-directory: frontend
 
+      - name: Check frontend bundle size
+        run: bash ./scripts/check-bundle-size.sh
+        working-directory: frontend
+
   backend:
     name: Backend CI
     runs-on: ubuntu-latest
+    needs: changes
+    if: >-
+      github.event_name == 'push' ||
+      needs.changes.outputs.backend == 'true'
     services:
       postgres:
         image: postgres:16-alpine@sha256:e013e867e712fec275706a6c51c966f0bb0c93cfa8f51000f85a15f9865a28cb
@@ -90,8 +123,14 @@ jobs:
         run: npm run build
         working-directory: backend
 
-      - name: Install Rollup Native Binding
-        run: npm install @rollup/rollup-linux-x64-gnu --no-save
+      - name: OpenAPI spec & API types drift check
+        run: |
+          cd backend
+          npm run codegen:openapi
+          cd ../frontend
+          npm run codegen:api-types
+          cd ..
+          git diff --exit-code -- backend/swagger/flowfi.openapi.json frontend/src/lib/api-types.generated.ts
 
       - name: Run Backend Tests
         run: |
@@ -192,6 +231,11 @@ jobs:
         run: cargo test
         working-directory: contracts
 
+      - name: Run Contract Benchmarks
+        run: cargo test --release --test '*' -- --nocapture --test-threads=1
+        working-directory: contracts
+        continue-on-error: true
+
       - name: Cache cargo-tarpaulin
         id: tarpaulin-cache
         uses: actions/cache@v4
@@ -220,9 +264,26 @@ jobs:
 
       - name: Install Stellar CLI
         run: |
-          curl -fsSL https://github.com/stellar/stellar-cli/raw/main/install.sh | sh -s -- --install-deps
-          echo "$HOME/.stellar-cli/bin" >> $GITHUB_PATH
+          set -euo pipefail
+          # Authenticate the release lookup through the runner's token. The
+          # upstream installer queries the unauthenticated GitHub API and can
+          # fail on shared-runner rate limits.
+          mkdir -p "$RUNNER_TEMP/stellar-cli"
+          stellar_cli_tag=$(gh release view --repo stellar/stellar-cli --json tagName --jq .tagName)
+          gh release download "$stellar_cli_tag" \
+            --repo stellar/stellar-cli \
+            --pattern 'stellar-cli-*-x86_64-unknown-linux-gnu.tar.gz' \
+            --dir "$RUNNER_TEMP/stellar-cli" \
+            --clobber
+          tar -xzf "$RUNNER_TEMP/stellar-cli/stellar-cli-"*.tar.gz \
+            -C "$RUNNER_TEMP/stellar-cli"
+          mkdir -p "$HOME/.stellar-cli/bin"
+          mv "$RUNNER_TEMP/stellar-cli/stellar" "$HOME/.stellar-cli/bin/stellar"
+          chmod +x "$HOME/.stellar-cli/bin/stellar"
+          echo "$HOME/.stellar-cli/bin" >> "$GITHUB_PATH"
         shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
 
       - name: Optimize WASM files
         run: |

.github/workflows/deploy-contracts.yml

@@ -0,0 +1,146 @@
+# Contract Deployment Workflow for FlowFi
+#
+# Compiles the Soroban stream contract to optimized WASM, runs contract tests,
+# and deploys + initializes the contract on Stellar Testnet on demand (or on
+# Mainnet for release tags). The resulting contract ID is surfaced in the job
+# summary and published as a release artifact.
+name: Deploy Soroban Contracts
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+    inputs:
+      network:
+        description: "Target network (testnet|mainnet)"
+        required: true
+        default: "testnet"
+        type: choice
+        options:
+          - testnet
+          - mainnet
+
+concurrency:
+  group: ${{ github.workflow }}-${{ inputs.network || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: write
+
+jobs:
+  deploy:
+    name: Build & Deploy stream_contract
+    runs-on: ubuntu-latest
+    environment: ${{ github.event_name == 'release' && 'production' || 'staging' }}
+
+    env:
+      NETWORK: ${{ inputs.network || (github.event_name == 'release' && 'mainnet' || 'testnet') }}
+      DEPLOYER_SECRET: ${{ secrets.DEPLOYER_SECRET }}
+      ADMIN_ADDRESS: ${{ secrets.ADMIN_ADDRESS }}
+      TREASURY_ADDRESS: ${{ secrets.TREASURY_ADDRESS }}
+      FEE_RATE_BPS: ${{ secrets.FEE_RATE_BPS }}
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          toolchain: stable
+          targets: wasm32-unknown-unknown
+          components: rustfmt, clippy
+
+      - name: Rust Cache
+        uses: Swatinem/rust-cache@v2
+        with:
+          workspace: "contracts -> target"
+
+      - name: Install Stellar CLI
+        run: |
+          curl -fsSL https://github.com/stellar/stellar-cli/raw/main/install.sh | sh -s -- --install-deps
+          echo "$HOME/.stellar-cli/bin" >> $GITHUB_PATH
+
+      - name: Run Contract Tests
+        run: cargo test --package stream_contract
+        working-directory: contracts
+
+      - name: Build & Optimize WASM
+        run: |
+          set -euo pipefail
+          cd contracts
+          cargo build --target wasm32-unknown-unknown --release
+          RELEASE_DIR="target/wasm32-unknown-unknown/release"
+          for w in "$RELEASE_DIR"/stream_contract.wasm; do
+            stellar contract optimize --wasm "$w" --wasm-out "$RELEASE_DIR/stream_contract.optimized.wasm"
+          done
+          ls -la "$RELEASE_DIR"/*.wasm
+
+      - name: Inspect Contract Interface & WASM Size
+        run: |
+          set -euo pipefail
+          WASM=contracts/target/wasm32-unknown-unknown/release/stream_contract.optimized.wasm
+          stellar contract inspect --wasm "$WASM"
+          SIZE=$(stat -c%s "$WASM")
+          echo "Optimized WASM size: $SIZE bytes"
+          if [ "$SIZE" -ge 65536 ]; then
+            echo "ERROR: optimized WASM exceeds 64KB budget ($SIZE bytes)"
+            exit 1
+          fi
+          echo "WASM_WASM_PATH=$WASM" >> $GITHUB_ENV
+
+      - name: Deploy & Initialize Contract
+        run: ./scripts/deploy.sh --network "$NETWORK"
+
+      - name: Read Deployed Contract ID
+        id: contract
+        run: |
+          set -euo pipefail
+          CONTRACT_ID=$(jq -r --arg net "$NETWORK" '.[$net].contractId' deployment-info.json)
+          echo "contract_id=$CONTRACT_ID" >> $GITHUB_OUTPUT
+          echo "deployment-json=$(jq -c . deployment-info.json)" >> $GITHUB_OUTPUT
+
+      - name: Emit Deployment Summary
+        if: always()
+        run: |
+          {
+            echo "## Deployment Summary"
+            echo ""
+            echo "- **Network**: \`$NETWORK\`"
+            echo "- **Contract ID**: \`${{ steps.contract.outputs.contract_id }}\`"
+            echo "- **WASM**: \`${{ env.WASM_WASM_PATH }}\`"
+            echo "- **Deployment info**: "
+            echo '```json'
+            echo "${{ steps.contract.outputs.deployment-json }}"
+            echo '```'
+          } >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Upload Optimized WASM Artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: stream-contract-${{ env.NETWORK }}
+          path: contracts/target/wasm32-unknown-unknown/optimized/*.wasm
+          if-no-files-found: error
+
+      - name: Upload Deployment Info
+        uses: actions/upload-artifact@v4
+        with:
+          name: deployment-info-${{ env.NETWORK }}
+          path: deployment-info.json
+          if-no-files-found: error
+
+      - name: Commit Deployment Info
+        if: github.event_name == 'release'
+        env:
+          NETWORK: ${{ env.NETWORK }}
+        run: |
+          set -euo pipefail
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add deployment-info.json
+          if git diff --cached --quiet; then
+            echo "No deployment-info.json changes to commit"
+            exit 0
+          fi
+          git commit -m "chore(contracts): record $NETWORK contract deployment"
+          git push

.github/workflows/pr-preview-cleanup.yml

@@ -0,0 +1,45 @@
+name: PR Preview Cleanup
+
+on:
+  pull_request:
+    types: [closed]
+
+permissions:
+  contents: read
+  pull-requests: write
+  issues: write
+  deployments: write
+
+jobs:
+  cleanup:
+    name: Teardown ephemeral preview
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    env:
+      PR_NUMBER: ${{ github.event.pull_request.number }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Teardown preview resources
+        run: bash scripts/cleanup-preview.sh --pr "$PR_NUMBER"
+        env:
+          FLY_API_TOKEN: ${{ secrets.FLY_API_TOKEN }}
+          NEON_API_KEY: ${{ secrets.NEON_API_KEY }}
+          NEON_PROJECT_ID: ${{ secrets.NEON_PROJECT_ID }}
+          SUPABASE_ACCESS_TOKEN: ${{ secrets.SUPABASE_ACCESS_TOKEN }}
+          SUPABASE_PROJECT_REF: ${{ secrets.SUPABASE_PROJECT_REF }}
+          DATABASE_URL: postgresql://postgres:password@127.0.0.1:5432/flowfi_preview
+
+      - name: Comment teardown notice
+        continue-on-error: true
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const pr = context.payload.pull_request.number;
+            github.rest.issues.createComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: pr,
+              body: `🧹 Preview environment for PR #${pr} has been deallocated (preview app + ephemeral database dropped).`,
+            });