[waleedlatif1]

Summary

• Add seal-account-tokens, a manual-only Trigger.dev task that runs the existing 0037_seal_account_tokens backfill from a worker, which already has the database and the fleet's ENCRYPTION_KEY (no scheduler, no app dispatch; queue concurrency 1, small-1x, 3h max duration, no retries)
• Payload { mode: 'seal' | 'unseal', dryRun, expectedKeyId, batchSize?, pauseMs? }; returns { keyId, scanned, pending, updated, foreignKey } as the run output
• Refuses before connecting when expectedKeyId is not the worker's own derived key id (replaces the CLI's ack env var), and refuses seal while ENCRYPT_ACCOUNT_TOKENS is off on the worker; unseal (the rollback) stays allowed
• Opens its own single postgres.js connection on the same URL the worker's db client resolves: the pass binds JS arrays through the postgres.js tag, which needs the array type map the shared pool skips (fetch_types: false), and it sets no startup search_path, which PgBouncer rejects
• Export isAccountTokenWriteSealingEnabled() from @sim/db/sealed-text so the task checks the same predicate writers use; the script migration stays unregistered from the deploy runner

Type of Change

• New feature

Testing

• background/seal-account-tokens.test.ts (3 tests): key-id mismatch and flag-off seal both reject without opening a connection; unseal with the flag off runs to completion. Each test goes red when its guard is removed
• biome on touched files; type-check, audits, and the full suite run in CI

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Oct 27, 2026 3:01am UTC

[cubic-dev-ai]

All reported issues were addressed across 3 files

<sub>This PR changes a database schema or migrates data. Ultrareviews find 2.4x more serious bugs than standard reviews. Comment @cubic-dev-ai ultrareview to run one.

Turn on auto-fix | Re-trigger cubic</sub>

[greptile-apps]

Confidence Score: 5/5

[Critical impact] The follow-up appears safe to merge, with both previous findings addressed and no new actionable issues found.

Summary

Adds a manual Trigger.dev task to seal or unseal account tokens using the existing backfill.

• Operators can run the account-token seal or rollback pass from Trigger.dev.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Manual task payload] --> B[Check payload and worker key ID]
  B --> C{Seal mode?}
  C -->|Yes| D[Require write sealing enabled]
  C -->|No| E[Open database connection]
  D --> E
  E --> F[Run existing backfill]
  F --> G[Close connection]
  G --> H[Return counts]

Loading

_{Reviews (2) · Last reviewed commit: "fix(db): reject seal-account-tokens payl..." · Reviewed by Greptile}

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 3 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}