chore(deps): bump @effectstream/* 0.200.2 -> 0.200.6 on ledger-v9 (carries the trustProxy fix)

[acedward]

Bumps every @effectstream/* dependency pinned at 0.200.2 to 0.200.6 across the ledger-v9 line, and regenerates bun.lock. Base: ledger-v9 @ bd0cde7 (the merge of #74).

Why 0.200.6

0.200.6 is the first 0.200.x release that carries the runtime trust-proxy fix — EFFECTSTREAM_TRUST_PROXY / parseTrustProxy(), effectstream #925. Verified against the published tarballs rather than assumed: the published 0.200.x runtimes are 0.200.1, 0.200.2, 0.200.4, 0.200.5, 0.200.6 (there is no .3); 0.200.4 and 0.200.5 still build Fastify with no trustProxy, and only 0.200.6 has

• @effectstream/runtime/src/api/http-server.ts:203 — trustProxy: parseTrustProxy(ENV.EFFECTSTREAM_TRUST_PROXY)
• @effectstream/utils/src/config.ts:210 — the EFFECTSTREAM_TRUST_PROXY config entry

Without it, request.ip is nginx for every caller, so all clients behind the proxy share one rate-limit bucket and #74's API_RATE_LIMIT_MAX default of 600/min only raises the ceiling for the proxy itself. This bump is what makes the ledger-v9 half of that fix actually per-client.

Pins

16 @effectstream packages, 11 manifests, 30 dependency lines, all 0.200.2 → 0.200.6:

wallets (docs) · celestia · midnight-contracts · orchestrator (root) · batcher-sdk · utils · runtime · db · config · sm · concise · coroutine · log · npm-midnight-indexer · npm-midnight-node · npm-midnight-proof-server

Each was confirmed to exist at 0.200.6 with npm view @effectstream/<name>@0.200.6 version before the bump — all 16 resolve, none missing.

@effectstream/mip-zswap-offer stays at 0.4.0-v9.0 (ledger-v9 contract artifact, versioned independently) — 6 lines deliberately untouched.

Lockfile assertions

Assertion	Result
grep -c ledger-v8 bun.lock	0 (also 0 before — this line was already clean)
@effectstream/*@0.103 in bun.lock	0; no 0.103 substring anywhere
@effectstream/*@0.200.2 in bun.lock	0; no 0.200.2 substring anywhere. 0.200.6: 50 occurrences, exactly the 50 that were 0.200.2
lockfile diff scope	106 changed lines, 100 of them @effectstream; the other 6 are the single third-party move below
bun install --frozen-lockfile on a fresh clone of this commit	passes, tree stays clean — CI's install step will not fight the lockfile

Resolved midnight wallet-sdk set matches @effectstream/midnight-contracts@0.200.6's requirements and is unchanged from 0.200.2 — npm view ... dependencies for the two versions is identical except the contracts package's own @effectstream/utils pin:

wallet-sdk-facade 5.0.0-beta.2 · wallet-sdk-dust-wallet 5.0.0-beta.2 · wallet-sdk-shielded 4.0.0-beta.2 · wallet-sdk-unshielded-wallet 4.0.0-beta.2 · wallet-sdk-capabilities 4.0.0-beta.2 · wallet-sdk-address-format 4.0.0-beta.2 · wallet-sdk-hd 3.1.0-beta.1 · wallet-sdk-abstractions 3.0.0-beta.0 · @midnightntwrk/ledger-v9 1.0.0-rc.3 · onchain-runtime-v4 4.0.0-rc.3 · midnight-js 5.0.0-beta.6

No midnight version moves with this bump.

The one third-party move: ntp-time-sync 0.5.0 → 0.6.0

Transitive @effectstream/sync tightened ntp-time-sync from ^0.5.0 to an exact 0.6.0 between the two releases, which also pulls ntp-packet-parser 0.5.0 → 0.6.1. That trips the deliberate pin guard in packages/tests/grand-e2e/lib/solver-offerfiles-real-ntp-responder.test.ts (expect(ntpPackageManifest.version).toBe("0.5.0")) — which is exactly what that guard is for.

The guard is re-pinned to 0.6.0 after checking the new version behaves the same, not instead of checking: the suite passes 12/12 (177 expect) against 0.6.0, including the eight-sample two-round exchange, per-request permit/sent pairing and every harness counter. So ntp-time-sync@0.6.0 is wire-compatible with the E1 responder. Two lines: the assertion and the test title.

Gates

Run in a space-free copy (this workspace's path contains a space — Offer Files issue 00009), host Bun 1.3.11-canary.1; CI pins 1.3.3.

Gate	Result
bun run typecheck (backend + solver + price-feed)	0 diagnostics in all three gates. Out-of-gate dependency diagnostics 23 → 18 — the bump reduces them
bun run check:pgtypes	generated output current, query names unique
bun run check:compact-runtime	compact-runtime invariant OK: @midnight-ntwrk/compact-runtime@0.19.0
full CI unit set (the 11 paths from ci.yml)	1470 pass / 1 fail / 14191 expect, 1471 tests across 112 files
solver-offerfiles-real-ntp-responder.test.ts	12 pass / 0 fail / 177 expect

The single failure is solver-offerfiles-real-image-secret-scan → "handles a large physical inventory and internal-link fanout without process amplification": scanner exit 70, stderr image-secret-scan: fail (link-broken-or-loop-truncated) after ~6 s — a truncated inventory over the 16 000-hardlink fixture, not the 25 s timeout the case guards.

It is not caused by this bump. Run head-to-head against an unmodified ledger-v9 @ bd0cde7 clone with the original lockfile, the same case passed on the first run and failed on the second. Non-deterministic on this macOS host on both trees; CI's Linux runner does not hit it.

trade-data.test.ts "Connection terminated" (the known PGlite flake) did not occur in either full run.

Not a breaking change

Pin-only. No source change outside the two-line test guard, no API, schema or config surface moves. EFFECTSTREAM_TRUST_PROXY defaults to true in the runtime this now pins, which is a behaviour change in the runtime (already flagged on effectstream #925): behind a proxy request.ip becomes the client address instead of the proxy's, which is the entire point. A deployment that wants the old shared-bucket behaviour sets EFFECTSTREAM_TRUST_PROXY=false.

Out of scope, noted

Prose/provenance references to 0.200.2 remain in LEDGER-V9-MIGRATION.md (4), deploy/images/{midnight-node,proof-server,indexer}/Dockerfile (4) and deploy/scripts/lib/pinned-wallet.ts (2). They are historical provenance comments, not pins. The three npm-midnight-* packages have identical dependency sets at both versions, so those comments are not wrong about the binaries — only about which source version was read.

---

Project 00043-rate-limit-shared-bucket, task P6a. Related: #73 (main), #74 (ledger-v9, merged — this PR completes it), effectstream #925 (v-next, the runtime fix) and #926 (midnight-1 port, blocked on the OIDC release port). Draft until the owner wants it merged.