feat: require SIWE auth for Planet upgrades

[AstralEX1]

Summary

• add minimal viem SIWE challenge verification with one-time PostgreSQL nonces
• issue a short-lived signed HttpOnly __Host- session cookie
• require the authenticated wallet to match expectedAddress
• check Planet ownership inside the existing locked economy transaction
• keep MINERAL_UPGRADES_ENABLED as the production kill switch

Verification

• pnpm db:generate
• pnpm db:validate
• pnpm lint
• pnpm typecheck
• pnpm test — 91 files, 403 tests, including 14 PostgreSQL concurrency tests
• pnpm --filter @megaplanets/planet-generator golden — 26 tests
• pnpm build
• disposable PostgreSQL migration deploy — 14 migrations, no pending migrations
• Vercel Preview build — READY

Rollout

• Configure production-only SIWE_ORIGIN and SIWE_SESSION_SECRET
• Keep production MINERAL_UPGRADES_ENABLED=false
• Apply 20260821173000_siwe_nonces to the production database
• Merge and verify the production deployment with upgrades still disabled
• Enable upgrades only after authenticated owner smoke verification

Rate limiting for the SIWE/upgrade routes, session rotation/revocation, and cross-origin auth are intentionally deferred.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
megastera	Ready	Preview	Aug 21, 2026 3:13pm