@aztec/validator-ha-signer 0.0.1-commit.6d3c34e → 0.0.1-commit.7035c9bd6

package/src/db/types.ts

@@ -1,13 +1,22 @@
-import type { EthAddress } from '@aztec/foundation/eth-address';
+import {
+  BlockNumber,
+  type CheckpointNumber,
+  type IndexWithinCheckpoint,
+  SlotNumber,
+} from '@aztec/foundation/branded-types';
+import { EthAddress } from '@aztec/foundation/eth-address';
 import type { Signature } from '@aztec/foundation/eth-signature';
+import { DutyType } from '@aztec/stdlib/ha-signing';
 
 /**
  * Row type from PostgreSQL query
  */
 export interface DutyRow {
+  rollup_address: string;
   validator_address: string;
   slot: string;
   block_number: string;
+  block_index_within_checkpoint: number;
   duty_type: DutyType;
   status: DutyStatus;
   message_hash: string;
@@ -20,19 +29,34 @@ export interface DutyRow {
 }
 
 /**
- * Row type from INSERT_OR_GET_DUTY query (includes is_new flag)
+ * Plain-primitive representation of a duty record suitable for serialization
+ * (e.g. msgpackr for LMDB). All domain types are stored as their string/number
+ * equivalents. Timestamps are Unix milliseconds.
  */
-export interface InsertOrGetRow extends DutyRow {
-  is_new: boolean;
+export interface StoredDutyRecord {
+  rollupAddress: string;
+  validatorAddress: string;
+  slot: string;
+  blockNumber: string;
+  blockIndexWithinCheckpoint: number;
+  dutyType: DutyType;
+  status: DutyStatus;
+  messageHash: string;
+  signature?: string;
+  nodeId: string;
+  lockToken: string;
+  /** Unix timestamp in milliseconds when signing started */
+  startedAtMs: number;
+  /** Unix timestamp in milliseconds when signing completed */
+  completedAtMs?: number;
+  errorMessage?: string;
 }
 
 /**
- * Type of validator duty being performed
+ * Row type from INSERT_OR_GET_DUTY query (includes is_new flag)
  */
-export enum DutyType {
-  BLOCK_PROPOSAL = 'BLOCK_PROPOSAL',
-  ATTESTATION = 'ATTESTATION',
-  ATTESTATIONS_AND_SIGNERS = 'ATTESTATIONS_AND_SIGNERS',
+export interface InsertOrGetRow extends DutyRow {
+  is_new: boolean;
 }
 
 /**
@@ -43,16 +67,24 @@ export enum DutyStatus {
   SIGNED = 'signed',
 }
 
+// Re-export DutyType from stdlib
+export { DutyType };
+
 /**
- * Record of a validator duty in the database
+ * Rich representation of a validator duty, with branded types and Date objects.
+ * This is the common output type returned by all SlashingProtectionDatabase implementations.
  */
 export interface ValidatorDutyRecord {
+  /** Ethereum address of the rollup contract */
+  rollupAddress: EthAddress;
   /** Ethereum address of the validator */
   validatorAddress: EthAddress;
   /** Slot number for this duty */
-  slot: bigint;
+  slot: SlotNumber;
   /** Block number for this duty */
-  blockNumber: bigint;
+  blockNumber: BlockNumber;
+  /** Block index within checkpoint (0, 1, 2... for block proposals, -1 for other duty types) */
+  blockIndexWithinCheckpoint: number;
   /** Type of duty being performed */
   dutyType: DutyType;
   /** Current status of the duty */
@@ -69,49 +101,151 @@ export interface ValidatorDutyRecord {
   startedAt: Date;
   /** When the duty signing was completed (success or failure) */
   completedAt?: Date;
-  /** Error message if status is 'failed' */
+  /** Error message (currently unused) */
   errorMessage?: string;
 }
 
 /**
- * Minimal info needed to identify a unique duty
+ * Convert a {@link StoredDutyRecord} (plain-primitive wire format) to a
+ * {@link ValidatorDutyRecord} (rich domain type).
+ *
+ * Shared by LMDB and any future non-Postgres backend implementations.
  */
-export interface DutyIdentifier {
+export function recordFromFields(stored: StoredDutyRecord): ValidatorDutyRecord {
+  return {
+    rollupAddress: EthAddress.fromString(stored.rollupAddress),
+    validatorAddress: EthAddress.fromString(stored.validatorAddress),
+    slot: SlotNumber.fromString(stored.slot),
+    blockNumber: BlockNumber.fromString(stored.blockNumber),
+    blockIndexWithinCheckpoint: stored.blockIndexWithinCheckpoint,
+    dutyType: stored.dutyType,
+    status: stored.status,
+    messageHash: stored.messageHash,
+    signature: stored.signature,
+    nodeId: stored.nodeId,
+    lockToken: stored.lockToken,
+    startedAt: new Date(stored.startedAtMs),
+    completedAt: stored.completedAtMs !== undefined ? new Date(stored.completedAtMs) : undefined,
+    errorMessage: stored.errorMessage,
+  };
+}
+
+/**
+ * Duty identifier for block proposals.
+ * blockIndexWithinCheckpoint is REQUIRED and must be >= 0.
+ */
+export interface BlockProposalDutyIdentifier {
+  rollupAddress: EthAddress;
   validatorAddress: EthAddress;
-  slot: bigint;
-  dutyType: DutyType;
+  slot: SlotNumber;
+  /** Block index within checkpoint (0, 1, 2...). Required for block proposals. */
+  blockIndexWithinCheckpoint: IndexWithinCheckpoint;
+  dutyType: DutyType.BLOCK_PROPOSAL;
 }
 
 /**
- * Parameters for checking and recording a new duty
+ * Duty identifier for non-block-proposal duties.
+ * blockIndexWithinCheckpoint is not applicable (internally stored as -1).
  */
-export interface CheckAndRecordParams {
+export interface OtherDutyIdentifier {
+  rollupAddress: EthAddress;
   validatorAddress: EthAddress;
-  slot: bigint;
-  blockNumber: bigint;
-  dutyType: DutyType;
+  slot: SlotNumber;
+  dutyType:
+    | DutyType.CHECKPOINT_PROPOSAL
+    | DutyType.ATTESTATION
+    | DutyType.ATTESTATIONS_AND_SIGNERS
+    | DutyType.GOVERNANCE_VOTE
+    | DutyType.SLASHING_VOTE
+    | DutyType.AUTH_REQUEST
+    | DutyType.TXS;
+}
+
+/**
+ * Minimal info needed to identify a unique duty.
+ * Uses discriminated union to enforce type safety:
+ * - BLOCK_PROPOSAL duties MUST have blockIndexWithinCheckpoint >= 0
+ * - Other duty types do NOT have blockIndexWithinCheckpoint (internally -1)
+ */
+export type DutyIdentifier = BlockProposalDutyIdentifier | OtherDutyIdentifier;
+
+/**
+ * Validates and normalizes the block index for a duty.
+ * - BLOCK_PROPOSAL: validates blockIndexWithinCheckpoint is provided and >= 0
+ * - Other duty types: always returns -1
+ *
+ * @throws Error if BLOCK_PROPOSAL is missing blockIndexWithinCheckpoint or has invalid value
+ */
+export function normalizeBlockIndex(dutyType: DutyType, blockIndexWithinCheckpoint: number | undefined): number {
+  if (dutyType === DutyType.BLOCK_PROPOSAL) {
+    if (blockIndexWithinCheckpoint === undefined) {
+      throw new Error('BLOCK_PROPOSAL duties require blockIndexWithinCheckpoint to be specified');
+    }
+    if (blockIndexWithinCheckpoint < 0) {
+      throw new Error(
+        `BLOCK_PROPOSAL duties require blockIndexWithinCheckpoint >= 0, got ${blockIndexWithinCheckpoint}`,
+      );
+    }
+    return blockIndexWithinCheckpoint;
+  }
+  // For all other duty types, always use -1
+  return -1;
+}
+
+/**
+ * Gets the block index from a DutyIdentifier.
+ * - BLOCK_PROPOSAL: returns the blockIndexWithinCheckpoint
+ * - Other duty types: returns -1
+ */
+export function getBlockIndexFromDutyIdentifier(duty: DutyIdentifier): number {
+  if (duty.dutyType === DutyType.BLOCK_PROPOSAL) {
+    return duty.blockIndexWithinCheckpoint;
+  }
+  return -1;
+}
+
+/**
+ * Additional parameters for checking and recording a new duty
+ */
+interface CheckAndRecordExtra {
+  /** Block number for this duty */
+  blockNumber: BlockNumber | CheckpointNumber;
+  /** The signing root (hash) for this duty */
   messageHash: string;
+  /** Identifier for the node that acquired the lock */
   nodeId: string;
 }
 
 /**
- * Parameters for recording a successful signing
+ * Parameters for checking and recording a new duty.
+ * Uses intersection with DutyIdentifier to preserve the discriminated union.
  */
-export interface RecordSuccessParams {
-  validatorAddress: EthAddress;
-  slot: bigint;
-  dutyType: DutyType;
+export type CheckAndRecordParams = DutyIdentifier & CheckAndRecordExtra;
+
+/**
+ * Additional parameters for recording a successful signing
+ */
+interface RecordSuccessExtra {
   signature: Signature;
   nodeId: string;
   lockToken: string;
 }
 
 /**
- * Parameters for deleting a duty
+ * Parameters for recording a successful signing.
+ * Uses intersection with DutyIdentifier to preserve the discriminated union.
  */
-export interface DeleteDutyParams {
-  validatorAddress: EthAddress;
-  slot: bigint;
-  dutyType: DutyType;
+export type RecordSuccessParams = DutyIdentifier & RecordSuccessExtra;
+
+/**
+ * Additional parameters for deleting a duty
+ */
+interface DeleteDutyExtra {
   lockToken: string;
 }
+
+/**
+ * Parameters for deleting a duty.
+ * Uses intersection with DutyIdentifier to preserve the discriminated union.
+ */
+export type DeleteDutyParams = DutyIdentifier & DeleteDutyExtra;

package/src/errors.ts

@@ -1,6 +1,8 @@
 /**
  * Custom errors for the validator HA signer
  */
+import type { SlotNumber } from '@aztec/foundation/branded-types';
+
 import type { DutyType } from './db/types.js';
 
 /**
@@ -10,8 +12,9 @@ import type { DutyType } from './db/types.js';
  */
 export class DutyAlreadySignedError extends Error {
   constructor(
-    public readonly slot: bigint,
+    public readonly slot: SlotNumber,
     public readonly dutyType: DutyType,
+    public readonly blockIndexWithinCheckpoint: number,
     public readonly signedByNode: string,
   ) {
     super(`Duty ${dutyType} for slot ${slot} already signed by node ${signedByNode}`);
@@ -28,10 +31,12 @@ export class DutyAlreadySignedError extends Error {
  */
 export class SlashingProtectionError extends Error {
   constructor(
-    public readonly slot: bigint,
+    public readonly slot: SlotNumber,
     public readonly dutyType: DutyType,
+    public readonly blockIndexWithinCheckpoint: number,
     public readonly existingMessageHash: string,
     public readonly attemptedMessageHash: string,
+    public readonly signedByNode: string,
   ) {
     super(
       `Slashing protection: ${dutyType} for slot ${slot} was already signed with different data. ` +

package/src/factory.ts

@@ -1,11 +1,17 @@
 /**
  * Factory functions for creating validator HA signers
  */
+import { DateProvider } from '@aztec/foundation/timer';
+import { createStore } from '@aztec/kv-store/lmdb-v2';
+import type { LocalSignerConfig, ValidatorHASignerConfig } from '@aztec/stdlib/ha-signing';
+import { getTelemetryClient } from '@aztec/telemetry-client';
+
 import { Pool } from 'pg';
 
-import type { CreateHASignerConfig } from './config.js';
+import { LmdbSlashingProtectionDatabase } from './db/lmdb.js';
 import { PostgresSlashingProtectionDatabase } from './db/postgres.js';
-import type { CreateHASignerDeps, SlashingProtectionDatabase } from './types.js';
+import { HASignerMetrics } from './metrics.js';
+import type { CreateHASignerDeps, CreateLocalSignerWithProtectionDeps, SlashingProtectionDatabase } from './types.js';
 import { ValidatorHASigner } from './validator_ha_signer.js';
 
 /**
@@ -23,7 +29,6 @@ import { ValidatorHASigner } from './validator_ha_signer.js';
  * ```typescript
  * const { signer, db } = await createHASigner({
  *   databaseUrl: process.env.DATABASE_URL,
- *   enabled: true,
  *   nodeId: 'validator-node-1',
  *   pollingIntervalMs: 100,
  *   signingTimeoutMs: 3000,
@@ -35,23 +40,15 @@ import { ValidatorHASigner } from './validator_ha_signer.js';
  * await signer.stop(); // On shutdown
  * ```
  *
- * Example with automatic migrations (simpler for dev/testing):
- * ```typescript
- * const { signer, db } = await createHASigner({
- *   databaseUrl: process.env.DATABASE_URL,
- *   enabled: true,
- *   nodeId: 'validator-node-1',
- *   runMigrations: true, // Auto-run migrations on startup
- * });
- * signer.start();
- * ```
+ * Note: Migrations must be run separately using `aztec migrate-ha-db up` before
+ * creating the signer. The factory will verify the schema is initialized via `db.initialize()`.
  *
  * @param config - Configuration for the HA signer
  * @param deps - Optional dependencies (e.g., for testing)
  * @returns An object containing the signer and database instances
  */
 export async function createHASigner(
-  config: CreateHASignerConfig,
+  config: ValidatorHASignerConfig,
   deps?: CreateHASignerDeps,
 ): Promise<{
   signer: ValidatorHASigner;
@@ -60,6 +57,13 @@ export async function createHASigner(
   const { databaseUrl, poolMaxCount, poolMinCount, poolIdleTimeoutMs, poolConnectionTimeoutMs, ...signerConfig } =
     config;
 
+  if (!databaseUrl) {
+    throw new Error('databaseUrl is required for createHASigner');
+  }
+
+  const telemetryClient = deps?.telemetryClient ?? getTelemetryClient();
+  const dateProvider = deps?.dateProvider ?? new DateProvider();
+
   // Create connection pool (or use provided pool)
   let pool: Pool;
   if (!deps?.pool) {
@@ -80,8 +84,88 @@ export async function createHASigner(
   // Verify database schema is initialized and version matches
   await db.initialize();
 
+  // Create metrics
+  const metrics = new HASignerMetrics(telemetryClient, signerConfig.nodeId);
+
   // Create signer
-  const signer = new ValidatorHASigner(db, { ...signerConfig, databaseUrl });
+  const signer = new ValidatorHASigner(db, signerConfig, { metrics, dateProvider });
+
+  return { signer, db };
+}
+
+/**
+ * Create a local (single-node) signing protection signer backed by LMDB.
+ *
+ * This provides double-signing protection for nodes that are NOT running in a
+ * high-availability (multi-node) setup. It prevents a proposer from sending two
+ * proposals for the same slot if the node crashes and restarts mid-proposal.
+ *
+ * When `config.dataDirectory` is set, the protection database is persisted to disk
+ * and survives crashes/restarts. When unset, an ephemeral in-memory store is
+ * used which protects within a single run but not across restarts.
+ *
+ * @param config - Local signer config
+ * @param deps - Optional dependencies (telemetry, date provider).
+ * @returns An object containing the signer and database instances.
+ */
+export async function createLocalSignerWithProtection(
+  config: LocalSignerConfig,
+  deps?: CreateLocalSignerWithProtectionDeps,
+): Promise<{
+  signer: ValidatorHASigner;
+  db: SlashingProtectionDatabase;
+}> {
+  const telemetryClient = deps?.telemetryClient ?? getTelemetryClient();
+  const dateProvider = deps?.dateProvider ?? new DateProvider();
+
+  const kvStore = await createStore('signing-protection', LmdbSlashingProtectionDatabase.SCHEMA_VERSION, {
+    dataDirectory: config.dataDirectory,
+    dataStoreMapSizeKb: config.signingProtectionMapSizeKb ?? config.dataStoreMapSizeKb,
+    l1Contracts: config.l1Contracts,
+  });
+
+  const db = new LmdbSlashingProtectionDatabase(kvStore, dateProvider);
+
+  const signerConfig = {
+    ...config,
+    nodeId: config.nodeId || 'local',
+  };
+
+  const metrics = new HASignerMetrics(telemetryClient, signerConfig.nodeId, 'LocalSigningProtectionMetrics');
+
+  const signer = new ValidatorHASigner(db, signerConfig, { metrics, dateProvider });
 
   return { signer, db };
 }
+
+/**
+ * Create an in-memory LMDB-backed SlashingProtectionDatabase that can be shared across
+ * multiple validator nodes in the same process. Used for testing HA setups.
+ */
+export async function createSharedSlashingProtectionDb(
+  dateProvider: DateProvider = new DateProvider(),
+): Promise<SlashingProtectionDatabase> {
+  const kvStore = await createStore('shared-signing-protection', LmdbSlashingProtectionDatabase.SCHEMA_VERSION, {
+    dataStoreMapSizeKb: 1024 * 1024,
+  });
+  return new LmdbSlashingProtectionDatabase(kvStore, dateProvider);
+}
+
+/**
+ * Create a ValidatorHASigner backed by a pre-existing SlashingProtectionDatabase.
+ * Used for testing HA setups where multiple nodes share the same protection database.
+ */
+export function createSignerFromSharedDb(
+  db: SlashingProtectionDatabase,
+  config: Pick<
+    ValidatorHASignerConfig,
+    'nodeId' | 'pollingIntervalMs' | 'signingTimeoutMs' | 'maxStuckDutiesAgeMs' | 'l1Contracts'
+  >,
+  deps?: CreateLocalSignerWithProtectionDeps,
+): { signer: ValidatorHASigner; db: SlashingProtectionDatabase } {
+  const telemetryClient = deps?.telemetryClient ?? getTelemetryClient();
+  const dateProvider = deps?.dateProvider ?? new DateProvider();
+  const metrics = new HASignerMetrics(telemetryClient, config.nodeId, 'SharedSigningProtectionMetrics');
+  const signer = new ValidatorHASigner(db, config, { metrics, dateProvider });
+  return { signer, db };
+}

package/src/metrics.ts

@@ -0,0 +1,138 @@
+import {
+  Attributes,
+  type Histogram,
+  Metrics,
+  type TelemetryClient,
+  type UpDownCounter,
+  createUpDownCounterWithDefault,
+} from '@aztec/telemetry-client';
+
+export type HACleanupType = 'stuck' | 'old' | 'outdated_rollup';
+
+/**
+ * Metrics for HA signer tracking signing operations, lock acquisition, and cleanup.
+ */
+export class HASignerMetrics {
+  // Signing lifecycle metrics
+  private signingDuration: Histogram;
+  private signingSuccessCount: UpDownCounter;
+  private dutyAlreadySignedCount: UpDownCounter;
+  private slashingProtectionCount: UpDownCounter;
+  private signingErrorCount: UpDownCounter;
+
+  // Lock acquisition metrics
+  private lockAcquiredCount: UpDownCounter;
+
+  // Cleanup metrics
+  private cleanupStuckDutiesCount: UpDownCounter;
+  private cleanupOldDutiesCount: UpDownCounter;
+  private cleanupOutdatedRollupDutiesCount: UpDownCounter;
+
+  constructor(
+    client: TelemetryClient,
+    private nodeId: string,
+    name = 'HASignerMetrics',
+  ) {
+    const meter = client.getMeter(name);
+
+    // Signing lifecycle
+    this.signingDuration = meter.createHistogram(Metrics.HA_SIGNER_SIGNING_DURATION);
+    this.signingSuccessCount = createUpDownCounterWithDefault(meter, Metrics.HA_SIGNER_SIGNING_SUCCESS_COUNT);
+    this.dutyAlreadySignedCount = createUpDownCounterWithDefault(meter, Metrics.HA_SIGNER_DUTY_ALREADY_SIGNED_COUNT);
+    this.slashingProtectionCount = createUpDownCounterWithDefault(meter, Metrics.HA_SIGNER_SLASHING_PROTECTION_COUNT);
+    this.signingErrorCount = createUpDownCounterWithDefault(meter, Metrics.HA_SIGNER_SIGNING_ERROR_COUNT);
+
+    // Lock acquisition
+    this.lockAcquiredCount = createUpDownCounterWithDefault(meter, Metrics.HA_SIGNER_LOCK_ACQUIRED_COUNT);
+
+    // Cleanup
+    this.cleanupStuckDutiesCount = createUpDownCounterWithDefault(meter, Metrics.HA_SIGNER_CLEANUP_STUCK_DUTIES_COUNT);
+    this.cleanupOldDutiesCount = createUpDownCounterWithDefault(meter, Metrics.HA_SIGNER_CLEANUP_OLD_DUTIES_COUNT);
+    this.cleanupOutdatedRollupDutiesCount = createUpDownCounterWithDefault(
+      meter,
+      Metrics.HA_SIGNER_CLEANUP_OUTDATED_ROLLUP_DUTIES_COUNT,
+    );
+  }
+
+  /**
+   * Record a successful signing operation.
+   * @param dutyType - The type of duty signed
+   * @param durationMs - Duration from start of signWithProtection to completion
+   */
+  public recordSigningSuccess(dutyType: string, durationMs: number): void {
+    const attributes = {
+      [Attributes.HA_DUTY_TYPE]: dutyType,
+      [Attributes.HA_NODE_ID]: this.nodeId,
+    };
+    this.signingSuccessCount.add(1, attributes);
+    this.signingDuration.record(durationMs, attributes);
+  }
+
+  /**
+   * Record a DutyAlreadySignedError (expected in HA; another node signed first).
+   * @param dutyType - The type of duty
+   */
+  public recordDutyAlreadySigned(dutyType: string): void {
+    const attributes = {
+      [Attributes.HA_DUTY_TYPE]: dutyType,
+      [Attributes.HA_NODE_ID]: this.nodeId,
+    };
+    this.dutyAlreadySignedCount.add(1, attributes);
+  }
+
+  /**
+   * Record a SlashingProtectionError (attempted to sign different data for same duty).
+   * @param dutyType - The type of duty
+   */
+  public recordSlashingProtection(dutyType: string): void {
+    const attributes = {
+      [Attributes.HA_DUTY_TYPE]: dutyType,
+      [Attributes.HA_NODE_ID]: this.nodeId,
+    };
+    this.slashingProtectionCount.add(1, attributes);
+  }
+
+  /**
+   * Record a signing function failure (lock will be deleted for retry).
+   * @param dutyType - The type of duty
+   */
+  public recordSigningError(dutyType: string): void {
+    const attributes = {
+      [Attributes.HA_DUTY_TYPE]: dutyType,
+      [Attributes.HA_NODE_ID]: this.nodeId,
+    };
+    this.signingErrorCount.add(1, attributes);
+  }
+
+  /**
+   * Record lock acquisition.
+   * @param acquired - Whether a new lock was acquired (true) or existing record found (false)
+   */
+  public recordLockAcquire(acquired: boolean): void {
+    if (acquired) {
+      const attributes = {
+        [Attributes.HA_NODE_ID]: this.nodeId,
+      };
+      this.lockAcquiredCount.add(1, attributes);
+    }
+  }
+
+  /**
+   * Record cleanup metrics.
+   * @param type - Type of cleanup
+   * @param count - Number of duties cleaned up
+   */
+  public recordCleanup(type: HACleanupType, count: number): void {
+    const attributes = {
+      [Attributes.HA_NODE_ID]: this.nodeId,
+    };
+
+    if (type === 'stuck') {
+      this.cleanupStuckDutiesCount.add(count, attributes);
+    } else if (type === 'old') {
+      this.cleanupOldDutiesCount.add(count, attributes);
+    } else if (type === 'outdated_rollup') {
+      this.cleanupOutdatedRollupDutiesCount.add(count, attributes);
+    }
+  }
+}

package/src/migrations.ts

@@ -3,6 +3,7 @@
  */
 import { createLogger } from '@aztec/foundation/log';
 
+import { readdirSync } from 'fs';
 import { runner } from 'node-pg-migrate';
 import { dirname, join } from 'path';
 import { fileURLToPath } from 'url';
@@ -30,17 +31,32 @@ export async function runMigrations(databaseUrl: string, options: RunMigrationsO
 
   const log = createLogger('validator-ha-signer:migrations');
 
+  const migrationsDir = join(__dirname, 'db', 'migrations');
+
   try {
     log.info(`Running migrations ${direction}...`);
 
+    // Filter out .d.ts and .d.ts.map files - node-pg-migrate only needs .js files
+    const migrationFiles = readdirSync(migrationsDir);
+    const jsMigrationFiles = migrationFiles.filter(
+      file => file.endsWith('.js') && !file.endsWith('.d.ts') && !file.endsWith('.d.ts.map'),
+    );
+
+    if (jsMigrationFiles.length === 0) {
+      log.info('No migration files found');
+      return [];
+    }
+
     const appliedMigrations = await runner({
       databaseUrl,
-      dir: join(__dirname, 'db', 'migrations'),
+      dir: migrationsDir,
       direction,
       migrationsTable: 'pgmigrations',
       count: direction === 'down' ? 1 : Infinity,
       verbose,
       log: msg => (verbose ? log.info(msg) : log.debug(msg)),
+      // Ignore TypeScript declaration files - node-pg-migrate will try to import them otherwise
+      ignorePattern: '.*\\.d\\.(ts|js)$|.*\\.d\\.ts\\.map$',
     });
 
     if (appliedMigrations.length === 0) {