@bevel-software/platform-core-backend 0.14.0 → 0.19.0

package/dist/modules/database/advisory-lock.d.ts

@@ -0,0 +1,103 @@
+import type { Database } from './connection.js';
+/**
+ * The locks this application takes, one constant per concern. A new entry is a
+ * new claim that two processes must not do something simultaneously, so it
+ * belongs here beside the others rather than as a number at a call site.
+ */
+export declare const AdvisoryLock: {
+    /**
+     * Serializes every schema migration across processes — core's and a
+     * distribution's alike, under ONE lock: the enterprise migrations reference
+     * core's tables, so two boots overlapping with one lock each could still
+     * run core's DDL while the other ran enterprise's over it.
+     */
+    readonly Migrations: 1;
+    /**
+     * Held by the ONE process allowed to drain the commit queue — see
+     * {@link AdvisoryLease}. Row-level `SKIP LOCKED` already stops two workers
+     * claiming the same row; it does nothing about two workers running git in
+     * the same working tree on a shared volume, which is what this excludes.
+     */
+    readonly CommitWorker: 3;
+};
+export type AdvisoryLockId = (typeof AdvisoryLock)[keyof typeof AdvisoryLock];
+/** A statement the database did not answer in time: the connection is presumed wedged. */
+export declare class WireTimeoutError extends Error {
+    constructor(message: string);
+}
+/**
+ * Run `fn` while holding the advisory lock `lock`, waiting up to `waitMs` for
+ * it. The lock is released however `fn` ends, and the connection carrying it
+ * goes back to the pool in the state it arrived in.
+ *
+ * Throws without running `fn` when the lock cannot be taken in time — the
+ * caller is expected to let that fail the boot.
+ */
+export declare function withAdvisoryLock<T>(db: Database, lock: AdvisoryLockId, fn: () => Promise<T>, opts?: {
+    waitMs?: number;
+}): Promise<T>;
+/** The slice of a `pg.Client` the lease uses — so a suite can hand in a double. */
+export interface LeaseClient {
+    query(text: string, values?: unknown[]): Promise<{
+        rows: Array<Record<string, unknown>>;
+    }>;
+    end(): Promise<void>;
+    on(event: 'error' | 'end', listener: (...args: unknown[]) => void): unknown;
+}
+export interface AdvisoryLeaseOptions {
+    /** How the lease opens its connection. Default: a `pg.Client` on the pool's connection string. */
+    connect?: () => Promise<LeaseClient>;
+    /** Bound on the connect and on each query, so an unreachable or half-dead database fails rather than waits. Default 10s. */
+    connectTimeoutMs?: number;
+}
+/**
+ * A SESSION-scoped advisory lock held for as long as this process wants it:
+ * the singleton lease. `tryAcquire` never waits — it answers whether this
+ * process is the holder — and the lock lives on a connection of its own for
+ * the process's lifetime, released by {@link release} or by that connection
+ * ending, however it ends.
+ *
+ * WHY ITS OWN CONNECTION, AND WHY THAT IS FINE. A session lock belongs to the
+ * connection that took it, so it cannot ride the pool (see the transaction
+ * form above for what goes wrong when it does). This connection is therefore
+ * opened once and kept, which is the one shape of resource the closing-owner
+ * rule exempts when it is said out loud: its lifetime is intentionally the
+ * process's. The owner that closes it is the shutdown sequence, through
+ * `release`, and if the process dies without one the session dies with it
+ * and Postgres releases the lock — which is exactly how the NEXT process gets
+ * to take it.
+ *
+ * LOSS IS A FIRST-CLASS EVENT. A connection can drop (a database restart, a
+ * network blip) while this process believes it holds the lease; from that
+ * moment another process may hold it too. So the lease watches its connection
+ * and tells its listeners the instant the holding session is gone, and
+ * `held` flips false before any of them run — a holder that keeps working
+ * after that call is the double-worker case this exists to prevent.
+ */
+export declare class AdvisoryLease {
+    private readonly db;
+    private readonly lock;
+    private readonly opts;
+    private client;
+    private heldFlag;
+    private readonly lostListeners;
+    constructor(db: Database, lock: AdvisoryLockId, opts?: AdvisoryLeaseOptions);
+    /** Whether this process holds the lease right now. */
+    get held(): boolean;
+    /** Called when the holding connection ends without {@link release} — the lease is gone. */
+    onLost(listener: () => void): void;
+    /**
+     * Take the lease if nobody holds it. Returns at once either way: `true` and
+     * this process is the holder from now on; `false` and nothing is held or
+     * kept open.
+     */
+    tryAcquire(): Promise<boolean>;
+    /**
+     * Give the lease up and close its connection. Idempotent, and safe to call
+     * on a lease that was never taken or has already been lost.
+     */
+    release(): Promise<void>;
+    private markLost;
+    private readonly defaultConnect;
+}
+//# sourceMappingURL=advisory-lock.d.ts.map

package/dist/modules/database/advisory-lock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"advisory-lock.d.ts","sourceRoot":"","sources":["../../../src/modules/database/advisory-lock.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AA6DhD;;;;GAIG;AACH,eAAO,MAAM,YAAY;IACvB;;;;;OAKG;;IAEH;;;;;OAKG;;CAEK,CAAC;AAEX,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,CAAC;AAgB9E,0FAA0F;AAC1F,qBAAa,gBAAiB,SAAQ,KAAK;gBAC7B,OAAO,EAAE,MAAM;CAI5B;AAsBD;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CAAC,CAAC,EACtC,EAAE,EAAE,QAAQ,EACZ,IAAI,EAAE,cAAc,EACpB,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EACpB,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAO,GAC7B,OAAO,CAAC,CAAC,CAAC,CAkEZ;AAED,mFAAmF;AACnF,MAAM,WAAW,WAAW;IAC1B,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;KAAE,CAAC,CAAC;IAC3F,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACrB,EAAE,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,GAAG,OAAO,CAAC;CAC7E;AAED,MAAM,WAAW,oBAAoB;IACnC,kGAAkG;IAClG,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC,WAAW,CAAC,CAAC;IACrC,4HAA4H;IAC5H,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,qBAAa,aAAa;IAMtB,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAPvB,OAAO,CAAC,MAAM,CAA4B;IAC1C,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAyB;gBAGpC,EAAE,EAAE,QAAQ,EACZ,IAAI,EAAE,cAAc,EACpB,IAAI,GAAE,oBAAyB;IAGlD,sDAAsD;IACtD,IAAI,IAAI,IAAI,OAAO,CAElB;IAED,2FAA2F;IAC3F,MAAM,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,IAAI;IAIlC;;;;OAIG;IACG,UAAU,IAAI,OAAO,CAAC,OAAO,CAAC;IAkCpC;;;OAGG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAc9B,OAAO,CAAC,QAAQ;IAOhB,OAAO,CAAC,QAAQ,CAAC,cAAc,CAY7B;CACH"}

package/dist/modules/database/advisory-lock.js

@@ -0,0 +1,320 @@
+import pg from 'pg';
+/**
+ * Postgres advisory locks — the one mechanism by which two Hexis processes
+ * agree that only one of them may do a thing at a time.
+ *
+ * WHY THIS EXISTS. Hexis is single-replica by design (see the notes in
+ * `event-bus.ts` and `pending-commits.worker.ts`), but
+ * nothing enforces it, and the deployment topology guarantees an overlap on
+ * every redeploy: the reverse-proxy deployments this project targets start the
+ * replacement container while the outgoing one is still running — which is
+ * exactly why `docker-compose.yml` publishes no fixed host port. For the
+ * length of that window two processes share one database and one set of
+ * volumes.
+ *
+ * Drizzle's Postgres migrator takes no lock of its own. It reads the newest
+ * applied migration, then opens a transaction and applies everything newer, so
+ * two boots read the same watermark and both apply. With an unguarded
+ * migration (0002 onward are plain DDL) the second boot fails on an
+ * already-applied `ALTER TABLE` and the container crash-loops; with a guarded
+ * one it instead writes a second ledger row for the same migration. A lock
+ * around the runner removes both outcomes, which is what every migration tool
+ * that is not drizzle does.
+ *
+ * WHY A TRANSACTION RATHER THAN A SESSION LOCK. `pg_advisory_lock` is
+ * session-scoped: it belongs to the connection that took it and is released by
+ * `pg_advisory_unlock` or by the session ending. Taken through the pool that is
+ * a trap — the connection carrying the lock returns to the pool still holding
+ * it, and the unlock may run on whichever connection the pool hands out next.
+ * `pg_advisory_xact_lock` is held until the transaction ends, so the `rollback`
+ * below releases it whatever happened inside, and a connection that dies
+ * releases it by dying. The same `rollback` reverts the transaction-local
+ * `lock_timeout`, so nothing about this connection is different when it goes
+ * back to the pool.
+ *
+ * The lock is held on its OWN connection while `fn` runs on others. That is
+ * deliberate and sufficient: the lock excludes other PROCESSES, and it does not
+ * need to be the connection doing the work.
+ *
+ * WHY IT DOES NOT WAIT FOREVER. A boot blocked indefinitely behind a wedged
+ * lock holder is worse than a boot that fails: the container's restart policy
+ * is a working retry, and a failed boot is visible. `lock_timeout` bounds the
+ * wait and surfaces a named error.
+ *
+ * The one caveat worth knowing: the lock connection sits idle in a transaction
+ * for as long as `fn` runs. A server configured with
+ * `idle_in_transaction_session_timeout` shorter than a migration run would kill
+ * it and drop the lock. The default is disabled, and migrations here run in
+ * seconds.
+ */
+/**
+ * The first argument to every `pg_advisory_*` call below: a namespace shared by
+ * every lock this application takes, so that an advisory lock belonging to
+ * something else on the same database cannot collide with one of ours by
+ * choosing the same number. `HEXI` read as ASCII bytes — stable, inside
+ * `int4`, and recognisable in `pg_locks` when someone is working out who holds
+ * what.
+ */
+const LOCK_NAMESPACE = 0x48455849;
+/**
+ * The locks this application takes, one constant per concern. A new entry is a
+ * new claim that two processes must not do something simultaneously, so it
+ * belongs here beside the others rather than as a number at a call site.
+ */
+export const AdvisoryLock = {
+    /**
+     * Serializes every schema migration across processes — core's and a
+     * distribution's alike, under ONE lock: the enterprise migrations reference
+     * core's tables, so two boots overlapping with one lock each could still
+     * run core's DDL while the other ran enterprise's over it.
+     */
+    Migrations: 1,
+    /**
+     * Held by the ONE process allowed to drain the commit queue — see
+     * {@link AdvisoryLease}. Row-level `SKIP LOCKED` already stops two workers
+     * claiming the same row; it does nothing about two workers running git in
+     * the same working tree on a shared volume, which is what this excludes.
+     */
+    CommitWorker: 3,
+};
+/** How long to wait for the lock before giving up and failing the boot. */
+const DEFAULT_WAIT_MS = 60_000;
+/** Postgres raises this when `lock_timeout` expires while waiting for a lock. */
+const LOCK_NOT_AVAILABLE = '55P03';
+function isLockTimeout(err) {
+    return (typeof err === 'object' &&
+        err !== null &&
+        err.code === LOCK_NOT_AVAILABLE);
+}
+/** A statement the database did not answer in time: the connection is presumed wedged. */
+export class WireTimeoutError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'WireTimeoutError';
+    }
+}
+/** `work`, or a {@link WireTimeoutError} naming `what` once `ms` have passed without an answer. */
+async function bounded(work, ms, what) {
+    let timer;
+    const deadline = new Promise((_, reject) => {
+        timer = setTimeout(() => reject(new WireTimeoutError(`Timed out after ${ms}ms ${what} — the database did not answer.`)), ms);
+        timer.unref?.();
+    });
+    try {
+        return await Promise.race([work, deadline]);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/** The name of a lock, for an error message a human has to act on. */
+function lockName(lock) {
+    const entry = Object.entries(AdvisoryLock).find(([, value]) => value === lock);
+    return entry ? entry[0] : String(lock);
+}
+/**
+ * Run `fn` while holding the advisory lock `lock`, waiting up to `waitMs` for
+ * it. The lock is released however `fn` ends, and the connection carrying it
+ * goes back to the pool in the state it arrived in.
+ *
+ * Throws without running `fn` when the lock cannot be taken in time — the
+ * caller is expected to let that fail the boot.
+ */
+export async function withAdvisoryLock(db, lock, fn, opts = {}) {
+    const waitMs = opts.waitMs ?? DEFAULT_WAIT_MS;
+    const client = await db.$client.connect();
+    // A statement that did not answer in time is STILL RUNNING on this
+    // connection — `bounded` gives up waiting, it cannot take the statement
+    // back — and every later statement on it, the rollback included, queues
+    // behind it. So a connection that wedged is remembered here and destroyed
+    // in the `finally` instead of being rolled back: ending its session is
+    // what releases whatever it held, and nothing waits on it again.
+    let wedged = null;
+    const onWire = async (work, what) => {
+        try {
+            return await bounded(work, waitMs, what);
+        }
+        catch (err) {
+            if (err instanceof WireTimeoutError)
+                wedged = err;
+            throw err;
+        }
+    };
+    try {
+        // `lock_timeout` bounds the wait for the lock, once it is set. The two
+        // statements before it run on a connection that may be half-dead — the
+        // socket open, the server gone — and would otherwise wait forever, with
+        // the boot behind them. So they carry a deadline of their own, and a
+        // connection that cannot answer them fails the boot as loudly as one that
+        // cannot take the lock.
+        await onWire(client.query('begin'), 'beginning the lock transaction');
+        try {
+            // `set_config` rather than `SET LOCAL`, which cannot take a bind
+            // parameter. `true` makes the setting transaction-local, so the
+            // `rollback` below reverts it.
+            await onWire(client.query("select set_config('lock_timeout', $1, true)", [String(waitMs)]), 'setting lock_timeout');
+            await client.query('select pg_advisory_xact_lock($1, $2)', [LOCK_NAMESPACE, lock]);
+        }
+        catch (err) {
+            if (isLockTimeout(err)) {
+                throw new Error(`Timed out after ${waitMs}ms waiting for the ${lockName(lock)} advisory lock. ` +
+                    'Another process is holding it — usually the outgoing container of a redeploy, ' +
+                    'in which case starting again succeeds once it exits.', { cause: err });
+            }
+            throw err;
+        }
+        return await fn();
+    }
+    finally {
+        if (wedged) {
+            // Not rolled back: a rollback would queue behind the statement that
+            // never answered, and the boot would hang on it after all. Destroyed
+            // — `release(err)` ends the session — which is what lets go of
+            // whatever the connection held.
+            client.release(wedged);
+        }
+        else {
+            // Ends the transaction, which releases the lock and reverts
+            // `lock_timeout`. A connection that cannot be rolled back is destroyed
+            // rather than returned to the pool: ending its session is what releases
+            // the lock, and a connection in an unknown transaction state is no use
+            // to anyone else.
+            let rollbackError;
+            try {
+                await client.query('rollback');
+            }
+            catch (err) {
+                rollbackError = err instanceof Error ? err : new Error(String(err));
+            }
+            client.release(rollbackError);
+        }
+    }
+}
+/**
+ * A SESSION-scoped advisory lock held for as long as this process wants it:
+ * the singleton lease. `tryAcquire` never waits — it answers whether this
+ * process is the holder — and the lock lives on a connection of its own for
+ * the process's lifetime, released by {@link release} or by that connection
+ * ending, however it ends.
+ *
+ * WHY ITS OWN CONNECTION, AND WHY THAT IS FINE. A session lock belongs to the
+ * connection that took it, so it cannot ride the pool (see the transaction
+ * form above for what goes wrong when it does). This connection is therefore
+ * opened once and kept, which is the one shape of resource the closing-owner
+ * rule exempts when it is said out loud: its lifetime is intentionally the
+ * process's. The owner that closes it is the shutdown sequence, through
+ * `release`, and if the process dies without one the session dies with it
+ * and Postgres releases the lock — which is exactly how the NEXT process gets
+ * to take it.
+ *
+ * LOSS IS A FIRST-CLASS EVENT. A connection can drop (a database restart, a
+ * network blip) while this process believes it holds the lease; from that
+ * moment another process may hold it too. So the lease watches its connection
+ * and tells its listeners the instant the holding session is gone, and
+ * `held` flips false before any of them run — a holder that keeps working
+ * after that call is the double-worker case this exists to prevent.
+ */
+export class AdvisoryLease {
+    db;
+    lock;
+    opts;
+    client = null;
+    heldFlag = false;
+    lostListeners = [];
+    constructor(db, lock, opts = {}) {
+        this.db = db;
+        this.lock = lock;
+        this.opts = opts;
+    }
+    /** Whether this process holds the lease right now. */
+    get held() {
+        return this.heldFlag;
+    }
+    /** Called when the holding connection ends without {@link release} — the lease is gone. */
+    onLost(listener) {
+        this.lostListeners.push(listener);
+    }
+    /**
+     * Take the lease if nobody holds it. Returns at once either way: `true` and
+     * this process is the holder from now on; `false` and nothing is held or
+     * kept open.
+     */
+    async tryAcquire() {
+        if (this.heldFlag)
+            return true;
+        const client = await (this.opts.connect ?? this.defaultConnect)();
+        // Watched BEFORE the lock is asked for — a `pg.Client` throws an 'error'
+        // with no listener at the process — and bound to THIS client: a loss is
+        // only a loss while this is the connection the lease is held on. Before
+        // the grant below the client is not that connection, so a drop during
+        // the query surfaces as the query's own rejection and nothing is marked
+        // held; after a release or a later reacquisition it is not that
+        // connection either, so a stale client's delayed 'end' cannot clear a
+        // lease held on a healthy one.
+        const lost = () => {
+            if (this.client === client)
+                this.markLost();
+        };
+        client.on('error', lost);
+        client.on('end', lost);
+        try {
+            const { rows } = await client.query('select pg_try_advisory_lock($1, $2) as held', [
+                LOCK_NAMESPACE,
+                this.lock,
+            ]);
+            if (rows[0]?.held !== true) {
+                await client.end().catch(() => undefined);
+                return false;
+            }
+            this.client = client;
+            this.heldFlag = true;
+            return true;
+        }
+        catch (err) {
+            await client.end().catch(() => undefined);
+            throw err;
+        }
+    }
+    /**
+     * Give the lease up and close its connection. Idempotent, and safe to call
+     * on a lease that was never taken or has already been lost.
+     */
+    async release() {
+        const client = this.client;
+        this.client = null;
+        this.heldFlag = false;
+        if (!client)
+            return;
+        try {
+            await client.query('select pg_advisory_unlock($1, $2)', [LOCK_NAMESPACE, this.lock]);
+        }
+        catch {
+            // Ending the session below releases the lock regardless.
+        }
+        finally {
+            await client.end().catch(() => undefined);
+        }
+    }
+    markLost() {
+        if (!this.heldFlag)
+            return;
+        this.heldFlag = false;
+        this.client = null;
+        for (const listener of this.lostListeners)
+            listener();
+    }
+    defaultConnect = async () => {
+        const timeout = this.opts.connectTimeoutMs ?? 10_000;
+        const client = new pg.Client({
+            connectionString: this.db.$client.options.connectionString,
+            connectionTimeoutMillis: timeout,
+            // The same bound on each query: a connection that opened and then went
+            // half-dead would otherwise hold `tryAcquire` open indefinitely, and
+            // with it the loop that should be asking again in five seconds.
+            query_timeout: timeout,
+        });
+        await client.connect();
+        return client;
+    };
+}
+//# sourceMappingURL=advisory-lock.js.map

package/dist/modules/database/advisory-lock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"advisory-lock.js","sourceRoot":"","sources":["../../../src/modules/database/advisory-lock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AAGpB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAEH;;;;;;;GAOG;AACH,MAAM,cAAc,GAAG,UAAU,CAAC;AAElC;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B;;;;;OAKG;IACH,UAAU,EAAE,CAAC;IACb;;;;;OAKG;IACH,YAAY,EAAE,CAAC;CACP,CAAC;AAIX,2EAA2E;AAC3E,MAAM,eAAe,GAAG,MAAM,CAAC;AAE/B,iFAAiF;AACjF,MAAM,kBAAkB,GAAG,OAAO,CAAC;AAEnC,SAAS,aAAa,CAAC,GAAY;IACjC,OAAO,CACL,OAAO,GAAG,KAAK,QAAQ;QACvB,GAAG,KAAK,IAAI;QACX,GAA0B,CAAC,IAAI,KAAK,kBAAkB,CACxD,CAAC;AACJ,CAAC;AAED,0FAA0F;AAC1F,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACzC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED,mGAAmG;AACnG,KAAK,UAAU,OAAO,CAAI,IAAgB,EAAE,EAAU,EAAE,IAAY;IAClE,IAAI,KAAgD,CAAC;IACrD,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;QAChD,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,gBAAgB,CAAC,mBAAmB,EAAE,MAAM,IAAI,iCAAiC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7H,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;IACH,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC9C,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED,sEAAsE;AACtE,SAAS,QAAQ,CAAC,IAAoB;IACpC,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC;IAC/E,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,EAAY,EACZ,IAAoB,EACpB,EAAoB,EACpB,OAA4B,EAAE;IAE9B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,eAAe,CAAC;IAC9C,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;IAC1C,mEAAmE;IACnE,wEAAwE;IACxE,wEAAwE;IACxE,0EAA0E;IAC1E,uEAAuE;IACvE,iEAAiE;IACjE,IAAI,MAAM,GAAiB,IAAI,CAAC;IAChC,MAAM,MAAM,GAAG,KAAK,EAAK,IAAgB,EAAE,IAAY,EAAc,EAAE;QACrE,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,gBAAgB;gBAAE,MAAM,GAAG,GAAG,CAAC;YAClD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;IACF,IAAI,CAAC;QACH,uEAAuE;QACvE,uEAAuE;QACvE,wEAAwE;QACxE,qEAAqE;QACrE,0EAA0E;QAC1E,wBAAwB;QACxB,MAAM,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,gCAAgC,CAAC,CAAC;QACtE,IAAI,CAAC;YACH,iEAAiE;YACjE,gEAAgE;YAChE,+BAA+B;YAC/B,MAAM,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,6CAA6C,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAC;YACpH,MAAM,MAAM,CAAC,KAAK,CAAC,sCAAsC,EAAE,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC,CAAC;QACrF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CACb,mBAAmB,MAAM,sBAAsB,QAAQ,CAAC,IAAI,CAAC,kBAAkB;oBAC7E,gFAAgF;oBAChF,sDAAsD,EACxD,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,OAAO,MAAM,EAAE,EAAE,CAAC;IACpB,CAAC;YAAS,CAAC;QACT,IAAI,MAAM,EAAE,CAAC;YACX,oEAAoE;YACpE,qEAAqE;YACrE,+DAA+D;YAC/D,gCAAgC;YAChC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACzB,CAAC;aAAM,CAAC;YACN,4DAA4D;YAC5D,uEAAuE;YACvE,wEAAwE;YACxE,uEAAuE;YACvE,kBAAkB;YAClB,IAAI,aAAgC,CAAC;YACrC,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACjC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,aAAa,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;AACH,CAAC;AAgBD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,OAAO,aAAa;IAML;IACA;IACA;IAPX,MAAM,GAAuB,IAAI,CAAC;IAClC,QAAQ,GAAG,KAAK,CAAC;IACR,aAAa,GAAsB,EAAE,CAAC;IAEvD,YACmB,EAAY,EACZ,IAAoB,EACpB,OAA6B,EAAE;QAF/B,OAAE,GAAF,EAAE,CAAU;QACZ,SAAI,GAAJ,IAAI,CAAgB;QACpB,SAAI,GAAJ,IAAI,CAA2B;IAC/C,CAAC;IAEJ,sDAAsD;IACtD,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED,2FAA2F;IAC3F,MAAM,CAAC,QAAoB;QACzB,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,UAAU;QACd,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC/B,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;QAClE,yEAAyE;QACzE,wEAAwE;QACxE,wEAAwE;QACxE,sEAAsE;QACtE,wEAAwE;QACxE,gEAAgE;QAChE,sEAAsE;QACtE,+BAA+B;QAC/B,MAAM,IAAI,GAAG,GAAG,EAAE;YAChB,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM;gBAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC9C,CAAC,CAAC;QACF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACzB,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,6CAA6C,EAAE;gBACjF,cAAc;gBACd,IAAI,CAAC,IAAI;aACV,CAAC,CAAC;YACH,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,KAAK,IAAI,EAAE,CAAC;gBAC3B,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAC1C,OAAO,KAAK,CAAC;YACf,CAAC;YACD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;YACrB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;YACrB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC1C,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAO;QACX,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;QACtB,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,KAAK,CAAC,mCAAmC,EAAE,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACvF,CAAC;QAAC,MAAM,CAAC;YACP,yDAAyD;QAC3D,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAEO,QAAQ;QACd,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,OAAO;QAC3B,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;QACtB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,aAAa;YAAE,QAAQ,EAAE,CAAC;IACxD,CAAC;IAEgB,cAAc,GAAG,KAAK,IAA0B,EAAE;QACjE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,gBAAgB,IAAI,MAAM,CAAC;QACrD,MAAM,MAAM,GAAG,IAAI,EAAE,CAAC,MAAM,CAAC;YAC3B,gBAAgB,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,gBAAgB;YAC1D,uBAAuB,EAAE,OAAO;YAChC,uEAAuE;YACvE,qEAAqE;YACrE,gEAAgE;YAChE,aAAa,EAAE,OAAO;SACvB,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;QACvB,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;CACH"}

package/dist/modules/database/connection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connection.d.ts","sourceRoot":"","sources":["../../../src/modules/database/connection.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AAItC,wBAAgB,KAAK,CAAC,WAAW,EAAE,MAAM;;EAMxC;AAED,MAAM,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,KAAK,CAAC,CAAC"}
+{"version":3,"file":"connection.d.ts","sourceRoot":"","sources":["../../../src/modules/database/connection.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AAItC,wBAAgB,KAAK,CAAC,WAAW,EAAE,MAAM;;EAcxC;AAED,MAAM,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,KAAK,CAAC,CAAC"}

package/dist/modules/database/connection.js

@@ -4,7 +4,15 @@ import * as schema from './schema.js';
 let db = null;
 export function getDb(databaseUrl) {
     if (!db) {
-        const pool = new pg.Pool({ connectionString: databaseUrl });
+        // A bounded handshake: `pg` waits forever by default for a NEW connection
+        // to come up, so a database that accepts the socket and never finishes
+        // the handshake would hold a boot (the migration lock is the first thing
+        // that asks) with nothing to say and nothing for the restart policy to
+        // see. Half a minute is generous for a handshake and short enough for a
+        // failed boot to be visible. It bounds only that: a checkout queued
+        // behind a saturated pool, or a query on a connection that stopped
+        // answering, is the caller's to bound — the advisory lock does.
+        const pool = new pg.Pool({ connectionString: databaseUrl, connectionTimeoutMillis: 30_000 });
         db = drizzle(pool, { schema });
     }
     return db;

package/dist/modules/database/connection.js.map

@@ -1 +1 @@
-{"version":3,"file":"connection.js","sourceRoot":"","sources":["../../../src/modules/database/connection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,2BAA2B,CAAC;AACpD,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AAEtC,IAAI,EAAE,GAAqD,IAAI,CAAC;AAEhE,MAAM,UAAU,KAAK,CAAC,WAAmB;IACvC,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,IAAI,GAAG,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,gBAAgB,EAAE,WAAW,EAAE,CAAC,CAAC;QAC5D,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC"}
+{"version":3,"file":"connection.js","sourceRoot":"","sources":["../../../src/modules/database/connection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,2BAA2B,CAAC;AACpD,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AAEtC,IAAI,EAAE,GAAqD,IAAI,CAAC;AAEhE,MAAM,UAAU,KAAK,CAAC,WAAmB;IACvC,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,0EAA0E;QAC1E,uEAAuE;QACvE,yEAAyE;QACzE,uEAAuE;QACvE,wEAAwE;QACxE,oEAAoE;QACpE,mEAAmE;QACnE,gEAAgE;QAChE,MAAM,IAAI,GAAG,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,gBAAgB,EAAE,WAAW,EAAE,uBAAuB,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7F,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC"}